Mastodon - Package Updates

[Package Updates]

[1.18.6]

• Update mastodon to 4.6.5
• Full Changelog
• Fix Collection items being rejected because of incorrect attribute being read (#40052 by @shleeable)
• Fix typo in embedded quote handling code (#40049 by @shleeable)
• Fix account merging worker incorrectly merging Appeal and AccountWarning records (#39982 by @shleeable)
• Fix off-by-one in handling of updated remote posts allowing up to 5 attachments (#39978 by @shleeable)
• Fix collection items limit not being consistently applied (#39969 by @oneiros)
• Fix oversized profile image crop uploads (#39958 by @sharlayan)
• Fix emoji autocomplete sometimes suggesting emojis for earlier keystrokes (#39947 by @ChaosExAnima)

[Package Updates]

[1.18.7]

• Update mastodon to 4.6.6
• Full Changelog
• Change mastodon:setup task warning about trademark to match masto but ignore subdomains (#40143 by @ClearlyClaire)
• Fix connection errors when processing fediverse:creator preventing creation of preview cards (#40135 by @ClearlyClaire)
• Fix Web UI being inaccessible with URLs ending with .zip (#40134 by @ClearlyClaire)
• Fix semitransparent background of picture-in-picture video player (#40132 by @diondiondion)
• Fix title tooltip appearing for fullscreen videos (#40127 by @diondiondion)
• Fix image preview too dark in alt text editor dialog (#40126 by @diondiondion)
• Fix domain block impact queries being rejected (#40122 by @ClearlyClaire)
• Fix mobile navigation scrolling to top while opening (#40042 by @sharlayan)
• Fix selected account being lost when creating a collection (#39897 and #40133 by @diondiondion and @sharlayan)

[Package Updates]

[1.19.0]

• Update mastodon to 4.7.0
• Full Changelog
• Add audit logs for Hashtags (#39473, #39337 and #39670 by @arte7)
• Add support for remote accounts changing handles (#39785, #39850, #39865 and #40045 by @ClearlyClaire)
• Add outgoing RFC9421 HTTP Message Signatures as fallback to earlier draft (#39756 by @ClearlyClaire)
• Add verification of FEP-8b32 Object Integrity Proofs (#39530, #39728, #39754, #39760, #39522 and #39747 by @ClearlyClaire)
• Fix error in tootctl media refresh when cleaning some incompletely processed files (#40056 by @shleeable)
• Fix performance of listing follow requests by adding appropriate index (#40033 by @ClearlyClaire)
• Fix embedded videos restarting when interacting with post (or other posts in the same feed) (#39746 by @diondiondion)
• Fix authored posts not immediately appearing in timelines (#39733 by @ChaosExAnima)
• Remove inbox processing of collections of activities (#39932 by @ClearlyClaire)
• Remove support for pre-Mastodon 4.3.0 cookies (#38918 by @ClearlyClaire)

[Package Updates]

[1.19.1]

• Update mastodon to 4.7.1
• Full Changelog

[Package Updates]

[1.19.2]

• Update mastodon to 4.7.2
• Full Changelog
• Temporarily disable HEIF support
• Fix relative privacy policy links in subscription emails (#40486 by @crafkaz)
• Fix canonical email blocks interfering with freezing or approving users (#40463 by @ClearlyClaire)
• Fix 500 error when trying to upload a non-custom-filter JSON import (#40449 and #40451 by @ClearlyClaire)
• Fix 500 error when submitting a status twice (#40439 by @ClearlyClaire)
• Fix self-deleted accounts not being un-deleted when using tootctl accounts create --reattach (#40430 by @mjankowski)
• Fix account deletion not deleting generated annual reports (#40394 by @ClearlyClaire)
• Fix notifications not being cleaned up when notification requests are deleted in bulk (#40393 by @ClearlyClaire)

[Package Updates]

[1.19.3]

• Update mastodon to 4.7.3
• Full Changelog
• Add logging of account data removal (#40572 by @ClearlyClaire)
• Add link to homepage to 404 error page (#40369 by @diondiondion)
• Change account self-deletion page to always ask to confirm username (#40576 and #40733 by @ClearlyClaire)
• Fix error handling for malformed webfinger subjects (#40731 by @ClearlyClaire)
• Fix threads leak by updating dependency aws-sdk-s3
• Fix occasional installation-time error by updating dependency yarn to v4.18.1 (#40722 by @renovate[bot])
• Fix inconsistent horizontal page padding between profile and profile editor (#40700 by @diondiondion)
• Fix server error on registration for wrong DOB (#40607 by @sudeeptarlekar)
• Fix quotes disclaimer disappearing on posts with no quote (#40587 by @crafkaz)
• Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681 by @ClearlyClaire)

[Package Updates]

[1.19.4]

• Keep the remote media cache out of backups

[Package Updates]

[1.20.0]

• Update node-base | final to 24-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[1.20.1]

• Update mastodon to 4.7.4
• Full Changelog
• Fix insufficient ActivityPub identifier verification (GHSA-288h-6j8h-6x5j)
• Added security challenge e-mail to users that try to log in after long period of inactivity (#40745 by @jhbabon)
• Updated dependencies, in particular to address security advisories in Ruby, NodeJS, excon, css_parser, pghero, and sanitize
• Fix inefficiency in some hashtag timeline queries (#41132 by @hugogameiro)
• Fix minor inefficiency in timeline deliveries (#41079 by @isidzukuri)
• Fix account timeline with exclude_direct also excluding followers-only posts for non-followed users (#41019 by @ClearlyClaire)
• Fix error in dev:populate_sample_data task (#40995 and #41051 by @isidzukuri and @mjankowski)
• Fix local collection item revocation not being properly federated (#40930 by @oneiros)

[Package Updates]

[1.20.2]

• Update mastodon to 4.7.5
• Full Changelog
• Fix password authentication bypass for inactive accounts (GHSA-3xjw-gv43-3w62)
• Fix DoS through JSON-LD compaction (#41482 by @ClearlyClaire, GHSA-cf49-73r7-rxj6)
• Fix Forwarded header taking precedence over X-Forwarded-For (#41481 by @ClearlyClaire, GHSA-qp4r-p842-mw5c)
• If your reverse-proxy setup uses Forwarded instead of X-Forwarded-For, please make sure it ignores user-provided X-Forwarded-For headers.
• If you are using our provided nginx.conf, please consider updating it.
• Updated dependencies, in particular to address security advisories in addressable, loofah, rack, and rails-html-sanitizer
• Change invites use counts to not decrease if an invited user deletes their account (#41458 by @ClearlyClaire)