Tags give the ability to mark specific points in history as being important
  • v2.0.5
    Release v2.0.5

    [2.0.5] 2020-05-13

    Backend changes

    Security

    • Fix possible private status leaks in Mastodon Streaming API

    Fixed

    • Crashes when trying to block a user if block federation is disabled
    • Not being able to start the instance without erlang-eldap installed
    • Users with bios over the limit getting rejected
    • Follower counters not being updated on incoming follow accepts

    Pleroma-FE changes

    Added

    • Private notifications option for push notifications
    • 'Copy link' button for statuses (in the ellipsis menu)

    Changed

    • Registration page no longer requires email if the server is configured not to require it

    Fixed

    • Status ellipsis menu closes properly when selecting certain options

    Upgrade notes

    1. Restart Pleroma
  • v2.0.4
    Release v2.0.4

    [2.0.4] - 2020-05-10

    Security

    • AP C2S: Fix a potential DoS by creating nonsensical objects that break timelines

    Fixed

    • Peertube user lookups not working
    • InsertSkeletonsForDeletedUsers migration failing on some instances
    • Healthcheck reporting the number of memory currently used, rather than allocated in total
    • LDAP not being usable in OTP releases
    • Default apache configuration having tls chain issues

    Upgrade notes

    Apache only

    1. Remove the following line from your config:
        SSLCertificateFile      /etc/letsencrypt/live/${servername}/cert.pem

    Everyone

    1. Restart Pleroma
  • v2.0.3
    Release v2.0.3

    [2.0.3] - 2020-05-02

    Security

    • Disallow re-registration of previously deleted users, which allowed viewing direct messages addressed to them
    • Mastodon API: Fix POST /api/v1/follow_requests/:id/authorize allowing to force a follow from a local user even if they didn't reques t to follow
    • CSP: Sandbox uploads

    Fixed

    • Notifications from blocked domains
    • Potential federation issues with Mastodon versions before 3.0.0
    • HTTP Basic Authentication permissions issue
    • Follow/Block imports not being able to find the user if the nickname started with an @
    • Instance stats counting internal users
    • Inability to run a From Source release without git
    • ObjectAgePolicy didn't filter out old messages
    • blob: urls not being allowed by CSP

    Added

    • NodeInfo: ObjectAgePolicy settings to the federation list.
    • Follow request notifications
    API Changes - Admin API: `GET /api/pleroma/admin/need_reboot`.

    Upgrade notes

    1. Restart Pleroma
    2. Run database migrations (inside Pleroma directory):
    • OTP: ./bin/pleroma_ctl migrate
    • From Source: mix ecto.migrate
  • v2.0.2
    Release v2.0.2

    [2.0.2] - 2020-04-08

    Added

    • Support for Funkwhale's Audio activity
    • Admin API: PATCH /api/pleroma/admin/users/:nickname/update_credentials

    Fixed

    • Blocked/muted users still generating push notifications
    • Input textbox for bio ignoring newlines
    • OTP: Inability to use PostgreSQL databases with SSL
    • user delete_activities breaking when trying to delete already deleted posts
    • Incorrect URL for Funkwhale channels

    Upgrade notes

    1. Restart Pleroma
  • v2.0.1
    Release v2.0.1

    [2.0.1] - 2020-03-15

    Security

    • Static-FE: Fix remote posts not being sanitized

    Fixed

    • Rate limiter crashes when there is no explicitly specified ip in the config
    • 500 errors when no Accept header is present if Static-FE is enabled
    • Instance panel not being updated immediately due to wrong Cache-Control headers
    • Statuses posted with BBCode/Markdown having unncessary newlines in Pleroma-FE
    • OTP: Fix some settings not being migrated to in-database config properly
    • No Cache-Control headers on attachment/media proxy requests
    • Character limit enforcement being off by 1
    • Mastodon Streaming API: hashtag timelines not working

    Changed

    • BBCode and Markdown formatters will no longer return any \n and only use <br/> for newlines
    • Mastodon API: Allow registration without email if email verification is not enabled

    Upgrade notes

    Nginx only

    1. Remove proxy_ignore_headers Cache-Control; and proxy_hide_header Cache-Control; from your config.

    Everyone

    1. Run database migrations (inside Pleroma directory):
    • OTP: ./bin/pleroma_ctl migrate
    • From Source: mix ecto.migrate
    1. Restart Pleroma
  • v2.0.0
    Release v2.0.0

    [2.0.0] - 2019-03-08

    Security

    • Mastodon API: Fix being able to request enourmous amount of statuses in timelines leading to DoS. Now limited to 40 per request.

