diff options
Diffstat (limited to 'changelog.d')
43 files changed, 28 insertions, 0 deletions
diff --git a/changelog.d/2023-06-deps-update.skip b/changelog.d/2023-06-deps-update.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/2023-06-deps-update.skip diff --git a/changelog.d/3126.fix b/changelog.d/3126.fix new file mode 100644 index 000000000..91d396c89 --- /dev/null +++ b/changelog.d/3126.fix @@ -0,0 +1 @@ +MediaProxy responses now return a sandbox CSP header diff --git a/changelog.d/3801.fix b/changelog.d/3801.fix new file mode 100644 index 000000000..8c2ec0199 --- /dev/null +++ b/changelog.d/3801.fix @@ -0,0 +1 @@ +Filter context activities using Visibility.visible_for_user? diff --git a/changelog.d/3831.skip b/changelog.d/3831.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/3831.skip diff --git a/changelog.d/3848.add b/changelog.d/3848.add new file mode 100644 index 000000000..d7b1b0a84 --- /dev/null +++ b/changelog.d/3848.add @@ -0,0 +1 @@ +Add OAuth scope descriptions diff --git a/changelog.d/3874.remove b/changelog.d/3874.remove new file mode 100644 index 000000000..a81f744bf --- /dev/null +++ b/changelog.d/3874.remove @@ -0,0 +1 @@ +Remove a few unused indexes. diff --git a/changelog.d/3880.remove b/changelog.d/3880.remove new file mode 100644 index 000000000..113c76c85 --- /dev/null +++ b/changelog.d/3880.remove @@ -0,0 +1 @@ +Cleanup OStatus-era user upgrades and ap_enabled indicator
\ No newline at end of file diff --git a/changelog.d/3882.add b/changelog.d/3882.add new file mode 100644 index 000000000..4712de1dc --- /dev/null +++ b/changelog.d/3882.add @@ -0,0 +1 @@ +Allow lang attribute in status text diff --git a/changelog.d/3883.fix b/changelog.d/3883.fix new file mode 100644 index 000000000..6824f2013 --- /dev/null +++ b/changelog.d/3883.fix @@ -0,0 +1 @@ +Fix abnormal behaviour when refetching a poll diff --git a/changelog.d/3884.fix b/changelog.d/3884.fix new file mode 100644 index 000000000..f8dbb2bbf --- /dev/null +++ b/changelog.d/3884.fix @@ -0,0 +1 @@ +Allow non-HTTP(s) URIs in "url" fields for compatibility with "FEP-fffd: Proxy Objects"
\ No newline at end of file diff --git a/changelog.d/3885.fix b/changelog.d/3885.fix new file mode 100644 index 000000000..c5fbb0ed4 --- /dev/null +++ b/changelog.d/3885.fix @@ -0,0 +1 @@ +Fix opengraph and twitter card meta tags diff --git a/changelog.d/3888.fix b/changelog.d/3888.fix new file mode 100644 index 000000000..886aa7b39 --- /dev/null +++ b/changelog.d/3888.fix @@ -0,0 +1 @@ +ForceMentionsInContent: fix double mentions for Mastodon/Misskey posts
\ No newline at end of file diff --git a/changelog.d/3891.fix b/changelog.d/3891.fix new file mode 100644 index 000000000..f1fb62d82 --- /dev/null +++ b/changelog.d/3891.fix @@ -0,0 +1 @@ +OEmbed HTML tags are now filtered diff --git a/changelog.d/3893.skip b/changelog.d/3893.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/3893.skip diff --git a/changelog.d/3897.add b/changelog.d/3897.add new file mode 100644 index 000000000..5c4402f45 --- /dev/null +++ b/changelog.d/3897.add @@ -0,0 +1 @@ +OnlyMedia Upload Filter diff --git a/changelog.d/3899.skip b/changelog.d/3899.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/3899.skip diff --git a/changelog.d/3901.security b/changelog.d/3901.security new file mode 100644 index 000000000..a3d8bd01f --- /dev/null +++ b/changelog.d/3901.security @@ -0,0 +1 @@ +Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes. diff --git a/changelog.d/3902.skip b/changelog.d/3902.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/3902.skip diff --git a/changelog.d/3909.skip b/changelog.d/3909.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/3909.skip diff --git a/changelog.d/akkoma-xml-remote-entities.security b/changelog.d/akkoma-xml-remote-entities.security new file mode 100644 index 000000000..5e6725e5b --- /dev/null +++ b/changelog.d/akkoma-xml-remote-entities.security @@ -0,0 +1 @@ +Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem diff --git a/changelog.d/amd64-runner.skip b/changelog.d/amd64-runner.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/amd64-runner.skip diff --git a/changelog.d/attachment-type-check.fix b/changelog.d/attachment-type-check.fix new file mode 100644 index 000000000..9e14b75f1 --- /dev/null +++ b/changelog.d/attachment-type-check.fix @@ -0,0 +1 @@ +Restrict attachments to only uploaded files only diff --git a/changelog.d/changelog-improve.skip b/changelog.d/changelog-improve.