• v2026.9.28 b32b8b55f2

    v2026.9.28
    All checks were successful
    CI / pre-commit (push) Successful in 2m8s
    CI / release-scripts (push) Successful in 17s
    publish-and-stage / decide (push) Successful in 11s
    security-scan / Python SCA (pip-audit) (push) Successful in 51s
    security-scan / Python SAST (bandit) (push) Successful in 31s
    security-scan / JS SCA (npm audit) (push) Successful in 34s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 23s
    CI / frontend-test (push) Successful in 4m59s
    security-scan / SBOM (trivy) (push) Successful in 17s
    tag-release / release (push) Successful in 12s
    release-and-deploy / release (push) Successful in 35s
    release-and-deploy / build (backend) (push) Successful in 2m41s
    release-and-deploy / build (frontend) (push) Successful in 2m31s
    release-and-deploy / build (push) Successful in 0s
    release-and-deploy / pre-commit (push) Successful in 2m18s
    publish-and-stage / build (backend) (push) Has been skipped
    publish-and-stage / build (frontend) (push) Has been skipped
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    release-and-deploy / backend-test (push) Successful in 1h37m6s
    release-and-deploy / release-scripts (push) Successful in 16s
    release-and-deploy / frontend-test (push) Successful in 3m44s
    release-and-deploy / e2e (push) Successful in 14m14s
    release-and-deploy / ci (push) Successful in 0s
    CI / backend-test (push) Successful in 15m16s
    release-and-deploy / deploy (push) Successful in 2m2s
    CI / e2e (push) Successful in 9m9s
    Stable

    Ghost released this 2026-09-28 20:46:38 +00:00 | 0 commits to main since this release

    Postvak & Meelezen

    • Attachments show as the same file cards as on a card: an HTML, PDF, text or
      video file opens in its preview instead of downloading.
    • The image viewer steps to the previous and next image of the message, also
      in the card's own message and its channel context.

    Container images

  • v2026.9.27.5 ea93b33ee7

    v2026.9.27.5
    All checks were successful
    CI / pre-commit (push) Successful in 2m20s
    security-scan / JS SCA (npm audit) (push) Successful in 33s
    CI / release-scripts (push) Successful in 18s
    publish-and-stage / decide (push) Successful in 10s
    security-scan / Python SCA (pip-audit) (push) Successful in 53s
    security-scan / Python SAST (bandit) (push) Successful in 35s
    CI / frontend-test (push) Successful in 5m14s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 25s
    tag-release / release (push) Successful in 12s
    security-scan / SBOM (trivy) (push) Successful in 17s
    release-and-deploy / release (push) Successful in 34s
    release-and-deploy / build (backend) (push) Successful in 2m44s
    release-and-deploy / build (frontend) (push) Successful in 2m30s
    release-and-deploy / build (push) Successful in 0s
    release-and-deploy / pre-commit (push) Successful in 2m20s
    release-and-deploy / frontend-test (push) Successful in 6m14s
    publish-and-stage / build (backend) (push) Has been skipped
    publish-and-stage / build (frontend) (push) Has been skipped
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    release-and-deploy / backend-test (push) Successful in 8m55s
    release-and-deploy / e2e (push) Successful in 8m37s
    release-and-deploy / release-scripts (push) Successful in 16s
    release-and-deploy / ci (push) Successful in 0s
    release-and-deploy / deploy (push) Successful in 1m38s
    CI / backend-test (push) Successful in 8m48s
    CI / e2e (push) Successful in 8m38s
    Stable

    Ghost released this 2026-09-27 19:03:59 +00:00 | 6 commits to main since this release

    Release notes

    • "Nieuw in Waggle" in the menu lists the release notes of every version,
      newest first.
    • The banner shows only what is new since your last visit, with a button
      to that page.

