Nostr ecosystem directory

Release notes say kind 30078 backups now use a dedicated HKDF-derived key outside the NIP-44 derive-key namespace, so apps with remembered nip44_decrypt permission cannot read backup payloads containing per-app NIP-46 secrets and local keys. Legacy restore remains available until a later publish overwrites the old backup.

The published release includes BOLT12 offers in profile payments and the zap picker with BOLT11 fallback on refused offers, plus a personal Health Connect dashboard. Downloadable Android and desktop artifacts are attached; feature behavior was not independently tested.

Release notes say profile fetches and startup callbacks could contact relays directly before the Tor setting finished loading. The same release bounds Tor bootstrap retries and restores relay connections when the daemon returns. No exploitation claim is made.

The release diff adds FiltersCounter.CountEventsFilters for multiple filters. Exact union counting depends on the storage backend implementing that interface; older backends still sum individual counts.

• Release diff

Release notes describe handling permissions without a kind field and returning request IDs with rejected signer requests so callers can match responses.

The merged diff says limit: 0 MUST skip stored events, still send EOSE after initial queries, and keep the subscription active for newly received matching events.

Release notes state that local signer requests with a mismatched signing identity are rejected and incoming Nostr Wallet Connect requests receive authentication hardening before processing. No exploitation claim is made.

The merged text covers both kinds 78 and 30078: relays SHOULD require NIP-42 AUTH before accepting or serving them and SHOULD serve them only to the authenticated author. A specification change does not establish deployed enforcement.

The merged diff permits NIP-73 i tags for structured sources and r tags containing URLs or text. It also changes quote-highlight rendering from MUST to SHOULD.

The merged NIP-42 and NIP-67 changes allow an auth hint when authentication may reveal additional results; the relay MUST send its AUTH challenge before the hinted EOSE.

Release notes add individual permission pre-approval under manual approval policy, a prompt for NIP-46 connections while the kill switch is enabled, and biometric authentication before changing the biometrics setting.

Following the August 26 merge, the August 27 commit changes the payto tag to type and address, marks the NIP draft and optional, and allows network-specific URI schemes with payto as fallback. This summary follows the revision, not the superseded initial instructions.

• Initial merge

The tagged changelog lists a WebSocket fragment memory DoS fix, a reused negentropy subscription ID crash fix and a reconnect fix. Date is the tagged commit date; the release API returns 404 and lightweight-tag creation time was not established.

Date basis: Tagged commit; a commit date, not a verified release date.

• Tag reference
• Tagged commit dated August 27
• WebSocket fragment buffer fix

Release notes describe choosing followed people, Web of Trust or selected relays for Divine, Photos and Yaks discovery, an On/Off Web of Trust control, and hiding out-of-network replies in nested threads. Behavior was not independently tested.

Maintainer release notes describe moving kind 30078 backups to a dedicated HKDF-derived key outside NIP-44 app permissions. This is classified as hardening; the source does not report observed exploitation.

Coverage: Current

Maintainer release notes state that startup network activity could reach relays directly before the Tor preference loaded. This is a documented privacy fix, not evidence of an exploited incident.

Coverage: Current

Maintainer release notes report identity-mismatch rejection and authentication hardening. They do not establish a compromised account, stolen funds or exploitation.

Coverage: Current

Protocol guidance uses SHOULD for authentication and owner-only serving of kinds 78 and 30078. This is neither an incident report nor proof that a relay enforces the guidance.

Coverage: Current

Release notes describe biometric authentication before toggling the biometrics setting. Listed as hardening, with no claim of observed exploitation.

Coverage: Current

Tagged changelog identifies the vulnerability fix; the upstream diff adds a check on accumulated WebSocket fragment-buffer size. Reviewed sources do not establish exploitation or a victim incident.

Coverage: Current

Date basis: Tagged commit; a commit date, not a verified release date.

• Tag reference
• Tagged commit dated August 27
• WebSocket fragment buffer fix

Four published advisories cover relay-auth authorization, NIP-46 replay protection, plaintext connection-secret storage and defense-in-depth items. Advisory ranges identify versions <= 6.4.0; patched_versions fields are null. Version 6.5.0 release notes explicitly list corresponding fixes. These are disclosures and reported fixes, not confirmed exploited incidents.

Coverage: Baseline

• Relay-auth authorization advisory
• Replay protection advisory
• Connection-secret storage advisory
• Defense-in-depth advisory