hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
18,496 commits 2 branches 0 tags 251 MiB
Commit graph

18,496 commits

This branch
This branch
All branches
Author SHA1 Message Date
Lain Soykaf
1a0212bf9a
 		fix(retention): pin threads addressed to a local user 
A mention or DM was only pinned by its notification, so clearing
notifications let retention evict a user's direct messages. Check the
activity recipients instead, which does not go away.
 2026-09-23 08:22:14 +04:00
Phantasm
f61cf55676
 		Docs: Add newer Elixir/Erlang versions installation documentation 
Also splits generic dependencies into elixir/erlang and the rest.
Generic depenencies then import the elixir/erlang snippets to preserve
previous layout.
 2026-09-22 22:44:20 +02:00
lain
b68f13b959 Merge pull request 'Woodpecker CI: Pass API deployment parameters separately' (#7990) from fix/woodpecker-trigger-params into develop 2026-09-09 12:18:37 +00:00
Lain Soykaf
239ae3403b
 		fix(ci): pass API deployment parameters separately 2026-09-09 15:55:18 +04:00
lain
c023727ecd Merge pull request 'Woodpecker CI: Remake docs building pipelines' (#7928) from woodpecker-ci-docs into develop 2026-09-09 11:01:35 +00:00
Lain Soykaf
fd1b15dd58
 		fix(ci): isolate API documentation channels 2026-09-09 13:21:07 +04:00
Phantasm
d6a5dd2b76
 		Bump minimum Elixir version to 1.17. 
Multiple dependencies require OTP27 and 1.17 is the oldest version
supporting it. Also bumps Docker Erlang version to current newest 27.
 2026-09-08 22:39:36 +02:00
Phantasm
72d45a9f8b
 		Merge branch 'develop' into audit-mix-audit-report 2026-09-08 21:58:23 +02:00
Phantasm
760daad8ef
 		Sec: Bump swoosh to version 1.28.0 
Fixes:
  swoosh 1.16.12 VULNERABLE!
    EEF-CVE-2026-54893 (LOW)
    aka: CVE-2026-54893, GHSA-754j-98wh-57rf
    Email-derived URL path injection in the Swoosh Microsoft Graph adapter
    https://osv.dev/vulnerability/EEF-CVE-2026-54893
 2026-09-08 21:53:55 +02:00
Phantasm
47629351f0
 		Sec: Bump mint to version 1.10.0 
Fixes:
  mint 1.9.3 - EEF-CVE-2026-82729 (MEDIUM)
    aka: CVE-2026-82729, GHSA-7p8w-j234-7qc8
    Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-82729

  mint 1.9.3 - EEF-CVE-2026-82728 (HIGH)
    aka: CVE-2026-82728, GHSA-g83f-2j6r-q6m4
    Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-82728
 2026-09-08 21:53:48 +02:00
Phantasm
bad04ab482
 		Sec: Bump cowboy to version 2.19.0 
Fixes:
  cowboy 2.16.1 - EEF-CVE-2026-65624 (MEDIUM)
    aka: CVE-2026-65624
    Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
    https://osv.dev/vulnerability/EEF-CVE-2026-65624
 2026-09-08 21:43:05 +02:00
Phantasm
92b8fba3e3
 		Sec: Bump cowlib to 2.20.0 and gun to 2.6.0 
Fixes:
  cowlib:
    EEF-CVE-2026-43971 (MEDIUM)
    aka: CVE-2026-43971
    Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43971

    EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

    EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
  gun:
    GHSA-w4f7-4cxr-rv3c (MEDIUM)
    aka: CVE-2026-43966, EEF-CVE-2026-43966
    cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
    https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c
 2026-09-08 21:38:55 +02:00
Phantasm
770d827b50
 		Sec: Bump bandit to version 1.12.5 
Fixes:
- EEF-CVE-2026-74836 (HIGH)
  aka: CVE-2026-74836, GHSA-xj8g-532w-jv94
  HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-74836

