-
v2026.9.28
StableAll checks were successfulCI / pre-commit (push) Successful in 2m8sCI / release-scripts (push) Successful in 17spublish-and-stage / decide (push) Successful in 11ssecurity-scan / Python SCA (pip-audit) (push) Successful in 51ssecurity-scan / Python SAST (bandit) (push) Successful in 31ssecurity-scan / JS SCA (npm audit) (push) Successful in 34ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 23sCI / frontend-test (push) Successful in 4m59ssecurity-scan / SBOM (trivy) (push) Successful in 17stag-release / release (push) Successful in 12srelease-and-deploy / release (push) Successful in 35srelease-and-deploy / build (backend) (push) Successful in 2m41srelease-and-deploy / build (frontend) (push) Successful in 2m31srelease-and-deploy / build (push) Successful in 0srelease-and-deploy / pre-commit (push) Successful in 2m18spublish-and-stage / build (backend) (push) Has been skippedpublish-and-stage / build (frontend) (push) Has been skippedpublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedrelease-and-deploy / backend-test (push) Successful in 1h37m6srelease-and-deploy / release-scripts (push) Successful in 16srelease-and-deploy / frontend-test (push) Successful in 3m44srelease-and-deploy / e2e (push) Successful in 14m14srelease-and-deploy / ci (push) Successful in 0sCI / backend-test (push) Successful in 15m16srelease-and-deploy / deploy (push) Successful in 2m2sCI / e2e (push) Successful in 9m9sreleased this
2026-09-28 20:46:38 +00:00 | 0 commits to main since this releasePostvak & Meelezen
- Attachments show as the same file cards as on a card: an HTML, PDF, text or
video file opens in its preview instead of downloading. - The image viewer steps to the previous and next image of the message, also
in the card's own message and its channel context.
Container images
- Attachments show as the same file cards as on a card: an HTML, PDF, text or
-
v2026.9.27.5
StableAll checks were successfulCI / pre-commit (push) Successful in 2m20ssecurity-scan / JS SCA (npm audit) (push) Successful in 33sCI / release-scripts (push) Successful in 18spublish-and-stage / decide (push) Successful in 10ssecurity-scan / Python SCA (pip-audit) (push) Successful in 53ssecurity-scan / Python SAST (bandit) (push) Successful in 35sCI / frontend-test (push) Successful in 5m14ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 25stag-release / release (push) Successful in 12ssecurity-scan / SBOM (trivy) (push) Successful in 17srelease-and-deploy / release (push) Successful in 34srelease-and-deploy / build (backend) (push) Successful in 2m44srelease-and-deploy / build (frontend) (push) Successful in 2m30srelease-and-deploy / build (push) Successful in 0srelease-and-deploy / pre-commit (push) Successful in 2m20srelease-and-deploy / frontend-test (push) Successful in 6m14spublish-and-stage / build (backend) (push) Has been skippedpublish-and-stage / build (frontend) (push) Has been skippedpublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedrelease-and-deploy / backend-test (push) Successful in 8m55srelease-and-deploy / e2e (push) Successful in 8m37srelease-and-deploy / release-scripts (push) Successful in 16srelease-and-deploy / ci (push) Successful in 0srelease-and-deploy / deploy (push) Successful in 1m38sCI / backend-test (push) Successful in 8m48sCI / e2e (push) Successful in 8m38sreleased this
2026-09-27 19:03:59 +00:00 | 6 commits to main since this releaseRelease notes
- "Nieuw in Waggle" in the menu lists the release notes of every version,
newest first. - The banner shows only what is new since your last visit, with a button
to that page.
