Merge remote-tracking branch 'origin/develop' into webfinger-fix

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>
2023-12-22 13:29:56 +01:00 · 2023-12-22 13:29:56 +01:00 · 28e5e65676
commit 28e5e65676
parent 39d3df86c8 5f1d707367
365 changed files with 3208 additions and 872 deletions
--- a/changelog.d/2023-06-deps-update.skip
+++ b/changelog.d/2023-06-deps-update.skip
--- a/changelog.d/2.6.1-mergeback.skip
+++ b/changelog.d/2.6.1-mergeback.skip
--- a/changelog.d/3126.fix
+++ b/changelog.d/3126.fix
@ -1 +0,0 @@
-MediaProxy responses now return a sandbox CSP header
--- a/changelog.d/3801.fix
+++ b/changelog.d/3801.fix
@ -1 +0,0 @@
-Filter context activities using Visibility.visible_for_user?
--- a/changelog.d/3848.add
+++ b/changelog.d/3848.add
@ -1 +0,0 @@
-Add OAuth scope descriptions
--- a/changelog.d/3872.remove
+++ b/changelog.d/3872.remove
@ -1 +0,0 @@
-remove BBS/SSH feature, replaced by an external bridge.
--- a/changelog.d/3873.fix
+++ b/changelog.d/3873.fix
@ -1 +0,0 @@
-UploadedMedia: Add missing disposition_type to Content-Disposition
--- a/changelog.d/3874.remove
+++ b/changelog.d/3874.remove
@ -1 +0,0 @@
-Remove a few unused indexes.
--- a/changelog.d/3879.fix
+++ b/changelog.d/3879.fix
@ -1 +0,0 @@
-fix not being able to fetch flash file from remote instance
--- a/changelog.d/3880.remove
+++ b/changelog.d/3880.remove
@ -1 +0,0 @@
-Cleanup OStatus-era user upgrades and ap_enabled indicator
--- a/changelog.d/3882.add
+++ b/changelog.d/3882.add
@ -1 +0,0 @@
-Allow lang attribute in status text
--- a/changelog.d/3883.fix
+++ b/changelog.d/3883.fix
@ -1 +0,0 @@
-Fix abnormal behaviour when refetching a poll
--- a/changelog.d/3884.fix
+++ b/changelog.d/3884.fix
@ -1 +0,0 @@
-Allow non-HTTP(s) URIs in "url" fields for compatibility with "FEP-fffd: Proxy Objects"
--- a/changelog.d/3885.fix
+++ b/changelog.d/3885.fix
@ -1 +0,0 @@
-Fix opengraph and twitter card meta tags
--- a/changelog.d/3888.fix
+++ b/changelog.d/3888.fix
@ -1 +0,0 @@
-ForceMentionsInContent: fix double mentions for Mastodon/Misskey posts
--- a/changelog.d/3891.fix
+++ b/changelog.d/3891.fix
@ -1 +0,0 @@
-OEmbed HTML tags are now filtered
--- a/changelog.d/3897.add
+++ b/changelog.d/3897.add
@ -1 +0,0 @@
-OnlyMedia Upload Filter
--- a/changelog.d/3900.change
+++ b/changelog.d/3900.change
@ -0,0 +1 @@
+Update to Phoenix 1.7
--- a/changelog.d/3901.security
+++ b/changelog.d/3901.security
@ -1 +0,0 @@
-Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.
--- a/changelog.d/3987.fix
+++ b/changelog.d/3987.fix
@ -0,0 +1 @@
+Remove checking ImageMagick's commands for Pleroma.Upload.Filter.AnalyzeMetadata
--- a/changelog.d/add-outbox.fix
+++ b/changelog.d/add-outbox.fix
@ -0,0 +1 @@
+ap userview: add outbox field.
