chore(release): bump version to v1.2.0 and update related documentation and packaging files

Author: Cod-e-Codes

.github/workflows/release.yml

@@ -6,9 +6,9 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version to build (e.g., v1.1.0)'
+        description: 'Version to build (e.g., v1.2.0)'
         required: true
-        default: 'v1.1.0'
+        default: 'v1.2.0'
 
 permissions:
   contents: read

CHANGELOG.md

@@ -4,13 +4,17 @@ Narrative notes by release. Per-file binaries and assets: [GitHub releases](http
 
 ## Unreleased
 
-On **`main`** only; not part of **[v1.1.0](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.1.0)** or its published binaries until you tag and publish. Compare [`v1.1.0...main`](https://github.com/Cod-e-Codes/marchat/compare/v1.1.0...main). Commits since the tag: **`git log v1.1.0..HEAD --oneline`**.
+On **`main`** only; not part of the latest tagged release until you tag and publish. Compare against the current tag on [GitHub releases](https://github.com/Cod-e-Codes/marchat/releases).
+
+## v1.2.0
+
+**Released 2026-06-06.** Since **[v1.1.0](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.1.0)**; compare [`v1.1.0...v1.2.0`](https://github.com/Cod-e-Codes/marchat/compare/v1.1.0...v1.2.0). Commits: **`git log v1.1.0..v1.2.0 --oneline`**.
 
 - **Server**: WebSocket **Origin** checks compare parsed hostnames (no substring matching); optional **`MARCHAT_ALLOWED_ORIGINS`** allowlist. **`getClientIP`** and web-admin login rate limiting honor **`X-Forwarded-For`** / **`X-Real-IP`** only when the immediate peer is in **`MARCHAT_TRUSTED_PROXIES`** (comma-separated IPs or CIDRs).
-- **Client**: Direct messages use the same E2E wire path as channel `text` when encryption is enabled (`encrypted` plus base64 nonce || ciphertext with the global key). Applies to `:dm <user> <msg>`, DM mode compose, and code snippets sent while a DM thread is open (`:code` / Alt+C).
-- **Dependencies**: **golang.org/x/crypto** v0.52.0 (SSH advisories cleared at module level; marchat uses ChaCha20-Poly1305 and PBKDF2 only); **modernc.org/sqlite** v1.50.1 (was v1.50.0). Transitive **filippo.io/edwards25519** v1.2.0 (MySQL driver).
-- **Toolchain**: Go **1.25.11** in **go.mod**, nested plugin modules, CI, and **Dockerfile** (stdlib fixes for **GO-2026-5037**, **GO-2026-5038**, **GO-2026-5039** reported by **govulncheck** on **1.25.10**).
-- **Plugins**: Plugin store downloads validate SHA-256 checksums before extraction (HTTP and `file://`), reject oversize archives, parse `file://` paths correctly on Linux and Windows (registry and download URLs via `plugin/fileurl`), detect archive type from the URL path (including query strings), extract to a staging directory with zip-slip checks, roll back failed updates, set the execute bit on the plugin binary by exact name match after ZIP/TAR extract, and do not leave an empty plugin directory when install download fails.
+- **Client**: Direct messages use the same E2E wire path as channel `text` when encryption is enabled (`encrypted` plus base64 nonce || ciphertext with the global key). Applies to **`:dm <user> <msg>`**, DM mode compose, and code snippets sent while a DM thread is open (**`:code`** / Alt+C). **Fix:** code snippets in DM mode route through the DM send path, not channel `text`.
+- **Plugins**: Plugin store downloads validate SHA-256 checksums before extraction (HTTP and `file://`), reject oversize archives, parse `file://` paths correctly on Linux and Windows (registry and download URLs via **`plugin/fileurl`**), detect archive type from the URL path (including query strings), extract to a staging directory with zip-slip checks, roll back failed updates, set the execute bit on the plugin binary by exact name match after ZIP/TAR extract, and do not leave an empty plugin directory when install download fails.
+- **Toolchain / dependencies**: Go **1.25.11** in **go.mod**, nested plugin modules, CI, and **Dockerfile** (stdlib fixes for **GO-2026-5037**, **GO-2026-5038**, **GO-2026-5039** reported by **govulncheck** on **1.25.10**); **golang.org/x/crypto** v0.52.0; **modernc.org/sqlite** v1.51.0 (was v1.50.0). Transitive **filippo.io/edwards25519** v1.2.0 (MySQL driver).
+- **Packaging**: Version strings and URLs for **v1.2.0** in **install.ps1**, **install.sh**, **build-release.ps1**, **scripts/build-*.ps1/sh**, **README**, **SECURITY.md**, **.github/workflows/release.yml**, and **packaging/** (Homebrew, Scoop, winget **1.2.0** manifest set, Chocolatey, AUR). **SHA256** fields are **placeholders** (`000000...`) until replaced from published release zips (**PACKAGING.md**, **packaging/ci/render-release-manifests.sh**). Regenerate **packaging/aur/.SRCINFO** on Arch after final **PKGBUILD** checksums (**`makepkg --printsrcinfo`**).
 
