hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
18,303 commits 2 branches 0 tags 250 MiB
Commit graph

18,303 commits

This branch
This branch
All branches
Author SHA1 Message Date
Lain Soykaf
1be50ed28b
 		fix(html): check link schemes the way browsers read them 
FastSanitize checks the scheme with URI.parse/1, which finds none in
java<TAB>script:alert(1). Browsers remove tabs and newlines and leading
control characters first and run it as a javascript: link. The scrubbers
now use Pleroma.HTML.URIAttributes, which normalizes the URL the same
way before the scheme check.
 2026-10-22 16:36:16 +04:00
Lain Soykaf
58d4f6aa2c
 		fix(formatter): percent-encode quotes in Markdown URLs instead of cutting 
Cutting the URL at the first quote dropped the rest of valid links such
as ?q=&quot;cat&quot;&page=2. Percent-encoding ", < and > keeps the URL
complete and still keeps it inside the attribute.
 2026-10-22 16:28:06 +04:00
Lain Soykaf
de6ac2392c
 		fix(formatter): keep links with formatted text in MFM posts 
The email autolink clause also matched a link whose only child is an
element, raised on "mailto:" <> element, and the rescue turned the
whole post into escaped source text.
 2026-10-22 16:25:54 +04:00
Lain Soykaf
1f2179872a
 		docs: require Elixir 1.17 and OTP 27 in the install guides 2026-10-22 16:25:03 +04:00
Lain Soykaf
e52ba68303
 		fix(http): make Hackney use HTTP/1.1 only 
Hackney 4 negotiates HTTP/2 and shares one connection per host. The
media proxy closes a response with :hackney.close/1, which stops the
whole connection, so parallel downloads from one host broke each other.
 2026-10-22 16:24:47 +04:00
Lain Soykaf
4943e6a914
 		fix(http): pass IP proxy hosts to Hackney as strings 
ConfigDB turns a numeric proxy host into an IP tuple. Hackney 1 took it,
Hackney 4 ignores such a proxy and connects directly, which skips a
SOCKS proxy (Tor) without any error.
 2026-10-22 16:23:40 +04:00
Phantasm
bbc53f0fef
 		Merge branch 'develop' into audit-mix-audit-report 2026-10-21 19:24:32 +02:00
Phantasm
5810ecd16e
 		Sec: Update Decimal to version 3.2.0 
Fixes:
  decimal 3.1.1 - EEF-CVE-2026-97853 (MEDIUM)
    aka: CVE-2026-97853, GHSA-6c27-994x-c52f
    Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-97853
 2026-10-21 11:27:55 +02:00
Phantasm
e7b88cd652
 		Sec: Update mint to version 1.11.0 
Fixes:
  mint 1.10.0 - EEF-CVE-2026-92103 (MEDIUM)
    aka: CVE-2026-92103, GHSA-q95c-ccq6-j5j6
    Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
    https://osv.dev/vulnerability/EEF-CVE-2026-92103

  mint 1.10.0 - EEF-CVE-2026-82672 (MEDIUM)
    aka: CVE-2026-82672, GHSA-rj5m-69wp-cxq9
    Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
    https://osv.dev/vulnerability/EEF-CVE-2026-82672

  mint 1.10.0 - EEF-CVE-2026-91043 (HIGH)
    aka: CVE-2026-91043, GHSA-9x8p-qrf4-jq7g
    HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
    https://osv.dev/vulnerability/EEF-CVE-2026-91043

  mint 1.10.0 - EEF-CVE-2026-94194 (MEDIUM)
    aka: CVE-2026-94194, GHSA-gvrc-75rc-7gj9
    Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
    https://osv.dev/vulnerability/EEF-CVE-2026-94194
 2026-10-21 11:27:55 +02:00
Phantasm
b4a3e8436d
 		Sec: Update bandit to version 1.13.1 
Fixes:
  bandit 1.12.5 - EEF-CVE-2026-105659 (HIGH)
    aka: CVE-2026-105659, GHSA-69m6-wcv4-rwcf
    HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105659

  bandit 1.12.5 - EEF-CVE-2026-105660 (MEDIUM)
    aka: CVE-2026-105660, GHSA-v53v-9hvg-37jf
    Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105660
 2026-10-21 11:27:55 +02:00
Phantasm
235435fc9b
 		Sec: Bump gun to version 2.7.0 and cowlib to version 2.21.0 
Fixes:
  cowlib 2.20.0 - EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

