NodeBB - Package Updates

[Package Updates]

[2.28.0]

• Update NodeBB to 4.12.0
• Full Changelog
• add privilege gate behind category outbox AP route (#14300)
• add a nbbRequire that works with esm/cjs (56606f3)
• allow owners to move misplaced topics (#14227)
• add blocked file extensions (blacklist) to complement the existing allowlist (#14229)
• add new localisation, Burmese (Myanmar) (b082d97)
• #14202, naive fulltext search on chats list (3f31105)
• don't escape [ & ] breaks nested translations (730e4da)
• custom routes bypassing /admin checks (19c7473)
• sanitize xml files in uploads (2bde875)
• #14208, off-by-some error on getUsersFields (b8af937)

[Package Updates]

[2.29.0]

• Update NodeBB to 4.13.0
• Full Changelog
• add core blocklist for domain management (fe48222)
• add filter option to categorization rules for post queue gating (dfb108e)
• add severity 3 (filter) queuing for blocklisted posts (80f40ae)
• cross-check received payload against received digest header if present (590ac68)
• upgrade to fa7 (4eec1d7)
• prevent XSS via intent templates and plugin upgrade bypass (2ba4119)
• reject POST requests without HTTP signature header (c4b9d03)
• anchor actor/uid passthrough regexes to prevent inbox bypass (6fcc344)
• replace user lockout with per-IP rate limit for RSS token failures (#14329) (bdac7a7)
• dont allow returning notifications by nid (fb3a905)

[james]

NodeBB Update 4.13.1 blocked by upstream issue: https://github.com/NodeBB/NodeBB/issues/14351

[Package Updates]

[2.29.1]

• Update NodeBB to 4.13.2
• Full Changelog
• register service worker on safari (2ec0987)
• closes #14355 dont flash unread notif for topics (0e8544b)
• uids used for priv check (bd7bf5b)
• dont allow global mods gdpr export (39299bd)
• prevent uploading thumbs if user does not have upload:image privilege (72defdc)
• dont mark nids that you don't own read/unread (001e45d)
• bind hooks module in admin/settings/email define() (#14352) (86fd621)
• translator.escape chat messages & teasers (7ef400b)
• closes #14346, make nodebb global available in src/cli (620ab63)
• closes #14344, fix cron jobs (d23efb4)

[Package Updates]

[2.30.0]

• Enable scaling by allowing to spin up more nodebb processes to utilize multiple CPU cores
• See https://docs.cloudron.io/packages/nodebb/#scaling

[Package Updates]

[2.31.0]

• Update NodeBB to 4.14.0
• Full Changelog
• add first-run modal for new installations (19e25f2)
• add localhost and URL mismatch warnings to dashboard notices (644034d)
• add reject all on registration queue (39f1115)
• extend prune cutoff for followed remote categories (57e65d0)
• make public key fetch rate limit configurable (471b827)
• block re-queuing of rejected crossposts (b9473b9)
• dont allow loading group list via api/v3 (3760c1e)
• check topics:read privilege when loading post diffs (8467945)
• closes #14432, dont show mobile nav on chat page (1633b47)
• use dummy lockout key for non-existent users to prevent username enumeration (e65c23a)

[Package Updates]

[2.31.1]

• Update NodeBB to 4.14.1
• Full Changelog
• add missing translations for admin restart/rebuild messages (ae76f5b)
• hide unenterable rooms from the chat list (#14483) (2540ec8)
• don't show bookmark alert when there is nothing to return to (#14476) (eb14adc)
• #14473, don't subtract milliseconds to generate dates (9e34bab)
• closes #14458, go back to using .translate for bodyShort (162cb67)
• closes #14453 (597cdb4)
• don't return ip of post on post edit (74360ec)
• recognize non-ASCII webfinger handles (#14466) (5b9b174)
• use raw body buffer for digest verification (6067a49)
• mark notifications with matching roomId read when opening a room (#14450) (3a7497e)

[Package Updates]

[2.31.2]

• Update NodeBB to 4.14.2
• Full Changelog
• tx error message on /login (c7cab16)
• lang key in intents (73d80fb)
• activitypub: use absolute avatar/cover URLs as-is in user actor (#14447) (7ccc3d2)

[Package Updates]

[2.31.3]

• Update NodeBB to 4.14.3
• Full Changelog
• don't prompt for plugin upgrades when stdin is not a TTY (#14523) (091a50d)
• closes #14524, don't return errors for rate limit error (1d3d65b)
• getEmail to verify email belongs to uid, closes #14512 (e5cc6c2)
• closes #14511 (dd4fd54)
• closes #14510 (0b0de8a)
• regression from benchpress parse => render change (afbecfd)
• closes #14506, only allow valid theme names in previews (298c6a0)
• update privileges.posts.get so it checks topic for (2c1a747)
• closes #14501, wrap toggleInstall and upgrade in try/catch (a034c26)
• closes #14500 (fc13bb5)

[Package Updates]

[2.31.4]

• Update NodeBB to 4.14.4
• Full Changelog
• trust_proxy upgrade script writes to wrong config.json when started with --config (breaks Docker logins) (#14527) (29f90de)

[Package Updates]

[2.31.5]

• Update NodeBB to 4.14.5
• Full Changelog
• clear session info when switching users in doLogin (bc206f6)
• replace outdated .includes() check for AP header in webfinger query method, in favour of Helpers.assertAccept (2079ea0)
• guard title regeneration in inbox.update behind posts.isMain (94feb90)
• only allow self/admins/gmods to view/list emails (a018478)
• enforce same checks on topic room enter as controller (54ff68b)
• search by email array bypass (5029739)
• dont return category if user doesnt have find privilege in getSelectedCategory (5a9d7f7)
• rss feed privilege check for topic feeds (2cc3ae1)
• private upload path bypass (35e7587)
• closes #14528, encode uid in group calls (c857090)