    Container images

  • v2026.9.27.4 e69976bec1

    v2026.9.27.4
    All checks were successful
    publish-and-stage / decide (push) Successful in 8s
    tag-release / release (push) Successful in 7s
    CI / release-scripts (push) Successful in 11s
    security-scan / SBOM (trivy) (push) Successful in 9s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 15s
    security-scan / JS SCA (npm audit) (push) Successful in 16s
    publish-and-stage / build (backend) (push) Has been skipped
    security-scan / Python SAST (bandit) (push) Successful in 18s
    publish-and-stage / build (frontend) (push) Has been skipped
    release-and-deploy / release (push) Successful in 18s
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    release-and-deploy / release-scripts (push) Successful in 11s
    security-scan / Python SCA (pip-audit) (push) Successful in 38s
    CI / pre-commit (push) Successful in 1m6s
    CI / frontend-test (push) Successful in 1m8s
    release-and-deploy / pre-commit (push) Successful in 1m7s
    release-and-deploy / frontend-test (push) Successful in 1m9s
    release-and-deploy / build (frontend) (push) Successful in 1m17s
    release-and-deploy / build (backend) (push) Successful in 1m25s
    release-and-deploy / build (push) Successful in 0s
    CI / backend-test (push) Successful in 3m53s
    release-and-deploy / backend-test (push) Successful in 3m49s
    CI / e2e (push) Successful in 5m32s
    release-and-deploy / e2e (push) Successful in 5m24s
    release-and-deploy / ci (push) Successful in 0s
    release-and-deploy / deploy (push) Successful in 1m18s
    Stable

    Ghost released this 2026-09-27 09:16:23 +00:00 | 11 commits to main since this release

    Release notes

    • Fixed: "Nieuw in Waggle" skipped a second release on the same day, so the
      note on following replies (27 september) never showed, and dismissing such
      a note would not have been saved.

    Container images

  • v2026.9.27.3 cb261f3960

    v2026.9.27.3
    Some checks failed
    publish-and-stage / decide (push) Successful in 8s
    tag-release / release (push) Successful in 8s
    CI / release-scripts (push) Successful in 12s
    security-scan / SBOM (trivy) (push) Successful in 10s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 14s
    security-scan / JS SCA (npm audit) (push) Successful in 15s
    publish-and-stage / build (frontend) (push) Has been skipped
    publish-and-stage / build (backend) (push) Has been skipped
    security-scan / Python SAST (bandit) (push) Successful in 17s
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    release-and-deploy / release (push) Successful in 21s
    release-and-deploy / release-scripts (push) Successful in 11s
    security-scan / Python SCA (pip-audit) (push) Successful in 36s
    release-and-deploy / backend-test (push) Failing after 33s
    CI / pre-commit (push) Successful in 1m5s
    CI / frontend-test (push) Successful in 1m6s
    release-and-deploy / pre-commit (push) Successful in 1m5s
    release-and-deploy / frontend-test (push) Successful in 1m5s
    release-and-deploy / build (frontend) (push) Successful in 1m17s
    release-and-deploy / build (backend) (push) Successful in 1m22s
    release-and-deploy / build (push) Successful in 0s
    CI / backend-test (push) Successful in 2m51s
    CI / e2e (push) Successful in 4m26s
    release-and-deploy / e2e (push) Successful in 4m21s
    release-and-deploy / ci (push) Failing after 0s
    release-and-deploy / deploy (push) Has been skipped
    Stable

    Ghost released this 2026-09-27 09:02:04 +00:00 | 13 commits to main since this release

    Postvak & Meelezen

    • "Volg antwoorden in dit kanaal automatisch" shows its new setting as soon
      as you pick it, and goes back if saving fails.

    Container images

  • v2026.9.27.2 aef1dd8946

    v2026.9.27.2
    All checks were successful
    publish-and-stage / decide (push) Successful in 7s
    tag-release / release (push) Successful in 7s
    security-scan / SBOM (trivy) (push) Successful in 9s
    CI / release-scripts (push) Successful in 10s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 13s
    publish-and-stage / build (backend) (push) Has been skipped
    security-scan / JS SCA (npm audit) (push) Successful in 14s
    publish-and-stage / build (frontend) (push) Has been skipped
    security-scan / Python SAST (bandit) (push) Successful in 16s
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    release-and-deploy / release (push) Successful in 20s
    release-and-deploy / release-scripts (push) Successful in 12s
    security-scan / Python SCA (pip-audit) (push) Successful in 36s
    CI / frontend-test (push) Successful in 1m2s
    CI / pre-commit (push) Successful in 1m6s
    release-and-deploy / pre-commit (push) Successful in 1m11s
    release-and-deploy / frontend-test (push) Successful in 1m8s
    release-and-deploy / build (frontend) (push) Successful in 1m17s
    release-and-deploy / build (backend) (push) Successful in 1m23s
    release-and-deploy / build (push) Successful in 0s
    CI / backend-test (push) Successful in 4m59s
    release-and-deploy / backend-test (push) Successful in 5m3s
    CI / e2e (push) Successful in 6m24s
    release-and-deploy / e2e (push) Successful in 6m22s
    release-and-deploy / ci (push) Successful in 0s
    release-and-deploy / deploy (push) Successful in 1m15s
    Stable

