v1.9.4

Security

• Pin Go toolchain to 1.25.11 (#34) — govulncheck flagged 19 reachable Go standard library vulnerabilities (crypto/tls, crypto/x509, net/http, net/url, net/textproto, encoding/asn1) when building with go1.24.4. The toolchain directive in go.mod now pins go1.25.11, which patches all of them. The go 1.21 language minimum is unchanged, so consumers on Go ≥ 1.21 are unaffected; builds of this module now use a patched toolchain. govulncheck reports no vulnerabilities in either the main or integration-test module.

Fixes

• Publish-recovery hardening (#31) — bounded polling, content-based carousel matching, and a root-post discriminator when recovering from /threads_publish HTTP 5xx and code-10 false failures; context errors are now propagated during recovery.

CI

• Bump actions/checkout to v7 and codecov/codecov-action to v7 (covers dependabot #33, #32).

Full changelog: v1.9.3...v1.9.4

v1.9.3

What's Changed

• Recover from /threads_publish HTTP 5xx + code 10 false-failures by @tirthpatell in #30

Full Changelog: v1.9.2...v1.9.3

v1.9.2

What's Changed

• fix: NewClientWithToken /me fallback + non-retryable auth errors by @tirthpatell in #29

Full Changelog: v1.9.1...v1.9.2

v1.9.1

What's Changed

• fix(auth): DebugToken must call Meta with app access token by @tirthpatell in #28

Full Changelog: v1.9.0...v1.9.1

v1.9.0

Security-focused release. Hardens OAuth against login CSRF (CWE-352) and tightens log redaction, ownership checks, and rate-limit thread-safety. Contains API breakage on the auth surface only.

Breaking changes

• Authenticator.GetAuthURL now returns (authURL, state, err) instead of just a URL string. Callers must persist state (session/cookie) and pass it back on exchange.

• Authenticator.ExchangeCodeForToken now requires (ctx, code, expectedState, receivedState). The two states are compared with crypto/subtle.ConstantTimeCompare before any network call; mismatch or empty values return a ValidationError.

  Migration: see examples/authentication/main.go.

Security fixes

• OAuth state CSRF (HIGH, CWE-352): state is generated with crypto/rand and surfaced to the caller; the predictable time-based fallback was removed (fail-closed on rand errors).
• Debug-log redaction: access_token, client_secret, input_token, code, and refresh_token are redacted from request URLs before logging.
• validatePostOwnership: prefers numeric owner ID over username and fails closed on empty identifiers — previously two empty strings compared equal and silently authorised deletion.
• DisableRateLimiting / EnableRateLimiting: the HTTPClient's limiter is now an atomic.Pointer so toggling from one goroutine is race-safe against an in-flight request on another.

CI / chores

• Bump schneegans/dynamic-badges-action v1.7.0 → v1.8.0 (supersedes #25).
• Bump codecov/codecov-action v5 → v6 (supersedes #26).
• Drop TestIntegration_GIFPosts — Tenor API deprecated.

Full Changelog: v1.8.0...v1.9.0

v1.8.0

Breaking Changes

This release includes source-incompatible changes to exported interfaces and types. Code that implements these interfaces (e.g., mocks, test wrappers) or reads these fields will need updates.

Change	Before	After
PostDeleter.DeletePost return	error	(string, error) — returns deleted_id
PostReader.GetUserMentions param	*PaginationOptions	*PostsOptions — adds since/until support
Post.ReplyAudience type	string	ReplyAudience (typed constant)
Post.HideStatus type	string	HideStatus (typed constant)
Post.TextEntities type	[]TextEntity	*TextEntitiesResponse (API returns {"data": [...]} wrapper)

New Features

• App Access Tokens — GetAppAccessToken() and GetAppAccessTokenShorthand() for app-level auth (e.g., oEmbed API)
• Ghost Posts on interface — GetUserGhostPosts added to PostReader interface
• Mentions time filtering — GetUserMentions now supports since/until unix timestamp parameters
• Response media type constants — MediaTypeResponseText (TEXT_POST), MediaTypeResponseCarousel (CAROUSEL_ALBUM), MediaTypeAudio, MediaTypeRepostFacade
• Typed reply/hide constants — ReplyAudience (5 values) and HideStatus (6 values) for type-safe response handling
• Geo-gating error codes — ErrCodeFeatureNotAvailable, ErrCodeGeoGatingInvalidCountryCodes
• Container error constants — 10 typed ContainerErr* constants for programmatic error handling

Bug Fixes

• Post struct missing fields — Added IsSpoilerMedia, TextEntities, TextAttachment, AllowlistedCountryCodes, LocationID, Location
• User.RecentlySearchedKeywords — Fixed type from []string to []RecentSearch (struct with Query/Timestamp) and wired field mapping
• User.IsEligibleForGeoGating — Added missing boolean field
• TotalValue.LinkURL — Added for per-link click metric breakdowns
• ContainerBuilder.SetIsGhostPost — Now order-independent with SetMediaType; SetIsGhostPost(false) correctly clears the flag

Validation Improvements

• Poll options: require sequential ordering (D requires C), reject whitespace-only options, enforce 1–25 char length
• Alt text: enforce 1000-character max on image/video posts
• Text styling: validate style values against allowed set (bold, italic, highlight, underline, strikethrough)
• Timestamps: since/until validated against MinSearchTimestamp on all endpoints (GetUserPostsWithOptions, GetUserMentions, GetPublicProfilePosts, GetUserReplies), with since <= until ordering check
• ValidatePostsOptions centralizes pagination + timestamp validation

Documentation

• Rate limit formula (4800 × Impressions) and per-operation defaults documented on QuotaConfig
• views/shares insight metrics marked as "in development" per API docs
• DeletePost documents 100/24hr limit and threads_delete scope requirement
• GetAppAccessToken notes RFC 6749 deviation (GET exposes client_secret)

Other

• Version constant updated from 1.1.0 to 1.8.0 (was stale; aligns with release tags)
• Test coverage improvements across all new code paths
• Replace Dependabot with govulncheck, increase coverage to 93.6%, add Codecov

Full Changelog: v1.7.1...v1.8.0

v1.7.1

What's Changed

• fix: use unicode character count for text length validation by @shyuan in #18
• fix: library improvements - bug fixes, tests, and coverage badge by @tirthpatell in #19
• fix: restrict GITHUB_TOKEN permissions in CI workflows by @tirthpatell in #20
• docs: update README, examples, and docs for recent API features by @tirthpatell in #21

New Contributors

• @shyuan made their first contribution in #18

Full Changelog: v1.7.0...v1.7.1

v1.7.0

What's Changed

• fix: improve retry logic, error metadata, and container lifecycle by @tirthpatell in #17

Full Changelog: v1.6.0...v1.7.0

v1.6.0

What's Changed

• feat: Add March 2026 API updates and fix carousel ordering by @tirthpatell in #16

Full Changelog: v1.5.0...v1.6.0

v1.5.0

What's Changed

• feat: Add February 2026 Threads API updates by @tirthpatell in #15

Full Changelog: v1.4.0...v1.5.0