Commit graph

479 commits

Author SHA1 Message Date
Phantasm
770d827b50
Sec: Bump bandit to version 1.12.5
Fixes:
- EEF-CVE-2026-74836 (HIGH)
  aka: CVE-2026-74836, GHSA-xj8g-532w-jv94
  HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-74836

- EEF-CVE-2026-75484 (MEDIUM)
  aka: CVE-2026-75484, GHSA-x3gh-xhj4-3vq8
  HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-75484
2026-09-08 21:28:37 +02:00
Phantasm
45459c8398
Merge branch 'develop' into audit-mix-audit-report 2026-08-19 22:20:55 +02:00
Phantasm
5709531197
Sec: Bump Phoenix LiveView to 1.2.9
Technically 1.1.33 would also do...

Also updates:
  phoenix_pubsub 2.1.3 => 2.2.0
  ranch 2.2.0 => 2.2.1
  websock_adapter 0.5.8 => 0.5.9
2026-08-19 22:08:21 +02:00
Phantasm
c4ca9b41ad
Sec: Bump Phoenix to version 1.8.11 2026-08-19 22:08:20 +02:00
Phantasm
39d5648447
Sec: Bump bandit to 1.12.4
Also bumps:
  plug 1.20.2 => 1.20.3
  plug_crypto 2.1.1 => 2.2.0
  thousand_island 1.4.3 => 1.5.0
2026-08-19 22:07:22 +02:00
Phantasm
71cb70cd01
Sec: Bump postgrex to 0.22.4 2026-08-19 22:06:26 +02:00
Phantasm
16890c051a
Syslog: Fix intermittent failure to compile due to old pc version
Upstream hasn't made a release with the fix, pin fixed commit
for the time being.
2026-08-18 19:54:42 +02:00
Lain Soykaf
656191bd1e
fix(deps): use released Hackney 4.7.3 2026-08-11 14:16:59 +04:00
Lain Soykaf
42c100605e
fix(deps): pin Hackney to the connection-leak fix
An unpooled Hackney 4 connection that ends without a reusable socket -- a
body cut short by the peer, a bodyless 204/304, or a failed read -- parks
in its `closed` state forever, holding every refc binary it read.
read_full_body/2 hands back `socket = undefined`, so it never reaches the
reuse check; `closed(enter)` arms a stop timer only for pooled
connections; and an unpooled connection is owned by hackney_conn_sup, so
the owner-DOWN cleanup never fires.

Nothing here can work around it. Since 4.0 Hackney ignores `with_body`
and always returns a fully read binary, so a synchronous request never
yields a handle to close, and the short read still reports {:ok, body}.
Media proxy warming hits this whenever an attachment fetch is cut short
and the outbound proxy is used as a CONNECT tunnel, since tunnels are
never pooled.

Pin the fix, a single commit on top of the 4.7.2 tag, until it ships in a
release. While it is a git dep Hackney drops out of `mix deps.audit` and
`mix hex.outdated`, so this wants moving back to hex promptly.

benoitc/hackney#918, benoitc/hackney#919
2026-07-26 10:15:52 +04:00
Lain Soykaf
7d1cc56a78
Merge remote-tracking branch 'origin/develop' into audit-mix-audit-report
Conflict resolution notes:

- mix.lock: kept this branch's versions for cowlib, h2, hackney and hpax.
  Those upgrades are the point of the branch; develop is still on hackney
  1.20.1.

- .woodpecker/docker-armv7.yaml: accepted develop's deletion. It only
  existed here to build mdex_native on armv7, and mdex was already
  replaced with earmark again.

- lib/pleroma/reverse_proxy.ex: took develop's version. It independently
  grew request_with_constraints/5 and the invalid-status close, which
  supersede the equivalent fixes on this branch. Re-applied this branch's
  recv_timeout seeding, which develop does not have.

- lib/pleroma/gun/connection_pool/worker.ex and
  lib/pleroma/reverse_proxy/client/tesla.ex: took develop's versions. The
  gun pool rework (#7934) already guards the demonitor and makes
  release_conn/cancel_stream exit-safe, and it splits the Tesla client's
  graceful release from its abort path, so this branch's changes there are
  obsolete.

