12808 Commits (46393bd9fc2b8cdba87647ea7206f205cb6e9316)

 

All Branches   

Search

Author	SHA1	Message	Date
Shlee	46393bd9fc	Move ValidateCsrfToken middleware to a new position	1 month ago
Shlee	9aa2df66cb	Merge pull request #6885 from pixelfed/shleeable-patch-1 ... Revert ValidateCsrfToken to PreventRequestForgery change - wait for Laravel 13	1 month ago
Shlee	2c704d9a76	Update app.php	1 month ago
Shlee	e9dcbf70e3	Merge pull request #6884 from pixelfed/fix/test-improvements ... pint /tests	1 month ago
Your Name	412c29bb47	Improve test assertions and imports	1 month ago
Daniel Supernault	db636ee08a	Pint database/	1 month ago
Shlee	7fa0615448	Merge pull request #6883 from pixelfed/shleeable-patch-1 ... Revert strict tests in nonprod	1 month ago
Shlee	f13a891ff4	Update AppServiceProvider.php	1 month ago
Daniel Supernault	42f361540c	Pint config/	1 month ago
Daniel Supernault	33dce75f2c	Pint app/	1 month ago
dansup	e1b60d070b	Merge pull request #6882 from pixelfed/shleeable-patch-2 ... Refactor: Add additional strict modes for testing environments only	1 month ago
Shlee	de8de9251b	Update AppServiceProvider.php	1 month ago
Shlee	1ae0feb129	Update AppServiceProvider.php	1 month ago
dansup	8e99e0c316	Merge pull request #6880 from pixelfed/fix/cache-serializable-classes ... Laravel 13 prep: add serializable_classes to cache config	1 month ago
dansup	90af7d8a2d	Merge pull request #6879 from pixelfed/fix/csrf-middleware-rename ... Laravel 13 prep: rename VerifyCsrfToken to PreventRequestForgery	1 month ago
dansup	e0876c8a97	Merge pull request #6878 from pixelfed/fix/mysql-strict-mode ... fix: enable MySQL strict mode and remove defaultStringLength(191)	1 month ago
dansup	93553670e5	Merge pull request #6877 from pixelfed/fix/replace-request-get ... Laravel 13 prep: replace Symfony deprecated ->get() with ->input()	1 month ago
dansup	665221176b	Merge pull request #6874 from pixelfed/fix/api-throttle-middleware ... feat: add global throttle:api middleware to the api route	1 month ago
Shlee	c04fec21fc	Update model loading behavior in AppServiceProvider	1 month ago
Shlee	542434785c	Set strict mode to true in database configuration	1 month ago
Shlee	35cb9a9dcb	Change DB_STRICT environment variable to true	1 month ago
Shlee	323cfc9cf7	Update database.php	1 month ago
Shlee	2f466b02d7	Update database.php	1 month ago
Your Name	ba90d1bd20	feat: add serializable_classes to cache config for Laravel 13 prep ... Laravel 13 defaults serializable_classes to false, blocking arbitrary PHP object unserialization from cache. This project caches CustomFilter model instances (in getCachedFiltersForAccount), so it must be explicitly allowlisted. All other cache usage in this project stores scalars, arrays, or Fractal-transformed array output — no other classes need allowlisting.	1 month ago
Your Name	9958b095dd	refactor: rename VerifyCsrfToken to PreventRequestForgery ... Prepares for Laravel 13 where VerifyCsrfToken is deprecated in favor of PreventRequestForgery. The old class remains as an alias in v13 but will be removed in a future version.	1 month ago
Your Name	4320231c1f	fix: replace deprecated $request->get() with $request->input() ... Symfony 8.0 removes Request::get(). Laravel 13 will support Symfony 8, so these 11 usages would break on upgrade. Using $request->input() which checks both query string and request body (same behavior as the old get() method).	1 month ago
Your Name	1b64c59beb	fix: enable MySQL strict mode and remove defaultStringLength(191) ... - Enable strict mode for MySQL connection to prevent silent data truncation, zero-date insertion, and division-by-zero errors. - Remove Schema::defaultStringLength(191) which was a MySQL 5.7 workaround no longer needed on MySQL 8.0+ / MariaDB 10.3+.	1 month ago
Shlee	08cdac1ef6	Merge pull request #6876 from pixelfed/fix/remove-unused-deps ... chore: remove unused direct dependencies	1 month ago
Your Name	1696dfacaa	chore: remove unused direct dependencies ... - Remove endroid/qr-code: never imported in app code; only bacon/bacon-qr-code is used directly (for 2FA QR generation). - Remove nesbot/carbon: already pulled in transitively by laravel/framework, laravel/horizon, and laravel/pulse.	1 month ago
