Merge branch 'develop' into fix/card-skip-quote-link

.woodpecker/docker.yaml

@@ -31,7 +31,7 @@ variables:
     <<: *docker_variables
     build_args:
       - ELIXIR_IMG=docker.io/arm32v7/elixir
-      - ELIXIR_TAG=1.17.3-otp-26-alpine
+      - ELIXIR_TAG=1.17.3-otp-27-alpine
       - ALPINE_IMG=docker.io/arm32v7/alpine
       - ALPINE_VER=3.20
     extra_opts: --custom-platform=linux/arm/v7

.woodpecker/lint.yaml

@@ -18,7 +18,7 @@ variables:
 steps:
   mix-format:
     image: &elixir-image
-      docker.io/elixir:1.15-alpine
+      docker.io/elixir:1.17-otp-27-alpine
     entrypoint: *script_file_entrypoint
     failure: ignore
     commands:

.woodpecker/unit-testing-elixir-1.17.yaml

@@ -19,8 +19,8 @@ variables:
     - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
 
 steps:
-  unit-testing-elixir-1.15:
-    image: elixir:1.15-alpine
+  unit-testing-elixir-1.17:
+    image: elixir:1.17-otp-27-alpine
     entrypoint: *script_file_entrypoint
     environment:
       MIX_ENV: test

