Clear, the xmppd mascot

xmppd Roadmap

Where it's been, where it's going

Current release: v0.8.11

← Back to xmppd.org

Release Cadence

Every minor version follows a fixed rule set. Looking at the minor digit is enough to know what a release is about.

Even

Feature releases. New protocol surface: XEPs, transports, storage features. v0.6, v0.8, v0.10.

Odd

Performance releases. Hot paths, load testing, memory footprint, latency. v0.7, v0.9.

÷3

Minors divisible by 3 also refactor. Internal architecture gets reworked on top of the feature or performance wave. v0.6 (actor model), v0.9 (allocation + internals).

.patch

Patch releases are hardening only. Compliance fixes, security, interop: v0.8.5 through v0.8.10. Minors are reserved for the roadmap; a bug never earns one.

Coming Up

v0.9.0 performance refactor in progress

  • Load-testing harness on an in-repo Zig XMPP client core (lib/xmppc, libstrophe-shaped): churn thousands of connections over TLS+SASL on a single kqueue loop, then measure connections/sec at 1 vs N workers, message throughput, and cross-thread delivery latency.
  • Measurement-gated allocator work: thread-local scratch arenas and slab pools land only if the benchmarks prove the shared allocator is the contention point.
  • Already on master, shipping with v0.9.0:
    • Cross-worker stream resumption (XEP-0198): a reconnect landing on any worker now resumes the session via a state handoff instead of failing.
    • Auth brute-force protection actually enforcing (it was silently inert), plus a config switch to relax it for benchmark rigs.
  • Also planned: cross-worker resource eviction, XEP-0012 last activity.

v0.10.0 feature planned

  • xmppd-ws — a supervised WebSocket↔XMPP bridge process, so browsers and web apps can connect natively.
  • XEP-0363 HTTP File Upload — xmppd-httpupload daemon.
  • XEP-0060 Publish-Subscribe — real pub/sub service (beyond the PEP subset used for avatars and bookmarks).
  • XEP-0049 Private XML Storage.

v1.0.0 production gate

The stability commitment: full interop sign-off (SINT), documented upgrade and backup procedures, and a completed security posture review.

Shipped

v0.8.11 2026-09-30 shipped

Security-relevant hardening: the authentication rate limiter had been silently inert in every prior release and now actually enforces. This upgrade activates brute-force protection for the first time.

  • Per-account rate checks and lockouts engage; SASL denials surface to clients as policy-violation / account-disabled.
  • New rate_limit = false switch for benchmark and load-test rigs (logs a prominent warning; never for reachable deployments).

v0.8.10 2026-08-31 shipped

Cross-worker correctness hardening on the multi-threaded path, plus stream-management safety under load.

  • New multi-worker CI lane; cross-worker MUC admin replies and subscription-cache invalidation fixed.
  • XEP-0198 unacked-queue overflow now fails the session loudly instead of silently dropping stanzas.
  • RFC 6120/6121 compliance fixes from the first full-spec SINT run (pre-bind stanzas, vCard privacy, MUC bounce behavior).

v0.8.5–v0.8.9 2026-06–08 shipped

The V1 hardening line leading to 0.8.10:

  • v0.8.5 — XEP-0115 entity capabilities (server caps hash), OIDC profile-photo import.
  • v0.8.6 — reconnection stability: SM resume dispatch ordering, unique stream IDs per restart (RFC 6120 §4.7.3); verified against Conversations (Android).
  • v0.8.7 — stale-bind eviction (a reconnect racing the old session's cleanup now wins).
  • v0.8.8 — broken-pipe and stale-fd hardening across all delivery paths; XEP-0077 registration advertisement fix.
  • v0.8.9 — code-audit sweep: eleven findings around feature-list drift and docs honesty, all corrected.

v0.8.0 2026-06 feature shipped

The V1 feature train: message archive (XEP-0313), carbons (XEP-0280), blocking (XEP-0191), delivery receipts, chat markers, last-message correction, client state indication (XEP-0352), PEP avatars (XEP-0084) with Gravatar fallback, PEP bookmarks (XEP-0402), in-band registration with invite codes, OIDC external auth.

v0.7.0 2026-06-15 performance shipped

  • FreeBSD KTLS offload — AES-GCM/ChaCha20 symmetric crypto moves into the kernel.
  • Auth credential cache, TCP_NODELAY, hot-path deduplication across the routing and archive paths.

v0.6.0 2026-06-14 feature refactor shipped

  • RFC 6121 interop compliance: 360/367 SINT tests passing.
  • Full XEP-0198 session resumption: detach on abnormal disconnect, resume by SM-ID, unacked stanza replay.
  • Actor-model refactor of cross-worker routing.

v0.5.0 2026-06-11 shipped

First functional server. The full 13-phase build: protocol library, core daemon, DANE-first S2S federation, client interop suite, MUC, authentication, LMDB storage — on a multi-process, thread-per-core architecture with six binaries.

Follow Along

Releases are tagged on all three mirrors; the changelog documents every release in detail.

Standards Compliance Changelog GitHub Codeberg Pacyworld Documentation