4.5.0 taught the server to make its certificate itself, but Start Haven.bat, Install Haven.ps1 and the web installer still went looking for openssl.exe first and reported a skipped certificate as done. They now call the same generator through scripts/gen-cert.js, the certificate carries the CA and server-auth flags phones expect when you import it, and the guide and support page stop telling people to install OpenSSL. Reported by MutantRabbit767.
- Sidebar panel no longer auto-opens on app launch when sidebar mode was
previously enabled. Panel always starts hidden; the toggle arrow on the
right edge must be clicked to open it.
- Manage tab: custom sounds now appear above built-in sounds.
- Manage tab: both sections (CUSTOM and BUILT-IN) are now collapsible
via native <details>/<summary> elements.
- Soundboard tile eye icon changed from display:none/inline to
visibility:hidden/visible so it always occupies space. Hovering no
longer shifts the tile content.
- Disabling sidebar mode now closes the panel immediately rather than
leaving it open in the background.
- Soundboard sidebar collapse now shrinks the panel to header height only
(bottom: auto when collapsed) so the whole panel folds up, not just the
sound grid.
- Users/voice sidebar collapse arrow repositioned to vertical center
(top: 50% / translateY(-50%) instead of fixed top: 56px).
- Built-in sounds (AOL set) can now be removed from the admin Manage tab.
Deleting a built-in adds it to a new disabled_builtin_sounds DB table
so it no longer appears in the soundboard or event-assign selects.
- Removed the lock icon on built-in sounds and gave them a delete button.
- Fixed garbled emoji characters (pencil and trash can) in the Manage tab
caused by double-encoded UTF-8 bytes; replaced with HTML entity forms
that are immune to encoding corruption.
Restored ~70 corrupted emojis across docs/index.html and website/index.html (matched contextually: nav, hero, channel-code, platform tags, feature icons, footer).
Added four-layer prevention so this doesn't ship again:
- UTF-8 BOM on the landing pages (first 3 bytes EF BB BF)
- .editorconfig pinning charset=utf-8-bom for docs/website index + support
- .gitattributes working-tree-encoding=UTF-8 for landing pages, CHANGELOG, README, GUIDE
- scripts/fix-emoji-encoding.py reusable repair script
Verified hashes match between docs and website copies. Google Ads tag AW-17950126697 already present (2 occurrences in each file).
The ask was to decouple translations from the release cycle so
community translators don't have to wait on a maintainer to merge
strings. Loading translations from a CDN was offered, but pulling
untrusted JSON into the UI at runtime adds attack surface and breaks
the offline-friendly self-hosted story.
Instead, automate the merge path that already exists:
- New scripts/validate-locales.js checks every public/locales/*.json
for JSON validity, _meta fields, and shape compatibility with
en.json (same key paths, same value types). Missing keys are
warnings (partial translations are OK, English is the fallback).
Also runnable locally with 'npm run validate-locales'.
- New .github/workflows/translations-autovalidate.yml runs that
validator on every PR that touches public/locales/**. If the PR is
translations-only (no en.json, no code) and validation passes,
it labels the PR 'translations-only' and turns on GitHub's
auto-merge so it goes in as soon as required checks are green.
- Workflow runs on pull_request (not pull_request_target) so it
cannot read secrets from fork PRs.
ancsemi