The Ignite Realtime community is pleased to announce the release of Openfire 5.1.1, a maintenance update to our open-source XMPP real-time communication server!

Following last month’s 5.1.0 feature release , we’ve been gathering feedback and tracking down the issues that inevitably surface once a bigger release meets the real world. Openfire 5.1.1 is the result: a focused round of bug fixes and improvements, with a particular emphasis on PubSub correctness and connection handling.

A good chunk of this release tidies up PubSub behaviour. We fixed excessive memory consumption caused by a bloated ofPubsubSubscription table ( OF-3306 ), alongside various smaller issues related to pub/sub functionality.

Connection handling gets some attention too. We resolved a nasty case where IQBindHandler could busy-wait up to 20 seconds on a resource conflict, causing thread starvation and misbehaving ( OF-3319 ), fixed a NullPointerException in outbound S2S DirectTLS connections ( OF-3332 ), and a number of other networking-related issues.

Certificate SANs now encode IP addresses correctly as iPAddress rather than dNSName ( OF-3324 ), which should fix an issue that popped up under certain network configurations with recent versions of the Conversations client.

We also cleaned up a couple of migration-related issues carried over from 5.1.0’s database work, such as XML properties failing to save during PBKDF2 migration ( OF-3305 ). This should guard against accidental loss of the encryption keys, preventing installations that become effectively unusable when migration happens while the file system is in a faulty state.

The full changelog has all the details, with 24 items resolved in total.

You can obtain Openfire 5.1.1 for your platform from its download page . The sha256sum values for the release artifacts are:

dc887032619b7ecf66cc8c17dc5cedc13c2479525cd93b41e5d999e4ec942adf  openfire-5.1.1-1.noarch.rpm
4f6c5ccfe44fdd494760ae5a6f00f971ea000ec6c69e1481d3546bed994598e2  openfire_5.1.1_all.deb
17eafa2641a5cbe226328d54e115fd1780a90d6fedb6d63d8bcea048f91f23ab  openfire_5_1_1.dmg
68b69309f22435e4996b18b21a451d8c3b98a543aa8680436694bf4a235b8299  openfire_5_1_1.exe
d930be11c93c995ee0a045118d0539629bd27d983ad99e6f174ded6453612a0d  openfire_5_1_1.tar.gz
b55659388274deedde92813ed830e1060c89b48fc3d61e6227c153bd4d96b57e  openfire_5_1_1_x64.exe
9faa8900c8aa56822deb83c82339842794b6e2e58be61ca08dbdf948ee931cd6  openfire_5_1_1.zip

Many of the issues fixed in this release were reported by our community members, and several of those were instrumental in finding and fixing bugs and applying improvements. We greatly appreciate everyone’s feedback! We’d love to hear from you! Please join our community forum or group chat and let us know what you think!

For other release announcements and news follow us on Mastodon or X

1 post - 1 participant

Read full topic

Aurora: a new identity for Fluux

Fluux has a new face. The app icon, logo, and the entire interface have been redesigned around Aurora, a teal-to-violet gradient identity with display headings, softer avatar shapes, and frosted-glass modals.

Aurora is more than a color swap:

• Per-person sender colors. Each participant in a group chat gets a stable, readable color, tuned for WCAG AA contrast in both light and dark themes.
• Curated accent presets. Pick the accent that suits you; the whole interface follows, including the encryption affordances, which now use one consistent color from the chat header to the message locks and the composer.
• Calmer chrome. Thinner scrollbars, consistent focus rings, quieter notification badges. Unread indicators now follow a simple two-tier model: red means something needs you (a direct message, a mention, a contact request), grey means ambient room activity.

If you preferred the previous color scheme, it is still there as the “Indigo classic” theme.

Conversation-first navigation

We removed the standalone Events view. It was a place you had to remember to check; now events come to you, in context:

• Contact requests, room invitations, and message requests appear as headed sections at the top of the relevant lists.
• A message from someone not in your roster opens as a read-only preview with an Accept / Ignore / Block banner, so you can see what it is before you commit to anything.
• Contacts moved down to the navigation cluster, with a badge when requests are pending.
• Archived conversations are one toggle away in the Messages header, and archiving now syncs live across your devices.

The result is fewer top-level destinations and less bookkeeping.

Jump anywhere with the command palette

Press Cmd-K (Ctrl-K on Windows and Linux) to jump to any conversation or action. The palette puts your unread chats and mentioned rooms first, shows avatars and unread badges, and never proposes the conversation you are already reading.