    Removed

    • Breaking: Removed 1.0+ deprecated configurations Pleroma.Upload, :strip_exif and :instance, :dedupe_media
    • Breaking: OStatus protocol support
    • Breaking: MDII uploader
    • Breaking: Using third party engines for user recommendation
    API Changes - **Breaking**: AdminAPI: migrate_from_db endpoint

    Changed

    • Breaking: Pleroma won't start if it detects unapplied migrations
    • Breaking: Elixir >=1.8 is now required (was >= 1.7)
    • Breaking: Pleroma.Plugs.RemoteIp and :rate_limiter enabled by default. Please ensure your reverse proxy forwards the real IP!
    • Breaking: attachment links (config :pleroma, :instance, no_attachment_links and config :pleroma, Pleroma.Upload, link_name) disabled by default
    • Breaking: OAuth: defaulted [:auth, :enforce_oauth_admin_scope_usage] setting to true which demands admin OAuth scope to perform admin actions (in addition to is_admin flag on User); make sure to use bundled or newer versions of AdminFE & PleromaFE to access admin / moderator features.
    • Breaking: Dynamic configuration has been rearchitected. The :pleroma, :instance, dynamic_configuration setting has been replaced with config :pleroma, configurable_from_database. Please backup your configuration to a file and run the migration task to ensure consistency with the new schema.
    • Breaking: :instance, no_attachment_links has been replaced with :instance, attachment_links which still takes a boolean value but doesn't use double negative language.
    • Replaced pleroma_job_queue and Pleroma.Web.Federator.RetryQueue with Oban (see docs/config.md on migrating customized worker / retry settings)
    • Introduced quantum job scheduler
    • Enabled :instance, extended_nickname_format in the default config
    • Add rel="ugc" to all links in statuses, to prevent SEO spam
    • Extract RSS functionality from OStatus
    • MRF (Simple Policy): Also use :accept/:reject on the actors rather than only their activities
    • OStatus: Extract RSS functionality
    • Deprecated User.Info embedded schema (fields moved to User)
    • Store status data inside Flag activity
    • Deprecated (reorganized as UserRelationship entity) User fields with user AP IDs (blocks, mutes, muted_reblogs, muted_notifications, subscribers).
    • Rate limiter is now disabled for localhost/socket (unless remoteip plug is enabled)
    • Logger: default log level changed from warn to info.
    • Config mix task migrate_to_db truncates config table before migrating the config file.
    • Default to prepare: :unnamed in the database configuration.
    • Instance stats are now loaded on startup instead of being empty until next hourly job.
    API Changes
    • Breaking EmojiReactions: Change endpoints and responses to align with Mastodon
    • Breaking Admin API: PATCH /api/pleroma/admin/users/:nickname/force_password_reset is now PATCH /api/pleroma/admin/users/force_password_reset (accepts nicknames array in the request body)
    • Breaking: Admin API: Return link alongside with token on password reset
    • Breaking: Admin API: PUT /api/pleroma/admin/reports/:id is now PATCH /api/pleroma/admin/reports, see admin_api.md for details
    • Breaking: /api/pleroma/admin/users/invite_token now uses POST, changed accepted params and returns full invite in json instead of only token string.
    • Breaking replying to reports is now "report notes", enpoint changed from POST /api/pleroma/admin/reports/:id/respond to POST /api/pleroma/admin/reports/:id/notes
    • Mastodon API: stopped sanitizing display names, field names and subject fields since they are supposed to be treated as plaintext
    • Admin API: Return total when querying for reports
    • Mastodon API: Return pleroma.direct_conversation_id when creating a direct message (POST /api/v1/statuses)
    • Admin API: Return link alongside with token on password reset
    • Admin API: Support authentication via x-admin-token HTTP header
    • Mastodon API: Add pleroma.direct_conversation_id to the status endpoint (GET /api/v1/statuses/:id)
    • Mastodon API: pleroma.thread_muted to the Status entity
    • Mastodon API: Mark the direct conversation as read for the author when they send a new direct message
    • Mastodon API, streaming: Add pleroma.direct_conversation_id to the conversation stream event payload.
    • Admin API: Render whole status in grouped reports
    • Mastodon API: User timelines will now respect blocks, unless you are getting the user timeline of somebody you blocked (which would be empty otherwise).
    • Mastodon API: Favoriting / Repeating a post multiple times will now return the identical response every time. Before, executing that action twice would return an error ("already favorited") on the second try.
    • Mastodon API: Limit timeline requests to 3 per timeline per 500ms per user/ip by default.

