pleroma/changelog.d
Phantasm 760daad8ef
Sec: Bump swoosh to version 1.28.0
Fixes:
  swoosh 1.16.12 VULNERABLE!
    EEF-CVE-2026-54893 (LOW)
    aka: CVE-2026-54893, GHSA-754j-98wh-57rf
    Email-derived URL path injection in the Swoosh Microsoft Graph adapter
    https://osv.dev/vulnerability/EEF-CVE-2026-54893
2026-09-08 21:53:55 +02:00
..
account-favourites-order.fix Fix account favourites ordering 2026-05-25 18:09:18 +04:00
activitypub-bot-rfc9421-fallback.fix fix: reject duplicate Signature headers 2026-07-26 12:26:35 +04:00
admin-api-passwordless-accounts.add Allow creating accounts without a password in the AdminAPI, update docs 2026-07-20 19:01:02 +02:00
bandit-1.11.1.security fix(deps): update bandit 2026-07-02 10:26:12 +04:00
bandit-1.12.4.security Sec: Bump bandit to 1.12.4 2026-08-19 22:07:22 +02:00
bandit-1.12.5.security Sec: Bump bandit to version 1.12.5 2026-09-08 21:28:37 +02:00
captcha-package.fix Use pleroma_captcha Hex package 2026-05-13 23:05:25 +04:00
context-cleanup.skip litepub-0.1.jsonld cleanup 2026-04-10 21:33:20 +02:00
cowboy-2.16.1.security fix(deps): update cowboy 2026-07-02 10:36:53 +04:00
cowboy-2.19.0.security Sec: Bump cowboy to version 2.19.0 2026-09-08 21:43:05 +02:00
cowlib-2.17.1.security fix(deps): update cowlib 2026-07-02 10:35:41 +04:00
cowlib-2.20.0.security Sec: Bump cowlib to 2.20.0 and gun to 2.6.0 2026-09-08 21:38:55 +02:00
decimal-3.1.1.security fix(deps): update decimal 2026-07-02 10:50:20 +04:00
disabling-chats.change changelog 2026-07-24 00:59:15 +02:00
docker-arm32v7-pr-forbid-build.skip Woodpecker CI: Do not build arm/v7 in PR, simplify 2026-07-20 11:17:09 +02:00
docker-baseimage-ssl.fix Dockerfile: update base images to fix problems with SSL handshakes 2026-07-18 11:15:45 +03:00
docker-e2e-image.skip Add custom Docker image for FE E2E tests 2026-05-05 21:34:10 +02:00
docs-otp-install-links.fix Docs: split wall of install commands, fix downloading OTP bundle 2026-08-13 23:52:06 +02:00
earmark-mdex.security fix(deps): replace mdex with earmark parser 2026-07-23 13:02:28 +04:00
elixir-1-19.add Elixir 1.19: Added features changelog (ConfigDB blacklist) 2026-07-18 16:10:22 +02:00
elixir-1-19.fix Elixir 1.19: Added changelogs 2026-03-25 19:35:46 +00:00
featured-collection-page.fix Fix paged featured collection fetches 2026-05-22 22:11:37 +04:00
fedidev-federation-compat.add fix(activitypub): harden object normalization 2026-07-26 12:35:09 +04:00
fix-preferred-frontend.fix StaticNotFoundPlug: Move 404 on non-existing static files to a new plug 2026-07-20 15:18:49 +00:00
grouped-notifications-api.add Persist notification group keys 2026-05-23 11:38:33 +04:00
grouped-notifs-embed.skip Embed notificaiton details for grouped move/reaction/chat/report notification 2026-08-02 22:13:31 +02:00
grouped_notifications_flag.skip Grouped Notifications: Add feature flag to instance view and nodeinfo 2026-06-10 22:54:06 +02:00
gun-2.6.0.security Sec: Bump cowlib to 2.20.0 and gun to 2.6.0 2026-09-08 21:38:55 +02:00
gun-pool-rework.fix fix(http): forward plain HTTP proxy requests 2026-07-22 20:35:51 +04:00
hackney-4.0.3.security fix(deps): update hackney 2026-07-02 10:57:12 +04:00
hackney-conn-leak.fix fix(deps): pin Hackney to the connection-leak fix 2026-07-26 10:15:52 +04:00
hashtag-timeline.fix changelog 2026-07-21 01:26:06 +02:00
host-header-verification.security EnsureHostMatchesPlug: Ensure Host header matches instance URI 2026-05-12 16:50:28 +02:00
http-signatures-0.1.3.fix Add changelog for http_signatures update 2026-05-11 21:12:34 +04:00
iceshrimpnet-reports-fix.fix Handle reports with just actor ap id as the object 2026-05-13 00:56:56 +02:00
improve-doc-debian-13.change docs: update Debian and Ubuntu requirements 2026-07-27 15:31:59 +04:00
jason-1.4.5.change chore(deps): update jason 2026-07-02 10:48:06 +04:00
list-emoji.add Allow attaching emojis to user lists 2026-06-23 16:08:52 +02:00
logger-backends.change Elixir 1.19: Added changelogs 2026-03-25 19:35:46 +00:00
majic-1.2.0.change Update majic to 1.2.0 2026-05-13 18:39:40 +04:00