Unlimited scroll-back

The fixed 1,000-message cap on conversation history is gone. History is now a sliding window: scroll back as far as you like, and messages load incrementally from the local cache and the server archive (MAM). Combined with message-list virtualization, now on by default, long conversations stay fast, and typing no longer reflows the message list on every keystroke.

While we were in there, we fixed a long tail of scroll issues: new messages reliably stick to the bottom on WebKit, returning to a conversation restores exactly where you were reading (even deep in history), and jumping to a search result lands the message a third of the way down the viewport instead of hiding it under the date header.

Your reading position follows you

Read markers now sync across devices (XEP-0490). If you read a conversation on your desktop, it opens at the right position on your laptop, and its notification is dismissed. Together with live archive sync and the carbons and MAM work from previous releases, your devices now agree on what you have read, what is pending, and what is filed away.

A friendlier admin console

For those who administer their own ejabberd server, the ad-hoc command list is gone, replaced by purpose-built screens: a server overview dashboard, a searchable user list with online status and last login, a redesigned user detail view with a Ban account action, and a mobile launchpad. Only a few server admin commands are available so far, but we plan to grow the list with each new version.

Desktop and everyday polish

• Window app bar. The desktop app gets back/forward navigation in a proper window bar, with correctly centered traffic lights on macOS.
• Calm updates. Instead of reloading the app under your feet, a new “Update available” button appears in the icon rail when a new version is ready. You decide when.
• Reduce motion. A new accessibility setting minimizes animations and follows your system preference.
• Advanced mode. The XMPP console and expert settings are now behind an in-app toggle, keeping the default settings approachable.
• Redesigned contact details. A person-forward view with cards for devices, groups, and security, and fingerprint verification in its own focused panel.

And the usual pile of fixes

Almost 300 commits went into this release, so the full list is long. Some favorites: your own encrypted messages now show their real trust level instead of a grey lock under some circumstances; whispers in group chats keep their corrections and reactions private; animated avatars are frozen so they stop competing for your attention, even if they are PNGs; reactions from ignored users are hidden; and rooms are sorted correctly the moment the app launches.

The complete list is in the changelog .

Try it

Fluux Messenger 0.17.0 is available for macOS, Windows, and Linux, or directly in your browser. As always, it works with any standards-compliant XMPP server, and it remains our day-to-day client at ProcessOne.

If you upgrade and something feels off, tell us. A lot of what shipped in this release started as a user report.

XMPP Newsletter Banner

Welcome to the XMPP Newsletter, great to have you here again! This issue covers the month of June 2026.

The XMPP Newsletter is brought to you by the XSF Communication Team.

Just like any other product or project by the XSF, the Newsletter is the result of the voluntary work of its members and contributors. If you are happy with the services and software you may be using, please consider saying thanks or help these projects!

Interested in contributing to the XSF Communication Team? Read more at the bottom.

XSF Announcements

XMPP Summit 29

The XMPP Standards Foundation (XSF) is excited to announce the 29th XMPP Summit, the first XMPP Summit to take place fully online! This XMPP Summit will be held from Friday 4th September to Saturday 5th September 2026, both days between 13:00 - 16:00 UTC. The XSF invites everyone interested in development of XMPP technologies to attend, and discuss all things XMPP remotely!

XSF Membership

Being an elected member of the XMPP Standards Foundation signals a commitment to open standards and professional engagement in / with the XMPP community. Here, your membership helps position the XSF as a healthy organization, which in itself is valuable. It also grants voting rights on technical and administrative matters within the XSF. The application is a light-weight and free of cost process and you can use your membership to get more involved more easily, too. If you are interested in joining the XMPP Standards Foundation as a member, please apply to our 3rd quarterly call for members admission before August 16th, 2026 00:00UTC.

XMPP Events

• XMPP Sprint in Berlin (DE / EN): during Friday June 19th to Sunday June 21st 2026, various developers had good discussions, tasty food, and did some programming! There was work on message edits in Conversations, stateless file sharing in Dino, fixes for the next release of Kaidan, OMEMO+PubSub improvements in Mellium, a bigger update of stanza content encryption and its Slixmpp implementation, and some fixes on Debian packages. Many thanks to the @wikimediaDE for hosting us, again! Wonderful location, kind people!

• XMPP and DI.DAY: In the frame of the DI.DAY, a collaborative list of local-oriented channels has been started. This list can be accessed as a map on OpenStreetMap.de or as a list on Codeberg. Feel free to complete it, or notify new rooms on the dedicated room mapofchannels@chat.yax.im, or via Mastodon.

