Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into auth-fetch-exception

2024-05-20 18:21:46 +04:00 · 2024-05-20 18:21:46 +04:00 · c67506ba68
commit c67506ba68
parent 086ba59d03 e8cd6662eb
555 changed files with 7860 additions and 3257 deletions
--- a/changelog.d/2.6.1-mergeback.skip
+++ b/changelog.d/2.6.1-mergeback.skip
--- a/changelog.d/3987.fix
+++ b/changelog.d/3987.fix
@ -0,0 +1 @@
+Remove checking ImageMagick's commands for Pleroma.Upload.Filter.AnalyzeMetadata
--- a/changelog.d/account-rendering-auth-check.fix
+++ b/changelog.d/account-rendering-auth-check.fix
@ -0,0 +1 @@
+Fix authentication check on account rendering when bio is defined
--- a/changelog.d/add-outbox.fix
+++ b/changelog.d/add-outbox.fix
@ -0,0 +1 @@
+ap userview: add outbox field.
--- a/changelog.d/akkoma-xml-remote-entities.security
+++ b/changelog.d/akkoma-xml-remote-entities.security
@ -1 +0,0 @@
-Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem
--- a/changelog.d/anonymous-exception-else.fix
+++ b/changelog.d/anonymous-exception-else.fix
@ -0,0 +1 @@
+Fix #strip_report_status_data
--- a/changelog.d/api-docs.skip
+++ b/changelog.d/api-docs.skip
--- a/changelog.d/atom-leak.skip
+++ b/changelog.d/atom-leak.skip
--- a/changelog.d/authorize-interaction.add
+++ b/changelog.d/authorize-interaction.add
@ -0,0 +1 @@
+Support /authorize-interaction route used by Mastodon
--- a/changelog.d/backups-follows.add
+++ b/changelog.d/backups-follows.add
@ -0,0 +1 @@
+Include following/followers in backups
--- a/changelog.d/bad_inbox_request.change
+++ b/changelog.d/bad_inbox_request.change
@ -0,0 +1 @@
+Invalid activities delivered to the inbox will be rejected with a 400 Bad Request
--- a/changelog.d/bandit.change
+++ b/changelog.d/bandit.change
@ -0,0 +1 @@
+Support Bandit as an alternative to Cowboy for the HTTP server. 
--- a/changelog.d/blurhash.change
+++ b/changelog.d/blurhash.change
@ -0,0 +1 @@
+Replace eblurhash with rinpatch_blurhash. This also removes a dependency on ImageMagick.
--- a/changelog.d/bookmark-folders.add
+++ b/changelog.d/bookmark-folders.add
@ -0,0 +1 @@
+Allow to group bookmarks in folders
--- a/changelog.d/bookmark-folders.skip
+++ b/changelog.d/bookmark-folders.skip
--- a/changelog.d/bugfix-ccworks.fix
+++ b/changelog.d/bugfix-ccworks.fix
@ -0,0 +1 @@
+Fix federation with Convergence AP Bridge
--- a/changelog.d/build-release-with-local-libvips.skip
+++ b/changelog.d/build-release-with-local-libvips.skip
--- a/changelog.d/card-endpoint.remove
+++ b/changelog.d/card-endpoint.remove
@ -0,0 +1 @@
+Mastodon API: Remove deprecated GET /api/v1/statuses/:id/card endpoint https://github.com/mastodon/mastodon/pull/11213
--- a/changelog.d/card-image-description.add
+++ b/changelog.d/card-image-description.add
@ -0,0 +1 @@
+Include image description in status media cards
--- a/changelog.d/chat-attachment-empty-array.fix
+++ b/changelog.d/chat-attachment-empty-array.fix
@ -0,0 +1 @@
+ChatMessage: Tolerate attachment field set to an empty array
--- a/changelog.d/check-attachment-attribution.security
+++ b/changelog.d/check-attachment-attribution.security
@ -1 +0,0 @@
-CommonAPI: Prevent users from accessing media of other users by creating a status with reused attachment ID
--- a/changelog.d/config-stat-symlink.fix
+++ b/changelog.d/config-stat-symlink.fix
@ -0,0 +1 @@
+- Config: Check the permissions of the linked file instead of the symlink
--- a/changelog.d/content-length.fix
+++ b/changelog.d/content-length.fix
@ -0,0 +1 @@
+MediaProxy was setting the content-length header which is not permitted by RFC9112§6.2 when we are chunking the reply as it conflicts with the existence of the transfer-encoding header.
