Releases: MostroP2P/mostro
Release v0.17.0
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.17.0
💼 Other
- Update CHANGELOG for version 0.17.0 by @grunch
🚜 Refactor
- refactor: remove from_globals() and construct AppContext explicitly (#656 PR F) by @mostronatorcoder[bot] in #672
- refactor: add keys to AppContext (#656 PR E) by @mostronatorcoder[bot] in #670
- refactor: migrate scheduler to AppContext (#656 PR D) by @mostronatorcoder[bot] in #667
- refactor: remove global accesses from handler paths (#656 PR C) by @mostronatorcoder[bot] in #666
- refactor: simplify dispatcher by removing pool parameter (#656 PR B) by @mostronatorcoder[bot] in #665
- refactor: remove legacy DI wrapper signatures (#656 PR A) by @mostronatorcoder[bot] in #663
📚 Documentation
- docs: update architecture docs for DI migration (#656) by @mostronatorcoder[bot] in #673
⚙️ Miscellaneous Tasks
- Release mostro version 0.17.0 by @grunch
Contributors
- @grunch made their contribution
- @mostronatorcoder[bot] made their contribution in #673
Full Changelog: v0.16.5...v0.17.0
Release v0.16.5
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.16.5
💼 Other
- Update CHANGELOG for version 0.16.5 by @grunch
- Adding instance name to "y" tags by @sergey3bv in #653
🚜 Refactor
- refactor: complete phase-5 handler DI migration to AppContext (#639) by @mostronatorcoder[bot] in #657
- refactor: wire AppContext into dispatcher and migrate cancel module (#639 phase 2) by @mostronatorcoder[bot] in #652
- refactor: add AppContext struct for dependency injection (#639 phase 1) by @mostronatorcoder[bot] in #651
- refactor: remove password infrastructure and all encryption code paths by @mostronatorcoder[bot] in #647
- refactor: remove dual encrypted/unencrypted code paths in db.rs by @mostronatorcoder[bot] in #646
- refactor: remove encryption from app layer and util by @mostronatorcoder[bot] in #645
- refactor: add --decrypt-db CLI command for database migration by @mostronatorcoder[bot] in #644
- refactor: add deprecation warning for MOSTRO_DB_PASSWORD by @mostronatorcoder[bot] in #643
🧪 Testing
- test: add phase-4 cancel unit tests using AppContext builder (#639) by @mostronatorcoder[bot] in #655
- test: add phase-3 mock test context utilities for AppContext (#639) by @mostronatorcoder[bot] in #654
- test: add 28 mutation testing tests for db module by @mostronatorcoder[bot] in #640
⚙️ Miscellaneous Tasks
- Release mostro version 0.16.5 by @grunch
- ci: make PR mutation testing opt-in via label by @mostronatorcoder[bot] in #648
◀️ Revert
- revert: logical revert of PR #617 targeted update behavior by @mostronatorcoder[bot] in #659
Contributors
- @grunch made their contribution
- @sergey3bv made their contribution in #653
- @mostronatorcoder[bot] made their contribution in #659
Full Changelog: v0.16.4...v0.16.5
Release v0.16.4
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.16.4
🚀 Features
- feat: add days field to user rating event (kind 38384) by @Catrya in #625
- feat: implement mutation testing for Rust codebase quality assurance by @mostronatorcoder[bot] in #619
- feat: added latest tag to both mostro docker versions by @arkanoider in #610
- feat: add expiration to rating events (kind 38384) by @mostronatorcoder[bot] in #612
🐛 Bug Fixes
- fix: use targeted SQL updates in check_failure_retries and payment_success by @Catrya in #617
- fix: prevent duplicate dev fee payments via idempotency check by @mostronatorcoder[bot] in #622
- fix: use expiration settings instead of hardcoded 24h for order events by @mostronatorcoder[bot] in #614
- fix: close active dispute when seller releases funds by @Mostrica in #606
💼 Other
- Update CHANGELOG for version 0.16.4 by @grunch
- Deduplicate db test helpers by @grunch in #629
- Automated badge for toolchain and version in README.md by @arkanoider in #628
- Fix restore session dispute initiator by @BraCR10 in #599
🚜 Refactor
- refactor: extract dev fee logic into dedicated module by @arkanoider in #627
📚 Documentation
- docs: fix inconsistent pubkey format in rating and info event examples by @mostronatorcoder[bot] in #615
⚙️ Miscellaneous Tasks
- Release mostro version 0.16.4 by @grunch
Contributors
- @grunch made their contribution
- @arkanoider made their contribution in #627
- @Catrya made their contribution in #617
- @mostronatorcoder[bot] made their contribution in #622
- @BraCR10 made their contribution in #599
- @Mostrica made their contribution in #606
Full Changelog: v0.16.3...v0.16.4
Release v0.16.3
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.16.3
🚀 Features
- feat(docker): plain image, settings.tpl.toml, StartOS as mostro-startos by @arkanoider in #597
🐛 Bug Fixes
💼 Other
- Update CHANGELOG for version 0.16.3 by @grunch
- Add configurable per-kind event expiration to prevent storage bloat by @mostronator in #603
- Fix Docker DB password startup flow by @grunch in #604