• XMPP at PravConf 2026: This year’s edition of PravConf, a Free Software and XMPP themed conference, is being planned by the Prav community from 4-5 July in Thiruvananthapuram, India. It will be followed by PravCamp on 6-7 July, a Sprint-inspired event where people sit together to work on Prav and other XMPP related things. Both events are held on college campuses and college students will get the chance to learn about XMPP too. Read more about it on the website.

• XMPP at FOSSY 2026: FOSSY, the fourth Free and Open Source Software Yearly conference, has published the complete list of presentation on the XMPP Track, which will be as follows:

  • On Saturday, August 08, in MCLD 3038:
    • Encrypted messaging interoperability with hybrid bridges in XMPP, by Marvin W. from 2:00 PM to 2:45 PM PDT.
    • Beyond Chat: Delivering mini “apps” with great UI, by Stephen Paul Weber from 3:00 PM to 3:45 PM PDT.
    • “Beautiful XMPP Testing” revisited – How to Overcome the Mind-Body Duality by Staring at XML, by Phillip Davis from 4:30 PM to 5:15 PM PDT.
  • On Sunday, August 09, in MCLD 3038:
    • When Data Gets Heavy: Voice and Video for Large Groups, by Christopher Vollick from 10:45 AM to 11:30 AM PDT.
    • UnifiedPush - Push notifications. Decentralized and Open Source, by Daniel Gultsch from 11:45 AM to 12:30 PM PDT.
    • Adventures in Onboarding: Episode V - The Server Goes Down, by Gideon Mayhak from 2:00 PM to 2:45 PM PDT.
    • Snikket: Behind the scenes of our on-demand XMPP server hosting, by Matthew Wild from 3:00 PM to 3:45 PM PDT.

XMPP Articles

• Openfire 5.1.0 Release, by guus for the Ignite Realtime community.
• Fluux Messenger 0.16.0: End-to-End Encryption and Fluux Messenger 0.16.1: fixes and refinements from real-world use, by Mickaël Rémond for the ProcessOne Blog.
• 18 meses depois, by isadora for the isaCloud diario-de-bordo. [PT_BR]
• Slidge v0.4.0beta “Spaces”, from the slidge.im blog.
• Movim 0.34 “Meier” is here as well as Movim 0.31.4, by Timothée Jaussoin for the Movim Blog, by Timothée Jaussoin for the Movim Blog.
• Introducing Tacky, a desktop XMPP chat client built with Tcl/Tk for Linux and Windows with support for modern A/V calls and OMEMO e2ee. Still in pre-alpha state.
• Introducing ffetcher, an XMPP bot that monitors RSS and Atom feeds and posts new articles to one or more MUC rooms. It specializes on Fediverse feeds. The code was AI generated and reviewed/tested by the author.

XMPP Software News

XMPP Clients and Applications

• aTalk has released versions 6.1.0, 6.2.0 and 6.3.0 of its encrypted instant messaging with video call and GPS features for Android. These versions introduce message retraction, remove merging of multiple messages in chat window, extend last message correction support to all other outgoing messages and not just the last sent message, support language translation for sent/received messages in chat/multi-user chat sessions with translation option that can be enabled/disabled per contact chat/multi-user chat session, and also bring improvements, quite a few fixes and lot of ‘under the hood’ changes. Please refer to the release notes for all the details.
• Conversations has released version 2.20.1 for Android. This releases adds Note to self as search suggestion and brings in minor bug fixes. Make sure to take a look at the changelog for all the details!
• Converse.js has released version 14.0.0 of its open-source web-based XMPP chat client. This release adds support for OMEMO:2 encryption! It also adds new pubsub API methods to create, subscribe and unsubscribe, software version support and show the server’s software version in the profile modal, support for OMEMO 2 (urn:xmpp:omemo:2) using stanza content encryption, detect omemo:2-only contacts as OMEMO-capable, with a whole lot of fixes and work under the hood!. All this also brings some backwards incompatible changes, so please go straight to the changelog for all the details!
• Fluux Messenger, has released versions 0.16.0, 0.16.1 and 0.16.2 , of its modern, cross-platform XMPP client for communities and organizations. These versions add OpenPGP end-to-end encryption — encrypted 1:1 messaging with passphrase-protected key storage and secret-key backup/restore, OpenPGP e2ee support in web version, Multi-TSK (Transferable Secret Key) handling in the backup restore flow for accounts with multiple OpenPGP keys, unread message count badge on avatar, compose messages offline and send on reconnect, support for room private messages ("whisper"), and a whole lot more along with a ton of changes and fixes. Please, go straight to the fulll changelog for all the details!

