# WeeChat changelog

> A fast, light, extensible chat client.

- Vendor: WeeChat
- Category: Communication
- Platforms: Desktop
- Official site: https://weechat.org
- Tracked by: What's New (https://whatsnew.fyi/product/weechat)
- Harvested from: GitHub (weechat/weechat)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v4.10.0

- Date: 2026-08-02
- Version: v4.10.0
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.10.0
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.10.0
- Labels: Platforms: Desktop

- **added** — Add command /theme
- **added** — Add built-in light theme applied automatically on first start on light-background terminals
- **added** — Add themable flag on configuration options
- **added** — Add options weechat.look.theme and weechat.look.theme_backup
- **added** — Add function theme_register to API
- **added** — Add filter t:themable to fset
- **added** — Add relay/api resource GET /api/scripts
- **added** — Add option relay.network.unix_socket_permissions
- **added** — Add info script_languages to script
- **changed** — Improve speed of /upgrade with a lot of buffers and lines
- **changed** — Improve speed of display of long words in chat area
- **changed** — Add condition on connected relay api clients in default value of option weechat.look.hotlist_add_conditions
- **changed** — Add /mute in default command for key Alt+= (toggle filters)
- **changed** — Change type of parameter pos_option_name to const char ** in function config_search_with_string
- **changed** — Add field last_read_line_id in relay/api GET /api/buffers
- **fixed** — Fix infinite loop when option weechat.look.read_marker_string is set to a string with a width of zero
- **fixed** — Fix option weechat.look.color_real_white not applied when color is white on 16+ colors terminals
- **fixed** — Fix buffer overflow in connection to SOCKS5 proxy
- **fixed** — Fix infinite loop in function string_replace when the search string is empty

###### Added

- core: add command `/theme` ([#1338](https://github.com/weechat/weechat/issues/1338))
- core: add built-in "light" theme, applied automatically on first start on light-background terminals ([#1338](https://github.com/weechat/weechat/issues/1338))
- core: add `themable` flag on configuration options ([#1338](https://github.com/weechat/weechat/issues/1338))
- core: add options weechat.look.theme and weechat.look.theme_backup ([#1338](https://github.com/weechat/weechat/issues/1338))
- api: add function theme_register ([#1338](https://github.com/weechat/weechat/issues/1338))
- fset: add filter `t:themable` ([#1338](https://github.com/weechat/weechat/issues/1338))
- relay/api: add resource `GET /api/scripts`
- relay: add option relay.network.unix_socket_permissions ([#2317](https://github.com/weechat/weechat/issues/2317))
- script: add info "script_languages"

###### Changed

- core: improve speed of `/upgrade` with a lot of buffers and lines ([#2338](https://github.com/weechat/weechat/issues/2338), [#2339](https://github.com/weechat/weechat/issues/2339), [#2341](https://github.com/weechat/weechat/issues/2341))
- core: improve speed of display of long words in chat area ([#2336](https://github.com/weechat/weechat/issues/2336))
- core: add condition on connected relay api clients in default value of option weechat.look.hotlist_add_conditions
- core: add `/mute` in default command for key `Alt`+`=` (toggle filters)
- api: change type of parameter "pos_option_name" to "const char **" in function config_search_with_string
- relay/api: add field "last_read_line_id" in GET /api/buffers

###### Fixed

- core: fix infinite loop when option weechat.look.read_marker_string is set to a string with a width of zero ([#2337](https://github.com/weechat/weechat/issues/2337))
- core: fix option weechat.look.color_real_white not applied when color is "white" on 16+ colors terminals ([#1742](https://github.com/weechat/weechat/issues/1742))
- core: fix buffer overflow in connection to SOCKS5 proxy ([#2325](https://github.com/weechat/weechat/issues/2325))
- api: fix infinite loop in function string_replace when the search string is empty
- api: do not free dynamic string on error in function string_dyn_concat
- irc: fix tag in message with list of names when joining a channel
- fset: remove error displayed in core buffer when clicking with the mouse below the last option displayed
- guile, lua, perl, python, ruby, tcl: fix conversion of dates in the API functions
- irc: fix conversion of dates in received messages

