Merge branch 'develop' into gitlab-mr-iid-4381

2026-05-14 00:14:27 +02:00 · 2026-05-14 00:14:27 +02:00 · 7651490c50
commit 7651490c50
parent 1701c343e1 2db3a9c04d
134 changed files with 4584 additions and 471 deletions
--- a/.gitignore
+++ b/.gitignore
@ -56,6 +56,9 @@ pleroma.iml
 # asdf
 .tool-versions

+# mise
+mise.toml
+
 # Editor temp files
 *~
 *#
--- a/.woodpecker/changelog.yaml
+++ b/.woodpecker/changelog.yaml
@ -0,0 +1,19 @@
+when:
+  - event: pull_request
+
+labels:
+  platform: linux/amd64
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+
+steps:
+  check-changelog:
+    image: docker.io/alpine:3.23
+    entrypoint: *script_file_entrypoint
+    commands:
+      - apk add --no-cache git
+      - sh ./tools/check-changelog
--- a/.woodpecker/docker-combine.yaml
+++ b/.woodpecker/docker-combine.yaml
@ -0,0 +1,60 @@
+when:
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**", "Dockerfile" ]
+  - event: tag
+  - event: manual
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+  - event: manual
+    branch: stable
+
+depends_on:
+  - docker
+
+skip_clone: true
+
+labels:
+  platform: linux/amd64
+
+steps:
+  docker-develop-combine:
+    image: git.fluffytail.org/phnt/wpc-docker-tagger:latest
+    when:
+      - event: push
+        branch: ${CI_REPO_DEFAULT_BRANCH}
+      - event: manual
+        branch: ${CI_REPO_DEFAULT_BRANCH}
+    settings: &docker_settings
+      registry: "git.pleroma.social"
+      image: "pleroma/pleroma"
+      architectures: [amd64, arm64]
+      tags:
+        - latest
+        - develop
+        - ${CI_COMMIT_SHA:0:8}
+      username:
+        from_secret: pleroma-ci-user
+      password:
+        from_secret: pleroma-ci-password
+
+  docker-stable-combine:
+    image: git.fluffytail.org/phnt/wpc-docker-tagger:latest
+    when:
+      - evaluate: 'CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG == ""'
+    settings:
+      <<: *docker_settings
+      tags: &stable_docker_tags
+        - latest
+        - stable
+        - ${CI_COMMIT_SHA:0:8}
+
+  docker-stable-tag-combine:
+    image: git.fluffytail.org/phnt/wpc-docker-tagger:latest
+    when:
+      - event: tag
+      - evaluate: 'CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG != ""'
+    settings:
+      <<: *docker_settings
+      tags:
+        - <<: *stable_docker_tags
+        - ${CI_COMMIT_TAG}
--- a/.woodpecker/docker.yaml
+++ b/.woodpecker/docker.yaml
@ -0,0 +1,96 @@
+when:
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**", "Dockerfile" ]
+  - event: tag
+  - event: manual
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+  - event: manual
+    branch: stable
+
+matrix:
+  platform:
+    - linux/amd64
+    - linux/arm64
+
+# This is needed for the when clauses below.
+labels:
+  platform: ${platform}
+  memory: 'high'
+
+variables:
+  docker_variables: &docker_variables
+    repo: pleroma/pleroma
+    registry: git.pleroma.social
+    username:
+      from_secret: pleroma-ci-user
+    password:
+      from_secret: pleroma-ci-password
+  kaniko_image: &kaniko_image woodpeckerci/plugin-kaniko:2.3.1
+
+steps:
+  docker-develop-amd64:
+    image: woodpeckerci/plugin-kaniko:2.3.1
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    settings:
+      <<: *docker_variables
+      tags:
+        - latest-amd64
+        - develop-amd64
+        - ${CI_COMMIT_SHA:0:8}-amd64
+
+  docker-develop-arm64:
+    image: woodpeckerci/plugin-kaniko:2.3.1
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    settings:
+      <<: *docker_variables
+      tags:
+        - latest-arm64
+        - develop-arm64
+        - ${CI_COMMIT_SHA:0:8}-arm64
+
+  docker-stable-amd64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG == ""'
+    settings:
+      <<: *docker_variables
+      tags: &amd64_tags
+        - latest-amd64
+        - stable-amd64
+        - ${CI_COMMIT_SHA:0:8}-amd64
+
+  docker-stable-tag-amd64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG != ""'
+    settings:
+      <<: *docker_variables
+      tags:
+        - <<: *amd64_tags
+        - ${CI_COMMIT_TAG}-amd64
+
+  docker-stable-arm64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG == ""'
+    settings:
+      <<: *docker_variables
+      tags: &arm64_tags
+        - latest-arm64
+        - stable-arm64
+        - ${CI_COMMIT_SHA:0:8}-arm64
+
+  docker-stable-tag-arm64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG != ""'
+    settings:
+      <<: *docker_variables
+      tags:
+        - <<: *arm64_tags
+        - ${CI_COMMIT_TAG}-arm64
--- a/.woodpecker/lint.yaml
+++ b/.woodpecker/lint.yaml
@ -0,0 +1,77 @@
+when:
+  - event: pull_request
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+
+labels:
+  platform: linux/amd64
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+
+steps:
+  mix-format:
+    image: &elixir-image
+      docker.io/elixir:1.15-alpine
+    entrypoint: *script_file_entrypoint
+    failure: ignore
+    commands:
+      - |
+        if ! mix format --check-formatted; then
+          touch fail.stamp
+          exit 1
+        fi
+
+  credo:
+    image: *elixir-image
+    entrypoint: *script_file_entrypoint
+    failure: ignore
+    environment:
+      MIX_ENV: test
+    commands:
+      - apk add --no-cache build-base cmake exiftool ffmpeg file-dev git openssl
+      - adduser -D -h /home/testuser testuser
+      - mkdir -p /home/testuser/.mix /home/testuser/.hex
+      - chown -R testuser:testuser . /home/testuser
+      - su testuser -c "HOME=/home/testuser mix local.hex --force"
+      - su testuser -c "HOME=/home/testuser mix local.rebar --force"
+      - su testuser -c "HOME=/home/testuser mix deps.get"
+      - |
+        if ! su testuser -c "HOME=/home/testuser mix analyze"; then
+          touch fail.stamp
+          exit 1
+        fi
+
+  # cycles:
+  #   image: *elixir-image
+  #   failure: ignore
+  #   commands:
+  #     - apk add --no-cache build-base cmake exiftool ffmpeg file-dev git openssl
+  #     - adduser -D -h /home/testuser testuser
+  #     - mkdir -p /home/testuser/.mix /home/testuser/.hex
+  #     - chown -R testuser:testuser . /home/testuser
+  #     - su testuser -c "HOME=/home/testuser mix local.hex --force"
+  #     - su testuser -c "HOME=/home/testuser mix local.rebar --force"
+  #     - su testuser -c "HOME=/home/testuser mix compile"
+  #     - |
+  #       if ! su testuser -c "HOME=/home/testuser mix xref graph --format cycles --label compile | awk '{print $0} END{exit ($0 != \"No cycles found\")}'"; then
+  #       touch fail.stamp
+  #       exit 1
+  #       fi
+
+  ensure-status:
+    image: *elixir-image
+    entrypoint: *script_file_entrypoint
+    commands: |
+      if test -f fail.stamp; then
+        echo "One or more previous steps fails. Failing workflow..."
+        exit 1
+      else
+        echo "All steps passed"
+        exit 0
+      fi
--- a/.woodpecker/otp-musl.yaml
+++ b/.woodpecker/otp-musl.yaml
@ -0,0 +1,292 @@
+when:
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+  - event: tag
+  - event: manual
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+  - event: manual
+    branch: stable
+
+matrix:
+  platform:
+    - linux/amd64
+    - linux/arm
+    - linux/arm64
+
+# This is needed for the when clauses below.
+# When the platform clause is fixed, this might not be needed anymore
+labels:
+  platform: ${platform}
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+  build_cmds: &build_cmds
+    - apk add git build-base cmake file-dev openssl vips-dev zip
+    - echo "import Config" > config/prod.secret.exs
+    - mix local.hex --force
+    - mix local.rebar --force
+    - mix deps.get --only prod
+    - mkdir release
+    - export PLEROMA_BUILD_BRANCH=${CI_COMMIT_BRANCH}
+    - mix release --path release
+  build_image_amd64: &build_image_amd64 docker.io/hexpm/elixir-amd64:1.17.3-erlang-27.3.4.2-alpine-3.22.1
+  build_image_arm: &build_image_arm docker.io/arm32v7/elixir:1.17.3-alpine
+  build_image_arm64: &build_image_arm64 docker.io/hexpm/elixir-arm64:1.17.3-erlang-27.3.4.2-alpine-3.22.1
+  artifacts_uploader_image: &artifacts_uploader_image docker.io/woodpeckercommunity/plugin-gitea-package:0.5.0
+  artifacts_uploader_settings: &artifacts_uploader_settings
+    user:
+      from_secret: pleroma-ci-user
+    password:
+      from_secret: pleroma-ci-password
+    owner: 'pleroma'
+  env: &env
+    MIX_ENV: prod
+    VIX_COMPILATION_MODE: PLATFORM_PROVIDED_LIBVIPS
+
+steps:
+  otp-develop-amd64-musl:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &amd64_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl.zip release
+
+  otp-stable-amd64-musl:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *amd64_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-amd64-musl:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-amd64-musl.zip release
+
+  otp-develop-arm-musl:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &arm_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl.zip release
+
+  otp-stable-arm-musl:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *arm_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-arm-musl:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-arm-musl.zip release
+
+  otp-develop-arm64-musl:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &arm64_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl.zip release
+
+  otp-stable-arm64-musl:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *arm64_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-arm64-musl:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-arm64-musl.zip release
+
+  upload-artifacts-amd64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-amd64-musl
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      update: 'true'
+
+  upload-latest-amd64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-amd64-musl
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-amd64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-amd64-musl
+      package_version: stable-${CI_COMMIT_SHA:0:8}-amd64-musl
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-amd64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-amd64-musl
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  upload-artifacts-arm-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm-musl
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      update: 'true'
+
+  upload-latest-arm-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm-musl
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-arm-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm-musl
+      package_version: stable-${CI_COMMIT_SHA:0:8}-arm-musl
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-arm-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm-musl
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  upload-artifacts-arm64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm64-musl
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      update: 'true'
+
+  upload-latest-arm64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm64-musl
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-arm64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm64-musl
+      package_version: stable-${CI_COMMIT_SHA:0:8}-arm64-musl
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-arm64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm64-musl
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
--- a/.woodpecker/otp.yaml
+++ b/.woodpecker/otp.yaml
@ -0,0 +1,293 @@
+when:
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+  - event: tag
+  - event: manual
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+  - event: manual
+    branch: stable
+
+matrix:
+  platform:
+    - linux/amd64
+    - linux/arm
+    - linux/arm64
+
+# This is needed for the when clauses below.
+# When the platform clause is fixed, this might not be needed anymore
+labels:
+  platform: ${platform}
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+  build_cmds: &build_cmds
+    - apt-get update && apt-get install -y cmake libmagic-dev libvips-dev erlang-dev git build-essential zip
+    - echo "import Config" > config/prod.secret.exs
+    - mix local.hex --force
+    - mix local.rebar --force
+    - mix deps.get --only prod
+    - mkdir release
+    - export PLEROMA_BUILD_BRANCH=${CI_COMMIT_BRANCH}
+    - mix release --path release
+  build_image_amd64: &build_image_amd64 docker.io/hexpm/elixir-amd64:1.17.3-erlang-27.3.4.2-ubuntu-noble-20250716
+  build_image_arm: &build_image_arm docker.io/arm32v7/elixir:1.17.3
+  build_image_arm64: &build_image_arm64 docker.io/hexpm/elixir-arm64:1.17.3-erlang-27.3.4.2-ubuntu-noble-20250716
+  artifacts_uploader_image: &artifacts_uploader_image docker.io/woodpeckercommunity/plugin-gitea-package:0.5.0
+  artifacts_uploader_settings: &artifacts_uploader_settings
+    user:
+      from_secret: pleroma-ci-user
+    password:
+      from_secret: pleroma-ci-password
+    owner: 'pleroma'
+  env: &env
+    MIX_ENV: prod
+    VIX_COMPILATION_MODE: PLATFORM_PROVIDED_LIBVIPS
+    DEBIAN_FRONTEND: noninteractive
+
+steps:
+  otp-develop-amd64:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &amd64_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64.zip release
+
+  otp-stable-amd64:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *amd64_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-amd64:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-amd64.zip release
+
+  otp-develop-arm:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &arm_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm.zip release
+
+  otp-stable-arm:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *arm_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-arm:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-arm.zip release
+
+  otp-develop-arm64:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &arm64_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64.zip release
+
+  otp-stable-arm64:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *arm64_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-arm64:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-arm64.zip release
+
+  upload-artifacts-amd64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-amd64
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64.zip
+      update: 'true'
+
+  upload-latest-amd64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-amd64
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-amd64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-amd64
+      package_version: stable-${CI_COMMIT_SHA:0:8}-amd64
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-amd64.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-amd64.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-amd64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-amd64
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-amd64.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  upload-artifacts-arm:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm.zip
+      update: 'true'
+
+  upload-latest-arm:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-arm:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm
+      package_version: stable-${CI_COMMIT_SHA:0:8}-arm
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-arm.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-arm:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  upload-artifacts-arm64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm64
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64.zip
+      update: 'true'
+
+  upload-latest-arm64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm64
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-arm64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm64
+      package_version: stable-${CI_COMMIT_SHA:0:8}-arm64
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm64.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-arm64.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-arm64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm64
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm64.zip
+      file_name: pleroma.zip
+      update: 'true'
--- a/.woodpecker/unit-testing-elixir-1.15.yaml
+++ b/.woodpecker/unit-testing-elixir-1.15.yaml
@ -1,10 +1,26 @@
 when:
-  - event:
-      - pull_request
+  - event: pull_request
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+
+depends_on:
+  - lint
+
+labels:
+  platform: linux/amd64
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'

 steps:
-  test:
-    image: elixir:1.19-alpine
+  unit-testing-elixir-1.15:
+    image: elixir:1.15-alpine
+    entrypoint: *script_file_entrypoint
    environment:
      MIX_ENV: test
      DB_HOST: postgres
@ -17,7 +33,7 @@ steps:
      - su testuser -c "HOME=/home/testuser mix local.hex --force"
      - su testuser -c "HOME=/home/testuser mix local.rebar --force"
      - su testuser -c "HOME=/home/testuser mix deps.get"
-      - su testuser -c "HOME=/home/testuser mix test"
+      - su testuser -c "HOME=/home/testuser mix pleroma.test_runner --preload-modules"

 services:
  postgres:
--- a/.woodpecker/unit-testing-elixir-1.18.yaml
+++ b/.woodpecker/unit-testing-elixir-1.18.yaml
@ -0,0 +1,44 @@
+when:
+  - event: pull_request
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+
+depends_on:
+  - lint
+
+labels:
+  platform: linux/amd64
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+
+steps:
+  unit-testing-elixir-1.18:
+    image: elixir:1.18-otp-27-alpine
+    entrypoint: *script_file_entrypoint
+    environment:
+      MIX_ENV: test
+      DB_HOST: postgres
+      DB_PORT: 5432
+    commands:
+      - apk add --no-cache build-base cmake exiftool ffmpeg file-dev git openssl
+      - adduser -D -h /home/testuser testuser
+      - mkdir -p /home/testuser/.mix /home/testuser/.hex
+      - chown -R testuser:testuser . /home/testuser
+      - su testuser -c "HOME=/home/testuser mix local.hex --force"
+      - su testuser -c "HOME=/home/testuser mix local.rebar --force"
+      - su testuser -c "HOME=/home/testuser mix deps.get"
+      - su testuser -c "HOME=/home/testuser mix pleroma.test_runner --preload-modules"
+
+services:
+  postgres:
+    image: postgres:13-alpine
+    environment:
+      POSTGRES_DB: pleroma_test
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -4,6 +4,60 @@ All notable changes to this project will be documented in this file.

