Merge branch 'main' into temp3_for-taruntarun

Author: mayaeh

.rubocop_todo.yml

@@ -69,15 +69,6 @@ Style/MapToHash:
   Exclude:
     - 'app/models/status.rb'
 
-# This cop supports unsafe autocorrection (--autocorrect-all).
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: literals, strict
-Style/MutableConstant:
-  Exclude:
-    - 'app/models/tag.rb'
-    - 'app/services/delete_account_service.rb'
-    - 'lib/mastodon/migration_warning.rb'
-
 # Configuration parameters: AllowedMethods.
 # AllowedMethods: respond_to_missing?
 Style/OptionalBooleanParameter:

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to this project will be documented in this file.
 
+## [4.3.3] - 2025-01-16
+
+### Security
+
+- Fix insufficient validation of account URIs ([GHSA-5wxh-3p65-r4g6](https://github.com/mastodon/mastodon/security/advisories/GHSA-5wxh-3p65-r4g6))
+- Update dependencies
+
+### Fixed
+
+- Fix `libyaml` missing from `Dockerfile` build stage (#33591 by @vmstan)
+- Fix incorrect notification settings migration for non-followers (#33348 by @ClearlyClaire)
+- Fix down clause for notification policy v2 migrations (#33340 by @jesseplusplus)
+- Fix error decrementing status count when `FeaturedTags#last_status_at` is `nil` (#33320 by @ClearlyClaire)
+- Fix last paginated notification group only including data on a single notification (#33271 by @ClearlyClaire)
+- Fix processing of mentions for post edits with an existing corresponding silent mention (#33227 by @ClearlyClaire)
+- Fix deletion of unconfirmed users with Webauthn set (#33186 by @ClearlyClaire)
+- Fix empty authors preview card serialization (#33151, #33466 by @mjankowski and @ClearlyClaire)
+
 ## [4.3.2] - 2024-12-03
 
 ### Added

Gemfile

@@ -104,19 +104,19 @@ gem 'opentelemetry-api', '~> 1.4.0'
 
 group :opentelemetry do
   gem 'opentelemetry-exporter-otlp', '~> 0.29.0', require: false
-  gem 'opentelemetry-instrumentation-active_job', '~> 0.7.1', require: false
-  gem 'opentelemetry-instrumentation-active_model_serializers', '~> 0.21.0', require: false
-  gem 'opentelemetry-instrumentation-concurrent_ruby', '~> 0.21.2', require: false
-  gem 'opentelemetry-instrumentation-excon', '~> 0.22.0', require: false
-  gem 'opentelemetry-instrumentation-faraday', '~> 0.25.0', require: false
-  gem 'opentelemetry-instrumentation-http', '~> 0.23.2', require: false
-  gem 'opentelemetry-instrumentation-http_client', '~> 0.22.3', require: false
-  gem 'opentelemetry-instrumentation-net_http', '~> 0.22.4', require: false
-  gem 'opentelemetry-instrumentation-pg', '~> 0.29.0', require: false
-  gem 'opentelemetry-instrumentation-rack', '~> 0.25.0', require: false
-  gem 'opentelemetry-instrumentation-rails', '~> 0.34.0', require: false
-  gem 'opentelemetry-instrumentation-redis', '~> 0.25.3', require: false
-  gem 'opentelemetry-instrumentation-sidekiq', '~> 0.25.2', require: false
+  gem 'opentelemetry-instrumentation-active_job', '~> 0.8.0', require: false
+  gem 'opentelemetry-instrumentation-active_model_serializers', '~> 0.22.0', require: false
+  gem 'opentelemetry-instrumentation-concurrent_ruby', '~> 0.22.0', require: false
+  gem 'opentelemetry-instrumentation-excon', '~> 0.23.0', require: false
+  gem 'opentelemetry-instrumentation-faraday', '~> 0.26.0', require: false
+  gem 'opentelemetry-instrumentation-http', '~> 0.24.0', require: false
+  gem 'opentelemetry-instrumentation-http_client', '~> 0.23.0', require: false
+  gem 'opentelemetry-instrumentation-net_http', '~> 0.23.0', require: false
+  gem 'opentelemetry-instrumentation-pg', '~> 0.30.0', require: false
+  gem 'opentelemetry-instrumentation-rack', '~> 0.26.0', require: false
+  gem 'opentelemetry-instrumentation-rails', '~> 0.35.0', require: false
+  gem 'opentelemetry-instrumentation-redis', '~> 0.26.0', require: false
+  gem 'opentelemetry-instrumentation-sidekiq', '~> 0.26.0', require: false
   gem 'opentelemetry-sdk', '~> 1.4', require: false
 end
 