    Ghost released this 2026-09-27 08:19:32 +00:00 | 16 commits to main since this release

    Mentions

    • Fixed: an @-mention of someone outside the channel stayed plain text. It
      now shows their name and opens their profile card, as in Mattermost.

    Container images

  • v2026.9.27.1 6a1b0d9cef

    v2026.9.27.1
    All checks were successful
    publish-and-stage / decide (push) Successful in 7s
    tag-release / release (push) Successful in 6s
    CI / release-scripts (push) Successful in 11s
    security-scan / SBOM (trivy) (push) Successful in 9s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 14s
    security-scan / JS SCA (npm audit) (push) Successful in 14s
    publish-and-stage / build (frontend) (push) Has been skipped
    publish-and-stage / build (backend) (push) Has been skipped
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    security-scan / Python SAST (bandit) (push) Successful in 17s
    release-and-deploy / release (push) Successful in 17s
    release-and-deploy / release-scripts (push) Successful in 12s
    security-scan / Python SCA (pip-audit) (push) Successful in 35s
    CI / frontend-test (push) Successful in 1m6s
    release-and-deploy / build (frontend) (push) Successful in 1m18s
    release-and-deploy / frontend-test (push) Successful in 1m15s
    release-and-deploy / build (backend) (push) Successful in 1m28s
    release-and-deploy / build (push) Successful in 0s
    CI / pre-commit (push) Successful in 1m51s
    release-and-deploy / pre-commit (push) Successful in 1m50s
    CI / backend-test (push) Successful in 4m56s
    release-and-deploy / backend-test (push) Successful in 4m49s
    CI / e2e (push) Successful in 5m57s
    release-and-deploy / e2e (push) Successful in 5m56s
    release-and-deploy / ci (push) Successful in 0s
    release-and-deploy / deploy (push) Successful in 1m18s
    Stable

    Ghost released this 2026-09-27 07:52:58 +00:00 | 18 commits to main since this release

    Postvak & Meelezen

    • Under a message with replies you do not follow: "Toon N antwoorden", the
      time of the last reply and "Antwoorden volgen", as in Mattermost.
    • "Volg antwoorden in dit kanaal automatisch" in the row menu follows every
      thread in a channel.
    • Every thread folds with one button under its message and says how many
      replies are new; "Nieuw" marks the first one, and a long run of read
      replies folds into "Toon N eerdere antwoorden".

    Container images

  • v2026.9.27 5128c799f5

    v2026.9.27
    All checks were successful
    CI / pre-commit (push) Successful in 2m12s
    CI / release-scripts (push) Successful in 16s
    publish-and-stage / decide (push) Successful in 10s
    security-scan / Python SCA (pip-audit) (push) Successful in 49s
    security-scan / Python SAST (bandit) (push) Successful in 31s
    security-scan / JS SCA (npm audit) (push) Successful in 29s
    CI / frontend-test (push) Successful in 4m35s
    security-scan / SBOM (trivy) (push) Successful in 15s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 24s
    tag-release / release (push) Successful in 11s
    release-and-deploy / release (push) Successful in 33s
    release-and-deploy / build (backend) (push) Successful in 2m44s
    release-and-deploy / build (frontend) (push) Successful in 2m26s
    release-and-deploy / build (push) Successful in 0s
    release-and-deploy / pre-commit (push) Successful in 2m20s
    release-and-deploy / frontend-test (push) Successful in 5m48s
    publish-and-stage / build (backend) (push) Has been skipped
    publish-and-stage / build (frontend) (push) Has been skipped
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    release-and-deploy / release-scripts (push) Successful in 13s
    CI / backend-test (push) Successful in 2m46s
    CI / e2e (push) Successful in 5m30s
    release-and-deploy / e2e (push) Successful in 12m22s
    release-and-deploy / backend-test (push) Successful in 12m53s
    release-and-deploy / ci (push) Successful in 0s
    release-and-deploy / deploy (push) Successful in 1m31s
    Stable

