Security/AdminAccessTest: verifies non-admin users are blocked from
all admin web routes (dashboard, users, reports, settings, instances,
curated onboarding) and admin API endpoints.
Security/ApiScopeSecurityTest: verifies read-only tokens cannot write
(follow, favourite, delete, mute, block), write tokens can read+write,
cross-user access is denied, and private statuses are protected.
BUG FOUND: CheckForAnyScope middleware (referenced in v1/admin routes)
was removed in Passport 13. All /api/v1/admin/* routes throw
BindingResolutionException. 6 tests skipped pending fix.
PHP's str_ends_with() only accepts a string needle, not an array.
The username validation was passing an array of extensions which
caused a TypeError on every registration attempt.
Replace with a loop over a configurable array of disallowed extensions,
making it easy to add new entries.
Also updates RegisterTest to properly test the registration flow
including the RT anti-bot token and age verification fields.
Convert all 273 short facade alias imports (e.g. 'use Cache;') to their
fully-qualified class names (e.g. 'use Illuminate\Support\Facades\Cache;')
across 193 files.
This resolves 643 PHPStan 'class.notFound' errors caused by the static
analyzer being unable to resolve global aliases, and aligns with modern
Laravel conventions. It also unblocks removing the aliases array from
config/app.php in a future change.
All 107 tests pass.
These deprecated helpers will throw 'undefined function' errors at
runtime since laravel/helpers was removed. Replace with Str::random(),
Str::limit(), and Str::slug() respectively.
* Added current title as value for input so that the current value remains stored by default
* Added parameter 'show_legal_notice_link' => (bool) config_cache('instance.has_legal_notice'),
* Added conditional display of a link to legal notice if the page is active
* Added key 'legalNotice'
* feat translate story
* translate auth
- register
- login
* add remove follow
* Update ApiV1Controller.php
Co-Authored-By: Mathieu <385764+Casmo@users.noreply.github.com>
* New translations web.php (Chinese Simplified)
[ci skip]
* Added current title as value for input so that the current value remains stored by default
* Added parameter 'show_legal_notice_link' => (bool) config_cache('instance.has_legal_notice'),
* Added conditional display of a link to legal notice if the page is active
* Added key 'legalNotice'
* add missing key
* add missing keys
* New translations web.php (Portuguese, Brazilian)
[ci skip]
* New translations web.php (Turkish)
[ci skip]
* New translations web.php (Italian)
[ci skip]
* translate custom filter
* New translations web.php (Italian)
[ci skip]
* use configured alt text length limit when uploading multiple photos
* in notifications sidebar, show popover on shared posts too, not just liked posts
* use case insensitive search when tagging accounts
* New translations web.php (Portuguese, Brazilian)
[ci skip]
* Generic OIDC Support
* Everything should be configurable by env variables
* Basic request tests
* Fixes for items highlighted by review.ai
* Consider using `hash_equals()` instead of `==` when comparing the state values to prevent timing attacks:
`abort_unless(hash_equals($request->input('state'), $request->session()->pull('oauth2state')), 400, 'invalid
state');`
* For better data integrity, consider adding a foreign key constraint to the user_id column: `$table-
>foreign('user_id')->references('id')->on('users')->onDelete('cascade');`
* Does the OIDC provider guarantee that the username field exists in the userInfo data? Consider adding a
null check or fallback: `$userInfoData[config('remote-auth.oidc.field_username')] ?? null`
* field isnt accessTokenResourceOwnerId but responseResourceOwnerId
* New translations web.php (Dutch)
[ci skip]
* Fix components
* Update LandingService and Config util to properly support the legal_notice setting
* Update footer to use legalNotice i18n
* Update i18n
* Update sidebar with gap padding for footer links
* Update compiled assets
* Update i18n json
* Update OIDC config with comments, and disable tests as we dont have db tests configured
* Update remove_from_followers api endpoint
* Update i18n
* Update compiled assets
* Update changelog
* New supported formats, Preserve ICC Color Profiles, libvips support
Update image pipeline to handle avif, heic and webp and preserve ICC color profiles and added libvips support.
* Fix tests
* Update CHANGELOG.md
---------
Co-authored-by: Samy Elshamy <elshamy@coderbutze.de>
Co-authored-by: Felipe Mateus <eu@felipemateus.com>
Co-authored-by: Mathieu <385764+Casmo@users.noreply.github.com>
Co-authored-by: Mackenzie Morgan <macoafi@gmail.com>
Co-authored-by: Gavin Mogan <git@gavinmogan.com>
Your Name
daniel
Sven Luijten
Joshua