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/changelog-improve.skip diff --git a/changelog.d/delete-status-of-banned-user.fix b/changelog.d/delete-status-of-banned-user.fix new file mode 100644 index 000000000..1fa6a29d8 --- /dev/null +++ b/changelog.d/delete-status-of-banned-user.fix @@ -0,0 +1 @@ +Fix error 404 when deleting status of a banned user diff --git a/changelog.d/deprecate-scrobbles.remove b/changelog.d/deprecate-scrobbles.remove new file mode 100644 index 000000000..c453a9784 --- /dev/null +++ b/changelog.d/deprecate-scrobbles.remove @@ -0,0 +1 @@ +Deprecate Pleroma's audio scrobbling diff --git a/changelog.d/disable-xml-entity-resolution.security b/changelog.d/disable-xml-entity-resolution.security new file mode 100644 index 000000000..db8e12f67 --- /dev/null +++ b/changelog.d/disable-xml-entity-resolution.security @@ -0,0 +1 @@ +Disable XML entity resolution completely to fix a dos vulnerability diff --git a/changelog.d/distro-docs-elixir-1.11.skip b/changelog.d/distro-docs-elixir-1.11.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/distro-docs-elixir-1.11.skip diff --git a/changelog.d/dockerfile-config-perms.fix b/changelog.d/dockerfile-config-perms.fix new file mode 100644 index 000000000..49ea5becb --- /dev/null +++ b/changelog.d/dockerfile-config-perms.fix @@ -0,0 +1 @@ +- Fix config ownership in dockerfile to pass restriction test diff --git a/changelog.d/emoji-pack-sanitization.security b/changelog.d/emoji-pack-sanitization.security new file mode 100644 index 000000000..f3218abd4 --- /dev/null +++ b/changelog.d/emoji-pack-sanitization.security @@ -0,0 +1 @@ +Emoji pack loader sanitizes pack names diff --git a/changelog.d/emoji-policy.add b/changelog.d/emoji-policy.add new file mode 100644 index 000000000..45510c4f6 --- /dev/null +++ b/changelog.d/emoji-policy.add @@ -0,0 +1 @@ +Implement MRF policy to reject or delist according to emojis diff --git a/changelog.d/featured-collection-shouldnt-break-user-fetch.fix b/changelog.d/featured-collection-shouldnt-break-user-fetch.fix new file mode 100644 index 000000000..e8ce288cc --- /dev/null +++ b/changelog.d/featured-collection-shouldnt-break-user-fetch.fix @@ -0,0 +1 @@ +Fix user fetch completely broken if featured collection is not in a supported form diff --git a/changelog.d/fix-object-test.fix b/changelog.d/fix-object-test.fix new file mode 100644 index 000000000..5eea719f0 --- /dev/null +++ b/changelog.d/fix-object-test.fix @@ -0,0 +1 @@ +Correctly handle the situation when a poll has both "anyOf" and "oneOf" but one of them being empty diff --git a/changelog.d/gentoo_otp.skip b/changelog.d/gentoo_otp.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/gentoo_otp.skip diff --git a/changelog.d/gentoo_otp_hotfix.skip b/changelog.d/gentoo_otp_hotfix.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/gentoo_otp_hotfix.skip diff --git a/changelog.d/gentoo_otp_intro.skip b/changelog.d/gentoo_otp_intro.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/gentoo_otp_intro.skip diff --git a/changelog.d/handle-report-from-deactivated-user.fix b/changelog.d/handle-report-from-deactivated-user.fix new file mode 100644 index 000000000..6692d1aa8 --- /dev/null +++ b/changelog.d/handle-report-from-deactivated-user.fix @@ -0,0 +1 @@ +Fix handling report from a deactivated user diff --git a/changelog.d/media-altdomain.skip b/changelog.d/media-altdomain.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/media-altdomain.skip diff --git a/changelog.d/no_new_privs.add b/changelog.d/no_new_privs.add new file mode 100644 index 000000000..b67396a4b --- /dev/null +++ b/changelog.d/no_new_privs.add @@ -0,0 +1 @@ +(hardening) Add no_new_privs=yes to OpenRC service files diff --git a/changelog.d/otp_perms.security b/changelog.d/otp_perms.security new file mode 100644 index 000000000..a3da1c677 --- /dev/null +++ b/changelog.d/otp_perms.security @@ -0,0 +1 @@ +- Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories
\ No newline at end of file diff --git a/changelog.d/pipeline-triggers.skip b/changelog.d/pipeline-triggers.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/pipeline-triggers.skip diff --git a/changelog.d/prevent-bypassing-authorized-fetch-mode.fix b/changelog.d/prevent-bypassing-authorized-fetch-mode.fix new file mode 100644 index 000000000..12f7260d7 --- /dev/null +++ b/changelog.d/prevent-bypassing-authorized-fetch-mode.fix @@ -0,0 +1 @@ +Prevent using the .json format to bypass authorized fetch mode
\ No newline at end of file diff --git a/changelog.d/testfix-system-config-use.skip b/changelog.d/testfix-system-config-use.skip new file mode 100644 index 000000000..e69de29bb --- /dev/null +++ b/changelog.d/testfix-system-config-use.skip diff --git a/changelog.d/update-credentials-limit-error.fix b/changelog.d/update-credentials-limit-error.fix new file mode 100644 index 000000000..7682f958e --- /dev/null +++ b/changelog.d/update-credentials-limit-error.fix @@ -0,0 +1 @@ +Show more informative errors when profile exceeds char limits |