 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

+## 2.10.2
+
+### Security
+
+- ActivityPub: Fixed failed-signature inbox retry handling and signer identity checks to prevent spoofed remote activities from being processed
+
+## 2.10.1
+
+### Changed
+
+- Move avatar_description and header_description fields to the account object
+- Update Bandit to 1.10.4
+- No-op code correctness improvements detected by Elixir 1.19 compiler
+- Downgrade Hackney to 1.20.1
+- Use a custom redirect handler to ensure MediaProxy redirects are followed with Hackney
+- Update Hackney, the default HTTP client, to the latest release which supports Happy Eyeballs for improved IPv6 federation
+- Paginate follow requests
+- Moved Phoenix LiveDashboard to /pleroma/live_dashboard
+- Add mute/block expiry to the relationship object
+- Filter indexable activities before inserting indexing jobs into the queue.
+
+### Added
+
+- Allow assigning users to reports
+- Allow fine-grained announce visibilities
+- Add immutable tag on cache-control header for several endpoints that's serving the same exact things.
+- Add reasonable defaults for :database_config_whitelist
+- Support lists `exclusive` param
+- Add v1/instance/domain_blocks endpoint
+- Add /api/v2/instance profile fields limits info used by Mastodon
+- Added Oban Web dashboard located at /pleroma/oban
+- Add instructions on how to run a release in docker, to make it easier to run on older distros.
+
+### Fixed
+
+- Fix the daily email digest job which was not executing
+- Encode custom emoji URLs in EmojiReact activity tags.
+- Gopher: Fix Ranch listener not being stopped properly on Pleroma restart when database configuration is enabled
+- Fix fetching Hubzilla Actors with alsoKnownAs as string
+- Fix /phoenix/live_dashboard redirect not working when user added a path segment
+- Fix 404 error codes for missing static files
+- Fix OAuth app registration to accept `redirect_uris` as an array of strings (RFC 7591), while keeping backwards compatibility with string input.
+- Correct old migrations for expiring activities and user access tokens.
+- Federate `votersCount` correctly
+- DB prune: Check if user follows hashtag with no objects before deletion
+- Stop the rate limiter from crashing when run with wrong settings.
+- Restore embeds route
+- ReverseProxy: Recursively follow redirects until redirect_limit is reached
+- Fix compilation with vips-8.18.0 with bumping to vix 0.36.0
+
+### Removed
+
+- Docs: Removed outdated, incorrect, unmaintained and inappropriate installation documentation (Arch, NetBSD, NixOS)
+
 ## 2.10

 ### Security
--- a/changelog.d/assign-users.add
+++ b/changelog.d/assign-users.add
@ -1 +0,0 @@
-Allow assigning users to reports
--- a/changelog.d/avatar-description-mastodon-api.change
+++ b/changelog.d/avatar-description-mastodon-api.change
@ -1 +0,0 @@
-Move avatar_description and header_description fields to the account object
--- a/changelog.d/bookmark-folders.ignore
+++ b/changelog.d/bookmark-folders.ignore
@ -1 +0,0 @@
-Various bookmark folders-related improvements
--- a/changelog.d/boost-visibilities.add
+++ b/changelog.d/boost-visibilities.add
@ -1 +0,0 @@
-Allow fine-grained announce visibilities
--- a/changelog.d/ci-artifacts.skip
+++ b/changelog.d/ci-artifacts.skip
--- a/changelog.d/context-cleanup.skip
+++ b/changelog.d/context-cleanup.skip
@ -0,0 +1 @@
+litepub-0.1.jsonld cleanup
--- a/changelog.d/database-config-whitelist.add
+++ b/changelog.d/database-config-whitelist.add
@ -1 +0,0 @@
-Add reasonable defaults for :database_config_whitelist
--- a/changelog.d/elixir-1.19-cherrypicks.change
+++ b/changelog.d/elixir-1.19-cherrypicks.change
@ -1 +0,0 @@
-No-op code correctness improvements detected by Elixir 1.19 compiler
--- a/changelog.d/emoji-reaction-url-escape.fix
+++ b/changelog.d/emoji-reaction-url-escape.fix
@ -1 +0,0 @@
-Encode custom emoji URLs in EmojiReact activity tags.
--- a/changelog.d/exclusive-lists.add
+++ b/changelog.d/exclusive-lists.add
@ -1 +0,0 @@
-Support lists `exclusive` param
--- a/changelog.d/gopher-genserver-crash-on-boot.fix
+++ b/changelog.d/gopher-genserver-crash-on-boot.fix
@ -1 +0,0 @@
-Gopher: Fix Ranch listener not being stopped properly on Pleroma restart when database configuration is enabled
--- a/changelog.d/hackney-mediaproxy.change
+++ b/changelog.d/hackney-mediaproxy.change
@ -1 +0,0 @@
-Use a custom redirect handler to ensure MediaProxy redirects are followed with Hackney
--- a/changelog.d/hackney.change
+++ b/changelog.d/hackney.change
@ -1 +0,0 @@
-Update Hackney, the default HTTP client, to the latest release which supports Happy Eyeballs for improved IPv6 federation
--- a/changelog.d/http-signatures-0.1.3.fix
+++ b/changelog.d/http-signatures-0.1.3.fix
@ -0,0 +1 @@
+Fix compatibility with timestamped HTTP Signatures used by GoToSocial
--- a/changelog.d/hubzilla-alsoknownas.fix
+++ b/changelog.d/hubzilla-alsoknownas.fix
@ -1 +0,0 @@
-Fix fetching Hubzilla Actors with alsoKnownAs as string
--- a/changelog.d/iceshrimpnet-reports-fix.fix
+++ b/changelog.d/iceshrimpnet-reports-fix.fix
@ -0,0 +1 @@
+Handle reports with just actor ap id as the object
--- a/changelog.d/inappropriate-docs.remove
+++ b/changelog.d/inappropriate-docs.remove
@ -1 +0,0 @@
-Docs: Removed outdated, incorrect, unmaintained and inappropriate installation documentation (Arch, NetBSD, NixOS)
--- a/changelog.d/instance-domain-blocks.add
+++ b/changelog.d/instance-domain-blocks.add
@ -1 +0,0 @@
-Add v1/instance/domain_blocks endpoint
--- a/changelog.d/instance-profile-fields.add
+++ b/changelog.d/instance-profile-fields.add
@ -1 +0,0 @@
-Add /api/v2/instance profile fields limits info used by Mastodon
--- a/changelog.d/majic-1.2.0.change
+++ b/changelog.d/majic-1.2.0.change
@ -0,0 +1 @@
+Update majic to 1.2.0.
--- a/changelog.d/map-side-effects.skip
+++ b/changelog.d/map-side-effects.skip
--- a/changelog.d/mfm-backend.add
+++ b/changelog.d/mfm-backend.add
@ -0,0 +1 @@
+Add backend support for Misskey Markdown (MFM) posts
--- a/changelog.d/mix-exs-fix.skip
+++ b/changelog.d/mix-exs-fix.skip
--- a/changelog.d/mix-exs-update.skip
+++ b/changelog.d/mix-exs-update.skip
--- a/changelog.d/oauth-registration-redirect_uris.fix
+++ b/changelog.d/oauth-registration-redirect_uris.fix
@ -1 +0,0 @@
-Fix OAuth app registration to accept `redirect_uris` as an array of strings (RFC 7591), while keeping backwards compatibility with string input.
--- a/changelog.d/oban-plugins-lazarus-hex.change
+++ b/changelog.d/oban-plugins-lazarus-hex.change
@ -0,0 +1 @@
+Use the Hex package for oban_plugins_lazarus.
--- a/changelog.d/oban-web.add
+++ b/changelog.d/oban-web.add
@ -1 +0,0 @@
-Added Oban Web dashboard located at /pleroma/oban
--- a/changelog.d/old-migrations.fix
+++ b/changelog.d/old-migrations.fix
@ -1 +0,0 @@
-Correct old migrations for expiring activities and user access tokens.
--- a/changelog.d/paginate-follow-requests.change
+++ b/changelog.d/paginate-follow-requests.change
@ -1 +0,0 @@
-Paginate follow requests
--- a/changelog.d/phoenix-livedashboard-move.change
+++ b/changelog.d/phoenix-livedashboard-move.change
@ -1 +0,0 @@
-Moved Phoenix LiveDashboard to /pleroma/live_dashboard
--- a/changelog.d/pleroma-fe-link.fix
+++ b/changelog.d/pleroma-fe-link.fix
@ -0,0 +1 @@
+Updated Pleroma-FE build URL after Forgejo migration
--- a/changelog.d/plug-test-typo.skip
+++ b/changelog.d/plug-test-typo.skip
--- a/changelog.d/poll-voters-count-inflation.fix
+++ b/changelog.d/poll-voters-count-inflation.fix
@ -0,0 +1 @@
+Fix votersCount inflation when same voter picks multiple options
--- a/changelog.d/prune-hashtag-follow-3376.fix
+++ b/changelog.d/prune-hashtag-follow-3376.fix
@ -1 +0,0 @@
-DB prune: Check if user follows hashtag with no objects before deletion
--- a/changelog.d/reduce-flaky-tests.skip
+++ b/changelog.d/reduce-flaky-tests.skip
@ -1 +0,0 @@
-Reduce the number of flaky tests by making them sync if they affect the global state, and silence noisy test output.
--- a/changelog.d/reject-third-party-reports.fix
+++ b/changelog.d/reject-third-party-reports.fix
@ -0,0 +1 @@
+Reject incoming reports when both the reporter and reported account are remote
--- a/changelog.d/relationship-expires-at.change
+++ b/changelog.d/relationship-expires-at.change
@ -1 +0,0 @@
-Add mute/block expiry to the relationship object
--- a/changelog.d/release-to-docker.add
+++ b/changelog.d/release-to-docker.add
@ -1 +0,0 @@
-Add instructions on how to run a release in docker, to make it easier to run on older distros.
--- a/changelog.d/twitter-api.skip
+++ b/changelog.d/twitter-api.skip
--- a/changelog.d/update-comment.ignore
+++ b/changelog.d/update-comment.ignore
@ -1 +0,0 @@
-Update comment for prepare_object, rename prepare_outgoing
--- a/changelog.d/user-search-sorting.change
+++ b/changelog.d/user-search-sorting.change
@ -0,0 +1 @@
+Improve user search / autocompletion ordering.
--- a/changelog.d/user-view.ignore
+++ b/changelog.d/user-view.ignore
@ -1 +0,0 @@
-Avoid code duplication in UserView
--- a/changelog.d/vix-0.36.0.fix
+++ b/changelog.d/vix-0.36.0.fix
@ -1 +0,0 @@
-Fix compilation with vips-8.18.0 with bumping to vix 0.36.0
--- a/config/config.exs
+++ b/config/config.exs
@ -202,7 +202,8 @@ config :pleroma, :instance,
    "text/plain",
    "text/html",
    "text/markdown",
-    "text/bbcode"
+    "text/bbcode",
+    "text/x.misskeymarkdown"
  ],
  autofollowed_nicknames: [],
  autofollowing_nicknames: [],
@ -774,7 +775,7 @@ config :pleroma, :frontends,
      "name" => "pleroma-fe",
      "git" => "https://git.pleroma.social/pleroma/pleroma-fe",
      "build_url" =>
-        "https://git.pleroma.social/pleroma/pleroma-fe/-/jobs/artifacts/${ref}/download?job=build",
+        "https://git.pleroma.social/api/packages/pleroma/generic/pleroma-fe-builds/${ref}/latest.zip",
      "ref" => "develop"
    },
    "fedi-fe" => %{
--- a/config/description.exs
+++ b/config/description.exs
@ -815,7 +815,8 @@ config :pleroma, :config_description, [
          "text/plain",
          "text/html",
          "text/markdown",
-          "text/bbcode"
+          "text/bbcode",
+          "text/x.misskeymarkdown"
        ]
      },
      %{
@ -1394,7 +1395,13 @@ config :pleroma, :config_description, [
            label: "Post Content Type",
            type: {:dropdown, :atom},
            description: "Default post formatting option",
-            suggestions: ["text/plain", "text/html", "text/markdown", "text/bbcode"]
+            suggestions: [
+              "text/plain",
+              "text/html",
+              "text/markdown",
+              "text/bbcode",
+              "text/x.misskeymarkdown"
+            ]
          },
          %{
            key: :redirectRootNoLogin,
--- a/lib/mix/tasks/pleroma/search/meilisearch.ex
+++ b/lib/mix/tasks/pleroma/search/meilisearch.ex
@ -72,7 +72,7 @@ defmodule Mix.Tasks.Pleroma.Search.Meilisearch do
          query,
          timeout: :infinity
        )
-        |> Stream.map(&Pleroma.Search.Meilisearch.object_to_search_data/1)
+        |> Stream.map(&Pleroma.Search.object_to_search_data/1)
        |> Stream.filter(fn o -> not is_nil(o) end)
        |> Stream.chunk_every(chunk_size)
        |> Stream.transform(0, fn objects, acc ->
--- a/lib/pleroma/config_db.ex
+++ b/lib/pleroma/config_db.ex
@ -10,6 +10,7 @@ defmodule Pleroma.ConfigDB do
  import Pleroma.Web.Gettext

  alias __MODULE__
+  alias Pleroma.EctoType.Config.RateLimit
  alias Pleroma.Repo

  @type t :: %__MODULE__{}
@ -60,8 +61,59 @@ defmodule Pleroma.ConfigDB do
    |> cast(params, [:key, :group, :value])
    |> validate_required([:key, :group, :value])
    |> unique_constraint(:key, name: :config_group_key_index)
+    |> validate_rate_limit()
  end

+  defp validate_rate_limit(changeset) do
+    group = get_field(changeset, :group)
+    key = get_field(changeset, :key)
+
+    if group == :pleroma and key == :rate_limit do
+      value = get_field(changeset, :value)
+
+      case normalize_rate_limit(value) do
+        {:ok, normalized_value} ->
+          put_change(changeset, :value, normalized_value)
+
+        {:error, {limiter_name, reason}} ->
+          add_error(
+            changeset,
+            :value,
+            "invalid :rate_limit value for #{inspect(limiter_name)}: #{reason}"
+          )
+      end
+    else
+      changeset
+    end
+  end
+
+  defp normalize_rate_limit(nil), do: {:ok, nil}
+
+  defp normalize_rate_limit(%{} = value), do: normalize_rate_limit(Map.to_list(value))
+
+  defp normalize_rate_limit(value) when is_list(value) do
+    if Keyword.keyword?(value) do
+      value
+      |> Enum.reduce_while({:ok, []}, fn {limiter_name, limiter_value}, {:ok, acc} ->
+        case RateLimit.cast_with_error(limiter_value) do
+          {:ok, normalized_limiter_value} ->
+            {:cont, {:ok, [{limiter_name, normalized_limiter_value} | acc]}}
+
+          {:error, reason} ->
+            {:halt, {:error, {limiter_name, reason}}}
+        end
+      end)
+      |> case do
+        {:ok, acc} -> {:ok, Enum.reverse(acc)}
+        {:error, _} = error -> error
+      end
+    else
+      {:error, {:rate_limit, "must be a keyword list"}}
+    end
+  end
+
+  defp normalize_rate_limit(_), do: {:error, {:rate_limit, "must be a keyword list"}}
+
  defp create(params) do
    %ConfigDB{}
    |> changeset(params)
--- a/lib/pleroma/constants.ex
+++ b/lib/pleroma/constants.ex
@ -29,7 +29,7 @@ defmodule Pleroma.Constants do

  const(static_only_files,
    do:
-      ~w(index.html robots.txt static static-fe finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc embed.js embed.css)
+      ~w(index.html robots.txt static static-fe finmoji emoji packs sounds images instance sw.js sw-pleroma.js schemas doc embed.js embed.css)
  )

  const(status_updatable_fields,
--- a/lib/pleroma/ecto_type/config/rate_limit.ex
+++ b/lib/pleroma/ecto_type/config/rate_limit.ex
@ -0,0 +1,71 @@
+# Pleroma: A lightweight social networking server
+# Copyright © Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.EctoType.Config.RateLimit do
+  @moduledoc false
+
+  use Ecto.Type
+
+  @type t ::
+          nil
+          | {non_neg_integer(), non_neg_integer()}
+          | [{non_neg_integer(), non_neg_integer()}]
+
+  @impl true
+  def type, do: :term
+
+  @impl true
+  def cast(value) do
+    case cast_with_error(value) do
+      {:ok, normalized} -> {:ok, normalized}
+      {:error, _reason} -> :error
+    end
+  end
+
+  @impl true
+  def load(value), do: cast(value)
+
+  @impl true
+  def dump(value), do: cast(value)
+
+  @spec cast_with_error(term()) :: {:ok, t()} | {:error, String.t()}
+  def cast_with_error(nil), do: {:ok, nil}
+
+  def cast_with_error({scale, limit}) do
+    with {:ok, scale} <- parse_integer(scale, "scale"),
+         {:ok, limit} <- parse_integer(limit, "limit"),
+         true <- scale >= 1 and limit >= 1 do
+      {:ok, {scale, limit}}
+    else
+      false -> {:error, "scale and limit must be >= 1"}
+      {:error, reason} -> {:error, reason}
+    end
+  end
+
+  def cast_with_error([{_, _} = unauth, {_, _} = auth]) do
+    with {:ok, unauth} <- cast_with_error(unauth),
+         {:ok, auth} <- cast_with_error(auth) do
+      {:ok, [unauth, auth]}
+    else
+      {:error, reason} -> {:error, reason}
+    end
+  end
+
+  def cast_with_error(_),
+    do:
+      {:error, "must be a {scale, limit} tuple, a [{scale, limit}, {scale, limit}] list, or nil"}
+
+  defp parse_integer(value, _label) when is_integer(value), do: {:ok, value}
+
+  defp parse_integer(value, label) when is_binary(value) do
+    value = String.trim(value)
+
+    case Integer.parse(value) do
+      {number, ""} -> {:ok, number}
+      _ -> {:error, "#{label} must be an integer"}
+    end
+  end
+
+  defp parse_integer(_value, label), do: {:error, "#{label} must be an integer"}
+end
--- a/lib/pleroma/formatter.ex
+++ b/lib/pleroma/formatter.ex
@ -127,6 +127,13 @@ defmodule Pleroma.Formatter do
    Earmark.as_html!(text, %Earmark.Options{compact_output: true, smartypants: false})
  end

