296 Commits (0eddd93d5eb5146c8b80ff39468df39fd64fe400)

Author	SHA1	Message	Date
Your Name	a56c1fb019	fix(mentions): allow long usernames in autolinking (#7204) ... Raise the mention regex local-part cap from 20 to 64 chars. The prior cap silently dropped long usernames from autolinking/mentions, and for remote handles it truncated the username and dropped the @domain, turning a remote mention into a broken local one. Adds extensive lexer coverage.	1 week ago
Your Name	5e76ed99bf	fix #7328	1 week ago
Shlee	9ec46005df	Merge pull request #7309 from pixelfed/feature/laravel-cap ... Refactor: Captcha provider - HCaptcha, Turnstile and Cap	1 week ago
Your Name	0aa4da98e3	larastan fix last commit	1 week ago
Shlee	3de36431bb	Merge pull request #7308 from pixelfed/fix/snowflake-seq-collision ... Fix/snowflake seq collision	1 week ago
Your Name	262065a485	Temp language fallback	1 week ago
Your Name	d1d15c76f9	fix i18n cache on about/guidelines	1 week ago
Your Name	8aadedb56c	Added i18n tests	1 week ago
Your Name	611f41bc59	polish	1 week ago
Your Name	e8f4ee86bd	polish	1 week ago
Your Name	1e78f9e93f	polish	1 week ago
Your Name	f144ea627c	polish	1 week ago
Your Name	b716a5aa5d	polish	1 week ago
Your Name	afe2bb6d1d	polish	1 week ago
Your Name	40fc084167	polish	1 week ago
Your Name	136e79885b	polish	1 week ago
Your Name	edde5b985f	polish	1 week ago
Your Name	d0f056058b	polish	1 week ago
Your Name	566c5503d3	polish	1 week ago
Your Name	ababab30ed	polish	1 week ago
Your Name	163cd9f589	polish	1 week ago
Your Name	0484be97b1	test(snowflake): cover sequence generation and collision regression ... Add tests/Unit/SnowflakeServiceTest.php covering SnowflakeService::next() and byDate(). Datacenter/worker ids are pinned via config so ids are fully deterministic and the sequence behaviour is assertable rather than probabilistic. Regression coverage for the stale-sequence bug (duplicate seq on the first two ids -> UNIQUE constraint collisions): - first two ids use distinct sequence values - consecutive calls yield a strictly increasing sequence (1,2,3,...) - a 100-id burst minted in the same frozen millisecond is fully unique - an explicit reproduction contrasting old (1,1) vs fixed (1,2) sequences Also covers: datacenter/worker bit encoding, sequence wraparound at 4095, cache reseeding on missing/non-numeric counters, timestamp bit encoding, and byDate() delegation/ordering. Verified these fail on the pre-fix code (6 failing) and pass on the fix (14 passing).	1 week ago
Shlee	79ad664159	Update ImageThumbnailSupersedeTest.php	1 week ago
Your Name	ddc617a8d2	Install libvips on CI runners and test on the vips driver ... The vips driver uses jcupitt/vips (FFI binding), which needs ext-ffi plus the libvips shared library at runtime - not the PECL vips extension. Add a libvips apt install step and enable ffi in both test workflows, then switch .env.testing to vips so CI exercises the new default driver. Guard ImageThumbnailSupersedeTest to skip when the configured driver's runtime is unavailable, so contributors without libvips are not blocked.	1 week ago
Your Name	a14fba166f	Fix cached-page 500s and flaky smoke/API tests ... - terms/privacy/community-guidelines views accessed the cached page as an object ($page->title), but cachedPage() returns an array, causing a 500 whenever a custom Page row existed. Switch to array access. - PublicRouteSmokeTest: enable open_registration before hitting /register, which 404s by default when registration is disabled. - Api/AccountTest: derive sanctum.stateful domain from app.url instead of hardcoding pixelfed.test, so the first-party auth test is environment independent.	1 week ago
Your Name	7b11b72e1d	test(federation): run AP delivery tests in production env ... ActivityPubDeliveryService::pool() and queueDelivery() only perform HTTP delivery when app()->environment('production'); outside production they log and return. The pool/job delivery tests were written before that guard was added (commit 868e09b64) and never forced production, so no requests were made and every assertSent/assertSentCount failed (6 failing tests). Wrap the delivery-exercising tests in a forged production environment (restored afterwards) and seed the public-ips DNS cache plus an empty banned-domains cache so validateDestination() passes without a real DNS lookup or DB query. Seed after factory creation, since the lazy DB refresh can flush the cache store. Also fix a by-value capture bug in the onError assertions: the $errors array was captured through an arrow-fn wrapper, so the inner callback's by-reference mutations never reached the assertion. Use a regular closure. No production code changed; the production delivery gate is intended behavior.	1 week ago
