Commit graph

642 commits

Author SHA1 Message Date
Phantasm
bbc53f0fef
Merge branch 'develop' into audit-mix-audit-report 2026-10-21 19:24:32 +02:00
Phantasm
9c76e0686a
Deps: Bump captcha version
Fixes build on OpenBSD and FreeBSD
2026-09-30 15:21:25 +02:00
Phantasm
d6a5dd2b76
Bump minimum Elixir version to 1.17.
Multiple dependencies require OTP27 and 1.17 is the oldest version
supporting it. Also bumps Docker Erlang version to current newest 27.
2026-09-08 22:39:36 +02:00
Phantasm
760daad8ef
Sec: Bump swoosh to version 1.28.0
Fixes:
  swoosh 1.16.12 VULNERABLE!
    EEF-CVE-2026-54893 (LOW)
    aka: CVE-2026-54893, GHSA-754j-98wh-57rf
    Email-derived URL path injection in the Swoosh Microsoft Graph adapter
    https://osv.dev/vulnerability/EEF-CVE-2026-54893
2026-09-08 21:53:55 +02:00
Phantasm
92b8fba3e3
Sec: Bump cowlib to 2.20.0 and gun to 2.6.0
Fixes:
  cowlib:
    EEF-CVE-2026-43971 (MEDIUM)
    aka: CVE-2026-43971
    Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43971

    EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

    EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
  gun:
    GHSA-w4f7-4cxr-rv3c (MEDIUM)
    aka: CVE-2026-43966, EEF-CVE-2026-43966
    cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
    https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c
2026-09-08 21:38:55 +02:00
Phantasm
45459c8398
Merge branch 'develop' into audit-mix-audit-report 2026-08-19 22:20:55 +02:00
Phantasm
5709531197
Sec: Bump Phoenix LiveView to 1.2.9
Technically 1.1.33 would also do...

Also updates:
  phoenix_pubsub 2.1.3 => 2.2.0
  ranch 2.2.0 => 2.2.1
  websock_adapter 0.5.8 => 0.5.9
2026-08-19 22:08:21 +02:00
Phantasm
c4ca9b41ad
Sec: Bump Phoenix to version 1.8.11 2026-08-19 22:08:20 +02:00
Phantasm
39d5648447
Sec: Bump bandit to 1.12.4
Also bumps:
  plug 1.20.2 => 1.20.3
  plug_crypto 2.1.1 => 2.2.0
  thousand_island 1.4.3 => 1.5.0
2026-08-19 22:07:22 +02:00
Phantasm
71cb70cd01
Sec: Bump postgrex to 0.22.4 2026-08-19 22:06:26 +02:00
Phantasm
59042e2793
Syslog: set runtime: false to fix OTP releases
The syslog package is not directly part of the runtime.
2026-08-18 21:41:48 +02:00
Phantasm
16890c051a
Syslog: Fix intermittent failure to compile due to old pc version
Upstream hasn't made a release with the fix, pin fixed commit
for the time being.
2026-08-18 19:54:42 +02:00
Lain Soykaf
656191bd1e
fix(deps): use released Hackney 4.7.3 2026-08-11 14:16:59 +04:00
Lain Soykaf
42c100605e
fix(deps): pin Hackney to the connection-leak fix
An unpooled Hackney 4 connection that ends without a reusable socket -- a
body cut short by the peer, a bodyless 204/304, or a failed read -- parks
in its `closed` state forever, holding every refc binary it read.
read_full_body/2 hands back `socket = undefined`, so it never reaches the
reuse check; `closed(enter)` arms a stop timer only for pooled
connections; and an unpooled connection is owned by hackney_conn_sup, so
the owner-DOWN cleanup never fires.

Nothing here can work around it. Since 4.0 Hackney ignores `with_body`
and always returns a fully read binary, so a synchronous request never
yields a handle to close, and the short read still reports {:ok, body}.
Media proxy warming hits this whenever an attachment fetch is cut short
and the outbound proxy is used as a CONNECT tunnel, since tunnels are
never pooled.

Pin the fix, a single commit on top of the 4.7.2 tag, until it ships in a
release. While it is a git dep Hackney drops out of `mix deps.audit` and
`mix hex.outdated`, so this wants moving back to hex promptly.

benoitc/hackney#918, benoitc/hackney#919
2026-07-26 10:15:52 +04:00
Lain Soykaf
7d1cc56a78
Merge remote-tracking branch 'origin/develop' into audit-mix-audit-report
Conflict resolution notes:

- mix.lock: kept this branch's versions for cowlib, h2, hackney and hpax.
  Those upgrades are the point of the branch; develop is still on hackney
  1.20.1.

- .woodpecker/docker-armv7.yaml: accepted develop's deletion. It only
  existed here to build mdex_native on armv7, and mdex was already
  replaced with earmark again.

- lib/pleroma/reverse_proxy.ex: took develop's version. It independently
  grew request_with_constraints/5 and the invalid-status close, which
  supersede the equivalent fixes on this branch. Re-applied this branch's
  recv_timeout seeding, which develop does not have.

- lib/pleroma/gun/connection_pool/worker.ex and
  lib/pleroma/reverse_proxy/client/tesla.ex: took develop's versions. The
  gun pool rework (#7934) already guards the demonitor and makes
  release_conn/cancel_stream exit-safe, and it splits the Tesla client's
  graceful release from its abort path, so this branch's changes there are
  obsolete.

