Merge remote-tracking branch 'origin/develop' into pr-7444-finish

2026-07-26 13:20:50 +04:00 · 2026-07-26 13:20:50 +04:00 · 7a741736ea
commit 7a741736ea
parent 656dce96dc d115b41848
1544 changed files with 43219 additions and 9351 deletions
--- a/changelog.d/3900.change
+++ b/changelog.d/3900.change
@ -1 +0,0 @@
-Update to Phoenix 1.7
--- a/changelog.d/3904.security
+++ b/changelog.d/3904.security
@ -1 +0,0 @@
-HTTP Security: By default, don't allow unsafe-eval. The setting needs to be changed to allow Flash emulation.
--- a/changelog.d/3987.fix
+++ b/changelog.d/3987.fix
@ -1 +0,0 @@
-Remove checking ImageMagick's commands for Pleroma.Upload.Filter.AnalyzeMetadata
--- a/changelog.d/account-favourites-order.fix
+++ b/changelog.d/account-favourites-order.fix
@ -0,0 +1 @@
+Fixed `/api/v1/pleroma/accounts/:id/favourites` ordering and pagination to use the favourite date.
--- a/changelog.d/account-rendering-auth-check.fix
+++ b/changelog.d/account-rendering-auth-check.fix
@ -1 +0,0 @@
-Fix authentication check on account rendering when bio is defined
--- a/changelog.d/activitypub-bot-rfc9421-fallback.fix
+++ b/changelog.d/activitypub-bot-rfc9421-fallback.fix
@ -0,0 +1 @@
+Reject unsupported or ambiguous inbox signatures instead of queueing a doomed failed-signature retry, allowing clients to fall back to legacy HTTP Signatures.
--- a/changelog.d/add-ipfs-upload.add
+++ b/changelog.d/add-ipfs-upload.add
@ -1 +0,0 @@
-Uploader: Add support for uploading attachments using IPFS
--- a/changelog.d/add-nsfw-mrf.add
+++ b/changelog.d/add-nsfw-mrf.add
@ -1 +0,0 @@
-Add NSFW-detecting MRF
--- a/changelog.d/add-outbox.fix
+++ b/changelog.d/add-outbox.fix
@ -1 +0,0 @@
-ap userview: add outbox field.
--- a/changelog.d/add-rbl-mrf.add
+++ b/changelog.d/add-rbl-mrf.add
@ -1 +0,0 @@
-Add DNSRBL MRF
--- a/changelog.d/akkoma-prune-options.add
+++ b/changelog.d/akkoma-prune-options.add
@ -1 +0,0 @@
-Add options to the mix prune_objects task
--- a/changelog.d/anonymous-exception-else.fix
+++ b/changelog.d/anonymous-exception-else.fix
@ -1 +0,0 @@
-Fix #strip_report_status_data
--- a/changelog.d/anti-mentionspam-mrf.add
+++ b/changelog.d/anti-mentionspam-mrf.add
@ -1 +0,0 @@
-Add Anti-mention Spam MRF backported from Rebased
--- a/changelog.d/auth-fetch-exception.add
+++ b/changelog.d/auth-fetch-exception.add
@ -1 +0,0 @@
-HTTPSignaturePlug: Add :authorized_fetch_mode_exceptions configuration
--- a/changelog.d/authorize-interaction.add
+++ b/changelog.d/authorize-interaction.add
@ -1 +0,0 @@
-Support /authorize-interaction route used by Mastodon
--- a/changelog.d/authorized-fetch-rejections.add
+++ b/changelog.d/authorized-fetch-rejections.add
@ -1 +0,0 @@
-Add an option to reject certain domains when authorized fetch is enabled.
