NodeBB - Package Updates

[Package Updates]

[2.32.1]

• Update NodeBB to 4.15.1
• Full Changelog
• privileges: add "All Categories" aggregate view to admin privileges page (#14303) (7156e73)
• allow delegating user management ACP pages via admin:users (#14629) (6cc33c3)
• allow granting post edit permission to groups (#14625) (f5f9439)
• closes #14635, fix reporterUid (e3ac49b)
• honor topic sort in navigator scroller, closes #12480 (#14634) (47bb314)
• send unread count with new notifications (#14632) (56ade8c)
• resync notification count when loading the notification list (#14631) (f01b041)
• mark chat notifications read when received in the open room (#14627) (daa65da)
• autocomplete menu position in rtl (#14626) (9cfc724)
• enforce email:disableEdit in the email change interstitial (#14620) (d7e6f92)

[Package Updates]

[2.32.2]

• Fix plugin install/update from the admin panel

[Package Updates]

[2.32.3]

• Update NodeBB to 4.15.2
• Full Changelog
• shift-click range selection when selecting posts (#14727) (f7668bd)
• add filter:privileges.posts.delete, fired ahead of the lock gate (#14722) (8d9d064)
• expose topic lock state to filter:privileges.posts.edit (#14710) (61126cc)
• allow disabling all notification emails, closes #5644 (46ac1ee)
• uid can be a groupname in groups.join/leave (857680c)
• do not expose raw content of deleted chat messages (#14709) (c5351fc)
• restrict x-return-to to internal paths (67555b4)
• check upload folder containment in admin uploadFile (#14693) (12230a3)
• return error instead of redirect for banned uid on token-authenticated requests, closes #12739 (#14639) (2c8379b)
• sync client category watch states with core so unread badge updates for watching users (#14648) (7751845)

[Package Updates]

[2.32.4]

• set minBoxVersion version to Cloudron 10 and redis maxmemoryPolicy to volatile-lru

[Package Updates]

[2.33.0]

• Update NodeBB to 4.16.0
• Full Changelog
• allow admins to hide topic event types (#14824)
• add Messaging.isRoomMember() (#14779)
• add action:messaging.markRead hook with previous read timestamp (#14777)
• update chat room url with message index on scroll (#14738)
• expose category privilege copying via v3 API (#14670)
• add full name to ACP user search (#14671)
• add case-sensitive tag support with caseSensitiveTags config (#14690)
• prevent caching of responses carrying a CSRF token (#14787)
• ask for the current password when an admin changes their own password from ACP (#14790)
• skip existing members in addUidsToRoom to preserve join timestamps

[Package Updates]

[2.33.1]

• Update NodeBB to 4.16.1
• Full Changelog
• let plugins map admin routes to privileges from static:privileges.admin.init (#14891) (527b868)
• generic bodyShort for merged notifications with a plugin-registered mergeId (#14886) (d3c5e1d)
• warn in the dashboard when a proxy is in front of an untrusting NodeBB (#14872) (3f479e8)
• let plugins take part in notification merging (#14843) (6c9f017)
• add a write API route for custom user fields (#14840) (3991085)
• category moderators see an empty post queue (#14943) (87f90bb)
• closes #14942, fix undefined attachment (85a9892)
• closes #14926, create indices when converting objects table (#14928) (2cd3678)
• update nodemailer and fix services (247b69b)
• reject array cid in createTopicFromPosts moderator gate (2be4c5c)

[Package Updates]

[2.33.2]

• Update NodeBB to 4.16.2
• Full Changelog
• activitypub: harden emoji cache against path traversal and SSRF (0832880)

[Package Updates]

[2.33.3]

• Update NodeBB to 4.16.3
• Full Changelog
• add an ip lockout to loginAttempts (780dd79)
• chat list search ignores the uid of the chats page being viewed (#15001) (1fc9d42)
• inconsistent sort order and stale results in user list search (#15000) (e4682ff)
• unread notification count includes notifications hidden from the list (#14997) (3a613d2)
• post queue self approve via cid modification (7864331)
• add wasForceLogin check to sso logins as well (c666586)
• serve federated emoji with nosniff/attachment headers (db3581d)
• require completed handshake for relay trust (2b76bc1)
• check target category privileges for remote authors (58e565d)

[Package Updates]

[2.33.4]

• Update base | final to 6.0.1
• security: fix eMudhra cert compromise

[Package Updates]

[2.33.5]

• Update NodeBB to 4.16.4
• Full Changelog
• add inflight request handling to lru/ttl cache (3b778b9)
• return registration pending message (31f883f)
• another security fix for body-parser (de3e773)
• update multer to address CVE (d7502b9)
• crosspost remove bypass via cid type manipulation (1a90f8a)
• closes #15029, apply default user settings set in acp to guests as well (73334d7)
• closes #15023 (b609bd3)
• closes #15022, encode targetId, fixed AP urls (387099d)
• closes #15011, update messageCount on message purge (4e4051f)
• search: support federated (UUID) tids in in-topic search (#15043) (1169aff)

[Package Updates]

[2.33.6]

• Update NodeBB to 4.16.5
• Full Changelog
• add missing ip-locked lang key, closes #15053 (e00506c)
• closes #15052, allow socket.emits from exempt groups (be7580a)
• add hint to force usage of zset indexes (687e1a5)
• catch all exceptions in localLogin, closes #15054 (ce62dcd)
• don't modify passed in data to renderAsync (897c15e)

[Package Updates]

[2.33.7]

• Update Node.js to 24.22.1 for Broccoli2Shell

[Package Updates]

[2.33.8]

• Update NodeBB to 4.16.6
• Full Changelog
• dont allow redirect to unsafe url via /ap?resource path (373f3f3)
• prevent user account enumeration (via email) on login (ce1c358)
• ignore client-supplied uid in registration flow (376d14a)

[Package Updates]

[2.33.9]

• Update NodeBB to 4.16.7
• Full Changelog
• xss in chat message restore via translateHtml (760ded4)
• add dedicated purge button to chat messages, same patter as posts (cdde44e)