  cowlib 2.20.0 - EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
 2026-10-21 11:27:55 +02:00
Phantasm
bde6bc91a4
 		Sec: Bump castore to version 1.0.22 
eMudhra Intermediate CA Compromise
 2026-10-20 23:46:45 +02:00
Phantasm
687fa6e1b2 Merge pull request 'Docs: Clarify that mise builds Erlang from source on Debian' (#8000) from fix-new-elixir-erlang-docs into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/8000
 2026-10-04 19:25:25 +00:00
Phantasm
0421e8b2e3
 		Docs New Elixir/Erlang: Clarify that mise builds Erlang on Debian 2026-10-04 21:20:19 +02:00
Phantasm
1659fd99d3
 		Docs: Add missing curl dependency for asdf 2026-10-04 21:18:13 +02:00
Phantasm
cfeca7f7af Merge pull request 'Deps: Bump captcha version' (#7996) from captcha-ver-bump into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7996
 2026-09-30 13:34:44 +00:00
Phantasm
9c76e0686a
 		Deps: Bump captcha version 
Fixes build on OpenBSD and FreeBSD
 2026-09-30 15:21:25 +02:00
Phantasm
1afc236468 Merge pull request 'Docs: Bump maximum datasize limit and mention cap_mkdb when creating login class' (#7995) from openbsd-bump-datasize into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7995
 2026-09-29 08:45:42 +00:00
Phantasm
62d4258d79
 		Docs OpenBSD: Mention running cap_mkdb after making new login class 2026-09-29 10:44:10 +02:00
Phantasm
4515f9139c
 		Docs OpenBSD: Bump recommended datasize login.conf limit 
Under OpenBSD datasize not only includes allocated memory using malloc,
but also anonymous memory mapped via mmap.
 2026-09-29 10:44:03 +02:00
Phantasm
5a4cffbb62 Merge pull request 'Docs: Guide on installing newer versions of Elixir/Erlang than what distro ships' (#7992) from erlang-elixir-install-docs into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7992
 2026-09-24 18:14:21 +00:00
Phantasm
62b6a24d5d Docs: move paragraph 2026-09-24 20:11:38 +02:00
Phantasm
0061f62355 Docs Newer Elixir/Erlang guide: Recommend upgrading OS release instead 2026-09-24 20:11:38 +02:00
Phantasm
775ae5d504 Docs New Elixir/Erlang versions install: Add maintenance chapter 2026-09-24 20:01:55 +02:00
Phantasm
f61cf55676
 		Docs: Add newer Elixir/Erlang versions installation documentation 
Also splits generic dependencies into elixir/erlang and the rest.
Generic depenencies then import the elixir/erlang snippets to preserve
previous layout.
 2026-09-22 22:44:20 +02:00
lain
b68f13b959 Merge pull request 'Woodpecker CI: Pass API deployment parameters separately' (#7990) from fix/woodpecker-trigger-params into develop 2026-09-09 12:18:37 +00:00
Lain Soykaf
239ae3403b
 		fix(ci): pass API deployment parameters separately 2026-09-09 15:55:18 +04:00
lain
c023727ecd Merge pull request 'Woodpecker CI: Remake docs building pipelines' (#7928) from woodpecker-ci-docs into develop 2026-09-09 11:01:35 +00:00
Lain Soykaf
fd1b15dd58
 		fix(ci): isolate API documentation channels 2026-09-09 13:21:07 +04:00
Phantasm
d6a5dd2b76
 		Bump minimum Elixir version to 1.17. 
Multiple dependencies require OTP27 and 1.17 is the oldest version
supporting it. Also bumps Docker Erlang version to current newest 27.
 2026-09-08 22:39:36 +02:00
Phantasm
72d45a9f8b
 		Merge branch 'develop' into audit-mix-audit-report 2026-09-08 21:58:23 +02:00
Phantasm
760daad8ef
 		Sec: Bump swoosh to version 1.28.0 
Fixes:
  swoosh 1.16.12 VULNERABLE!
    EEF-CVE-2026-54893 (LOW)
    aka: CVE-2026-54893, GHSA-754j-98wh-57rf
    Email-derived URL path injection in the Swoosh Microsoft Graph adapter
    https://osv.dev/vulnerability/EEF-CVE-2026-54893
 2026-09-08 21:53:55 +02:00
Phantasm
47629351f0
 		Sec: Bump mint to version 1.10.0 
Fixes:
  mint 1.9.3 - EEF-CVE-2026-82729 (MEDIUM)
    aka: CVE-2026-82729, GHSA-7p8w-j234-7qc8
    Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-82729

