| .. |
|
actor-containment.security
|
fix(federation): reject actors that point at other hosts
|
2026-10-27 21:37:20 +04:00 |
|
advisory-bumps.security
|
build: update ssl_verify_fun and phoenix_html for advisories
|
2026-11-01 11:10:49 +04:00 |
|
ap-c2s-oauth-scopes.security
|
fix(activitypub): check OAuth scopes on C2S endpoints
|
2026-10-26 12:49:58 +04:00 |
|
attachment-zero-size.fix
|
test(status_view): cover attachments with zero dimensions
|
2026-10-27 17:27:41 +04:00 |
|
bandit-1.14.1.security
|
Sec: Update bandit to version 1.14.1
|
2026-10-29 09:24:08 +04:00 |
|
c2s-rate-limit.security
|
chore: add changelog entry for C2S rate limits
|
2026-10-31 11:51:28 +04:00 |
|
cast-and-validate-cast-opts.fix
|
fix(api_spec): pass cast options on the first permissive cast
|
2026-10-31 13:12:15 +04:00 |
|
cast-and-validate-many-params.fix
|
fix(api_spec): drop every unexpected query param in permissive mode
|
2026-10-31 18:47:27 +04:00 |
|
ci-cheap-changelog-check.skip
|
ci: fetch only the target branch tip trees in check-changelog
|
2026-10-29 12:37:02 +04:00 |
|
config-db-unknown-module.fix
|
fix(config): skip ConfigDB settings for modules that no longer exist
|
2026-10-31 18:47:26 +04:00 |
|
context-local-only.fix
|
fix(context): show local-only replies to local users
|
2026-10-31 13:43:59 +04:00 |
|
emoji-react-single-tag.fix
|
fix(activitypub): accept emoji reactions with a single tag object
|
2026-10-31 15:37:41 +04:00 |
|
empty-proxy-url.fix
|
fix(http): treat an empty proxy_url as no proxy
|
2026-10-24 14:12:47 +04:00 |
|
exif-heic-gps.security
|
build: bump exif_stripper to 0.1.3
|
2026-10-28 11:35:47 +04:00 |
|
exif-stripper.change
|
refactor(upload): make Exiftool filters deprecated aliases of Exif filters
|
2026-10-27 17:29:15 +04:00 |
|
federation-reject-instances.security
|
fix(federation): do not deliver to instances rejected by SimplePolicy
|
2026-10-27 12:38:18 +04:00 |
|
fetch-id-containment.security
|
fix(fetcher): require fetched documents to have the fetched id
|
2026-10-27 21:58:41 +04:00 |
|
filter-regex-escape.fix
|
fix(filters): treat phrases as literal text in the regex
|
2026-10-27 12:36:09 +04:00 |
|
filter-whole-word.fix
|
fix(filters): honour whole_word
|
2026-10-27 12:50:04 +04:00 |
|
get-actor-crash.fix
|
fix(containment): return nil for actor shapes without an id
|
2026-10-27 22:03:13 +04:00 |
|
gin-fuzzy-search-limit.fix
|
fix(search): set gin_fuzzy_search_limit only for search queries
|
2026-10-29 11:26:02 +04:00 |
|
jose-1.11.13.security
|
Sec: Update jose to version 1.11.13
|
2026-10-29 09:24:14 +04:00 |
|
legacy-sequences.fix
|
Delete legacy Postgres sequences
|
2026-08-24 14:51:58 -07:00 |
|
marker-updated-at-format.fix
|
fix(mastodon_api): use the Mastodon date format for marker updated_at
|
2026-10-31 18:47:54 +04:00 |
|
mastodon-quote-entity.add
|
feat(api): add the Mastodon quote entity to statuses
|
2026-10-28 11:38:49 +04:00 |
|
media-proxy-data-urls.fix
|
fix(media_proxy): do not proxy data: URLs
|
2026-10-31 18:47:54 +04:00 |
|
media-proxy-network-path.security
|
chore: add changelog entry for network-path media proxy fix
|
2026-10-27 17:30:08 +04:00 |
|
media-proxy-static-redirect.fix
|
fix(media_proxy): serve static previews instead of redirecting to the main host
|
2026-10-31 13:43:59 +04:00 |
|
mention-notify-access.security
|
fix(notifications): handle unknown users when filtering tagged mentions
|
2026-10-27 12:39:02 +04:00 |
|
move-refetch-target.fix
|
fix(activitypub): refetch a stale Move target once
|
2026-10-31 15:53:41 +04:00 |
|
mrf-domain-regex-escape.security
|
fix(mrf): match domain rules literally
|
2026-10-31 13:17:50 +04:00 |
|
notification-filter-nil-content.fix
|
fix(notifications): skip the filter check for objects without content
|
2026-10-27 12:53:21 +04:00 |
|
oauth-profile-scope.add
|
feat(oauth): support the profile scope
|
2026-10-26 12:29:51 +04:00 |
|
oauth-tokens-scopes.security
|
fix(oauth): require security scopes to list and revoke tokens
|
2026-10-26 12:28:04 +04:00 |
|
object-age-non-public.security
|
test(mrf): cover ObjectAgePolicy with private, direct and unlisted posts
|
2026-10-27 12:35:16 +04:00 |
|
personal-inbox-addressing.fix
|
fix(activitypub): do not require the personal inbox owner to be addressed
|
2026-10-31 15:37:41 +04:00 |
|
question-note-fixups.fix
|
fix(activitypub): apply the Note fixups to incoming Questions
|
2026-10-31 13:43:59 +04:00 |
|
rate-limiter-test-flake.skip
|
test(rate_limiter): use windows that cannot expire during the test
|
2026-10-27 16:10:14 +04:00 |
|
refetch-containment.security
|
fix(fetcher): keep id and author fixed when refetching objects
|
2026-10-27 21:58:46 +04:00 |
|
release-2.11.1.skip
|
Prepare 2.11.1 release
|
2026-10-26 22:02:51 +04:00 |
|
remove-dead-pleroma-api-controllers.skip
|
chore: remove unrouted PleromaAPI token and password controllers
|
2026-10-26 12:44:32 +04:00 |
|
search-remote-fetch.security
|
fix(search): fetch remote statuses only when resolving is allowed
|
2026-10-31 12:30:57 +04:00 |
|
shared-inbox.change
|
perf(federation): always prefer the shared inbox
|
2026-10-27 20:45:32 +04:00 |
|
signature-freshness.security
|
fix(federation): enforce the signature policy on incoming requests
|
2026-10-27 21:46:40 +04:00 |
|
stats-peers-from-instances.change
|
fix(stats): leave our own host out of the peers
|
2026-10-29 10:42:54 +04:00 |
|
status-id-action-rate-limit.fix
|
fix(mastodon_api): rate limit status actions per status id
|
2026-10-30 10:40:18 +04:00 |
|
user-fetch-display-url.fix
|
fix(user): update the known user when fetched from a display URL
|
2026-10-27 21:58:46 +04:00 |
|
user-query-is-active.fix
|
fix(user): use deactivated: false for familiar followers
|
2026-10-27 17:26:20 +04:00 |