+  def markdown_to_html(text, opts) do
+    Earmark.as_html!(
+      text,
+      %Earmark.Options{compact_output: true, smartypants: false} |> Map.merge(opts)
+    )
+  end
+
  def html_escape({text, mentions, hashtags}, type) do
    {html_escape(text, type), mentions, hashtags}
  end
@ -135,6 +142,10 @@ defmodule Pleroma.Formatter do
    HTML.filter_tags(text)
  end

+  def html_escape(text, "text/x.misskeymarkdown") do
+    HTML.filter_tags(text)
+  end
+
  def html_escape(text, "text/plain") do
    Regex.split(@link_regex, text, include_captures: true)
    |> Enum.map_every(2, fn chunk ->
--- a/lib/pleroma/frontend.ex
+++ b/lib/pleroma/frontend.ex
@ -75,8 +75,8 @@ defmodule Pleroma.Frontend do
  end

  defp download_build(frontend_info, dest) do
-    Logger.info("Downloading pre-built bundle for #{frontend_info["name"]}")
    url = String.replace(frontend_info["build_url"], "${ref}", frontend_info["ref"])
+    Logger.info("Downloading pre-built bundle for #{frontend_info["name"]} from #{url}")

    with {:ok, %{status: 200, body: zip_body}} <-
           Pleroma.HTTP.get(url, [], pool: :media, recv_timeout: 120_000) do
--- a/lib/pleroma/object.ex
+++ b/lib/pleroma/object.ex
@ -372,12 +372,28 @@ defmodule Pleroma.Object do
            option
        end)

-      voters = [actor | object.data["voters"] || []] |> Enum.uniq()
+      existing_voters = object.data["voters"] || []
+      voters = [actor | existing_voters] |> Enum.uniq()
+      new_voter? = actor not in existing_voters
+      existing_voters_count = object.data["votersCount"]
+
+      voters_count =
+        cond do
+          is_integer(existing_voters_count) and new_voter? ->
+            existing_voters_count + 1
+
+          is_integer(existing_voters_count) ->
+            existing_voters_count
+
+          true ->
+            length(voters)
+        end

      data =
        object.data
        |> Map.put(key, options)
        |> Map.put("voters", voters)
+        |> Map.put("votersCount", voters_count)

      object
      |> Object.change(%{data: data})
--- a/lib/pleroma/release_tasks.ex
+++ b/lib/pleroma/release_tasks.ex
@ -5,7 +5,10 @@
 defmodule Pleroma.ReleaseTasks do
  @repo Pleroma.Repo

-  def run(args) do
+  # TODO: Kept for some backwards compatibility with buggy pleroma_ctl,
+  # if a mismatch between pleroma_ctl and Pleroma accidentaly happens.
+  # Remove in the future.
+  def run(args) when is_binary(args) do
    [task | args] = String.split(args)

    case task do
@ -16,6 +19,20 @@ defmodule Pleroma.ReleaseTasks do
    end
  end

+  # HACK: Script arguments need to be received as a list, otherwise (quoted) arguments with
+  # whitespace will be broken. Previously the broken string form above was used,
+  # escaping in the shell does not help.
+  def run(args) when is_list(args) do
+    [task | args] = args
+
+    case task do
+      "migrate" -> migrate(args)
+      "create" -> create()
+      "rollback" -> rollback(args)
+      task -> mix_task(task, args)
+    end
+  end
+
  def find_module(task) do
    module_name =
      task
--- a/lib/pleroma/reverse_proxy.ex
+++ b/lib/pleroma/reverse_proxy.ex
@ -12,7 +12,7 @@ defmodule Pleroma.ReverseProxy do
  @keep_resp_headers @resp_cache_headers ++
                       ~w(content-length content-type content-disposition content-encoding) ++
                       ~w(content-range accept-ranges vary)
-  @default_cache_control_header "public, max-age=1209600"
+  @default_cache_control_header "public, max-age=1209600, immutable"
  @valid_resp_codes [200, 206, 304]
  @max_read_duration :timer.seconds(30)
  @max_body_length :infinity
--- a/lib/pleroma/reverse_proxy/client/hackney.ex
+++ b/lib/pleroma/reverse_proxy/client/hackney.ex
@ -4,6 +4,9 @@

 defmodule Pleroma.ReverseProxy.Client.Hackney do
  @behaviour Pleroma.ReverseProxy.Client
+  @redirect_limit 5
+
+  require Logger

  # In-app redirect handler to avoid Hackney redirect bugs:
  # - https://github.com/benoitc/hackney/issues/527 (relative/protocol-less redirects can crash Hackney)
@ -31,26 +34,15 @@ defmodule Pleroma.ReverseProxy.Client.Hackney do

    if opts[:follow_redirect] != false do
      {_state, req_opts} = Access.get_and_update(opts, :follow_redirect, fn a -> {a, false} end)
+      env = %{method: method, headers: headers, body: body, req_opts: req_opts}
      res = :hackney.request(method, url, headers, body, req_opts)

      case res do
        {:ok, code, resp_headers, _client} when code in @redirect_statuses ->
-          :hackney.request(
-            method,
-            absolute_redirect_url(url, resp_headers),
-            headers,
-            body,
-            req_opts
-          )
+          redirect(url, resp_headers, env, @redirect_limit)

        {:ok, code, resp_headers} when code in @redirect_statuses ->
-          :hackney.request(
-            method,
-            absolute_redirect_url(url, resp_headers),
-            headers,
-            body,
-            req_opts
-          )
+          redirect(url, resp_headers, env, @redirect_limit)

        _ ->
          res
@ -71,4 +63,32 @@ defmodule Pleroma.ReverseProxy.Client.Hackney do

  @impl true
  def close(ref), do: :hackney.close(ref)
+
+  defp redirect(url, resp_headers, env, limit) when limit == 0 do
+    new_url = absolute_redirect_url(url, resp_headers)
+
+    Logger.debug(
+      "#{__MODULE__}: Handling redirect #{url} -> #{new_url}; redirect limit was reached - returning response after final redirect"
+    )
+
+    :hackney.request(env.method, new_url, env.headers, env.body, env.req_opts)
+  end
+
+  defp redirect(url, resp_headers, env, limit) do
+    new_url = absolute_redirect_url(url, resp_headers)
+    Logger.debug("#{__MODULE__}: handling redirect #{url} -> #{new_url}; limit = #{limit}")
+
+    res = :hackney.request(env.method, new_url, env.headers, env.body, env.req_opts)
+
+    case res do
+      {:ok, code, new_resp_headers, _client} when code in @redirect_statuses ->
+        redirect(new_url, new_resp_headers, env, limit - 1)
+
+      {:ok, code, new_resp_headers} when code in @redirect_statuses ->
+        redirect(new_url, new_resp_headers, env, limit - 1)
+
+      _ ->
+        res
+    end
+  end
 end
--- a/lib/pleroma/search.ex
+++ b/lib/pleroma/search.ex
@ -1,11 +1,28 @@
 defmodule Pleroma.Search do
+  alias Pleroma.Activity
+  alias Pleroma.Object
+  alias Pleroma.Web.ActivityPub.Visibility
  alias Pleroma.Workers.SearchIndexingWorker

-  def add_to_index(%Pleroma.Activity{id: activity_id}) do
-    SearchIndexingWorker.new(%{"op" => "add_to_index", "activity" => activity_id})
-    |> Oban.insert()
+  @spec add_to_index(Activity.t()) :: {:ok, Oban.Job.t() | :noop} | {:error, Oban.Job.changeset()}
+  def add_to_index(%Activity{id: activity_id, object: %Object{} = object} = activity) do
+    with {_, true} <- {:indexable, indexable?(activity)},
+         {_, "public"} <- {:visibility, Visibility.get_visibility(object)} do
+      SearchIndexingWorker.new(%{"op" => "add_to_index", "activity" => activity_id})
+      |> Oban.insert()
+    else
+      _ -> {:ok, :noop}
+    end
  end

+  def add_to_index(%Activity{id: activity_id}) do
+    case Activity.get_by_id_with_object(activity_id) do
+      %Activity{} = preloaded -> add_to_index(preloaded)
+      _ -> {:ok, :noop}
+    end
+  end
+
+  @spec remove_from_index(Object.t()) :: {:ok, Oban.Job.t()} | {:error, Oban.Job.changeset()}
  def remove_from_index(%Pleroma.Object{id: object_id}) do
    SearchIndexingWorker.new(%{"op" => "remove_from_index", "object" => object_id})
    |> Oban.insert()
@ -20,4 +37,44 @@ defmodule Pleroma.Search do
    search_module = Pleroma.Config.get([Pleroma.Search, :module])
    search_module.healthcheck_endpoints()
  end
+
+  def object_to_search_data(%Object{} = object) do
+    data = object.data
+
+    content_str =
+      case data["content"] do
+        [nil | rest] -> to_string(rest)
+        str -> str
+      end
+
+    content =
+      with {:ok, scrubbed} <-
+             FastSanitize.Sanitizer.scrub(content_str, Pleroma.HTML.Scrubber.SearchIndexing),
+           trimmed <- String.trim(scrubbed) do
+        trimmed
+      end
+
+    # Make sure we have a non-empty string
+    if content != "" do
+      {:ok, published, _} = DateTime.from_iso8601(data["published"])
+
+      %{
+        id: object.id,
+        content: content,
+        ap: data["id"],
+        published: published |> DateTime.to_unix()
+      }
+    end
+  end
+
+  defp indexable?(%Activity{
+         data: %{"type" => "Create"},
+         object: %Object{
+           data: %{"content" => content, "published" => published, "type" => "Note"}
+         }
+       })
+       when not is_nil(content) and content not in ["", "."] and not is_nil(published),
+       do: true
+
+  defp indexable?(_), do: false
 end
--- a/lib/pleroma/search/meilisearch.ex
+++ b/lib/pleroma/search/meilisearch.ex
@ -4,6 +4,8 @@ defmodule Pleroma.Search.Meilisearch do

  alias Pleroma.Activity
  alias Pleroma.Config.Getting, as: Config
+  alias Pleroma.Object
+  alias Pleroma.Search

  import Pleroma.Search.DatabaseSearch
  import Ecto.Query
@ -118,66 +120,24 @@ defmodule Pleroma.Search.Meilisearch do
    end
  end

-  def object_to_search_data(object) do
-    # Only index public or unlisted Notes
-    if not is_nil(object) and object.data["type"] == "Note" and
-         not is_nil(object.data["content"]) and
-         not is_nil(object.data["published"]) and
-         (Pleroma.Constants.as_public() in object.data["to"] or
-            Pleroma.Constants.as_public() in object.data["cc"]) and
-         object.data["content"] not in ["", "."] do
-      data = object.data
-
-      content_str =
-        case data["content"] do
-          [nil | rest] -> to_string(rest)
-          str -> str
-        end
-
-      content =
-        with {:ok, scrubbed} <-
-               FastSanitize.Sanitizer.scrub(content_str, Pleroma.HTML.Scrubber.SearchIndexing),
-             trimmed <- String.trim(scrubbed) do
-          trimmed
-        end
-
-      # Make sure we have a non-empty string
-      if content != "" do
-        {:ok, published, _} = DateTime.from_iso8601(data["published"])
-
-        %{
-          id: object.id,
-          content: content,
-          ap: data["id"],
-          published: published |> DateTime.to_unix()
-        }
-      end
-    end
-  end
-
  @impl true
-  def add_to_index(activity) do
-    maybe_search_data = object_to_search_data(activity.object)
+  def add_to_index(%Activity{object: %Object{} = object} = activity) do
+    search_data = Search.object_to_search_data(object)

-    if activity.data["type"] == "Create" and maybe_search_data do
-      result =
-        meili_put(
-          "/indexes/objects/documents",
-          [maybe_search_data]
-        )
+    result =
+      meili_put(
+        "/indexes/objects/documents",
+        [search_data]
+      )

-      with {:ok, %{"status" => "enqueued"}} <- result do
-        # Added successfully
-        :ok
-      else
-        _ ->
-          # There was an error, report it
-          Logger.error("Failed to add activity #{activity.id} to index: #{inspect(result)}")
-          {:error, result}
-      end
-    else
-      # The post isn't something we can search, that's ok
+    with {:ok, %{"status" => "enqueued"}} <- result do
+      # Added successfully
      :ok
+    else
+      _ ->
+        # There was an error, report it
+        Logger.error("Failed to add activity #{activity.id} to index: #{inspect(result)}")
+        {:error, result}
    end
  end

--- a/lib/pleroma/search/qdrant_search.ex
+++ b/lib/pleroma/search/qdrant_search.ex
@ -4,11 +4,12 @@ defmodule Pleroma.Search.QdrantSearch do

  alias Pleroma.Activity
  alias Pleroma.Config.Getting, as: Config
+  alias Pleroma.Object
+  alias Pleroma.Search

  alias __MODULE__.OpenAIClient
  alias __MODULE__.QdrantClient

-  import Pleroma.Search.Meilisearch, only: [object_to_search_data: 1]
  import Pleroma.Search.DatabaseSearch, only: [maybe_fetch: 3]

  @impl true
@ -82,23 +83,18 @@ defmodule Pleroma.Search.QdrantSearch do
  end

  @impl true
-  def add_to_index(activity) do
-    # This will only index public or unlisted notes
-    maybe_search_data = object_to_search_data(activity.object)
+  def add_to_index(%Activity{object: %Object{} = object} = activity) do
+    search_data = Search.object_to_search_data(object)

-    if activity.data["type"] == "Create" and maybe_search_data do
-      with {:ok, embedding} <- get_embedding(maybe_search_data.content),
-           {:ok, %{status: 200}} <-
-             QdrantClient.put(
-               "/collections/posts/points",
-               build_index_payload(activity, embedding)
-             ) do
-        :ok
-      else
-        e -> {:error, e}
-      end
-    else
+    with {:ok, embedding} <- get_embedding(search_data.content),
+         {:ok, %{status: 200}} <-
+           QdrantClient.put(
+             "/collections/posts/points",
+             build_index_payload(activity, embedding)
+           ) do
      :ok
+    else
+      e -> {:error, e}
    end
  end

--- a/lib/pleroma/signature.ex
+++ b/lib/pleroma/signature.ex
@ -104,7 +104,7 @@ defmodule Pleroma.Signature do
      |> put_req_header("(request-target)", request_target)
      |> put_req_header("@request-target", request_target)

-    @http_signatures_impl.validate_conn(conn)
+    @http_signatures_impl.validate_conn(conn) == true
  end

  @spec validate_signature(Plug.Conn.t()) :: boolean()
--- a/lib/pleroma/user/search.ex
+++ b/lib/pleroma/user/search.ex
@ -4,6 +4,7 @@

 defmodule Pleroma.User.Search do
  alias Pleroma.EctoType.ActivityPub.ObjectValidators.Uri, as: UriType
+  alias Pleroma.Instances.Instance
  alias Pleroma.Pagination
  alias Pleroma.User

