Nostr VPN 4.1.3

Most People Will Want

• Nostr VPN for macOS (Apple Silicon): nostr-vpn-v4.1.3-macos-arm64.dmg
• Nostr VPN for Debian/Ubuntu (.deb): nostr-vpn-v4.1.3-linux-x64.deb
• Nostr VPN for Windows: nostr-vpn-v4.1.3-windows-x64-setup.exe
• Nostr VPN for Android: nostr-vpn-v4.1.3-android-arm64.apk

StartOS Servers

Server One and Server Pure use x86_64; use aarch64 only for an ARM64 StartOS host.

• Nostr VPN for StartOS (x86_64): nostr-vpn-v4.1.3-startos-x86_64.s9pk
• Nostr VPN for StartOS (aarch64): nostr-vpn-v4.1.3-startos-aarch64.s9pk

Command Line

• macOS Apple Silicon CLI: nvpn-aarch64-apple-darwin.tar.gz
• Linux x64 CLI: nvpn-x86_64-unknown-linux-musl.tar.gz
• Linux ARM64 CLI: nvpn-aarch64-unknown-linux-musl.tar.gz
• Windows x64 CLI: nvpn-v4.1.3-x86_64-pc-windows-msvc.zip

Other Files

• Android arm64 AAB: nostr-vpn-v4.1.3-android-arm64.aab
• macOS Apple Silicon updater archive: nostr-vpn-v4.1.3-macos-arm64.app.tar.gz
• nvpn-arm-unknown-linux-musleabihf.tar.gz: nvpn-arm-unknown-linux-musleabihf.tar.gz
• nvpn-v4.1.3-arm-unknown-linux-musleabihf.tar.gz: nvpn-v4.1.3-arm-unknown-linux-musleabihf.tar.gz

Changes

Added

• Add one cross-platform exit DNS policy with automatic WireGuard-profile DNS,

built-in or custom encrypted DNS, and explicit DNS-through-exit options.

• Add physical Android and iOS WireGuard exit release coverage that proves

provider-side forwarding, profile DNS, public Internet access, TUN traffic, and native device DNS/Internet restoration after disconnect.

Changed

• Shorten release validation by running the remote Windows lane and one shared

Docker image build alongside host checks, then overlapping subnet-isolated NAT and kernel/userspace WireGuard fixtures while keeping roaming, throughput, device, and idle-CPU measurements contention-free and serial.

• Add a focused loaded-latency scenario so performance outliers can be repeated

without paying for the full roaming and network-change suite.

Fixed

• Restore the original Direct route and DNS ownership after WireGuard and

private-exit transitions on macOS and Windows without disturbing scoped VPN routes or the WireGuard endpoint's underlay route.

• Keep daemon reload acknowledgements and offline paid-exit retries from

delaying tunnel maintenance and route convergence.

• Keep iOS physical-device debug signing independent from the App Store

distribution identity used by release uploads.

• Reduce joined iOS onboarding polling so an idle app stays within the mobile

CPU release budget.

• Build Windows release and smoke-test artifacts away from the live service,

and fail instead of reusing an installer after a nested build error.

Release Build

• Built from commit 3ee1b3d7d4234919a512459ce5f0eead8b1c5999 for release v4.1.3.
• Built signed and notarized Apple Silicon macOS DMG and updater archive.
• Built Linux x64 desktop Debian package.
• Built Windows x64 installer.
• Built signed Android arm64 APK/AAB.
• Built signed StartOS packages for x86_64 and aarch64.