release: 0.53.0 — R4 auth funnel & abuse hardening

VERSION

@@ -1 +1 @@
-0.52.0
+0.53.0

frontend/src/lib/releaseNotes.ts

@@ -14,6 +14,24 @@ export interface ReleaseEntry {
 }
 
 export const RELEASE_NOTES: ReleaseEntry[] = [
+  {
+    version: "0.53.0",
+    date: "2026-07-23",
+    summary:
+      "Account & sign-in dead ends fixed, a way out of a forgotten messaging passphrase, and share-link password controls — plus security hardening.",
+    features: [
+      "Forgot your secure-messaging passphrase? You can now reset it from the unlock screen and start fresh with a new one. Resetting permanently clears your existing message history (it can't be decrypted without the old passphrase) — you're warned clearly before it happens.",
+      "Didn't get your verification email, or the link expired? You can now request a new one right from the sign-in screen.",
+      "Share links: you can now change or remove the password on an existing link, not just when creating it. Changing it immediately stops the old password from working.",
+    ],
+    fixes: [
+      "Completing a password reset now also verifies your email — so an account that never clicked the original verification link isn't left stuck.",
+      "Cancelling Google sign-in now returns you to the login page with a clear message instead of a raw error page; the same for cancelling a Google connect/upgrade from inside the app.",
+    ],
+    chores: [
+      "Security hardening: rotating a share-link password now instantly revokes links already handed out; the share recipient list and messaging key lookup no longer reveal suspended/deactivated accounts; and assorted race-condition and abuse-surface fixes.",
+    ],
+  },
   {
     version: "0.52.0",
     date: "2026-07-22",