Bump from ^0.13.0 to ^1.0 (installs v1.14.0). The only breaking change
in v1.0.0 is the removal of $resend->sendEmail in favor of
$resend->emails->send. Pixelfed uses the SDK only through Laravel's
'resend' mail transport, which already calls emails->send and declares
support for resend/resend-php ^1.0, so no application code changes are
needed. Verified the resend mailer resolves and email tests pass.
The org's allowed-actions policy blocks crowdin/github-action@v3
(third-party, not verified/allowlisted). Reimplement the same flow
using the official @crowdin/cli npm package plus the GitHub-native gh
CLI, both of which satisfy the policy:
- upload sources: crowdin upload sources
- download translations: crowdin download
- open/update PR: gh pr create against staging, only when translations
changed
Credentials continue to come from crowdin.yml (project_id_env /
api_token_env), so no config change is needed.
An empty 'branches: []' under push/pull_request does not disable a
trigger; GitHub treats it as no branch filter and runs on every ref.
Expose only workflow_dispatch so the experimental suite runs solely on
manual trigger.
- Set a unique REDIS_PREFIX per matrix entry so cache/queue keys never
collide (the config default derives the prefix from APP_NAME, which is
identical across entries).
- Point the MariaDB entry at the 'mariadb' connection instead of 'mysql'
so the MariaDB driver is actually exercised (Laravel 11 treats them as
distinct drivers).
For the rare cases where SQL must differ between MySQL and MariaDB,
add DatabaseDriver::isMysql()/isMariadb() and db_is_mysql()/db_is_mariadb()
alongside the existing grouped isMysqlMaria()/db_is_mysql_maria().
Laravel 11 exposes MariaDB as a dedicated 'mariadb' driver, so
config('database.default') === 'mysql' checks silently misclassified
MariaDB as the non-mysql (postgres) branch.
- Add App\Util\Database\DatabaseDriver with isMysqlLike()/isPgsql()
plus db_is_mysql_like()/db_is_pgsql() global helpers.
- Route all database.default driver checks through the helpers so
MySQL and MariaDB are treated as one group.
- Use '' (not null) for share/compose caption+rendered, valid whether
the column is nullable or NOT NULL (it is NOT NULL on MySQL/MariaDB).
- Guard pgsql strtolower() in registration against missing fields.
- Scope CustomEmoji::duplicateShortcodes to the grouped column for
Postgres GROUP BY validity.
- Remove stale Postgres guard in status:dedup; use havingRaw for
cross-driver HAVING.
docker/build-push-action attaches provenance (and SBOM) attestations as
extra manifests with an 'unknown/unknown' platform. These render as noisy
'unknown' entries in the GHCR package UI next to the real amd64/arm64
platforms. Set provenance: false and sbom: false so only the runnable
architecture manifests are pushed.
Applied to both the branch-image (docker-push) and release-tag
(docker-tag) workflows.
Adopt the Loops approach of compiling FFmpeg from source (shared build,
hardened toolchain, LTO) in a dedicated build stage instead of installing
Debian's packaged ffmpeg. The source-built ffmpeg/ffprobe binaries and
shared libs are copied into the final image.
x264 and x265 continue to use Debian's packaged libraries
(libx264-dev / libx265-dev) for now; only FFmpeg itself is compiled.
Preserves the existing image-optimization tools (jpegoptim, optipng,
pngquant, gifsicle) and PHP extensions, and adds an ffmpeg/ffprobe
smoke test.
Runs the Pest suite against real MySQL 8.4, MariaDB 11.4, and PostgreSQL 16
services instead of the default in-memory SQLite, to surface DB-specific
behavior (strict mode, ONLY_FULL_GROUP_BY, unsigned underflow).
This is expected to fail currently, so every step uses continue-on-error
and the test command is suffixed with '|| true' to always report success.
Testing/investigation only; not a required check.
- terms/privacy/community-guidelines views accessed the cached page as an
object ($page->title), but cachedPage() returns an array, causing a 500
whenever a custom Page row existed. Switch to array access.
- PublicRouteSmokeTest: enable open_registration before hitting /register,
which 404s by default when registration is disabled.
- Api/AccountTest: derive sanctum.stateful domain from app.url instead of
hardcoding pixelfed.test, so the first-party auth test is environment
independent.
Shlee
Your Name
dependabot[bot]
dansup