⚙️ Miscellaneous Tasks
- Release mostro version 0.16.3 by @grunch
Contributors
- @grunch made their contribution
- @Catrya made their contribution in #609
- @mostronator made their contribution in #603
- @arkanoider made their contribution in #597
Full Changelog: v0.16.2...v0.16.3
Release v0.16.2
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.16.2
🐛 Bug Fixes
- fix: prevent redundant LND queries for confirmed dev fee payments by @mostronator in #586
- fix: check LN payment status before resetting on dev fee timeout by @mostronator in #582
- fix: prevent duplicate dev fee payment on timeout by @mostronator in #584
- fix: add rate limiting to ValidateDbPassword RPC endpoint by @mostronator in #580
- fix: close active dispute when order is cooperatively canceled by @mostronator in #578
💼 Other
- Update CHANGELOG for version 0.16.2 by @grunch
- update readme: add mostrix and mobile client, remove mostro-web by @Catrya in #576
📚 Documentation
- docs: add fenced code block language specifier guideline to AGENTS.md by @mostronator in #579
⚙️ Miscellaneous Tasks
- Release mostro version 0.16.2 by @grunch
- chore: update Rust toolchain from 1.90.0 to 1.93.0 by @mostronator in #581
Contributors
- @grunch made their contribution
- @mostronator made their contribution in #586
- @Catrya made their contribution in #576
Full Changelog: v0.16.1...v0.16.2
Release v0.16.1
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.16.1
🚀 Features
💼 Other
- Update CHANGELOG for version 0.16.1 by @grunch
- Inconsistent Version Tag Format in CHANGELOG by @grunch
- Missing Admin Participant Declaration in Mermaid Diagram by @grunch
📚 Documentation
- docs: Remove hardcoded line numbers and add guideline against them by @grunch in #573
- docs: Fix dev_fee calculation timing contradictions in DEV_FEE.md by @grunch in #571
⚙️ Miscellaneous Tasks
- Release mostro version 0.16.1 by @grunch
Contributors
- @grunch made their contribution
Full Changelog: v0.16.0...v0.16.1
Release v0.16.0
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.16.0
🚀 Features
💼 Other
- Update CHANGELOG for version 0.16.0 by @grunch
- Small fix on readme by @grunch
- Update readme by @grunch in #564
- Include dispute initiator in Nostr dispute events by @arkanoider in #563
⚙️ Miscellaneous Tasks
- Release mostro version 0.16.0 by @grunch
Contributors
- @grunch made their contribution
- @arkanoider made their contribution in #563
Full Changelog: v0.15.6...v0.16.0
Release v0.15.6
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.15.6
🚀 Features
- feat: implement Phase 4 dev fee audit events via Nostr by @grunch in #559
- feat: add development fund configuration infrastructure by @grunch in #555
🐛 Bug Fixes
💼 Other
- Update CHANGELOG for version 0.15.6 by @grunch
- Change development fund to be paid by mostrod by @grunch in #561
- Development fund implementation third phase by @grunch in #558
- Document development fund payment phases and architecture by @grunch in #556
- Aligned premium logic to lnp2p bot by @arkanoider in #550
📚 Documentation
⚙️ Miscellaneous Tasks
- Release mostro version 0.15.6 by @grunch
Contributors
- @grunch made their contribution
- @Catrya made their contribution in #552
- @arkanoider made their contribution in #550
Full Changelog: v0.15.5...v0.15.6
Release v0.15.5
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.15.5
🚀 Features
- Restored previous changelog.md local file creation by @arkanoider in #541
🐛 Bug Fixes
- Added protobuf to rust.yml in publish stage by @arkanoider in #547
💼 Other
- Update CHANGELOG for version 0.15.5 by @grunch
- New github actions stuff by @arkanoider in #546
- Improved last trade index response by @arkanoider in #545
- add order_expires_at to order event by @Catrya in #544
⚙️ Miscellaneous Tasks
- Release mostro version 0.15.5 by @grunch
Contributors
- @arkanoider made their contribution in #547
- @grunch made their contribution
- @Catrya made their contribution in #544
Full Changelog: v0.15.3...v0.15.5
Release v0.15.3
Verifying the Release
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --importOnce you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
gpg --verify manifest.txt.sig.negrunch manifest.txt
gpg --verify manifest.txt.sig.arkanoider manifest.txt
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
gpg: Good signature from "Francisco Calderón <fjcalderon@gmail.com>" [ultimate]
gpg: Signature made fri 10 oct 2025 11:28:03 -03
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
gpg: Good signature from "Arkanoider <github.913zc@simplelogin.com>" [ultimate]
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.
What's Changed in v0.15.3
💼 Other
- Update rust version by @grunch
⚙️ Miscellaneous Tasks
- Release mostro version 0.15.3 by @grunch
Contributors
- @grunch made their contribution
Full Changelog: v0.15.2...v0.15.3