###### Security

- core: fix buffer overflow in display of time in chat area with a custom time format ([#2342](https://github.com/weechat/weechat/issues/2342))
- core: fix integer overflow in size calculation when evaluating "${hide:...}" and "${base_encode:...}" ([#2335](https://github.com/weechat/weechat/issues/2335))
- core: fix possible buffer overflow in command /color alias ([#2330](https://github.com/weechat/weechat/issues/2330))
- core: fix possible buffer overflow in list of commands displayed by /help ([#2330](https://github.com/weechat/weechat/issues/2330))
- irc: fix heap use-after-free when a batched message causes a disconnection from the server ([GHSA-rfmh-3r7f-jpx5](https://github.com/weechat/weechat/security/advisories/GHSA-rfmh-3r7f-jpx5))
- irc: fix stack buffer overflow when splitting a JOIN message with a large list of channels and keys ([GHSA-q2xg-9ggx-77mr](https://github.com/weechat/weechat/security/advisories/GHSA-q2xg-9ggx-77mr))
- irc: limit size of data received from the server to prevent memory exhaustion
- irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message ([#2322](https://github.com/weechat/weechat/issues/2322))
- logger: fix path traversal in log file name when a buffer local variable contains the char used internally to protect directory separators ([#2340](https://github.com/weechat/weechat/issues/2340))
-

_[Truncated at 4000 characters — full notes: https://github.com/weechat/weechat/releases/tag/v4.10.0]_

### v4.9.5

- Date: 2026-07-26
- Version: v4.9.5
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.9.5
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.9.5
- Labels: Platforms: Desktop

- **fixed** — Fix buffer overflow in display of time in chat area with a custom time format
- **security** — Fix heap use-after-free when a batched message causes a disconnection from the server
- **security** — Fix stack buffer overflow when splitting a JOIN message with a large list of channels and keys
- **security** — Fix use-after-free and double free on remote buffer
- **changed** — Increase max size for decompressed websocket frame

###### Fixed

- core: fix buffer overflow in display of time in chat area with a custom time format ([#2342](https://github.com/weechat/weechat/issues/2342))
- irc: fix heap use-after-free when a batched message causes a disconnection from the server ([GHSA-rfmh-3r7f-jpx5](https://github.com/weechat/weechat/security/advisories/GHSA-rfmh-3r7f-jpx5))
- irc: fix stack buffer overflow when splitting a JOIN message with a large list of channels and keys ([GHSA-q2xg-9ggx-77mr](https://github.com/weechat/weechat/security/advisories/GHSA-q2xg-9ggx-77mr))
- relay: fix use-after-free and double free on remote buffer ([GHSA-hx59-4hq9-6vmw](https://github.com/weechat/weechat/security/advisories/GHSA-hx59-4hq9-6vmw))
- relay: increase max size for decompressed websocket frame

##### Download

https://weechat.org/download/weechat/4.9.5/

### v4.9.4

- Date: 2026-07-19
- Version: v4.9.4
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.9.4
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.9.4
- Labels: Platforms: Desktop

- **changed** — Improve speed of display of long words in chat area
- **fixed** — Fix infinite loop when option weechat.look.read_marker_string is set to a string with a width of zero
- **fixed** — Fix integer overflow in size calculation when evaluating ${hide:...} and ${base_encode:...}
- **fixed** — Fix path traversal in log file name when a buffer local variable contains the char used internally to protect directory separators
- **security** — Fix authentication bypass with the plain password hash algorithm

###### Changed

- core: improve speed of display of long words in chat area ([#2336](https://github.com/weechat/weechat/issues/2336))

###### Fixed

- core: fix infinite loop when option weechat.look.read_marker_string is set to a string with a width of zero ([#2337](https://github.com/weechat/weechat/issues/2337))
- core: fix integer overflow in size calculation when evaluating "${hide:...}" and "${base_encode:...}" ([#2335](https://github.com/weechat/weechat/issues/2335))
- logger: fix path traversal in log file name when a buffer local variable contains the char used internally to protect directory separators ([#2340](https://github.com/weechat/weechat/issues/2340))
- relay: fix authentication bypass with the "plain" password hash algorithm ([GHSA-68ff-gq39-pqjm](https://github.com/weechat/weechat/security/advisories/GHSA-68ff-gq39-pqjm))