Container images
- "Nieuw in Waggle" in the menu lists the release notes of every version,
-
v2026.9.27.4
StableAll checks were successfulpublish-and-stage / decide (push) Successful in 8stag-release / release (push) Successful in 7sCI / release-scripts (push) Successful in 11ssecurity-scan / SBOM (trivy) (push) Successful in 9ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 15ssecurity-scan / JS SCA (npm audit) (push) Successful in 16spublish-and-stage / build (backend) (push) Has been skippedsecurity-scan / Python SAST (bandit) (push) Successful in 18spublish-and-stage / build (frontend) (push) Has been skippedrelease-and-deploy / release (push) Successful in 18spublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedrelease-and-deploy / release-scripts (push) Successful in 11ssecurity-scan / Python SCA (pip-audit) (push) Successful in 38sCI / pre-commit (push) Successful in 1m6sCI / frontend-test (push) Successful in 1m8srelease-and-deploy / pre-commit (push) Successful in 1m7srelease-and-deploy / frontend-test (push) Successful in 1m9srelease-and-deploy / build (frontend) (push) Successful in 1m17srelease-and-deploy / build (backend) (push) Successful in 1m25srelease-and-deploy / build (push) Successful in 0sCI / backend-test (push) Successful in 3m53srelease-and-deploy / backend-test (push) Successful in 3m49sCI / e2e (push) Successful in 5m32srelease-and-deploy / e2e (push) Successful in 5m24srelease-and-deploy / ci (push) Successful in 0srelease-and-deploy / deploy (push) Successful in 1m18sreleased this
2026-09-27 09:16:23 +00:00 | 11 commits to main since this releaseRelease notes
- Fixed: "Nieuw in Waggle" skipped a second release on the same day, so the
note on following replies (27 september) never showed, and dismissing such
a note would not have been saved.
Container images
- Fixed: "Nieuw in Waggle" skipped a second release on the same day, so the
-
v2026.9.27.3
StableSome checks failedpublish-and-stage / decide (push) Successful in 8stag-release / release (push) Successful in 8sCI / release-scripts (push) Successful in 12ssecurity-scan / SBOM (trivy) (push) Successful in 10ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 14ssecurity-scan / JS SCA (npm audit) (push) Successful in 15spublish-and-stage / build (frontend) (push) Has been skippedpublish-and-stage / build (backend) (push) Has been skippedsecurity-scan / Python SAST (bandit) (push) Successful in 17spublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedrelease-and-deploy / release (push) Successful in 21srelease-and-deploy / release-scripts (push) Successful in 11ssecurity-scan / Python SCA (pip-audit) (push) Successful in 36srelease-and-deploy / backend-test (push) Failing after 33sCI / pre-commit (push) Successful in 1m5sCI / frontend-test (push) Successful in 1m6srelease-and-deploy / pre-commit (push) Successful in 1m5srelease-and-deploy / frontend-test (push) Successful in 1m5srelease-and-deploy / build (frontend) (push) Successful in 1m17srelease-and-deploy / build (backend) (push) Successful in 1m22srelease-and-deploy / build (push) Successful in 0sCI / backend-test (push) Successful in 2m51sCI / e2e (push) Successful in 4m26srelease-and-deploy / e2e (push) Successful in 4m21srelease-and-deploy / ci (push) Failing after 0srelease-and-deploy / deploy (push) Has been skippedreleased this
2026-09-27 09:02:04 +00:00 | 13 commits to main since this releasePostvak & Meelezen
- "Volg antwoorden in dit kanaal automatisch" shows its new setting as soon
as you pick it, and goes back if saving fails.
Container images
- "Volg antwoorden in dit kanaal automatisch" shows its new setting as soon
-
v2026.9.27.2
StableAll checks were successfulpublish-and-stage / decide (push) Successful in 7stag-release / release (push) Successful in 7ssecurity-scan / SBOM (trivy) (push) Successful in 9sCI / release-scripts (push) Successful in 10ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 13spublish-and-stage / build (backend) (push) Has been skippedsecurity-scan / JS SCA (npm audit) (push) Successful in 14spublish-and-stage / build (frontend) (push) Has been skippedsecurity-scan / Python SAST (bandit) (push) Successful in 16spublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedrelease-and-deploy / release (push) Successful in 20srelease-and-deploy / release-scripts (push) Successful in 12ssecurity-scan / Python SCA (pip-audit) (push) Successful in 36sCI / frontend-test (push) Successful in 1m2sCI / pre-commit (push) Successful in 1m6srelease-and-deploy / pre-commit (push) Successful in 1m11srelease-and-deploy / frontend-test (push) Successful in 1m8srelease-and-deploy / build (frontend) (push) Successful in 1m17srelease-and-deploy / build (backend) (push) Successful in 1m23srelease-and-deploy / build (push) Successful in 0sCI / backend-test (push) Successful in 4m59srelease-and-deploy / backend-test (push) Successful in 5m3sCI / e2e (push) Successful in 6m24srelease-and-deploy / e2e (push) Successful in 6m22srelease-and-deploy / ci (push) Successful in 0srelease-and-deploy / deploy (push) Successful in 1m15sreleased this
2026-09-27 08:19:32 +00:00 | 16 commits to main since this releaseMentions
- Fixed: an @-mention of someone outside the channel stayed plain text. It
now shows their name and opens their profile card, as in Mattermost.