--- a/changelog.d/akkoma-xml-remote-entities.security
+++ b/changelog.d/akkoma-xml-remote-entities.security
@ -1 +0,0 @@
-Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem
--- a/changelog.d/anonymous-exception-else.fix
+++ b/changelog.d/anonymous-exception-else.fix
@ -0,0 +1 @@
+Fix #strip_report_status_data
--- a/changelog.d/attachment-type-check.fix
+++ b/changelog.d/attachment-type-check.fix
@ -1 +0,0 @@
-Restrict attachments to only uploaded files only
--- a/changelog.d/authorize-interaction.add
+++ b/changelog.d/authorize-interaction.add
@ -0,0 +1 @@
+Support /authorize-interaction route used by Mastodon
--- a/changelog.d/bad_inbox_request.change
+++ b/changelog.d/bad_inbox_request.change
@ -0,0 +1 @@
+Invalid activities delivered to the inbox will be rejected with a 400 Bad Request
--- a/changelog.d/bare_uri_test.skip
+++ b/changelog.d/bare_uri_test.skip
--- a/changelog.d/benchee.skip
+++ b/changelog.d/benchee.skip
--- a/changelog.d/blurhash.change
+++ b/changelog.d/blurhash.change
@ -0,0 +1 @@
+Replace eblurhash with rinpatch_blurhash. This also removes a dependency on ImageMagick.
--- a/changelog.d/build-release-with-local-libvips.skip
+++ b/changelog.d/build-release-with-local-libvips.skip
--- a/changelog.d/check-attachment-attribution.security
+++ b/changelog.d/check-attachment-attribution.security
@ -1 +0,0 @@
-CommonAPI: Prevent users from accessing media of other users by creating a status with reused attachment ID
--- a/changelog.d/delete-status-of-banned-user.fix
+++ b/changelog.d/delete-status-of-banned-user.fix
@ -1 +0,0 @@
-Fix error 404 when deleting status of a banned user
--- a/changelog.d/deprecate-scrobbles.remove
+++ b/changelog.d/deprecate-scrobbles.remove
@ -1 +0,0 @@
-Deprecate Pleroma's audio scrobbling
--- a/changelog.d/deprecations.skip
+++ b/changelog.d/deprecations.skip
@ -0,0 +1 @@
+
--- a/changelog.d/deprecations2.skip
+++ b/changelog.d/deprecations2.skip
--- a/changelog.d/digest_emails.fix
+++ b/changelog.d/digest_emails.fix
@ -0,0 +1 @@
+Fix the processing of email digest jobs.
--- a/changelog.d/disable-xml-entity-resolution.security
+++ b/changelog.d/disable-xml-entity-resolution.security
@ -1 +0,0 @@
-Disable XML entity resolution completely to fix a dos vulnerability
--- a/changelog.d/doc-fix.skip
+++ b/changelog.d/doc-fix.skip
--- a/changelog.d/dockerfile-config-perms.fix
+++ b/changelog.d/dockerfile-config-perms.fix
@ -1 +0,0 @@
- Fix config ownership in dockerfile to pass restriction test
--- a/changelog.d/docs-max-elixir-erlang.change
+++ b/changelog.d/docs-max-elixir-erlang.change
@ -0,0 +1 @@
+- Document maximum supported version of Erlang & Elixir
--- a/changelog.d/emoji-pack-sanitization.security
+++ b/changelog.d/emoji-pack-sanitization.security
@ -1 +0,0 @@
-Emoji pack loader sanitizes pack names
--- a/changelog.d/emoji-policy.add
+++ b/changelog.d/emoji-policy.add
@ -1 +0,0 @@
-Implement MRF policy to reject or delist according to emojis
--- a/changelog.d/favicon.add
+++ b/changelog.d/favicon.add
@ -0,0 +1 @@
