What's Changed

• Bump Node.js base images by @jimmackenzie / @jaywink in #722

  Addresses the following high/medium/low CVE's CVE-2026-105482,
  CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074,
  CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073.

New Contributors

• @jimmackenzie made their first contribution in #722

Full Changelog: v2.0.1...v2.0.2

What's Changed

• Fix tests incompatible with room v12 by @H-Shay in #715

Full Changelog: v2.0.0...v2.0.1

What's Changed

• Remove legacy MSC4284 implementation support by @turt2live in #653
• Clean up github actions by @H-Shay in #654
• Bump yaml from 2.2.2 to 2.8.3 by @dependabot[bot] in #660
• Bump picomatch from 2.3.0 to 2.3.2 by @dependabot[bot] in #659
• Bump the minor-and-patches group with 2 updates by @dependabot[bot] in #656
• Bump flatted from 3.2.7 to 3.4.2 by @dependabot[bot] in #655
• Bump js-yaml from 4.1.0 to 4.1.1 by @dependabot[bot] in #629
• Bump brace-expansion from 1.1.11 to 1.1.13 by @dependabot[bot] in #662
• Bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in #665
• Bump follow-redirects from 1.15.9 to 1.16.0 by @dependabot[bot] in #668
• Bump the minor-and-patches group across 1 directory with 4 updates by @dependabot[bot] in #671
• Bump axios from 1.12.0 to 1.15.2 by @dependabot[bot] in #672
• Bump postcss from 8.4.39 to 8.5.15 by @dependabot[bot] in #674
• Bump shell-quote from 1.7.3 to 1.9.0 by @dependabot[bot] in #694
• Bump js-yaml from 4.1.1 to 4.3.0 by @dependabot[bot] in #693
• Remove Mjolnir-for-all appservice by @H-Shay in #703
• Batch admin redactions by @H-Shay in #705
• Make Mjolnir more robust to homeserver degredation by @H-Shay in #706
• Fix MAS deactivate error by @H-Shay in #711

Full Changelog: v1.12.1...v2.0.0

What's Changed

• Fix property access on error in ModCache by @H-Shay in #651

Full Changelog: v1.12.0...v1.12.1

What's Changed

• Bump axios from 1.8.2 to 1.12.0 by @dependabot[bot] in #627
• Update minimum NodeJS version to 24 by @Half-Shot in #626
• Bump tensorflow and nsfwjs versions by @H-Shay in #628
• Revert update to Node 24 by @H-Shay in #630
• Update to Node 22 by @H-Shay in #631
• Upgrade bot-sdk for crypto compatibility by @turt2live in #635
• Bump lodash from 4.17.21 to 4.17.23 by @dependabot[bot] in #636
• Don't apply protection actions to members of the moderation room by @H-Shay in #633
• fix quarantine commands by @H-Shay in #637
• Include reason when redacting-on-ban by @H-Shay in #640
• Fix mjolnir version in package json by @H-Shay in #642

Full Changelog: v1.11.0...v1.12.0

What's Changed

• Quarantine redacted media by @Half-Shot in #593
• Introduce a labs section for MSC4284 and similar commands by @turt2live in #605
• Don't redact literally everything when NSFW sensitivity is low by @turt2live in #606
• Add a "first message is link" protection by @H-Shay in #603
• Parse matrix.to links when banning by @H-Shay in #609
• Set MSC4293 flag when autoredacting users by @turt2live in #612
• Log & expose device ID and identity at startup for visibility by @Half-Shot in #613
• Misc fixes - better error handling + store access token when fetched by @H-Shay in #619
• Use admin redaction endpoint if possible by @H-Shay in #621
• Support synapse-http-antispam by @turt2live in #610
• Fix references to node 18 in docs/comments by @H-Shay in #623
• Prepare for room v12 by @H-Shay in #620

Full Changelog: v1.10.0...v1.11.0

What's Changed

• Unflake tests by @H-Shay in #570
• Fix call to admin redaction api by @H-Shay in #568
• Add some debug logging for mention spam protection by @H-Shay in #569
• Revert "Add displayname mention spam protection (#537)" by @H-Shay in #571
• Refer to CONTRIBUTING from README by @andybalaam in #572
• Fallback to old-style redactions for now by @H-Shay in #578
• Support deployments using Matrix Authentication Service by @H-Shay in #577
• Support scanning stickers for NSFW content, and don't error so loudly when a MXC is missing by @Half-Shot in #585
• Logging improvements by @H-Shay in #589
• Skip NSFW classification if treshold is 0.0 by @TheArcaneBrony in #583
• Bump cross-spawn from 7.0.3 to 7.0.6 by @dependabot in #561
• Add MessageIsVideo protection by @H-Shay in #582
• Bump axios from 1.7.7 to 1.8.2 by @dependabot in #590
• Bump parse-duration from 1.0.2 to 2.1.3 by @H-Shay in #592
• Create funding-manifest-urls by @HarHarLinks in #596
• Demote "Applying ACL" to debug by @turt2live in #597
• Fix alignment in help menu by @turt2live in #599
• Fix function return by @H-Shay in #598
• Soften the default shutdown message/room name by @turt2live in #600
• Don't include historical members in mod cache by @H-Shay in #601

New Contributors

• @andybalaam made their first contribution in #572
• @TheArcaneBrony made their first contribution in #583
• @HarHarLinks made their first contribution in #596

Full Changelog: v1.9.2...v1.10.0

What's Changed

• Forward mentions from bot to management room by @H-Shay in #567

Security

• This release reintroduces the mention forwarding feature removed in 1.9.1. See GHSA-3jq6-xc85-m394 / CVE-2025-24024 for details.

Full Changelog: v1.9.1...v1.9.2

Security Advisory

A security issue was discovered in the mention forwarding feature. We've backed it out in v1.9.1 (this release) and encourage admins to immediately upgrade to this version while we take a closer look.

Update January 21, 2025: This is GHSA-3jq6-xc85-m394 / CVE-2025-24024

What's Changed

• Revert "forward mentions to management room" feature by @turt2live in #565

Full Changelog: v1.9.0...v1.9.1

Security Advisory

Please upgrade immediately to v1.9.1 instead of v1.9.0

Update January 21, 2025: This is GHSA-3jq6-xc85-m394 / CVE-2025-24024

What's Changed

• A few small fixes by @H-Shay in #536
• Add displayname mention spam protection by @H-Shay in #537
• Add users who activate mention spam protection to auto-redact list by @H-Shay in #541
• Remove notes from the default config.yaml that suggest mjolnir's wordlist feature supports regex, it does not. by @PC-Admin in #543
• Use Prettier to format code by @H-Shay in #542
• Use admin api for redactions if possible by @H-Shay in #538
• Add a test verifying messageIsMediaProtection by @H-Shay in #545
• Trim leading whitespace from !mjolnir command by @Half-Shot in #549
• Create CODEOWNERS by @turt2live in #550
• Don't ban users in moderator room by @H-Shay in #544
• Filter out rooms where user was never a member when redacting rooms by @H-Shay in #551
• Don't shut down protected rooms by @H-Shay in #554
• Notify moderation room when users in protected rooms mention the bot (configurable) by @Half-Shot in #553
• Add a test verifying unban command by @H-Shay in #557
• Stop printing help menu on unknown command by @H-Shay in #558
• Don't allow mods to demote bot or members of management room in protected rooms by @H-Shay in #555
• Use spoilers when mentioning targets of a rule by @H-Shay in #559
• v1.9.0 by @H-Shay in #563

New Contributors

• @PC-Admin made their first contribution in #543

Full Changelog: v1.8.3...v1.9.0