hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
18,255 commits 2 branches 0 tags 250 MiB
Commit graph

10,680 commits

Author SHA1 Message Date
Lain Soykaf
65076aa2f8
 		fix(http): reject Hackney's certifi partial chains 
Hackney 4 merges given ssl_options into its defaults and keeps its own
partial_chain, which trusts any certificate in the peer chain that is in
certifi. A peer could send the emSign ECC Root CA - G3 root in its chain
and pass. Set partial_chain so certifi is never a trust anchor.
 2026-10-22 10:05:12 +04:00
Lain Soykaf
92a112cf15
 		fix(mailer): drop the TLS 1.2 pin 
The pin worked around a TLS 1.3 problem with Hackney on OTP 23
(swoosh/swoosh#478). Pleroma no longer supports OTP 23.
 2026-10-22 08:48:56 +04:00
Lain Soykaf
f4ff7cb1ea
 		fix(http): make Finch trust the CAStore bundle 
Mint trusts the OTP CA store, which comes from the OS. Load the CAStore
bundle into it when Finch starts, so Finch trusts the same roots as the
other adapters.
 2026-10-21 08:27:30 +04:00
Lain Soykaf
830455d197
 		fix(mailer): keep certificate checks for Swoosh HTTP adapters 
The TLS version override replaced all Hackney TLS defaults. On OTP 26+
this fails with cacerts: :undefined; on older OTP it skipped certificate
checks. Closes #7962 on the public tracker.
 2026-10-21 08:27:30 +04:00
Lain Soykaf
d8c880e494
 		fix(http): make Hackney trust the CAStore bundle 
Hackney trusts its own certifi bundle, which still has the roots of the
compromised eMudhra intermediate CAs. Pass explicit ssl_options with the
CAStore bundle. Hackney drops all its TLS defaults when ssl_options are
given, so keep peer and hostname checks in the options.
 2026-10-21 08:21:43 +04:00
Phantasm
820e80bdc7
 		IdempotencyPlug: Fix private function name typo 2026-09-03 00:07:25 +02:00
lain
70d743bff9 Merge branch 'develop' into fix/domain-block-subplan-cost 2026-09-02 10:19:27 +00:00
Lain Soykaf
635bc19ac8
 		fix(notifications): cost the followed-accounts subselect once 
Wrap the followed ap_ids subselect in keep_following_or_not_domain_blocked
in ARRAY(...) so it becomes an InitPlan. As a plain subselect the planner
charged its startup per rescan of the actor lookup, which could make
Notification.for_user pick a plan that scans every active user per row.
 2026-09-02 13:42:48 +04:00
Phantasm
f672ab337c
 		Revert "Merge pull request 'MediaProxy: detect images when there's no file extension' (#7933) from mediaproxy-content-type into develop" 
A partial revert, keeping the updated @inline_content_types list and
cosmetic changes.

