Merge remote-tracking branch 'origin/develop' into link-verification

2024-03-07 13:13:49 +01:00 · 2024-03-07 13:13:49 +01:00 · b7c625db0f
commit b7c625db0f
parent 47ce33a90d 8298b326a7
609 changed files with 6056 additions and 2607 deletions
--- a/changelog.d/2023-06-deps-update.skip
+++ b/changelog.d/2023-06-deps-update.skip
--- a/changelog.d/2.6.1-mergeback.skip
+++ b/changelog.d/2.6.1-mergeback.skip
--- a/changelog.d/3126.fix
+++ b/changelog.d/3126.fix
@ -1 +0,0 @@
-MediaProxy responses now return a sandbox CSP header
--- a/changelog.d/3801.fix
+++ b/changelog.d/3801.fix
@ -1 +0,0 @@
-Filter context activities using Visibility.visible_for_user?
--- a/changelog.d/3848.add
+++ b/changelog.d/3848.add
@ -1 +0,0 @@
-Add OAuth scope descriptions
--- a/changelog.d/3872.remove
+++ b/changelog.d/3872.remove
@ -1 +0,0 @@
-remove BBS/SSH feature, replaced by an external bridge.
--- a/changelog.d/3873.fix
+++ b/changelog.d/3873.fix
@ -1 +0,0 @@
-UploadedMedia: Add missing disposition_type to Content-Disposition
--- a/changelog.d/3874.remove
+++ b/changelog.d/3874.remove
@ -1 +0,0 @@
-Remove a few unused indexes.
--- a/changelog.d/3879.fix
+++ b/changelog.d/3879.fix
@ -1 +0,0 @@
-fix not being able to fetch flash file from remote instance
--- a/changelog.d/3880.remove
+++ b/changelog.d/3880.remove
@ -1 +0,0 @@
-Cleanup OStatus-era user upgrades and ap_enabled indicator
--- a/changelog.d/3882.add
+++ b/changelog.d/3882.add
@ -1 +0,0 @@
-Allow lang attribute in status text
--- a/changelog.d/3883.fix
+++ b/changelog.d/3883.fix
@ -1 +0,0 @@
-Fix abnormal behaviour when refetching a poll
--- a/changelog.d/3884.fix
+++ b/changelog.d/3884.fix
@ -1 +0,0 @@
-Allow non-HTTP(s) URIs in "url" fields for compatibility with "FEP-fffd: Proxy Objects"
--- a/changelog.d/3885.fix
+++ b/changelog.d/3885.fix
@ -1 +0,0 @@
-Fix opengraph and twitter card meta tags
--- a/changelog.d/3888.fix
+++ b/changelog.d/3888.fix
@ -1 +0,0 @@
-ForceMentionsInContent: fix double mentions for Mastodon/Misskey posts
--- a/changelog.d/3891.fix
+++ b/changelog.d/3891.fix
@ -1 +0,0 @@
-OEmbed HTML tags are now filtered
--- a/changelog.d/3897.add
+++ b/changelog.d/3897.add
@ -1 +0,0 @@
-OnlyMedia Upload Filter
--- a/changelog.d/3900.change
+++ b/changelog.d/3900.change
@ -0,0 +1 @@
+Update to Phoenix 1.7
--- a/changelog.d/3901.security
+++ b/changelog.d/3901.security
@ -1 +0,0 @@
-Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.
--- a/changelog.d/3987.fix
+++ b/changelog.d/3987.fix
@ -0,0 +1 @@
+Remove checking ImageMagick's commands for Pleroma.Upload.Filter.AnalyzeMetadata
--- a/changelog.d/account-rendering-auth-check.fix
+++ b/changelog.d/account-rendering-auth-check.fix
@ -0,0 +1 @@
+Fix authentication check on account rendering when bio is defined
--- a/changelog.d/add-outbox.fix
+++ b/changelog.d/add-outbox.fix
@ -0,0 +1 @@
+ap userview: add outbox field.