Container images
- Fixed: an @-mention of someone outside the channel stayed plain text. It
-
v2026.9.27.1
StableAll checks were successfulpublish-and-stage / decide (push) Successful in 7stag-release / release (push) Successful in 6sCI / release-scripts (push) Successful in 11ssecurity-scan / SBOM (trivy) (push) Successful in 9ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 14ssecurity-scan / JS SCA (npm audit) (push) Successful in 14spublish-and-stage / build (frontend) (push) Has been skippedpublish-and-stage / build (backend) (push) Has been skippedpublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedsecurity-scan / Python SAST (bandit) (push) Successful in 17srelease-and-deploy / release (push) Successful in 17srelease-and-deploy / release-scripts (push) Successful in 12ssecurity-scan / Python SCA (pip-audit) (push) Successful in 35sCI / frontend-test (push) Successful in 1m6srelease-and-deploy / build (frontend) (push) Successful in 1m18srelease-and-deploy / frontend-test (push) Successful in 1m15srelease-and-deploy / build (backend) (push) Successful in 1m28srelease-and-deploy / build (push) Successful in 0sCI / pre-commit (push) Successful in 1m51srelease-and-deploy / pre-commit (push) Successful in 1m50sCI / backend-test (push) Successful in 4m56srelease-and-deploy / backend-test (push) Successful in 4m49sCI / e2e (push) Successful in 5m57srelease-and-deploy / e2e (push) Successful in 5m56srelease-and-deploy / ci (push) Successful in 0srelease-and-deploy / deploy (push) Successful in 1m18sreleased this
2026-09-27 07:52:58 +00:00 | 18 commits to main since this releasePostvak & Meelezen
- Under a message with replies you do not follow: "Toon N antwoorden", the
time of the last reply and "Antwoorden volgen", as in Mattermost. - "Volg antwoorden in dit kanaal automatisch" in the row menu follows every
thread in a channel. - Every thread folds with one button under its message and says how many
replies are new; "Nieuw" marks the first one, and a long run of read
replies folds into "Toon N eerdere antwoorden".
Container images
- Under a message with replies you do not follow: "Toon N antwoorden", the
-
v2026.9.27
StableAll checks were successfulCI / pre-commit (push) Successful in 2m12sCI / release-scripts (push) Successful in 16spublish-and-stage / decide (push) Successful in 10ssecurity-scan / Python SCA (pip-audit) (push) Successful in 49ssecurity-scan / Python SAST (bandit) (push) Successful in 31ssecurity-scan / JS SCA (npm audit) (push) Successful in 29sCI / frontend-test (push) Successful in 4m35ssecurity-scan / SBOM (trivy) (push) Successful in 15ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 24stag-release / release (push) Successful in 11srelease-and-deploy / release (push) Successful in 33srelease-and-deploy / build (backend) (push) Successful in 2m44srelease-and-deploy / build (frontend) (push) Successful in 2m26srelease-and-deploy / build (push) Successful in 0srelease-and-deploy / pre-commit (push) Successful in 2m20srelease-and-deploy / frontend-test (push) Successful in 5m48spublish-and-stage / build (backend) (push) Has been skippedpublish-and-stage / build (frontend) (push) Has been skippedpublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedrelease-and-deploy / release-scripts (push) Successful in 13sCI / backend-test (push) Successful in 2m46sCI / e2e (push) Successful in 5m30srelease-and-deploy / e2e (push) Successful in 12m22srelease-and-deploy / backend-test (push) Successful in 12m53srelease-and-deploy / ci (push) Successful in 0srelease-and-deploy / deploy (push) Successful in 1m31sreleased this
2026-09-26 22:08:21 +00:00 | 23 commits to main since this releaseStatus messages
- A narrow orange bar at the top of every page says Waggle is a beta:
"Bètaversie - Waggle is in ontwikkeling en kan fouten bevatten". - An outage ("Storing: Waggle is tijdelijk niet bereikbaar") is now a narrow
bar at the top too, in NLDD'snldd-status-bar. - An expired Mattermost token, or no Mattermost account yet, now shows as an
NLDD banner in the page with a button to Instellingen.