Fluux Messenger: Private whisper messages to a single room occupant

• Gajim has released version 2.4.7 of its free and fully featured chat app for XMPP. This release brings support for modern OpenPGP encryption, message drafts are now persistent, which means after restarting Gajim, you can continue where you left off, group chats are now named after participants if no other name is available, disabling account while connecting has been fixed, and it also comes with many small improvements and bugfixes. Thank you for all your contributions!

Gajim: A message mentioning you

• Movim has released versions 0.34, code named “Meier”, and 0.34.1! These new Movim milestones stabilize the important work done in the previous release while introducing a completely redesigned conference-call experience. In this version, you can add dedicated conference-call rooms to your Spaces and explore the new video-call interface. Conference calls, rebuilt from the ground up, media renegotiation, new layouts and redesigned interface, new notification sounds, session management, other fixes and more!

Movim: Conference-Call Rooms in Spaces!

• Profanity has released version 0.18.2 of its console based XMPP client. This release brings bug fixes to guard terminal writes while suspended, prevents OTR handshake from leaking presence to strangers, and silence ’no key’ error for key transport messages. Please make sure to read the changelog for all the details!

XMPP Servers

• The Ignite Realtime community is pleased to announce the release of Openfire 5.1.0. The highlights of this release include: SASL channel binding (with generous support from the NLnet Foundation), a round of crypto hardening, an O(n²) bug that was causing 2-hour startup times on large deployments (now seconds), Java 25, and new first-class support for MariaDB, Firebird and CockroachDB. Make sure to read the full changelog for all the details!

XMPP Libraries & Tools

• go-sendxmpp, a tool to send messages to an XMPP contact or MUC inspired by sendxmpp, version 0.16.0 has been released. Full details on the changelog.
• go-xmpp versions 0.3.5 and 0.3.6 have been released.
• jabber.el, the XMPP client for Emacs, versions 0.11.0 and 0.11.1 have been released. Full details on the changelog.
• libomemo.js, a TypeScript implementation of the OMEMO Multi-End Message and Object Encryption protocol for XMPP, versions 1.0.0, 2.0.0, 2.0.1 and 2.0.2 have been released. This library supports both version 0.3.0, which is what most XMPP clients support today, and the latest version 0.9.1 (also known as OMEMO2 or NEWMEMO). The list of changes is larger and has more details and notices on breaking changes that what could ever be mentioned in here. Please refer to the full changelog for all the details!
• peertube-plugin-livechat, a plugin meant to provide a chat system for Peertube videos, versions 14.0.3 and 14.0.4 have been released. You can read all the details in the changelog!
• QXmpp, the cross-platform C++ XMPP client and server library, versions 1.16.0 and 1.16.1 have been released. Full details on the changelog.
• slidge-whatsapp, the WhatsApp to XMPP gateway based on Slidge and whatsmeow, version 0.3.11 has been released. You can read the intermediate changelog from 0.3.11beta1 to 0.3.11 for all the details.
• slixmpp, the MIT licensed XMPP library for Python 3.7+ version 1.16.0 has been released. This release brings two new XEPs into the fold, and has quite a few internal changes as well. You can read the official release announcement for all the details. Breaking: The get_certs method on XEP-0257 is now an async function, which breaks compatibility with previous usages.
• strophejs, a JavaScript library for speaking XMPP via BOSH (XEP-0124 and XEP-0206) and WebSockets, version 4.0.0 has been released. You can read the full changelog for all the details.
• xmpp-dns, a CLI tool to check XMPP SRV records, version 0.6.3 has been released. Full details on the changelog.
• xmpp-rs, has released:
  • minidom-0.19.0, a DOM library quite specific for XMPP.
  • sasl-0.5.3 , handles the SASL protocol.
• xmpppy, a Python library that is targeted to provide easy scripting with Jabber, version 0.7.4 has been released. Full details on the changelog.

Extensions and specifications

The XMPP Standards Foundation develops extensions to XMPP in its XEP series in addition to XMPP RFCs. Developers and other standards experts from around the world collaborate on these extensions, developing new specifications for emerging practices, and refining existing ways of doing things. Proposed by anybody, the particularly successful ones end up as Final or Active - depending on their type - while others are carefully archived as Deferred. This life cycle is described in XEP-0001, which contains the formal and canonical definitions for the types, states, and processes. Read more about the standards process. Communication around Standards and Extensions happens in the Standards Mailing List (online archive).

