Fider - Package Updates

[Package Updates]

[3.0.0]

• Remove built-in OIDC integration. The OIDC integration is meant to be used like external provider login. Set this up manually if required

[Package Updates]

[3.1.0]

• Update fider to 0.35.0
• Full Changelog
• Support for an annual plan too. by @mattwoberts in #1516
• Fix mass assignment auth bypass in sign-in verification by @mattwoberts in #1517
• Add rate limiting to sign-in verification code by @mattwoberts in #1524
• fix(email): unescape HTML entities in rendered subject by @americodias in #1513
• Harden post filter against edge cases by @lol2x in #1515

[Package Updates]

[3.2.0]

• Update fider to 0.36.0
• Full Changelog
• This release includes several security fixes upgrading is recommended.
• SSRF hardening block server-side request forgery via custom OAuth provider Token/Profile URLs.
• XSS fix prevent potential malicious script execution in rendered content (plus a DOMPurify update).
• Invite scoping invite-token verification is now scoped to the tenant.
• Roadmap a new public roadmap view (pro-only on the cloud instance)
• Self-service board deletion owners on multi-site instances can schedule deletion of their own board, with a grace period, a cancel link, and a confirmation email.
• SMTP implicit TLS (SMTPS) optional implicit-TLS / port-465 support for outbound email.
• Show images placed at the very beginning of post content.
• Append attachments supplied via POST /api/v1/posts to the end of the post description.
• New navigation header: stop notification icons wrapping onto a second row.

[Package Updates]

[3.2.1]

• Update fider to 0.36.1
• Full Changelog
• feat(webhooks): ALLOW_PRIVATE_NETWORK_TARGETS env to allow internal targets by @hodyhq in #1579
• Fix missing email strings by @mattwoberts in #1598
• Respond copy by @mattwoberts in #1601

[Package Updates]

[3.3.0]

• Update fider to 0.37.0
• Full Changelog
• Stop retrying Let's Encrypt for hosts that just failed by @mattwoberts in #1616
• Improvements to tiptap editor by @mattwoberts in #1604
• Plural vote translations by @mattwoberts in #1605
• Issues with the share feedback page by @mattwoberts in #1617
• fix(locale): register and polish Korean (ko) translations by @Cynn in #1619
• Fix cross-tenant auth takeover via tenant-unbound user lookup by @mattwoberts in #1623
• Update Italian translation by @albanobattistella in #1592
• Bind OAuth sign-in to the tenant's canonical origin by @mattwoberts in #1626
• Support for deleting accounts from support tools by @mattwoberts in #1671
• Sanitize backend markdown output and filter URL schemes by @mattwoberts in #1673

[Package Updates]

[3.4.0]

• Update fider to 0.38.0
• Full Changelog
• GHSA-whx4-hxwq-qgjh: SSRF protection bypass via DNS rebinding (#1678)
• GHSA-p8j9-wxg9-qp34: SSRF protection bypass via IPv6 transition addresses (#1678)
• GHSA-xjr8-w967-4xjq: CSRF bypass via the Accept header (#1676)
• GHSA-7cw3-7xh9-529r: Denial of service via image decompression bomb (#1677)
• Enforce the SSRF guard at connect time and block IPv6 transition addresses by @mattwoberts in #1678
• Require a preflight-forcing signal for write requests (CSRF hardening) by @mattwoberts in #1676
• Bound image decode memory before resizing (decompression bomb DoS) by @mattwoberts in #1677

[Package Updates]

[3.4.1]

• Update fider to 0.38.1
• Full Changelog
• Fixed a stored XSS in post previews on the home page and in the moderation queue (#1687). Advisory to follow.
• Security updates for dependencies, including gomarkdown, DOMPurify, golang.org/x/crypto and golang.org/x/net (#1682).
• Now built with Go 1.27, because Go 1.25 no longer gets security fixes (#1686).
• Editor upgraded to tiptap v3, with a single markdown engine for editing and display. Tables and task lists are now kept when editing (#1644).
• Search engines now get fully rendered pages; previously, pages showing vote counts failed to render for them (#1685).
• Design System page fix (#1654, thanks @dhinesh20022806).

[Package Updates]

[3.4.2]

• Update fider to 0.38.2
• Full Changelog
• GHSA-wjrq-7x2x-9p48: display names and post titles weren't escaped in notification emails and in-app notifications (#1704)
• GHSA-5x23-xx46-6w7r: comments on deleted posts could still be read through the API (#1718)
• Hardening (#1703 request size limits, pagination caps, extra security headers, and stricter image upload checks
• Code in posts and comments shows < instead of <, which had been wrong since 2019 (#1698)
• Closing a post no longer makes the list jump to the top for a moment (#1708)
• Email subjects no longer lose their first few letters in some cases (#1704)
• Modal accessibility fix (#1709)

[Package Updates]

[3.5.0]

• Update node-base | final to 24-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[3.6.0]

• Update fider to 0.39.0
• Full Changelog
• LOG_SQL now defaults to false (#1688). Fider no longer writes every log entry to the logs table, which was never pruned and could grow to many GB. Console logging is unchanged. If you read logs from the database, set LOG_SQL=true. To reclaim the space on an existing install, run TRUNCATE logs; once.
• GHSA-f9m2-vm33-7hvh: a blocked administrator's API key still worked when combined with the X-Fider-UserID impersonation header (#1751)
• OAuth sign-in rejects redirect targets that start with several slashes (#1737)
• DOMPurify updated to 3.4.17 (#1743)
• Disable sign-ups (#1732 a new toggle under Site Settings > Privacy stops visitors creating their own accounts, so a public board can be invite-only. Trusted OAuth providers can still create accounts. Thanks @kevinpapst.
• Post actions have moved into a 3-dot menu at the top of the post (#1725)
• The members menu lists every user level (Administrator, Collaborator, Trusted member, Member, Blocked) and you can move a user between any of them. The API roles filter also accepts member, trusted and blocked (#1726)
• Fider stops responding (#1744, fixes #1042 the SQL blob storage opened a second database connection for every image request, so a few concurrent image requests could use up the connection pool and hang every request after that. Thanks @kevinpapst for tracking this one down.
• Mobile layout fixes for posts, comments, modals and sign-in (#1720)
• Declining a post takes you back to the home page instead of a 404 (#1746, thanks @kevinpapst)