Stoat

0.15.0 (2026-08-05)

Features

• add an approximate member count to servers (#884) (ccfb5f1)
• add call event (#873) (457c770)

Bug Fixes

• rewrite youtube embedder to use youtube oembed (#878) (0369451)

Security Fixes

• Fetching a single message checks only ViewChannel, not ReadMessageHistory (GHSA-8qp4-h9xf-2vqr)
• Missing authorization on Bonfire Subscribe — cross‑server member enumeration & profile/status surveillance (ban‑evasion) (GHSA-jj3j-9qr7-jgfc)
• Unauthenticated SSRF via IPv6 unspecified address (::) bypass (GHSA-4rmr-77qv-hq47)
• Uncapped SVG rendering in January (GHSA-x87r-h3mq-7mgr)