2086 Commits (6ae40d7266cceaf8926ca8a21a5b00321a84cdbf)

Author	SHA1	Message	Date
Your Name	98267eb26f	refactor: replace deprecated str_random() with Str::random() ... str_random() is a deprecated helper from laravel/helpers that was missed in the initial helpers removal. Replace all 18 call sites with the modern Str::random() equivalent.	4 weeks ago
Your Name	edb4368b08	refactor: replace deprecated laravel/helpers with native alternatives ... Replace all deprecated helper function calls: - str_slug() → Str::slug() - starts_with() → str_starts_with() - ends_with() → str_ends_with() - array_first() → Arr::first() - array_last() → Arr::last() - array_flatten() → Arr::flatten() Remove laravel/helpers package from composer.json as it is no longer needed and will not be maintained for Laravel 13.	4 weeks ago
Daniel Supernault	8f1e475407	Fix typo	4 weeks ago
Shlee	3c88343a52	Merge pull request #6813 from pixelfed/refactor/middleware-aliases-property ... refactor: rename $routeMiddleware to $middlewareAliases	4 weeks ago
Shlee	1593fb71b8	Merge pull request #6811 from pixelfed/refactor/replace-maintenance-mode-middleware ... refactor: replace deprecated CheckForMaintenanceMode with PreventRequestsDuringMaintenance	4 weeks ago
Your Name	d2bd73c27e	refactor: rename $routeMiddleware to $middlewareAliases ... The $routeMiddleware property was renamed to $middlewareAliases in Laravel 11. The old name still works in 12 via backwards compatibility but is on the deprecation path for removal in Laravel 13.	4 weeks ago
Your Name	f363715ad8	refactor: replace deprecated CheckForMaintenanceMode with PreventRequestsDuringMaintenance ... CheckForMaintenanceMode was deprecated in Laravel 8 and will be removed in Laravel 13. PreventRequestsDuringMaintenance is the modern replacement with support for secret bypass tokens and pre-rendered maintenance views.	4 weeks ago
Daniel Supernault	7937d91c37	Update ApiV1Controller, add is_suggestable to update_credentials endpoint	4 weeks ago
Daniel Supernault	4e2e49f843	Update ApiV1Controller, add show_atom support to update_credentials endpoint	4 weeks ago
Your Name	79541afaa0	Merge origin/staging, resolve conflicts keeping matomo/device-detector over jenssegers/agent	4 weeks ago
Shlee	80738385ba	Merge pull request #6777 from pixelfed/fix/pat-creation-500-6630 ... Fix: Bounce error on PAT when OAUTH_PAT_ENABLED is false	4 weeks ago
Shlee	06e3351e92	Merge pull request #6778 from pixelfed/fix/prevent-pat-client-deletion-6630 ... Fix: Improve the web UX for deleting the OAuth Client and PAT	4 weeks ago
Shlee	fb655f1308	Merge pull request #6782 from ashleyhull-versent/shift-179490 ... Laravel Shift Preshift	4 weeks ago
Ashley Hull	ab07a705e6	Merge branch 'dev' into shift-179490	4 weeks ago
Shlee	68dca50973	Merge pull request #6774 from pixelfed/fix/oauth-scope-bypass-remove-follower-6643 ... Fix: OAuth accountRemoveFollowById to check token.	4 weeks ago
Shlee	20123ff5ba	Merge pull request #6773 from pixelfed/fix/first-follower-pagination-6695 ... Fix: Show first follower/following record excluded from previous API responses	4 weeks ago
Shlee	49d8e02411	Merge pull request #6757 from pixelfed/shleeable-patch-3 ... Fix RESTRICTED_INSTANCE	4 weeks ago
Your Name	552a55c2d2	Upgrade images to v4	4 weeks ago
Daniel Supernault	91645faeee	Lint	4 weeks ago
Daniel Supernault	e1235dfd75	Fix ApiV1Controller, ensure follow notifications have an account	4 weeks ago
Your Name	53759e3ad6	Prevent deletion of personal access OAuth client ... Fixes #6630 (partial — deletion causing broken PAT) If a user deletes the OAuth client that serves as the personal access client, all PAT creation breaks for the entire instance with a 500 error. Changes: - Add custom OAuthClientController@destroy that checks if the client has the personal_access grant type before allowing deletion - Returns 403 with a clear error message if deletion is blocked - Add confirmation dialog before client deletion in the frontend - Add error handling to show server error messages to the user This prevents accidental destruction of the PAT infrastructure.	4 weeks ago
Your Name	1ab677a526	Handle PAT creation gracefully when not configured ... Fixes #6630 (partial — PAT 500 error) Previously, POST /oauth/personal-access-tokens would throw an unhandled RuntimeException (HTTP 500) when: - OAUTH_PAT_ENABLED is false (the default), or - No personal access client exists in the database Now the endpoint: 1. Returns 403 with a clear message if PAT is disabled in config 2. Catches RuntimeException from the token factory and returns 500 with an actionable error message instead of a stack trace	4 weeks ago
