CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[unreleased]

Changed

API Changes

- **Breaking:** Emoji API: changed methods and renamed routes.

Removed

• Breaking: removed with_move parameter from notifications timeline.

Added

• Instance: Extend /api/v1/instance with Pleroma-specific information.
• NodeInfo: pleroma:api/v1/notifications:include_types_filter to the features list.
• NodeInfo: pleroma_emoji_reactions to the features list.
• Configuration: :restrict_unauthenticated setting, restrict access for unauthenticated users to timelines (public and federate), user profiles and statuses.
• New HTTP adapter gun. Gun adapter requires minimum OTP version of 22.2 otherwise Pleroma won’t start. For hackney OTP update is not required.
• Mix task to create trusted OAuth App.
• Notifications: Added follow_request notification type.
• Added :reject_deletes group to SimplePolicy

API Changes

- Mastodon API: Extended `/api/v1/instance`. - Mastodon API: Support for `include_types` in `/api/v1/notifications`. - Mastodon API: Added `/api/v1/notifications/:id/dismiss` endpoint. - Mastodon API: Add support for filtering replies in public and home timelines - Admin API: endpoints for create/update/delete OAuth Apps.

Fixed

• Support pagination in conversations API
• Breaking: SimplePolicy :reject and :accept allow deletions again
• Fix follower/blocks import when nicknames starts with @
• Filtering of push notifications on activities from blocked domains

[unreleased-patch]

Security

• Disallow re-registration of previously deleted users, which allowed viewing direct messages addressed to them
• Mastodon API: Fix POST /api/v1/follow_requests/:id/authorize allowing to force a follow from a local user even if they didn't request to follow

Fixed

• Logger configuration through AdminFE
• HTTP Basic Authentication permissions issue
• ObjectAgePolicy didn't filter out old messages

Added

• NodeInfo: ObjectAgePolicy settings to the federation list.

API Changes

- Admin API: `GET /api/pleroma/admin/need_reboot`.

[2.0.2] - 2020-04-08

Added

• Support for Funkwhale's Audio activity
• Admin API: PATCH /api/pleroma/admin/users/:nickname/update_credentials

Fixed

• Blocked/muted users still generating push notifications
• Input textbox for bio ignoring newlines
• OTP: Inability to use PostgreSQL databases with SSL
• user delete_activities breaking when trying to delete already deleted posts
• Incorrect URL for Funkwhale channels

Upgrade notes

1. Restart Pleroma

[2.0.1] - 2020-03-15

Security

• Static-FE: Fix remote posts not being sanitized

Fixed

• 500 errors when no Accept header is present if Static-FE is enabled
• Instance panel not being updated immediately due to wrong Cache-Control headers
• Statuses posted with BBCode/Markdown having unncessary newlines in Pleroma-FE
• OTP: Fix some settings not being migrated to in-database config properly
• No Cache-Control headers on attachment/media proxy requests
• Character limit enforcement being off by 1
• Mastodon Streaming API: hashtag timelines not working

Changed

• BBCode and Markdown formatters will no longer return any \n and only use <br/> for newlines
• Mastodon API: Allow registration without email if email verification is not enabled

Upgrade notes

Nginx only

1. Remove proxy_ignore_headers Cache-Control; and proxy_hide_header Cache-Control; from your config.

Everyone

1. Run database migrations (inside Pleroma directory):

• OTP: ./bin/pleroma_ctl migrate
• From Source: mix ecto.migrate

2. Restart Pleroma

[2.0.0] - 2019-03-08

Security

• Mastodon API: Fix being able to request enormous amount of statuses in timelines leading to DoS. Now limited to 40 per request.

Removed

• Breaking: Removed 1.0+ deprecated configurations Pleroma.Upload, :strip_exif and :instance, :dedupe_media
• Breaking: OStatus protocol support
• Breaking: MDII uploader
• Breaking: Using third party engines for user recommendation