Your Name	729396302a	fix(federation): swallow ConnectionException on synchronous AP delivery ... queueDelivery() runs synchronously from the v1 follow/unfollow endpoints (via Helpers::sendSignedObject), which commit local state before delivery and have no try/catch. After the Http::send() rewrite, a ConnectionException from a momentarily-unreachable remote was rethrown out of queueDelivery(), turning a best-effort delivery into a 500 for the user after the follow/ unfollow was already persisted. For unfollows, a retry then hit the isFollowing==false branch and never re-sent the Undo, diverging state. Treat transport failures (ConnectionException) as best-effort on this single-delivery path: log, record host health, and return without propagating. Other exception types (invalid sender/destination, signing, serialization) still throw, matching pre-rewrite precondition behavior. Also widen SendUpdateActor's per-user catch from HttpException to Throwable so a single bad host no longer aborts a fleet-wide actor update (the old HttpException catch is dead for ConnectionException/invalid-destination).	1 week ago
Your Name	8a4567a5c2	Isolate fanout delivery failures from StatusDelete local cleanup	1 week ago
Shlee	a1abf10010	Merge pull request #7254 from pixelfed/fix/oidc-dangerzone-lockout ... Mark OIDC login session password-confirmed to fix dangerzone lockout	1 week ago
Your Name	fbca487bcd	Mark OIDC login session password-confirmed to fix dangerzone lockout	1 week ago
Shlee	78447646b8	Merge pull request #7253 from pixelfed/fix/remote-update-media-validate-before-orphan ... Validate remote update attachments before detaching existing media	1 week ago
Your Name	9b829ca56e	Validate remote update attachments before detaching existing media	1 week ago
Shlee	1d7ee48f2e	Merge pull request #7252 from pixelfed/fix/v2-media-can-post-role ... Enforce can-post role check on POST /api/v2/media	1 week ago
Your Name	3a23606573	Enforce can-post role check on POST /api/v2/media	1 week ago
Shlee	a510682122	Merge pull request #7251 from pixelfed/fix/delete-account-purge-status-edits ... Purge status_edits on account and status deletion	1 week ago
Your Name	60284a871e	Purge status_edits on account and status deletion	1 week ago
Your Name	7b90bc8699	Fix remove-all follower purge chunkById key and gate the route behind dangerzone	1 week ago
Your Name	cfbdabdd61	Send verification email for admin-invite users that require verification	1 week ago
Shlee	1fffdef464	Merge pull request #7247 from pixelfed/fix/report-object-id-integer-validation ... Validate report object_id as a positive integer to fix 500	1 week ago
Your Name	b4bd3c87a0	Validate report object_id as a positive integer to fix 500 on array input	1 week ago
Your Name	fe382bdb86	Extend story author-key TTL instead of overwriting so it survives to the longest-lived story	1 week ago
Shlee	2f9f8ecd1b	Merge pull request #7244 from pixelfed/fix/curated-register-details-xss ... Escape message in curated register details email to fix reflected XSS	1 week ago
Your Name	623f03bb68	Escape message in curated register details email to fix reflected XSS	1 week ago
Shlee	88137649a3	Merge pull request #7242 from pixelfed/fix/home-timeline-null-account ... Guard home timeline filter against null account	1 week ago
Shlee	589e9bef9e	Merge pull request #7241 from pixelfed/fix/status-delete-notification-cache ... Invalidate notification cache when deleting a status	1 week ago
Your Name	b13c374f21	Guard home timeline filter against null account	1 week ago
Your Name	f1e4536d19	Invalidate notification cache when deleting a status	1 week ago
Your Name	ac872c12ed	Use absolute path for /horizon dashboard redirect	1 week ago
Your Name	9d839f7b5a	Fix missing email verification dispatch on settings email change	2 weeks ago
Your Name	c9c897c4e7	Fix stale-CSRF login recovery render callback	2 weeks ago