hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
18,250 commits 2 branches 0 tags 250 MiB
Commit graph

18,250 commits

This branch
This branch
All branches
Author SHA1 Message Date
Phantasm
bad04ab482
 		Sec: Bump cowboy to version 2.19.0 
Fixes:
  cowboy 2.16.1 - EEF-CVE-2026-65624 (MEDIUM)
    aka: CVE-2026-65624
    Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
    https://osv.dev/vulnerability/EEF-CVE-2026-65624
 2026-09-08 21:43:05 +02:00
Phantasm
92b8fba3e3
 		Sec: Bump cowlib to 2.20.0 and gun to 2.6.0 
Fixes:
  cowlib:
    EEF-CVE-2026-43971 (MEDIUM)
    aka: CVE-2026-43971
    Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43971

    EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

    EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
  gun:
    GHSA-w4f7-4cxr-rv3c (MEDIUM)
    aka: CVE-2026-43966, EEF-CVE-2026-43966
    cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
    https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c
 2026-09-08 21:38:55 +02:00
Phantasm
770d827b50
 		Sec: Bump bandit to version 1.12.5 
Fixes:
- EEF-CVE-2026-74836 (HIGH)
  aka: CVE-2026-74836, GHSA-xj8g-532w-jv94
  HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-74836

- EEF-CVE-2026-75484 (MEDIUM)
  aka: CVE-2026-75484, GHSA-x3gh-xhj4-3vq8
  HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-75484
 2026-09-08 21:28:37 +02:00
Phantasm
45459c8398
 		Merge branch 'develop' into audit-mix-audit-report 2026-08-19 22:20:55 +02:00
Phantasm
5709531197
 		Sec: Bump Phoenix LiveView to 1.2.9 
Technically 1.1.33 would also do...

Also updates:
  phoenix_pubsub 2.1.3 => 2.2.0
  ranch 2.2.0 => 2.2.1
  websock_adapter 0.5.8 => 0.5.9
 2026-08-19 22:08:21 +02:00
Phantasm
c4ca9b41ad
 		Sec: Bump Phoenix to version 1.8.11 2026-08-19 22:08:20 +02:00
Phantasm
39d5648447
 		Sec: Bump bandit to 1.12.4 
Also bumps:
  plug 1.20.2 => 1.20.3
  plug_crypto 2.1.1 => 2.2.0
  thousand_island 1.4.3 => 1.5.0
 2026-08-19 22:07:22 +02:00
Phantasm
71cb70cd01
 		Sec: Bump postgrex to 0.22.4 2026-08-19 22:06:26 +02:00
Phantasm
124f4ece1d Merge pull request 'Syslog: set runtime: false to fix OTP releases' (#7966) from syslog-fix-otp into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7966
 2026-08-18 20:47:55 +00:00
Phantasm
59042e2793
 		Syslog: set runtime: false to fix OTP releases 
The syslog package is not directly part of the runtime.
 2026-08-18 21:41:48 +02:00
Phantasm
0e642d4c90 Merge pull request 'Syslog: Fix intermittent failure to compile due to old pc version' (#7965) from syslog-pc-fix into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7965
 2026-08-18 18:53:17 +00:00
Phantasm
16890c051a
 		Syslog: Fix intermittent failure to compile due to old pc version 
Upstream hasn't made a release with the fix, pin fixed commit
for the time being.
 2026-08-18 19:54:42 +02:00
Phantasm
3ecfe034d7 Merge pull request 'Oban: Enable Reindexer plugin to reduce oban_jobs index DB bloat' (#7964) from oban-reindex-cron into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7964
 2026-08-18 17:51:30 +00:00
Phantasm
6a5ca6213a
 		Oban: Enable Reindexer plugin to reduce oban_jobs index DB bloat 2026-08-18 19:29:00 +02:00
Phantasm
48d6e9476b Merge pull request 'Revert "Merge pull request 'MediaProxy: detect images when there's no file extension' (#7933) from mediaproxy-content-type into develop"' (#7959) from revert-7933 into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7959
 2026-08-14 20:24:56 +00:00
Phantasm
96d69bfa0a Merge pull request 'Docs: Fix OTP install links left behind during migration, broke up wall of install commands in OTP guides' (#7960) from fix-otp-guide-links into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7960
 2026-08-13 22:01:27 +00:00
Phantasm
5ecc936444
 		Docs: split wall of install commands, fix downloading OTP bundle 
Bundle could not be downloaded, because sudo does not cope with the
previous syntax that double quoted the whole command, and the download
link was single quoted.
 2026-08-13 23:52:06 +02:00
Phantasm
2dda6cb52a
 		Docs: Update OTP bundle links left behind in the Forgejo migration 2026-08-13 23:26:44 +02:00
Phantasm
f672ab337c
 		Revert "Merge pull request 'MediaProxy: detect images when there's no file extension' (#7933) from mediaproxy-content-type into develop" 
A partial revert, keeping the updated @inline_content_types list and
cosmetic changes.

