- Add a vips builder stage that compiles libvips 8.18.6 from source
(pinned tarball + sha256), linked against distro libheif/aom/dav1d
(AVIF/HEIC) and libjxl (JPEG XL).
- Trim delegates to the formats Pixelfed uses: jpeg, png, gif, webp,
avif/heic, jxl; disable tiff, pdf, svg, openexr, magick, etc. to keep
the library small and reduce attack surface on untrusted uploads.
- Drop the ext-vips C extension (incompatible with libvips 8.18 and
unused: Pixelfed uses jcupitt/vips via FFI) and keep ffi enabled.
- Update runtime deps to match the compiled library.
- Add MEDIA_TYPES (webp/avif/jxl) to .env.example and .env.docker.example.
The singleton closure injected the boot-time $app and constructed
new CaptchaManager($app), which larastan's checkOctaneCompatibility flags as
holding a stale container across requests. Resolve the current container via
Container::getInstance() instead.
is_admin is cast to bool on the User model, so $user->is_admin === 1 is always
false and the gate 403s every user, admins included. Use a boolean check,
consistent with the viewHorizon gate.
- Pulse: set PULSE_PATH default to admin/pulse; Pulse::ignoreRoutes() in
AppServiceProvider and register the dashboard explicitly in routes/web-admin.php
so it is matched before the {username} profile catch-all.
- Horizon: set horizon.path to admin/horizon (all Horizon routes follow); add an
explicit base-path GET mirroring Horizon's own HomeController@index for clarity.
- Remove now-unneeded 'horizon' reservation from RestrictedNames.
- Add PULSE_ENABLED-gated Pulse links to admin sidenav and topnav.
- Replace HorizonRedirectTest with HorizonDashboardTest (base path now renders
the dashboard directly instead of redirecting).