  mint 1.9.3 - EEF-CVE-2026-82728 (HIGH)
    aka: CVE-2026-82728, GHSA-g83f-2j6r-q6m4
    Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-82728
 2026-09-08 21:53:48 +02:00
Phantasm
bad04ab482
 		Sec: Bump cowboy to version 2.19.0 
Fixes:
  cowboy 2.16.1 - EEF-CVE-2026-65624 (MEDIUM)
    aka: CVE-2026-65624
    Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
    https://osv.dev/vulnerability/EEF-CVE-2026-65624
 2026-09-08 21:43:05 +02:00
Phantasm
92b8fba3e3
 		Sec: Bump cowlib to 2.20.0 and gun to 2.6.0 
Fixes:
  cowlib:
    EEF-CVE-2026-43971 (MEDIUM)
    aka: CVE-2026-43971
    Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43971

    EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

    EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
  gun:
    GHSA-w4f7-4cxr-rv3c (MEDIUM)
    aka: CVE-2026-43966, EEF-CVE-2026-43966
    cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
    https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c
 2026-09-08 21:38:55 +02:00
Phantasm
770d827b50
 		Sec: Bump bandit to version 1.12.5 
Fixes:
- EEF-CVE-2026-74836 (HIGH)
  aka: CVE-2026-74836, GHSA-xj8g-532w-jv94
  HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-74836

- EEF-CVE-2026-75484 (MEDIUM)
  aka: CVE-2026-75484, GHSA-x3gh-xhj4-3vq8
  HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-75484
 2026-09-08 21:28:37 +02:00
Phantasm
b3f95adfb7 Merge pull request 'CI: Fix failing OTP builds, switch to mirrored Woodpecker multi-arch manifest plugin' (#7989) from wpc-ci-bump into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7989
 2026-09-08 11:54:49 +00:00
Phantasm
b3007be961
 		Woodpecker CI: Update Docker multi-arch plugin, fix commit sha mangling 
149236e468 would become 1.49236e+09 when passed to the plugin due to
YAML's type coercion (string of a float in scientific -> float).
 2026-09-08 13:18:36 +02:00
Phantasm
ef011bb8f9
 		Woodpecker CI: Ignore failure to stop for services 2026-09-08 13:17:55 +02:00
Phantasm
5452e3f73e
 		Fix indentation 2026-09-05 21:25:28 +02:00
Phantasm
a881ffe8c2
 		Woodpecker CI API spec: Update Elixir image to an existing one 
Switches from hexpm/elixir-amd64 to hexpm/elixir.
 2026-09-05 21:24:35 +02:00
Phantasm
c978fe0b7b
 		CI: Bump Gitea Package plugin version 2026-09-05 21:24:35 +02:00
Phantasm
a050b00898
 		Woodpecker CI Docs: Also build docs for develop branch 2026-09-05 21:24:17 +02:00
Phantasm
d549b98f8b
 		changelog 2026-09-05 20:48:56 +02:00
Phantasm
e35dacf9f9
 		Woodpecker CI: pass branch to triggered docs workflows 2026-09-05 20:48:56 +02:00
Phantasm
71104db3f6
 		Woodpecker CI: Deploy docs on stable tag 2026-09-05 20:48:55 +02:00
Phantasm
c596ace9df
 		Woodpecker CI: Build API specs again 2026-09-05 20:48:55 +02:00
Phantasm
0e1315099f
 		changelog 2026-09-05 00:47:27 +02:00
Phantasm
407db6c118
 		CI: Update Gitea Package plugin to 0.5.1 2026-09-05 00:14:19 +02:00
Phantasm
5a7635b943
 		CI OTP: Update elixir images, switch to hexpm/elixir except armv7 2026-09-05 00:14:19 +02:00