    Added

    • :chat_limit option to limit chat characters.
    • cleanup_attachments option to remove attachments along with statuses. Does not affect duplicate files and attachments without status. Enabling this will increase load to database when deleting statuses on larger instances.
    • Refreshing poll results for remote polls
    • Authentication: Added rate limit for password-authorized actions / login existence checks
    • Static Frontend: Add the ability to render user profiles and notices server-side without requiring JS app.
    • Mix task to re-count statuses for all users (mix pleroma.count_statuses)
    • Mix task to list all users (mix pleroma.user list)
    • Mix task to send a test email (mix pleroma.email test)
    • Support for X-Forwarded-For and similar HTTP headers which used by reverse proxies to pass a real user IP address to the backend. Must not be enabled unless your instance is behind at least one reverse proxy (such as Nginx, Apache HTTPD or Varnish Cache).
    • MRF: New module which handles incoming posts based on their age. By default, all incoming posts that are older than 2 days will be unlisted and not shown to their followers.
    • User notification settings: Add privacy_option option.
    • Support for custom Elixir modules (such as MRF policies)
    • User settings: Add This account is a option.
    • A new users admin digest email
    • OAuth: admin scopes support (relevant setting: [:auth, :enforce_oauth_admin_scope_usage]).
    • Add an option authorized_fetch_mode to require HTTP signatures for AP fetches.
    • ActivityPub: support for replies collection (output for outgoing federation & fetching on incoming federation).
    • Mix task to refresh counter cache (mix pleroma.refresh_counter_cache)
    API Changes
    • Job queue stats to the healthcheck page
    • Admin API: Add ability to fetch reports, grouped by status GET /api/pleroma/admin/grouped_reports
    • Admin API: Add ability to require password reset
    • Mastodon API: Account entities now include follow_requests_count (planned Mastodon 3.x addition)
    • Pleroma API: GET /api/v1/pleroma/accounts/:id/scrobbles to get a list of recently scrobbled items
    • Pleroma API: POST /api/v1/pleroma/scrobble to scrobble a media item
    • Mastodon API: Add upload_limit, avatar_upload_limit, background_upload_limit, and banner_upload_limit to /api/v1/instance
    • Mastodon API: Add pleroma.unread_conversation_count to the Account entity
    • OAuth: support for hierarchical permissions / Mastodon 2.4.3 OAuth permissions
    • Metadata Link: Atom syndication Feed
    • Mix task to re-count statuses for all users (mix pleroma.count_statuses)
    • Mastodon API: Add exclude_visibilities parameter to the timeline and notification endpoints
    • Admin API: /users/:nickname/toggle_activation endpoint is now deprecated in favor of: /users/activate, /users/deactivate, both accept nicknames array
    • Admin API: Multiple endpoints now require nicknames array, instead of singe nickname:
      • POST/DELETE /api/pleroma/admin/users/:nickname/permission_group/:permission_group are deprecated in favor of: POST/DELETE /api/pleroma/admin/users/permission_group/:permission_group
      • DELETE /api/pleroma/admin/users (nickname query param or nickname sent in JSON body) is deprecated in favor of: DELETE /api/pleroma/admin/users (nicknames query array param or nicknames sent in JSON body)
    • Admin API: Add GET /api/pleroma/admin/relay endpoint - lists all followed relays
    • Pleroma API: POST /api/v1/pleroma/conversations/read to mark all conversations as read
    • ActivityPub: Support Move activities
    • Mastodon API: Add /api/v1/markers for managing timeline read markers
    • Mastodon API: Add the recipients parameter to GET /api/v1/conversations
    • Configuration: feed option for user atom feed.
    • Pleroma API: Add Emoji reactions
    • Admin API: Add /api/pleroma/admin/instances/:instance/statuses - lists all statuses from a given instance
    • Admin API: Add /api/pleroma/admin/users/:nickname/statuses - lists all statuses from a given user
    • Admin API: PATCH /api/pleroma/users/confirm_email to confirm email for multiple users, PATCH /api/pleroma/users/resend_confirmation_email to resend confirmation email for multiple users
    • ActivityPub: Configurable type field of the actors.
    • Mastodon API: /api/v1/accounts/:id has source/pleroma/actor_type field.
    • Mastodon API: /api/v1/update_credentials accepts actor_type field.
    • Captcha: Support native provider
    • Captcha: Enable by default
    • Mastodon API: Add support for account_id param to filter notifications by the account
    • Mastodon API: Add emoji_reactions property to Statuses
    • Mastodon API: Change emoji reaction reply format
    • Notifications: Added pleroma:emoji_reaction notification type
    • Mastodon API: Change emoji reaction reply format once more
    • Configuration: feed.logo option for tag feed.
    • Tag feed: /tags/:tag.rss - list public statuses by hashtag.
    • Mastodon API: Add reacted property to emoji_reactions
    • Pleroma API: Add reactions for a single emoji.
    • ActivityPub: [:activitypub, :note_replies_output_limit] setting sets the number of note self-replies to output on outgoing federation.
    • Admin API: GET /api/pleroma/admin/stats to get status count by visibility scope
    • Admin API: GET /api/pleroma/admin/statuses - list all statuses (accepts godmode and local_only)