--- a/changelog.d/backups-follows.add
+++ b/changelog.d/backups-follows.add
@ -1 +0,0 @@
-Include following/followers in backups
--- a/changelog.d/bad_inbox_request.change
+++ b/changelog.d/bad_inbox_request.change
@ -1 +0,0 @@
-Invalid activities delivered to the inbox will be rejected with a 400 Bad Request
--- a/changelog.d/bandit.change
+++ b/changelog.d/bandit.change
@ -1 +0,0 @@
-Support Bandit as an alternative to Cowboy for the HTTP server. 
--- a/changelog.d/bare_uri_test.skip
+++ b/changelog.d/bare_uri_test.skip
--- a/changelog.d/benchee.skip
+++ b/changelog.d/benchee.skip
--- a/changelog.d/blurhash.change
+++ b/changelog.d/blurhash.change
@ -1 +0,0 @@
-Replace eblurhash with rinpatch_blurhash. This also removes a dependency on ImageMagick.
--- a/changelog.d/bookmark-folders.add
+++ b/changelog.d/bookmark-folders.add
@ -1 +0,0 @@
-Allow to group bookmarks in folders
--- a/changelog.d/bookmark-folders.skip
+++ b/changelog.d/bookmark-folders.skip
--- a/changelog.d/bugfix-ccworks.fix
+++ b/changelog.d/bugfix-ccworks.fix
@ -1 +0,0 @@
-Fix federation with Convergence AP Bridge
--- a/changelog.d/build-release-with-local-libvips.skip
+++ b/changelog.d/build-release-with-local-libvips.skip
--- a/changelog.d/bump-elixir.change
+++ b/changelog.d/bump-elixir.change
@ -1 +0,0 @@
-Elixir 1.13 is the minimum required version.
--- a/changelog.d/captcha-package.fix
+++ b/changelog.d/captcha-package.fix
@ -0,0 +1 @@
+Switch native captcha to the published pleroma_captcha Hex package.
--- a/changelog.d/card-endpoint.remove
+++ b/changelog.d/card-endpoint.remove
@ -1 +0,0 @@
-Mastodon API: Remove deprecated GET /api/v1/statuses/:id/card endpoint https://github.com/mastodon/mastodon/pull/11213
--- a/changelog.d/card-image-description.add
+++ b/changelog.d/card-image-description.add
@ -1 +0,0 @@
-Include image description in status media cards
--- a/changelog.d/chat-attachment-empty-array.fix
+++ b/changelog.d/chat-attachment-empty-array.fix
@ -1 +0,0 @@
-ChatMessage: Tolerate attachment field set to an empty array
--- a/changelog.d/config-stat-symlink.fix
+++ b/changelog.d/config-stat-symlink.fix
@ -1 +0,0 @@
- Config: Check the permissions of the linked file instead of the symlink
--- a/changelog.d/content-length.fix
+++ b/changelog.d/content-length.fix
@ -1 +0,0 @@
-MediaProxy was setting the content-length header which is not permitted by RFC9112§6.2 when we are chunking the reply as it conflicts with the existence of the transfer-encoding header.
--- a/changelog.d/context-cleanup.skip
+++ b/changelog.d/context-cleanup.skip
@ -0,0 +1 @@
+litepub-0.1.jsonld cleanup
--- a/changelog.d/deprecations.skip
+++ b/changelog.d/deprecations.skip
@ -1 +0,0 @@
-
--- a/changelog.d/deprecations2.skip
+++ b/changelog.d/deprecations2.skip
--- a/changelog.d/deps-bump-2024-01-25.skip
+++ b/changelog.d/deps-bump-2024-01-25.skip
--- a/changelog.d/description-meilisearch-type.skip
+++ b/changelog.d/description-meilisearch-type.skip
--- a/changelog.d/dialyzer.skip
+++ b/changelog.d/dialyzer.skip
--- a/changelog.d/dialyzer2.skip
+++ b/changelog.d/dialyzer2.skip
--- a/changelog.d/dialyzer3.skip
+++ b/changelog.d/dialyzer3.skip
--- a/changelog.d/dialyzer4.skip
+++ b/changelog.d/dialyzer4.skip
--- a/changelog.d/digest_emails.fix
+++ b/changelog.d/digest_emails.fix
@ -1 +0,0 @@
-Fix the processing of email digest jobs.
