hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
18,310 commits 2 branches 0 tags 250 MiB
Commit graph

18,310 commits

This branch
This branch
All branches
Author SHA1 Message Date
Lain Soykaf
fc91131892
 		Merge branch 'fix/emudhra-ca-trust' (#77) into release/2.11 2026-10-22 11:27:15 +04:00
Lain Soykaf
f4a3bc2300
 		Static: Update bundled frontend to 2.11.4 2026-10-22 11:23:51 +04:00
Lain Soykaf
accadd99f3
 		fix(mailer): make Mua trust the CAStore bundle 
Mua (the SMTP adapter in the docs) trusts the OS CA store unless it gets
a CA. Pass the CAStore bundle, but keep a CA that the admin set.
 2026-10-22 11:21:50 +04:00
Lain Soykaf
d698b96579
 		fix(search): make the Qdrant clients trust the CAStore bundle 
The Qdrant and OpenAI clients do not go through Pleroma.HTTP, so on
Hackney they trusted certifi. Both send API keys. Give them the
configured adapter with the same TLS options.
 2026-10-22 11:21:00 +04:00
Lain Soykaf
8880c502be
 		Merge branch 'develop' into fix/emudhra-ca-trust 
# Conflicts:
#	mix.lock
 2026-10-22 11:15:06 +04:00
Lain Soykaf
e0ed6b5d39
 		Merge branch 'fix/emudhra-ca-trust' (#77) into release/2.11 
# Conflicts:
#	lib/pleroma/http/adapter_helper/hackney.ex
#	mix.lock
 2026-10-22 10:05:45 +04:00
Lain Soykaf
52762f9770
 		Merge branch 'audit-mix-audit-report' (#69) into release/2.11 2026-10-22 10:05:33 +04:00
Lain Soykaf
65076aa2f8
 		fix(http): reject Hackney's certifi partial chains 
Hackney 4 merges given ssl_options into its defaults and keeps its own
partial_chain, which trusts any certificate in the peer chain that is in
certifi. A peer could send the emSign ECC Root CA - G3 root in its chain
and pass. Set partial_chain so certifi is never a trust anchor.
 2026-10-22 10:05:12 +04:00
Lain Soykaf
92a112cf15
 		fix(mailer): drop the TLS 1.2 pin 
The pin worked around a TLS 1.3 problem with Hackney on OTP 23
(swoosh/swoosh#478). Pleroma no longer supports OTP 23.
 2026-10-22 08:48:56 +04:00
Phantasm
bbc53f0fef
 		Merge branch 'develop' into audit-mix-audit-report 2026-10-21 19:24:32 +02:00
Phantasm
5810ecd16e
 		Sec: Update Decimal to version 3.2.0 
Fixes:
  decimal 3.1.1 - EEF-CVE-2026-97853 (MEDIUM)
    aka: CVE-2026-97853, GHSA-6c27-994x-c52f
    Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-97853
 2026-10-21 11:27:55 +02:00
Phantasm
e7b88cd652
 		Sec: Update mint to version 1.11.0 
Fixes:
  mint 1.10.0 - EEF-CVE-2026-92103 (MEDIUM)
    aka: CVE-2026-92103, GHSA-q95c-ccq6-j5j6
    Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
    https://osv.dev/vulnerability/EEF-CVE-2026-92103

  mint 1.10.0 - EEF-CVE-2026-82672 (MEDIUM)
    aka: CVE-2026-82672, GHSA-rj5m-69wp-cxq9
    Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
    https://osv.dev/vulnerability/EEF-CVE-2026-82672

  mint 1.10.0 - EEF-CVE-2026-91043 (HIGH)
    aka: CVE-2026-91043, GHSA-9x8p-qrf4-jq7g
    HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
    https://osv.dev/vulnerability/EEF-CVE-2026-91043

  mint 1.10.0 - EEF-CVE-2026-94194 (MEDIUM)
    aka: CVE-2026-94194, GHSA-gvrc-75rc-7gj9
    Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
    https://osv.dev/vulnerability/EEF-CVE-2026-94194
 2026-10-21 11:27:55 +02:00
Phantasm
b4a3e8436d
 		Sec: Update bandit to version 1.13.1 
Fixes:
  bandit 1.12.5 - EEF-CVE-2026-105659 (HIGH)
    aka: CVE-2026-105659, GHSA-69m6-wcv4-rwcf
    HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105659