Gemfile.lock

@@ -94,20 +94,20 @@ GEM
     ast (2.4.2)
     attr_required (1.0.2)
     aws-eventstream (1.3.0)
-    aws-partitions (1.1032.0)
-    aws-sdk-core (3.214.1)
+    aws-partitions (1.1038.0)
+    aws-sdk-core (3.216.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.96.0)
-      aws-sdk-core (~> 3, >= 3.210.0)
+    aws-sdk-kms (1.97.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.177.0)
-      aws-sdk-core (~> 3, >= 3.210.0)
+    aws-sdk-s3 (1.178.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.10.1)
+    aws-sigv4 (1.11.0)
       aws-eventstream (~> 1, >= 1.0.2)
     azure-blob (0.5.4)
       rexml
@@ -159,7 +159,7 @@ GEM
     climate_control (1.2.0)
     cocoon (1.2.15)
     color_diff (0.1)
-    concurrent-ruby (1.3.4)
+    concurrent-ruby (1.3.5)
     connection_pool (2.5.0)
     cose (1.3.1)
       cbor (~> 0.5.9)
@@ -473,78 +473,78 @@ GEM
       opentelemetry-common (~> 0.20)
       opentelemetry-sdk (~> 1.2)
       opentelemetry-semantic_conventions
-    opentelemetry-helpers-sql-obfuscation (0.2.1)
+    opentelemetry-helpers-sql-obfuscation (0.3.0)
       opentelemetry-common (~> 0.21)
-    opentelemetry-instrumentation-action_mailer (0.3.0)
+    opentelemetry-instrumentation-action_mailer (0.4.0)
       opentelemetry-api (~> 1.0)
       opentelemetry-instrumentation-active_support (~> 0.7)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-action_pack (0.10.0)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-action_pack (0.11.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
+      opentelemetry-instrumentation-base (~> 0.23.0)
       opentelemetry-instrumentation-rack (~> 0.21)
-    opentelemetry-instrumentation-action_view (0.8.0)
+    opentelemetry-instrumentation-action_view (0.9.0)
       opentelemetry-api (~> 1.0)
       opentelemetry-instrumentation-active_support (~> 0.7)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-active_job (0.7.8)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-active_job (0.8.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-active_model_serializers (0.21.1)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-active_model_serializers (0.22.0)
       opentelemetry-api (~> 1.0)
       opentelemetry-instrumentation-active_support (>= 0.7.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-active_record (0.8.1)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-active_record (0.9.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-active_support (0.7.0)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-active_support (0.8.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-base (0.22.6)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-base (0.23.0)
       opentelemetry-api (~> 1.0)
       opentelemetry-common (~> 0.21)
       opentelemetry-registry (~> 0.1)
-    opentelemetry-instrumentation-concurrent_ruby (0.21.4)
+    opentelemetry-instrumentation-concurrent_ruby (0.22.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-excon (0.22.5)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-excon (0.23.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-faraday (0.25.0)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-faraday (0.26.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-http (0.23.5)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-http (0.24.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-http_client (0.22.8)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-http_client (0.23.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-net_http (0.22.8)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-net_http (0.23.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-pg (0.29.2)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-pg (0.30.0)
