v1.2.1

After 11 months (and a lot of rain), I'm back with a minor update to catch up with the CVE-2025-66457 issue, minor fixes, new small features and improvements. This version keeps the concept exactly the same, just a bit better. The next versions should be focused on implementing the Private Chat Protocol using E2E encryption and more advanced messaging.

New features

• Added input validation for room IDs and usernames (alphanumeric, _, -, max 64 chars).
• Added membership check before relaying CHAT_MESSAGE / IMAGE_MESSAGE.
• joinRoom now returns a specific error string on failure instead of a generic boolean.
• Added configurable WebSocket payload size limit via MAX_PAYLOAD_SIZE_MB (default: 10 MB).
• Added log level hierarchy, setting LOG_LEVEL=warn now also shows errors.

Security fixes

• Upgraded Elysia to v1.4.18 to fix security issue CVE-2025-66457

Bug fixes

• Fixed leaveRoom broadcasting to a room after it was already deleted.
• Fixed USER_LIST message missing the required type discriminant field.
• Fixed require() mixed with ESM, replaced with a proper import statement.
• Fixed fragile --port argument parsing.

Other improvements

• Removed redundant usernames set from room state, derived from clients map.
• Pinned bun-types to 1.2.4.
• Added CLAUDE.md

Tests

• Added 30 unit tests for ChatManager using Bun's built-in test runner.
• Added GitHub Actions CI workflow, which runs bun test on pull requests and pushes to main/develop.

Full Changelog: v1.2.0...v1.2.1

v1.2.0

New features:

• Added API endpoint on / to serve HTML landing page if the user agent is a browser, or JSON if not.
• Listen on port passed by parameter.

Other improvements

• Improved types.
• Updated docs.
• Updated docker schema.
• Repo was moved to PrivateChatProtocol/private-chat-server.

New Contributors

• @jrgf made their first contribution in #2

Full Changelog: v1.1.0...v1.2.0

v1.1.0

New features:

• Broadcast room members (USER_LIST)
• Handling images (IMAGE_MESSAGE)

Other changes:

• General improvements
• Updated docs

Full Changelog: v1.0.0...v1.1.0

v1.0.0

Initial Features

✅ Real-time messaging using secure WebSockets
✅ Private chat rooms with strict access control
✅ Zero storage of message content on the server
✅ Containerized deployment for easy backend setup with Docker

Release notes:
https://blog.carloslugones.com/private-chat