Proposed

The XEP development process starts by writing up an idea and submitting it to the XMPP Editor. Within two weeks, the Council decides whether to accept this proposal as an Experimental XEP.

• Jingle User Location
  • This specification defines a Jingle application extension for negotiating and updating user location inside an active Jingle session using the XEP-0080 User Location payload.
• XMPP Decentralized ID (XID)
  • XMPP Decentralized ID (XID) is a DNS independent XMPP entity identifier. This specification describes how to generate, use, and handle them.
• Jingle Synchronized Real-Time Text
  • This specification defines a Jingle application extension for negotiating real-time text as part of the same conversational session as audio and video.

New

• Version 0.1.0 of XEP-0514 (Emoji Markup)
  • Accepted as Experimental by council vote on 2026-05-12 (XEP Editor(dg))
• Version 0.1.0 of XEP-0515 (TLS Channel-Binding Downgrade Protection)
  • Accepted as Experimental by council vote (XEP Editor (dg))
• Version 0.1.0 of XEP-0516 (XMPP Decentralized ID (XID))
  • Accepted as Experimental by council vote (XEP Editor (dg))
• Version 0.1.0 of XEP-0517 (Jingle Synchronized Real-Time Text)
  • Accepted as Experimental by council vote (XEP Editor (dg))

Deferred

If an experimental XEP is not updated for more than twelve months, it will be moved off Experimental to Deferred. If there is another update, it will put the XEP back onto Experimental.

• No XEPs deferred this month.

Updated

• Version 1.35.5 of XEP-0045 (Multi-User Chat)
  • Fix from attribute in examples where the room itself sends a message.
  • Fix associated pubsub node field name in disco info example. (nc)
• Version 0.5.0 of XEP-0420 (Stanza Content Encryption)
  • The time affix uses the DateTime profile of XEP-0082
  • Longer rpads MUST NOT be rejected
  • Add a minimum size target for random padding to add resistance against potential correlation attacks in case of short content and 0-length rpad
  • Removed unhelpful Implementation
  • Note warning about injection of decrypted stanzas
  • Clarify fallback body policy
  • Fix descriptions to apply to all stanzas instead of just messages
  • Remove questionable SHOULD in the time affix handling and clarify the affix’es verification
  • Request the registrar to provide a list of exclusively server-processed elements
  • List XEP dependencies
  • Add XML schema (syndace)
• Version 0.1.1 of XEP-0514 (Emoji Markup)
  • Remove outdated reference to BoB (techmetx11)

Last Call

Last calls are issued once everyone seems satisfied with the current XEP status. After the Council decides whether the XEP seems ready, the XMPP Editor issues a Last Call for comments. The feedback gathered during the Last Call can help improve the XEP before returning it to the Council for advancement to Stable.

• No Last Call this month.

Stable

• No stable XEPs this month.

Deprecated

• No XEPs deprecated this month.

Rejected

• No XEPs rejected this month.

Spread the news

Please share the news on other networks:

• Mastodon
• Movim
• Bluesky
• Reddit
• LinkedIn
• YouTube
• Lemmy instance (unofficial)
• XMPP Facebook page (unofficial)

Also check out our RSS Feed!

Looking for job offers or want to hire a professional consultant for your XMPP project? Visit our XMPP job board.

Newsletter Contributors & Translations

This is a community effort, and we would like to thank translators for their contributions. Volunteers and more languages are welcome! Translations of the XMPP Newsletter will be released here (with some delay):

• Contributors:

  • To this issue: emus, cal0pteryx, Gonzalo Raúl Nemmi, Ludovic Bocquet, anubis, Badri (badrihippo), XSF iTeam

• Translations:

  • French: Adrien Bourmault (neox), alkino, anubis, Arkem, Benoît Sibaud, mathieui, nyco, Pierre Jarillon, Ppjet6, Ysabeau
  • Italian: Mario Sabatino, Roberto Resoli

Help us to build the newsletter

This XMPP Newsletter is produced collaboratively by the XMPP community. Each month’s newsletter issue is drafted in this simple pad. At the end of each month, the pad’s content is merged into the XSF GitHub repository. We are always happy to welcome contributors. Do not hesitate to join the discussion in our XSF Communications Team group chat (MUC) and thereby help us sustain this as a community effort. You have a project and want to spread the news? Please consider sharing your news or events here, and promote it to a large audience.

