[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/m1k1o/neko/firefox	minor	3.1.5 → 3.2.0

---

Release Notes

m1k1o/neko (ghcr.io/m1k1o/neko/firefox)

v3.2.0: n.eko v3.2.0

Compare Source

New Features

• Replaced the Vue 2 web client with a React 19 and TypeScript client built with Vite. It keeps the familiar layout and workflows: login and invite links, OAuth, video controls, fullscreen and Picture-in-Picture, clipboard, control handoff, microphone, emotes, chat, file transfer, settings, broadcast, member actions, and all 15 translations and URL parameters (#​713).
• Added a framework-free TypeScript client core, client/core (@m1k1o/neko), with authentication, room state and events, a pluggable stream transport, WebRTC, typed input channels, and the keyboard/mouse/touch overlay. It can be used independently of the React GUI or embedded in another framework (#​713).
• The client detects silent websocket connections, reconnects with backoff, and requests a replacement media peer when WebRTC fails. The stream can continue through a signalling outage, and playback resumes after reconnection (#​713).
• Added binary WebRTC data-channel input with websocket control-event fallback for transports without their own input channel. The client also handles IME and on-screen keyboard text as key events; Ctrl+V uses whichever clipboard was changed most recently (#​713).
• Chat now renders CommonMark and GitHub Flavored Markdown, including tables, lists, and nested quotes. Links are limited to HTTP, HTTPS, and mailto; HTML and images are not rendered. The new renderer replaces the hand-written parser and keeps hostile or oversized messages from stalling the chat (#​713).

Fixes

• Bound each OAuth authorization state to a short-lived, HttpOnly browser cookie, preventing a callback URL from creating a session in a browser that did not start the login. Concurrent login flows and explicit reverse-proxy redirects are supported (#​708).
• Fixed session and member IDs containing URL path characters. The multiuser and noauth providers now use sanitized IDs while preserving the display name; unsafe usernames submitted through POST /api/members are rejected (#​712).
• Fixed a server panic when video pipelines were configured without explicit video IDs, and when no video stream was available (#​711).
• Fixed slow WebRTC video timestamps under load, which could make browser buffers grow and audio/video drift. Generated pipelines also keep only the newest raw frame when an encoder falls behind, reducing input latency instead of accumulating stale frames (#​712).
• Fixed the client leaving a user at the disconnected screen when the server rejects a banned session, and hiding the microphone control when the browser does not support media capture (#​713).
• Internal websocket connections without an Origin header are now accepted, allowing trusted server-side websocket dials (#​710).

Changes

• The React client uses the v3 API only and works with NEKO_LEGACY=false. It no longer supports legacy v2-only behavior, including IP bans; kick removes the session, and the user may log in again (#​713).
• Added chat.max_length (default 512 characters; 0 disables the limit). Longer messages receive HTTP 400 through REST and are dropped over the websocket. Incoming websocket frames are limited to 1 MiB (#​712).
• Added the neko_capture_streamsink_frames metric to show when a video pipeline produces fewer frames than its configured frame rate (#​712).
• The default video pipeline no longer draws the mouse pointer into the stream; the client draws it without the stream delay. Set capture.video.show_pointer to true to restore the old behavior (#​713).
• Scroll sensitivity uses the v3 scale (-5 to 5), with the ?scroll URL parameter mapped to it. File downloads are streamed instead of buffered in memory. The microphone turns off when the connection is re-established, and opening a second tab takes over the session (#​713).
• The client uses the system font stack instead of Whitney and renders emoji as native characters rather than a sprite sheet (#​713).

v3.1.6: n.eko v3.1.6

Compare Source

New Features

• Added a capture subscription API to support more transports (#​699).
• Added support for restricting OAuth login by user email, along with a new email OAuth scope.
• Added OIDC-only member authentication (#​686).
• Enabled automatic video quality (bandwidth estimation) for legacy (v2) clients (#​693).
• Added a mouse pointer visibility toggle via capture.video.show_pointer (#​691).
• Added multi-file selection and bulk deletion to file transfer (#​687).
• Added file deletion support and a user delete config option to file transfer (#​683).
• Added a ?scroll query param to set scroll sensitivity on load (#​681).
• Added an arm64 Google Chrome image (#​685).
• Added example Docker Compose configurations for simple browser, TURN server, GPU-accelerated browser, and OAuth setups (#​684).
• Added an "open in app" plugin to open chat links in a shared neko instance (#​682).

Fixes

• Fixed missing clipboard fallback button in Safari (#​709).
• Fixed a XSS vulnerability by sanitizing attribute values and preventing Vue template compilation in rendered markdown.
• Fixed video pipeline configuration to accept a bare pipeline string (#​701).
• Fixed a goroutine leak in the RTCP PLI ticker (#​697).
• Fixed a memory leak by freeing CString allocations and GFile references in drag URI handling (#​700).
• Fixed a nil pointer panic when destroying the WebRTC peer during a profile change (#​695).
• Fixed file transfer to allow non-admin uploads and downloads (#​679).
• Fixed the TOR browser image to fetch it from the latest download source.

Misc

• Removed the default configuration file bundled with the image; defaults are now built into the server, preventing accidental overrides when providing a custom config.
• Updated persistent data policies for Firefox-based browsers.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[xRahul]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 9d7cd350-0114-4053-a23e-b043d310e104

📥 Commits

Reviewing files that changed from the base of the PR and between c36b9e4 and ef80b21.

📒 Files selected for processing: 1

• docker-compose.yml

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The Firefox service in docker-compose.yml now uses the Neko Firefox image tagged 3.2.0 instead of 3.1.5.

Changes: Firefox image update

Layer / File(s)	Summary
Update Firefox image tag docker-compose.yml	The Firefox service image tag changes from 3.1.5 to 3.2.0.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: xrahul

Merge Risk: ⚪ Minimal · up to ef80b

The Firefox service uses a published image tag; no merge-blocking risk from this update remains.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the Docker image tag update from 3.1.5 to 3.2.0 shown in docker-compose.yml.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}