- EEF-CVE-2026-75484 (MEDIUM)
  aka: CVE-2026-75484, GHSA-x3gh-xhj4-3vq8
  HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-75484
 2026-09-08 21:28:37 +02:00
Phantasm
b3f95adfb7 Merge pull request 'CI: Fix failing OTP builds, switch to mirrored Woodpecker multi-arch manifest plugin' (#7989) from wpc-ci-bump into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7989
 2026-09-08 11:54:49 +00:00
Phantasm
b3007be961
 		Woodpecker CI: Update Docker multi-arch plugin, fix commit sha mangling 
149236e468 would become 1.49236e+09 when passed to the plugin due to
YAML's type coercion (string of a float in scientific -> float).
 2026-09-08 13:18:36 +02:00
Phantasm
ef011bb8f9
 		Woodpecker CI: Ignore failure to stop for services 2026-09-08 13:17:55 +02:00
Phantasm
5452e3f73e
 		Fix indentation 2026-09-05 21:25:28 +02:00
Phantasm
a881ffe8c2
 		Woodpecker CI API spec: Update Elixir image to an existing one 
Switches from hexpm/elixir-amd64 to hexpm/elixir.
 2026-09-05 21:24:35 +02:00
Phantasm
c978fe0b7b
 		CI: Bump Gitea Package plugin version 2026-09-05 21:24:35 +02:00
Phantasm
a050b00898
 		Woodpecker CI Docs: Also build docs for develop branch 2026-09-05 21:24:17 +02:00
Phantasm
d549b98f8b
 		changelog 2026-09-05 20:48:56 +02:00
Phantasm
e35dacf9f9
 		Woodpecker CI: pass branch to triggered docs workflows 2026-09-05 20:48:56 +02:00
Phantasm
71104db3f6
 		Woodpecker CI: Deploy docs on stable tag 2026-09-05 20:48:55 +02:00
Phantasm
c596ace9df
 		Woodpecker CI: Build API specs again 2026-09-05 20:48:55 +02:00
Phantasm
0e1315099f
 		changelog 2026-09-05 00:47:27 +02:00
Phantasm
407db6c118
 		CI: Update Gitea Package plugin to 0.5.1 2026-09-05 00:14:19 +02:00
Phantasm
5a7635b943
 		CI OTP: Update elixir images, switch to hexpm/elixir except armv7 2026-09-05 00:14:19 +02:00
Phantasm
21bb1a98a3
 		CI: Update woodpecker Docker multi-arch tagger plugin 
Also moves it to a git.pleroma.social mirror
 2026-09-05 00:14:07 +02:00
Phantasm
149236e468 Merge pull request 'IdempotencyPlug: Fix private function name typo' (#7985) from idempotency-plug-typo into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7985
 2026-09-02 22:31:01 +00:00
Phantasm
820e80bdc7
 		IdempotencyPlug: Fix private function name typo 2026-09-03 00:07:25 +02:00
lain
fa920037f1 Merge pull request 'Fix notification query plan for users with domain blocks' (#7981) from fix/domain-block-subplan-cost into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7981
 2026-09-02 13:41:40 +00:00
lain
70d743bff9 Merge branch 'develop' into fix/domain-block-subplan-cost 2026-09-02 10:19:27 +00:00
Lain Soykaf
635bc19ac8
 		fix(notifications): cost the followed-accounts subselect once 
Wrap the followed ap_ids subselect in keep_following_or_not_domain_blocked
in ARRAY(...) so it becomes an InitPlan. As a plain subselect the planner
charged its startup per rescan of the actor lookup, which could make
Notification.for_user pick a plan that scans every active user per row.
 2026-09-02 13:42:48 +04:00
Lain Soykaf
89e684dc9c
 		docs(retention): describe the cursor walk and its limits 2026-09-02 12:32:09 +04:00
Lain Soykaf
6c8ed0a3b8
 		feat(retention): walk activities incrementally with a persisted cursor 
Grouping the whole activities table by thread every run is unusable on
a large instance: on a 312 GB database it plans as a seq scan plus a
50M-row on-disk sort. Instead, walk activities in id order (flake ids
are time-ordered) from a persisted cursor up to the id that corresponds
to the deadline, and verify only the threads those activities belong to
through the (type, context) index. Measured on that instance: 147 ms
for a 50k-activity range scan, 349 ms warm / 14 s cold to verify ~700
threads.