API Changes

- **Breaking**: AdminAPI: migrate_from_db endpoint

Changed

• Breaking: Pleroma won't start if it detects unapplied migrations
• Breaking: Elixir >=1.8 is now required (was >= 1.7)
• Breaking: Pleroma.Plugs.RemoteIp and :rate_limiter enabled by default. Please ensure your reverse proxy forwards the real IP!
• Breaking: attachment links (config :pleroma, :instance, no_attachment_links and config :pleroma, Pleroma.Upload, link_name) disabled by default
• Breaking: OAuth: defaulted [:auth, :enforce_oauth_admin_scope_usage] setting to true which demands admin OAuth scope to perform admin actions (in addition to is_admin flag on User); make sure to use bundled or newer versions of AdminFE & PleromaFE to access admin / moderator features.
• Breaking: Dynamic configuration has been rearchitected. The :pleroma, :instance, dynamic_configuration setting has been replaced with config :pleroma, configurable_from_database. Please backup your configuration to a file and run the migration task to ensure consistency with the new schema.
• Breaking: :instance, no_attachment_links has been replaced with :instance, attachment_links which still takes a boolean value but doesn't use double negative language.
• Replaced pleroma_job_queue and Pleroma.Web.Federator.RetryQueue with Oban (see docs/config.md on migrating customized worker / retry settings)
• Introduced quantum job scheduler
• Enabled :instance, extended_nickname_format in the default config
• Add rel="ugc" to all links in statuses, to prevent SEO spam
• Extract RSS functionality from OStatus
• MRF (Simple Policy): Also use :accept/:reject on the actors rather than only their activities
• OStatus: Extract RSS functionality
• Deprecated User.Info embedded schema (fields moved to User)
• Store status data inside Flag activity
• Deprecated (reorganized as UserRelationship entity) User fields with user AP IDs (blocks, mutes, muted_reblogs, muted_notifications, subscribers).
• Rate limiter is now disabled for localhost/socket (unless remoteip plug is enabled)
• Logger: default log level changed from warn to info.
• Config mix task migrate_to_db truncates config table before migrating the config file.
• Allow account registration without an email
• Default to prepare: :unnamed in the database configuration.
• Instance stats are now loaded on startup instead of being empty until next hourly job.

API Changes

• Breaking EmojiReactions: Change endpoints and responses to align with Mastodon
• Breaking Admin API: PATCH /api/pleroma/admin/users/:nickname/force_password_reset is now PATCH /api/pleroma/admin/users/force_password_reset (accepts nicknames array in the request body)
• Breaking: Admin API: Return link alongside with token on password reset
• Breaking: Admin API: PUT /api/pleroma/admin/reports/:id is now PATCH /api/pleroma/admin/reports, see admin_api.md for details
• Breaking: /api/pleroma/admin/users/invite_token now uses POST, changed accepted params and returns full invite in json instead of only token string.
• Breaking replying to reports is now "report notes", endpoint changed from POST /api/pleroma/admin/reports/:id/respond to POST /api/pleroma/admin/reports/:id/notes
• Mastodon API: stopped sanitizing display names, field names and subject fields since they are supposed to be treated as plaintext
• Admin API: Return total when querying for reports
• Mastodon API: Return pleroma.direct_conversation_id when creating a direct message (POST /api/v1/statuses)
• Admin API: Return link alongside with token on password reset
• Admin API: Support authentication via x-admin-token HTTP header
• Mastodon API: Add pleroma.direct_conversation_id to the status endpoint (GET /api/v1/statuses/:id)
• Mastodon API: pleroma.thread_muted to the Status entity
• Mastodon API: Mark the direct conversation as read for the author when they send a new direct message
• Mastodon API, streaming: Add pleroma.direct_conversation_id to the conversation stream event payload.
• Admin API: Render whole status in grouped reports
• Mastodon API: User timelines will now respect blocks, unless you are getting the user timeline of somebody you blocked (which would be empty otherwise).
• Mastodon API: Favoriting / Repeating a post multiple times will now return the identical response every time. Before, executing that action twice would return an error ("already favorited") on the second try.
• Mastodon API: Limit timeline requests to 3 per timeline per 500ms per user/ip by default.
• Admin API: PATCH /api/pleroma/admin/users/:nickname/credentials and GET /api/pleroma/admin/users/:nickname/credentials