    Ghost released this 2026-09-26 22:08:21 +00:00 | 23 commits to main since this release

    Status messages

    • A narrow orange bar at the top of every page says Waggle is a beta:
      "Bètaversie - Waggle is in ontwikkeling en kan fouten bevatten".
    • An outage ("Storing: Waggle is tijdelijk niet bereikbaar") is now a narrow
      bar at the top too, in NLDD's nldd-status-bar.
    • An expired Mattermost token, or no Mattermost account yet, now shows as an
      NLDD banner in the page with a button to Instellingen.

    Container images

  • v2026.9.26 72e4055f34

    v2026.9.26
    All checks were successful
    tag-release / release (push) Successful in 8s
    publish-and-stage / decide (push) Successful in 8s
    CI / release-scripts (push) Successful in 12s
    security-scan / SBOM (trivy) (push) Successful in 10s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 14s
    publish-and-stage / build (backend) (push) Has been skipped
    publish-and-stage / build (frontend) (push) Has been skipped
    security-scan / JS SCA (npm audit) (push) Successful in 18s
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    release-and-deploy / release-scripts (push) Successful in 11s
    security-scan / Python SAST (bandit) (push) Successful in 23s
    release-and-deploy / release (push) Successful in 21s
    security-scan / Python SCA (pip-audit) (push) Successful in 41s
    CI / frontend-test (push) Successful in 1m6s
    CI / pre-commit (push) Successful in 1m11s
    release-and-deploy / pre-commit (push) Successful in 1m10s
    release-and-deploy / frontend-test (push) Successful in 1m9s
    release-and-deploy / build (frontend) (push) Successful in 1m26s
    release-and-deploy / build (backend) (push) Successful in 1m30s
    release-and-deploy / build (push) Successful in 0s
    CI / backend-test (push) Successful in 3m58s
    release-and-deploy / backend-test (push) Successful in 3m56s
    CI / e2e (push) Successful in 6m11s
    release-and-deploy / e2e (push) Successful in 6m4s
    release-and-deploy / ci (push) Successful in 0s
    release-and-deploy / deploy (push) Successful in 1m31s
    Stable

    Ghost released this 2026-09-26 06:25:30 +00:00 | 34 commits to main since this release

    Notifications

    • Notifications are now NLDD's nldd-notification: top right, stacked as a
      deck, and 5 seconds for every message. Undo on sending and on throwing
      away a draft follows that, 5 seconds instead of 10. A failure stays until
      you close it.

    Postvak & Meelezen

    • Fixed on phones: no sideways scrolling, channel and author names stay
      readable, and the reply toolbar fits on one line with "Verzend".
    • Fixed: an @-mention stayed plain text. It now shows the person's name and
      opens their profile card, as on a card. The quoted message on a concept or a
      queued reply shows the name too.

    Profile card

    • "Stuur een bericht" on the profile card of an @-mention opens a new message
      to that person, with the cursor in the message.

    New message

    • Searching "Aan" puts the 1:1 conversation with someone first, then group
      conversations, then channels. A 1:1 is also found by its @username.

    Concepten, Uitgaande post, Notities

    • The empty state on these pages is NLDD's nldd-inline-dialog, the same one
      the reading list uses.

    Under the hood

    • NLDD design system 0.8.90 -> 0.8.92.
    • A failed login is audited once per reason and client address again, not once
      per reason for everyone: the address is now the router's, verified on
      staging and production. The per-window count of distinct addresses, which
      only served to spot a forged header, is gone.
    • All rendered markdown goes through one SafeMarkdown component, the app's
      only v-html; eslint now refuses v-html anywhere else.
    • A message can no longer draw a text field into Waggle: of <input>, only the
      task-list checkbox is kept, and it cannot be ticked.
    • The composer inserts at the caret and sets lists, tasks and headings with
      NLDD's own commands; "Takenlijst" now also works on a selection of lines.

