🟣 Nostr – Monday, 14 September 2026 **Citrine patches an AUTH bypass** greenart7c3's Citrine relay app shipped 3.1.1 this week, closing a hole where kind-22242 NIP-42 AUTH events were accepted without signature verification, and scoping REQ subscription IDs per socket so one connection can no longer clobber another's — a concrete relay-side fix on the remote-signer/auth baseline.

GitHub

Release Release v3.1.1 · greenart7c3/Citrine

Citrine 3.1.1 Fixed an NIP-42 auth bypass where kind-22242 AUTH events were added to the connection without signature verification Scoped REQ subs...

**Amethyst keeps shipping infrastructure fixes** Vitor Pamplona merged PRs 4118-4120 on September 13: fewer relay connections opened per session, faster blurhash image loading, and an Arti/Tor library bump to 2.6.0 for Amethyst's built-in Tor relay support — incremental outbox-side tuning rather than a scheme change. https://github.com/vitorpamplona/amethyst/commits/main Previously: