Security release
Release v4.12.0 ships coordinated security hardening work following v4.11.1. This is a critical security release addressing confirmed stored XSS paths and other significant vulnerabilities found in earlier versions. Users should update as soon as possible and ensure they are running the latest ADAMANT Messenger build.
Key changes
This release closes confirmed stored XSS paths, removes all v-html usage, hardens markdown rendering through SafeHtml, and verifies node-supplied public keys against addresses. Local secret storage and password KDF are upgraded with versioned scrypt, cryptographic helpers are migrated to @noble and @scure, and strict CSP is enforced across PWA, Tor, testnet, Android, and Electron artifacts.
Android backup and data-extraction boundaries along with FileProvider paths are hardened. AIP-6 signal messages are kept out of visible chat history, and binary and hex crypto input boundaries are normalized. Coin-service sync thresholds are fixed so lagging indexers are no longer treated as available, and node minimum-version checks now use semver instead of lexicographic string comparison.
Bug fixes
Coin services no longer treat lagging indexers as online, resolved through PR #954. Newest nodes (v0.10.0+) are no longer incorrectly flagged as unsupported or having an outdated API version, resolved through PR #956.
Tasks
The release includes preparation for a safe ESLint 10 migration without losing import checks, a stale direct dependency review with a phased replacement plan, and a full security audit with coordinated hardening work across PRs #963, #964, and #966.