@ -88,12 +89,13 @@ defmodule Pleroma.User.Search do
    |> filter_invisible_users()
    |> filter_internal_users()
    |> filter_blocked_domains(for_user)
+    |> filter_unreachable_users()
    |> fts_search(query_string)
    |> select_top_users(top_user_ids)
    |> trigram_rank(query_string)
    |> boost_search_rank(for_user, top_user_ids)
    |> subquery()
-    |> order_by(desc: :search_rank)
+    |> order_by_search_rank(for_user)
    |> maybe_restrict_local(for_user)
    |> maybe_restrict_accepting_chat_messages(capabilities)
    |> filter_deactivated_users()
@ -196,6 +198,14 @@ defmodule Pleroma.User.Search do

  defp filter_blocked_domains(query, _), do: query

+  defp filter_unreachable_users(query) do
+    from(u in query,
+      left_join: i in Instance,
+      on: i.host == fragment("substring(? from '.*://([^/]*)')", u.ap_id),
+      where: is_nil(i.unreachable_since)
+    )
+  end
+
  defp maybe_resolve(true, user, query) do
    case {limit(), user} do
      {:all, _} -> :noop
@ -236,6 +246,16 @@ defmodule Pleroma.User.Search do

    from(u in subquery(query),
      select_merge: %{
+        search_type:
+          fragment(
+            """
+            CASE WHEN (?) THEN 2
+            WHEN (?) THEN 1
+            ELSE 0 END
+            """,
+            u.id in ^top_user_ids,
+            u.id in ^friends_ids or u.id in ^followers_ids
+          ),
        search_rank:
          fragment(
            """
@ -261,6 +281,14 @@ defmodule Pleroma.User.Search do
  defp boost_search_rank(query, _for_user, top_user_ids) do
    from(u in subquery(query),
      select_merge: %{
+        search_type:
+          fragment(
+            """
+            CASE WHEN (?) THEN 2
+            ELSE 0 END
+            """,
+            u.id in ^top_user_ids
+          ),
        search_rank:
          fragment(
            """
@ -273,4 +301,22 @@ defmodule Pleroma.User.Search do
      }
    )
  end
+
+  defp order_by_search_rank(query, %User{}) do
+    order_by(
+      query,
+      [u],
+      desc: u.search_type,
+      desc_nulls_last:
+        fragment(
+          "CASE WHEN ? = 1 THEN COALESCE(?, ?) ELSE NULL END",
+          u.search_type,
+          u.last_status_at,
+          u.last_active_at
+        ),
+      desc: u.search_rank
+    )
+  end
+
+  defp order_by_search_rank(query, _), do: order_by(query, desc: :search_rank)
 end
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@ -1677,44 +1677,80 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do

    show_birthday = !!birthday

-    # if WebFinger request was already done, we probably have acct, otherwise
-    # we request WebFinger here
-    nickname = additional[:nickname_from_acct] || generate_nickname(data)
+    with {:ok, nickname} <- nickname_from_actor(data, additional) do
+      {:ok,
+       %{
+         ap_id: data["id"],
+         uri: get_actor_url(data["url"]),
+         banner: normalize_image(data["image"]),
+         fields: fields,
+         emoji: emojis,
+         is_locked: is_locked,
+         is_discoverable: is_discoverable,
+         invisible: invisible,
+         avatar: normalize_image(data["icon"]),
+         name: data["name"],
+         follower_address: data["followers"],
+         following_address: data["following"],
+         featured_address: featured_address,
+         bio: data["summary"] || "",
+         actor_type: actor_type,
+         also_known_as: normalize_also_known_as(data["alsoKnownAs"]),
+         public_key: public_key,
+         inbox: data["inbox"],
+         shared_inbox: shared_inbox,
+         accepts_chat_messages: accepts_chat_messages,
+         birthday: birthday,
+         show_birthday: show_birthday,
+         pinned_objects: pinned_objects,
+         nickname: nickname
+       }}
+    end
+  end

-    %{
-      ap_id: data["id"],
-      uri: get_actor_url(data["url"]),
-      banner: normalize_image(data["image"]),
-      fields: fields,
-      emoji: emojis,
-      is_locked: is_locked,
-      is_discoverable: is_discoverable,
-      invisible: invisible,
-      avatar: normalize_image(data["icon"]),
-      name: data["name"],
-      follower_address: data["followers"],
-      following_address: data["following"],
-      featured_address: featured_address,
-      bio: data["summary"] || "",
-      actor_type: actor_type,
-      also_known_as: normalize_also_known_as(data["alsoKnownAs"]),
-      public_key: public_key,
-      inbox: data["inbox"],
-      shared_inbox: shared_inbox,
-      accepts_chat_messages: accepts_chat_messages,
-      birthday: birthday,
-      show_birthday: show_birthday,
-      pinned_objects: pinned_objects,
-      nickname: nickname
-    }
+  defp nickname_from_actor(data, additional) do
+    generated = generated_nickname(data)
+
+    case additional[:nickname_from_acct] do
+      ^generated when is_binary(generated) ->
+        {:ok, generated}
+
+      acct when is_binary(acct) ->
+        with ^acct <- webfinger_nickname(data) do
+          {:ok, acct}
+        else
+          _ -> {:error, {:webfinger_actor_mismatch, acct, data["id"]}}
+        end
+
+      _ ->
+        {:ok, generate_nickname(data)}
+    end
+  end
+
+  defp generated_nickname(%{"preferredUsername" => username, "id" => ap_id})
+       when is_binary(username) and is_binary(ap_id) do
+    case URI.parse(ap_id) do
+      %URI{host: host} when is_binary(host) -> "#{username}@#{host}"
+      _ -> nil
+    end
+  end
+
+  defp generated_nickname(_), do: nil
+
+  defp webfinger_nickname(data) do
+    with generated when is_binary(generated) <- generated_nickname(data),
+         {:ok, %{"subject" => "acct:" <> acct, "ap_id" => ap_id}} <- WebFinger.finger(generated),
+         true <- ap_id == data["id"] do
+      acct
+    end
  end

  defp generate_nickname(%{"preferredUsername" => username} = data) when is_binary(username) do
-    generated = "#{username}@#{URI.parse(data["id"]).host}"
+    generated = generated_nickname(data)

    if Config.get([WebFinger, :update_nickname_on_user_fetch]) do
-      case WebFinger.finger(generated) do
-        {:ok, %{"subject" => "acct:" <> acct}} -> acct
+      case webfinger_nickname(data) do
+        acct when is_binary(acct) -> acct
        _ -> generated
      end
    else
@ -1794,9 +1830,11 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
  defp collection_private(_data), do: {:ok, true}

  def user_data_from_user_object(data, additional \\ []) do
-    with {:ok, data} <- MRF.filter(data) do
-      {:ok, object_to_user_data(data, additional)}
+    with {:ok, data} <- MRF.filter(data),
+         {:ok, data} <- object_to_user_data(data, additional) do
+      {:ok, data}
    else
+      {:error, _} = e -> e
      e -> {:error, e}
    end
  end
--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@ -348,7 +348,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
  end

  def inbox(%{assigns: %{valid_signature: false}} = conn, params) do
-    Federator.incoming_ap_doc(%{
+    Federator.incoming_failed_signature_ap_doc(%{
      method: conn.method,
      req_headers: conn.req_headers,
      request_path: conn.request_path,
--- a/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/article_note_page_validator.ex
@ -6,9 +6,12 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.ArticleNotePageValidator do
  use Ecto.Schema

  alias Pleroma.EctoType.ActivityPub.ObjectValidators
+  alias Pleroma.HTML
+  alias Pleroma.User
  alias Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes
  alias Pleroma.Web.ActivityPub.ObjectValidators.CommonValidations
  alias Pleroma.Web.ActivityPub.Transmogrifier
+  alias Pleroma.Web.CommonAPI.Utils

  import Ecto.Changeset

@ -26,6 +29,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.ArticleNotePageValidator do
    end

    field(:replies, {:array, ObjectValidators.ObjectID}, default: [])
+    field(:source, :map)
  end

  def cast_and_apply(data) do
@ -80,6 +84,113 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.ArticleNotePageValidator do

  def fix_attachments(data), do: data

+  defp remote_mention_resolver(
+         %{"id" => ap_id, "tag" => tags},
+         "@" <> nickname = mention,
+         buffer,
+         opts,
+         acc
+       )
+       when is_binary(ap_id) and is_list(tags) do
+    initial_host =
+      ap_id
+      |> URI.parse()
+      |> Map.get(:host)
+
+    with mention_tag when not is_nil(mention_tag) <-
+           Enum.find(tags, &mention_tag?(&1, mention, initial_host)),
+         href when is_binary(href) <- mention_tag["href"],
+         %User{} = user <- User.get_cached_by_ap_id(href) do
+      link = Pleroma.Formatter.mention_from_user(user, opts)
+      {link, %{acc | mentions: MapSet.put(acc.mentions, {"@" <> nickname, user})}}
+    else
+      _ -> {buffer, acc}
+    end
+  end
+
+  defp remote_mention_resolver(_object, _mention, buffer, _opts, acc), do: {buffer, acc}
+
+  defp mention_tag?(%{"type" => "Mention", "name" => name}, mention, initial_host)
+       when is_binary(name) do
+    name == mention || mention == "#{name}@#{initial_host}"
+  end
+
+  defp mention_tag?(_tag, _mention, _initial_host), do: false
+
+  defp scrub_content(%{"content" => content} = object) when is_binary(content) do
+    Map.put(object, "content", HTML.filter_tags(content))
+  end
+
+  defp scrub_content(object), do: object
+
+  defp mfm_parse_limit do
+    min(Pleroma.Config.get([:instance, :limit]), Pleroma.Config.get([:instance, :remote_limit]))
+  end
+
+  defp normalize_source(%{"source" => source} = object) when is_binary(source) do
+    object
+    |> Map.put("source", %{"content" => source})
+    |> normalize_source()
+  end
+
+  defp normalize_source(%{"source" => source} = object) when is_map(source) do
+    source =
+      case source["content"] do
+        content when is_binary(content) ->
+          if String.length(content) <= mfm_parse_limit() do
+            source
+          else
+            Map.delete(source, "content")
+          end
+
+        nil ->
+          source
+
+        _ ->
+          Map.delete(source, "content")
+      end
+
+    Map.put(object, "source", source)
+  end
+
+  defp normalize_source(object), do: object
+
+  defp fix_misskey_content(%{"htmlMfm" => true, "content" => content} = object)
+       when is_binary(content) do
+    Map.put(object, "content", HTML.filter_tags(content))
+  end
+
+  defp fix_misskey_content(%{"htmlMfm" => true} = object), do: object
+
+  defp fix_misskey_content(
+         %{"source" => %{"mediaType" => "text/x.misskeymarkdown", "content" => content}} = object
+       )
+       when is_binary(content) do
+    mention_handler = fn nick, buffer, opts, acc ->
+      remote_mention_resolver(object, nick, buffer, opts, acc)
+    end
+
+    {linked, _mentions, _tags} =
+      Utils.format_input(content, "text/x.misskeymarkdown", mention_handler: mention_handler)
+
+    Map.put(object, "content", linked)
+  end
+
+  defp fix_misskey_content(%{"source" => %{"mediaType" => "text/x.misskeymarkdown"}} = object),
+    do: scrub_content(object)
+
+  defp fix_misskey_content(%{"_misskey_content" => content} = object) when is_binary(content) do
+    object
+    |> Map.put("source", %{
+      "content" => content,
+      "mediaType" => "text/x.misskeymarkdown"
+    })
+    |> Map.delete("_misskey_content")
+    |> fix_misskey_content()
+  end
+
+  defp fix_misskey_content(object), do: object
+
  defp fix(data) do
    data
    |> CommonFixes.fix_actor()
@ -88,6 +199,8 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.ArticleNotePageValidator do
    |> fix_tag()
    |> fix_replies()
    |> fix_attachments()
+    |> normalize_source()
+    |> fix_misskey_content()
    |> CommonFixes.fix_quote_url()
    |> CommonFixes.fix_likes()
    |> Transmogrifier.fix_emoji()
--- a/lib/pleroma/web/activity_pub/object_validators/common_fields.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/common_fields.ex
@ -32,6 +32,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFields do
    quote bind_quoted: binding() do
      field(:content, :string)
      field(:contentMap, ObjectValidators.ContentLanguageMap)
+      field(:htmlMfm, :boolean)

      field(:published, ObjectValidators.DateTime)
      field(:updated, ObjectValidators.DateTime)
--- a/lib/pleroma/web/activity_pub/object_validators/question_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/question_validator.ex
@ -28,6 +28,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.QuestionValidator do
    end

    field(:closed, ObjectValidators.DateTime)
+    field(:votersCount, :integer)
    field(:voters, {:array, ObjectValidators.ObjectID}, default: [])
    field(:nonAnonymous, :boolean)
    embeds_many(:anyOf, QuestionOptionsValidator)
--- a/lib/pleroma/web/activity_pub/object_validators/update_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/update_validator.ex
@ -75,15 +75,40 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.UpdateValidator do
    end
  end

-  # For remote Updates, verify the host is the same.
+  # For remote Updates, verify the Actor is the same
  def validate_updating_rights_remote(cng) do
    with actor = get_field(cng, :actor),
         object = get_field(cng, :object),
         {:ok, object_id} <- ObjectValidators.ObjectID.cast(object),
-         actor_uri <- URI.parse(actor),
-         object_uri <- URI.parse(object_id),
-         true <- actor_uri.host == object_uri.host do
-      cng
+         entity <-
+           Object.normalize(object_id, fetch: false) || User.get_cached_by_ap_id(object_id) do
+      case entity do
+        # Actor must own Object to update it
+        %Object{} ->
+          if actor == entity.data["actor"] do
+            cng
+          else
+            cng
+            |> add_error(:object, "Can't be updated by this actor")
+          end
+
+        # Actor must only be allowed to update itself
+        %User{} ->
+          if actor == entity.ap_id do
+            cng
+          else
+            cng
+            |> add_error(:object, "Can't be updated by this actor")
+          end
+
+        nil ->
+          cng
+          |> add_error(:object, "Can't be updated by this actor")
+
+        _ ->
+          cng
+          |> add_error(:object, "Update is neither for Object or Actor")
+      end
    else
      _e ->
        cng
--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
@ -430,6 +430,12 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
    end)
  end

+  defp reject_third_party_report(%User{local: false}, %User{local: false} = account) do
+    {:reject, "[Transmogrifier] third-party report: #{account.ap_id}"}
+  end
+
+  defp reject_third_party_report(_, _), do: :ok
+
  def handle_incoming(data, options \\ []) do
    data
    |> fix_recursive(&strip_internal_fields/1)
@ -444,9 +450,11 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
       ) do
    with context <- data["context"] || Utils.generate_context_id(),
         content <- data["content"] || "",
+         objects <- List.wrap(objects),
         %User{} = actor <- User.get_cached_by_ap_id(actor),
         # Reduce the object list to find the reported user.
         %User{} = account <- get_reported(objects),
+         :ok <- reject_third_party_report(actor, account),
         # Remove the reported user from the object list.
         statuses <- Enum.filter(objects, fn ap_id -> ap_id != account.ap_id end) do
      %{
@ -783,6 +791,12 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do

  def set_replies(obj_data), do: obj_data

+  defp set_voters_count(%{"voters" => [_ | _] = voters} = obj) do
+    Map.merge(obj, %{"votersCount" => length(voters)})
+  end
+
+  defp set_voters_count(obj), do: obj
+
  # Prepares and sanitizes the object for federation.
  def prepare_object(object) do
    object
@ -795,6 +809,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
    |> set_reply_to_uri
    |> set_quote_url
    |> set_replies
+    |> set_voters_count
    |> CommonFixes.maybe_add_content_map()
    |> strip_internal_fields
    |> strip_internal_tags
--- a/lib/pleroma/web/activity_pub/utils.ex
+++ b/lib/pleroma/web/activity_pub/utils.ex
@ -120,7 +120,8 @@ defmodule Pleroma.Web.ActivityPub.Utils do
        "https://www.w3.org/ns/activitystreams",
        "#{Endpoint.url()}/schemas/litepub-0.1.jsonld",
        %{
-          "@language" => get_language(data)
+          "@language" => get_language(data),
+          "htmlMfm" => "https://w3id.org/fep/c16b#htmlMfm"
        }
      ]
    }
--- a/lib/pleroma/web/api_spec/operations/list_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/list_operation.ex
@ -172,7 +172,10 @@ defmodule Pleroma.Web.ApiSpec.ListOperation do
        type: :object,
        properties: %{
          title: %Schema{type: :string, description: "List title"},
-          exclusive: %Schema{type: :boolean, description: "Whether members of the list should be removed from the “Home” feed"}
+          exclusive: %Schema{
+            type: :boolean,
+            description: "Whether members of the list should be removed from the “Home” feed"
+          }
        },
        required: [:title]
      },
@ -188,7 +191,10 @@ defmodule Pleroma.Web.ApiSpec.ListOperation do
        type: :object,
        properties: %{
          title: %Schema{type: :string, description: "List title"},
-          exclusive: %Schema{type: :boolean, description: "Whether members of the list should be removed from the “Home” feed"}
+          exclusive: %Schema{
+            type: :boolean,
+            description: "Whether members of the list should be removed from the “Home” feed"
+          }
        }
      },
      required: true
--- a/lib/pleroma/web/common_api/activity_draft.ex
+++ b/lib/pleroma/web/common_api/activity_draft.ex
@ -317,6 +317,7 @@ defmodule Pleroma.Web.CommonAPI.ActivityDraft do

    emoji = Map.merge(emoji, summary_emoji)