--- a/changelog.d/akkoma-xml-remote-entities.security
+++ b/changelog.d/akkoma-xml-remote-entities.security
@ -1 +0,0 @@
-Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem
--- a/changelog.d/anonymous-exception-else.fix
+++ b/changelog.d/anonymous-exception-else.fix
@ -0,0 +1 @@
+Fix #strip_report_status_data
--- a/changelog.d/api-docs.skip
+++ b/changelog.d/api-docs.skip
--- a/changelog.d/atom-leak.skip
+++ b/changelog.d/atom-leak.skip
--- a/changelog.d/attachment-type-check.fix
+++ b/changelog.d/attachment-type-check.fix
@ -1 +0,0 @@
-Restrict attachments to only uploaded files only
--- a/changelog.d/authorize-interaction.add
+++ b/changelog.d/authorize-interaction.add
@ -0,0 +1 @@
+Support /authorize-interaction route used by Mastodon
--- a/changelog.d/bad_inbox_request.change
+++ b/changelog.d/bad_inbox_request.change
@ -0,0 +1 @@
+Invalid activities delivered to the inbox will be rejected with a 400 Bad Request
--- a/changelog.d/bandit.change
+++ b/changelog.d/bandit.change
@ -0,0 +1 @@
+Support Bandit as an alternative to Cowboy for the HTTP server. 
--- a/changelog.d/bare_uri_test.skip
+++ b/changelog.d/bare_uri_test.skip
--- a/changelog.d/benchee.skip
+++ b/changelog.d/benchee.skip
--- a/changelog.d/blurhash.change
+++ b/changelog.d/blurhash.change
@ -0,0 +1 @@
+Replace eblurhash with rinpatch_blurhash. This also removes a dependency on ImageMagick.
--- a/changelog.d/bugfix-ccworks.fix
+++ b/changelog.d/bugfix-ccworks.fix
@ -0,0 +1 @@
+Fix federation with Convergence AP Bridge
--- a/changelog.d/build-release-with-local-libvips.skip
+++ b/changelog.d/build-release-with-local-libvips.skip
--- a/changelog.d/chat-attachment-empty-array.fix
+++ b/changelog.d/chat-attachment-empty-array.fix
@ -0,0 +1 @@
+ChatMessage: Tolerate attachment field set to an empty array
--- a/changelog.d/check-attachment-attribution.security
+++ b/changelog.d/check-attachment-attribution.security
@ -1 +0,0 @@
-CommonAPI: Prevent users from accessing media of other users by creating a status with reused attachment ID
--- a/changelog.d/config-stat-symlink.fix
+++ b/changelog.d/config-stat-symlink.fix
@ -0,0 +1 @@
+- Config: Check the permissions of the linked file instead of the symlink
--- a/changelog.d/content-length.fix
+++ b/changelog.d/content-length.fix
@ -0,0 +1 @@
+MediaProxy was setting the content-length header which is not permitted by RFC9112§6.2 when we are chunking the reply as it conflicts with the existence of the transfer-encoding header.
--- a/changelog.d/delete-status-of-banned-user.fix
+++ b/changelog.d/delete-status-of-banned-user.fix
@ -1 +0,0 @@
-Fix error 404 when deleting status of a banned user
--- a/changelog.d/deprecate-scrobbles.remove
+++ b/changelog.d/deprecate-scrobbles.remove
@ -1 +0,0 @@
-Deprecate Pleroma's audio scrobbling
--- a/changelog.d/deprecations.skip
+++ b/changelog.d/deprecations.skip
@ -0,0 +1 @@
+
--- a/changelog.d/deprecations2.skip
+++ b/changelog.d/deprecations2.skip
--- a/changelog.d/deps-bump-2024-01-25.skip
+++ b/changelog.d/deps-bump-2024-01-25.skip
--- a/changelog.d/dialyzer.skip
+++ b/changelog.d/dialyzer.skip
--- a/changelog.d/dialyzer2.skip
+++ b/changelog.d/dialyzer2.skip
--- a/changelog.d/amd64-runner.skip
+++ b/changelog.d/amd64-runner.skip
--- a/changelog.d/changelog-improve.skip
+++ b/changelog.d/changelog-improve.skip
--- a/changelog.d/digest_emails.fix
+++ b/changelog.d/digest_emails.fix
@ -0,0 +1 @@
+Fix the processing of email digest jobs.