--- a/changelog.d/disabling-chats.change
+++ b/changelog.d/disabling-chats.change
@ -0,0 +1 @@
+Allow disabling Chats feature
--- a/changelog.d/doc-fix.skip
+++ b/changelog.d/doc-fix.skip
--- a/changelog.d/docker-arm32v7-pr-forbid-build.skip
+++ b/changelog.d/docker-arm32v7-pr-forbid-build.skip
--- a/changelog.d/docker-baseimage-ssl.fix
+++ b/changelog.d/docker-baseimage-ssl.fix
@ -0,0 +1 @@
+Dockerfile: update base images to fix problems with SSL handshakes
--- a/changelog.d/docker-e2e-image.skip
+++ b/changelog.d/docker-e2e-image.skip
--- a/changelog.d/docs-max-elixir-erlang.change
+++ b/changelog.d/docs-max-elixir-erlang.change
@ -1 +0,0 @@
- Document maximum supported version of Erlang & Elixir
--- a/changelog.d/elixir-1-19.add
+++ b/changelog.d/elixir-1-19.add
@ -0,0 +1 @@
+Implemented ConfigDB configuration blacklist and accompanying Mix task
--- a/changelog.d/elixir-1-19.fix
+++ b/changelog.d/elixir-1-19.fix
@ -0,0 +1 @@
+Fixed Elixir 1.19 warnings
--- a/changelog.d/emoji-download-paginate.fix
+++ b/changelog.d/emoji-download-paginate.fix
@ -1 +0,0 @@
-When downloading remote emojis packs, account for pagination
--- a/changelog.d/emoji-use-v1.fix
+++ b/changelog.d/emoji-use-v1.fix
@ -1 +0,0 @@
-Make remote emoji packs API use specifically the V1 URL. Akkoma does not understand it without V1, and it works either way with normal pleroma, so no reason to not do this
--- a/changelog.d/exile-bsds.skip
+++ b/changelog.d/exile-bsds.skip
--- a/changelog.d/exile-freebsd.skip
+++ b/changelog.d/exile-freebsd.skip
--- a/changelog.d/exile-macos.skip
+++ b/changelog.d/exile-macos.skip
--- a/changelog.d/exile.skip
+++ b/changelog.d/exile.skip
--- a/changelog.d/familiar-followers.add
+++ b/changelog.d/familiar-followers.add
@ -1 +0,0 @@
-Implement `/api/v1/accounts/familiar_followers`
--- a/changelog.d/favicon.add
+++ b/changelog.d/favicon.add
@ -1 +0,0 @@
-Add support for configuring favicon, embed favicon and PWA manifest in server-generated meta
--- a/changelog.d/featured-collection-page.fix
+++ b/changelog.d/featured-collection-page.fix
@ -0,0 +1 @@
+Support fetching featured collection items from the first collection page
--- a/changelog.d/federation_status-access.change
+++ b/changelog.d/federation_status-access.change
@ -1 +0,0 @@
- Make `/api/v1/pleroma/federation_status` publicly available
--- a/changelog.d/federator-modules.remove
+++ b/changelog.d/federator-modules.remove
@ -1 +0,0 @@
-Removed support for multiple federator modules as we only support ActivityPub
--- a/changelog.d/federator.skip
+++ b/changelog.d/federator.skip
--- a/changelog.d/fedidev-federation-compat.add
+++ b/changelog.d/fedidev-federation-compat.add
@ -0,0 +1 @@
+Accept more real-world ActivityPub object shapes collected by fedidev.fun
--- a/changelog.d/fep-2c59.add
+++ b/changelog.d/fep-2c59.add
@ -1 +0,0 @@
-Implement FEP-2c59, add "webfinger" to user actor
--- a/changelog.d/ffmpeg-limiter.add
+++ b/changelog.d/ffmpeg-limiter.add
@ -1 +0,0 @@
-Framegrabs with ffmpeg will execute with a 5 second timeout and cache the URLs of failures with a TTL of 15 minutes to prevent excessive retries.