    Fixed

    • Report emails now include functional links to profiles of remote user accounts
    • Not being able to log in to some third-party apps when logged in to MastoFE
    • MRF: Delete activities being exempt from MRF policies
    • OTP releases: Not being able to configure OAuth expired token cleanup interval
    • OTP releases: Not being able to configure HTML sanitization policy
    • OTP releases: Not being able to change upload limit (again)
    • Favorites timeline now ordered by favorite date instead of post date
    • Support for cancellation of a follow request
    API Changes
    • Mastodon API: Fix private and direct statuses not being filtered out from the public timeline for an authenticated user (GET /api/v1/timelines/public)
    • Mastodon API: Inability to get some local users by nickname in /api/v1/accounts/:id_or_nickname
    • AdminAPI: If some status received reports both in the "new" format and "old" format it was considered reports on two different statuses (in the context of grouped reports)
    • Admin API: Error when trying to update reports in the "old" format
    • Mastodon API: Marking a conversation as read (POST /api/v1/conversations/:id/read) now no longer brings it to the top in the user's direct conversation list
  • v1.1.9
    Release v1.1.9

    Fixed

    • OTP: Inability to set the upload limit (again)
    • Not being able to pin polls
    • Streaming API: incorrect handling of reblog mutes
    • Rejecting the user when field length limit is exceeded
    • OpenGraph provider: html entities in descriptions
  • v1.1.8
    Release v1.1.8

    [1.1.8] - 2020-01-10

    Fixed

    • Captcha generation issues
    • Returned Kocaptcha endpoint to configuration
    • Captcha validity is now 5 minutes
  • v1.1.7
    Release v1.1.7

    [1.1.7] - 2019-12-14

    Fixed

    • OTP: Inability to set the upload limit
    • OTP: Inability to override node name/distribution type to run 2 Pleroma instances on the same machine

