Rspamd vs Rocket.Chat

The 4.1.x series has moved fast on two fronts. The neural plugin gained pluggable feature-provider and ANN-architecture registries, multi-head attention pooling, slice and concat graph transforms, and a static_embed provider running a WordPiece subword tokenizer over a static embedding matrix. Separately the fuzzy subsystem got structured match results with a diagnostics API, Redis-persisted shingle sets and per-hash introspection. 4.1.4 in July fixed a critical controller bug where a malformed password hash caused it to fail open and accept any password, alongside a set of PCRE2 leaks and unbounded-match conditions in the regexp engine.

The neural work is the strategic thread: turning a fixed classifier into a registry where feature extraction and network architecture are both swappable is what lets learned filtering evolve without forking the daemon. Around it, the project is systematically bounding resource use under adversarial input — regexp heap limits, zip-bomb extraction caps, per-message word budgets, a Lua URL filter consulted twice per field instead of once per byte. The front end is being simplified in the opposite direction, with jQuery, Font Awesome and FooTable all removed outright.

The registries and the static embedding provider arrived one release apart, so the piece not yet visible in these notes is a shipped model that uses them. Whether Rspamd distributes one or leaves it to operators is not indicated here.