Mastodon - Package Updates

[nebulon]

[1.13.1]

• Update Mastodon to 4.2.8
• This update changes registrations to be closed by default.
• Full changelog
• Add hourly task to automatically require approval for new registrations in the absence of moderators (ClearlyClaire, ClearlyClaire)
• In order to prevent future abandoned Mastodon servers from being used for spam, harassment and other malicious activity, Mastodon will now automatically switch new user registrations to require moderator approval whenever they are left open and no activity (including non-moderation actions from apps) from any logged-in user with permission to access moderation reports has been detected in a full week.
• When this happens, users with the permission to change server settings will receive an email notification.
• This feature is disabled when EMAIL_DOMAIN_ALLOWLIST is used, and can also be disabled with DISABLE_AUTOMATIC_SWITCHING_TO_APPROVED_REGISTRATIONS=true.
• Change registrations to be closed by default on new installations (ClearlyClaire)
• If you are running a server and never changed your registrations mode from the default, updating will automatically close your registrations.
• Simply re-enable them through the administration interface or using tootctl settings registrations open if you want to enable them again.
• Fix processing of remote ActivityPub actors making use of Link objects as Image url (ClearlyClaire)
• Fix link verifications when page size exceeds 1MB (ClearlyClaire)

[girish]

[1.13.2]

• Update Mastodon to 4.2.9
• Full changelog
• Update dependencies
• Fix private mention filtering (GHSA-5fq7-3p3j-9vrf)
• Fix password change endpoint not being rate-limited (GHSA-q3rg-xx5v-4mxh)
• Add hardening around rate-limit bypass (GHSA-c2r5-cfqr-c553)

[nebulon]

[1.13.3]

• Update Mastodon to 4.2.10
• Full changelog

[Package Updates]

[1.13.4]

• Update Mastodon to 4.2.11
• Full changelog

[Package Updates]

[1.13.5]

• Update Mastodon to 4.2.12
• Full changelog
• This is a hotfix release for an issue introduced in 4.2.11

[Package Updates]

[1.13.6]

• Update Mastodon to 4.2.13
• Full changelog
• Fix ReDoS vulnerability on some Ruby versions (GHSA-jpxp-r43f-rhvx)
• Update dependencies
• Add “A Mastodon update is available.” message on admin dashboard for non-bugfix updates (#32106 by @ClearlyClaire)
• Change Mastodon to issue correct HTTP signatures by default (#31994 by @ClearlyClaire)
• Fix replies collection being cached improperly
• Fix security context sometimes not being added in LD-Signed activities (#31871 by @ClearlyClaire)
• Fix error when encountering reblog of deleted post in feed rebuild (#32001 by @ClearlyClaire)

[Package Updates]

[1.14.0]

• Update Mastodon to 4.3.0
• Full changelog
• Add server-side notification grouping
• Add notification policies, filtered notifications and notification requests
• Add notifications of severed relationships
• Add hover cards in web UI
• Add "system" theme setting (light/dark theme depending on user system preference)
• Add timeline of public posts about a trending link
• Add author highlight for news articles whose authors are on the fediverse

[Package Updates]

[1.14.1]

• Update Mastodon to 4.3.1
• Full changelog

[Package Updates]

[1.14.2]

• Update mastodon to 4.3.2
• Full Changelog
• Add tootctl feeds vacuum (#​33065 by @​ClearlyClaire)
• Add error message when user tries to follow their own account (#​31910 by @​lenikadali)
• Add client_secret_expires_at to OAuth Applications (#​30317 by @​ThisIsMissEm)
• Change design of Content Warnings and filters (#​32543 by @​ClearlyClaire)
• Fix processing incoming post edits with mentions to unresolvable accounts (#​33129 by @​ClearlyClaire)
• Fix error when including multiple instances of embed.js (#​33107 by @​YKWeyer)
• Fix inactive users' timelines being backfilled on follow and unsuspend (#​33094 by @​ClearlyClaire)
• Fix direct inbox delivery pushing posts into inactive followers' timelines (#​33067 by @​ClearlyClaire)
• Fix TagFollow records not being correctly handled in account operations (#​33063 by @​ClearlyClaire)
• Fix pushing hashtag-followed posts to feeds of inactive users (#​33018 by @​Gargron)
• Fix duplicate notifications in notification groups when using slow mode (#​33014 by @​ClearlyClaire)
• Fix posts made in the future being allowed to trend (#​32996 by @​ClearlyClaire)
• Fix uploading higher-than-wide GIF profile picture with libvips enabled (#​32911 by @​ClearlyClaire)
• Fix domain attribution field having autocorrect and autocapitalize enabled (#​32903 by @​ClearlyClaire)
• Fix titles being escaped twice (#​32889 by @​ClearlyClaire)
• Fix list creation limit check (#​32869 by @​ClearlyClaire)
• Fix error in tootctl email_domain_blocks when supplying --with-dns-records (#​32863 by @​mjankowski)
• Fix min_id and max_id causing error in search API (#​32857 by @​Gargron)
• Fix inefficiencies when processing removal of posts that use featured tags (#​32787 by @​ClearlyClaire)
• Fix alt-text pop-in not using the translated description (#​32766 by @​ClearlyClaire)
• Fix preview cards with long titles erroneously causing layout changes (#​32678 by @​ClearlyClaire)
• Fix embed modal layout on mobile (#​32641 by @​DismalShadowX)
• Fix and improve batch attachment deletion handling when using OpenStack Swift (#​32637 by @​hugogameiro)
• Fix blocks not being applied on link timeline (#​32625 by @​tribela)
• Fix follow counters being incorrectly changed (#​32622 by @​oneiros)
• Fix 'unknown' media attachment type rendering (#​32613 and #​32713 by @​ThisIsMissEm and @​renatolond)
• Fix tl language native name (#​32606 by @​seav)

