Fix memory leak — HttpResponseMessage objects never disposed in ApiClient, leaking TCP connections and content buffers on every API call (especially on failed connection attempts)
Fix 401 retry leak — AuthenticatedGetAsync/AuthenticatedRequestAsync leaked the original response when retrying after token refresh
Fix connection failure cleanup — ConnectionManager.ConnectAsync now properly disposes ApiClient and EchoHubConnection on any failure path (previously only cleaned up on saved-token auth failures)
Fix IRC gateway sending UTF-8 BOM on first message, breaking CAP negotiation and SASL auth for all clients
Handle AUTHENTICATE * (SASL abort) instead of crashing on invalid base64
Fix userlist not refreshing when creating a new channel — now fetches online users after channel creation
Fix unmute timer not working — add MuteExpirationService background job that proactively unmutes users when their timed mute expires (previously only checked on message send)
Fix missing space between mod/admin role icon and username in the userlist
Fix invisible users still visible in the userlist — GetOnlineUsersAsync now filters invisible users; server skips UserJoined broadcast for invisible users
Fix invisible→online transition — user reappears in cached userlist when switching from invisible back to a visible status
Fix thread safety — _channelUsers presence cache now protected by Lock to prevent races between SignalR events and background fetches
Fix @mention regex matching email addresses and #channel regex matching hex colors / issue numbers — both now use lookbehind and letter-requirement guards
Fix ParseThemeColor accepting non-hex characters — now validates [0-9a-fA-F] digits
Fix ghost channel when trying to join a channel that doesn't exist
New Features
Add Docker support for EchoHub.Server — docker compose up -d for easy self-hosting with persistent volume for database, uploads, and logs
IRC account creation — connecting with a new username auto-registers the account (PASS and SASL PLAIN)
Auto-updater rollback — pre-update backup created automatically before each update; restore via File > Rollback menu or --rollback CLI flag
Update failure recovery — if an update fails mid-extraction, offers to restore from the backup immediately
Defensive Unix permission check — verify execute permission on startup after auto-update (defense-in-depth)
Clickable usernames — press Enter on a username in the userlist or message sender to view their profile
Clickable @mentions — press Enter on a message containing @username to open that user's profile
Clickable #channels — press Enter on a message containing #channel to join/switch to that channel; #channel references are now highlighted in chat
Embed theme colors — embed vertical border line now uses the source site's theme-color meta tag when available
Stateful userlist — user presence is cached per channel and updated incrementally via SignalR events instead of re-fetching the full list on every join/leave/status change
Security
Restrict file auto-open — only safe file types (video, PDF, text) are opened with the system default app; all other files are downloaded to temp without executing (prevents script execution via .bat, .exe, etc.)
Refactoring
Extract IUserService/UserService — consolidate user registration, authentication, and profile management into a dedicated service, eliminating duplicated logic between AuthController and ChatService
IRC gateway now checks ban status during authentication (previously skipped)
EchoHubSpace directory updates — server now only sends user count when it actually changes instead of every 30 seconds
ChatHub.JoinChannel now returns JoinChannelResult instead of List<MessageDto> to allow for better error handling
Distribution
Add Chocolatey package — choco install echohub for Windows users, auto-published from CI on each release
Add Linux/macOS install script — curl -sSfL .../install.sh | sh with automatic OS/arch detection
Documentation
Add Flows section — Mermaid sequence diagrams documenting all major request/event flows (auth, connection, messaging, channels, moderation, file upload, link embeds, server directory) with inline code references
CI
Add Docker workflow — builds and pushes multi-arch (amd64/arm64) server image to GHCR on release
Add linux-arm64 builds to release pipeline — server and client binaries for ARM Linux (Raspberry Pi, cloud ARM instances)