Container images
- A narrow orange bar at the top of every page says Waggle is a beta:
-
v2026.9.26
StableAll checks were successfultag-release / release (push) Successful in 8spublish-and-stage / decide (push) Successful in 8sCI / release-scripts (push) Successful in 12ssecurity-scan / SBOM (trivy) (push) Successful in 10ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 14spublish-and-stage / build (backend) (push) Has been skippedpublish-and-stage / build (frontend) (push) Has been skippedsecurity-scan / JS SCA (npm audit) (push) Successful in 18spublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedrelease-and-deploy / release-scripts (push) Successful in 11ssecurity-scan / Python SAST (bandit) (push) Successful in 23srelease-and-deploy / release (push) Successful in 21ssecurity-scan / Python SCA (pip-audit) (push) Successful in 41sCI / frontend-test (push) Successful in 1m6sCI / pre-commit (push) Successful in 1m11srelease-and-deploy / pre-commit (push) Successful in 1m10srelease-and-deploy / frontend-test (push) Successful in 1m9srelease-and-deploy / build (frontend) (push) Successful in 1m26srelease-and-deploy / build (backend) (push) Successful in 1m30srelease-and-deploy / build (push) Successful in 0sCI / backend-test (push) Successful in 3m58srelease-and-deploy / backend-test (push) Successful in 3m56sCI / e2e (push) Successful in 6m11srelease-and-deploy / e2e (push) Successful in 6m4srelease-and-deploy / ci (push) Successful in 0srelease-and-deploy / deploy (push) Successful in 1m31sreleased this
2026-09-26 06:25:30 +00:00 | 34 commits to main since this releaseNotifications
- Notifications are now NLDD's
nldd-notification: top right, stacked as a
deck, and 5 seconds for every message. Undo on sending and on throwing
away a draft follows that, 5 seconds instead of 10. A failure stays until
you close it.
Postvak & Meelezen
- Fixed on phones: no sideways scrolling, channel and author names stay
readable, and the reply toolbar fits on one line with "Verzend". - Fixed: an @-mention stayed plain text. It now shows the person's name and
opens their profile card, as on a card. The quoted message on a concept or a
queued reply shows the name too.
Profile card
- "Stuur een bericht" on the profile card of an @-mention opens a new message
to that person, with the cursor in the message.
New message
- Searching "Aan" puts the 1:1 conversation with someone first, then group
conversations, then channels. A 1:1 is also found by its @username.
Concepten, Uitgaande post, Notities
- The empty state on these pages is NLDD's
nldd-inline-dialog, the same one
the reading list uses.
Under the hood
- NLDD design system 0.8.90 -> 0.8.92.
- A failed login is audited once per reason and client address again, not once
per reason for everyone: the address is now the router's, verified on
staging and production. The per-window count of distinct addresses, which
only served to spot a forged header, is gone. - All rendered markdown goes through one
SafeMarkdowncomponent, the app's
onlyv-html; eslint now refusesv-htmlanywhere else. - A message can no longer draw a text field into Waggle: of
<input>, only the
task-list checkbox is kept, and it cannot be ticked. - The composer inserts at the caret and sets lists, tasks and headings with
NLDD's own commands; "Takenlijst" now also works on a selection of lines.
