hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
18,348 commits 2 branches 0 tags 250 MiB
Commit graph

18,348 commits

This branch
This branch
All branches
Author SHA1 Message Date
Phantasm
cfeca7f7af Merge pull request 'Deps: Bump captcha version' (#7996) from captcha-ver-bump into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7996
 2026-09-30 13:34:44 +00:00
Phantasm
9c76e0686a
 		Deps: Bump captcha version 
Fixes build on OpenBSD and FreeBSD
 2026-09-30 15:21:25 +02:00
Phantasm
1afc236468 Merge pull request 'Docs: Bump maximum datasize limit and mention cap_mkdb when creating login class' (#7995) from openbsd-bump-datasize into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7995
 2026-09-29 08:45:42 +00:00
Phantasm
62d4258d79
 		Docs OpenBSD: Mention running cap_mkdb after making new login class 2026-09-29 10:44:10 +02:00
Phantasm
4515f9139c
 		Docs OpenBSD: Bump recommended datasize login.conf limit 
Under OpenBSD datasize not only includes allocated memory using malloc,
but also anonymous memory mapped via mmap.
 2026-09-29 10:44:03 +02:00
Phantasm
5a4cffbb62 Merge pull request 'Docs: Guide on installing newer versions of Elixir/Erlang than what distro ships' (#7992) from erlang-elixir-install-docs into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7992
 2026-09-24 18:14:21 +00:00
Phantasm
62b6a24d5d Docs: move paragraph 2026-09-24 20:11:38 +02:00
Phantasm
0061f62355 Docs Newer Elixir/Erlang guide: Recommend upgrading OS release instead 2026-09-24 20:11:38 +02:00
Phantasm
775ae5d504 Docs New Elixir/Erlang versions install: Add maintenance chapter 2026-09-24 20:01:55 +02:00
Phantasm
f61cf55676
 		Docs: Add newer Elixir/Erlang versions installation documentation 
Also splits generic dependencies into elixir/erlang and the rest.
Generic depenencies then import the elixir/erlang snippets to preserve
previous layout.
 2026-09-22 22:44:20 +02:00
lain
b68f13b959 Merge pull request 'Woodpecker CI: Pass API deployment parameters separately' (#7990) from fix/woodpecker-trigger-params into develop 2026-09-09 12:18:37 +00:00
Lain Soykaf
239ae3403b
 		fix(ci): pass API deployment parameters separately 2026-09-09 15:55:18 +04:00
lain
c023727ecd Merge pull request 'Woodpecker CI: Remake docs building pipelines' (#7928) from woodpecker-ci-docs into develop 2026-09-09 11:01:35 +00:00
Lain Soykaf
fd1b15dd58
 		fix(ci): isolate API documentation channels 2026-09-09 13:21:07 +04:00
Phantasm
d6a5dd2b76
 		Bump minimum Elixir version to 1.17. 
Multiple dependencies require OTP27 and 1.17 is the oldest version
supporting it. Also bumps Docker Erlang version to current newest 27.
 2026-09-08 22:39:36 +02:00
Phantasm
72d45a9f8b
 		Merge branch 'develop' into audit-mix-audit-report 2026-09-08 21:58:23 +02:00
Phantasm
760daad8ef
 		Sec: Bump swoosh to version 1.28.0 
Fixes:
  swoosh 1.16.12 VULNERABLE!
    EEF-CVE-2026-54893 (LOW)
    aka: CVE-2026-54893, GHSA-754j-98wh-57rf
    Email-derived URL path injection in the Swoosh Microsoft Graph adapter
    https://osv.dev/vulnerability/EEF-CVE-2026-54893
 2026-09-08 21:53:55 +02:00
Phantasm
47629351f0
 		Sec: Bump mint to version 1.10.0 
Fixes:
  mint 1.9.3 - EEF-CVE-2026-82729 (MEDIUM)
    aka: CVE-2026-82729, GHSA-7p8w-j234-7qc8
    Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-82729

  mint 1.9.3 - EEF-CVE-2026-82728 (HIGH)
    aka: CVE-2026-82728, GHSA-g83f-2j6r-q6m4
    Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-82728
 2026-09-08 21:53:48 +02:00
Phantasm
bad04ab482
 		Sec: Bump cowboy to version 2.19.0 
Fixes:
  cowboy 2.16.1 - EEF-CVE-2026-65624 (MEDIUM)
    aka: CVE-2026-65624
    Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
    https://osv.dev/vulnerability/EEF-CVE-2026-65624
 2026-09-08 21:43:05 +02:00
Phantasm
92b8fba3e3
 		Sec: Bump cowlib to 2.20.0 and gun to 2.6.0 
Fixes:
  cowlib:
    EEF-CVE-2026-43971 (MEDIUM)
    aka: CVE-2026-43971
    Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43971

    EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

    EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
  gun:
    GHSA-w4f7-4cxr-rv3c (MEDIUM)
    aka: CVE-2026-43966, EEF-CVE-2026-43966
    cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
    https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c
 2026-09-08 21:38:55 +02:00
Phantasm
770d827b50
 		Sec: Bump bandit to version 1.12.5 
Fixes:
- EEF-CVE-2026-74836 (HIGH)
  aka: CVE-2026-74836, GHSA-xj8g-532w-jv94
  HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-74836