CHANGELOG.md

@@ -4,6 +4,122 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2.11.1
+
+### Security
+
+- Update Bandit to version 1.14.0, which fixes HTTP/1.1, HTTP/2 and WebSocket denial-of-service and request smuggling vulnerabilities
+- Update Hackney to version 4.9.1, which fixes unbounded response body buffering and decompression, CA pinning, redirect credential leaks and other vulnerabilities
+
+## 2.11.0
+
+### Security
+
+- Update Bandit to address HTTP request handling vulnerabilities.
+- Update bandit to version 1.12.4 to fix a DoS vulnerability
+- Update bandit to version 1.12.5 to fix an HTTP/2 DoS vulnerability
+- Update bandit to version 1.13.1 resolving a stuck process and unvalidated HTTP/1 headers vulnerabilities
+- Updated CAStore to version 1.0.22 with updated Mozilla certificate bundle after eMudhra Intermediate CA Compromise
+- Update certifi to version 2.18.0, which removes the distrusted emSign roots
+- Update plug_crypto to version 2.2.1, so a malformed shout socket token no longer writes the secret key base to the error log
+- Update Cowboy to address multipart header parsing denial-of-service vulnerabilities.
+- Update cowboy to version 2.19.0 which fixes a memory exhaustion DoS
+- Update Cowlib to address HTTP parsing resource exhaustion and injection vulnerabilities.
+- Update cowlib to version 2.20.0 which fixes HTTP splitting and header smuggling/injection vulnerabilities
+- Update gun to version 2.7.0 and cowlib to version 2.21.0 resolving a header smuggling vulnerability
+- Update Decimal and compatible dependencies to address a rounding vulnerability.
+- Update Decimal to version 3.2.0 resolving an unbounded allocation vulnerability
+- Replace retired Earmark rendering with the maintained EarmarkParser and an attribute-escaping renderer.
+- Update gun to version 2.6.0 which fixes an HTTP request/response smuggling vulnerability
+- Update Hackney and its HTTPoison integration to address SSRF, timeout, and injection vulnerabilities.
+- Hackney, Finch, Mua and the Swoosh HTTP mail adapters now trust only the CAStore certificate bundle, which rejects the compromised eMudhra intermediate CAs
+- Ensure Host header is present and matches instance URI
+- Update mint to version 1.10.0 which fixes multiple DoS vulnerabilities
+- Update mint to version 1.11.0 resolving multiple vulnerabilities
+- Update Phoenix LiveView to version 1.2.9 to fix an open redirect vulnerability
+- Update Phoenix to version 1.8.11 resolving a process-exhaustion DoS vulnerability
+- Update Phoenix to address long-poll NDJSON request denial-of-service vulnerabilities.
+- Update Plug to address multipart header parsing denial-of-service vulnerabilities.
+- Update Plug.Cowboy to address HTTP/2 scheme atom exhaustion denial-of-service vulnerabilities.
+- Update Postgrex to address notification channel-name SQL injection vulnerabilities.
+- Update postgrex to version 0.22.4 to fix an SQL injection vulnerability
+- Remove unused QUIC lockfile entry with vulnerable TLS verification behavior.
+- Update swoosh to version 1.28.0 which fixes a url injection vulnerability for the Microsoft Graph adapter
+- Scrubbers: remove links and images whose scheme is hidden with tabs, newlines or leading control characters (for example java<TAB>script:), which browsers still run as javascript:. Custom scrubbers should use Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes instead of the FastSanitize macro
+
+### Changed
+
+- Update bundled Pleroma-FE to 2.11.4
+- Allow disabling Chats feature
+- Pleroma now requires Elixir 1.17 or newer and Erlang/OTP 27 or newer
+- Update Debian and Ubuntu installation requirements and OTP dependencies
+- Update Jason to support Decimal 3 dependency resolution.
+- Changed how Logger is configured due to changes in Elixir and added deprecation warnings for the old configuration format
+- Update majic to 1.2.0.
+- Avoid a duplicate user query during OAuth authentication.
+- Use the Hex package for oban_plugins_lazarus.
+- Docs OpenBSD: Increased recommended `datasize` from 1536M to 4096M to avoid Pleroma crashes
+- OpenRC: Automatically run migrations before starting pleroma
+- Optimize orphaned OAuth apps cleanup by deleting records in batches instead of one by one.
+- Switch patched Phoenix 1.7.14 back to upstream with Phoenix 1.8.0+
+- Add optional migrations for rollback from Rebased
+- Use upstream Hex releases for the `remote_ip` dependency and expose client IP ranges for remote IP resolution.
+- Improve user search / autocompletion ordering.
+- Gun is now the default HTTP client instead of Hackney
+
+### Added
+
+- Allow creating accounts without a password in the AdminAPI
+- Implemented ConfigDB configuration blacklist and accompanying Mix task
+- Accept more real-world ActivityPub object shapes collected by fedidev.fun
+- Add Mastodon-compatible grouped notifications API endpoints under `/api/v2/notifications` for newly-created notifications
+- Docs: Added documentation for installing newer version of Elixir/Erlang than what distro ships
+- Allow attaching emojis to user lists
+- Implement basics of Mastodon admin API
+- Add backend support for Misskey Markdown (MFM) posts
+- Add mix_audit for dependency vulnerability checks.
+- Oban: Enabled the Reindexer plugin to reduce oban_jobs index DB bloat
+- Add ParadeDB (pg_search) as an optional external search backend, indexing status content, content warnings, and attachment descriptions.
+- Add support for Mastodon-compatible webhooks
+
+### Fixed
+
+- Fixed `/api/v1/pleroma/accounts/:id/favourites` ordering and pagination to use the favourite date.
+- Reject unsupported or ambiguous inbox signatures instead of queueing a doomed failed-signature retry, allowing clients to fall back to legacy HTTP Signatures.
+- Switch native captcha to the published pleroma_captcha Hex package.
+- Updated the captcha package to fix compilation failure on BSD-based systems
+- Dockerfile: update base images to fix problems with SSL handshakes
+- Docs: Fixed OTP install links in documentation, broke up wall of install commands into smaller chunks, fixed sudo commands execution
+- Fix notification and timeline queries for users with domain blocks choosing a plan that scans every active user per row; the followed-accounts exception is now an `ARRAY(SELECT ...)` InitPlan that the planner costs once.
+- Fixed Elixir 1.19 warnings
+- Support fetching featured collection items from the first collection page
+- Fix preferred frontend not working due to InstanceStatic plug prematurely returning HTTP 404
+- Fixed Gun HTTP/1 concurrency, forwarding and authenticated proxy handling, tunnel requests, and streamed connection cleanup. Updated Gun and Cowlib for HTTP client security fixes.
+- Stop leaking a Hackney connection process, and the response bytes it read, for every unpooled request that ends without a reusable socket
+- Fix hashtag timeline query for additional tag handling
+- Fix compatibility with timestamped HTTP Signatures used by GoToSocial
+- Handle reports with just actor ap id as the object
+- Fix Swoosh HTTP mail adapters failing with `cacerts: :undefined` on OTP 26+
+- Echo Mastodon-style `Sec-WebSocket-Protocol` tokens in streaming WebSocket handshakes.
+- Enforce the max_body HTTP option again, which Hackney 4 silently stopped honouring because it always returns a fully read body
+- Abort incomplete media proxy responses instead of caching partial bodies.
+- Updated Pleroma-FE build URL after Forgejo migration
+- Fix votersCount inflation when same voter picks multiple options
+- Status: Fill all MastoAPI required values in preview cards
+- Avoid creating atoms from serialized PublisherWorker parameters.
+- Reject incoming reports when both the reporter and reported account are remote
+- Fixed account status and media views exposing activities restricted from unauthenticated users.
+- Stop leaking a Hackney connection process for every media proxy response that was streamed to the end
+- Fix RSS feeds to be W3C compliant and render better in RSS readers
+- Keep followed users visible in streams when their domain is blocked.
+- Fix intermittent failure to compile syslog package
+- Fix inconsistent User cache keys and invalidate numeric ID aliases.
+- Include arm32v7 in multi-arch Docker images
+- RichMedia: Fix backfill causing old posts to show up on timelines by disabling it in MastoAPI StatusView
+- Fix Admin-FE installation by downloading builds from the package registry instead of GitLab job artifacts.
+- Hackney: use HTTP/1.1 only, so closing one media proxy response no longer breaks other downloads from the same host
+- Hackney: use the configured proxy when its host is an IP address; Hackney 4 ignored such proxies and connected directly
+
 ## 2.10.2
 