+    media_type = Utils.get_content_type(draft.params[:content_type])
    {:ok, note_data, _meta} = Builder.note(draft)

    object =
@ -324,14 +325,18 @@ defmodule Pleroma.Web.CommonAPI.ActivityDraft do
      |> Map.put("emoji", emoji)
      |> Map.put("source", %{
        "content" => draft.status,
-        "mediaType" => Utils.get_content_type(draft.params[:content_type])
+        "mediaType" => media_type
      })
+      |> maybe_put("htmlMfm", true, media_type == "text/x.misskeymarkdown")
      |> Map.put("generator", draft.params[:generator])
      |> Map.put("language", draft.language)

    %{draft | object: object}
  end

+  defp maybe_put(map, key, value, true), do: Map.put(map, key, value)
+  defp maybe_put(map, _key, _value, _condition), do: map
+
  defp preview?(%__MODULE__{} = draft) do
    preview? = Pleroma.Web.Utils.Params.truthy_param?(draft.params[:preview])
    %{draft | preview?: preview?}
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@ -322,6 +322,14 @@ defmodule Pleroma.Web.CommonAPI.Utils do
    |> Formatter.linkify(options)
  end

+  def format_input(text, "text/x.misskeymarkdown", options) do
+    text
+    |> Formatter.markdown_to_html(%{breaks: true})
+    |> safe_mfm_to_html()
+    |> Formatter.linkify(options)
+    |> Formatter.html_escape("text/x.misskeymarkdown")
+  end
+
  def format_input(text, "text/markdown", options) do
    text
    |> Formatter.mentions_escape(options)
@ -330,6 +338,16 @@ defmodule Pleroma.Web.CommonAPI.Utils do
    |> Formatter.html_escape("text/html")
  end

+  defp safe_mfm_to_html(html) do
+    html
+    |> MfmParser.Parser.parse()
+    |> MfmParser.Encoder.to_html()
+  rescue
+    _ -> html
+  catch
+    _, _ -> html
+  end
+
  def format_naive_asctime(date) do
    date |> DateTime.from_naive!("Etc/UTC") |> format_asctime
  end
--- a/lib/pleroma/web/embed_controller.ex
+++ b/lib/pleroma/web/embed_controller.ex
@ -20,6 +20,7 @@ defmodule Pleroma.Web.EmbedController do
      conn
      |> delete_resp_header("x-frame-options")
      |> delete_resp_header("content-security-policy")
+      |> put_layout({Pleroma.Web.LayoutView, :embed})
      |> render("show.html",
        activity: activity,
        author: User.sanitize_html(author),
--- a/lib/pleroma/web/endpoint.ex
+++ b/lib/pleroma/web/endpoint.ex
@ -46,8 +46,10 @@ defmodule Pleroma.Web.Endpoint do
  plug(Pleroma.Web.Plugs.HTTPSecurityPlug)
  plug(Pleroma.Web.Plugs.UploadedMedia)

-  @static_cache_control "public, max-age=1209600"
+  @static_cache_control "public, max-age=1209600, immutable"
  @static_cache_disabled "public, no-cache"
+  # cache for a day
+  @favicon_cache_control "public, max=age=86400, immutable"

  # InstanceStatic needs to be before Plug.Static to be able to override shipped-static files
  # If you're adding new paths to `only:` you'll need to configure them in InstanceStatic as well
@ -64,6 +66,15 @@ defmodule Pleroma.Web.Endpoint do
    }
  )

+  plug(Pleroma.Web.Plugs.FaviconPlug,
+    at: "/",
+    only: ["favicon.png"],
+    cache_control_for_etags: @favicon_cache_control,
+    headers: %{
+      "cache-control" => @favicon_cache_control
+    }
+  )
+
  plug(Pleroma.Web.Plugs.InstanceStatic,
    at: "/",
    gzip: true,
--- a/lib/pleroma/web/fallback/redirect_controller.ex
+++ b/lib/pleroma/web/fallback/redirect_controller.ex
@ -29,9 +29,18 @@ defmodule Pleroma.Web.Fallback.RedirectController do
    )
  end

-  def live_dashboard(conn, _params) do
+  def live_dashboard(conn, %{"path" => path}) do
+    query_params = conn.query_string
+
+    redirect_path =
+      if query_params == "" do
+        "/pleroma/live_dashboard/#{path}"
+      else
+        "/pleroma/live_dashboard/#{path}?#{query_params}"
+      end
+
    conn
-    |> redirect(to: "/pleroma/live_dashboard")
+    |> redirect(to: redirect_path)
  end

  def redirector(conn, _params, code \\ 200) do
--- a/lib/pleroma/web/federator.ex
+++ b/lib/pleroma/web/federator.ex
@ -11,6 +11,7 @@ defmodule Pleroma.Web.Federator do
  alias Pleroma.Web.ActivityPub.Utils
  alias Pleroma.Workers.PublisherWorker
  alias Pleroma.Workers.ReceiverWorker
+  alias Pleroma.Workers.SignatureRetryWorker

  require Logger

@ -35,12 +36,21 @@ defmodule Pleroma.Web.Federator do
  end

  # Client API
-  def incoming_ap_doc(%{params: params, req_headers: req_headers}) do
-    ReceiverWorker.new(
+  def incoming_failed_signature_ap_doc(%{
+        method: method,
+        params: params,
+        req_headers: req_headers,
+        request_path: request_path,
+        query_string: query_string
+      }) do
+    SignatureRetryWorker.new(
      %{
-        "op" => "incoming_ap_doc",
+        "op" => "incoming_failed_signature_ap_doc",
+        "method" => method,
        "req_headers" => req_headers,
        "params" => params,
+        "request_path" => request_path,
+        "query_string" => query_string,
        "timeout" => :timer.seconds(20)
      },
      priority: 2
--- a/lib/pleroma/web/mastodon_api/views/poll_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/poll_view.ex
@ -71,6 +71,8 @@ defmodule Pleroma.Web.MastodonAPI.PollView do
    end)
  end

+  defp voters_count(%{data: %{"votersCount" => voters}}) when is_integer(voters), do: voters
+
  defp voters_count(%{data: %{"voters" => [_ | _] = voters}}) do
    length(voters)
  end
--- a/lib/pleroma/web/o_auth/token_controller.ex
+++ b/lib/pleroma/web/o_auth/token_controller.ex
@ -7,8 +7,8 @@ defmodule Pleroma.Web.OAuth.TokenController do

  alias Pleroma.User
  alias Pleroma.Web.OAuth.Token
-  alias Pleroma.Web.Plugs.OAuthScopesPlug
  alias Pleroma.Web.OAuth.TokenView
+  alias Pleroma.Web.Plugs.OAuthScopesPlug

  require Logger

--- a/lib/pleroma/web/pleroma_api/controllers/token_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/token_controller.ex
@ -7,8 +7,8 @@ defmodule Pleroma.Web.PleromaAPI.TokenController do

  alias Pleroma.User
  alias Pleroma.Web.OAuth.Token
-  alias Pleroma.Web.Plugs.OAuthScopesPlug
  alias Pleroma.Web.PleromaAPI.TokenView
+  alias Pleroma.Web.Plugs.OAuthScopesPlug

  require Logger

--- a/lib/pleroma/web/plugs/favicon_plug.ex
+++ b/lib/pleroma/web/plugs/favicon_plug.ex
@ -0,0 +1,71 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2026 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Plugs.FaviconPlug do
+  @behaviour Plug
+
+  @moduledoc """
+  This is a shim to call `Plug.Static` but with runtime `from` configuration for instance favicon.
+
+  Serves default or custom favicon.png with cacheable cache-control.
+  """
+
+  import Plug.Conn, only: [put_resp_header: 3, send_resp: 3, halt: 1]
+
+  require Logger
+
+  def init(opts) do
+    opts
+    |> Keyword.put(:from, "__unconfigured_favicon_static_plug")
+    |> Plug.Static.init()
+  end
+
+  def call(%{request_path: "/favicon.png"} = conn, opts) do
+    case find_favicon_dir() do
+      {:ok, dir} ->
+        call_static(conn, opts, dir)
+
+      :error ->
+        # Favicon should always be available and this should never occur.
+        # If it does, halt the pipeline before having unintended side-effects.
+        Logger.error("No favicon.png found! Is the default favicon deleted?")
+
+        conn
+        |> send_resp(404, "Not found")
+        |> halt()
+    end
+  end
+
+  def call(conn, _) do
+    conn
+  end
+
+  defp find_favicon_dir do
+    instance_dir = Pleroma.Config.get([:instance, :static_dir], "instance/static")
+    instance_path = Path.join(instance_dir, "favicon.png")
+
+    priv_dir = Application.app_dir(:pleroma, "priv/static")
+    priv_path = Path.join(priv_dir, "favicon.png")
+
+    cond do
+      File.exists?(instance_path) -> {:ok, instance_dir}
+      File.exists?(priv_path) -> {:ok, priv_dir}
+      true -> :error
+    end
+  end
+
+  defp call_static(conn, opts, from) do
+    opts =
+      opts
+      |> Map.put(:from, from)
+      |> Map.put(:content_types, false)
+
+    conn = set_content_type(conn)
+    Plug.Static.call(conn, opts)
+  end
+
+  defp set_content_type(conn) do
+    put_resp_header(conn, "content-type", "image/png")
+  end
+end
--- a/lib/pleroma/web/plugs/instance_static.ex
+++ b/lib/pleroma/web/plugs/instance_static.ex
@ -4,7 +4,7 @@

 defmodule Pleroma.Web.Plugs.InstanceStatic do
  require Pleroma.Constants
-  import Plug.Conn, only: [put_resp_header: 3]
+  import Plug.Conn, only: [put_resp_header: 3, put_status: 2, send_resp: 3, halt: 1]

  @moduledoc """
  This is a shim to call `Plug.Static` but with runtime `from` configuration.
@ -51,10 +51,37 @@ defmodule Pleroma.Web.Plugs.InstanceStatic do
      |> Map.put(:from, from)
      |> Map.put(:content_types, false)

-    conn = set_content_type(conn, conn.request_path)
+    conn =
+      conn
+      |> set_content_type(conn.request_path)
+      |> Plug.Static.call(opts)

-    # Call Plug.Static with our sanitized content-type
-    Plug.Static.call(conn, opts)
+    if conn.halted do
+      conn
+    else
+      path = String.trim_leading(conn.request_path, "/")
+
+      if not File.exists?(file_path(path)) do
+        conn
+        |> put_status(:not_found)
+        |> send_404()
+        |> halt()
+      else
+        conn
+      end
+    end
+  end
+
+  defp send_404(conn) do
+    if String.ends_with?(String.downcase(conn.request_path), ".json") do
+      conn
+      |> put_resp_header("content-type", "application/json")
+      |> send_resp(404, Jason.encode!(%{error: "not found"}))
+    else
+      conn
+      |> put_resp_header("content-type", "text/plain")
+      |> send_resp(404, "Not found")
+    end
  end

  defp set_content_type(conn, "/emoji/" <> filepath) do
--- a/lib/pleroma/web/plugs/mapped_signature_to_identity_plug.ex
+++ b/lib/pleroma/web/plugs/mapped_signature_to_identity_plug.ex
@ -32,8 +32,8 @@ defmodule Pleroma.Web.Plugs.MappedSignatureToIdentityPlug do
      # remove me once testsuite uses mapped capabilities instead of what we do now
      {:user, nil} ->
        Logger.debug("Failed to map identity from signature (lookup failure)")
-        Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{actor}")
-        conn
+        Logger.debug("key_id=#{inspect(key_id_from_conn(conn))}, actor=#{inspect(actor)}")
+        assign(conn, :valid_signature, false)
    end
  end

--- a/lib/pleroma/web/plugs/rate_limiter.ex
+++ b/lib/pleroma/web/plugs/rate_limiter.ex
@ -67,6 +67,8 @@ defmodule Pleroma.Web.Plugs.RateLimiter do
  import Plug.Conn

  alias Pleroma.Config
+  alias Pleroma.Config.Holder
+  alias Pleroma.EctoType.Config.RateLimit
  alias Pleroma.User
  alias Pleroma.Web.Plugs.RateLimiter.LimiterSupervisor

@ -143,7 +145,7 @@ defmodule Pleroma.Web.Plugs.RateLimiter do

  def action_settings(plug_opts) do
    with limiter_name when is_atom(limiter_name) <- plug_opts[:name],
-         limits when not is_nil(limits) <- Config.get([:rate_limit, limiter_name]) do
+         {:ok, limits} <- fetch_and_normalize_limits(limiter_name) do
      bucket_name_root = Keyword.get(plug_opts, :bucket_name, limiter_name)

      %{
@ -151,6 +153,72 @@ defmodule Pleroma.Web.Plugs.RateLimiter do
        limits: limits,
        opts: plug_opts
      }
+    else
+      :disabled -> nil
+    end
+  end
+
+  defp fetch_and_normalize_limits(limiter_name) do
+    limits = Config.get([:rate_limit, limiter_name])
+
+    case normalize_limits(limits) do
+      {:ok, limits} ->
+        {:ok, limits}
+
+      :disabled ->
+        :disabled
+
+      :error ->
+        default_limits =
+          Holder.default_config(:pleroma, :rate_limit)
+          |> get_default_limits(limiter_name)
+
+        case normalize_limits(default_limits) do
+          {:ok, normalized_limits} ->
+            warn_invalid_limits_once(limiter_name, limits)
+            {:ok, normalized_limits}
+
+          _ ->
+            warn_invalid_limits_once(limiter_name, limits)
+            :disabled
+        end
+    end
+  end
+
+  defp get_default_limits(%{} = rate_limit, limiter_name), do: Map.get(rate_limit, limiter_name)
+
+  defp get_default_limits(rate_limit, limiter_name) when is_list(rate_limit) do
+    if Keyword.keyword?(rate_limit) do
+      Keyword.get(rate_limit, limiter_name)
+    else
+      nil
+    end
+  end
+
+  defp get_default_limits(_, _), do: nil
+
+  @invalid_limits_warned_key {__MODULE__, :invalid_limits_warned}
+
+  defp warn_invalid_limits_once(limiter_name, limits) do
+    warned = :persistent_term.get(@invalid_limits_warned_key, MapSet.new())
+
+    if MapSet.member?(warned, limiter_name) do
+      :ok
+    else
+      :persistent_term.put(@invalid_limits_warned_key, MapSet.put(warned, limiter_name))
+
+      Logger.warning(
+        "Invalid rate limiter config for #{inspect(limiter_name)}: #{inspect(limits)}. Falling back to defaults or disabling this limiter."
+      )
+    end
+  end
+
+  defp normalize_limits(nil), do: :disabled
+
+  defp normalize_limits(limits) do
+    case RateLimit.cast(limits) do
+      {:ok, normalized_limits} -> {:ok, normalized_limits}
+      :error -> :error
    end
  end

--- a/lib/pleroma/web/plugs/uploaded_media.ex
+++ b/lib/pleroma/web/plugs/uploaded_media.ex
@ -17,7 +17,7 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do
  # no slashes
  @path "media"

-  @default_cache_control_header "public, max-age=1209600"
+  @default_cache_control_header "public, max-age=1209600, immutable"

  def init(_opts) do
    static_plug_opts =
--- a/lib/pleroma/web/preload/providers/instance.ex
+++ b/lib/pleroma/web/preload/providers/instance.ex
@ -5,9 +5,9 @@
 defmodule Pleroma.Web.Preload.Providers.Instance do
  alias Pleroma.Web.MastodonAPI.InstanceView
  alias Pleroma.Web.Nodeinfo.Nodeinfo
+  alias Pleroma.Web.PleromaAPI.UtilView
  alias Pleroma.Web.Plugs.InstanceStatic
  alias Pleroma.Web.Preload.Providers.Provider
-  alias Pleroma.Web.PleromaAPI.UtilView