 ## v1.1.0
 

PACKAGING.md

@@ -58,7 +58,7 @@ Published tap: [homebrew-marchat](https://github.com/Cod-e-Codes/homebrew-marcha
 
 Upstream is [microsoft/winget-pkgs](https://github.com/microsoft/winget-pkgs). Maintainers use a fork, add `manifests/c/Cod-e-Codes/Marchat/<PackageVersion>/`, run `winget validate` on that folder, and open a PR. Package identifier: `Cod-e-Codes.Marchat`. The installer is a zip with `NestedInstallerType: portable` and two `PortableCommandAlias` entries for client and server. Microsoft may prompt first-time contributors to accept the CLA on the PR; follow the bot instructions there.
 
-Example template path in this repo: `packaging/winget/manifests/c/Cod-e-Codes/Marchat/1.1.0/` (duplicate the folder layout for new versions). Older **`1.0.0/`** manifests may remain for reference; the current release templates target **v1.1.0** until the next bump.
+Example template path in this repo: `packaging/winget/manifests/c/Cod-e-Codes/Marchat/1.2.0/` (duplicate the folder layout for new versions). Older **`1.0.0/`** and **`1.1.0/`** manifests may remain for reference; the current release templates target **v1.2.0** until the next bump.
 
 **Checksums vs GitHub release timing:** Portable zip manifests embed SHA256. After you publish a release and the five platform zips exist on GitHub, run [`packaging/ci/render-release-manifests.sh`](packaging/ci/render-release-manifests.sh) with `RELEASE_TAG` set and copy `packaging-out/` into `packaging/` (and into your tap, bucket, winget fork, or AUR clone as needed) so local `winget validate`, `brew audit`, and `choco pack` match real bytes. The committed templates may carry placeholder hashes until that sync step.
 

README.md

@@ -7,7 +7,7 @@
 [![Go Version](https://img.shields.io/github/go-mod/go-version/Cod-e-Codes/marchat?logo=go)](https://go.dev/dl/)
 [![GitHub all releases](https://img.shields.io/github/downloads/Cod-e-Codes/marchat/total?logo=github)](https://github.com/Cod-e-Codes/marchat/releases)
 [![Docker Pulls](https://img.shields.io/docker/pulls/codecodesxyz/marchat?logo=docker)](https://hub.docker.com/r/codecodesxyz/marchat)
-[![Version](https://img.shields.io/badge/version-v1.1.0-blue)](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.1.0)
+[![Version](https://img.shields.io/badge/version-v1.2.0-blue)](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.2.0)
 
 A lightweight terminal chat with real-time messaging over WebSockets, optional E2E encryption, and a flexible plugin ecosystem. Built for developers who prefer the command line.
 
@@ -37,7 +37,7 @@ Both clients follow the same wire format documented in [PROTOCOL.md](PROTOCOL.md
 
 ## Release notes
 
-**Latest tagged release:** [v1.1.0](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.1.0) (2026-05-12). Narrative history: [CHANGELOG.md](CHANGELOG.md). Assets and tags: [GitHub releases](https://github.com/Cod-e-Codes/marchat/releases).
+**Latest tagged release:** [v1.2.0](https://github.com/Cod-e-Codes/marchat/releases/tag/v1.2.0) (2026-06-06). Narrative history: [CHANGELOG.md](CHANGELOG.md). Assets and tags: [GitHub releases](https://github.com/Cod-e-Codes/marchat/releases).
 
 **`main` branch:** may include changes not yet in that tag (for example items under **Unreleased** in [CHANGELOG.md](CHANGELOG.md)). Feature descriptions elsewhere in this README match the tree you build from source; compare your binary’s `-doctor` / `-version` output to the release page when in doubt.
 