  bandit 1.12.5 - EEF-CVE-2026-105660 (MEDIUM)
    aka: CVE-2026-105660, GHSA-v53v-9hvg-37jf
    Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105660
 2026-10-21 11:27:55 +02:00
Phantasm
235435fc9b
 		Sec: Bump gun to version 2.7.0 and cowlib to version 2.21.0 
Fixes:
  cowlib 2.20.0 - EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

  cowlib 2.20.0 - EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
 2026-10-21 11:27:55 +02:00
Lain Soykaf
f4ff7cb1ea
 		fix(http): make Finch trust the CAStore bundle 
Mint trusts the OTP CA store, which comes from the OS. Load the CAStore
bundle into it when Finch starts, so Finch trusts the same roots as the
other adapters.
 2026-10-21 08:27:30 +04:00
Lain Soykaf
830455d197
 		fix(mailer): keep certificate checks for Swoosh HTTP adapters 
The TLS version override replaced all Hackney TLS defaults. On OTP 26+
this fails with cacerts: :undefined; on older OTP it skipped certificate
checks. Closes #7962 on the public tracker.
 2026-10-21 08:27:30 +04:00
Lain Soykaf
d8c880e494
 		fix(http): make Hackney trust the CAStore bundle 
Hackney trusts its own certifi bundle, which still has the roots of the
compromised eMudhra intermediate CAs. Pass explicit ssl_options with the
CAStore bundle. Hackney drops all its TLS defaults when ssl_options are
given, so keep peer and hostname checks in the options.
 2026-10-21 08:21:43 +04:00
Phantasm
6ac6cff5b5
 		Sec: Bump castore to version 1.0.22 
eMudhra Intermediate CA Compromise
 2026-10-21 08:17:26 +04:00
Phantasm
bde6bc91a4
 		Sec: Bump castore to version 1.0.22 
eMudhra Intermediate CA Compromise
 2026-10-20 23:46:45 +02:00
Phantasm
687fa6e1b2 Merge pull request 'Docs: Clarify that mise builds Erlang from source on Debian' (#8000) from fix-new-elixir-erlang-docs into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/8000
 2026-10-04 19:25:25 +00:00
Phantasm
0421e8b2e3
 		Docs New Elixir/Erlang: Clarify that mise builds Erlang on Debian 2026-10-04 21:20:19 +02:00
Phantasm
1659fd99d3
 		Docs: Add missing curl dependency for asdf 2026-10-04 21:18:13 +02:00
Phantasm
cfeca7f7af Merge pull request 'Deps: Bump captcha version' (#7996) from captcha-ver-bump into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7996
 2026-09-30 13:34:44 +00:00
Phantasm
9c76e0686a
 		Deps: Bump captcha version 
Fixes build on OpenBSD and FreeBSD
 2026-09-30 15:21:25 +02:00
Phantasm
1afc236468 Merge pull request 'Docs: Bump maximum datasize limit and mention cap_mkdb when creating login class' (#7995) from openbsd-bump-datasize into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7995
 2026-09-29 08:45:42 +00:00
Phantasm
62d4258d79
 		Docs OpenBSD: Mention running cap_mkdb after making new login class 2026-09-29 10:44:10 +02:00
Phantasm
4515f9139c
 		Docs OpenBSD: Bump recommended datasize login.conf limit 
Under OpenBSD datasize not only includes allocated memory using malloc,
but also anonymous memory mapped via mmap.
 2026-09-29 10:44:03 +02:00
Phantasm
5a4cffbb62 Merge pull request 'Docs: Guide on installing newer versions of Elixir/Erlang than what distro ships' (#7992) from erlang-elixir-install-docs into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7992
 2026-09-24 18:14:21 +00:00
Phantasm
62b6a24d5d Docs: move paragraph 2026-09-24 20:11:38 +02:00
Phantasm
0061f62355 Docs Newer Elixir/Erlang guide: Recommend upgrading OS release instead 2026-09-24 20:11:38 +02:00
Phantasm
775ae5d504 Docs New Elixir/Erlang versions install: Add maintenance chapter 2026-09-24 20:01:55 +02:00
Phantasm
f61cf55676
 		Docs: Add newer Elixir/Erlang versions installation documentation 
Also splits generic dependencies into elixir/erlang and the rest.
Generic depenencies then import the elixir/erlang snippets to preserve
previous layout.
 2026-09-22 22:44:20 +02:00
lain
b68f13b959 Merge pull request 'Woodpecker CI: Pass API deployment parameters separately' (#7990) from fix/woodpecker-trigger-params into develop 2026-09-09 12:18:37 +00:00
Lain Soykaf
239ae3403b
 		fix(ci): pass API deployment parameters separately 2026-09-09 15:55:18 +04:00
lain
c023727ecd Merge pull request 'Woodpecker CI: Remake docs building pipelines' (#7928) from woodpecker-ci-docs into develop 2026-09-09 11:01:35 +00:00
Lain Soykaf
fd1b15dd58
 		fix(ci): isolate API documentation channels 2026-09-09 13:21:07 +04:00
Phantasm
d6a5dd2b76
 		Bump minimum Elixir version to 1.17. 
Multiple dependencies require OTP27 and 1.17 is the oldest version
supporting it. Also bumps Docker Erlang version to current newest 27.
 2026-09-08 22:39:36 +02:00
Phantasm
72d45a9f8b
 		Merge branch 'develop' into audit-mix-audit-report 2026-09-08 21:58:23 +02:00
Phantasm
760daad8ef
 		Sec: Bump swoosh to version 1.28.0 
Fixes:
  swoosh 1.16.12 VULNERABLE!
    EEF-CVE-2026-54893 (LOW)
    aka: CVE-2026-54893, GHSA-754j-98wh-57rf
    Email-derived URL path injection in the Swoosh Microsoft Graph adapter
    https://osv.dev/vulnerability/EEF-CVE-2026-54893
 2026-09-08 21:53:55 +02:00
Phantasm
47629351f0
 		Sec: Bump mint to version 1.10.0 
Fixes:
  mint 1.9.3 - EEF-CVE-2026-82729 (MEDIUM)
    aka: CVE-2026-82729, GHSA-7p8w-j234-7qc8
    Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-82729