- EEF-CVE-2026-75484 (MEDIUM)
  aka: CVE-2026-75484, GHSA-x3gh-xhj4-3vq8
  HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-75484
 2026-09-08 21:28:37 +02:00
Phantasm
b3f95adfb7 Merge pull request 'CI: Fix failing OTP builds, switch to mirrored Woodpecker multi-arch manifest plugin' (#7989) from wpc-ci-bump into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7989
 2026-09-08 11:54:49 +00:00
Phantasm
b3007be961
 		Woodpecker CI: Update Docker multi-arch plugin, fix commit sha mangling 
149236e468 would become 1.49236e+09 when passed to the plugin due to
YAML's type coercion (string of a float in scientific -> float).
 2026-09-08 13:18:36 +02:00
Phantasm
ef011bb8f9
 		Woodpecker CI: Ignore failure to stop for services 2026-09-08 13:17:55 +02:00
Phantasm
5452e3f73e
 		Fix indentation 2026-09-05 21:25:28 +02:00
Phantasm
a881ffe8c2
 		Woodpecker CI API spec: Update Elixir image to an existing one 
Switches from hexpm/elixir-amd64 to hexpm/elixir.
 2026-09-05 21:24:35 +02:00
Phantasm
c978fe0b7b
 		CI: Bump Gitea Package plugin version 2026-09-05 21:24:35 +02:00
Phantasm
a050b00898
 		Woodpecker CI Docs: Also build docs for develop branch 2026-09-05 21:24:17 +02:00
Phantasm
d549b98f8b
 		changelog 2026-09-05 20:48:56 +02:00
Phantasm
e35dacf9f9
 		Woodpecker CI: pass branch to triggered docs workflows 2026-09-05 20:48:56 +02:00
Phantasm
71104db3f6
 		Woodpecker CI: Deploy docs on stable tag 2026-09-05 20:48:55 +02:00
Phantasm
c596ace9df
 		Woodpecker CI: Build API specs again 2026-09-05 20:48:55 +02:00
Phantasm
0e1315099f
 		changelog 2026-09-05 00:47:27 +02:00
Phantasm
407db6c118
 		CI: Update Gitea Package plugin to 0.5.1 2026-09-05 00:14:19 +02:00
Phantasm
5a7635b943
 		CI OTP: Update elixir images, switch to hexpm/elixir except armv7 2026-09-05 00:14:19 +02:00
Phantasm
21bb1a98a3
 		CI: Update woodpecker Docker multi-arch tagger plugin 
Also moves it to a git.pleroma.social mirror
 2026-09-05 00:14:07 +02:00
Phantasm
149236e468 Merge pull request 'IdempotencyPlug: Fix private function name typo' (#7985) from idempotency-plug-typo into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7985
 2026-09-02 22:31:01 +00:00
Phantasm
820e80bdc7
 		IdempotencyPlug: Fix private function name typo 2026-09-03 00:07:25 +02:00
lain
fa920037f1 Merge pull request 'Fix notification query plan for users with domain blocks' (#7981) from fix/domain-block-subplan-cost into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7981
 2026-09-02 13:41:40 +00:00
lain
70d743bff9 Merge branch 'develop' into fix/domain-block-subplan-cost 2026-09-02 10:19:27 +00:00
Lain Soykaf
635bc19ac8
 		fix(notifications): cost the followed-accounts subselect once 
Wrap the followed ap_ids subselect in keep_following_or_not_domain_blocked
in ARRAY(...) so it becomes an InitPlan. As a plain subselect the planner
charged its startup per rescan of the actor lookup, which could make
Notification.for_user pick a plan that scans every active user per row.
 2026-09-02 13:42:48 +04:00
Mark Felder
9921e802c9 Delete legacy Postgres sequences 
for activities, chats, and users which were converted to Flake IDs
 2026-08-24 14:51:58 -07:00
Phantasm
45459c8398
 		Merge branch 'develop' into audit-mix-audit-report 2026-08-19 22:20:55 +02:00
Phantasm
5709531197
 		Sec: Bump Phoenix LiveView to 1.2.9 
Technically 1.1.33 would also do...

Also updates:
  phoenix_pubsub 2.1.3 => 2.2.0
  ranch 2.2.0 => 2.2.1
  websock_adapter 0.5.8 => 0.5.9
 2026-08-19 22:08:21 +02:00
Phantasm
c4ca9b41ad
 		Sec: Bump Phoenix to version 1.8.11 2026-08-19 22:08:20 +02:00
Phantasm
39d5648447
 		Sec: Bump bandit to 1.12.4 
Also bumps:
  plug 1.20.2 => 1.20.3
  plug_crypto 2.1.1 => 2.2.0
  thousand_island 1.4.3 => 1.5.0
 2026-08-19 22:07:22 +02:00
Phantasm
71cb70cd01
 		Sec: Bump postgrex to 0.22.4 2026-08-19 22:06:26 +02:00
Phantasm
124f4ece1d Merge pull request 'Syslog: set runtime: false to fix OTP releases' (#7966) from syslog-fix-otp into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7966
 2026-08-18 20:47:55 +00:00
Phantasm
59042e2793
 		Syslog: set runtime: false to fix OTP releases 
The syslog package is not directly part of the runtime.
 2026-08-18 21:41:48 +02:00
Phantasm
0e642d4c90 Merge pull request 'Syslog: Fix intermittent failure to compile due to old pc version' (#7965) from syslog-pc-fix into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7965
 2026-08-18 18:53:17 +00:00