  @behaviour Provider
  @instance_url "/api/v1/instance"
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@ -1032,6 +1032,8 @@ defmodule Pleroma.Web.Router do
    pipe_through(:pleroma_html)

    post("/auth/password", OAuth.PasswordController, :request)
+
+    get("/embed/:id", EmbedController, :show)
  end

  scope "/proxy/", Pleroma.Web do
@ -1093,7 +1095,7 @@ defmodule Pleroma.Web.Router do
    get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
    match(:*, "/api/pleroma/*path", LegacyPleromaApiRerouterPlug, [])
    get("/api/*path", RedirectController, :api_not_implemented)
-    get("/phoenix/live_dashboard", RedirectController, :live_dashboard)
+    get("/phoenix/live_dashboard/*path", RedirectController, :live_dashboard)
    get("/*path", RedirectController, :redirector_with_preload)

    options("/*path", RedirectController, :empty)
--- a/lib/pleroma/workers/cron/digest_emails_worker.ex
+++ b/lib/pleroma/workers/cron/digest_emails_worker.ex
@ -7,7 +7,7 @@ defmodule Pleroma.Workers.Cron.DigestEmailsWorker do
  The worker to send digest emails.
  """

-  use Oban.Worker, queue: "mailer"
+  use Oban.Worker, queue: :background

  alias Pleroma.Config
  alias Pleroma.Emails
--- a/lib/pleroma/workers/receiver_worker.ex
+++ b/lib/pleroma/workers/receiver_worker.ex
@ -4,40 +4,37 @@

 defmodule Pleroma.Workers.ReceiverWorker do
  alias Pleroma.Instances
-  alias Pleroma.Signature
-  alias Pleroma.User
  alias Pleroma.Web.Federator
+  alias Pleroma.Workers.SignatureRetryWorker

  use Oban.Worker, queue: :federator_incoming, max_attempts: 5, unique: [period: :infinity]

  @impl true
+  def perform(%Job{args: %{"op" => "incoming_ap_doc", "params" => params} = args} = job) do
+    if signature_retry_job?(args) do
+      perform_signature_retry(job)
+    else
+      perform_incoming(params)
+    end
+  end

-  def perform(%Job{
-        args: %{
-          "op" => "incoming_ap_doc",
-          "method" => method,
-          "params" => params,
-          "req_headers" => req_headers,
-          "request_path" => request_path,
-          "query_string" => query_string
-        }
-      }) do
-    # Oban's serialization converts our tuple headers to lists.
-    # Revert it for the signature validation.
-    req_headers = Enum.into(req_headers, [], &List.to_tuple(&1))
+  def perform(%Job{args: %{"op" => "incoming_ap_doc"} = args} = job) do
+    if signature_retry_job?(args) do
+      perform_signature_retry(job)
+    else
+      process_errors(:missing_incoming_ap_doc_params)
+    end
+  end

-    conn_data = %Plug.Conn{
-      method: method,
-      params: params,
-      req_headers: req_headers,
-      request_path: request_path,
-      query_string: query_string
-    }
+  defp perform_signature_retry(%Job{args: args} = job) do
+    SignatureRetryWorker.perform(%Job{
+      job
+      | args: Map.put(args, "op", "incoming_failed_signature_ap_doc")
+    })
+  end

-    with {:ok, %User{}} <- User.get_or_fetch_by_ap_id(conn_data.params["actor"]),
-         {:ok, _public_key} <- Signature.refetch_public_key(conn_data),
-         {:signature, true} <- {:signature, Signature.validate_signature(conn_data)},
-         {:ok, res} <- Federator.perform(:incoming_ap_doc, params) do
+  defp perform_incoming(params) do
+    with {:ok, res} <- Federator.perform(:incoming_ap_doc, params) do
      unless Instances.reachable?(params["actor"]) do
        domain = URI.parse(params["actor"]).host
        Oban.insert(Pleroma.Workers.ReachabilityWorker.new(%{"domain" => domain}))
@ -49,17 +46,8 @@ defmodule Pleroma.Workers.ReceiverWorker do
    end
  end

-  def perform(%Job{args: %{"op" => "incoming_ap_doc", "params" => params}}) do
-    with {:ok, res} <- Federator.perform(:incoming_ap_doc, params) do
-      unless Instances.reachable?(params["actor"]) do
-        domain = URI.parse(params["actor"]).host
-        Oban.insert(Pleroma.Workers.ReachabilityWorker.new(%{"domain" => domain}))
-      end
-
-      {:ok, res}
-    else
-      e -> process_errors(e)
-    end
+  defp signature_retry_job?(args) do
+    Enum.any?(~w(method req_headers request_path query_string), &Map.has_key?(args, &1))
  end

