This will be the last release to support Node.js 0.10 and 0.12.

Improved

• Added some basic styles to the LibreJS info page (#1353)
• Minor UX improvements to the web UI (#1355, #1354)
• Expanded the list of disallowed nicknames and warn about them in the web UI (#1345, #1347)
• Pull our fork of connect-auth from npm instead of GitHub (#1360)
• Use Subresource Integrity for web UI resources pulled from CDNs (#1340)
• Internal test refactoring

Changed

• Switched bcrypt implementation from bcrypt to bcryptjs (#1233)

Fixed

• Return the correct Content-Type for OAuth endpoints (#822)

Security

• Increase minimum DOMPurify version to 0.9.0

Security

• Increase minimum DOMPurify version to 0.9.0

Security

• Increase minimum DOMPurify version to 0.9.0

No changes from 4.0.0 beta 5.

Fixed

• Revert bcrypt upgrade to fix install issues (#1333)
• Don't use newer github: syntax in connect-auth dep as it breaks npm@1 (#1253)
• The commandline tools no longer crash due to missing optimist

Improved

• Update documentation to match new config options
• Lock connect-auth dep to a particular version
• Turn on tests for Node 6

Fixed

• Fix a whitespace issue with appendFooter

Changed

• Permanently remove the build-on-git-install hacks (#1291)

Fixed

• Correct a potentially bad npm publish

Improved

• Added the appendFooter config option

Fixed

• Fix README.md documenting the old name of a config parameter
• Fix the sample pump.io.json including an obsolete parameter

Fixed

• Removed build logic from public npm package because it was completely breaking installs (#1291)

Improved

• Frontend JavaScript runs in strict mode (#1221)
• Frontend Javascript passes JSHint (#1176)
• Remove direct Connect dependency (#1274)
• Upgrade many minor dependencies
• Add a robots.txt file (#1286)
• Don't suggest or offer avatar uploads if uploads aren't available
• Added the ability to specify configuration via environment variables
• Added the ability to specify configuration via CLI flags
• Added --help and --version CLI flags
• Embed IndieWeb metadata in the web UI

Breaking

• Upgrade to Express 4.x (affects plugins)
• Switch to Yargs for config and CLI option parsing (should be identical but please double-check that your config is respected in case of subtle edge cases)

No changes from 3.0.0 beta 1.

Improved

• Improve performance of front-page image

Fixed

• Fix the web UI repeating YouTube videos (again)
• Fix direct visits to /following URLs not rendering layout (#1279)

Improved

• HTTP Strict Transport Security can now be configured (#1197)

Changed

• The web UI no longer loads a JSON polyfill

Fixed

• Incorrect and unnecessary plugin-types Content Security Policy directives are no longer sent

Breaking

• The uploaddir option is obsolete and should be migrated to the new datadir option (#1272)

Fixed

• Realtime functionality is working again
• Incorrect and unnecessary 'plugin-types' Content Security Policy directives are no longer sent

No changes from 2.1.0 beta 0.

Fixed

• Files in bin/ are now properly validated by JSHint and JSCS

Improved

• Enable strict mode for server-side JS (#1221)
• Provide a more useful error message for invalid config JSON
• A sample systemd service is now included

Fixed

• Fix web UI YouTube embeds appearing in all subsequent posts (#1249)