    Added

    • Integrated captcha provider

    Changed

    • Captcha enabled by default
    • Default Captcha provider changed from Pleroma.Captcha.Kocaptcha to Pleroma.Captcha.Native
    • Better Cache-Control header for static content

    Bundled Pleroma-FE Changes

    Added

    • Icons in the navigation panel

    Fixed

    • Improved support unauthenticated view of private instances

    Removed

    • Whitespace hack on empty post content
  • v1.1.6
    Release v1.1.6

    [1.1.6] - 2019-11-19

    Fixed

    • Not being able to log into to third party apps when the browser is logged into mastofe
    • Email confirmation not being required even when enabled
    • Mastodon API: conversations API crashing when one status is malformed

    Bundled Pleroma-FE Changes

    Added

    • About page
    • Meme arrows

    Fixed

    • Image modal not closing unless clicked outside of image
    • Attachment upload spinner not being centered
    • Showing follow counters being 0 when they are actually hidden
  • v1.1.5   Retag with a version bump
    36f4382b · Bump mix.exs version ·
    Release v1.1.5

    [1.1.5] - 2019-11-09

    Fixed

    • Polls having different numbers in timelines/notifications/poll api endpoints due to cache desyncronization
    • Pleroma API: OAuth token endpoint not being found when ".json" suffix is appended

    Changed

  • v1.1.4   1.1.4 release.
    Release v1.1.4

    [1.1.4] - 2019-11-01

    Fixed

    • Added a migration that fills up empty user.info fields to prevent breakage after previous unsafe migrations.
    • Failure to migrate from pre-1.0.0 versions
    • Mastodon API: Notification stream not including follow notifications
  • v1.1.3
    Release v1.1.3

    [1.1.3] - 2019-10-25

    Fixed

    • Blocked users showing up in notifications collapsed as if they were muted
    • pleroma_ctl not working on Debian's default shell
  • v1.1.2
    Release v1.1.2

    [1.1.2] - 2019-10-18

    Fixed

    • pleroma_ctl trying to connect to a running instance when generating the config, which of course doesn't exist.
  • v1.1.1
    Release v1.1.1

    [1.1.1] - 2019-10-18

    Fixed

    • One of the migrations between 1.0.0 and 1.1.0 wiping user info of the relay user because of unexpected behavior of postgresql's jsonb_set, resulting in inability to post in the default configuration. If you were affected, please run the following query in postgres console, the relay user will be recreated automatically:
    delete from users where ap_id = 'https://your.instance.hostname/relay';
    • Bad user search matches
  • v1.1.0
    442acb31 · Fix pleroma_ctl link ·
    Release v1.1.0

    [1.1.0] - 2019-10-14

    Breaking: The stable branch has been changed from master to stable. If you want to keep using 1.0, the release/1.0 branch will receive security updates for 6 months after 1.1 release.

    OTP Note: pleroma_ctl in 1.0 defaults to master and doesn't support specifying arbitrary branches, making ./pleroma_ctl update fail. To fix this, fetch a version of pleroma_ctl from 1.1 using the command below and proceed with the update normally:

    curl -Lo ./bin/pleroma_ctl 'https://git.pleroma.social/pleroma/pleroma/raw/develop/rel/files/bin/pleroma_ctl'

    Security

    • Mastodon API: respect post privacy in /api/v1/statuses/:id/{favourited,reblogged}_by

    Removed

    • Breaking: GNU Social API with Qvitter extensions support
    • Emoji: Remove longfox emojis.
    • Remove Reply-To header from report emails for admins.
    • ActivityPub: The /objects/:uuid/likes endpoint.