The cursor is persisted per chunk so a killed run resumes. The
watermark walk keeps a cursor of its own so it cannot leave the
age-based walk stranded behind the deadline. Adds the retention_cursors
table.
 2026-09-02 12:32:09 +04:00
Lain Soykaf
c1f8d75019
 		docs: document the bounded retention mode 2026-09-02 11:53:42 +04:00
Lain Soykaf
fa4fb00910
 		refactor(database): reuse retention query in prune_objects 
prune_objects --keep-threads now shares the thread selection with
Pleroma.Retention, which additionally keeps threads that mention a
local user or that are referenced by a report. The hashtag cleanup
is shared as well.
 2026-09-02 11:53:42 +04:00
Lain Soykaf
cd796f007d
 		feat(retention): run eviction from an Oban cron worker 
Adds config :pleroma, :retention (disabled by default) and an hourly
crontab entry that evicts one bounded batch per run.
 2026-09-02 11:53:42 +04:00
Lain Soykaf
1ebcd4f79d
 		feat(retention): add bounded eviction of old remote threads 
Pleroma.Retention treats remote content as a cache: a thread is evicted
once nobody local has interacted with it and it has been quiet for
longer than remote_post_retention_days, or when the objects table is
over an optional row watermark. Local posts are never deleted.

A single grouping scan collects activity and object ids per thread so
the deletes only touch primary key and ap_id indexes.
 2026-09-02 11:53:41 +04:00
Mark Felder
9921e802c9 Delete legacy Postgres sequences 
for activities, chats, and users which were converted to Flake IDs
 2026-08-24 14:51:58 -07:00
Phantasm
45459c8398
 		Merge branch 'develop' into audit-mix-audit-report 2026-08-19 22:20:55 +02:00
Phantasm
5709531197
 		Sec: Bump Phoenix LiveView to 1.2.9 
Technically 1.1.33 would also do...

Also updates:
  phoenix_pubsub 2.1.3 => 2.2.0
  ranch 2.2.0 => 2.2.1
  websock_adapter 0.5.8 => 0.5.9
 2026-08-19 22:08:21 +02:00
Phantasm
c4ca9b41ad
 		Sec: Bump Phoenix to version 1.8.11 2026-08-19 22:08:20 +02:00
Phantasm
39d5648447
 		Sec: Bump bandit to 1.12.4 
Also bumps:
  plug 1.20.2 => 1.20.3
  plug_crypto 2.1.1 => 2.2.0
  thousand_island 1.4.3 => 1.5.0
 2026-08-19 22:07:22 +02:00
Phantasm
71cb70cd01
 		Sec: Bump postgrex to 0.22.4 2026-08-19 22:06:26 +02:00
Phantasm
124f4ece1d Merge pull request 'Syslog: set runtime: false to fix OTP releases' (#7966) from syslog-fix-otp into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7966
 2026-08-18 20:47:55 +00:00
Phantasm
59042e2793
 		Syslog: set runtime: false to fix OTP releases 
The syslog package is not directly part of the runtime.
 2026-08-18 21:41:48 +02:00
Phantasm
0e642d4c90 Merge pull request 'Syslog: Fix intermittent failure to compile due to old pc version' (#7965) from syslog-pc-fix into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7965
 2026-08-18 18:53:17 +00:00
Phantasm
16890c051a
 		Syslog: Fix intermittent failure to compile due to old pc version 
Upstream hasn't made a release with the fix, pin fixed commit
for the time being.
 2026-08-18 19:54:42 +02:00
Phantasm
3ecfe034d7 Merge pull request 'Oban: Enable Reindexer plugin to reduce oban_jobs index DB bloat' (#7964) from oban-reindex-cron into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7964
 2026-08-18 17:51:30 +00:00