That leaves the client leak fix as a Hackney-only concern, which
stream_body/1 now handles the same way the gun client does.
2026-07-25 19:54:48 +04:00
Lain Soykaf
bf477c1a53
fix(deps): replace mdex with earmark parser 2026-07-23 13:02:28 +04:00
Lain Soykaf
77a7ba3a0e
fix(http): harden Hackney request lifecycle 2026-07-22 16:18:04 +04:00
Lain Soykaf
e6598ae5c7
fix(ci): build mdex native on armv7 2026-07-21 21:23:18 +04:00
Lain Soykaf
b862254889
fix(deps): update Gun to 2.4.1 2026-07-17 21:09:13 +04:00
Lain Soykaf
9154f6fe3c
fix(deps): replace earmark with mdex 2026-07-02 11:31:54 +04:00
Lain Soykaf
a96fb31a89
fix(deps): update hackney 2026-07-02 10:57:12 +04:00
Lain Soykaf
28d7ac3a43
fix(deps): update decimal 2026-07-02 10:50:20 +04:00
Lain Soykaf
ab49f00090
chore(deps): update jason 2026-07-02 10:48:06 +04:00
Lain Soykaf
604e2ad849
fix(deps): remove unused quic lock 2026-07-02 10:40:53 +04:00
Lain Soykaf
d964737d75
fix(deps): update postgrex 2026-07-02 10:39:34 +04:00
Lain Soykaf
dc28528588
fix(deps): update cowboy 2026-07-02 10:36:53 +04:00
Lain Soykaf
eae1311bc2
fix(deps): update cowlib 2026-07-02 10:35:41 +04:00
Lain Soykaf
4d1044e2d1
fix(deps): update plug_cowboy 2026-07-02 10:33:50 +04:00
Lain Soykaf
dcc5a33f4d
fix(deps): update phoenix 2026-07-02 10:31:34 +04:00
Lain Soykaf
f6cc4c144b
fix(deps): update plug 2026-07-02 10:27:21 +04:00
Lain Soykaf
fa7986a267
fix(deps): update bandit 2026-07-02 10:26:12 +04:00
Lain Soykaf
7e54b0935b
chore(deps): add mix audit 2026-07-02 10:20:59 +04:00
lain
c7c453ca21 Merge branch 'develop' into gitlab-mr-iid-4426 2026-05-14 06:56:57 +00:00
Lain Soykaf
512b0f67a4
Merge remote-tracking branch 'origin/develop' into issue-3314-remote-ip-hex
# Conflicts:
#	mix.exs
2026-05-14 09:27:18 +04:00
Lain Soykaf
7ab9e2c7ce
Use pleroma_captcha Hex package 2026-05-13 23:05:25 +04:00
Lain Soykaf
c92d233233
Use upstream remote_ip package 2026-05-13 20:04:12 +04:00
Lain Soykaf
d0c2d04356
Use Hex release for oban_plugins_lazarus 2026-05-13 19:10:15 +04:00
Lain Soykaf
d8e3ea69b1
Use Hex release for majic 1.2.0 2026-05-13 19:00:16 +04:00
Lain Soykaf
9e16332d9d
Update majic to 1.2.0 2026-05-13 18:39:40 +04:00
lain
8e72f4cd17 Merge branch 'develop' into gitlab-mr-iid-4426 2026-05-11 18:16:12 +00:00
Lain Soykaf
216a00f73f
Merge develop into Phoenix upstream migration 2026-05-11 22:13:46 +04:00
Lain Soykaf
61feb3dfcd
Update http_signatures to 0.1.3 2026-05-11 21:01:59 +04:00
Lain Soykaf
592be493c8
Use published Pleroma MFM parser package 2026-05-11 19:13:01 +04:00
Lain Soykaf
6b86e31e5d
Add backend MFM support 2026-05-11 14:53:06 +04:00
feld
683ab39160 Merge pull request 'Downgrade Hackney' (#7860) from hackney-downgrade into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7860
2026-04-08 19:29:50 +00:00
Mark Felder
7582b71f46 Downgrade Hackney to 1.20.1, before connection performance regressions
It appears the implementation of Happy Eyeballs in 1.22.0 is the origin of
some pretty serious performance regressions that remain even in the latest
Hackney 3.0 branch.

Connection tests:

=== 1.22.0 ===
First call:  9434ms
Second call: 14ms

=== 1.21.0 ===
First call:  228ms
Second call: 16ms

We went back further to 1.20.1 though because of reported problems with the mail
client and ssl_options. That bug was not reproduced by a dev, though, but we'll
trust it for now.
2026-04-08 12:27:47 -07:00
Mark Felder
00265751cc Update Bandit 2026-04-03 13:22:12 -07:00
Haelwenn (lanodan) Monnier
be327ca982
Switch Phoenix back to upstream
See <https://github.com/phoenixframework/phoenix/pull/6094>
for `:sec_websocket_protocol` -> `:sec_websocket_headers`
2026-01-18 10:40:10 +01:00
Lain Soykaf
346014b897 Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into revert-d6888e24 2026-01-16 22:43:10 +04:00
Haelwenn (lanodan) Monnier
05704ec86e
mix: upgrade vix from "~> 0.26.0" to "~> 0.36"
Dropping the last zero should allow to get 0.x updates rather
than only 0.36.x updates.

Fixes: https://git.pleroma.social/pleroma/pleroma/-/issues/3393
2026-01-14 03:11:37 +01:00
Phantasm
e671ca2554
Add Oban Web and upgrade LiveView, plug 2026-01-07 20:41:56 +01:00
lain
e091349718 Revert "Merge branch 'revert-cdd6df06' into 'develop'"
This reverts merge request !4411
2025-12-26 05:08:52 +00:00
lain
23cb42a436 Revert "Merge branch 'hackney-bump' into 'develop'"
This reverts merge request !4409
2025-12-26 05:07:51 +00:00
Mark Felder
3f9466e3a9 Update Hackney, the default HTTP client, to the latest release which supports Happy Eyeballs for improved IPv6 federation 2025-12-23 11:44:21 -08:00
Lain Soykaf
8428a1bed3 Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into lazarus 2025-08-27 11:43:32 +04:00