 ### Security

Dockerfile

@@ -1,7 +1,7 @@
 # https://hub.docker.com/r/hexpm/elixir/tags
 ARG ELIXIR_IMG=hexpm/elixir
 ARG ELIXIR_VER=1.17.3
-ARG ERLANG_VER=27.3.4.14
+ARG ERLANG_VER=27.3.4.17
 ARG ALPINE_VER=3.23.5
 ARG ELIXIR_TAG=${ELIXIR_VER}-erlang-${ERLANG_VER}-alpine-${ALPINE_VER}
 ARG ALPINE_IMG=alpine
@@ -42,7 +42,7 @@ ARG HOME=/opt/pleroma
 ARG DATA=/var/lib/pleroma
 
 RUN apk update &&\
-	apk add exiftool ffmpeg vips libmagic ncurses postgresql-client &&\
+	apk add ffmpeg vips libmagic ncurses postgresql-client &&\
 	adduser --system --shell /bin/false --home ${HOME} pleroma &&\
 	mkdir -p ${DATA}/uploads &&\
 	mkdir -p ${DATA}/static &&\

Dockerfile-e2e

@@ -41,7 +41,7 @@ ARG HOME=/opt/pleroma
 ARG DATA=/var/lib/pleroma
 
 RUN apk update &&\
-	apk add exiftool ffmpeg vips libmagic ncurses postgresql-client &&\
+	apk add ffmpeg vips libmagic ncurses postgresql-client &&\
 	adduser --system --shell /bin/false --home ${HOME} pleroma &&\
 	mkdir -p ${DATA}/uploads &&\
 	mkdir -p ${DATA}/static &&\

changelog.d/account-favourites-order.fix

@@ -1 +0,0 @@
-Fixed `/api/v1/pleroma/accounts/:id/favourites` ordering and pagination to use the favourite date.

changelog.d/activitypub-bot-rfc9421-fallback.fix

@@ -1 +0,0 @@
-Reject unsupported or ambiguous inbox signatures instead of queueing a doomed failed-signature retry, allowing clients to fall back to legacy HTTP Signatures.

changelog.d/actor-containment.security

@@ -0,0 +1 @@
+Reject remote actors whose inbox, shared inbox, followers, following or featured collection, or key id is on another host

changelog.d/admin-api-passwordless-accounts.add

@@ -1 +0,0 @@
-Allow creating accounts without a password in the AdminAPI

changelog.d/advisory-bumps.security

@@ -0,0 +1 @@
+Update ssl_verify_fun to 1.1.9 (EEF-CVE-2026-117666) and phoenix_html to 3.3.5 (EEF-CVE-2026-117645)

changelog.d/ap-c2s-oauth-scopes.security

@@ -0,0 +1 @@
+Check OAuth token scopes on the ActivityPub C2S endpoints; posting to the outbox with a token now needs the `write` scope

changelog.d/attachment-zero-size.fix

@@ -0,0 +1 @@
+Do not crash when rendering attachments with zero width or height

changelog.d/bandit-1.14.1.security

@@ -0,0 +1 @@
+Update Bandit to version 1.14.1, which fixes an HTTP/2 request body memory amplification

changelog.d/c2s-rate-limit.security

@@ -0,0 +1 @@
+Rate limit ActivityPub C2S outbox posts and emoji reactions

changelog.d/captcha-package.fix

@@ -1 +0,0 @@
-Switch native captcha to the published pleroma_captcha Hex package.