[Package Updates]

[1.14.3]

• Update mastodon to 4.3.3
• Full Changelog
• Fix insufficient validation of account URIs (GHSA-5wxh-3p65-r4g6)
• Update dependencies
• Fix libyaml missing from Dockerfile build stage (#​33591 by @​vmstan)
• Fix incorrect notification settings migration for non-followers (#​33348 by @​ClearlyClaire)
• Fix down clause for notification policy v2 migrations (#​33340 by @​jesseplusplus)
• Fix error decrementing status count when FeaturedTags#last_status_at is nil (#​33320 by @​ClearlyClaire)
• Fix last paginated notification group only including data on a single notification (#​33271 by @​ClearlyClaire)

[Package Updates]

[1.14.4]

• Update mastodon to 4.3.4
• Full Changelog
• Fix GET /api/v2/notifications/:id and POST /api/v2/notifications/:id/dismiss for ungrouped notifications (#​33990 by @​ClearlyClaire)
• Fix issue with some versions of libvips on some systems (#​33853 by @​kleisauke)
• Fix handling of duplicate mentions in incoming status Update (#​33911 by @​ClearlyClaire)
• Fix inefficiencies in timeline generation (#​33839 and #​33842 by @​ClearlyClaire)
• Fix emoji rewrite adding unnecessary curft to the DOM for most emoji (#​33818 by @​ClearlyClaire)
• Fix tootctl feeds build not building list timelines (#​33783 by @​ClearlyClaire)
• Fix processing of incoming notifications for unfilterable types (#​33429 by @​ClearlyClaire)

[Package Updates]

[1.14.5]

• Update mastodon to 4.3.5
• Full Changelog
• Change hashtag suggestion to prefer personal history capitalization (#​34070 by @​ClearlyClaire)
• Fix processing errors for some HEIF images from iOS 18 (#​34086 by @​renchap)
• Fix streaming server not filtering unknown-language posts from public timelines (#​33774 by @​ClearlyClaire)
• Fix preview cards under Content Warnings not being shown in detailed statuses (#​34068 by @​ClearlyClaire)
• Fix username and display name being hidden on narrow screens in moderation interface (#​33064 by @​ClearlyClaire)
• Ruby: 3.1 or newer
• PostgreSQL: 12 or newer. PostgreSQL versions 14.0 to 14.3 are not supported as they contain a critical data-corruption bug (see v4.3.0 release notes)
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 4 or newer
• Node: 18 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer

[Package Updates]

[1.15.0]

• Update base image to 5.0.0

[Package Updates]

[1.15.1]

• Update mastodon to 4.3.6
• Full Changelog
• Update dependency omniauth-saml
• Update dependency rack
• Fix Stoplight errors when using REDIS_NAMESPACE (#​34126 by @​ClearlyClaire)

[Package Updates]

[1.15.2]

• Update mastodon to 4.3.7
• Full Changelog
• Add delay to profile updates to debounce them (#34137 by @ClearlyClaire)
• Add support for paginating partial collections in SynchronizeFollowersService (#34272 and #34277 by @ClearlyClaire)
• Change account suspensions to be federated to recently-followed accounts as well (#34294 by @ClearlyClaire)
• Change AccountReachFinder to consider statuses based on suspension date (#32805 and #34291 by @ClearlyClaire and @mjankowski)
• Change user archive signed URL TTL from 10 seconds to 1 hour (#34254 by @ClearlyClaire)
• Fix static version of animated PNG emojis not being properly extracted (#34337 by @ClearlyClaire)
• Fix filters not applying in detailed view, favourites and bookmarks (#34259 and #34260 by @ClearlyClaire)
• Fix handling of malformed/unusual HTML (#34201 by @ClearlyClaire)
• Fix CacheBuster being queued for missing media attachments (#34253 by @ClearlyClaire)
• Fix incorrect URL being used when cache busting (#34189 by @ClearlyClaire)

[Package Updates]

[1.15.3]