--- a/changelog.d/finch_redirects.fix
+++ b/changelog.d/finch_redirects.fix
@ -1 +0,0 @@
-Following HTTP Redirects when the HTTP Adapter is Finch
--- a/changelog.d/fix-bookmark-folder-tests.skip
+++ b/changelog.d/fix-bookmark-folder-tests.skip
--- a/changelog.d/fix-dockerfile.skip
+++ b/changelog.d/fix-dockerfile.skip
--- a/changelog.d/fix-duplicate-inbox-deliveries.fix
+++ b/changelog.d/fix-duplicate-inbox-deliveries.fix
--- a/changelog.d/fix-otp-comparison.skip
+++ b/changelog.d/fix-otp-comparison.skip
--- a/changelog.d/fix-preferred-frontend.fix
+++ b/changelog.d/fix-preferred-frontend.fix
@ -0,0 +1 @@
+Fix preferred frontend not working due to InstanceStatic plug prematurely returning HTTP 404
--- a/changelog.d/fix-tests.skip
+++ b/changelog.d/fix-tests.skip
--- a/changelog.d/fix-webfinger-spoofing.security
+++ b/changelog.d/fix-webfinger-spoofing.security
@ -1 +0,0 @@
-Fix webfinger spoofing.
--- a/changelog.d/force-mention-mrf.add
+++ b/changelog.d/force-mention-mrf.add
@ -1 +0,0 @@
-Add ForceMention MRF
--- a/changelog.d/framegrabs.fix
+++ b/changelog.d/framegrabs.fix
@ -1 +0,0 @@
-Video framegrabs were not working correctly after the change to use Exile to execute ffmpeg
--- a/changelog.d/frontend-management.add
+++ b/changelog.d/frontend-management.add
@ -1 +0,0 @@
-[docs] add frontends management documentation
--- a/changelog.d/generate-unset-user-keys-migration.skip
+++ b/changelog.d/generate-unset-user-keys-migration.skip
--- a/changelog.d/group-actor.add
+++ b/changelog.d/group-actor.add
@ -1 +0,0 @@
-Implement group actors
--- a/changelog.d/grouped-notifications-api.add
+++ b/changelog.d/grouped-notifications-api.add
@ -0,0 +1 @@
+Add Mastodon-compatible grouped notifications API endpoints under `/api/v2/notifications` for newly-created notifications
--- a/changelog.d/grouped_notifications_flag.skip
+++ b/changelog.d/grouped_notifications_flag.skip
--- a/changelog.d/gun-logs.skip
+++ b/changelog.d/gun-logs.skip
--- a/changelog.d/gun-pool-rework.fix
+++ b/changelog.d/gun-pool-rework.fix
@ -0,0 +1 @@
+Fixed Gun HTTP/1 concurrency, forwarding and authenticated proxy handling, tunnel requests, and streamed connection cleanup. Updated Gun and Cowlib for HTTP client security fixes.
--- a/changelog.d/gun_pool.fix
+++ b/changelog.d/gun_pool.fix
@ -1 +0,0 @@
-Fix logic error in Gun connection pooling which prevented retries even when the worker was launched with retry = true
--- a/changelog.d/gun_pool2.fix
+++ b/changelog.d/gun_pool2.fix
@ -1 +0,0 @@
-Connection pool errors when publishing an activity is a soft-error that will be retried shortly.