  mint 1.9.3 - EEF-CVE-2026-82728 (HIGH)
    aka: CVE-2026-82728, GHSA-g83f-2j6r-q6m4
    Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-82728
 2026-09-08 21:53:48 +02:00
Phantasm
bad04ab482
 		Sec: Bump cowboy to version 2.19.0 
Fixes:
  cowboy 2.16.1 - EEF-CVE-2026-65624 (MEDIUM)
    aka: CVE-2026-65624
    Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
    https://osv.dev/vulnerability/EEF-CVE-2026-65624
 2026-09-08 21:43:05 +02:00
Phantasm
92b8fba3e3
 		Sec: Bump cowlib to 2.20.0 and gun to 2.6.0 
Fixes:
  cowlib:
    EEF-CVE-2026-43971 (MEDIUM)
    aka: CVE-2026-43971
    Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43971

    EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

    EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
  gun:
    GHSA-w4f7-4cxr-rv3c (MEDIUM)
    aka: CVE-2026-43966, EEF-CVE-2026-43966
    cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
    https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c
 2026-09-08 21:38:55 +02:00
Phantasm
770d827b50
 		Sec: Bump bandit to version 1.12.5 
Fixes:
- EEF-CVE-2026-74836 (HIGH)
  aka: CVE-2026-74836, GHSA-xj8g-532w-jv94
  HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-74836

- EEF-CVE-2026-75484 (MEDIUM)
  aka: CVE-2026-75484, GHSA-x3gh-xhj4-3vq8
  HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-75484
 2026-09-08 21:28:37 +02:00
Phantasm
b3f95adfb7 Merge pull request 'CI: Fix failing OTP builds, switch to mirrored Woodpecker multi-arch manifest plugin' (#7989) from wpc-ci-bump into develop 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7989
 2026-09-08 11:54:49 +00:00
Phantasm
b3007be961
 		Woodpecker CI: Update Docker multi-arch plugin, fix commit sha mangling 
149236e468 would become 1.49236e+09 when passed to the plugin due to
YAML's type coercion (string of a float in scientific -> float).
 2026-09-08 13:18:36 +02:00
Phantasm
ef011bb8f9
 		Woodpecker CI: Ignore failure to stop for services 2026-09-08 13:17:55 +02:00
Phantasm
5452e3f73e
 		Fix indentation 2026-09-05 21:25:28 +02:00
Phantasm
a881ffe8c2
 		Woodpecker CI API spec: Update Elixir image to an existing one 
Switches from hexpm/elixir-amd64 to hexpm/elixir.
 2026-09-05 21:24:35 +02:00
Phantasm
c978fe0b7b
 		CI: Bump Gitea Package plugin version 2026-09-05 21:24:35 +02:00
Phantasm
a050b00898
 		Woodpecker CI Docs: Also build docs for develop branch 2026-09-05 21:24:17 +02:00