Your Name	822e9c98cb	Fix OAuth scope bypass on remove_from_followers endpoint ... Fixes #6643 The POST /api/v1/accounts/{id}/remove_from_followers endpoint was missing the token existence check (! $request->user()->token()). While the tokenCan('follow') scope check was already present, the missing token guard meant unauthenticated token-less requests could potentially bypass the scope enforcement. Added the standard guard pattern consistent with accountFollowById and accountUnfollowById endpoints. Also adds tests verifying: - Read-only tokens are denied (403) - Follow-scoped tokens succeed (200) - Unauthenticated requests are denied (403)	4 weeks ago
Your Name	396cf2d861	Fix first follower/following record excluded from API responses ... Fixes #6695 When no pagination params are provided, the default min_id was set to 1 and the query used 'id > 1', which excluded the very first follower row (id=1) on fresh instances. Changed default min_id from 1 to 0 and switched the direction check from truthy evaluation to !== null, so the query becomes 'id > 0' which correctly includes all records.	4 weeks ago
Shift	19880c2ffb	Convert string references to `::class` ... PHP 5.5.9 adds the new static `class` property which provides the fully qualified class name. This is preferred over using strings for class names since the `class` property references are checked by PHP.	4 weeks ago
Your Name	651f0de74f	Replace jenssegers/agent with matomo/device-detector ... - Remove unmaintained jenssegers/agent package (no releases since 2021) - Add matomo/device-detector v6.5 as actively maintained replacement - Create App\Services\UserAgentService wrapper for drop-in compatibility - Update UserDevice model and ApiV1Dot1Controller to use new service	4 weeks ago
Shlee	f6f9d5368c	Update allowed routes for restricted access middleware	4 weeks ago
Shlee	3800612fdf	Update Kernel.php	4 weeks ago
dansup	268ab6dba0	Merge branch 'staging' into remove-exp-pue	1 month ago
dansup	7354f63563	Merge branch 'staging' into remove-exp-rec	1 month ago
Daniel Supernault	26ee049d07	Update AppRegisterController	1 month ago
Daniel Supernault	fbff6ed307	Update trustedproxy config	1 month ago
Daniel Supernault	a2be0cb47d	Update CommentController	1 month ago
Daniel Supernault	40aef7a212	Update GroupsFeedController	1 month ago
Daniel Supernault	5f397f9135	Update StoryController	1 month ago
dansup	f568804426	Merge pull request #6680 from pixelfed/shleeable-patch-15 ... Update FollowerObserver.php	1 month ago
dansup	d6cd65463d	Merge pull request #6676 from pixelfed/shleeable-patch-10 ... Stories API: PostgreSQL story carousel endpoints crash due to calling collection methods on query builder	1 month ago
dansup	668653039f	Merge pull request #6663 from vinzgreg/fix/api-status-edit-auth-guard ... Fix API status editing: use auth:api guard	1 month ago
dansup	ca5f83d2d1	Merge pull request #6655 from TowyTowy/fix/timeline-home-nullable-max-id ... Fix home timeline rejecting empty max_id/min_id pagination params	1 month ago
dansup	5aae3f46c7	Merge pull request #6691 from pixelfed/shleeable-patch-26 ... Improve validation	1 month ago
dansup	219297d0e3	Merge pull request #6690 from pixelfed/shleeable-patch-25 ... Typo: change pid to id for FollowerService::remove	1 month ago
dansup	6910115166	Merge pull request #6686 from pixelfed/shleeable-patch-20 ... Update type on abort.	1 month ago
dansup	77831e7640	Merge pull request #6688 from pixelfed/shleeable-patch-22 ... Clear oauth material on permanent delete	1 month ago
dansup	5115e5c960	Merge pull request #6677 from pixelfed/shleeable-patch-12 ... Typo in abort	1 month ago
dansup	179dfffafe	Merge pull request #6672 from pixelfed/shleeable-patch-5 ... Places directory crashes on PostgreSQL for multi-word country URLs (case-sensitive mismatch)	1 month ago
dansup	f344b40aa9	Merge pull request #6671 from pixelfed/shleeable-patch-4 ... Account migration fails with 500 when remote ActivityPub profile returns `alsoKnownAs` as a string	1 month ago
Shlee	c2044f77cf	Update AdminUserController.php	1 month ago
Shlee	1d72f1b437	Update ApiV1Controller.php	1 month ago
Shlee	fbe98ea4de	Update AccountController.php	1 month ago
Shlee	9966eb50b8	Update ApiV1Controller.php	1 month ago