After a long journey through ancient code, temperamental enchanted portraits, stubborn database scrolls and more than a few defensive spells, Mediabot 3.5 has officially been released. 🎉
This is an important milestone for the project. Version 3.5 is not merely another collection of features: it establishes a tested, documented and reproducible foundation for Mediabot’s future development.
The final release spell has been cast:
3.5a55d0300a8e0dda0f18f97a6f19bcb2fa48ae47c3.5MB727: open the castle gates for Mediabot 3.5 🏰🦉Mediabot 3.5 represents a substantial modernization and hardening effort across the whole project.
The Hailo subsystem has been strengthened with clearer per-channel behaviour, bounded learning and safer response handling.
Gemini integration is now wired behind its own explicit channel capability. It remains independently controlled and disabled unless an operator deliberately enables it—no surprise incantations in channels that did not request them. ✨
As always, deterministic local behaviour remains available when an external provider is unavailable or disabled.
The mbweb console has graduated into the officially supported Mediabot 3.5 surface.
Its protections include:
The web console can therefore sit safely behind Apache without being handed the keys to the entire castle. 🔐
The cross-cutting security gate now checks 37 fail-closed invariants across 16 security axes.
These cover authentication, sessions, database access, privileged commands, external HTTP requests, plugins, scripts, update boundaries, systemd identities, writable paths, rollback, release archives and other sensitive corridors.
The final verdict was:
GO — all 37 security invariants hold.
No secret values, private configuration files or generated debris are permitted to hide inside the public release trunks. Even the Room of Requirement would struggle to conceal them. 🧹
Fresh installations and upgrades now follow a clearer and more thoroughly tested database path.
The release includes:
QUOTES.quotetext contract aligned with the application’s existing 512-character limit;Production migration remains an explicit operator decision. The release process itself touched no production database.
Mediabot 3.5 now identifies clear authorities for:
The obsolete remote updater has been removed, eliminating an ambiguous and unsupported deployment route.
The map now shows one marked path through each part of the grounds—considerably safer than following mysterious footprints into the Forbidden Forest. 🗺️
The canonical mbweb dependency lock was refreshed, including secure versions of mysql2 and qs.
Deployment now fails when npm audit reports a vulnerability at moderate severity or above. The release dependency audit completed with:
0 vulnerabilities
Before the gates could open, Mediabot 3.5 had to survive the complete release gauntlet.
The full suite was executed once, directly in the terminal with its progress display intact—no redirected prophecy, no captured crystal ball and no broken progress bar. ⚡
Both final workflows completed successfully:
The Debian 13 gate exercised the actual release candidate archive rather than quietly testing a different working-tree checkout.
It covered the fresh-install path as well as the representative stable upgrade scenario, including exact rollback and deterministic reapplication.
Six public files were generated from the annotated 3.5 tag:
mediabot_v3-3.5.tar.gzmediabot_v3-3.5.tar.xzmediabot_v3-3.5-FILES.txtmediabot_v3-3.5-RELEASE.txtmediabot_v3-3.5-SHA256SUMSmediabot_v3-3.5-SHA512SUMSThe archives were built and checked reproducibly.
51e73e7abc1f655dd7cfb15c40d729180ca5806e6a05f2032d92b4c49f92a84c mediabot_v3-3.5.tar.gz
a26b6a13686023883a1a3e932d57ef2892849a4c28ff367b8f018d069f9dd029 mediabot_v3-3.5.tar.xz
ea011a72c271f3d3f9467153f65b7713e46dd24b844e36c6e0136c4b790d31549f587710c3904abc90034c132acc7d04ec56a00833bfe2f7c4181bdb29660f96 mediabot_v3-3.5.tar.gz
fe63dc381cc6eecdbf0be0cf9fe7e59cb0a01c96043c51964f74e5d35391f324fd1928807b3d8f966e110ff04f72f311b4886634f2997e91444ced3065967ef0 mediabot_v3-3.5.tar.xz
The source corresponding to the release can also be inspected through the Mediabot 3.5 tag on GitHub.
The final editorial task is to create the GitHub Release page and attach these six already verified files.
This release publishes the source code, release contract, tag and artifacts.
It did not modify any production instance, production database, grant or private configuration file. Production upgrades remain controlled, instance-specific operations performed by their respective operator.
That distinction is intentional: releasing the spell book does not automatically cast every spell written inside it. 📖
Mediabot has travelled a long way from its original IRC roots. Version 3.5 preserves that history while giving the project a much stronger platform for future work.
Many tests were written. Several old assumptions were challenged. A few enchanted portraits insisted on describing yesterday’s roadmap. Some owls misunderstood timestamps. One or two protective charms were perhaps a little too enthusiastic.
But the result is here:
Mediabot 3.5 is committed, tested, tagged and published.
Thank you to everyone who tested, reviewed, operated, reported problems or simply kept believing that this old castle was worth renovating. ❤️
The gates are open.
Welcome to Mediabot 3.5. 🏰🦉✨
You must be logged in to reply.