Bump to v0.12.9 — Web of Trust everywhere

Extends the WoT filter beyond the global feed: reaction pills, zap
totals, and all feed tabs (global, following, trending) now respect
the trust graph. Also drops the "new account" badge, since the
kind-0 created_at proxy was unreliable.

Softens the v0.12.8 forward-reference to Blossom — it will reappear
in a future release, not specifically this one, since it still needs
a safe-probe or allowlist (see WEBKIT_OOM_INVESTIGATION).

.github/workflows/release.yml

@@ -69,9 +69,14 @@ jobs:
 
             > **Windows note:** The installer is not yet code-signed. Windows SmartScreen will show an "Unknown publisher" warning — click "More info → Run anyway" to install.
 
+            ### v0.12.9 — Web of Trust everywhere
+
+            - **Web of Trust filter now applies everywhere.** Previously it only hid notes from outside your social graph on the global feed. It now also filters all feed tabs (global, following, trending), reaction pills, and zap totals. Zaps are filtered by the actual zapper's pubkey (from the inner zap request), not the outer LNURL service pubkey.
+            - **Removed the "new account" badge** on notes. The proxy was unreliable — kind-0 `created_at` is "profile last updated," not "account created," so it flagged anyone who tweaked their bio recently. Dropped until there's a real signal to use.
+
             ### v0.12.8 — Fix Linux OOM crash
 
-            - **Fix Linux memory crash** — Vega no longer crashes on Linux. Memory now oscillates at ~1.1–1.6 GB during heavy use instead of climbing to 8–12 GB. Root cause traced to v0.12.6: the Blossom SHA-256 URL auto-detection regex caused 3–5× more `<img>` elements per feed page, which combined with WebKitGTK's weak bitmap eviction pushed the WebKit process past its 8 GB self-kill threshold. Blossom auto-detection is temporarily disabled pending proper validation in v0.12.9.
+            - **Fix Linux memory crash** — Vega no longer crashes on Linux. Memory now oscillates at ~1.1–1.6 GB during heavy use instead of climbing to 8–12 GB. Root cause traced to v0.12.6: the Blossom SHA-256 URL auto-detection regex caused 3–5× more `<img>` elements per feed page, which combined with WebKitGTK's weak bitmap eviction pushed the WebKit process past its 8 GB self-kill threshold. Blossom auto-detection is temporarily disabled pending proper validation in a future release.
             - **Feed depths restored** — the v0.12.7 OOM firefighting that slashed follow/global feed limits to 30 is reverted; follow feed now fetches 100 and global caches up to 200, matching pre-crisis v0.12.6 behavior.
             - **WebKit rendering fix** — `WEBKIT_FORCE_SOFTWARE_RENDERING=1` keeps the Wayland compositor path intact on Hyprland.
             - **Notification fetch dedup** — `fetchNotifications` was firing 3× in the first 8 seconds of login; now fires once and the first background poll is delayed to 90s.

CHANGELOG.md

@@ -1,9 +1,20 @@
 # Changelog
 
+## v0.12.9 — Web of Trust everywhere (2026-04-23)
+
+### Changed
+- **Web of Trust filter now applies everywhere.** Previously it only hid notes from outside your social graph on the global feed. It now also filters:
+  - **All feed tabs** — global, following, and trending.
+  - **Reaction pills** — emoji counts no longer include reactions from pubkeys outside your trust graph.
+  - **Zap totals** — sat counts and zap counts no longer include zaps from outside your trust graph. Zaps are filtered by the actual zapper's pubkey (from the inner zap request), not the outer LNURL service pubkey.
+
+### Removed
+- The "new account" badge on notes. It marked pubkeys whose kind-0 profile event was newer than 60 days, on the assumption that that approximated account age. It doesn't — kind-0 `created_at` is "profile last updated," so anyone who tweaked their bio recently got flagged regardless of how long they've been on Nostr. Dropped until there's a real signal to use.
+
 ## v0.12.8 — Fix Linux OOM crash (2026-04-16)
 
 ### Fixed
-- Linux WebKit web process no longer grows unbounded to 8–12 GB and self-kills. Memory now oscillates at ~0.85–1.6 GB during heavy scrolling on Linux and Windows. Root cause: the Blossom SHA-256 URL auto-detection regex introduced in v0.12.6 caused 3–5× more `<img>` elements per feed page, which combined with WebKitGTK's weak bitmap eviction pushed the WebProcess past its self-kill threshold. Blossom URL auto-detection is temporarily disabled pending proper validation in v0.12.9.
+- Linux WebKit web process no longer grows unbounded to 8–12 GB and self-kills. Memory now oscillates at ~0.85–1.6 GB during heavy scrolling on Linux and Windows. Root cause: the Blossom SHA-256 URL auto-detection regex introduced in v0.12.6 caused 3–5× more `<img>` elements per feed page, which combined with WebKitGTK's weak bitmap eviction pushed the WebProcess past its self-kill threshold. Blossom URL auto-detection is temporarily disabled pending proper validation in a future release.
 - WebKit rendering: `WEBKIT_FORCE_SOFTWARE_RENDERING=1` on Linux to keep the Wayland compositor path intact on Hyprland.
 - `fetchNotifications` was firing 3× in the first 8 seconds of login; now fires once and the first background poll is delayed to 90s.
 

PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: hoornet <hoornet@users.noreply.github.com>
 pkgname=vega-nostr
-pkgver=0.12.8
+pkgver=0.12.9
 pkgrel=1
 pkgdesc="Cross-platform Nostr desktop client with Lightning integration"
 arch=('x86_64')

ROADMAP.md

@@ -100,7 +100,8 @@ Bugs found during testing are fixed before Phase N+1 starts. A release is cut be
 - ✓ Vertex DVM integration (kind 5312→6312)
 - ✓ "Followed by people you trust" on profiles with clickable follower avatars
 - ✓ Personalized trust scoring
-- Remaining: WoT-powered feed ranking, spam filtering
+- ✓ WoT spam filtering — v0.12.9 extends the filter to reactions, zaps, and all feed tabs (global, following, trending)
+- Remaining: WoT-powered feed ranking
 
 ### Long-form features (NIP-23 depth) — mostly shipped (v0.6.0 + v0.7.0)
 - ✓ Discovery: dedicated article feed with Latest/Following tabs

package.json

@@ -1,7 +1,7 @@
 {
   "name": "vega",
   "private": true,
-  "version": "0.12.8",
+  "version": "0.12.9",
   "type": "module",
   "scripts": {
     "dev": "vite",

src-tauri/Cargo.lock

@@ -5320,7 +5320,7 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
 [[package]]
 name = "vega"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "futures-util",
  "hex",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "vega"
-version = "0.12.8"
+version = "0.12.9"
 description = "Cross-platform Nostr desktop client with Lightning integration"
 authors = ["hoornet"]
 edition = "2021"

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Vega",
-  "version": "0.12.8",
+  "version": "0.12.9",
   "identifier": "com.hoornet.vega",
   "build": {
     "beforeDevCommand": "npm run dev",