Added

• :chat_limit option to limit chat characters.
• cleanup_attachments option to remove attachments along with statuses. Does not affect duplicate files and attachments without status. Enabling this will increase load to database when deleting statuses on larger instances.
• Refreshing poll results for remote polls
• Authentication: Added rate limit for password-authorized actions / login existence checks
• Static Frontend: Add the ability to render user profiles and notices server-side without requiring JS app.
• Mix task to re-count statuses for all users (mix pleroma.count_statuses)
• Mix task to list all users (mix pleroma.user list)
• Mix task to send a test email (mix pleroma.email test)
• Support for X-Forwarded-For and similar HTTP headers which used by reverse proxies to pass a real user IP address to the backend. Must not be enabled unless your instance is behind at least one reverse proxy (such as Nginx, Apache HTTPD or Varnish Cache).
• MRF: New module which handles incoming posts based on their age. By default, all incoming posts that are older than 2 days will be unlisted and not shown to their followers.
• User notification settings: Add privacy_option option.
• Support for custom Elixir modules (such as MRF policies)
• User settings: Add This account is a option.
• A new users admin digest email
• OAuth: admin scopes support (relevant setting: [:auth, :enforce_oauth_admin_scope_usage]).
• Add an option authorized_fetch_mode to require HTTP signatures for AP fetches.
• ActivityPub: support for replies collection (output for outgoing federation & fetching on incoming federation).
• Mix task to refresh counter cache (mix pleroma.refresh_counter_cache)

API Changes

• Job queue stats to the healthcheck page
• Admin API: Add ability to fetch reports, grouped by status GET /api/pleroma/admin/grouped_reports
• Admin API: Add ability to require password reset
• Mastodon API: Account entities now include follow_requests_count (planned Mastodon 3.x addition)
• Pleroma API: GET /api/v1/pleroma/accounts/:id/scrobbles to get a list of recently scrobbled items
• Pleroma API: POST /api/v1/pleroma/scrobble to scrobble a media item
• Mastodon API: Add upload_limit, avatar_upload_limit, background_upload_limit, and banner_upload_limit to /api/v1/instance
• Mastodon API: Add pleroma.unread_conversation_count to the Account entity
• OAuth: support for hierarchical permissions / Mastodon 2.4.3 OAuth permissions
• Metadata Link: Atom syndication Feed
• Mix task to re-count statuses for all users (mix pleroma.count_statuses)
• Mastodon API: Add exclude_visibilities parameter to the timeline and notification endpoints
• Admin API: /users/:nickname/toggle_activation endpoint is now deprecated in favor of: /users/activate, /users/deactivate, both accept nicknames array
• Admin API: Multiple endpoints now require nicknames array, instead of singe nickname:
  • POST/DELETE /api/pleroma/admin/users/:nickname/permission_group/:permission_group are deprecated in favor of: POST/DELETE /api/pleroma/admin/users/permission_group/:permission_group
  • DELETE /api/pleroma/admin/users (nickname query param or nickname sent in JSON body) is deprecated in favor of: DELETE /api/pleroma/admin/users (nicknames query array param or nicknames sent in JSON body)
• Admin API: Add GET /api/pleroma/admin/relay endpoint - lists all followed relays
• Pleroma API: POST /api/v1/pleroma/conversations/read to mark all conversations as read
• ActivityPub: Support Move activities
• Mastodon API: Add /api/v1/markers for managing timeline read markers
• Mastodon API: Add the recipients parameter to GET /api/v1/conversations
• Configuration: feed option for user atom feed.
• Pleroma API: Add Emoji reactions
• Admin API: Add /api/pleroma/admin/instances/:instance/statuses - lists all statuses from a given instance
• Admin API: Add /api/pleroma/admin/users/:nickname/statuses - lists all statuses from a given user
• Admin API: PATCH /api/pleroma/users/confirm_email to confirm email for multiple users, PATCH /api/pleroma/users/resend_confirmation_email to resend confirmation email for multiple users
• ActivityPub: Configurable type field of the actors.
• Mastodon API: /api/v1/accounts/:id has source/pleroma/actor_type field.
• Mastodon API: /api/v1/update_credentials accepts actor_type field.
• Captcha: Support native provider
• Captcha: Enable by default
• Mastodon API: Add support for account_id param to filter notifications by the account
• Mastodon API: Add emoji_reactions property to Statuses
• Mastodon API: Change emoji reaction reply format
• Notifications: Added pleroma:emoji_reaction notification type
• Mastodon API: Change emoji reaction reply format once more
• Configuration: feed.logo option for tag feed.
• Tag feed: /tags/:tag.rss - list public statuses by hashtag.
• Mastodon API: Add reacted property to emoji_reactions
• Pleroma API: Add reactions for a single emoji.
• ActivityPub: [:activitypub, :note_replies_output_limit] setting sets the number of note self-replies to output on outgoing federation.
• Admin API: GET /api/pleroma/admin/stats to get status count by visibility scope
• Admin API: GET /api/pleroma/admin/statuses - list all statuses (accepts godmode and local_only)