    Container images

  • v2026.9.25 6eb84b1bae

    v2026.9.25
    All checks were successful
    publish-and-stage / build (frontend) (push) Has been skipped
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    release-and-deploy / release-scripts (push) Successful in 13s
    security-scan / Python SCA (pip-audit) (push) Successful in 42s
    CI / frontend-test (push) Successful in 1m11s
    CI / pre-commit (push) Successful in 1m19s
    release-and-deploy / pre-commit (push) Successful in 1m19s
    release-and-deploy / frontend-test (push) Successful in 1m15s
    release-and-deploy / build (push) Successful in 0s
    release-and-deploy / build (frontend) (push) Successful in 1m27s
    release-and-deploy / build (backend) (push) Successful in 1m36s
    CI / backend-test (push) Successful in 4m15s
    CI / e2e (push) Successful in 5m40s
    release-and-deploy / e2e (push) Successful in 5m31s
    release-and-deploy / ci (push) Successful in 0s
    release-and-deploy / backend-test (push) Successful in 4m6s
    release-and-deploy / deploy (push) Successful in 1m29s
    publish-and-stage / decide (push) Successful in 6s
    tag-release / release (push) Successful in 7s
    CI / release-scripts (push) Successful in 12s
    security-scan / SBOM (trivy) (push) Successful in 11s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 18s
    security-scan / JS SCA (npm audit) (push) Successful in 20s
    publish-and-stage / build (backend) (push) Has been skipped
    security-scan / Python SAST (bandit) (push) Successful in 23s
    release-and-deploy / release (push) Successful in 21s
    Stable

    Ghost released this 2026-09-25 05:49:47 +00:00 | 50 commits to main since this release

    Postvak & Meelezen

    • "Tot hier gelezen" no longer makes "Toon eerdere berichten" and the end of
      the row look like they are loading; they wait until it is done. "Toon
      eerdere berichten" says "Eerdere berichten laden..." instead of a spinner.

    Container images

  • v2026.9.24 471fe907b9

    v2026.9.24
    All checks were successful
    publish-and-stage / decide (push) Successful in 9s
    CI / release-scripts (push) Successful in 12s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 19s
    tag-release / release (push) Successful in 10s
    security-scan / SBOM (trivy) (push) Successful in 12s
    security-scan / JS SCA (npm audit) (push) Successful in 22s
    security-scan / Python SAST (bandit) (push) Successful in 23s
    publish-and-stage / build (backend) (push) Has been skipped
    release-and-deploy / release (push) Successful in 22s
    publish-and-stage / build (frontend) (push) Has been skipped
    publish-and-stage / build (push) Successful in 0s
    publish-and-stage / deploy-staging (push) Has been skipped
    release-and-deploy / release-scripts (push) Successful in 14s
    security-scan / Python SCA (pip-audit) (push) Successful in 43s
    CI / frontend-test (push) Successful in 1m24s
    CI / pre-commit (push) Successful in 1m27s
    release-and-deploy / frontend-test (push) Successful in 1m27s
    release-and-deploy / pre-commit (push) Successful in 1m29s
    release-and-deploy / build (frontend) (push) Successful in 1m45s
    release-and-deploy / build (backend) (push) Successful in 1m53s
    release-and-deploy / build (push) Successful in 0s
    CI / backend-test (push) Successful in 5m33s
    release-and-deploy / backend-test (push) Successful in 5m21s
    release-and-deploy / e2e (push) Successful in 6m27s
    release-and-deploy / ci (push) Successful in 0s
    CI / e2e (push) Successful in 7m9s
    release-and-deploy / deploy (push) Successful in 1m51s
    Stable

    Ghost released this 2026-09-24 21:18:27 +00:00 | 53 commits to main since this release

    Postvak & Meelezen

    • Fixed: "Toon eerdere berichten" and "Toon N eerdere antwoorden" scrolled the
      page up; the message you were reading now stays where it was.
    • "Tot hier gelezen" shows it is busy until the row has updated, and a row
      read to the end hands focus to the next one.
    • Fixed: "Tot hier gelezen" stayed disabled after a deleted message or below a
      very long one.
    • Fixed: a muted channel with a mention opened empty.

    Under the hood

    • The client address is the one the ZAD router appends to X-Forwarded-For,
      not the one the caller wrote: the app counts proxy hops
      (WAGGLE_TRUSTED_PROXY_HOPS, image default 1) instead of uvicorn's
      --forwarded-allow-ips, which ZAD had at *.

    Container images