  @impl true
@ -85,10 +73,12 @@ defmodule Pleroma.Workers.ReceiverWorker do
      {:error, {:reject, _} = reason} -> {:cancel, reason}
      # HTTP Sigs
      {:signature, false} -> {:cancel, :invalid_signature}
+      {:same_actor, false} -> {:cancel, :actor_signature_mismatch}
      # Origin / URL validation failed somewhere possibly due to spoofing
      {:error, :origin_containment_failed} -> {:cancel, :origin_containment_failed}
      # Unclear if this can be reached
      {:error, {:side_effects, {:error, :no_object_actor}} = reason} -> {:cancel, reason}
+      :missing_incoming_ap_doc_params -> {:cancel, :missing_incoming_ap_doc_params}
      # Catchall
      {:error, _} = e -> e
      e -> {:error, e}
--- a/lib/pleroma/workers/signature_retry_worker.ex
+++ b/lib/pleroma/workers/signature_retry_worker.ex
@ -0,0 +1,254 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Workers.SignatureRetryWorker do
+  alias Pleroma.Instances
+  alias Pleroma.Signature
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Utils
+  alias Pleroma.Web.Federator
+  alias Pleroma.Web.Plugs.MappedSignatureToIdentityPlug
+
+  require Logger
+
+  use Oban.Worker, queue: :federator_incoming, max_attempts: 5, unique: [period: :infinity]
+
+  @impl true
+  def perform(%Job{
+        args: %{
+          "op" => "incoming_failed_signature_ap_doc",
+          "method" => method,
+          "params" => params,
+          "req_headers" => req_headers,
+          "request_path" => request_path,
+          "query_string" => query_string
+        }
+      })
+      when is_binary(method) and is_map(params) and is_list(req_headers) and
+             is_binary(request_path) and is_binary(query_string) do
+    case normalize_req_headers(req_headers) do
+      {:ok, req_headers} ->
+        conn_data = %Plug.Conn{
+          assigns: %{valid_signature: true},
+          method: method,
+          params: params,
+          req_headers: req_headers,
+          request_path: request_path,
+          query_string: query_string
+        }
+
+        signature_actor_result = signature_actor_id(conn_data)
+
+        with actor_id = Utils.get_ap_id(params["actor"]),
+             {:signature_actor, {:ok, signature_actor_id}} <-
+               {:signature_actor, signature_actor_result},
+             {:same_actor, true} <- {:same_actor, signature_actor_id == actor_id},
+             {:ok, %User{}} <- User.get_or_fetch_by_ap_id(actor_id),
+             {:ok, _public_key} <- Signature.refetch_public_key(conn_data),
+             {:signature, true} <- {:signature, validate_signature(conn_data)},
+             {:same_actor, true} <- {:same_actor, validate_same_actor(conn_data)},
+             {:ok, res} <- Federator.perform(:incoming_ap_doc, params) do
+          unless Instances.reachable?(params["actor"]) do
+            domain = URI.parse(params["actor"]).host
+            Oban.insert(Pleroma.Workers.ReachabilityWorker.new(%{"domain" => domain}))
+          end
+
+          {:ok, res}
+        else
+          e -> process_errors(e, retry_log_context(params, request_path, signature_actor_result))
+        end
+
+      e ->
+        process_errors(e, retry_log_context(params, request_path, nil))
+    end
+  end
+
+  def perform(%Job{args: %{"op" => "incoming_failed_signature_ap_doc"} = args}) do
+    process_errors(
+      :missing_signature_retry_metadata,
+      retry_log_context(Map.get(args, "params"), Map.get(args, "request_path"), nil)
+    )
+  end
+
+  def perform(%Job{args: args}) when is_map(args) do
+    process_errors(
+      :missing_signature_retry_metadata,
+      retry_log_context(Map.get(args, "params"), Map.get(args, "request_path"), nil)
+    )
+  end
+
+  def perform(%Job{}), do: process_errors(:missing_signature_retry_metadata)
+
+  @impl true
+  def timeout(%_{args: %{"timeout" => timeout}}), do: timeout
+
+  def timeout(_job), do: :timer.seconds(5)
+
+  defp normalize_req_headers(req_headers) do
+    req_headers
+    |> Enum.reduce_while({:ok, []}, fn
+      {key, value}, {:ok, acc} when is_binary(key) and is_binary(value) ->
+        {:cont, {:ok, [{key, value} | acc]}}
+
+      [key, value], {:ok, acc} when is_binary(key) and is_binary(value) ->
+        {:cont, {:ok, [{key, value} | acc]}}
+
+      _, _ ->
+        {:halt, {:error, :invalid_signature_retry_metadata}}
+    end)
+    |> case do
+      {:ok, headers} -> {:ok, Enum.reverse(headers)}
+      error -> error
+    end
+  end
+
+  defp validate_same_actor(conn_data) do
+    case MappedSignatureToIdentityPlug.call(conn_data, []) do
+      %Plug.Conn{assigns: %{valid_signature: true}} ->
+        true
+
+      _ ->
+        false
+    end
+  end
+
+  defp validate_signature(conn_data) do
+    Signature.validate_signature(conn_data)
+  rescue
+    _ -> false
+  catch
+    _, _ -> false
+  end
+
+  defp signature_actor_id(conn_data) do
+    Signature.get_actor_id(conn_data)
+  rescue
+    _ -> {:error, :invalid_signature}
+  catch
+    _, _ -> {:error, :invalid_signature}
+  end
+
+  defp process_errors(errors, context \\ %{})
+
+  defp process_errors({:error, {:error, _} = error}, context), do: process_errors(error, context)
+
+  defp process_errors(errors, context) do
+    result =
+      case errors do
+        # User fetch failures
+        {:error, :not_found} = reason ->
+          {:cancel, reason}
+
+        {:error, :forbidden} = reason ->
+          {:cancel, reason}
+
+        # Inactive user
+        {:error, {:user_active, false} = reason} ->
+          {:cancel, reason}
+
+        # Validator will error and return a changeset error
+        # e.g., duplicate activities or if the object was deleted
+        {:error, {:validate, {:error, _changeset} = reason}} ->
+          {:cancel, reason}
+
+        # Duplicate detection during Normalization
+        {:error, :already_present} ->
+          {:cancel, :already_present}
+
+        # MRFs will return a reject
+        {:error, {:reject, _} = reason} ->
+          {:cancel, reason}
+
+        # HTTP Sigs
+        {:signature_actor, {:error, _}} ->
+          {:cancel, :invalid_signature}
+
+        {:signature, false} ->
+          {:cancel, :invalid_signature}
+
+        {:same_actor, false} ->
+          {:cancel, :actor_signature_mismatch}
+
+        # Origin / URL validation failed somewhere possibly due to spoofing
+        {:error, :origin_containment_failed} ->
+          {:cancel, :origin_containment_failed}
+
+        # Unclear if this can be reached
+        {:error, {:side_effects, {:error, :no_object_actor}} = reason} ->
+          {:cancel, reason}
+
+        # Fail closed if the retry cannot reconstruct the original request.
+        :missing_signature_retry_metadata ->
+          {:cancel, :missing_signature_retry_metadata}
+
+        {:error, :invalid_signature_retry_metadata} ->
+          {:cancel, :invalid_signature_retry_metadata}
+
+        # Catchall
+        {:error, _} = e ->
+          e
+
+        e ->
+          {:error, e}
+      end
+
+    log_signature_retry_rejection(result, context)
+    result
+  end
+
+  defp retry_log_context(params, request_path, signature_actor_result) when is_map(params) do
+    signature_actor =
+      case signature_actor_result do
+        {:ok, actor} when is_binary(actor) -> actor
+        actor when is_binary(actor) -> actor
+        _ -> nil
+      end
+
+    %{
+      activity_id: params["id"],
+      payload_actor: Utils.get_ap_id(params["actor"]),
+      request_path: request_path,
+      signature_actor: signature_actor,
+      type: params["type"]
+    }
+  end
+
+  defp retry_log_context(_params, request_path, signature_actor_result) do
+    signature_actor =
+      case signature_actor_result do
+        {:ok, actor} when is_binary(actor) -> actor
+        actor when is_binary(actor) -> actor
+        _ -> nil
+      end
+
+    %{
+      activity_id: nil,
+      payload_actor: nil,
+      request_path: request_path,
+      signature_actor: signature_actor,
+      type: nil
+    }
+  end
+
+  defp log_signature_retry_rejection({:cancel, reason}, context)
+       when reason in [
+              :actor_signature_mismatch,
+              :invalid_signature,
+              :invalid_signature_retry_metadata,
+              :missing_signature_retry_metadata,
+              :origin_containment_failed
+            ] do
+    Logger.warning(
+      "Failed-signature inbox retry rejected " <>
+        "reason=#{inspect(reason)} " <>
+        "payload_actor=#{inspect(context[:payload_actor])} " <>
+        "signature_actor=#{inspect(context[:signature_actor])} " <>
+        "activity_id=#{inspect(context[:activity_id])} " <>
+        "type=#{inspect(context[:type])} " <>
+        "request_path=#{inspect(context[:request_path])}"
+    )
+  end
+
+  defp log_signature_retry_rejection(_result, _context), do: :ok
+end
--- a/mix.exs
+++ b/mix.exs
@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
  def project do
    [
      app: :pleroma,
-      version: version("2.10.0"),
+      version: version("2.10.2"),
      elixir: "~> 1.15",
      elixirc_paths: elixirc_paths(Mix.env()),
      compilers: Mix.compilers(),
@ -144,9 +144,7 @@ defmodule Pleroma.Mixfile do
      {:tzdata, "~> 1.0.5"},
      {:plug_cowboy, "~> 2.7"},
      {:oban, "~> 2.19.4"},
-      {:oban_plugins_lazarus,
-       git: "https://git.pleroma.social/pleroma/elixir-libraries/oban_plugins_lazarus.git",
-       ref: "e49fc355baaf0e435208bf5f534d31e26e897711"},
+      {:oban_plugins_lazarus, "~> 0.1.1"},
      {:oban_web, "~> 2.11"},
      {:gettext, "~> 0.24"},
      {:bcrypt_elixir, "~> 2.3"},
@ -167,6 +165,7 @@ defmodule Pleroma.Mixfile do
      {:sweet_xml, "~> 0.7.5"},
      {:earmark, "1.4.46"},
      {:bbcode_pleroma, "~> 0.2.0"},
+      {:pleroma_mfm_parser, "~> 0.2.1"},
      {:cors_plug, "~> 2.0"},
      {:web_push_encryption, "~> 0.3.1"},
      {:swoosh, "~> 1.16.12"},
@ -179,7 +178,7 @@ defmodule Pleroma.Mixfile do
      {:timex, "~> 3.7"},
      {:ueberauth, "~> 0.10"},
      {:linkify, "~> 0.5.3"},
-      {:http_signatures, "~> 0.1.2"},
+      {:http_signatures, "~> 0.1.3"},
      {:telemetry, "~> 1.0.0", override: true},
      {:poolboy, "~> 1.5"},
      {:prom_ex, "~> 1.9"},
@ -197,14 +196,14 @@ defmodule Pleroma.Mixfile do
       git: "https://git.pleroma.social/pleroma/elixir-libraries/elixir-captcha.git",
       ref: "e7b7cc34cc16b383461b966484c297e4ec9aeef6"},
      {:restarter, path: "./restarter"},
-      {:majic, "~> 1.1"},
+      {:majic, "~> 1.2"},
      {:open_api_spex, "~> 3.22"},
      {:ecto_psql_extras, "~> 0.8"},
      {:vix, "~> 0.36"},
      {:elixir_make, "~> 0.7.8", override: true},
      {:blurhash, "~> 0.1.0", hex: :rinpatch_blurhash},
      {:exile, "~> 0.10.0"},
-      {:bandit, "~> 1.5.7"},
+      {:bandit, "~> 1.10"},
      {:websock_adapter, "~> 0.5.8"},
      {:oban_live_dashboard, "~> 0.1.1"},
      {:multipart, "~> 0.4.0", optional: true},
@ -218,7 +217,7 @@ defmodule Pleroma.Mixfile do
      {:credo, "~> 1.7", only: [:dev, :test], runtime: false},
      {:mock, "~> 0.3.9", only: :test},
      {:covertool, "~> 2.0", only: :test},
-      {:hackney, "~> 1.25.0", override: true},
+      {:hackney, "~> 1.20.1", override: true},
      {:mox, "~> 1.2", only: :test},
      {:websockex, "~> 0.4.3", only: :test},
      {:benchee, "~> 1.4", only: :benchmark},
--- a/mix.lock
+++ b/mix.lock
@ -1,7 +1,7 @@
 %{
  "accept": {:hex, :accept, "0.3.5", "b33b127abca7cc948bbe6caa4c263369abf1347cfa9d8e699c6d214660f10cd1", [:rebar3], [], "hexpm", "11b18c220bcc2eab63b5470c038ef10eb6783bcb1fcdb11aa4137defa5ac1bb8"},
  "argon2_elixir": {:hex, :argon2_elixir, "4.1.3", "4f28318286f89453364d7fbb53e03d4563fd7ed2438a60237eba5e426e97785f", [:make, :mix], [{:comeonin, "~> 5.3", [hex: :comeonin, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "7c295b8d8e0eaf6f43641698f962526cdf87c6feb7d14bd21e599271b510608c"},
-  "bandit": {:hex, :bandit, "1.5.7", "6856b1e1df4f2b0cb3df1377eab7891bec2da6a7fd69dc78594ad3e152363a50", [:mix], [{:hpax, "~> 1.0.0", [hex: :hpax, repo: "hexpm", optional: false]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}, {:thousand_island, "~> 1.0", [hex: :thousand_island, repo: "hexpm", optional: false]}, {:websock, "~> 0.5", [hex: :websock, repo: "hexpm", optional: false]}], "hexpm", "f2dd92ae87d2cbea2fa9aa1652db157b6cba6c405cb44d4f6dd87abba41371cd"},
+  "bandit": {:hex, :bandit, "1.10.4", "02b9734c67c5916a008e7eb7e2ba68aaea6f8177094a5f8d95f1fb99069aac17", [:mix], [{:hpax, "~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}, {:plug, "~> 1.18", [hex: :plug, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}, {:thousand_island, "~> 1.0", [hex: :thousand_island, repo: "hexpm", optional: false]}, {:websock, "~> 0.5", [hex: :websock, repo: "hexpm", optional: false]}], "hexpm", "a5faf501042ac1f31d736d9d4a813b3db4ef812e634583b6a457b0928798a51d"},
  "base62": {:hex, :base62, "1.2.2", "85c6627eb609317b70f555294045895ffaaeb1758666ab9ef9ca38865b11e629", [:mix], [{:custom_base, "~> 0.2.1", [hex: :custom_base, repo: "hexpm", optional: false]}], "hexpm", "d41336bda8eaa5be197f1e4592400513ee60518e5b9f4dcf38f4b4dae6f377bb"},
  "bbcode_pleroma": {:hex, :bbcode_pleroma, "0.2.0", "d36f5bca6e2f62261c45be30fa9b92725c0655ad45c99025cb1c3e28e25803ef", [:mix], [{:nimble_parsec, "~> 0.5", [hex: :nimble_parsec, repo: "hexpm", optional: false]}], "hexpm", "19851074419a5fedb4ef49e1f01b30df504bb5dbb6d6adfc135238063bebd1c3"},
  "bcrypt_elixir": {:hex, :bcrypt_elixir, "2.3.1", "5114d780459a04f2b4aeef52307de23de961b69e13a5cd98a911e39fda13f420", [:make, :mix], [{:comeonin, "~> 5.3", [hex: :comeonin, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "42182d5f46764def15bf9af83739e3bf4ad22661b1c34fc3e88558efced07279"},
@ -13,7 +13,7 @@
  "captcha": {:git, "https://git.pleroma.social/pleroma/elixir-libraries/elixir-captcha.git", "e7b7cc34cc16b383461b966484c297e4ec9aeef6", [ref: "e7b7cc34cc16b383461b966484c297e4ec9aeef6"]},
  "castore": {:hex, :castore, "1.0.15", "8aa930c890fe18b6fe0a0cff27b27d0d4d231867897bd23ea772dee561f032a3", [:mix], [], "hexpm", "96ce4c69d7d5d7a0761420ef743e2f4096253931a3ba69e5ff8ef1844fe446d3"},
  "cc_precompiler": {:hex, :cc_precompiler, "0.1.11", "8c844d0b9fb98a3edea067f94f616b3f6b29b959b6b3bf25fee94ffe34364768", [:mix], [{:elixir_make, "~> 0.7", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "3427232caf0835f94680e5bcf082408a70b48ad68a5f5c0b02a3bea9f3a075b9"},
-  "certifi": {:hex, :certifi, "2.15.0", "0e6e882fcdaaa0a5a9f2b3db55b1394dba07e8d6d9bcad08318fb604c6839712", [:rebar3], [], "hexpm", "b147ed22ce71d72eafdad94f055165c1c182f61a2ff49df28bcc71d1d5b94a60"},
+  "certifi": {:hex, :certifi, "2.12.0", "2d1cca2ec95f59643862af91f001478c9863c2ac9cb6e2f89780bfd8de987329", [:rebar3], [], "hexpm", "ee68d85df22e554040cdb4be100f33873ac6051387baf6a8f6ce82272340ff1c"},
  "combine": {:hex, :combine, "0.10.0", "eff8224eeb56498a2af13011d142c5e7997a80c8f5b97c499f84c841032e429f", [:mix], [], "hexpm", "1b1dbc1790073076580d0d1d64e42eae2366583e7aecd455d1215b0d16f2451b"},
  "comeonin": {:hex, :comeonin, "5.5.1", "5113e5f3800799787de08a6e0db307133850e635d34e9fab23c70b6501669510", [:mix], [], "hexpm", "65aac8f19938145377cee73973f192c5645873dcf550a8a6b18187d17c13ccdb"},
  "concurrent_limiter": {:hex, :concurrent_limiter, "0.1.1", "43ae1dc23edda1ab03dd66febc739c4ff710d047bb4d735754909f9a474ae01c", [:mix], [{:telemetry, "~> 0.3", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "53968ff238c0fbb4d7ed76ddb1af0be6f3b2f77909f6796e249e737c505a16eb"},
@ -59,10 +59,10 @@
  "gen_smtp": {:hex, :gen_smtp, "0.15.0", "9f51960c17769b26833b50df0b96123605a8024738b62db747fece14eb2fbfcc", [:rebar3], [], "hexpm", "29bd14a88030980849c7ed2447b8db6d6c9278a28b11a44cafe41b791205440f"},
  "gettext": {:hex, :gettext, "0.24.0", "6f4d90ac5f3111673cbefc4ebee96fe5f37a114861ab8c7b7d5b30a1108ce6d8", [:mix], [{:expo, "~> 0.5.1", [hex: :expo, repo: "hexpm", optional: false]}], "hexpm", "bdf75cdfcbe9e4622dd18e034b227d77dd17f0f133853a1c73b97b3d6c770e8b"},
  "gun": {:hex, :gun, "2.2.0", "b8f6b7d417e277d4c2b0dc3c07dfdf892447b087f1cc1caff9c0f556b884e33d", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "76022700c64287feb4df93a1795cff6741b83fb37415c40c34c38d2a4645261a"},
-  "hackney": {:hex, :hackney, "1.25.0", "390e9b83f31e5b325b9f43b76e1a785cbdb69b5b6cd4e079aa67835ded046867", [:rebar3], [{:certifi, "~> 2.15.0", [hex: :certifi, repo: "hexpm", optional: false]}, {:idna, "~> 6.1.0", [hex: :idna, repo: "hexpm", optional: false]}, {:metrics, "~> 1.0.0", [hex: :metrics, repo: "hexpm", optional: false]}, {:mimerl, "~> 1.4", [hex: :mimerl, repo: "hexpm", optional: false]}, {:parse_trans, "3.4.1", [hex: :parse_trans, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "~> 1.1.0", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}, {:unicode_util_compat, "~> 0.7.1", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm", "7209bfd75fd1f42467211ff8f59ea74d6f2a9e81cbcee95a56711ee79fd6b1d4"},
+  "hackney": {:hex, :hackney, "1.20.1", "8d97aec62ddddd757d128bfd1df6c5861093419f8f7a4223823537bad5d064e2", [:rebar3], [{:certifi, "~> 2.12.0", [hex: :certifi, repo: "hexpm", optional: false]}, {:idna, "~> 6.1.0", [hex: :idna, repo: "hexpm", optional: false]}, {:metrics, "~> 1.0.0", [hex: :metrics, repo: "hexpm", optional: false]}, {:mimerl, "~> 1.1", [hex: :mimerl, repo: "hexpm", optional: false]}, {:parse_trans, "3.4.1", [hex: :parse_trans, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "~> 1.1.0", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}, {:unicode_util_compat, "~> 0.7.0", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm", "fe9094e5f1a2a2c0a7d10918fee36bfec0ec2a979994cff8cfe8058cd9af38e3"},