Fixed

• Report emails now include functional links to profiles of remote user accounts
• Not being able to log in to some third-party apps when logged in to MastoFE
• MRF: Delete activities being exempt from MRF policies
• OTP releases: Not being able to configure OAuth expired token cleanup interval
• OTP releases: Not being able to configure HTML sanitization policy
• OTP releases: Not being able to change upload limit (again)
• Favorites timeline now ordered by favorite date instead of post date
• Support for cancellation of a follow request

API Changes

• Mastodon API: Fix private and direct statuses not being filtered out from the public timeline for an authenticated user (GET /api/v1/timelines/public)
• Mastodon API: Inability to get some local users by nickname in /api/v1/accounts/:id_or_nickname
• AdminAPI: If some status received reports both in the "new" format and "old" format it was considered reports on two different statuses (in the context of grouped reports)
• Admin API: Error when trying to update reports in the "old" format
• Mastodon API: Marking a conversation as read (POST /api/v1/conversations/:id/read) now no longer brings it to the top in the user's direct conversation list

[1.1.9] - 2020-02-10

Fixed

• OTP: Inability to set the upload limit (again)
• Not being able to pin polls
• Streaming API: incorrect handling of reblog mutes
• Rejecting the user when field length limit is exceeded
• OpenGraph provider: html entities in descriptions

[1.1.8] - 2020-01-10

Fixed

• Captcha generation issues
• Returned Kocaptcha endpoint to configuration
• Captcha validity is now 5 minutes

[1.1.7] - 2019-12-13

Fixed

• OTP: Inability to set the upload limit
• OTP: Inability to override node name/distribution type to run 2 Pleroma instances on the same machine

Added

• Integrated captcha provider

Changed

• Captcha enabled by default
• Default Captcha provider changed from Pleroma.Captcha.Kocaptcha to Pleroma.Captcha.Native
• Better Cache-Control header for static content

Bundled Pleroma-FE Changes

Added

• Icons in the navigation panel

Fixed

• Improved support unauthenticated view of private instances

Removed

• Whitespace hack on empty post content

[1.1.6] - 2019-11-19

Fixed

• Not being able to log into to third party apps when the browser is logged into mastofe
• Email confirmation not being required even when enabled
• Mastodon API: conversations API crashing when one status is malformed

Bundled Pleroma-FE Changes

Added

• About page
• Meme arrows

Fixed

• Image modal not closing unless clicked outside of image
• Attachment upload spinner not being centered
• Showing follow counters being 0 when they are actually hidden

[1.1.5] - 2019-11-09

Fixed

• Polls having different numbers in timelines/notifications/poll api endpoints due to cache desyncronization
• Pleroma API: OAuth token endpoint not being found when ".json" suffix is appended

Changed

• Frontend bundle updated to 044c9ad0

[1.1.4] - 2019-11-01

Fixed

• Added a migration that fills up empty user.info fields to prevent breakage after previous unsafe migrations.
• Failure to migrate from pre-1.0.0 versions
• Mastodon API: Notification stream not including follow notifications

[1.1.3] - 2019-10-25

Fixed

• Blocked users showing up in notifications collapsed as if they were muted
• pleroma_ctl not working on Debian's default shell

[1.1.2] - 2019-10-18

Fixed

• pleroma_ctl trying to connect to a running instance when generating the config, which of course doesn't exist.

[1.1.1] - 2019-10-18

Fixed

• One of the migrations between 1.0.0 and 1.1.0 wiping user info of the relay user because of unexpected behavior of postgresql's jsonb_set, resulting in inability to post in the default configuration. If you were affected, please run the following query in postgres console, the relay user will be recreated automatically:

delete from users where ap_id = 'https://your.instance.hostname/relay';

• Bad user search matches

[1.1.0] - 2019-10-14

Breaking: The stable branch has been changed from master to stable. If you want to keep using 1.0, the release/1.0 branch will receive security updates for 6 months after 1.1 release.

OTP Note: pleroma_ctl in 1.0 defaults to master and doesn't support specifying arbitrary branches, making ./pleroma_ctl update fail. To fix this, fetch a version of pleroma_ctl from 1.1 using the command below and proceed with the update normally:

curl -Lo ./bin/pleroma_ctl 'https://git.pleroma.social/pleroma/pleroma/raw/develop/rel/files/bin/pleroma_ctl'

Security

• Mastodon API: respect post privacy in /api/v1/statuses/:id/{favourited,reblogged}_by