##### Download

https://weechat.org/download/weechat/4.9.4/

### v4.9.3

- Date: 2026-07-05
- Version: v4.9.3
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.9.3
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.9.3
- Labels: Platforms: Desktop

- **security** — Fix buffer overflow in connection to SOCKS5 proxy
- **security** — Fix possible buffer overflow in command /color alias
- **security** — Fix possible buffer overflow in list of commands displayed by /help
- **fixed** — Do not free dynamic string on error in function string_dyn_concat
- **security** — Fix memory leak in relay/api resources "handshake", "input" and "completion"
- **fixed** — Fix read of uncompressed websocket frame
- **security** — Fix out-of-bounds write in xfer file transfer resume

###### Fixed

- core: fix buffer overflow in connection to SOCKS5 proxy ([#2325](https://github.com/weechat/weechat/issues/2325))
- core: fix possible buffer overflow in command /color alias ([#2330](https://github.com/weechat/weechat/issues/2330))
- core: fix possible buffer overflow in list of commands displayed by /help ([#2330](https://github.com/weechat/weechat/issues/2330))
- api: do not free dynamic string on error in function string_dyn_concat
- relay/api: fix memory leak in resources "handshake", "input" and "completion" ([GHSA-wmpc-m6g9-fwj8](https://github.com/weechat/weechat/security/advisories/GHSA-wmpc-m6g9-fwj8))
- relay: fix read of uncompressed websocket frame ([#2331](https://github.com/weechat/weechat/issues/2331))
- xfer: fix out-of-bounds write in xfer file transfer resume ([#2326](https://github.com/weechat/weechat/issues/2326))

##### Download

https://weechat.org/download/weechat/4.9.3/

### v4.9.2

- Date: 2026-06-07
- Version: v4.9.2
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.9.2
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.9.2
- Labels: Platforms: Desktop

- **fixed** — api: fix infinite loop in function string_replace when the search string is empty
- **fixed** — irc: limit size of data received from the server to prevent memory exhaustion
- **fixed** — irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message
- **fixed** — relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion
- **fixed** — relay: limit size of partial message received while reading an HTTP request to prevent memory exhaustion
- **fixed** — relay: fix out-of-bounds read in dump of data
- **fixed** — xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory
- **fixed** — xfer: fix out-of-bounds read when receiving empty line in DCC chat

###### Fixed

- api: fix infinite loop in function string_replace when the search string is empty
- irc: limit size of data received from the server to prevent memory exhaustion
- irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message ([#2322](https://github.com/weechat/weechat/issues/2322))
- relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion
- relay: limit size of partial message received while reading an HTTP request to prevent memory exhaustion
- relay: fix out-of-bounds read in dump of data ([#2324](https://github.com/weechat/weechat/issues/2324))
- xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory ([#2321](https://github.com/weechat/weechat/issues/2321))
- xfer: fix out-of-bounds read when receiving empty line in DCC chat ([#2323](https://github.com/weechat/weechat/issues/2323))

##### Download

https://weechat.org/download/weechat/4.9.2/

### v4.9.1

- Date: 2026-05-31
- Version: v4.9.1
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.9.1
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.9.1
- Labels: Platforms: Desktop

- **fixed** — Fix option weechat.look.color_real_white not applied when color is white on 16+ colors terminals
- **fixed** — Fix tag in message with list of names when joining a channel
- **security** — Limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion
- **security** — Fix timing attack on password authentication
- **security** — Fix timing attack on TOTP validation

###### Fixed

- core: fix option weechat.look.color_real_white not applied when color is "white" on 16+ colors terminals ([#1742](https://github.com/weechat/weechat/issues/1742))
- irc: fix tag in message with list of names when joining a channel
- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3), [CVE-2026-53524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53524))
- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))
- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))

