Chatto v0.1.0-alpha.3 release notes

0.1.0-alpha.3 (2026-06-08)

add compact encrypted data envelopes (#704) (4c6b7b6)
add ES rollout observability (#709) (2c0cb34)
add explicit room thread creation events (#722) (2de3459)
add server-admin system diagnostics (#720) (64e23f0)
add server-side cookie sessions (#732) (3a0b224)
add shreddable message body events (#729) (ea05797)
audit auth token workflows (#697) (fce12a4)
auth: use OTP codes for email verification (#771) (0bf1905)
frontend: polish service worker shell caching (#773) (b842901)
graphql: clean up schema hygiene (#724) (f68ae54)
harden encryption key storage (#710) (0bf76e7)
move presence and calls to memory cache (#702) (c98aacf)
store link preview cache in runtime state (#708) (d5832c4)

add GraphQL length validation (#751) (715a3b4)
add HTTP server timeout hardening (#723) (880628e)
add report-only CSP header (#728) (74e6200)
auth: revoke credentials after password changes (#752) (e1adcbd)
autofocus login identifier field (#727) (f349bba)
clamp room event query limits (#735) (75bf8e0)
clean up cached asset derivatives on deletion (#766) (f7a6d04)
core: consolidate NATS asset storage (#768) (1eaca2b)
disable video uploads when processing is off (#695) (4a31d1a)
enforce core string length limits (#741) (3c64b17)
frontend: disable composer submit while attachments stage (#711) (fdb1831)
frontend: keep failed server icons visible (#772) (7b974d6)
graphql: widen event log total count (#760) (79ebf41)
harden OIDC avatar fetching (#739) (7b82ad7)
hide echoes on direct retraction (#701) (035601b)
limit GraphQL JSON request body size (#740) (8cae516)
make message ES importer non-atomic (#733) (651780b)
paginate unbounded GraphQL list fields (#726) (1e7d5e8)
require mandatory SMTP TLS by default (#725) (ecad9c5)