+Add support for configuring favicon, embed favicon and PWA manifest in server-generated meta
--- a/changelog.d/featured-collection-shouldnt-break-user-fetch.fix
+++ b/changelog.d/featured-collection-shouldnt-break-user-fetch.fix
@ -1 +0,0 @@
-Fix user fetch completely broken if featured collection is not in a supported form
--- a/changelog.d/federation_status-access.change
+++ b/changelog.d/federation_status-access.change
@ -0,0 +1 @@
+- Make `/api/v1/pleroma/federation_status` publicly available
--- a/changelog.d/fix-dockerfile.skip
+++ b/changelog.d/fix-dockerfile.skip
--- a/changelog.d/fix-object-test.fix
+++ b/changelog.d/fix-object-test.fix
@ -1 +0,0 @@
-Correctly handle the situation when a poll has both "anyOf" and "oneOf" but one of them being empty
--- a/changelog.d/fix-otp-comparison.skip
+++ b/changelog.d/fix-otp-comparison.skip
--- a/changelog.d/fix-tests.skip
+++ b/changelog.d/fix-tests.skip
--- a/changelog.d/frontend-management.add
+++ b/changelog.d/frontend-management.add
@ -0,0 +1 @@
+[docs] add frontends management documentation
--- a/changelog.d/generate-unset-user-keys-migration.skip
+++ b/changelog.d/generate-unset-user-keys-migration.skip
--- a/changelog.d/gentoo_otp_hotfix.skip
+++ b/changelog.d/gentoo_otp_hotfix.skip
--- a/changelog.d/gentoo_otp_intro.skip
+++ b/changelog.d/gentoo_otp_intro.skip
--- a/changelog.d/handle-report-from-deactivated-user.fix
+++ b/changelog.d/handle-report-from-deactivated-user.fix
@ -1 +0,0 @@
-Fix handling report from a deactivated user
--- a/changelog.d/healthcheck-disabled-error.fix
+++ b/changelog.d/healthcheck-disabled-error.fix
@ -0,0 +1 @@
+TwitterAPI: Return proper error when healthcheck is disabled
--- a/changelog.d/instance-v2.add
+++ b/changelog.d/instance-v2.add
@ -0,0 +1 @@
+Implement /api/v2/instance route
--- a/changelog.d/last_status_at.change
+++ b/changelog.d/last_status_at.change
@ -0,0 +1 @@
+- Change AccountView `last_status_at` from a datetime to a date (as done in Mastodon 3.1.0)
--- a/changelog.d/lint.skip
+++ b/changelog.d/lint.skip
--- a/changelog.d/loading-order-test-fix.skip
+++ b/changelog.d/loading-order-test-fix.skip
--- a/changelog.d/media-altdomain.skip
+++ b/changelog.d/media-altdomain.skip
--- a/changelog.d/meilisearch.add
+++ b/changelog.d/meilisearch.add
@ -0,0 +1 @@
+Add meilisearch, make search engines pluggable
--- a/changelog.d/migration-fix.skip
+++ b/changelog.d/migration-fix.skip
@ -0,0 +1 @@
+
--- a/changelog.d/no-async-with-clear-config.skip
+++ b/changelog.d/no-async-with-clear-config.skip
--- a/changelog.d/no_new_privs.add
+++ b/changelog.d/no_new_privs.add
@ -1 +0,0 @@
-(hardening) Add no_new_privs=yes to OpenRC service files
--- a/changelog.d/opengraph-rich-media-proxy.add
+++ b/changelog.d/opengraph-rich-media-proxy.add
@ -0,0 +1 @@
+Add media proxy to opengraph rich media cards
--- a/changelog.d/optimistic-inbox.change
+++ b/changelog.d/optimistic-inbox.change
@ -0,0 +1 @@
+Optimistic Inbox reduces the processing overhead of incoming activities without instantly verifiable signatures.