--- a/changelog.d/deprecations.skip
+++ b/changelog.d/deprecations.skip
@ -0,0 +1 @@
+
--- a/changelog.d/deprecations2.skip
+++ b/changelog.d/deprecations2.skip
--- a/changelog.d/deps-bump-2024-01-25.skip
+++ b/changelog.d/deps-bump-2024-01-25.skip
--- a/changelog.d/description-meilisearch-type.skip
+++ b/changelog.d/description-meilisearch-type.skip
--- a/changelog.d/dialyzer.skip
+++ b/changelog.d/dialyzer.skip
--- a/changelog.d/dialyzer2.skip
+++ b/changelog.d/dialyzer2.skip
--- a/changelog.d/dialyzer3.skip
+++ b/changelog.d/dialyzer3.skip
--- a/changelog.d/dialyzer4.skip
+++ b/changelog.d/dialyzer4.skip
--- a/changelog.d/doc-fix.skip
+++ b/changelog.d/doc-fix.skip
--- a/changelog.d/emoji-download-paginate.fix
+++ b/changelog.d/emoji-download-paginate.fix
@ -0,0 +1 @@
+When downloading remote emojis packs, account for pagination
--- a/changelog.d/emoji-pack-sanitization.security
+++ b/changelog.d/emoji-pack-sanitization.security
@ -1 +0,0 @@
-Emoji pack loader sanitizes pack names
--- a/changelog.d/emoji-use-v1.fix
+++ b/changelog.d/emoji-use-v1.fix
@ -0,0 +1 @@
+Make remote emoji packs API use specifically the V1 URL. Akkoma does not understand it without V1, and it works either way with normal pleroma, so no reason to not do this
--- a/changelog.d/exile-bsds.skip
+++ b/changelog.d/exile-bsds.skip
--- a/changelog.d/exile-freebsd.skip
+++ b/changelog.d/exile-freebsd.skip
--- a/changelog.d/exile-macos.skip
+++ b/changelog.d/exile-macos.skip
--- a/changelog.d/exile.skip
+++ b/changelog.d/exile.skip
--- a/changelog.d/familiar-followers.add
+++ b/changelog.d/familiar-followers.add
@ -0,0 +1 @@
+Implement `/api/v1/accounts/familiar_followers`
--- a/changelog.d/favicon.add
+++ b/changelog.d/favicon.add
@ -0,0 +1 @@
+Add support for configuring favicon, embed favicon and PWA manifest in server-generated meta
--- a/changelog.d/federator-modules.remove
+++ b/changelog.d/federator-modules.remove
@ -0,0 +1 @@
+Removed support for multiple federator modules as we only support ActivityPub
--- a/changelog.d/federator.skip
+++ b/changelog.d/federator.skip
--- a/changelog.d/fep-2c59.add
+++ b/changelog.d/fep-2c59.add
@ -0,0 +1 @@
+Implement FEP-2c59, add "webfinger" to user actor
--- a/changelog.d/ffmpeg-limiter.add
+++ b/changelog.d/ffmpeg-limiter.add
@ -0,0 +1 @@
+Framegrabs with ffmpeg will execute with a 5 second timeout and cache the URLs of failures with a TTL of 15 minutes to prevent excessive retries.
--- a/changelog.d/finch_redirects.fix
+++ b/changelog.d/finch_redirects.fix
@ -0,0 +1 @@
+Following HTTP Redirects when the HTTP Adapter is Finch
--- a/changelog.d/fix-bookmark-folder-tests.skip
+++ b/changelog.d/fix-bookmark-folder-tests.skip
--- a/changelog.d/fix-dockerfile.skip
+++ b/changelog.d/fix-dockerfile.skip
--- a/changelog.d/fix-duplicate-inbox-deliveries.fix
+++ b/changelog.d/fix-duplicate-inbox-deliveries.fix
--- a/changelog.d/fix-otp-comparison.skip
+++ b/changelog.d/fix-otp-comparison.skip
--- a/changelog.d/fix-tests.skip
+++ b/changelog.d/fix-tests.skip
--- a/changelog.d/force-mention-mrf.add
+++ b/changelog.d/force-mention-mrf.add
@ -0,0 +1 @@
+Add ForceMention MRF
--- a/changelog.d/framegrabs.fix
+++ b/changelog.d/framegrabs.fix
@ -0,0 +1 @@
+Video framegrabs were not working correctly after the change to use Exile to execute ffmpeg
--- a/changelog.d/frontend-management.add
+++ b/changelog.d/frontend-management.add
@ -0,0 +1 @@
+[docs] add frontends management documentation
--- a/changelog.d/generate-unset-user-keys-migration.skip
+++ b/changelog.d/generate-unset-user-keys-migration.skip
--- a/changelog.d/group-actor.add
+++ b/changelog.d/group-actor.add
@ -0,0 +1 @@
+Implement group actors
--- a/changelog.d/gun-logs.skip
+++ b/changelog.d/gun-logs.skip
--- a/changelog.d/gun_pool.fix
+++ b/changelog.d/gun_pool.fix
@ -0,0 +1 @@
+Fix logic error in Gun connection pooling which prevented retries even when the worker was launched with retry = true
--- a/changelog.d/gun_pool2.fix
+++ b/changelog.d/gun_pool2.fix
@ -0,0 +1 @@
+Connection pool errors when publishing an activity is a soft-error that will be retried shortly.