mastodon-admin.add MastoAPI: /api/v1/admin/accounts, /api/v1/admin/reports 2026-03-06 10:25:33 +00:00
mastodon-websocket-protocol.fix Fix WebSocket protocol token handshakes 2026-05-22 16:30:14 +04:00
max-body-hackney.fix fix(http): enforce max_body again under Hackney 4 2026-07-26 09:29:36 +04:00
media-proxy-truncated-stream.fix fix(media-proxy): abort truncated streams 2026-07-27 16:32:44 +04:00
mfm-backend.add Add changelog for MFM support 2026-05-11 15:05:00 +04:00
mfm-extend.skip "changelog" 2026-05-18 21:07:12 +03:00
mint-1.10.0.security Sec: Bump mint to version 1.10.0 2026-09-08 21:53:48 +02:00
mix-audit.add chore(deps): add mix audit 2026-07-02 10:20:59 +04:00
oauth-user-preload.change perf(oauth): avoid duplicate user preload 2026-07-24 16:01:34 +04:00
oban-plugins-lazarus-hex.change Use Hex release for oban_plugins_lazarus 2026-05-13 19:10:15 +04:00
oban-reindexer.add Oban: Enable Reindexer plugin to reduce oban_jobs index DB bloat 2026-08-18 19:29:00 +02:00
opt-init.d-migrations.change */init.d/pleroma: run migrations before starting 2024-12-19 21:59:33 +01:00
optimize-orphaned-apps-cleanup.change fix(oauth): preserve dependent app cleanup 2026-07-27 11:57:16 +04:00
paradedb-search.add Fix ParadeDB search indexing 2026-05-25 18:45:47 +04:00
phoenix-1.8.8.security fix(deps): update phoenix 2026-07-02 10:31:34 +04:00
phoenix-1.8.11.security Sec: Bump Phoenix to version 1.8.11 2026-08-19 22:08:20 +02:00
phoenix-sec-websocket-headers.change Switch Phoenix back to upstream 2026-01-18 10:40:10 +01:00
phoenix_live_dashboard-1.2.9.security Sec: Bump Phoenix LiveView to 1.2.9 2026-08-19 22:08:21 +02:00
pleroma-fe-link.fix Update Pleroma-FE build artifacts URL 2026-05-06 13:55:45 +00:00
plug-1.20.2.security fix(deps): update plug 2026-07-02 10:27:21 +04:00
plug-cowboy-2.9.0.security fix(deps): update plug_cowboy 2026-07-02 10:33:50 +04:00
poll-voters-count-inflation.fix Add changelog for votersCount inflation fix 2026-05-06 11:48:20 +04:00
postgrex-0.22.2.security fix(deps): update postgrex 2026-07-02 10:39:34 +04:00
postgrex-0.22.4.security Sec: Bump postgrex to 0.22.4 2026-08-19 22:06:26 +02:00
previewcard-void-fill.fix Status: Fill all MastoAPI required values in preview cards 2024-05-29 06:43:14 +02:00
publisher-worker-atoms.fix fix(workers): avoid dynamic publisher atoms 2026-07-24 16:01:24 +04:00
quic-unused.security fix(deps): remove unused quic lock 2026-07-02 10:40:53 +04:00
rebased-migration.change Add rollback migrations for Rebased 2026-07-29 15:22:13 +04:00
reject-third-party-reports.fix Reject third-party remote reports 2026-05-12 23:50:30 +04:00
remote-ip-hex.change Use upstream remote_ip package 2026-05-13 20:04:12 +04:00
restrict-unauthenticated-account-statuses.fix fix(mastodon-api): restrict unauthenticated account statuses 2026-07-26 18:12:49 +04:00
reverse-proxy-hackney-leak.fix Merge remote-tracking branch 'origin/develop' into audit-mix-audit-report 2026-07-25 19:54:48 +04:00
rss.fix Improve RSS compliance 2026-07-10 16:57:13 +00:00
stream-domain-block-following.fix fix(streaming): preserve followed domain exception 2026-07-24 16:01:46 +04:00
swoosh-1.28.0.security Sec: Bump swoosh to version 1.28.0 2026-09-08 21:53:55 +02:00
syslog-fix-otp.skip Syslog: set runtime: false to fix OTP releases 2026-08-18 21:41:48 +02:00
syslog-pc.fix Syslog: Fix intermittent failure to compile due to old pc version 2026-08-18 19:54:42 +02:00
typo.skip Fix typo in spec 2026-07-28 01:06:00 +02:00
unit-testing-build-vix.skip Woodpecker CI: Build Vix in unit test pipelines instead of downloading 2026-07-20 11:16:25 +02:00
user-cache-keys.fix fix(user): correct cache key invalidation 2026-07-24 16:01:13 +04:00
user-search-sorting.change Add changelog 2026-01-01 10:04:55 +04:00
webhooks.add Mastodon-compatible webhooks 2025-09-19 17:07:23 +02:00
weblate-ci.skip Woodpecker CI: Do not trigger on Weblate MRs 2026-05-14 12:34:27 +02:00
woodpecker-armv7-fixups.fix Woodpecker CI: include armv7 arch in combined Docker tags 2026-07-20 16:49:53 +02:00
wss-necroposts.fix changelog 2026-05-24 23:41:59 +02:00