Skip to content
Snippets Groups Projects
Select Git revision
  • tedomum default
  • tedomum-prod
  • master protected
  • v4.3.6+tedomum.1
  • v4.3.5+tedomum.1
  • v4.3.4+tedomum.1
  • v4.3.3+tedomum.1
  • v4.3.0+tedomum.1
  • v4.2.12+tedomum.1
  • v4.2.10+tedomum.1
  • v4.2.9+tedomum.1
  • v4.2.8+tedomum.1
  • v4.2.6+tedomum.1
  • v4.2.5+tedomum.1
  • v4.2.4+tedomum.1
  • v4.2.3+tedomum.1
  • v4.2.2+tedomum.4
  • v4.2.2+tedomum.3
  • v4.2.2+tedomum.2
  • v4.2.2+tedomum.1
  • v4.2.1+tedomum.1
  • v4.2.0+tedomum.1
  • v4.1.9+tedomum.1
23 results
Blame Permalink
To find the state of this project's repository at the time of any of these versions, check out the tags.
CHANGELOG.md 130.97 KiB

Changelog

All notable changes to this project will be documented in this file.

[4.2.9] - 2024-05-30

Security

Added

  • Add rate-limit on OAuth application registration (ThisIsMissEm)
  • Add fallback redirection when getting a webfinger query WEB_DOMAIN@WEB_DOMAIN (ClearlyClaire)
  • Add digest attribute to Admin::DomainBlock entity in REST API (ThisIsMissEm)

Removed

  • Remove superfluous application-level caching in some controllers (ClearlyClaire)
  • Remove aggressive OAuth application vacuuming (ThisIsMissEm)

Fixed

  • Fix leaking Elasticsearch connections in Sidekiq processes (ClearlyClaire)
  • Fix language of remote posts not being recognized when using unusual casing (ClearlyClaire)
  • Fix off-by-one in tootctl media commands (ClearlyClaire)
  • Fix removal of allowed domains (in LIMITED_FEDERATION_MODE) not being recorded in the audit log (ThisIsMissEm)
  • Fix not being able to block a subdomain of an already-blocked domain through the API (ClearlyClaire)
  • Fix Idempotency-Key being ignored when scheduling a post (ClearlyClaire)
  • Fix crash when supplying the FFMPEG_BINARY environment variable (timothyjrogers)
  • Fix improper email address validation (ClearlyClaire)
  • Fix results/query in api/v1/featured_tags/suggestions (mjankowski)
  • Fix unblocking internationalized domain names under certain conditions (tribela)
  • Fix admin account created by mastodon:setup not being auto-approved (ClearlyClaire)
  • Fix reference to non-existent var in CLI maintenance command (mjankowski)

[4.2.8] - 2024-02-23

Added

  • Add hourly task to automatically require approval for new registrations in the absence of moderators (ClearlyClaire, ClearlyClaire) In order to prevent future abandoned Mastodon servers from being used for spam, harassment and other malicious activity, Mastodon will now automatically switch new user registrations to require moderator approval whenever they are left open and no activity (including non-moderation actions from apps) from any logged-in user with permission to access moderation reports has been detected in a full week. When this happens, users with the permission to change server settings will receive an email notification. This feature is disabled when EMAIL_DOMAIN_ALLOWLIST is used, and can also be disabled with DISABLE_AUTOMATIC_SWITCHING_TO_APPROVED_REGISTRATIONS=true.

Changed

  • Change registrations to be closed by default on new installations (ClearlyClaire) If you are running a server and never changed your registrations mode from the default, updating will automatically close your registrations. Simply re-enable them through the administration interface or using tootctl settings registrations open if you want to enable them again.

