chore: release new version 🚀

CHANGELOG.md

@@ -1,5 +1,43 @@
 # nostream
 
+## 3.11.0
+
+### Minor Changes
+
+- [#1030](https://github.com/cameri/nostream/pull/1030) [`9b585db`](https://github.com/cameri/nostream/commit/9b585db93796b4149d3932487686a46a597b7643) Thanks [@Ferryx349](https://github.com/Ferryx349)! - feat(peering): authenticate peer relays with NIP-42 using the relay keypair
+
+  Adds the peering identity layer: a configured `peering.peers` trust list keyed
+  by relay pubkey (hex or `npub`), outbound NIP-42 AUTH signed with the relay's own
+  keypair, and inbound recognition of a verified peer pubkey on the connection
+  state. Peer status is tied to the NIP-42 session, so it expires or clears with
+  the socket; a valid AUTH from an unconfigured pubkey stays an ordinary client.
+
+  `peering.peers[].relayUrl` is the outbound address only — identity is always the
+  verified pubkey, never the URL. Relay key storage and the AUTH exchange are
+  documented in `docs/PEERING.md`, and the new fields are validated with the rest
+  of the settings document.
+
+### Patch Changes
+
+- [#1024](https://github.com/cameri/nostream/pull/1024) [`eb304b8`](https://github.com/cameri/nostream/commit/eb304b80c9cb997634509df8ef8155fe8ef619dd) Thanks [@chappie-daemon](https://github.com/chappie-daemon)! - fix(deps): bump knex to 3.2.9 for the search_path SQL injection (AIKIDO-2026-10469)
+
+  knex 0.0.1–3.2.8 interpolates values passed to `searchPath` for the Postgres
+  dialect into generated SQL without validating or escaping them, so a value an
+  attacker can influence becomes an injected identifier. 3.2.9 escapes the double
+  quotes ([#6411](https://github.com/cameri/nostream/issues/6411)); this repository declares `knex` 2.4.2 on both the default branch
+  and `rewrite/main`.
+
+  nostream never sets `searchPath` — `grep -rn "search_path" src/` finds nothing —
+  so the reachable path is not exercised today, and the bump is taken to remove a
+  vulnerable dependency from the image, not to close a reachable hole.
+
+  knex 3.0.0 drops Node < 16, which the repo already requires (>=24.14.1), and 3.2.0
+  tightens `RawBinding`. The one compile error that surfaced,
+  `src/scripts/benchmark-queries.ts` passing `bindings as readonly unknown[]` to
+  `db.raw()`, is fixed by dropping the assertion: `toSQL().bindings` is already the
+  accepted type. The emitted JavaScript is byte-identical with and without the
+  assertion.
+
 ## 3.10.2
 
 ### Patch Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostream",
-  "version": "3.10.2",
+  "version": "3.11.0",
   "packageManager": "pnpm@10.33.0",
   "private": true,
   "description": "A Nostr relay written in Typescript.",