--- a/changelog.d/gun_pool3.skip
+++ b/changelog.d/gun_pool3.skip
--- a/changelog.d/handle_object_fetch_failures.change
+++ b/changelog.d/handle_object_fetch_failures.change
@ -0,0 +1 @@
+Remote object fetch failures will prevent the object fetch job from retrying if the object request returns 401, 403, 404, 410, or exceeds the maximum thread depth.
--- a/changelog.d/instance-contact-account.add
+++ b/changelog.d/instance-contact-account.add
@ -0,0 +1 @@
+Add contact account to InstanceView
--- a/changelog.d/instance-defdelegates.skip
+++ b/changelog.d/instance-defdelegates.skip
--- a/changelog.d/instance-rules.add
+++ b/changelog.d/instance-rules.add
@ -0,0 +1 @@
+Add instance rules
--- a/changelog.d/instance-v2.add
+++ b/changelog.d/instance-v2.add
@ -0,0 +1 @@
+Implement /api/v2/instance route
--- a/changelog.d/instance-v2.skip
+++ b/changelog.d/instance-v2.skip
--- a/changelog.d/issue-3241.fix
+++ b/changelog.d/issue-3241.fix
@ -0,0 +1 @@
+Handle cases when users.inbox is nil.
--- a/changelog.d/last_status_at.change
+++ b/changelog.d/last_status_at.change
@ -0,0 +1 @@
+- Change AccountView `last_status_at` from a datetime to a date (as done in Mastodon 3.1.0)
--- a/changelog.d/link-verification.add
+++ b/changelog.d/link-verification.add
@ -0,0 +1 @@
+Verify profile link ownership with rel="me"
--- a/changelog.d/loading-order-test-fix.skip
+++ b/changelog.d/loading-order-test-fix.skip
--- a/changelog.d/local-webfinger.fix
+++ b/changelog.d/local-webfinger.fix
@ -0,0 +1 @@
+Use correct domain for fqn and InstanceView
--- a/changelog.d/mark-read.fix
+++ b/changelog.d/mark-read.fix
@ -0,0 +1 @@
+The query for marking notifications as read has been simplified
--- a/changelog.d/mastodon_api_v2.add
+++ b/changelog.d/mastodon_api_v2.add
@ -0,0 +1 @@
+Add new parameters to /api/v2/instance: configuration[accounts][max_pinned_statuses] and configuration[statuses][characters_reserved_per_url]
--- a/changelog.d/mastodon_directory.fix
+++ b/changelog.d/mastodon_directory.fix
@ -0,0 +1 @@
+Mastodon API /api/v1/directory: Fix listing directory contents when not authenticated
--- a/changelog.d/memleak.fix
+++ b/changelog.d/memleak.fix
@ -0,0 +1 @@
+Fix a memory leak caused by Websocket connections that would not enter a state where a full garbage collection run could be triggered.