This reverts commit 4fe567064a, reversing
changes made to 9b8aa2e2ee.
 2026-08-13 22:02:11 +02:00
nicole mikołajczyk
2876fed876 Embed notificaiton details for grouped move/reaction/chat/report notification 
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
 2026-08-02 22:13:31 +02:00
lain
1dd6a345bf Merge pull request 'Respect activity restrictions in account statuses' (#7943) from mkljczk/pleroma:issue-2604-restrict-account-statuses into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7943
 2026-07-29 06:44:26 +00:00
Lain Soykaf
4a47a756be
 		fix(mastodon-api): optimize account status restrictions 2026-07-28 16:01:48 +04:00
nicole mikołajczyk
5c85dadb29 Fix typo in spec 
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
 2026-07-28 01:06:00 +02:00
lain
a45eb365ed Merge pull request 'Abort incomplete media proxy responses' (#7946) from lambadalambda/pleroma:fix/media-proxy-truncated-cache into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7946
 2026-07-27 15:08:06 +00:00
Lain Soykaf
bc999b3309
 		fix(media-proxy): abort truncated streams 2026-07-27 16:32:44 +04:00
Lain Soykaf
030c7e929c
 		style(oauth): use single alias directives 2026-07-27 12:14:58 +04:00
Lain Soykaf
d30d205f0b
 		fix(oauth): preserve dependent app cleanup 2026-07-27 11:57:16 +04:00
Lain Soykaf
b4c624911c
 		Merge branch 'develop' into gitlab-mr-iid-4315 2026-07-27 11:34:31 +04:00
lain
8ab0e046b1 Merge pull request 'Allow creating accounts without a password in the AdminAPI, update docs' (#7937) from mkljczk/pleroma:admin-api-passwordless-user-creation into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7937
 2026-07-27 07:17:14 +00:00
Lain Soykaf
2b32e3cf1f
 		fix(mastodon-api): restrict unauthenticated account statuses 2026-07-26 18:12:49 +04:00
Lain Soykaf
03e75d3b3e
 		fix(webhooks): merge develop and harden delivery 2026-07-26 17:00:14 +04:00
lain
b9ef1e2182 Merge pull request 'Restore preview cards tests and update their OpenAPI description' (#7444) from gitlab-mr-iid-4067 into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7444
 2026-07-26 10:32:26 +00:00
lain
e210e16a37 Merge pull request 'MastoAPI: /api/{v1,v2}/admin/accounts, /api/v1/admin/reports' (#7842) from mkljczk/pleroma:mastodon-admin-api into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7842
 2026-07-26 10:06:01 +00:00
Lain Soykaf
842e6bcaff
 		Merge remote-tracking branch 'origin/develop' into pr-7444-finish 2026-07-26 13:56:09 +04:00
Lain Soykaf
c591ca518c
 		fix(mastodon-api): finish preview card compatibility 2026-07-26 13:55:57 +04:00
Lain Soykaf
458a15bf9f
 		fix(mastodon-api): harden admin moderation actions 2026-07-26 13:24:03 +04:00
Lain Soykaf
7a741736ea
 		Merge remote-tracking branch 'origin/develop' into pr-7444-finish 2026-07-26 13:20:50 +04:00
lain
3c916891f6 Merge branch 'develop' into paradedb-search-backend 2026-07-26 09:15:42 +00:00
lain
a5aad47cff Merge branch 'develop' into mastodon-admin-api 2026-07-26 08:52:01 +00:00
lain
d115b41848 Merge pull request 'Reject unsupported HTTP Message Signatures' (#7918) from activitypub-bot-federation into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7918
 2026-07-26 08:50:16 +00:00
lain
f5dd75b1a3 Merge branch 'develop' into activitypub-bot-federation 2026-07-26 08:36:46 +00:00
Lain Soykaf
ce5c1b4c15
 		fix(activitypub): harden object normalization 2026-07-26 12:35:09 +04:00
Lain Soykaf
9df50eea82
 		fix: reject duplicate Signature headers 2026-07-26 12:26:35 +04:00
Lain Soykaf
13c944a04b
 		fix(search): index remote attachment descriptions 2026-07-26 12:03:24 +04:00
Lain Soykaf
271c3a3dd8
 		fix(config): keep search startup settings static 2026-07-26 11:58:31 +04:00
Lain Soykaf
acc44a5b6f
 		Merge remote-tracking branch 'origin/develop' into pr-7805-finish 2026-07-26 11:55:01 +04:00
lain
51349f61f8 Merge branch 'develop' into mastodon-admin-api 2026-07-26 07:46:55 +00:00
Lain Soykaf
91089c93ad
 		feat(search): add resumable runtime backfill 2026-07-26 11:38:24 +04:00
Lain Soykaf
a9862dcaa0
 		chore: merge develop into ParadeDB backend 2026-07-26 11:24:37 +04:00
Lain Soykaf
99befcaf1b
 		fix(activitypub): deduplicate account favourites 2026-07-25 10:51:09 +04:00
Lain Soykaf
9a6c2f909d
 		Merge remote-tracking branch 'origin/develop' into issue-3379-favourites-order 2026-07-25 10:31:57 +04:00
lain
cc1b95c88e Merge pull request 'Rework Gun connection pooling' (#7934) from issue-2263-gun-validation into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7934
 2026-07-25 05:44:39 +00:00
Lain Soykaf
d5f48101b8
 		fix(media-proxy): safely detect extensionless images 2026-07-25 00:06:03 +04:00
Lain Soykaf
bb4826d8ae
 		fix(admin-api): structure reset token failures 2026-07-24 23:24:52 +04:00
Lain Soykaf
465a81ecf2
 		Merge remote-tracking branch 'origin/develop' into review-pr-7933 2026-07-24 23:24:11 +04:00
Lain Soykaf
d0b5a05075
 		fix(admin-api): confirm created users 2026-07-24 23:14:03 +04:00
Lain Soykaf
836f4a2d69
 		fix(admin-api): reject explicit empty passwords 2026-07-24 22:52:23 +04:00
Lain Soykaf
3b3aad6065
 		fix(api): isolate sensitive idempotency responses 2026-07-24 22:45:50 +04:00
Lain Soykaf
d57fdcc7b0
 		fix(admin-api): create reset tokens atomically 2026-07-24 22:25:44 +04:00
Lain Soykaf
34d827730a
 		fix(admin-api): preserve user batch validation 2026-07-24 22:15:14 +04:00