13.0.0

Released: 2025-03-17

Summary

See our blog post for an overview of the main features and improvements this release brings.

Here you will find a summary of all major changes and other things you need to be aware of.

Upgrading

If you are upgrading from a previous release, we generally expect things to go smoothly for you.

There have been some changes and improvements in the default config file that is shipped with Prosody. When upgrading, your package manager may prompt you - asking if you want to use the new config, or keep your own. You almost always want to keep your existing configuration file. After the upgrade, you can review the new configuration file and incorporate any changes into your existing config.

To be clear, it is expected that Prosody 13.0 will function correctly on any config file that is compatible with 0.12. No changes are required, however there may be some recommendations - such as options that have been deprecated or replaced.

The best way to find these is to run ‘prosodyctl check config’, before and after you upgrade, which will find most issues and suggest a solution.

Common issues

No upgrade issues have been reported. If you have any problems upgrading, join our community chat and let us know!

Lua 5.1 support removed

This is the first Prosody release that won’t support Lua 5.1, and this includes LuaJIT. While Lua 5.1 was a popular milestone for the Lua language and will likely live on for many years, maintaining backwards compatibility is a burden and was holding us back from adopting some nice APIs and features of more modern Lua versions.

Most distributions already supply newer Lua versions available and your package manager should figure everything out for you.

We recommend Lua 5.4 for most deployments, although Prosody will also run on Lua 5.2 and 5.3 for this release branch.

Note: Lua 5.4 support was lacking in Debian 11 and earlier. If Prosody complains about missing dependencies on your system when running with Lua 5.4, even though the dependencies appear to be installed, you may be encountering this problem. We recommend switching to an older Lua version such as 5.2 or 5.3 in this case. Or, you know, finally upgrading your OS :)

Debian/Ubuntu Lua version agility

Starting with 0.12, the packages supplied by the Prosody team for Debian/Ubuntu systems support running with any compatible Lua version. To update the default Lua version for your system, run:

update-alternatives --config lua-interpreter

Are you packaging Prosody for a distribution? Check our notes for packagers!

Changes

New in this release

Modules

A number of popular modules have transitioned from community modules into Prosody with this release:

And the following modules are completely new:

Administration

  • New ‘prosodyctl check features’ recommends configuration improvements
  • mod_announce: Add shell commands to send messages to all users, online users, or limited by roles
  • New mod_account_activity plugin records last login/logout time of a user account
  • New ‘watch log’ command to follow live debug logs at runtime
  • Similarly, ‘watch stanzas’ can be used to capture XML logs in real-time

Networking

  • Honour ‘weight’ parameter during SRV record selection
  • Support for RFC 8305 “Happy Eyeballs” to improve IPv4/IPv6 connectivity
  • Support for TCP Fast Open in server_epoll (pending LuaSocket support)
  • Support for deferred accept in server_epoll (pending LuaSocket support)

MUC

  • Component admins are no longer room owners by default. This can be reverted to the old behaviour with component_admins_as_room_owners = true, but this has known incompatibilities with some clients. Instead, use the shell or ad-hoc commands to gain ownership of rooms when necessary.
  • Permissions updates:
    • Room creation restricted to local users (of the parent host) by default
      • restrict_room_creation = true restricts to admins, false disables all restrictions
    • Persistent rooms can only be created by local users (parent host) by default
      • muc_room_allow_persistent = false restricts to admins
    • Public rooms can only be created by local users (parent host) by default
      • muc_room_allow_public = false restricts to admins
  • Commands to show occupants and affiliations in the Shell
  • Save ‘reason’ text supplied with affiliation change
  • Owners can set MUC avatars (functionality previously in community module mod_vcard_muc)

Security and authentication

  • New role and permissions framework and API
  • Ability to disable and enable user accounts
  • A “grace period” is now supported for deletion requests via in-band registration
  • Advertise supported SASL Channel-Binding types (XEP-0440)
  • Implement RFC 9266 ‘tls-exporter’ channel binding with TLS 1.3
  • Implement ‘tls-server-end-point’ channel binding
  • Full DANE support for s2s
  • No longer check certificate Common Names per RFC 9525

Storage

  • Performance improvements in internal archive stores
  • Ability to use SQLite3 storage with LuaSQLite3 instead of LuaDBI
  • SQLCipher support

Module API for developers

  • New ‘keyval+’ combined keyval/map store type
  • Config interface API can require that string values be picked from a provided set
  • Acceptable interval can be specified for number options
  • Method for parsing time periods / intervals from config
  • Method for retrieving integer settings from config
  • It is now easy for modules to expose a Prosody shell command, by adding a shell-command item
  • Modules can now implement a module.ready method which will be called after server initialization
  • module:depends() now accepts a second parameter ‘soft’ to enable soft dependencies

Configuration file

  • The configuration file now supports referring and appending to options previously set
  • Direct usage of the Lua API in the config file is deprecated, but can now be accessed via Lua.* instead
  • Convenience functions for reading values from files, with variant meant for credentials or secrets (e.g. from systemd-creds)

Changed in this release

  • Support sub-second precision timestamps
  • mod_blocklist: New option ‘migrate_legacy_blocking’ to disable migration from mod_privacy
  • Moved all modules into the Lua namespace prosody.
  • Forwarded header from RFC 7239 supported, disabled by default
  • mod_http_file_share now uses roles framework, affecting access from e.g. components
  • Intervals of mod_cron managed periodic jobs made configurable
  • When mod_smacks is enabled, s2s connections not responding to ack requests are closed.
  • Arguments to prosodyctl shell that start with ‘:’ are now turned into method calls
  • Support for Type=notify and notify-reload systemd service type added
  • Support for the roster group access_model in mod_pep
  • Support for systemd socket activation in server_epoll
  • mod_invites_adhoc gained a command for creating password resets
  • [mod_cloud_notify] imported from community modules for push notification support
  • [mod_http_altconnect] imported from community modules, simplifying web clients

Removed in this release

  • Lua 5.1 support
  • XEP-0090 support removed from mod_time
  • util.rfc6724