--- a/changelog.d/disable-xml-entity-resolution.security
+++ b/changelog.d/disable-xml-entity-resolution.security
@ -1 +0,0 @@
-Disable XML entity resolution completely to fix a dos vulnerability
--- a/changelog.d/distro-docs-elixir-1.11.skip
+++ b/changelog.d/distro-docs-elixir-1.11.skip
--- a/changelog.d/dockerfile-config-perms.fix
+++ b/changelog.d/dockerfile-config-perms.fix
@ -1 +0,0 @@
- Fix config ownership in dockerfile to pass restriction test
--- a/changelog.d/docs-max-elixir-erlang.change
+++ b/changelog.d/docs-max-elixir-erlang.change
@ -0,0 +1 @@
+- Document maximum supported version of Erlang & Elixir
--- a/changelog.d/emoji-download-paginate.fix
+++ b/changelog.d/emoji-download-paginate.fix
@ -0,0 +1 @@
+When downloading remote emojis packs, account for pagination
--- a/changelog.d/emoji-pack-sanitization.security
+++ b/changelog.d/emoji-pack-sanitization.security
@ -1 +0,0 @@
-Emoji pack loader sanitizes pack names
--- a/changelog.d/emoji-policy.add
+++ b/changelog.d/emoji-policy.add
@ -1 +0,0 @@
-Implement MRF policy to reject or delist according to emojis
--- a/changelog.d/emoji-use-v1.fix
+++ b/changelog.d/emoji-use-v1.fix
@ -0,0 +1 @@
+Make remote emoji packs API use specifically the V1 URL. Akkoma does not understand it without V1, and it works either way with normal pleroma, so no reason to not do this
--- a/changelog.d/exile-bsds.skip
+++ b/changelog.d/exile-bsds.skip
--- a/changelog.d/gentoo_otp_hotfix.skip
+++ b/changelog.d/gentoo_otp_hotfix.skip
--- a/changelog.d/gentoo_otp_intro.skip
+++ b/changelog.d/gentoo_otp_intro.skip
--- a/changelog.d/exile.skip
+++ b/changelog.d/exile.skip
--- a/changelog.d/favicon.add
+++ b/changelog.d/favicon.add
@ -0,0 +1 @@
+Add support for configuring favicon, embed favicon and PWA manifest in server-generated meta
--- a/changelog.d/featured-collection-shouldnt-break-user-fetch.fix
+++ b/changelog.d/featured-collection-shouldnt-break-user-fetch.fix
@ -1 +0,0 @@
-Fix user fetch completely broken if featured collection is not in a supported form
--- a/changelog.d/federation_status-access.change
+++ b/changelog.d/federation_status-access.change
@ -0,0 +1 @@
+- Make `/api/v1/pleroma/federation_status` publicly available
--- a/changelog.d/federator-modules.remove
+++ b/changelog.d/federator-modules.remove
@ -0,0 +1 @@
+Removed support for multiple federator modules as we only support ActivityPub
--- a/changelog.d/media-altdomain.skip
+++ b/changelog.d/media-altdomain.skip
--- a/changelog.d/finch_redirects.fix
+++ b/changelog.d/finch_redirects.fix
@ -0,0 +1 @@
+Following HTTP Redirects when the HTTP Adapter is Finch
--- a/changelog.d/pipeline-triggers.skip
+++ b/changelog.d/pipeline-triggers.skip
--- a/changelog.d/fix-duplicate-inbox-deliveries.fix
+++ b/changelog.d/fix-duplicate-inbox-deliveries.fix
--- a/changelog.d/fix-object-test.fix
+++ b/changelog.d/fix-object-test.fix
@ -1 +0,0 @@
-Correctly handle the situation when a poll has both "anyOf" and "oneOf" but one of them being empty
--- a/changelog.d/fix-otp-comparison.skip
+++ b/changelog.d/fix-otp-comparison.skip
--- a/changelog.d/fix-tests.skip
+++ b/changelog.d/fix-tests.skip
--- a/changelog.d/frontend-management.add
+++ b/changelog.d/frontend-management.add
@ -0,0 +1 @@
+[docs] add frontends management documentation
--- a/changelog.d/generate-unset-user-keys-migration.skip
+++ b/changelog.d/generate-unset-user-keys-migration.skip
--- a/changelog.d/group-actor.add
+++ b/changelog.d/group-actor.add
@ -0,0 +1 @@
+Implement group actors
--- a/changelog.d/gun-logs.skip
+++ b/changelog.d/gun-logs.skip
--- a/changelog.d/gun_pool.fix
+++ b/changelog.d/gun_pool.fix
@ -0,0 +1 @@
+Fix logic error in Gun connection pooling which prevented retries even when the worker was launched with retry = true
--- a/changelog.d/gun_pool2.fix
+++ b/changelog.d/gun_pool2.fix
@ -0,0 +1 @@
+Connection pool errors when publishing an activity is a soft-error that will be retried shortly.
--- a/changelog.d/gun_pool3.skip
+++ b/changelog.d/gun_pool3.skip
--- a/changelog.d/handle-report-from-deactivated-user.fix
+++ b/changelog.d/handle-report-from-deactivated-user.fix
@ -1 +0,0 @@
-Fix handling report from a deactivated user
--- a/changelog.d/handle_object_fetch_failures.change
+++ b/changelog.d/handle_object_fetch_failures.change
@ -0,0 +1 @@
+Remote object fetch failures will prevent the object fetch job from retrying if the object request returns 401, 403, 404, 410, or exceeds the maximum thread depth.
