NodeBB - Package Updates

[Package Updates]

[2.29.1]

• Update NodeBB to 4.13.2
• Full Changelog
• register service worker on safari (2ec0987)
• closes #14355 dont flash unread notif for topics (0e8544b)
• uids used for priv check (bd7bf5b)
• dont allow global mods gdpr export (39299bd)
• prevent uploading thumbs if user does not have upload:image privilege (72defdc)
• dont mark nids that you don't own read/unread (001e45d)
• bind hooks module in admin/settings/email define() (#14352) (86fd621)
• translator.escape chat messages & teasers (7ef400b)
• closes #14346, make nodebb global available in src/cli (620ab63)
• closes #14344, fix cron jobs (d23efb4)

[Package Updates]

[2.30.0]

• Enable scaling by allowing to spin up more nodebb processes to utilize multiple CPU cores
• See https://docs.cloudron.io/packages/nodebb/#scaling

[Package Updates]

[2.31.0]

• Update NodeBB to 4.14.0
• Full Changelog
• add first-run modal for new installations (19e25f2)
• add localhost and URL mismatch warnings to dashboard notices (644034d)
• add reject all on registration queue (39f1115)
• extend prune cutoff for followed remote categories (57e65d0)
• make public key fetch rate limit configurable (471b827)
• block re-queuing of rejected crossposts (b9473b9)
• dont allow loading group list via api/v3 (3760c1e)
• check topics:read privilege when loading post diffs (8467945)
• closes #14432, dont show mobile nav on chat page (1633b47)
• use dummy lockout key for non-existent users to prevent username enumeration (e65c23a)

[Package Updates]

[2.31.1]

• Update NodeBB to 4.14.1
• Full Changelog
• add missing translations for admin restart/rebuild messages (ae76f5b)
• hide unenterable rooms from the chat list (#14483) (2540ec8)
• don't show bookmark alert when there is nothing to return to (#14476) (eb14adc)
• #14473, don't subtract milliseconds to generate dates (9e34bab)
• closes #14458, go back to using .translate for bodyShort (162cb67)
• closes #14453 (597cdb4)
• don't return ip of post on post edit (74360ec)
• recognize non-ASCII webfinger handles (#14466) (5b9b174)
• use raw body buffer for digest verification (6067a49)
• mark notifications with matching roomId read when opening a room (#14450) (3a7497e)

[Package Updates]

[2.31.2]

• Update NodeBB to 4.14.2
• Full Changelog
• tx error message on /login (c7cab16)
• lang key in intents (73d80fb)
• activitypub: use absolute avatar/cover URLs as-is in user actor (#14447) (7ccc3d2)

[Package Updates]

[2.31.3]

• Update NodeBB to 4.14.3
• Full Changelog
• don't prompt for plugin upgrades when stdin is not a TTY (#14523) (091a50d)
• closes #14524, don't return errors for rate limit error (1d3d65b)
• getEmail to verify email belongs to uid, closes #14512 (e5cc6c2)
• closes #14511 (dd4fd54)
• closes #14510 (0b0de8a)
• regression from benchpress parse => render change (afbecfd)
• closes #14506, only allow valid theme names in previews (298c6a0)
• update privileges.posts.get so it checks topic for (2c1a747)
• closes #14501, wrap toggleInstall and upgrade in try/catch (a034c26)
• closes #14500 (fc13bb5)

[Package Updates]

[2.31.4]

• Update NodeBB to 4.14.4
• Full Changelog
• trust_proxy upgrade script writes to wrong config.json when started with --config (breaks Docker logins) (#14527) (29f90de)

[Package Updates]

[2.31.5]

• Update NodeBB to 4.14.5
• Full Changelog
• clear session info when switching users in doLogin (bc206f6)
• replace outdated .includes() check for AP header in webfinger query method, in favour of Helpers.assertAccept (2079ea0)
• guard title regeneration in inbox.update behind posts.isMain (94feb90)
• only allow self/admins/gmods to view/list emails (a018478)
• enforce same checks on topic room enter as controller (54ff68b)
• search by email array bypass (5029739)
• dont return category if user doesnt have find privilege in getSelectedCategory (5a9d7f7)
• rss feed privilege check for topic feeds (2cc3ae1)
• private upload path bypass (35e7587)
• closes #14528, encode uid in group calls (c857090)

[Package Updates]

[2.31.6]

• Update NodeBB to 4.14.6
• Full Changelog
• tx.compile so arguments can't break out of the translation token (1205d0b)
• dont leak ip in api/v3 replies and summary (fadb4e3)
• escape uid in buildAvatar (f2615ed)
• closes #14533, json.stringify and escape breadcrumbs structured data (433c768)

[Package Updates]

[2.31.7]

• Update NodeBB to 4.14.7
• Full Changelog
• add a middleware to require reauth on api routes (69e749a)
• use renderCategory for move event (6972b70)
• closes #14550, closes #14549 (5f6ddbd)
• closes #14548, wait for parsing of input elements before selecting (0d67edd)
• hide URL profile upload when uploads are disabled (#14547) (fafced7)
• use isSafeHref on user.url and category.url (26333b8)
• privileges: route ActivityPub URIs to fediverse pseudo-user check (ab95445)
• activitypub: enforce attributedTo origin check in inbox handlers (f93507a)

[Package Updates]

[2.31.8]

• Update NodeBB to 4.14.8
• Full Changelog
• typo on reauthAt (f29db71)
• don't save req into post queue (28899f7)
• closes #14553, closes #14554 (37c1853)
• sanitize system messages (f5be7f6)
• handle both local and remote users' aboutme identically (3f18849)
• validate group hex colors (a30dfd1)
• add priv check to loading profile pictures (707bfe0)
• reject invalid cid in topic post route (35c4975)
• xss in room rename event in chat modals (55b1ea5)
• api: exclude cookie header from buildReqObject to prevent session token exposure in post queue (e44d909)