changelog.d/captcha-ver-bump.fix

@@ -1 +0,0 @@
-Updated the captcha package to fix compilation failure on BSD-based systems

changelog.d/cast-and-validate-cast-opts.fix

@@ -0,0 +1 @@
+Fix per-status and per-account rate limits when `Pleroma.Web.ApiSpec.CastAndValidate` `strict` is off (the production default)

changelog.d/cast-and-validate-many-params.fix

@@ -0,0 +1 @@
+Drop all unexpected query params, not just the first one, when `Pleroma.Web.ApiSpec.CastAndValidate` `strict` is off

changelog.d/config-db-unknown-module.fix

@@ -0,0 +1 @@
+Do not crash at boot or in the AdminAPI config listing when a ConfigDB setting refers to a module that no longer exists

changelog.d/context-cleanup.skip

@@ -1 +0,0 @@
-litepub-0.1.jsonld cleanup

changelog.d/context-local-only.fix

@@ -0,0 +1 @@
+Show local-only replies in status context to local users who don't follow the replier

changelog.d/disabling-chats.change

@@ -1 +0,0 @@
-Allow disabling Chats feature

changelog.d/docker-baseimage-ssl.fix

@@ -1 +0,0 @@
-Dockerfile: update base images to fix problems with SSL handshakes

changelog.d/docs-otp-install-links.fix

@@ -1 +0,0 @@
-Docs: Fixed OTP install links in documentation, broke up wall of install commands into smaller chunks, fixed sudo commands execution

changelog.d/domain-block-subplan-cost.fix

@@ -1 +0,0 @@
-Fix notification and timeline queries for users with domain blocks choosing a plan that scans every active user per row; the followed-accounts exception is now an `ARRAY(SELECT ...)` InitPlan that the planner costs once.

changelog.d/elixir-1-19.add

@@ -1 +0,0 @@
-Implemented ConfigDB configuration blacklist and accompanying Mix task

changelog.d/elixir-1-19.fix

@@ -1 +0,0 @@
-Fixed Elixir 1.19 warnings

changelog.d/emoji-react-single-tag.fix

@@ -0,0 +1 @@
+Accept incoming emoji reactions whose tag is a single object instead of an array

changelog.d/empty-proxy-url.fix

@@ -0,0 +1 @@
+HTTP: treat an empty proxy_url as no proxy; with Hackney 4 it made every outgoing request fail

changelog.d/exif-heic-gps.security

@@ -0,0 +1 @@
+Strip GPS data from WebP and HEIC/AVIF uploads; the Exiftool.StripLocation filter used to skip them; GPS data in XMP (including DJI drone positions) is stripped too

changelog.d/exif-stripper.change

@@ -0,0 +1 @@
+Exiftool upload filters are replaced by the built-in Exif.StripLocation and Exif.ReadDescription filters; exiftool is no longer required, old filter names still work but are deprecated

changelog.d/featured-collection-page.fix

@@ -1 +0,0 @@
-Support fetching featured collection items from the first collection page

changelog.d/federation-reject-instances.security

@@ -0,0 +1 @@
+Do not deliver activities, including public ones and deletes, to instances rejected by SimplePolicy (or not on its accept list), and refuse their signed fetches in authorized fetch mode

changelog.d/fedidev-federation-compat.add

@@ -1 +0,0 @@
-Accept more real-world ActivityPub object shapes collected by fedidev.fun

changelog.d/fetch-id-containment.security

@@ -0,0 +1 @@
+Only accept fetched objects whose id is the URL they were fetched from; for other ids, refetch once from the canonical id on the same host

changelog.d/filter-regex-escape.fix

@@ -0,0 +1 @@
+Treat filter phrases as literal text; a phrase like "(" no longer breaks timeline and notification queries, and phrases that start or end with punctuation (like "#tag") now match

changelog.d/filter-whole-word.fix

@@ -0,0 +1 @@
+Filters with whole_word set to false now also match inside words

changelog.d/fix-preferred-frontend.fix

@@ -1 +0,0 @@
-Fix preferred frontend not working due to InstanceStatic plug prematurely returning HTTP 404