Shlee	1f3e472a7e	Merge pull request #6875 from pixelfed/fix/unpin-symfony-http-foundation ... fix: unpin symfony/http-foundation to allow patch updates	1 month ago
Your Name	0c849ca4e7	fix: unpin symfony/http-foundation to allow patch updates ... Changes constraint from exact '7.4.13' to '^7.4.13'. The pin was introduced for CVE-2026-48736 but is overly restrictive — any 7.4.x release >= 7.4.13 includes the fix. This allows future security patches to install via composer update. Note: Symfony 8.x is blocked by laravel/framework ^12 which requires symfony/http-foundation ^7.2.0. Symfony 8 support arrives with Laravel 13.	1 month ago
Shlee	0837968fad	Update AppServiceProvider.php	1 month ago
Your Name	ed90e619fb	feat: add throttle:api middleware to the api route group ... Adds a global rate limiter (240 req/min per user or IP) to all API routes. Previously rate limiting was only applied ad-hoc on individual routes, leaving some endpoints unprotected.	1 month ago
Shlee	f81d7ba666	Merge pull request #6873 from pixelfed/fix/deprecated-starts-with ... fix: replace deprecated starts_with() with str_starts_with()	1 month ago
Your Name	26b8a0a6b0	fix: replace deprecated starts_with() with str_starts_with() ... The starts_with() helper was removed in Laravel 6. Use PHP 8's native str_starts_with() instead.	1 month ago
Shlee	cf714c6fb7	Merge pull request #6872 from pixelfed/larastan0 ... refactor: replace $fillable with $guarded = [] across all models	1 month ago
Your Name	570a30d037	refactor: replace $fillable with $guarded = [] across all models ... Aligns all models with the project convention (see .ai/rules/models.md). Model::shouldBeStrict() in non-production will catch any issues early.	1 month ago
Shlee	2fbb9fa428	Merge pull request #6871 from pixelfed/larastan0 ... polish	1 month ago
Your Name	c891f34df6	polish	1 month ago
Shlee	b5c9f2d062	Merge pull request #6870 from pixelfed/shleeable-patch-1 ... Update DOCKER_COMPOSE_SETUP.md	1 month ago
Shlee	4086f07783	Fix duplicate command in Docker Compose setup	1 month ago
Shlee	e2c6162b35	Update DOCKER_COMPOSE_SETUP.md	1 month ago
Shlee	1b3c8150b0	Merge pull request #6869 from pixelfed/larastan0 ... Larastan0	1 month ago
Your Name	f54e6280bc	comment dead code	1 month ago
Your Name	ea2d054a40	Revert "fix: remove dead publicApi/homeApi methods from TimelineController" ... This reverts commit 8cf5321566.	1 month ago
Your Name	8cf5321566	fix: remove dead publicApi/homeApi methods from TimelineController ... - publicApi referenced non-existent StatusTimelineTransformer class - Neither method is routed anywhere - Removes unused imports (Fractal, Cache, Status, Profile, UserFilter)	1 month ago
Shlee	d4fc25907c	Merge pull request #6868 from pixelfed/larastan0 ... fix: remove dead RemoteFollowPipeline (old code before AP)	1 month ago
Your Name	7042ea5367	fix: remove dead RemoteFollowPipeline (references uninstalled HttpSignatures package) ... - Delete app/Jobs/RemoteFollowPipeline/RemoteFollowPipeline.php - Delete app/Jobs/RemoteFollowPipeline/RemoteFollowImportRecent.php - Neither job is dispatched anywhere in the codebase - Remote follow is handled by ActivityPub Inbox and FollowPipeline	1 month ago
Shlee	eb8806f37d	Merge pull request #6867 from pixelfed/fix/passport-v13-cleanup ... fix: remove deprecated Passport::personalAccessClientId()	1 month ago
Your Name	5a364be58b	fix: remove deprecated Passport::personalAccessClientId() and enableImplicitGrant() ... - Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now) - Remove Passport::enableImplicitGrant() (legacy grant, no clients use it) - Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key) - Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example - Show swal alert when PATs disabled instead of hidden API error - Improve store() error handling to surface 403 messages in the UI - Remove OAUTH_PAT_ID row from admin diagnostics blade	1 month ago