Tasks we do on a regular basis:

• gathering news in the XMPP universe
• short summaries of news and events
• summary of the monthly communication on extensions (XEPs)
• review of the newsletter draft
• preparation of media images
• translations
• communication via media accounts

Unsubscribe from the XMPP Newsletter

For this newsletter either log in here and unsubscribe or simply send an email to newsletter-leave@xmpp.org. (If you have not previously logged in, you may need to set up an account with the appropriate email address.)

License

This newsletter is published under CC BY-SA license.

0.16.1 is our quick turnaround on that: a focused round offixes for the issues that have been reported, across encryption, connectivity,message history, and the desktop apps. Nothing dramatic here, we mainly want to show that we&aposre listening and addressing reported problems fast.

End-to-end encryption in daily use

With people now encrypting real conversations, a few practical details surfaced —and they&aposre sorted:

• Verification works across clients. Fingerprints are published and compared in a consistent case (XEP-0373 expects upper-case), so the green "verified" lock appears reliably whatever XMPP client your contact uses.
• Cleaner previews and placeholders. Encrypted reactions now show up properly in the conversation list, and you&aposll see a "decrypting…" placeholder while the encryption plugin finishes loading.
• Complete archive. Encrypted messages without a plaintext body now come through correctly from server history (MAM).

Smoother connections

Field reports pointed to a handful of connection scenarios, now improved:

• Happy Eyeballs. Fluux races IPv4 and IPv6 when connecting, so a slow or broken IPv6 route no longer holds things up, whichever answers first wins.
• More reliable reconnection. Stream Management handling and the desktop&aposs local proxy hop were both tuned to resolve reconnection cases users reported.
• Clearer status. Presence pills stay grey while reconnecting, and the reconnect spinner and countdown are back in the sidebar status chip for a calmer interface on unstable networks.

More complete message history

• Gap recovery. Some users reported missing stretches of history after long periods offline. Catch-up now closes those gaps in both group chats and 1:1 conversations, with a "load missing messages" marker to bring back anything that was skipped.
• Reliable scroll-up. Loading older history by scrolling up now works as expected.

A more polished desktop experience

• Notifications open the right chat. On macOS, clicking a notification takes you straight to the conversation it belongs to.
• Single window. Relaunching the app focuses the window that&aposs already running instead of opening a second copy.
• Linux tray fallback. When the system tray isn&apost available, closing the window quits the app, so it can always be reopened.
• Image downloads use the native save dialog, and Settings now links straight to your system notification settings.

Lots of smaller fixes

And plenty of smaller refinements from everyday use: consistent empty-state icons, reply quotes that match the original sender&aposs color and render as nested bars, opening a contact profile no longer bouncing you back, link-preview images that retry once before hiding, a smoother composer resize, local JID validation on the login screen, and group-chat performance improvements on room join.

Thanks to everyone who reported issues and shared feedback – that&aposs exactly what shapes a release like this one. 0.16.1 is available now on our website , and the full changelog is on GitHub . Keep the reports coming!

Beyond that headline, the release also ships whisper messages, offline compose, unread badges, and a significant render-performance pass. Here is what changed and why.

End-to-End Encryption with OpenPGP

When end-to-end encryption is on, your messages are scrambled on your device before they leave it. Your XMPP server relays ciphertext, but it cannot read your conversations, even if the server is compromised or an administrator goes looking. The same applies to any relay between servers.

Fluux implements OpenPGP for XMPP (XEP-0373, also called OX) — the modern redesign of OpenPGP encryption for XMPP. If you have come across XEP-0027 (the older "Current Jabber OpenPGP Usage"), that is a different, now-deprecated approach with well-documented weaknesses: no authenticated message envelope, signed-plaintext exposure, and no multi-device story. Fluux implements XEP-0373 only. It uses a proper content-encryption layer (XEP-0420) that authenticates the full message context and hides metadata from the server. It builds on the same OpenPGP cryptography used in encrypted email for decades, adapted correctly to instant messaging.

Once you enable encryption in Settings → Encryption, your key pair is generated and your public key is published to your server. From that point, whenever a contact also has encryption enabled, Fluux automatically starts encrypting messages to them. A lock icon above the composer confirms it. Nothing to configure per conversation.

Encrypted messages cover more than just text: reactions, edits, retractions, link previews, and file attachments all ride inside the same encrypted envelope. The server cannot see which emoji you reacted with, what you edited a message to say, or which files you shared.

Why OpenPGP first?

The choice of OpenPGP as the first E2EE protocol was deliberate, and it comes down to four practical properties.

Multi-device without friction. A single OpenPGP key pair works across all your devices. You generate it once; every device you add simply loads the same key. There is no per-device key negotiation, no session bootstrapping required before encrypted history loads. This stands in contrast to ratchet-based protocols that issue a key per client installation and require all clients to exchange session state before decryption is possible.