@@ -153,12 +153,12 @@ Tables created by the server (dialect-aware DDL for SQLite, PostgreSQL, and MySQ
 **Binary Installation:**
 ```bash
 # Linux (amd64)
-wget https://github.com/Cod-e-Codes/marchat/releases/download/v1.1.0/marchat-v1.1.0-linux-amd64.zip
-unzip marchat-v1.1.0-linux-amd64.zip && chmod +x marchat-*
+wget https://github.com/Cod-e-Codes/marchat/releases/download/v1.2.0/marchat-v1.2.0-linux-amd64.zip
+unzip marchat-v1.2.0-linux-amd64.zip && chmod +x marchat-*
 
 # macOS (amd64)
-wget https://github.com/Cod-e-Codes/marchat/releases/download/v1.1.0/marchat-v1.1.0-darwin-amd64.zip
-unzip marchat-v1.1.0-darwin-amd64.zip && chmod +x marchat-*
+wget https://github.com/Cod-e-Codes/marchat/releases/download/v1.2.0/marchat-v1.2.0-darwin-amd64.zip
+unzip marchat-v1.2.0-darwin-amd64.zip && chmod +x marchat-*
 
 # Windows - PowerShell
 iwr -useb https://raw.githubusercontent.com/Cod-e-Codes/marchat/main/install.ps1 | iex
@@ -184,11 +184,11 @@ See [PACKAGING.md](PACKAGING.md) and `packaging/` for Homebrew, Scoop, winget, C
 
 **Docker:**
 ```bash
-docker pull codecodesxyz/marchat:v1.1.0
+docker pull codecodesxyz/marchat:v1.2.0
 docker run -d -p 8080:8080 \
   -e MARCHAT_ADMIN_KEY=$(openssl rand -hex 32) \
   -e MARCHAT_USERS=admin1,admin2 \
-  codecodesxyz/marchat:v1.1.0
+  codecodesxyz/marchat:v1.2.0
 ```
 
 **Docker Compose (local development):**

SECURITY.md

@@ -2,12 +2,12 @@
 
 ## Supported Versions
 
-`marchat` is currently at **v1.1.0**.  
+`marchat` is currently at **v1.2.0**.  
 All security updates and fixes are applied to the `main` branch.
 
 | Version            | Supported |
 |--------------------|-----------|
-| v1.1.x (`main`)    | Yes       |
+| v1.2.x (`main`)    | Yes       |
 | v1.0.x             | Yes       |
 | v0.11.x            | No        |
 | v0.10.x            | No        |

build-release.ps1

@@ -1,9 +1,9 @@
-# Build script for marchat v1.1.0
+# Build script for marchat v1.2.0
 # This script builds all platform targets and creates release zips
 
 $ErrorActionPreference = "Stop"
 
-$VERSION = "v1.1.0"
+$VERSION = "v1.2.0"
 $BUILD_DIR = "build"
 $RELEASE_DIR = "release"
 

install.ps1

@@ -4,7 +4,7 @@
 # Supports Windows, Linux, macOS, and Android (via PowerShell Core)
 
 param(
-    [string]$Version = "v1.1.0"
+    [string]$Version = "v1.2.0"
 )
 
 $ErrorActionPreference = "Stop"

install.sh

@@ -5,7 +5,7 @@
 
 set -e  # Exit on any error
 
-VERSION="v1.1.0"
+VERSION="v1.2.0"
 
 # Detect OS and architecture
 OS=$(uname | tr '[:upper:]' '[:lower:]')

packaging/aur/.SRCINFO

@@ -1,16 +1,16 @@
 pkgbase = marchat-bin
 	pkgdesc = Terminal chat with WebSockets (official release binaries)
-	pkgver = 1.1.0
+	pkgver = 1.2.0
 	pkgrel = 1
 	url = https://github.com/Cod-e-Codes/marchat
 	arch = x86_64
 	arch = aarch64
 	license = MIT
 	depends = glibc
 	options = !strip
-	source_x86_64 = marchat-v1.1.0-linux-amd64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/v1.1.0/marchat-v1.1.0-linux-amd64.zip
-	sha256sums_x86_64 = 66d8d6b08746e087d7831c3e705956f46068d35bfeea75c7154f31143be70719
-	source_aarch64 = marchat-v1.1.0-linux-arm64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/v1.1.0/marchat-v1.1.0-linux-arm64.zip
-	sha256sums_aarch64 = 76efd9de78da9e5b7065969371598f172a24d971dd5baf91cdd7a36a02229b0a
+	source_x86_64 = marchat-v1.2.0-linux-amd64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/v1.2.0/marchat-v1.2.0-linux-amd64.zip
+	sha256sums_x86_64 = 0000000000000000000000000000000000000000000000000000000000000000
+	source_aarch64 = marchat-v1.2.0-linux-arm64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/v1.2.0/marchat-v1.2.0-linux-arm64.zip
+	sha256sums_aarch64 = 0000000000000000000000000000000000000000000000000000000000000000
 
 pkgname = marchat-bin

packaging/aur/PKGBUILD

@@ -1,8 +1,8 @@
 # Maintainer: Cody Marsengill <cod.e.codes.dev@gmail.com>
 pkgname=marchat-bin
-pkgver=1.1.0
+pkgver=1.2.0
 pkgrel=1
-_pkgtag=v1.1.0
+_pkgtag=v1.2.0
 pkgdesc='Terminal chat with WebSockets (official release binaries)'
 arch=('x86_64' 'aarch64')
 url='https://github.com/Cod-e-Codes/marchat'
@@ -11,8 +11,8 @@ options=('!strip')
 depends=('glibc')
 source_x86_64=("marchat-${_pkgtag}-linux-amd64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/${_pkgtag}/marchat-${_pkgtag}-linux-amd64.zip")
 source_aarch64=("marchat-${_pkgtag}-linux-arm64.zip::https://github.com/Cod-e-Codes/marchat/releases/download/${_pkgtag}/marchat-${_pkgtag}-linux-arm64.zip")
-sha256sums_x86_64=('66d8d6b08746e087d7831c3e705956f46068d35bfeea75c7154f31143be70719')
-sha256sums_aarch64=('76efd9de78da9e5b7065969371598f172a24d971dd5baf91cdd7a36a02229b0a')
+sha256sums_x86_64=('0000000000000000000000000000000000000000000000000000000000000000')
+sha256sums_aarch64=('0000000000000000000000000000000000000000000000000000000000000000')
 
 package() {
   if [[ $CARCH == x86_64 ]]; then