  "hpax": {:hex, :hpax, "1.0.3", "ed67ef51ad4df91e75cc6a1494f851850c0bd98ebc0be6e81b026e765ee535aa", [:mix], [], "hexpm", "8eab6e1cfa8d5918c2ce4ba43588e894af35dbd8e91e6e55c817bca5847df34a"},
  "html_entities": {:hex, :html_entities, "0.5.2", "9e47e70598da7de2a9ff6af8758399251db6dbb7eebe2b013f2bbd2515895c3c", [:mix], [], "hexpm", "c53ba390403485615623b9531e97696f076ed415e8d8058b1dbaa28181f4fdcc"},
-  "http_signatures": {:hex, :http_signatures, "0.1.2", "ed1cc7043abcf5bb4f30d68fb7bad9d618ec1a45c4ff6c023664e78b67d9c406", [:mix], [], "hexpm", "f08aa9ac121829dae109d608d83c84b940ef2f183ae50f2dd1e9a8bc619d8be7"},
+  "http_signatures": {:hex, :http_signatures, "0.1.3", "19f26aee35b4684e37efdce3ac4638605e6e41a04368186bd39d2b6138a60ea9", [:mix], [{:plug, "~> 1.18", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "20313a65516db88006f85b090f6f76cc5b04e9609b45943657e6781eb91174f4"},
  "httpoison": {:hex, :httpoison, "1.8.2", "9eb9c63ae289296a544842ef816a85d881d4a31f518a0fec089aaa744beae290", [:mix], [{:hackney, "~> 1.17", [hex: :hackney, repo: "hexpm", optional: false]}], "hexpm", "2bb350d26972e30c96e2ca74a1aaf8293d61d0742ff17f01e0279fef11599921"},
  "idna": {:hex, :idna, "6.1.1", "8a63070e9f7d0c62eb9d9fcb360a7de382448200fbbd1b106cc96d3d8099df8d", [:rebar3], [{:unicode_util_compat, "~> 0.7.0", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm", "92376eb7894412ed19ac475e4a86f7b413c1b9fbb5bd16dccd57934157944cea"},
  "inet_cidr": {:hex, :inet_cidr, "1.0.8", "d26bb7bdbdf21ae401ead2092bf2bb4bf57fe44a62f5eaa5025280720ace8a40", [:mix], [], "hexpm", "d5b26da66603bb56c933c65214c72152f0de9a6ea53618b56d63302a68f6a90e"},
@ -73,14 +73,14 @@
  "linkify": {:hex, :linkify, "0.5.3", "5f8143d8f61f5ff08d3aeeff47ef6509492b4948d8f08007fbf66e4d2246a7f2", [:mix], [], "hexpm", "3ef35a1377d47c25506e07c1c005ea9d38d700699d92ee92825f024434258177"},
  "logger_backends": {:hex, :logger_backends, "1.0.0", "09c4fad6202e08cb0fbd37f328282f16539aca380f512523ce9472b28edc6bdf", [:mix], [], "hexpm", "1faceb3e7ec3ef66a8f5746c5afd020e63996df6fd4eb8cdb789e5665ae6c9ce"},
  "mail": {:hex, :mail, "0.3.1", "cb0a14e4ed8904e4e5a08214e686ccf6f9099346885db17d8c309381f865cc5c", [:mix], [], "hexpm", "1db701e89865c1d5fa296b2b57b1cd587587cca8d8a1a22892b35ef5a8e352a6"},
-  "majic": {:hex, :majic, "1.1.1", "16092a3a3376cc5e13d207e82ec06e05a5561170465e50cc11cc4df8a5747938", [:make, :mix], [{:elixir_make, "~> 0.8.4", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:nimble_pool, "~> 1.0", [hex: :nimble_pool, repo: "hexpm", optional: false]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm", "7fbb0372f0447b3f777056177d6ab3f009742e68474f850521ff56b84bd85b96"},
+  "majic": {:hex, :majic, "1.2.0", "414b69c1460ece692fa892a0ed6669b8db6a44c42bb3071cb723854f22e7bd78", [:make, :mix], [{:elixir_make, "~> 0.8.4", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:nimble_pool, "~> 1.0", [hex: :nimble_pool, repo: "hexpm", optional: false]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm", "0bd0c65f8e4dcc595757d957577f6151b59246da9614ba87debfdc641ccc0514"},
  "makeup": {:hex, :makeup, "1.0.5", "d5a830bc42c9800ce07dd97fa94669dfb93d3bf5fcf6ea7a0c67b2e0e4a7f26c", [:mix], [{:nimble_parsec, "~> 0.5 or ~> 1.0", [hex: :nimble_parsec, repo: "hexpm", optional: false]}], "hexpm", "cfa158c02d3f5c0c665d0af11512fed3fba0144cf1aadee0f2ce17747fba2ca9"},
  "makeup_elixir": {:hex, :makeup_elixir, "0.14.1", "4f0e96847c63c17841d42c08107405a005a2680eb9c7ccadfd757bd31dabccfb", [:mix], [{:makeup, "~> 1.0", [hex: :makeup, repo: "hexpm", optional: false]}], "hexpm", "f2438b1a80eaec9ede832b5c41cd4f373b38fd7aa33e3b22d9db79e640cbde11"},
  "makeup_erlang": {:hex, :makeup_erlang, "1.0.2", "03e1804074b3aa64d5fad7aa64601ed0fb395337b982d9bcf04029d68d51b6a7", [:mix], [{:makeup, "~> 1.0", [hex: :makeup, repo: "hexpm", optional: false]}], "hexpm", "af33ff7ef368d5893e4a267933e7744e46ce3cf1f61e2dccf53a111ed3aa3727"},
  "meck": {:hex, :meck, "0.9.2", "85ccbab053f1db86c7ca240e9fc718170ee5bda03810a6292b5306bf31bae5f5", [:rebar3], [], "hexpm", "81344f561357dc40a8344afa53767c32669153355b626ea9fcbc8da6b3045826"},
  "metrics": {:hex, :metrics, "1.0.1", "25f094dea2cda98213cecc3aeff09e940299d950904393b2a29d191c346a8486", [:rebar3], [], "hexpm", "69b09adddc4f74a40716ae54d140f93beb0fb8978d8636eaded0c31b6f099f16"},
  "mime": {:hex, :mime, "1.6.0", "dabde576a497cef4bbdd60aceee8160e02a6c89250d6c0b29e56c0dfb00db3d2", [:mix], [], "hexpm", "31a1a8613f8321143dde1dafc36006a17d28d02bdfecb9e95a880fa7aabd19a7"},
-  "mimerl": {:hex, :mimerl, "1.4.0", "3882a5ca67fbbe7117ba8947f27643557adec38fa2307490c4c4207624cb213b", [:rebar3], [], "hexpm", "13af15f9f68c65884ecca3a3891d50a7b57d82152792f3e19d88650aa126b144"},
+  "mimerl": {:hex, :mimerl, "1.5.0", "f35aca6f23242339b3666e0ac0702379e362b469d0aea167f6cc713547e777ed", [:rebar3], [], "hexpm", "db648ce065bae14ea84ca8b5dd123f42f49417cef693541110bf6f9e9be9ecc4"},
  "mint": {:hex, :mint, "1.7.1", "113fdb2b2f3b59e47c7955971854641c61f378549d73e829e1768de90fc1abf1", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "fceba0a4d0f24301ddee3024ae116df1c3f4bb7a563a731f45fdfeb9d39a231b"},
  "mochiweb": {:hex, :mochiweb, "2.18.0", "eb55f1db3e6e960fac4e6db4e2db9ec3602cc9f30b86cd1481d56545c3145d2e", [:rebar3], [], "hexpm"},
  "mock": {:hex, :mock, "0.3.9", "10e44ad1f5962480c5c9b9fa779c6c63de9bd31997c8e04a853ec990a9d841af", [:mix], [{:meck, "~> 0.9.2", [hex: :meck, repo: "hexpm", optional: false]}], "hexpm", "9e1b244c4ca2551bb17bb8415eed89e40ee1308e0fbaed0a4fdfe3ec8a4adbd3"},
@ -96,7 +96,7 @@
  "oban": {:hex, :oban, "2.19.4", "045adb10db1161dceb75c254782f97cdc6596e7044af456a59decb6d06da73c1", [:mix], [{:ecto_sql, "~> 3.10", [hex: :ecto_sql, repo: "hexpm", optional: false]}, {:ecto_sqlite3, "~> 0.9", [hex: :ecto_sqlite3, repo: "hexpm", optional: true]}, {:igniter, "~> 0.5", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.1", [hex: :jason, repo: "hexpm", optional: true]}, {:myxql, "~> 0.7", [hex: :myxql, repo: "hexpm", optional: true]}, {:postgrex, "~> 0.16", [hex: :postgrex, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "5fcc6219e6464525b808d97add17896e724131f498444a292071bf8991c99f97"},
  "oban_live_dashboard": {:hex, :oban_live_dashboard, "0.1.1", "8aa4ceaf381c818f7d5c8185cc59942b8ac82ef0cf559881aacf8d3f8ac7bdd3", [:mix], [{:oban, "~> 2.15", [hex: :oban, repo: "hexpm", optional: false]}, {:phoenix_live_dashboard, "~> 0.7", [hex: :phoenix_live_dashboard, repo: "hexpm", optional: false]}], "hexpm", "16dc4ce9c9a95aa2e655e35ed4e675652994a8def61731a18af85e230e1caa63"},
  "oban_met": {:hex, :oban_met, "1.0.5", "bb633ab06448dab2ef9194f6688d33b3d07fc3f2ad793a1a08f4dfbb2cc9fe50", [:mix], [{:oban, "~> 2.19", [hex: :oban, repo: "hexpm", optional: false]}], "hexpm", "64664d50805bbfd3903aeada1f3c39634652a87844797ee400b0bcc95a28f5ea"},
-  "oban_plugins_lazarus": {:git, "https://git.pleroma.social/pleroma/elixir-libraries/oban_plugins_lazarus.git", "e49fc355baaf0e435208bf5f534d31e26e897711", [ref: "e49fc355baaf0e435208bf5f534d31e26e897711"]},
+  "oban_plugins_lazarus": {:hex, :oban_plugins_lazarus, "0.1.1", "a5141d569e5b9f3bec8f4a958231d2c538af097d3c1ad06274f096fc06956821", [:mix], [{:oban, "< 3.0.0", [hex: :oban, repo: "hexpm", optional: false]}], "hexpm", "7e9c51bc44d33f71c0a52cf0cd5c8d4c70380ede065c1042013f5123f2fc9729"},
  "oban_web": {:hex, :oban_web, "2.11.6", "53933cb4253c4d9f1098ee311c06f07935259f0e564dcf2d66bae4cc98e317fe", [:mix], [{:jason, "~> 1.2", [hex: :jason, repo: "hexpm", optional: false]}, {:oban, "~> 2.19", [hex: :oban, repo: "hexpm", optional: false]}, {:oban_met, "~> 1.0", [hex: :oban_met, repo: "hexpm", optional: false]}, {:phoenix, "~> 1.7", [hex: :phoenix, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 3.3 or ~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 1.0", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}, {:phoenix_pubsub, "~> 2.1", [hex: :phoenix_pubsub, repo: "hexpm", optional: false]}], "hexpm", "576d94b705688c313694c2c114ca21aa0f8f2ad1b9ca45c052c5ba316d3e8d10"},
  "octo_fetch": {:hex, :octo_fetch, "0.4.0", "074b5ecbc08be10b05b27e9db08bc20a3060142769436242702931c418695b19", [:mix], [{:castore, "~> 0.1 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "~> 1.1", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}], "hexpm", "cf8be6f40cd519d7000bb4e84adcf661c32e59369ca2827c4e20042eda7a7fc6"},
  "open_api_spex": {:hex, :open_api_spex, "3.22.0", "fbf90dc82681dc042a4ee79853c8e989efbba73d9e87439085daf849bbf8bc20", [:mix], [{:decimal, "~> 1.0 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:plug, "~> 1.7", [hex: :plug, repo: "hexpm", optional: false]}, {:poison, "~> 3.0 or ~> 4.0 or ~> 5.0 or ~> 6.0", [hex: :poison, repo: "hexpm", optional: true]}, {:ymlr, "~> 2.0 or ~> 3.0 or ~> 4.0 or ~> 5.0", [hex: :ymlr, repo: "hexpm", optional: true]}], "hexpm", "dd751ddbdd709bb4a5313e9a24530da6e66594773c7242a0c2592cbd9f589063"},
@ -112,6 +112,7 @@
  "phoenix_swoosh": {:hex, :phoenix_swoosh, "1.2.1", "b74ccaa8046fbc388a62134360ee7d9742d5a8ae74063f34eb050279de7a99e1", [:mix], [{:finch, "~> 0.8", [hex: :finch, repo: "hexpm", optional: true]}, {:hackney, "~> 1.10", [hex: :hackney, repo: "hexpm", optional: true]}, {:phoenix, "~> 1.6", [hex: :phoenix, repo: "hexpm", optional: true]}, {:phoenix_html, "~> 3.0 or ~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: true]}, {:phoenix_view, "~> 1.0 or ~> 2.0", [hex: :phoenix_view, repo: "hexpm", optional: false]}, {:swoosh, "~> 1.5", [hex: :swoosh, repo: "hexpm", optional: false]}], "hexpm", "4000eeba3f9d7d1a6bf56d2bd56733d5cadf41a7f0d8ffe5bb67e7d667e204a2"},
  "phoenix_template": {:hex, :phoenix_template, "1.0.4", "e2092c132f3b5e5b2d49c96695342eb36d0ed514c5b252a77048d5969330d639", [:mix], [{:phoenix_html, "~> 2.14.2 or ~> 3.0 or ~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: true]}], "hexpm", "2c0c81f0e5c6753faf5cca2f229c9709919aba34fab866d3bc05060c9c444206"},
  "phoenix_view": {:hex, :phoenix_view, "2.0.4", "b45c9d9cf15b3a1af5fb555c674b525391b6a1fe975f040fb4d913397b31abf4", [:mix], [{:phoenix_html, "~> 2.14.2 or ~> 3.0 or ~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: true]}, {:phoenix_template, "~> 1.0", [hex: :phoenix_template, repo: "hexpm", optional: false]}], "hexpm", "4e992022ce14f31fe57335db27a28154afcc94e9983266835bb3040243eb620b"},
+  "pleroma_mfm_parser": {:hex, :pleroma_mfm_parser, "0.2.1", "87a40fec4e2e035447df34e1c98e1b816b6a448d49baea73eb2273531ac5ce66", [:mix], [], "hexpm", "ec4845461da95d63ab3d592086d65114c45057a1f2d48d768f3def45b0d7696f"},
  "plug": {:hex, :plug, "1.19.1", "09bac17ae7a001a68ae393658aa23c7e38782be5c5c00c80be82901262c394c0", [:mix], [{:mime, "~> 1.0 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:plug_crypto, "~> 1.1.1 or ~> 1.2 or ~> 2.0", [hex: :plug_crypto, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4.3 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "560a0017a8f6d5d30146916862aaf9300b7280063651dd7e532b8be168511e62"},
  "plug_cowboy": {:hex, :plug_cowboy, "2.7.4", "729c752d17cf364e2b8da5bdb34fb5804f56251e88bb602aff48ae0bd8673d11", [:mix], [{:cowboy, "~> 2.7", [hex: :cowboy, repo: "hexpm", optional: false]}, {:cowboy_telemetry, "~> 0.3", [hex: :cowboy_telemetry, repo: "hexpm", optional: false]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "9b85632bd7012615bae0a5d70084deb1b25d2bcbb32cab82d1e9a1e023168aa3"},
  "plug_crypto": {:hex, :plug_crypto, "2.1.1", "19bda8184399cb24afa10be734f84a16ea0a2bc65054e23a62bb10f06bc89491", [:mix], [], "hexpm", "6470bce6ffe41c8bd497612ffde1a7e4af67f36a15eea5f921af71cf3e11247c"},
@ -128,6 +129,7 @@
  "prometheus_phx": {:git, "https://git.pleroma.social/pleroma/elixir-libraries/prometheus-phx.git", "9cd8f248c9381ffedc799905050abce194a97514", [branch: "no-logging"]},
  "prometheus_plugs": {:hex, :prometheus_plugs, "1.1.5", "25933d48f8af3a5941dd7b621c889749894d8a1082a6ff7c67cc99dec26377c5", [:mix], [{:accept, "~> 0.1", [hex: :accept, repo: "hexpm", optional: false]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: false]}, {:prometheus_ex, "~> 1.1 or ~> 2.0 or ~> 3.0", [hex: :prometheus_ex, repo: "hexpm", optional: false]}, {:prometheus_process_collector, "~> 1.1", [hex: :prometheus_process_collector, repo: "hexpm", optional: true]}], "hexpm", "0273a6483ccb936d79ca19b0ab629aef0dba958697c94782bb728b920dfc6a79"},
  "quantile_estimator": {:hex, :quantile_estimator, "0.2.1", "ef50a361f11b5f26b5f16d0696e46a9e4661756492c981f7b2229ef42ff1cd15", [:rebar3], [], "hexpm", "282a8a323ca2a845c9e6f787d166348f776c1d4a41ede63046d72d422e3da946"},
+  "quic": {:hex, :quic, "0.10.2", "4b390507a85f65ce47808f3df1a864e0baf9adb7a1b4ea9f4dcd66fe9d0cb166", [:rebar3], [], "hexpm", "7c196a66973c877a59768a5687f0a0610ff11817254d0a4e45cc4e3a16b1d00b"},
  "ranch": {:hex, :ranch, "2.2.0", "25528f82bc8d7c6152c57666ca99ec716510fe0925cb188172f41ce93117b1b0", [:make, :rebar3], [], "hexpm", "fa0b99a1780c80218a4197a59ea8d3bdae32fbff7e88527d7d8a4787eff4f8e7"},
  "recon": {:hex, :recon, "2.5.6", "9052588e83bfedfd9b72e1034532aee2a5369d9d9343b61aeb7fbce761010741", [:mix, :rebar3], [], "hexpm", "96c6799792d735cc0f0fd0f86267e9d351e63339cbe03df9d162010cefc26bb0"},
  "remote_ip": {:git, "https://git.pleroma.social/pleroma/remote_ip.git", "b647d0deecaa3acb140854fe4bda5b7e1dc6d1c8", [ref: "b647d0deecaa3acb140854fe4bda5b7e1dc6d1c8"]},
@ -144,7 +146,7 @@
  "telemetry_metrics_prometheus_core": {:hex, :telemetry_metrics_prometheus_core, "1.2.1", "c9755987d7b959b557084e6990990cb96a50d6482c683fb9622a63837f3cd3d8", [:mix], [{:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}, {:telemetry_metrics, "~> 0.6 or ~> 1.0", [hex: :telemetry_metrics, repo: "hexpm", optional: false]}], "hexpm", "5e2c599da4983c4f88a33e9571f1458bf98b0cf6ba930f1dc3a6e8cf45d5afb6"},
  "telemetry_poller": {:hex, :telemetry_poller, "1.3.0", "d5c46420126b5ac2d72bc6580fb4f537d35e851cc0f8dbd571acf6d6e10f5ec7", [:rebar3], [{:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "51f18bed7128544a50f75897db9974436ea9bfba560420b646af27a9a9b35211"},
  "tesla": {:hex, :tesla, "1.15.3", "3a2b5c37f09629b8dcf5d028fbafc9143c0099753559d7fe567eaabfbd9b8663", [:mix], [{:castore, "~> 0.1 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:exjsx, ">= 3.0.0", [hex: :exjsx, repo: "hexpm", optional: true]}, {:finch, "~> 0.13", [hex: :finch, repo: "hexpm", optional: true]}, {:fuse, "~> 2.4", [hex: :fuse, repo: "hexpm", optional: true]}, {:gun, ">= 1.0.0", [hex: :gun, repo: "hexpm", optional: true]}, {:hackney, "~> 1.21", [hex: :hackney, repo: "hexpm", optional: true]}, {:ibrowse, "4.4.2", [hex: :ibrowse, repo: "hexpm", optional: true]}, {:jason, ">= 1.0.0", [hex: :jason, repo: "hexpm", optional: true]}, {:mime, "~> 1.0 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:mint, "~> 1.0", [hex: :mint, repo: "hexpm", optional: true]}, {:mox, "~> 1.0", [hex: :mox, repo: "hexpm", optional: true]}, {:msgpax, "~> 2.3", [hex: :msgpax, repo: "hexpm", optional: true]}, {:poison, ">= 1.0.0", [hex: :poison, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: true]}], "hexpm", "98bb3d4558abc67b92fb7be4cd31bb57ca8d80792de26870d362974b58caeda7"},
-  "thousand_island": {:hex, :thousand_island, "1.3.14", "ad45ebed2577b5437582bcc79c5eccd1e2a8c326abf6a3464ab6c06e2055a34a", [:mix], [{:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "d0d24a929d31cdd1d7903a4fe7f2409afeedff092d277be604966cd6aa4307ef"},
+  "thousand_island": {:hex, :thousand_island, "1.4.3", "2158209580f633be38d43ec4e3ce0a01079592b9657afff9080d5d8ca149a3af", [:mix], [{:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "6e4ce09b0fd761a58594d02814d40f77daff460c48a7354a15ab353bb998ea0b"},
  "timex": {:hex, :timex, "3.7.7", "3ed093cae596a410759104d878ad7b38e78b7c2151c6190340835515d4a46b8a", [:mix], [{:combine, "~> 0.10", [hex: :combine, repo: "hexpm", optional: false]}, {:gettext, "~> 0.10", [hex: :gettext, repo: "hexpm", optional: false]}, {:tzdata, "~> 1.0", [hex: :tzdata, repo: "hexpm", optional: false]}], "hexpm", "0ec4b09f25fe311321f9fc04144a7e3affe48eb29481d7a5583849b6c4dfa0a7"},
  "toml": {:hex, :toml, "0.7.0", "fbcd773caa937d0c7a02c301a1feea25612720ac3fa1ccb8bfd9d30d822911de", [:mix], [], "hexpm", "0690246a2478c1defd100b0c9b89b4ea280a22be9a7b313a8a058a2408a2fa70"},
  "trailing_format_plug": {:hex, :trailing_format_plug, "0.0.7", "64b877f912cf7273bed03379936df39894149e35137ac9509117e59866e10e45", [:mix], [{:plug, "> 0.12.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "bd4fde4c15f3e993a999e019d64347489b91b7a9096af68b2bdadd192afa693f"},
--- a/Show more
+++ b/Show more
				`@ -1 +0,0 @@`
				`Move avatar_description and header_description fields to the account object`
				`@ -1 +0,0 @@`
				`Various bookmark folders-related improvements`
				`@ -1 +0,0 @@`
				`Add reasonable defaults for :database_config_whitelist`
				`@ -1 +0,0 @@`
				`No-op code correctness improvements detected by Elixir 1.19 compiler`
				`@ -1 +0,0 @@`
				`Encode custom emoji URLs in EmojiReact activity tags.`
				`@ -1 +0,0 @@`
				`Gopher: Fix Ranch listener not being stopped properly on Pleroma restart when database configuration is enabled`
				`@ -1 +0,0 @@`
				`Use a custom redirect handler to ensure MediaProxy redirects are followed with Hackney`
				`@ -1 +0,0 @@`
				`Update Hackney, the default HTTP client, to the latest release which supports Happy Eyeballs for improved IPv6 federation`
				`@ -0,0 +1 @@`
				`Fix compatibility with timestamped HTTP Signatures used by GoToSocial`
				`@ -1 +0,0 @@`
				`Fix fetching Hubzilla Actors with alsoKnownAs as string`