LoginSign Up
← Back to all sparks
C

Converse.js

COMMS
Velocity2.5

Web-based XMPP chat client that runs in the browser

conversejs.org ↗

Converse.js 14.0.1 fixes OMEMO:2 group decryption broken by Chromium 153.

xmppomemo-encryptione2e-usabilitybrowser-clientsecurity
◆Current state
Converse.js shipped 14.0.0 in June with OMEMO:2, the current revision of XMPP's end-to-end encryption, plus fixes that make encryption state and errors visible. 14.0.1 in October fixes OMEMO:2 group messages that stopped decrypting in Chromium 153, a bug that also skipped a sender check.
◆Where it's heading
The project is in a stabilisation phase on the 14 line, with encryption correctness as the main concern. Releases are months apart.
◆Prediction
Expect further 14.0.x patches for encryption and browser compatibility; no next major is signalled.

◆Recent moves

  1. 27d ago

    Release 14.0.1 (2026-10-17)

    Converse.js 14.0.1 fixes OMEMO:2 group messages that stopped decrypting in Chromium 153, which also skipped a sender check, plus reaction ordering from the archive. A necessary patch for encrypted group chat users.

    View source ↗
  2. 4mo ago

    OMEMO:2 encryption support ships in Converse 14

    ⚡ SPARK

    The stable release of the OMEMO:2 work, together with the encryption-usability fixes accumulated across the beta train: persistent per-chat encryption state, visible decryption errors, and the toggle suppressed on untrusted devices. This is the release the whole 14.0.0 beta cycle was building toward.

    View source ↗
  3. 4mo ago

    OMEMO bundle self-healing and new PubSub API methods

    The final beta adds self-healing for abandoned or unpublished OMEMO bundles, graceful handling of contacts whose device is listed but whose bundle is missing, and new PubSub methods to create, subscribe and unsubscribe. Recovery behaviour for exactly the states that leave encrypted chat mysteriously broken.

    View source ↗
  4. 4mo ago

    libomemo.js dependency bump

    A beta whose only change is bumping libomemo.js to 2.0.1. Pure dependency movement inside the OMEMO:2 push.

    View source ↗
  5. 4mo ago

    client-compress replaced with native browser APIs

    A single change dropping the client-compress dependency in favour of browser APIs. Small, but consistent with trimming third-party code out of a security-sensitive client.

    View source ↗
  6. 4mo ago

    First beta carrying the OMEMO usability fixes

    Where the 14.0.0 encryption work first appears: persistent per-chat encryption state, surfaced decryption errors, the untrusted-device toggle fix, and preserved filenames on encrypted downloads. The stable release restates this same set.

    View source ↗