       opentelemetry-api (~> 1.0)
       opentelemetry-helpers-sql-obfuscation
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-rack (0.25.0)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-rack (0.26.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-rails (0.34.1)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-rails (0.35.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-action_mailer (~> 0.3.0)
-      opentelemetry-instrumentation-action_pack (~> 0.10.0)
-      opentelemetry-instrumentation-action_view (~> 0.8.0)
-      opentelemetry-instrumentation-active_job (~> 0.7.0)
-      opentelemetry-instrumentation-active_record (~> 0.8.0)
-      opentelemetry-instrumentation-active_support (~> 0.7.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-      opentelemetry-instrumentation-concurrent_ruby (~> 0.21.4)
-    opentelemetry-instrumentation-redis (0.25.7)
+      opentelemetry-instrumentation-action_mailer (~> 0.4.0)
+      opentelemetry-instrumentation-action_pack (~> 0.11.0)
+      opentelemetry-instrumentation-action_view (~> 0.9.0)
+      opentelemetry-instrumentation-active_job (~> 0.8.0)
+      opentelemetry-instrumentation-active_record (~> 0.9.0)
+      opentelemetry-instrumentation-active_support (~> 0.8.0)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+      opentelemetry-instrumentation-concurrent_ruby (~> 0.22.0)
+    opentelemetry-instrumentation-redis (0.26.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-sidekiq (0.25.7)
+      opentelemetry-instrumentation-base (~> 0.23.0)
+    opentelemetry-instrumentation-sidekiq (0.26.0)
       opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
+      opentelemetry-instrumentation-base (~> 0.23.0)
     opentelemetry-registry (0.3.1)
       opentelemetry-api (~> 1.1)
     opentelemetry-sdk (1.6.0)
@@ -962,19 +962,19 @@ DEPENDENCIES
   omniauth_openid_connect (~> 0.6.1)
   opentelemetry-api (~> 1.4.0)
   opentelemetry-exporter-otlp (~> 0.29.0)
-  opentelemetry-instrumentation-active_job (~> 0.7.1)
-  opentelemetry-instrumentation-active_model_serializers (~> 0.21.0)
-  opentelemetry-instrumentation-concurrent_ruby (~> 0.21.2)
-  opentelemetry-instrumentation-excon (~> 0.22.0)
-  opentelemetry-instrumentation-faraday (~> 0.25.0)
-  opentelemetry-instrumentation-http (~> 0.23.2)
-  opentelemetry-instrumentation-http_client (~> 0.22.3)
-  opentelemetry-instrumentation-net_http (~> 0.22.4)
-  opentelemetry-instrumentation-pg (~> 0.29.0)
-  opentelemetry-instrumentation-rack (~> 0.25.0)
-  opentelemetry-instrumentation-rails (~> 0.34.0)
-  opentelemetry-instrumentation-redis (~> 0.25.3)
-  opentelemetry-instrumentation-sidekiq (~> 0.25.2)
+  opentelemetry-instrumentation-active_job (~> 0.8.0)
+  opentelemetry-instrumentation-active_model_serializers (~> 0.22.0)
+  opentelemetry-instrumentation-concurrent_ruby (~> 0.22.0)
+  opentelemetry-instrumentation-excon (~> 0.23.0)
+  opentelemetry-instrumentation-faraday (~> 0.26.0)
+  opentelemetry-instrumentation-http (~> 0.24.0)
+  opentelemetry-instrumentation-http_client (~> 0.23.0)
+  opentelemetry-instrumentation-net_http (~> 0.23.0)
+  opentelemetry-instrumentation-pg (~> 0.30.0)
+  opentelemetry-instrumentation-rack (~> 0.26.0)
+  opentelemetry-instrumentation-rails (~> 0.35.0)
+  opentelemetry-instrumentation-redis (~> 0.26.0)
+  opentelemetry-instrumentation-sidekiq (~> 0.26.0)
   opentelemetry-sdk (~> 1.4)
   ox (~> 2.14)
   parslet