• Update mastodon to 4.3.8
• Full Changelog
• Add warning for REDIS_NAMESPACE deprecation at startup (#34581 by @ClearlyClaire)
• Add built-in context for interaction policies (#34574 by @ClearlyClaire)
• Change activity distribution error handling to skip retrying for deleted accounts (#33617 by @ClearlyClaire)
• Remove double-query for signed query strings (#34610 by @ClearlyClaire)
• Fix incorrect redirect in response to unauthenticated API requests in limited federation mode (#34549 by @ClearlyClaire)
• Fix sign-up e-mail confirmation page reloading on error or redirect (#34548 by @ClearlyClaire)

[Package Updates]

[1.15.4]

• Update mastodon to 4.3.9
• Full Changelog
• Change passthrough video processing to emit moov atom at start of video (#​34726 by @​ClearlyClaire)
• Fix NoMethodError in edge case of emoji cache handling (#​34749 by @​dariusk)
• Fix error when viewing statuses to deleted replies in moderation view (#​32986 by @​ClearlyClaire)
• Fix search operators sometimes getting lost (#​35190 by @​ClearlyClaire)
• Fix Alt text button submitting form in moderation interface (#​35147 by @​ClearlyClaire)
• Fix handling of remote attachments with multiple media types (#​34996 by @​ClearlyClaire)
• Fix blocked accounts not being automatically removed from trending statuses (#​34891 by @​ClearlyClaire)
• Fix inconsistent filtering of silenced accounts for other silenced accounts (#​34863 by @​ClearlyClaire)
• Fix handling of inlined featured collections in ActivityPub actor objects (#​34789 and #​34811 by @​ClearlyClaire)
• Fix admin dashboard crash on specific Elasticsearch connection errors (#​34683 by @​ClearlyClaire)

[Package Updates]

[1.16.0]

• Update mastodon to 4.4.0
• Full Changelog
• Add Followers you know widget to user profiles and hover cards (#34652, #34678, #34681, #34697, #34699, #34769, #34774 and #34914 by @diondiondion)
• Add featured tab to profiles on web UI and rework pinned posts (#34405, #34483, #34491, #34754, #34855, #34858, #34868, #34869, #34927, #34995, #35056 and #34931 by @ChaosExAnima, @ClearlyClaire, @Gargron, and @diondiondion)
• Add endorsed accounts to featured tab in web UI (#34421 and #34568 by @Gargron)
• Add ability to add and remove hashtags from featured tags in web UI (#34489, #34887, and #34490 by @ClearlyClaire and @Gargron)
• Add reminder when about to post without alt text in web UI (#33760 and #33784 by @Gargron)
• Add a warning in Web UI when composing a post when the selected and detected language are different (#33042, #33683, #33700, #33724, #33770, and #34193 by @ClearlyClaire and @Gargron)
• Add support for verifying and displaying remote quote posts (#34370, #34481, #34510, #34551, #34480, #34479, #34553, #34584, #34623, #34738, #34766, #34770, #34772, #34773, #34786, #34790, #34864, #34957, #34961, #35016, #35022, #35036, #34946, #34945 and #34958 by @ClearlyClaire and @diondiondion)
• Add ability to reorder and translate server rules (#34637, #34737, #34494, #34756, #34820, #34997, #35170, #35174 and #35174 by @ChaosExAnima and @ClearlyClaire)
• Add emoji from Twemoji 15.1.0, including in the emoji picker/completion (#33395, #34321, #34620, and #34677 by @ChaosExAnima, @ClearlyClaire, @TheEssem, and @eramdam)
• Add option to remove account from followers in web UI (#34488 by @Gargron)

[Package Updates]

[1.16.1]

• Update mastodon to 4.4.1
• Full Changelog
• Fix nearly every sub-directory being crawled as part of Vite build (#35323 by @ClearlyClaire)
• Fix assets not building when Redis is unavailable (#35321 by @oneiros)
• Fix replying from media modal or pop-in-player tagging user @undefined (#35317 by @ClearlyClaire)
• Fix support for special characters in various environment variables (#35314 by @mjankowski and @ClearlyClaire)
• Fix some database migrations failing for indexes manually removed by admins (#35309 by @mjankowski)

[Package Updates]

[1.16.2]

• Update mastodon to 4.4.2
• Full Changelog
• update dependencies
• Fix menu not clickable in Firefox (#​35390 and #​35414 by @​diondiondion)
• Add lang attribute to current composer language in alt text modal (#​35412 by @​diondiondion)
• Fix quote posts styling on notifications page (#​35411 by @​diondiondion)
• Improve a11y of custom select menus in notifications settings (#​35403 by @​diondiondion)
• Fix selected item in poll select menus is unreadable in Firefox (#​35402 by @​diondiondion)
• Update age limit wording (#​35387 by @​diondiondion)
• Fix support for quote verification in implicit status updates (#​35384 by @​ClearlyClaire)
• Improve Dropdown component accessibility (#​35373 by @​diondiondion)
• Fix processing some incoming quotes failing because of missing JSON-LD context (#​35354 and #​35380 by @​ClearlyClaire)