--- a/changelog.d/gun_pool3.skip
+++ b/changelog.d/gun_pool3.skip
--- a/changelog.d/handle_object_fetch_failures.change
+++ b/changelog.d/handle_object_fetch_failures.change
@ -1 +0,0 @@
-Remote object fetch failures will prevent the object fetch job from retrying if the object request returns 401, 403, 404, 410, or exceeds the maximum thread depth.
--- a/changelog.d/hashtag-timeline.fix
+++ b/changelog.d/hashtag-timeline.fix
@ -0,0 +1 @@
+Fix hashtag timeline query for additional tag handling
--- a/changelog.d/healthcheck-disabled-error.fix
+++ b/changelog.d/healthcheck-disabled-error.fix
@ -1 +0,0 @@
-TwitterAPI: Return proper error when healthcheck is disabled
--- a/changelog.d/host-header-verification.security
+++ b/changelog.d/host-header-verification.security
@ -0,0 +1 @@
+Ensure Host header is present and matches instance URI
--- a/changelog.d/http-signatures-0.1.3.fix
+++ b/changelog.d/http-signatures-0.1.3.fix
@ -0,0 +1 @@
+Fix compatibility with timestamped HTTP Signatures used by GoToSocial
--- a/changelog.d/iceshrimpnet-reports-fix.fix
+++ b/changelog.d/iceshrimpnet-reports-fix.fix
@ -0,0 +1 @@
+Handle reports with just actor ap id as the object
--- a/changelog.d/instance-contact-account.add
+++ b/changelog.d/instance-contact-account.add
@ -1 +0,0 @@
-Add contact account to InstanceView
--- a/changelog.d/instance-defdelegates.skip
+++ b/changelog.d/instance-defdelegates.skip
--- a/changelog.d/instance-rules.add
+++ b/changelog.d/instance-rules.add
@ -1 +0,0 @@
-Add instance rules
--- a/changelog.d/instance-v2.add
+++ b/changelog.d/instance-v2.add
@ -1 +0,0 @@
-Implement /api/v2/instance route
--- a/changelog.d/instance-v2.skip
+++ b/changelog.d/instance-v2.skip
--- a/changelog.d/issue-3241.fix
+++ b/changelog.d/issue-3241.fix
@ -1 +0,0 @@
-Handle cases when users.inbox is nil.
--- a/changelog.d/last_status_at.change
+++ b/changelog.d/last_status_at.change
@ -1 +0,0 @@
- Change AccountView `last_status_at` from a datetime to a date (as done in Mastodon 3.1.0)
--- a/changelog.d/link-verification.add
+++ b/changelog.d/link-verification.add
@ -1 +0,0 @@
-Verify profile link ownership with rel="me"
--- a/Show more
+++ b/Show more
				`@ -1 +0,0 @@`
				`HTTP Security: By default, don't allow unsafe-eval. The setting needs to be changed to allow Flash emulation.`
				`@ -1 +0,0 @@`
				`Remove checking ImageMagick's commands for Pleroma.Upload.Filter.AnalyzeMetadata`
				`@ -0,0 +1 @@`
				Fixed `/api/v1/pleroma/accounts/:id/favourites` ordering and pagination to use the favourite date.
				`@ -1 +0,0 @@`
				`Fix authentication check on account rendering when bio is defined`
				`@ -0,0 +1 @@`
				`Reject unsupported or ambiguous inbox signatures instead of queueing a doomed failed-signature retry, allowing clients to fall back to legacy HTTP Signatures.`
				`@ -1 +0,0 @@`
				`Uploader: Add support for uploading attachments using IPFS`
				`@ -1 +0,0 @@`
				`Add Anti-mention Spam MRF backported from Rebased`
				`@ -1 +0,0 @@`
				`HTTPSignaturePlug: Add :authorized_fetch_mode_exceptions configuration`
				`@ -1 +0,0 @@`
				`Support /authorize-interaction route used by Mastodon`
				`@ -1 +0,0 @@`
				`Add an option to reject certain domains when authorized fetch is enabled.`