Fixed

  • Fix processing of remote ActivityPub actors making use of Link objects as Image url (ClearlyClaire)
  • Fix link verifications when page size exceeds 1MB (ClearlyClaire)

[4.2.7] - 2024-02-16

Fixed

  • Fix OmniAuth tests and edge cases in error handling (ClearlyClaire, ClearlyClaire)
  • Fix new installs by upgrading to the latest release of the nsa gem, instead of a no longer existing commit (mjankowski)

Security

[4.2.6] - 2024-02-14

Security

  • Update the sidekiq-unique-jobs dependency (see GHSA-cmh9-rx85-xj38) In addition, we have disabled the web interface for sidekiq-unique-jobs out of caution. If you need it, you can re-enable it by setting ENABLE_SIDEKIQ_UNIQUE_JOBS_UI=true. If you only need to clear all locks, you can now use bundle exec rake sidekiq_unique_jobs:delete_all_locks.
  • Update the nokogiri dependency (see GHSA-xc9x-jj77-9p9j)
  • Disable administrative Doorkeeper routes (ThisIsMissEm)
  • Fix ongoing streaming sessions not being invalidated when applications get deleted in some cases (GHSA-7w3c-p9j8-mq3x) In some rare cases, the streaming server was not notified of access tokens revocation on application deletion.
  • Change external authentication behavior to never reattach a new identity to an existing user by default (GHSA-vm39-j3vx-pch3) Up until now, Mastodon has allowed new identities from external authentication providers to attach to an existing local user based on their verified e-mail address. This allowed upgrading users from a database-stored password to an external authentication provider, or move from one authentication provider to another. However, this behavior may be unexpected, and means that when multiple authentication providers are configured, the overall security would be that of the least secure authentication provider. For these reasons, this behavior is now locked under the ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH environment variable. In addition, regardless of this environment variable, Mastodon will refuse to attach two identities from the same authentication provider to the same account.

[4.2.5] - 2024-02-01

Security

[4.2.4] - 2024-01-24

Fixed

  • Fix error when processing remote files with unusually long names (ClearlyClaire)
  • Fix processing of compacted single-item JSON-LD collections (ClearlyClaire)
  • Retry 401 errors on replies fetching (ShadowJonathan)
  • Fix RecordNotUnique errors in LinkCrawlWorker (tribela)
  • Fix Mastodon not correctly processing HTTP Signatures with query strings (ClearlyClaire, ClearlyClaire)
  • Fix potential redirection loop of streaming endpoint (ClearlyClaire)
  • Fix streaming API redirection ignoring the port of streaming_api_base_url (ClearlyClaire)
  • Fix error when processing link preview with an array as inLanguage (ClearlyClaire)
  • Fix unsupported time zone or locale preventing sign-up (Gargron)
  • Fix "Hide these posts from home" list setting not refreshing when switching lists (brianholley)
  • Fix missing background behind dismissable banner in web UI (Gargron)
  • Fix line wrapping of language selection button with long locale codes (gunchleoc, ClearlyClaire)
  • Fix Undo Announce activity not being sent to non-follower authors (MitarashiDango)
  • Fix N+1s because of association preloaders not actually getting called (ClearlyClaire)
  • Fix empty column explainer getting cropped under certain conditions (ClearlyClaire)
  • Fix LinkCrawlWorker error when encountering empty OEmbed response (ClearlyClaire)
  • Fix call to inefficient delete_matched cache method in domain blocks (ClearlyClaire)

Security

  • Add rate-limit of TOTP authentication attempts at controller level (ClearlyClaire)

[4.2.3] - 2023-12-05

Fixed

  • Fix dependency on json-canonicalization version that has been made unavailable since last release

[4.2.2] - 2023-12-04

Changed

  • Change dismissed banners to be stored server-side (ClearlyClaire)
  • Change GIF max matrix size error to explicitly mention GIF files (ClearlyClaire)
  • Change Follow activities delivery to bypass availability check (ShadowJonathan)
  • Change single-column navigation notice to be displayed outside of the logo container (renchap, renchap)
  • Change Content-Security-Policy to be tighter on media paths (ClearlyClaire)
  • Change post language code to include country code when relevant (gunchleoc, ClearlyClaire)