Encrypted backup you control. When you click Back up in the encryption settings, Fluux generates a backup code — 24 upper-case characters drawn from an unambiguous alphabet (no O or 0), grouped into 4-character chunks with dashes (e.g. TWNK-KD5Y-MT3T-E1GS-DRDB-KVTW). This format follows XEP-0373 §5.4 and is accepted by other compliant clients such as Gajim. Fluux encrypts your secret key with this code and stores the encrypted blob on your own XMPP server under a private node only you can access. The code never leaves your device.

Your full history stays readable. Because every device shares the same key, messages encrypted months ago on one device remain decryptable on another. The server&aposs message archive (MAM) becomes a true history, not a graveyard of ciphertext only the originating device can open. Outgoing messages are also encrypted to your own key, so your sent history is fully accessible on every device.

Simple, comprehensible verification. Trust On First Use (TOFU) gives you safe, convenient defaults. When you want a stronger guarantee, you compare fingerprints out-of-band, i.e. in person, over a phone call, on a separate verified channel. The fingerprint lives in the tooltip on the lock icon and in Settings → Encryption. You verify once per contact, per key, and you are done.

Whisper messages — private threads inside group chats

It is now possible to reply privately to a single occupant of a room without leaving the room. These whisper messages follow XEP-0045 §7.5 and appear in a distinct private thread so it is always clear they are not visible to the room at large.

Other improvements worth knowing

Compose while offline. Messages typed before a connection is established are queued locally and sent as soon as the session comes online.

Connection status banner. A banner now appears while the app is reconnecting, so you always know when you are temporarily offline rather than wondering whether a message failed to send.

Render-performance pass. This release eliminates a class of re-render storms that affected the conversation list, command palette, room config modals, occupant panel, roster, search, and individual message rows during background sync and group-chat presence churn. The result is a noticeably smoother experience on busy accounts.

XMPP Console cleanup. Stream Management packets are now hidden by default in the developer XMPP console. The toggle remains available for when you need to trace them.

What comes next for encryption

The encryption engine is a plugin layer sitting between the XMPP client and the UI. OpenPGP is the first plugin loaded into that framework. Adding a second protocol means writing a new plugin that implements the same interface: key management, encrypt, decrypt, trust state. The rest of the app — message routing, UI indicators, backup flow — does not need to change.

This matters because no single protocol wins every use case. OpenPGP&aposs shared-key model is ideal for multi-device history access; ratchet-based protocols like OMEMO excel at forward secrecy on single-device deployments; MLS is designed for large groups where pairwise key agreement would be impractical. The plan is to support several, letting users and deployments choose.

The framework is in place; the question is which protocol to add second. OMEMO (XEP-0384) is the most widely deployed XMPP encryption protocol today. Adding it would maximise interoperability with existing XMPP clients. MLS (RFC 9420) is the newer IETF standard, designed from the ground up for multi-device and group scenarios, and is where the industry is heading long term.

We have not decided yet. If you have a strong opinion, whether you are running an ejabberd deployment or just a user who cares, we would genuinely like to hear it. Just comment under that blog post.

Release notes and download

Full changelog on GitHub. Desktop builds for macOS, Windows, and Linux — plus the web version — are available on the ProcessOne website.

Over the past few months, our team has been exploring what happens when systems come under pressure.

Through a series of webinars, we’ve looked at everything from concurrency in the BEAM to traffic spikes, real-time communication platforms, and resilient system design.

Maybe you’ve been following along, or maybe one or two of these webinars slipped past you. Either way, this is a chance to catch up on the ideas shaping how modern platforms are built and scaled.

Concurrency, Understanding the BEAM Limits

Modern systems can handle huge amounts of concurrent work. But sooner or later, every system reaches a point where performance starts to suffer.

In “Concurrency, Understanding the BEAM Limits”, Lorena Mireles Rivero explores how concurrency works inside the BEAM and where those limits begin to appear. Using examples from web applications and e-commerce platforms, she looks at how schedulers, mailboxes, CPU usage, and latency behave under load.

The session also explores common signs of system saturation and practical ways to keep applications running smoothly as demand grows.

Watch the webinar to learn more about concurrency in the BEAM and how to build systems that perform under pressure.

Keeping Real-Time Communication Platforms Online During Peak Demand

Real-time platforms don’t get a second chance. When demand spikes, messages still need to be delivered instantly and reliably.