changelog.d/get-actor-crash.fix

@@ -0,0 +1 @@
+Reject fetched objects whose author has no id instead of crashing

changelog.d/gin-fuzzy-search-limit.fix

@@ -0,0 +1 @@
+gin_fuzzy_search_limit is now only set for search queries (configurable under Pleroma.Search.DatabaseSearch), so other GIN index scans such as recipient lookups and Oban job queries are exact again

changelog.d/grouped-notifications-api.add

@@ -1 +0,0 @@
-Add Mastodon-compatible grouped notifications API endpoints under `/api/v2/notifications` for newly-created notifications

changelog.d/gun-ipv6-only-hosts.fix

@@ -0,0 +1 @@
+Gun adapter: connect to hosts that only have IPv6 (AAAA) addresses

changelog.d/gun-pool-rework.fix

@@ -1 +0,0 @@
-Fixed Gun HTTP/1 concurrency, forwarding and authenticated proxy handling, tunnel requests, and streamed connection cleanup. Updated Gun and Cowlib for HTTP client security fixes.

changelog.d/hashtag-timeline.fix

@@ -1 +0,0 @@
-Fix hashtag timeline query for additional tag handling

changelog.d/host-header-verification.security

@@ -1 +0,0 @@
-Ensure Host header is present and matches instance URI

changelog.d/http-backoff.add

@@ -0,0 +1 @@
+Back off from hosts that answer 429 or 503 to object fetches and WebFinger, until Retry-After or X-RateLimit-Reset (default 5 minutes, max 1 hour)

changelog.d/http-signatures-0.1.3.fix

@@ -1 +0,0 @@
-Fix compatibility with timestamped HTTP Signatures used by GoToSocial

changelog.d/iceshrimpnet-reports-fix.fix

@@ -1 +0,0 @@
-Handle reports with just actor ap id as the object

changelog.d/improve-doc-debian-13.change

@@ -1 +0,0 @@
-Update Debian and Ubuntu installation requirements and OTP dependencies

changelog.d/installing_newer_elixir_erlang.add

@@ -1 +0,0 @@
-Docs: Added documentation for installing newer version of Elixir/Erlang than what distro ships

changelog.d/jose-1.11.13.security

@@ -0,0 +1 @@
+Update jose to version 1.11.13, which fixes JWE, key parsing and signature validation vulnerabilities

changelog.d/legacy-sequences.fix

@@ -0,0 +1 @@
+Delete legacy Postgres sequences for activities, chats, and users which were converted to Flake IDs

changelog.d/list-emoji.add

@@ -1 +0,0 @@
-Allow attaching emojis to user lists

changelog.d/logger-backends.change

@@ -1 +0,0 @@
-Changed how Logger is configured due to changes in Elixir and added deprecation warnings for the old configuration format

changelog.d/majic-1.2.0.change

@@ -1 +0,0 @@
-Update majic to 1.2.0.

changelog.d/marker-updated-at-format.fix

@@ -0,0 +1 @@
+Mastodon API: Use the Mastodon date format for marker updated_at

changelog.d/mastodon-admin.add

@@ -1 +0,0 @@
-Implement basics of Mastodon admin API

changelog.d/mastodon-quote-entity.add

@@ -0,0 +1 @@
+Add the Mastodon quote entity (`quote` with `state` and `quoted_status`) to statuses, so Mastodon 4.4+ clients show quote posts

changelog.d/mastodon-websocket-protocol.fix

@@ -1 +0,0 @@
-Echo Mastodon-style `Sec-WebSocket-Protocol` tokens in streaming WebSocket handshakes.

changelog.d/media-proxy-data-urls.fix

@@ -0,0 +1 @@
+MediaProxy: Do not proxy data: URLs

changelog.d/media-proxy-network-path.security

@@ -0,0 +1 @@
+Proxy media given as network-path URLs (//host/path), so remote HTML cannot load images directly

changelog.d/media-proxy-static-redirect.fix

@@ -0,0 +1 @@
+Media proxy: serve a preview for static=true on non-GIF files instead of redirecting to the main endpoint host

changelog.d/media-proxy-truncated-stream.fix

@@ -1 +0,0 @@
-Abort incomplete media proxy responses instead of caching partial bodies.