--- a/changelog.d/mergeback-2.6.2.skip
+++ b/changelog.d/mergeback-2.6.2.skip
--- a/changelog.d/migration-fix.skip
+++ b/changelog.d/migration-fix.skip
@ -0,0 +1 @@
+
--- a/changelog.d/missing-mrfs.add
+++ b/changelog.d/missing-mrfs.add
@ -0,0 +1 @@
+Startup detection for configured MRF modules that are missing or incorrectly defined
--- a/changelog.d/mrf-regex-error.fix
+++ b/changelog.d/mrf-regex-error.fix
@ -0,0 +1 @@
+MRF: Log sensible error for subdomains_regex
--- a/changelog.d/mrf-steal-emoji-extname.fix
+++ b/changelog.d/mrf-steal-emoji-extname.fix
@ -0,0 +1 @@
+MRF.StealEmojiPolicy: Properly add fallback extension to filenames missing one
--- a/changelog.d/mrf_hashtags.fix
+++ b/changelog.d/mrf_hashtags.fix
@ -0,0 +1 @@
+Federated timeline removal of hashtags via MRF HashtagPolicy
--- a/changelog.d/nil-content-map.fix
+++ b/changelog.d/nil-content-map.fix
@ -0,0 +1 @@
+Support objects with a null contentMap (firefish)
--- a/changelog.d/no-async-with-clear-config.skip
+++ b/changelog.d/no-async-with-clear-config.skip
--- a/changelog.d/notifications-index.fix
+++ b/changelog.d/notifications-index.fix
@ -0,0 +1 @@
+Fix notifications query which was not using the index properly
--- a/changelog.d/notifications.fix
+++ b/changelog.d/notifications.fix
@ -0,0 +1 @@
+Notifications: improve performance by filtering on users table instead of activities table
--- a/changelog.d/oauth-nickname.skip
+++ b/changelog.d/oauth-nickname.skip
@ -0,0 +1 @@
+Use User.full_nickname/1 in oauth html template
--- a/changelog.d/opengraph-rich-media-proxy.add
+++ b/changelog.d/opengraph-rich-media-proxy.add
@ -0,0 +1 @@
+Add media proxy to opengraph rich media cards
--- a/changelog.d/optimistic-inbox.change
+++ b/changelog.d/optimistic-inbox.change
@ -0,0 +1 @@
+Optimistic Inbox reduces the processing overhead of incoming activities without instantly verifiable signatures.
--- a/changelog.d/otp26.add
+++ b/changelog.d/otp26.add
@ -0,0 +1 @@
+Support for Erlang OTP 26
--- a/changelog.d/otp_perms.security
+++ b/changelog.d/otp_perms.security
@ -1 +0,0 @@
- Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories
--- a/changelog.d/postgres-jit.change
+++ b/changelog.d/postgres-jit.change
@ -0,0 +1 @@
+Disable jit by default for PostgreSQL
--- a/changelog.d/prioritize-direct-recipients.add
+++ b/changelog.d/prioritize-direct-recipients.add
@ -0,0 +1 @@
+- Prioritize mentioned recipients (i.e., those that are not just followers) when federating.
--- a/changelog.d/promex.change
+++ b/changelog.d/promex.change
@ -0,0 +1 @@
+Change the prometheus library to PromEx.
--- a/changelog.d/public-polls.add
+++ b/changelog.d/public-polls.add
@ -0,0 +1 @@
+Expose nonAnonymous field from Smithereen polls
--- a/changelog.d/publisher_discard.change
+++ b/changelog.d/publisher_discard.change
@ -0,0 +1 @@
+Activity publishing failures will prevent the job from retrying if the publishing request returns a 403 or 410
--- a/changelog.d/publisher_log.change
+++ b/changelog.d/publisher_log.change
@ -0,0 +1 @@
+Publisher errors will now emit logs indicating the inbox that was not available for delivery.
--- a/changelog.d/qtfaststart.fix
+++ b/changelog.d/qtfaststart.fix
@ -0,0 +1 @@
+MediaProxy Preview failures prevented when encountering certain video files
--- a/changelog.d/reachability.change
+++ b/changelog.d/reachability.change
@ -0,0 +1 @@
+Reduce the reachability timestamp update to a single upsert query
--- a/changelog.d/receiverworker-error-handling.fix
+++ b/changelog.d/receiverworker-error-handling.fix
@ -0,0 +1 @@
+ReceiverWorker: Make sure non-{:ok, _} is returned as {:error, …}
--- a/changelog.d/remote-fetcher-error.skip
+++ b/changelog.d/remote-fetcher-error.skip
--- a/Show more
+++ b/Show more
				`@ -0,0 +1 @@`
				`Remove checking ImageMagick's commands for Pleroma.Upload.Filter.AnalyzeMetadata`
				`@ -0,0 +1 @@`
				`Fix authentication check on account rendering when bio is defined`
				`@ -1 +0,0 @@`
				`Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem`
				`@ -0,0 +1 @@`
				`Support /authorize-interaction route used by Mastodon`
				`@ -0,0 +1 @@`
				`Invalid activities delivered to the inbox will be rejected with a 400 Bad Request`
				`@ -0,0 +1 @@`
				`Support Bandit as an alternative to Cowboy for the HTTP server.`
				`@ -0,0 +1 @@`
				`Replace eblurhash with rinpatch_blurhash. This also removes a dependency on ImageMagick.`
				`@ -0,0 +1 @@`
				`Mastodon API: Remove deprecated GET /api/v1/statuses/:id/card endpoint https://github.com/mastodon/mastodon/pull/11213`
				`@ -0,0 +1 @@`
				`Include image description in status media cards`
				`@ -0,0 +1 @@`
				`ChatMessage: Tolerate attachment field set to an empty array`