In this webinar, Bartłomiej Górny explores what happens when systems are pushed to their limits. He looks at common bottlenecks, overloaded services, and how failures can spread across a platform when demand suddenly increases.

The session also covers practical approaches to scaling real-time systems, from service decoupling and back pressure to monitoring and load testing.

Watch the webinar to learn how real-time platforms can stay reliable during periods of peak demand.

How to Build Systems That Stay Online When Everything Spikes

Traffic doesn’t always increase gradually. Sometimes it arrives all at once.

In this session, Camjar Djoweini explores what happens when systems come under sudden pressure and why failures can quickly spread across services. He looks at where problems typically start and what makes some architectures more resilient than others.

The webinar focuses on designing systems that can absorb spikes, tolerate failures, and continue operating when conditions become unpredictable.

Explore the webinar to learn more about building resilient systems that stay online under pressure.

How to Build Platforms That Don’t Let Audiences Down

For gaming, betting, and entertainment platforms, traffic spikes are part of everyday life. The challenge is making sure users never notice them.

In this webinar, Lee Sigauke explores why systems fail during sudden surges in demand and how teams can build platforms that remain reliable under pressure. Drawing on principles from transactional systems in Erlang and Elixir, she shows how concurrency-first design helps systems cope with unpredictable workloads.

The session covers common failure patterns, resilience at scale, and practical ways to build platforms that continue performing when demand reaches its peak.

Watch the webinar to see how concurrency-first design helps platforms remain reliable when traffic surges.

To conclude

That wraps up our latest webinar round-up. We hope this guide helps you catch up on some of the ideas we’ve been exploring over the past few months.

If something here has sparked your interest, whether it’s concurrency in the BEAM, building resilient architectures, or keeping platforms reliable during periods of peak demand, we’d love to continue the conversation. So get in touch.

Here’s to building systems that stay stable, scalable, and ready for whatever comes next.

The post Erlang Solutions Webinar Round-Up appeared first on Erlang Solutions .

Here is a new version for slixmpp, the python XMPP library.

This release has one specific breaking change and two new XEP plugins. Thanks to everyone involved!

We are pleased to announce a new minor release from our stable branch.

This release fixes a handful of bugs which were discovered and fixed since the 13.0.5 release. Most of these are minor, but a few of them are important fixes.

A summary of changes in this release:

Fixes and improvements

• mod_cloud_notify: Use correct stanza id when clearing table entries (mem leak)
• mod_admin_shell: Don’t echo new password back to the client
• util.pubsub: Remove JIDs not permitted to be subscribed on affiliation change (fixes #1709 )

Minor changes

• mod_account_activity: Don’t traceback when called without options
• util.jsonschema: Always accept 0 for multipleOf properties
• util.paths: Fix check for adding installer path to package.cpath
• util.datamanager: Fix listing of host stores
• util.crypto: Use post-Lua 5.1 buffer API for improved memory safety
• util.dataforms: Don’t treat invalid jid-multi fields as missing
• util.crypto: Ensure signing parameter is a string
• util.poll: Reject unsupported file descriptors when using select() backend
• util.pubsub: Ensure deleted node stays in memory store deletion failed
• util.ringbuffer: Fix incorrect returned position from :find() for #needle~=1
• util.pposix: Fix incorrect syslog facility mapping
• util.ringbuffer: find(): Fix find logic bugs
• util.signal: Fix signalfd closure on non-Linux systems
• net.websocket: Fix traceback in client if server doesn’t respond with Connection header
• net.server_event: Fix incorrect flag logic for watchfd handles
• mod_debug_stanzas: Only clear active_filters when there are no subscribers
• mod_carbons: Fix ‘to’ attribute of stanzas to own account
• net.stun: Fix parsing of STUN packets with 0-length attributes
• mod_storage_memory: Fix assignment to ‘with’ when calling archive:set()
• net.http.parser: Include final component in path normalization check
• mod_register_ibr: Use set_password() instead of create_user() for resets
• mod_vcard: Ignore invalid photo data
• util.timer: Fix incorrect rescheduling of some kinds of timers

Download

As usual, download instructions for many platforms can be found on our download page

If you have any questions, comments or other issues with this release, let us know!

Poezio is a terminal-based XMPP client which aims to replicate the feeling of terminal-based IRC clients such as irssi or weechat; to this end, poezio originally only supported multi-user chats and anonymous authentication.

This new release has mostly internal improvements, but a few improvements and fixes as well.

Thanks to all contributors and users!

% git diff --stat v0.17...v0.18
…
157 files changed, 5366 insertions(+), 3158 deletions(-)