app/controllers/auth/setup_controller.rb

@@ -18,7 +18,7 @@ def update
 
     if @user.update(user_params)
       @user.resend_confirmation_instructions unless @user.confirmed?
-      redirect_to auth_setup_path, notice: I18n.t('auth.setup.new_confirmation_instructions_sent')
+      redirect_to auth_setup_path, notice: t('auth.setup.new_confirmation_instructions_sent')
     else
       render :show
     end

app/javascript/mastodon/locales/sk.json

@@ -378,6 +378,8 @@
   "ignore_notifications_modal.not_followers_title": "Nevšímať si oznámenia od ľudí, ktorí ťa nenasledujú?",
   "ignore_notifications_modal.not_following_title": "Nevšímať si oznámenia od ľudí, ktorých nenasleduješ?",
   "ignore_notifications_modal.private_mentions_title": "Nevšímať si oznámenia o nevyžiadaných súkromných spomínaniach?",
+  "interaction_modal.action.favourite": "Pre pokračovanie si musíš obľúbiť zo svojho účtu.",
+  "interaction_modal.action.follow": "Pre pokračovanie musíš nasledovať zo svojho účtu.",
   "interaction_modal.action.reply": "Pre pokračovanie musíš odpovedať s tvojho účtu.",
   "interaction_modal.action.vote": "Pre pokračovanie musíš hlasovať s tvojho účtu.",
   "interaction_modal.go": "Prejdi",
@@ -389,6 +391,7 @@
   "interaction_modal.title.reblog": "Zdieľať príspevok od {name}",
   "interaction_modal.title.reply": "Odpovedať na príspevok od {name}",
   "interaction_modal.title.vote": "Hlasuj v ankete od {name}",
+  "interaction_modal.username_prompt": "Napr. {example}",
   "intervals.full.days": "{number, plural, one {# deň} few {# dni} many {# dní} other {# dní}}",
   "intervals.full.hours": "{number, plural, one {# hodina} few {# hodiny} many {# hodín} other {# hodín}}",
   "intervals.full.minutes": "{number, plural, one {# minúta} few {# minúty} many {# minút} other {# minút}}",
@@ -517,6 +520,7 @@
   "notification.moderation_warning": "Dostal/a si varovanie od moderátora",
   "notification.moderation_warning.action_delete_statuses": "Niektoré z tvojich príspevkov boli odstránené.",
   "notification.moderation_warning.action_disable": "Tvoj účet bol vypnutý.",
+  "notification.moderation_warning.action_mark_statuses_as_sensitive": "Niektoré tvoje príspevky boli označené za chúlostivé.",
   "notification.moderation_warning.action_none": "Tvoj účet dostal upozornenie od moderátora.",
   "notification.moderation_warning.action_sensitive": "Tvoje príspevky budú odteraz označované ako chúlostivé.",
   "notification.moderation_warning.action_silence": "Tvoj účet bol obmedzený.",
@@ -575,9 +579,11 @@
   "notifications.policy.accept_hint": "Ukáž v oznámeniach",
   "notifications.policy.drop": "Ignoruj",
   "notifications.policy.filter": "Triediť",
+  "notifications.policy.filter_limited_accounts_hint": "Obmedzené moderátormi servera",
   "notifications.policy.filter_limited_accounts_title": "Moderované účty",
   "notifications.policy.filter_new_accounts_title": "Nové účty",
   "notifications.policy.filter_not_followers_title": "Ľudia, ktorí ťa nenasledujú",
+  "notifications.policy.filter_not_following_hint": "Pokiaľ ich ručne neschváliš",
   "notifications.policy.filter_not_following_title": "Ľudia, ktorých nenasleduješ",
   "notifications.policy.filter_private_mentions_title": "Nevyžiadané priame spomenutia",
   "notifications.policy.title": "Spravuj oznámenia od…",
@@ -625,6 +631,7 @@
   "privacy_policy.title": "Pravidlá ochrany súkromia",
   "recommended": "Odporúčané",
   "refresh": "Obnoviť",
+  "regeneration_indicator.please_stand_by": "Prosím, čakajte.",
   "regeneration_indicator.preparing_your_home_feed": "Pripravuje sa tvoj domáci kanál…",
   "relative_time.days": "{number} dní",
   "relative_time.full.days": "Pred {number, plural, one {# dňom} other {# dňami}}",
@@ -716,6 +723,7 @@
   "server_banner.about_active_users": "Ľudia používajúci tento server za posledných 30 dní (aktívni používatelia za mesiac)",
   "server_banner.active_users": "Aktívne účty",
   "server_banner.administered_by": "Správa servera:",
+  "server_banner.is_one_of_many": "{domain} je jeden z mnohých nezávislých Mastodon serverov, ktoré môžeš použiť na zúčastňovanie sa v rámci fediversa.",
   "server_banner.server_stats": "Štatistiky servera:",
   "sign_in_banner.create_account": "Vytvoriť účet",
   "sign_in_banner.sign_in": "Prihlásiť sa",
@@ -758,6 +766,7 @@
   "status.reblogs.empty": "Nikto ešte tento príspevok nezdieľal. Keď tak niekto urobí, zobrazí sa to tu.",
   "status.redraft": "Vymazať a prepísať",
   "status.remove_bookmark": "Odstrániť záložku",
+  "status.remove_favourite": "Odstráň z obľúbených",
   "status.replied_in_thread": "Odpovedal/a vo vlákne",
   "status.replied_to": "Odpoveď na {name}",
   "status.reply": "Odpovedať",

