# Changelog: ipx-directory The directory of public podcasts that ipx servers share (docs/directory.md). ipx's changelog is [crates/ipx/CHANGELOG.md](../ipx/CHANGELOG.md), the page's [web/CHANGELOG.md](../../web/CHANGELOG.md). Its version is in `crates/directory/Cargo.toml`, and a release is tagged `directory-vX.Y.Z`. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] ### Fixed - A WordPress.com site that answers its feed with a browser check (HTTP 403) is read from WordPress.com's API instead of failing (#317). ### Security - HTTPS connections no longer trust certificates from emSign's distrusted intermediates, and certificate checks use constant-time comparisons: rustls-webpki, webpki-roots and ctutils are updated (#351). - The public pages read the list from the database at most once a minute, however many people ask. Each page asked for the whole catalogue, so a flood of requests with query strings of their own reached the database every time (#341). - The directory no longer fetches feeds at internal addresses (loopback, the LAN, Docker's networks), named in a snapshot or reached by a redirect, unless directory.toml's `fetch_internal` lists them. It fetched them, and stored what answered as the feed's title and description (#329). - A server's count of a feed's subscribers is taken up to a million. Two servers sending the largest number there is made the sum overflow, and every listing and page failed until one was dropped (#342). ## [1.3.0] - 2026-10-19 ### Added - A feed's items written in Markdown show formatted on its page, from a Markdown description or RSS's `` (#284). ### Fixed - A listed feed whose address serves something larger than 50 MB is refused as too large, instead of read whole into memory at every check (#295). ### Security - ammonia, which cleans publishers' HTML, updated to 4.2.4 for three advisories, among them XSS through SVG animation tags; rustls to 0.23.46 for five and h2 to 0.4.20 for one (#281). ## [1.2.0] - 2026-10-16 ### Added - Answers and pages go out compressed, brotli, zstd or gzip as the caller takes them: the feed list ipx asks for was 603 KB of JSON. A snapshot may come gzipped, `/metrics` answers gzipped, and with `OTEL_EXPORTER_OTLP_COMPRESSION=gzip` traces go to the collector compressed (#253). - With `apple_country` set, Apple Podcasts' top charts for that country (the top 100 and the top 50 of each category) come into the directory every week, beside what servers share, without counting as subscribers; and a warning says when Apple's categories no longer match ipx's (#252). ### Changed - Each feed is checked every twelve hours instead of six (#243). - Feeds are fetched accepting brotli and zstd as well as gzip (#244). - On Postgres the server keeps all ten of its database connections open, so a request does not wait for a new one (#241). ## [1.1.1] - 2026-10-15 ### Changed - The directory checks five feeds at a time, so a publisher that does not answer no longer holds up the rest of its round (#227). - A feed's server that takes 10 s to connect, or sends nothing for 15 s, is given up on (#230). ### Security - A failed feed check is logged without its address's query or password (#238). ## [1.1.0] - 2026-10-13 ### Added - With `metrics_bind` set, the directory serves Prometheus metrics on a port of its own: memory, open files, and the feeds it has fetched and their bytes. A feed check's trace says how large the feed was (#224). ### Changed - The directory uses mimalloc instead of glibc's allocator, so it gives back memory it has freed instead of holding over a gigabyte while idle (#224). - The example in docs/directory.md has no healthcheck; `ipx-directory health` is still there to run by hand (#218). ### Security - A feed check's trace keeps the feed's address without its query or password (#225). ## [1.0.0] - 2026-10-12 ### Added - Anyone can browse the directory in a web browser, read only: the most subscribed, categories, every feed A to Z, a search by name, and each feed's page with its latest items and its address to copy into any podcast app (#215). - `GET /v1/instances` lists the servers holding a snapshot, with their feeds and subscribers, for an admin token (#206). - `ipx-directory`, a directory of public podcasts that ipx servers share: each sends the public feeds its people subscribe to, and any server with a token browses them, each feed listed once it has been read. Tokens are in its config file, each read-only, read-write or admin, and revoked one at a time (#204, #205). - Traces: a span a request, joining the trace of the ipx server that called, and a trace a refresher round with a span a feed (#213). [unreleased]: https://git.sdf1.net/rays/ipx/compare/directory-v1.3.0...main [1.3.0]: https://git.sdf1.net/rays/ipx/compare/directory-v1.2.0...directory-v1.3.0 [1.2.0]: https://git.sdf1.net/rays/ipx/compare/directory-v1.1.1...directory-v1.2.0 [1.1.1]: https://git.sdf1.net/rays/ipx/compare/directory-v1.1.0...directory-v1.1.1 [1.1.0]: https://git.sdf1.net/rays/ipx/compare/directory-v1.0.0...directory-v1.1.0 [1.0.0]: https://git.sdf1.net/rays/ipx/releases/tag/directory-v1.0.0