changelog.d/mention-notify-access.security

@@ -0,0 +1 @@
+Do not notify tagged users who cannot see the post

changelog.d/mfm-backend.add

@@ -1 +0,0 @@
-Add backend support for Misskey Markdown (MFM) posts

changelog.d/move-refetch-target.fix

@@ -0,0 +1 @@
+Accept a Move when the cached remote target does not list the alias yet, by refetching the target once

changelog.d/mrf-domain-regex-escape.security

@@ -0,0 +1 @@
+MRF domain rules now match dots literally, so a rule for `good.example` no longer also matches `goodxexample`, and wildcard rules no longer backtrack on hostile host names

changelog.d/notification-filter-nil-content.fix

@@ -0,0 +1 @@
+Do not crash when creating notifications for posts without content while the user has filters

changelog.d/oauth-profile-scope.add

@@ -0,0 +1 @@
+Support the Mastodon `profile` OAuth scope, which only gives the public account from verify_credentials

changelog.d/oauth-tokens-scopes.security

@@ -0,0 +1 @@
+Require the read:security and write:security scopes to list and revoke OAuth tokens (HTTP Basic auth no longer works for these endpoints)

changelog.d/oauth-user-preload.change

@@ -1 +0,0 @@
-Avoid a duplicate user query during OAuth authentication.

changelog.d/oban-plugins-lazarus-hex.change

@@ -1 +0,0 @@
-Use the Hex package for oban_plugins_lazarus.

changelog.d/oban-reindexer.add

@@ -1 +0,0 @@
-Oban: Enabled the Reindexer plugin to reduce oban_jobs index DB bloat

changelog.d/object-age-non-public.security

@@ -0,0 +1 @@
+ObjectAgePolicy no longer makes old DMs and followers-only posts public

changelog.d/openbsd-datasize-bump.change

@@ -1 +0,0 @@
-Docs OpenBSD: Increased recommended `datasize` from 1536M to 4096M to avoid Pleroma crashes

changelog.d/opt-init.d-migrations.change

@@ -1 +0,0 @@
-- OpenRC: Automatically run migrations before starting pleroma

changelog.d/optimize-orphaned-apps-cleanup.change

@@ -1 +0,0 @@
-- Optimize orphaned OAuth apps cleanup by deleting records in batches instead of one by one.

changelog.d/paradedb-search.add

@@ -1 +0,0 @@
-Add ParadeDB (pg_search) as an optional external search backend, indexing status content, content warnings, and attachment descriptions.

changelog.d/personal-inbox-addressing.fix

@@ -0,0 +1 @@
+Accept activities delivered to a personal inbox that do not address the inbox owner (fixes Bridgy Fed follows)

changelog.d/phoenix-sec-websocket-headers.change

@@ -1 +0,0 @@
-Switch patched Phoenix 1.7.14 back to upstream with Phoenix 1.8.0+

changelog.d/pleroma-fe-link.fix

@@ -1 +0,0 @@
-Updated Pleroma-FE build URL after Forgejo migration

changelog.d/poll-voters-count-inflation.fix

@@ -1 +0,0 @@
-Fix votersCount inflation when same voter picks multiple options

changelog.d/previewcard-void-fill.fix

@@ -1 +0,0 @@
-Status: Fill all MastoAPI required values in preview cards

changelog.d/publisher-worker-atoms.fix

@@ -1 +0,0 @@
-Avoid creating atoms from serialized PublisherWorker parameters.

changelog.d/question-note-fixups.fix

@@ -0,0 +1 @@
+Apply the Note fixups to incoming Questions, so polls with a single non-array tag or attachment are accepted

changelog.d/rebased-migration.change

@@ -1 +0,0 @@
-Add optional migrations for rollback from Rebased

changelog.d/refetch-containment.security

@@ -0,0 +1 @@
+Do not let a refetched object (such as a poll) change its id or author

changelog.d/reject-third-party-reports.fix

@@ -1 +0,0 @@
-Reject incoming reports when both the reporter and reported account are remote

changelog.d/remote-ip-hex.change

@@ -1 +0,0 @@
-Use upstream Hex releases for the `remote_ip` dependency and expose client IP ranges for remote IP resolution.

changelog.d/restrict-unauthenticated-account-statuses.fix

@@ -1 +0,0 @@
-Fixed account status and media views exposing activities restricted from unauthenticated users.

changelog.d/rss.fix

@@ -1 +0,0 @@
-Fix RSS feeds to be W3C compliant and render better in RSS readers

changelog.d/search-remote-fetch.security

@@ -0,0 +1 @@
+Status search only fetches remote URLs with resolve=true, on the first page, and for anonymous users only if limit_to_local_content allows it