##### Download

https://weechat.org/download/weechat/4.9.1/

### v4.9.0

- Date: 2026-03-29
- Version: v4.9.0
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.9.0
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.9.0
- Labels: Platforms: Desktop

- **added** — Add option `-e` to evaluate all commands before executing them in command `/eval`
- **changed** — Evaluate option xfer.network.own_ip
- **added** — Add option typing.look.item_text
- **fixed** — Fix crash with `/eval` when the current buffer is closed in a command
- **fixed** — Fix buffer size in function util_parse_time, causing buffer overflow error in unit tests
- **fixed** — Fix display of CTCP query sent multiple times to the same user when capability echo-message is enabled
- **fixed** — Fix unit of server option `anti_flood` from seconds to milliseconds in output of `/server listfull`
- **fixed** — Fix creation of irc.msgbuffer option without a server name
- **fixed** — Ignore self join if the channel is already joined
- **fixed** — Fix memory leaks in resources "ping" and "sync"
- **fixed** — Fix memory leak in receive of message from remote WeeChat

###### Changed

- core: add option `-e` to evaluate all commands before executing them in command `/eval`
- xfer: evaluate option xfer.network.own_ip

###### Added

- typing: add option typing.look.item_text ([#2305](https://github.com/weechat/weechat/issues/2305))

###### Fixed

- core: fix crash with `/eval` when the current buffer is closed in a command
- core: fix buffer size in function util_parse_time, causing buffer overflow error in unit tests
- irc: fix display of CTCP query sent multiple times to the same user when capability echo-message is enabled ([#2309](https://github.com/weechat/weechat/issues/2309))
- irc: fix unit of server option `anti_flood` from seconds to milliseconds in output of `/server listfull`
- irc: fix creation of irc.msgbuffer option without a server name
- irc: ignore self join if the channel is already joined ([#2291](https://github.com/weechat/weechat/issues/2291))
- relay/api: fix memory leaks in resources "ping" and "sync"
- relay/api: fix memory leak in receive of message from remote WeeChat

##### Download

https://weechat.org/download/weechat/4.9.0/

### v4.8.2

- Date: 2026-03-06
- Version: v4.8.2
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.8.2
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.8.2
- Labels: Platforms: Desktop

- **fixed** — Ignore self join if the channel is already joined in IRC
- **fixed** — Fix memory leaks in relay/api resources ping and sync
- **fixed** — Fix memory leak in relay/api receive of message from remote WeeChat

###### Fixed

- irc: ignore self join if the channel is already joined ([#2291](https://github.com/weechat/weechat/issues/2291))
- relay/api: fix memory leaks in resources "ping" and "sync"
- relay/api: fix memory leak in receive of message from remote WeeChat

##### Download

https://weechat.org/download/weechat/4.8.2/

### v4.8.1

- Date: 2025-12-01
- Version: v4.8.1
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.8.1
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.8.1
- Labels: Platforms: Desktop

- **fixed** — fix buffer size in function util_parse_time, causing buffer overflow error in unit tests
- **fixed** — fix creation of irc.msgbuffer option without a server name

###### Fixed

- core: fix buffer size in function util_parse_time, causing buffer overflow error in unit tests
- irc: fix creation of irc.msgbuffer option without a server name

##### Download

https://weechat.org/download/weechat/4.8.1/

### v4.8.0

- Date: 2025-11-30
- Version: v4.8.0
- Original notes: https://github.com/weechat/weechat/releases/tag/v4.8.0
- Permalink: https://whatsnew.fyi/product/weechat/releases/v4.8.0
- Labels: Platforms: Desktop