app/lib/delivery_failure_tracker.rb

@@ -46,6 +46,8 @@ def without_unavailable(urls)
       urls.reject do |url|
         host = Addressable::URI.parse(url).normalized_host
         unavailable_domains_map[host]
+      rescue Addressable::URI::InvalidURIError, IDN::Idna::IdnaError
+        true
       end
     end
 

app/models/tag.rb

@@ -35,11 +35,11 @@ class Tag < ApplicationRecord
   has_one :trend, class_name: 'TagTrend', inverse_of: :tag, dependent: :destroy
 
   HASHTAG_SEPARATORS = "_\u00B7\u30FB\u200c"
-  HASHTAG_FIRST_SEQUENCE_CHUNK_ONE = "[[:word:]_][[:word:]#{HASHTAG_SEPARATORS}]*[[:alpha:]#{HASHTAG_SEPARATORS}]"
-  HASHTAG_FIRST_SEQUENCE_CHUNK_TWO = "[[:word:]#{HASHTAG_SEPARATORS}]*[[:word:]_]"
-  HASHTAG_FIRST_SEQUENCE = "(#{HASHTAG_FIRST_SEQUENCE_CHUNK_ONE}#{HASHTAG_FIRST_SEQUENCE_CHUNK_TWO})"
+  HASHTAG_FIRST_SEQUENCE_CHUNK_ONE = "[[:word:]_][[:word:]#{HASHTAG_SEPARATORS}]*[[:alpha:]#{HASHTAG_SEPARATORS}]".freeze
+  HASHTAG_FIRST_SEQUENCE_CHUNK_TWO = "[[:word:]#{HASHTAG_SEPARATORS}]*[[:word:]_]".freeze
+  HASHTAG_FIRST_SEQUENCE = "(#{HASHTAG_FIRST_SEQUENCE_CHUNK_ONE}#{HASHTAG_FIRST_SEQUENCE_CHUNK_TWO})".freeze
   HASHTAG_LAST_SEQUENCE = '([[:word:]_]*[[:alpha:]][[:word:]_]*)'
-  HASHTAG_NAME_PAT = "#{HASHTAG_FIRST_SEQUENCE}|#{HASHTAG_LAST_SEQUENCE}"
+  HASHTAG_NAME_PAT = "#{HASHTAG_FIRST_SEQUENCE}|#{HASHTAG_LAST_SEQUENCE}".freeze
 
   HASHTAG_RE = %r{(?<![=/)\p{Alnum}])#(#{HASHTAG_NAME_PAT})}
   HASHTAG_NAME_RE = /\A(#{HASHTAG_NAME_PAT})\z/i