Container images
- Notifications are now NLDD's
-
v2026.9.25
StableAll checks were successfulpublish-and-stage / build (frontend) (push) Has been skippedpublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedrelease-and-deploy / release-scripts (push) Successful in 13ssecurity-scan / Python SCA (pip-audit) (push) Successful in 42sCI / frontend-test (push) Successful in 1m11sCI / pre-commit (push) Successful in 1m19srelease-and-deploy / pre-commit (push) Successful in 1m19srelease-and-deploy / frontend-test (push) Successful in 1m15srelease-and-deploy / build (push) Successful in 0srelease-and-deploy / build (frontend) (push) Successful in 1m27srelease-and-deploy / build (backend) (push) Successful in 1m36sCI / backend-test (push) Successful in 4m15sCI / e2e (push) Successful in 5m40srelease-and-deploy / e2e (push) Successful in 5m31srelease-and-deploy / ci (push) Successful in 0srelease-and-deploy / backend-test (push) Successful in 4m6srelease-and-deploy / deploy (push) Successful in 1m29spublish-and-stage / decide (push) Successful in 6stag-release / release (push) Successful in 7sCI / release-scripts (push) Successful in 12ssecurity-scan / SBOM (trivy) (push) Successful in 11ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 18ssecurity-scan / JS SCA (npm audit) (push) Successful in 20spublish-and-stage / build (backend) (push) Has been skippedsecurity-scan / Python SAST (bandit) (push) Successful in 23srelease-and-deploy / release (push) Successful in 21sreleased this
2026-09-25 05:49:47 +00:00 | 50 commits to main since this releasePostvak & Meelezen
- "Tot hier gelezen" no longer makes "Toon eerdere berichten" and the end of
the row look like they are loading; they wait until it is done. "Toon
eerdere berichten" says "Eerdere berichten laden..." instead of a spinner.
Container images
- "Tot hier gelezen" no longer makes "Toon eerdere berichten" and the end of
-
v2026.9.24
StableAll checks were successfulpublish-and-stage / decide (push) Successful in 9sCI / release-scripts (push) Successful in 12ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 19stag-release / release (push) Successful in 10ssecurity-scan / SBOM (trivy) (push) Successful in 12ssecurity-scan / JS SCA (npm audit) (push) Successful in 22ssecurity-scan / Python SAST (bandit) (push) Successful in 23spublish-and-stage / build (backend) (push) Has been skippedrelease-and-deploy / release (push) Successful in 22spublish-and-stage / build (frontend) (push) Has been skippedpublish-and-stage / build (push) Successful in 0spublish-and-stage / deploy-staging (push) Has been skippedrelease-and-deploy / release-scripts (push) Successful in 14ssecurity-scan / Python SCA (pip-audit) (push) Successful in 43sCI / frontend-test (push) Successful in 1m24sCI / pre-commit (push) Successful in 1m27srelease-and-deploy / frontend-test (push) Successful in 1m27srelease-and-deploy / pre-commit (push) Successful in 1m29srelease-and-deploy / build (frontend) (push) Successful in 1m45srelease-and-deploy / build (backend) (push) Successful in 1m53srelease-and-deploy / build (push) Successful in 0sCI / backend-test (push) Successful in 5m33srelease-and-deploy / backend-test (push) Successful in 5m21srelease-and-deploy / e2e (push) Successful in 6m27srelease-and-deploy / ci (push) Successful in 0sCI / e2e (push) Successful in 7m9srelease-and-deploy / deploy (push) Successful in 1m51sreleased this
2026-09-24 21:18:27 +00:00 | 53 commits to main since this releasePostvak & Meelezen
- Fixed: "Toon eerdere berichten" and "Toon N eerdere antwoorden" scrolled the
page up; the message you were reading now stays where it was. - "Tot hier gelezen" shows it is busy until the row has updated, and a row
read to the end hands focus to the next one. - Fixed: "Tot hier gelezen" stayed disabled after a deleted message or below a
very long one. - Fixed: a muted channel with a mention opened empty.
Under the hood
- The client address is the one the ZAD router appends to
X-Forwarded-For,
not the one the caller wrote: the app counts proxy hops
(WAGGLE_TRUSTED_PROXY_HOPS, image default 1) instead of uvicorn's
--forwarded-allow-ips, which ZAD had at*.
Container images
- Fixed: "Toon eerdere berichten" and "Toon N eerdere antwoorden" scrolled the