That leaves the client leak fix as a Hackney-only concern, which
stream_body/1 now handles the same way the gun client does.
2026-07-25 19:54:48 +04:00
lain
cc1b95c88e Merge pull request 'Rework Gun connection pooling' (#7934) from issue-2263-gun-validation into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7934
2026-07-25 05:44:39 +00:00
Lain Soykaf
bf477c1a53
fix(deps): replace mdex with earmark parser 2026-07-23 13:02:28 +04:00
Lain Soykaf
77a7ba3a0e
fix(http): harden Hackney request lifecycle 2026-07-22 16:18:04 +04:00
Lain Soykaf
e6598ae5c7
fix(ci): build mdex native on armv7 2026-07-21 21:23:18 +04:00
Lain Soykaf
b862254889
fix(deps): update Gun to 2.4.1 2026-07-17 21:09:13 +04:00
Lain Soykaf
9154f6fe3c
fix(deps): replace earmark with mdex 2026-07-02 11:31:54 +04:00
Lain Soykaf
a96fb31a89
fix(deps): update hackney 2026-07-02 10:57:12 +04:00
Lain Soykaf
fa7986a267
fix(deps): update bandit 2026-07-02 10:26:12 +04:00
Lain Soykaf
7e54b0935b
chore(deps): add mix audit 2026-07-02 10:20:59 +04:00
lain
4fe802b25a Merge branch 'develop' into gitlab-mr-iid-4381 2026-05-14 09:27:13 +00:00
lain
c7c453ca21 Merge branch 'develop' into gitlab-mr-iid-4426 2026-05-14 06:56:57 +00:00
Lain Soykaf
512b0f67a4
Merge remote-tracking branch 'origin/develop' into issue-3314-remote-ip-hex
# Conflicts:
#	mix.exs
2026-05-14 09:27:18 +04:00
Phantasm
7651490c50
Merge branch 'develop' into gitlab-mr-iid-4381 2026-05-14 00:14:27 +02:00
Lain Soykaf
7ab9e2c7ce
Use pleroma_captcha Hex package 2026-05-13 23:05:25 +04:00
Lain Soykaf
c92d233233
Use upstream remote_ip package 2026-05-13 20:04:12 +04:00
Lain Soykaf
d0c2d04356
Use Hex release for oban_plugins_lazarus 2026-05-13 19:10:15 +04:00
Lain Soykaf
d8e3ea69b1
Use Hex release for majic 1.2.0 2026-05-13 19:00:16 +04:00
Lain Soykaf
9e16332d9d
Update majic to 1.2.0 2026-05-13 18:39:40 +04:00
lain
8e72f4cd17 Merge branch 'develop' into gitlab-mr-iid-4426 2026-05-11 18:16:12 +00:00
Lain Soykaf
216a00f73f
Merge develop into Phoenix upstream migration 2026-05-11 22:13:46 +04:00
Lain Soykaf
61feb3dfcd
Update http_signatures to 0.1.3 2026-05-11 21:01:59 +04:00
Lain Soykaf
592be493c8
Use published Pleroma MFM parser package 2026-05-11 19:13:01 +04:00
Lain Soykaf
6b86e31e5d
Add backend MFM support 2026-05-11 14:53:06 +04:00
Lain Soykaf
8ccdd98914
Prepare 2.10.2 release 2026-05-03 20:23:35 +04:00
Lain Soykaf
6553ba24aa
Prepare 2.10.1 release 2026-05-03 16:56:01 +04:00
feld
683ab39160 Merge pull request 'Downgrade Hackney' (#7860) from hackney-downgrade into develop
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7860
2026-04-08 19:29:50 +00:00
Mark Felder
7582b71f46 Downgrade Hackney to 1.20.1, before connection performance regressions
It appears the implementation of Happy Eyeballs in 1.22.0 is the origin of
some pretty serious performance regressions that remain even in the latest
Hackney 3.0 branch.

Connection tests:

=== 1.22.0 ===
First call:  9434ms
Second call: 14ms

=== 1.21.0 ===
First call:  228ms
Second call: 16ms

We went back further to 1.20.1 though because of reported problems with the mail
client and ssl_options. That bug was not reproduced by a dev, though, but we'll
trust it for now.
2026-04-08 12:27:47 -07:00
Mark Felder
00265751cc Update Bandit 2026-04-03 13:22:12 -07:00
Phantasm
c455e02255 Elixir 1.19: Add non-test Elixir files in test/ to mix.exs filter
This is a new filter introduced in 1.19.
2026-03-25 19:35:46 +00:00
nicole mikołajczyk
37041aae60 update mix.exs deps versions to match mix.lock so they don't look that scary
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-03-02 22:50:49 +01:00
nicole mikołajczyk
938ee4cb01 mix.exs: use correct override value
Signed-off-by: nicole mikołajczyk <git@mkljczk.pl>
2026-02-27 15:45:57 +01:00
Haelwenn (lanodan) Monnier
be327ca982
Switch Phoenix back to upstream
See <https://github.com/phoenixframework/phoenix/pull/6094>
for `:sec_websocket_protocol` -> `:sec_websocket_headers`
2026-01-18 10:40:10 +01:00
Lain Soykaf
346014b897 Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into revert-d6888e24 2026-01-16 22:43:10 +04:00
Haelwenn (lanodan) Monnier
05704ec86e
mix: upgrade vix from "~> 0.26.0" to "~> 0.36"
Dropping the last zero should allow to get 0.x updates rather
than only 0.36.x updates.

Fixes: https://git.pleroma.social/pleroma/pleroma/-/issues/3393
2026-01-14 03:11:37 +01:00
lain
9fcf918e1c Merge branch 'phnt/oban-web' into 'develop'
Add Oban Web and upgrade LiveView, plug

See merge request pleroma/pleroma!4422
2026-01-11 05:40:47 +00:00