--- a/changelog.d/healthcheck-disabled-error.fix
+++ b/changelog.d/healthcheck-disabled-error.fix
@ -0,0 +1 @@
+TwitterAPI: Return proper error when healthcheck is disabled
--- a/changelog.d/instance-defdelegates.skip
+++ b/changelog.d/instance-defdelegates.skip
--- a/changelog.d/instance-v2.add
+++ b/changelog.d/instance-v2.add
@ -0,0 +1 @@
+Implement /api/v2/instance route
--- a/changelog.d/instance-v2.skip
+++ b/changelog.d/instance-v2.skip
--- a/changelog.d/last_status_at.change
+++ b/changelog.d/last_status_at.change
@ -0,0 +1 @@
+- Change AccountView `last_status_at` from a datetime to a date (as done in Mastodon 3.1.0)
--- a/changelog.d/loading-order-test-fix.skip
+++ b/changelog.d/loading-order-test-fix.skip
--- a/changelog.d/local-webfinger.fix
+++ b/changelog.d/local-webfinger.fix
@ -0,0 +1 @@
+Use correct domain for fqn and InstanceView
--- a/changelog.d/mastodon_directory.fix
+++ b/changelog.d/mastodon_directory.fix
@ -0,0 +1 @@
+Mastodon API /api/v1/directory: Fix listing directory contents when not authenticated
--- a/changelog.d/meilisearch.add
+++ b/changelog.d/meilisearch.add
@ -0,0 +1 @@
+Add meilisearch, make search engines pluggable
--- a/changelog.d/memleak.fix
+++ b/changelog.d/memleak.fix
@ -0,0 +1 @@
+Fix a memory leak caused by Websocket connections that would not enter a state where a full garbage collection run could be triggered.
--- a/changelog.d/mergeback-2.6.2.skip
+++ b/changelog.d/mergeback-2.6.2.skip
--- a/changelog.d/migration-fix.skip
+++ b/changelog.d/migration-fix.skip
@ -0,0 +1 @@
+
--- a/changelog.d/mrf-regex-error.fix
+++ b/changelog.d/mrf-regex-error.fix
@ -0,0 +1 @@
+MRF: Log sensible error for subdomains_regex
--- a/changelog.d/mrf-steal-emoji-extname.fix
+++ b/changelog.d/mrf-steal-emoji-extname.fix
@ -0,0 +1 @@
+MRF.StealEmojiPolicy: Properly add fallback extension to filenames missing one
--- a/changelog.d/mrf_hashtags.fix
+++ b/changelog.d/mrf_hashtags.fix
@ -0,0 +1 @@
+Federated timeline removal of hashtags via MRF HashtagPolicy
--- a/changelog.d/nil-content-map.fix
+++ b/changelog.d/nil-content-map.fix
@ -0,0 +1 @@
+Support objects with a null contentMap (firefish)
--- a/changelog.d/no-async-with-clear-config.skip
+++ b/changelog.d/no-async-with-clear-config.skip
--- a/changelog.d/no_new_privs.add
+++ b/changelog.d/no_new_privs.add
@ -1 +0,0 @@
-(hardening) Add no_new_privs=yes to OpenRC service files
--- a/changelog.d/notifications-index.fix
+++ b/changelog.d/notifications-index.fix
@ -0,0 +1 @@
+Fix notifications query which was not using the index properly
--- a/Show more
+++ b/Show more
				`@ -1 +0,0 @@`
				`MediaProxy responses now return a sandbox CSP header`
				`@ -1 +0,0 @@`
				`Filter context activities using Visibility.visible_for_user?`
				`@ -1 +0,0 @@`
				`remove BBS/SSH feature, replaced by an external bridge.`
				`@ -1 +0,0 @@`
				`UploadedMedia: Add missing disposition_type to Content-Disposition`
				`@ -1 +0,0 @@`
				`fix not being able to fetch flash file from remote instance`
				`@ -1 +0,0 @@`
				`Cleanup OStatus-era user upgrades and ap_enabled indicator`
				`@ -1 +0,0 @@`
				`Fix abnormal behaviour when refetching a poll`
				`@ -1 +0,0 @@`
				`Allow non-HTTP(s) URIs in "url" fields for compatibility with "FEP-fffd: Proxy Objects"`
				`@ -1 +0,0 @@`
				`ForceMentionsInContent: fix double mentions for Mastodon/Misskey posts`
				`@ -1 +0,0 @@`
				`Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.`