Fixed

  • Fix upper border radius of onboarding columns (ClearlyClaire)
  • Fix incoming status creation date not being restricted to standard ISO8601 (ClearlyClaire, ClearlyClaire)
  • Fix some posts from threads received out-of-order sometimes not being inserted into timelines (ClearlyClaire)
  • Fix posts from force-sensitized accounts being able to trend (ClearlyClaire)
  • Fix error when trying to delete already-deleted file with OpenStack Swift (ClearlyClaire)
  • Fix batch attachment deletion when using OpenStack Swift (ClearlyClaire)
  • Fix processing LDSigned activities from actors with unknown public keys (ClearlyClaire)
  • Fix error and incorrect URLs in /api/v1/accounts/:id/featured_tags for remote accounts (ClearlyClaire)
  • Fix report processing notice not mentioning the report number when performing a custom action (ClearlyClaire)
  • Fix handling of inLanguage attribute in preview card processing (ClearlyClaire)
  • Fix own posts being removed from home timeline when unfollowing a used hashtag (kmycode)
  • Fix some link anchors being recognized as hashtags (ClearlyClaire, ClearlyClaire)
  • Fix format-dependent redirects being cached regardless of requested format (ClearlyClaire)

[4.2.1] - 2023-10-10

Added

  • Add redirection on /deck URLs for logged-out users (ClearlyClaire)
  • Add support for v4.2.0 migrations to tootctl maintenance fix-duplicates (ClearlyClaire)

Changed

  • Change some worker lock TTLs to be shorter-lived (ClearlyClaire)
  • Change user archive export allowed period from 7 days to 6 days (suddjian)

Fixed

  • Fix duplicate reports being sent when reporting some remote posts (ClearlyClaire)
  • Fix clicking on already-opened thread post scrolling to the top of the thread (ClearlyClaire, ClearlyClaire, ClearlyClaire)
  • Fix some remote posts getting truncated (ClearlyClaire)
  • Fix some cases of infinite scroll code trying to fetch inaccessible posts in a loop (ClearlyClaire)
  • Fix Vary headers not being set on some redirects (ClearlyClaire)
  • Fix mentions being matched in some URL query strings (mjankowski)
  • Fix unexpected linebreak in version string in the Web UI (vmstan)
  • Fix double scroll bars in some columns in advanced interface (ClearlyClaire)
  • Fix boosts of local users being filtered in account timelines (ClearlyClaire)
  • Fix multiple instances of the trend refresh scheduler sometimes running at once (ClearlyClaire)
  • Fix importer returning negative row estimates (jgillich)
  • Fix incorrectly keeping outdated update notices absent from the API endpoint (ClearlyClaire)
  • Fix import progress not updating on certain failures (ClearlyClaire)
  • Fix websocket connections being incorrectly decremented twice on errors (ThisIsMissEm)
  • Fix explore prompt appearing because of posts being received out of order (ClearlyClaire)
  • Fix explore prompt sometimes showing up when the home TL is loading (ClearlyClaire)
  • Fix link handling of mentions in user profiles when logged out (ClearlyClaire)
  • Fix filtering audit log for entries about disabling 2FA (ClearlyClaire)
  • Fix notification toasts not respecting reduce-motion (c960657)
  • Fix retention dashboard not displaying correct month (vmstan)
  • Fix tIME chunk not being properly removed from PNG uploads (TheEssem)
  • Fix division by zero in video in bitrate computation code (ClearlyClaire)
  • Fix inefficient queries in “Follows and followers” as well as several admin pages (ClearlyClaire, ClearlyClaire)
  • Fix ActiveRecord using two connection pools when no replica is defined (ClearlyClaire)
  • Fix the search documentation URL in system checks (renchap)

[4.2.0] - 2023-09-21