--- a/changelog.d/otp_perms.security
+++ b/changelog.d/otp_perms.security
@ -1 +0,0 @@
- Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories
--- a/changelog.d/pipeline-triggers.skip
+++ b/changelog.d/pipeline-triggers.skip
--- a/changelog.d/prevent-bypassing-authorized-fetch-mode.fix
+++ b/changelog.d/prevent-bypassing-authorized-fetch-mode.fix
@ -1 +0,0 @@
-Prevent using the .json format to bypass authorized fetch mode
--- a/changelog.d/prioritize-direct-recipients.add
+++ b/changelog.d/prioritize-direct-recipients.add
@ -0,0 +1 @@
+- Prioritize mentioned recipients (i.e., those that are not just followers) when federating.
--- a/changelog.d/promex.change
+++ b/changelog.d/promex.change
@ -0,0 +1 @@
+Change the prometheus library to PromEx.
--- a/changelog.d/punycode-mention.fix
+++ b/changelog.d/punycode-mention.fix
@ -1 +0,0 @@
-Fix mentioning punycode domains when using Markdown
--- a/changelog.d/quote.add
+++ b/changelog.d/quote.add
@ -1 +0,0 @@
-Implement quotes
--- a/changelog.d/distro-docs-elixir-1.11.skip
+++ b/changelog.d/distro-docs-elixir-1.11.skip
--- a/changelog.d/reachability.change
+++ b/changelog.d/reachability.change
@ -0,0 +1 @@
+Reduce the reachability timestamp update to a single upsert query
--- a/changelog.d/scrobble-url.add
+++ b/changelog.d/scrobble-url.add
@ -0,0 +1 @@
+Adds the capability to add a URL to a scrobble (optional field)
--- a/changelog.d/scrubbers-html4-GtS.add
+++ b/changelog.d/scrubbers-html4-GtS.add
@ -0,0 +1 @@
+- scrubbers/default: Add more formatting elements from HTML4 / GoToSocial (acronym, bdo, big, cite, dfn, ins, kbd, q, samp, s, tt, var, wbr)
--- a/changelog.d/system-cflags.fix
+++ b/changelog.d/system-cflags.fix
@ -0,0 +1 @@
+- Fix eblurhash and elixir-captcha not using system cflags
--- a/changelog.d/testfix-system-config-use.skip
+++ b/changelog.d/testfix-system-config-use.skip
--- a/changelog.d/testsecrets.skip
+++ b/changelog.d/testsecrets.skip
--- a/changelog.d/unified-streaming.add
+++ b/changelog.d/unified-streaming.add
@ -1 +0,0 @@
-Add unified streaming endpoint
--- a/changelog.d/update-credentials-limit-error.fix
+++ b/changelog.d/update-credentials-limit-error.fix
@ -1 +0,0 @@
-Show more informative errors when profile exceeds char limits
--- a/changelog.d/vips.change
+++ b/changelog.d/vips.change
@ -0,0 +1 @@
+Change mediaproxy previews to use vips to generate thumbnails instead of ImageMagick
--- a/changelog.d/web_push.fix
+++ b/changelog.d/web_push.fix
@ -0,0 +1 @@
+Fix web push notifications not successfully delivering
				`@ -1 +0,0 @@`
				`MediaProxy responses now return a sandbox CSP header`
				`@ -1 +0,0 @@`
				`Filter context activities using Visibility.visible_for_user?`
				`@ -1 +0,0 @@`
				`remove BBS/SSH feature, replaced by an external bridge.`
				`@ -1 +0,0 @@`
				`UploadedMedia: Add missing disposition_type to Content-Disposition`
				`@ -1 +0,0 @@`
				`fix not being able to fetch flash file from remote instance`
				`@ -1 +0,0 @@`
				`Cleanup OStatus-era user upgrades and ap_enabled indicator`
				`@ -1 +0,0 @@`
				`Fix abnormal behaviour when refetching a poll`
				`@ -1 +0,0 @@`
				`Allow non-HTTP(s) URIs in "url" fields for compatibility with "FEP-fffd: Proxy Objects"`
				`@ -1 +0,0 @@`
				`ForceMentionsInContent: fix double mentions for Mastodon/Misskey posts`
				`@ -1 +0,0 @@`
				`Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.`