This reverts commit 4fe567064a, reversing
changes made to 9b8aa2e2ee.
 2026-08-13 22:02:11 +02:00
Lain Soykaf
656191bd1e
 		fix(deps): use released Hackney 4.7.3 2026-08-11 14:16:59 +04:00
nicole mikołajczyk
ad7f68b924 Merge pull request 'Embed notificaiton details for grouped move/reaction/chat/report notification' (#7954) from mkljczk/pleroma:grouped-notifs-embed into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7954
 2026-08-03 14:07:32 +00:00
nicole mikołajczyk
2876fed876 Embed notificaiton details for grouped move/reaction/chat/report notification 
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
 2026-08-02 22:13:31 +02:00
lain
f53342775d Merge pull request 'Add rollback migrations for Rebased' (#7685) from gitlab-mr-iid-4308 into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7685
 2026-07-29 12:31:25 +00:00
Lain Soykaf
478b021fbe
 		fix(migrations): make Rebased rollback safe 2026-07-29 15:22:13 +04:00
nicole mikołajczyk
e1e853e8f7
 		Remove migration merged upstream 
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
 2026-07-29 15:22:13 +04:00
mkljczk
2e59dcb9f6
 		style 
Signed-off-by: mkljczk <git@mkljczk.pl>
 2026-07-29 15:22:13 +04:00
mkljczk
e516c43411
 		Add docs for Rebased migration 
Signed-off-by: mkljczk <git@mkljczk.pl>
 2026-07-29 15:22:13 +04:00
mkljczk
253bbb80f5
 		Add rollback migrations for Rebased 
Signed-off-by: mkljczk <git@mkljczk.pl>
 2026-07-29 15:22:13 +04:00
lain
e143e645d3 Merge pull request 'OpenRC: Automatically run migrations before starting pleroma' (#7680) from gitlab-mr-iid-4303 into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7680
 2026-07-29 11:07:32 +00:00
Lain Soykaf
8943ab8140
 		fix(openrc): preserve migration execution context 2026-07-29 15:02:16 +04:00
lain
1dd6a345bf Merge pull request 'Respect activity restrictions in account statuses' (#7943) from mkljczk/pleroma:issue-2604-restrict-account-statuses into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7943
 2026-07-29 06:44:26 +00:00
Lain Soykaf
4a47a756be
 		fix(mastodon-api): optimize account status restrictions 2026-07-28 16:01:48 +04:00
nicole mikołajczyk
1bb5eca063 Merge pull request 'Fix typo in spec' (#7947) from mkljczk/pleroma:typo into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7947
 2026-07-28 10:41:05 +00:00
nicole mikołajczyk
5c85dadb29 Fix typo in spec 
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
 2026-07-28 01:06:00 +02:00
lain
a45eb365ed Merge pull request 'Abort incomplete media proxy responses' (#7946) from lambadalambda/pleroma:fix/media-proxy-truncated-cache into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7946
 2026-07-27 15:08:06 +00:00
lain
a22062a224 Merge pull request 'OAuth App: Fix test, optimize code.' (#7692) from gitlab-mr-iid-4315 into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7692
 2026-07-27 14:42:53 +00:00
Lain Soykaf
bc999b3309
 		fix(media-proxy): abort truncated streams 2026-07-27 16:32:44 +04:00
lain
16581a2f6d Merge pull request 'Update Debian and Ubuntu installation requirements' (#7806) from gitlab-mr-iid-4429 into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7806
 2026-07-27 12:16:12 +00:00
Lain Soykaf
be5a3957b2
 		docs: explain libvips dependency 2026-07-27 16:12:21 +04:00
Lain Soykaf
3b71770cfa
 		docs: update Debian and Ubuntu requirements 2026-07-27 15:31:59 +04:00
Lain Soykaf
030c7e929c
 		style(oauth): use single alias directives 2026-07-27 12:14:58 +04:00
Lain Soykaf
d30d205f0b
 		fix(oauth): preserve dependent app cleanup 2026-07-27 11:57:16 +04:00
Lain Soykaf
b4c624911c
 		Merge branch 'develop' into gitlab-mr-iid-4315 2026-07-27 11:34:31 +04:00
lain
8ab0e046b1 Merge pull request 'Allow creating accounts without a password in the AdminAPI, update docs' (#7937) from mkljczk/pleroma:admin-api-passwordless-user-creation into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7937
 2026-07-27 07:17:14 +00:00
Phantasm
ea49ad121e Merge pull request 'Fix missing readme logo' (#7945) from readme-logo-fix into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7945
 2026-07-26 19:18:24 +00:00
Phantasm
6132c9e88a
 		Fix missing readme logo 2026-07-26 21:14:29 +02:00
Lain Soykaf
2b32e3cf1f
 		fix(mastodon-api): restrict unauthenticated account statuses 2026-07-26 18:12:49 +04:00
lain
fd2074a30d Merge pull request 'Mastodon-compatible webhooks' (#7844) from mkljczk/pleroma:webhooks into develop 2026-07-26 13:10:48 +00:00
Lain Soykaf
03e75d3b3e
 		fix(webhooks): merge develop and harden delivery 2026-07-26 17:00:14 +04:00
lain
b9ef1e2182 Merge pull request 'Restore preview cards tests and update their OpenAPI description' (#7444) from gitlab-mr-iid-4067 into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7444
 2026-07-26 10:32:26 +00:00