Chatto

v0.4.8 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 14d Communication & Email

✓ No known CVEs patched

This release patches 2 known CVEs

Topics

chat communication gdpr-compliant privacy-first screensharing video-calls

+1 more

voice-calls

Affected surfaces

auth crypto_tls

Summary

AI summary

Updates Bug Fixes, 0.4.8, and 2026-07-12 across a mixed release.

Full changelog

api: bound message attachment asset IDs (#1458) (f22b343)
auth: keep provider redirects credential-free (#1437) (e9c5ebf)
auth: preserve sessions during storage outages (#1431) (3442f8a)
auth: throttle password reset requests (#1441) (67dd1dc)
backup: harden archive creation and restore (#1435) (d07672c)
cli: require explicit passphrase sources (#1451) (6b8b24e)
frontend: embed main build version (#1463) (21a20a8)
frontend: label deleted users consistently (#1452) (8e04235)
release: publish sortable main image tags (030db55)
security: harden realtime auth and request handling (#1433) (75c5a24)
security: require explicit proxy trust (#1447) (234862f)
tls: secure autocert cache permissions (#1461) (cef9d29)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Chatto

Get notified when new releases ship.

About Chatto

Chat app for teams and communities