- **removed** — Remove temporary servers and option irc.look.temporary_servers
- **changed** — Add support of date like ISO 8601 but with spaces and lower t and z in function util_parse_time
- **changed** — Request and perform SASL authentication when the server advertises SASL support with message CAP NEW
- **changed** — Send SASL username with mechanism EXTERNAL
- **changed** — Change default time format to %@%F %T.%fZ (UTC)
- **changed** — Use function util_parse_time to parse date/time in log files
- **changed** — Return an error 400 (Bad Request) when URL parameters "colors", "nicks", "lines" and "lines_free" have an invalid value
- **changed** — Return an error 401 (Unauthorized) when header "x-weechat-totp" has an invalid value
- **changed** — Add buffer local variable "server" in DCC CHAT buffers
- **changed** — Add tag "tls" in gnutls messages
- **changed** — Add tags "irc_cap" and "log3" in client capability request and SASL not supported messages
- **changed** — Require Curl ≥ 7.68.0
- **changed** — Require GnuTLS ≥ 3.6.3
- **changed** — Require libgcrypt ≥ 1.8.0
- **changed** — Require Enchant v2
- **changed** — Require Lua ≥ 5.3
- **added** — Add option weechat.completion.cycle
- **added** — Add hdata for hooks
- **added** — Add functions util_parse_int, util_parse_long and util_parse_longlong
- **added** — Add variable ${index_displayed} in buflist

###### Removed

- irc: remove temporary servers and option irc.look.temporary_servers

###### Changed

- api: add support of date like ISO 8601 but with spaces and lower `t` and `z` in function util_parse_time ([#886](https://github.com/weechat/weechat/issues/886))
- irc: request and perform SASL authentication when the server advertises SASL support with message "CAP NEW" ([#2277](https://github.com/weechat/weechat/issues/2277))
- irc: send SASL username with mechanism EXTERNAL ([#2270](https://github.com/weechat/weechat/issues/2270))
- logger: change default time format to `%@%F %T.%fZ` (UTC) ([#886](https://github.com/weechat/weechat/issues/886))
- logger: use function util_parse_time to parse date/time in log files ([#886](https://github.com/weechat/weechat/issues/886))
- relay/api: return an error 400 (Bad Request) when URL parameters "colors", "nicks", "lines" and "lines_free" have an invalid value
- relay/api: return an error 401 (Unauthorized) when header "x-weechat-totp" has an invalid value
- xfer: add buffer local variable "server" in DCC CHAT buffers
- core, irc, relay: add tag "tls" in gnutls messages
- irc: add tags "irc_cap" and "log3" in client capability request and SASL not supported messages
- build: require Curl ≥ 7.68.0 ([#2268](https://github.com/weechat/weechat/issues/2268))
- build: require GnuTLS ≥ 3.6.3 ([#2268](https://github.com/weechat/weechat/issues/2268))
- build: require libgcrypt ≥ 1.8.0 ([#2268](https://github.com/weechat/weechat/issues/2268))
- build: require Enchant v2 ([#2268](https://github.com/weechat/weechat/issues/2268))
- build: require Lua ≥ 5.3 ([#2268](https://github.com/weechat/weechat/issues/2268))

###### Added

- core: add option weechat.completion.cycle
- core: add hdata for hooks
- api: add functions util_parse_int, util_parse_long and util_parse_longlong
- buflist: add variable `${index_displayed}`

###### Fixed

- core: display an error message in case of invalid parameters in commands `/bar`, `/buffer`, `/cursor`, `/print` and `/window`
- api: fix file descriptor leak in hook_url when a timeout occurs or if the hook is removed during the transfer ([#2284](https://github.com/weechat/weechat/issues/2284))
- api: fix parsing of date/times with timezone offset in function util_parse_time
- irc: fix warning on creation of irc.msgbuffer option when the server name contains upper case letters ([#2281](https://github.com/weechat/weechat/issues/2281))
- irc: display a warning for each unknown or invalid server option in commands `/connect` and `/server`
- irc: fix colors in messages 367 (ban mask), 728 (quiet mask) and MODE ([#2286](https://github.com/weechat/weechat/issues/2286))
- irc: fix reset of color when multiple modes are set with command `/mode`
- relay/api: fix crash when an invalid HTTP request is received from a client
- relay/api: return HTTP error 404 instead of 400 when the buffer is not found in resources completion and input
- relay/api: return HTTP error 400 in case of invalid body in resource ping

##### Download

https://weechat.org/download/weechat/4.8.0/