We merged 15 PRs in September and released OpenMLSv0.7.1.

v0.7.1 Release 🔐

The most critical update this month was the release of v0.7.1, which addresses a security vulnerability. We urge all users to upgrade to this version as soon as possible to ensure their applications remains secure. You can find more details about the vulnerability in the official security advisory: GHSA-qr9h-x63w-vqfm.

New Features and Fixes 🚀

September and this release also saw the addition of some handy new features and important bug fixes:

  • Check for Pending Proposals: A new function has been added to easily check if there are any pending proposals in a group (#1840).
  • External Commit Builder Fix: A regression in the external commit builder has been addressed (#1842).
  • Forward secure exporter: We added “Safe exporters” as defined in the MLS extension draft behind the extensions-draft-08 feature flag. Previously serialized groups will derive the exporter upon creating/processing and merging the next commit. (#1725).
  • New External Commit Builder: A new builder pattern for external commits has been introduced with MlsGroup::external_commit_builder (#1801). Consequently, the old MlsGroup::join_by_external_commit method is now deprecated. We also fixed a regression related to this new builder in #1842.
  • Check for Pending Proposals: You can now easily see if a group has unprocessed proposals using the new MlsGroup::has_pending_proposals() method (#1840).
  • Flexible Lifetime Validation: For advanced use cases, it’s now possible to disable leaf node lifetime validation when joining a group via StagedWelcome::build_from_welcome (#1814).

Contributors 🎉

We are also thrilled to welcome @nuke-web3 as a new contributor.

Merged PRs September 2025

Contributors