    Changed

    • Breaking: Configuration: A setting to explicitly disable the mailer was added, defaulting to true, if you are using a mailer add config :pleroma, Pleroma.Emails.Mailer, enabled: true to your config
    • Breaking: Configuration: /media/ is now removed when base_url is configured, append /media/ to your base_url config to keep the old behaviour if desired
    • Breaking: /api/pleroma/notifications/read is moved to /api/v1/pleroma/notifications/read and now supports max_id and responds with Mastodon API entities.
    • Configuration: added config/description.exs, from which docs/config.md is generated
    • Configuration: OpenGraph and TwitterCard providers enabled by default
    • Configuration: Filter.AnonymizeFilename added ability to retain file extension with custom text
    • Federation: Return 403 errors when trying to request pages from a user's follower/following collections if they have hide_followers/hide_follows set
    • NodeInfo: Return skipThreadContainment in metadata for the skip_thread_containment option
    • NodeInfo: Return mailerEnabled in metadata
    • Mastodon API: Unsubscribe followers when they unfollow a user
    • Mastodon API: pleroma.thread_muted key in the Status entity
    • AdminAPI: Add "godmode" while fetching user statuses (i.e. admin can see private statuses)
    • Improve digest email template – Pagination: (optional) return total alongside with items when paginating
    • The Pleroma.FlakeId module has been replaced with the flake_id library.

    Fixed

    • Following from Osada
    • Favorites timeline doing database-intensive queries
    • Metadata rendering errors resulting in the entire page being inaccessible
    • federation_incoming_replies_max_depth option being ignored in certain cases
    • Mastodon API: Handling of search timeouts (/api/v1/search and /api/v2/search)
    • Mastodon API: Misskey's endless polls being unable to render
    • Mastodon API: Embedded relationships not being properly rendered in the Account entity of Status entity
    • Mastodon API: Notifications endpoint crashing if one notification failed to render
    • Mastodon API: exclude_replies is correctly handled again.
    • Mastodon API: Add account_id, type, offset, and limit to search API (/api/v1/search and /api/v2/search)
    • Mastodon API, streaming: Fix filtering of notifications based on blocks/mutes/thread mutes
    • Mastodon API: Fix private and direct statuses not being filtered out from the public timeline for an authenticated user (GET /api/v1/timelines/public)
    • Mastodon API: Ensure the account field is not empty when rendering Notification entities.
    • Mastodon API: Inability to get some local users by nickname in /api/v1/accounts/:id_or_nickname
    • Mastodon API: Blocks are now treated consistently between the Streaming API and the Timeline APIs
    • Rich Media: Parser failing when no TTL can be found by image TTL setters
    • Rich Media: The crawled URL is now spliced into the rich media data.
    • ActivityPub S2S: sharedInbox usage has been mostly aligned with the rules in the AP specification.
    • ActivityPub C2S: follower/following collection pages being inaccessible even when authentifucated if hide_followers/ hide_follows was set
    • ActivityPub: Deactivated user deletion
    • ActivityPub: Fix /users/:nickname/inbox crashing without an authenticated user
    • MRF: fix ability to follow a relay when AntiFollowbotPolicy was enabled
    • ActivityPub: Correct addressing of Undo.
    • ActivityPub: Correct addressing of profile update activities.
    • ActivityPub: Polls are now refreshed when necessary.
    • Report emails now include functional links to profiles of remote user accounts
    • Existing user id not being preserved on insert conflict
    • Pleroma.Upload base_url was not automatically whitelisted by MediaProxy. Now your custom CDN or file hosting will be accessed directly as expected.
    • Report email not being sent to admins when the reporter is a remote user
    • Reverse Proxy limiting max_body_length was incorrectly defined and only checked Content-Length headers which may not be sufficient in some circumstances

    Added

    • Expiring/ephemeral activites. All activities can have expires_at value set, which controls when they should be deleted automatically.
    • Mastodon API: in post_status, the expires_in parameter lets you set the number of seconds until an activity expires. It must be at least one hour.
    • Mastodon API: all status JSON responses contain a pleroma.expires_at item which states when an activity will expire. The value is only shown to the user who created the activity. To everyone else it's empty.
    • Configuration: ActivityExpiration.enabled controls whether expired activites will get deleted at the appropriate time. Enabled by default.
    • Conversations: Add Pleroma-specific conversation endpoints and status posting extensions. Run the bump_all_conversations task again to create the necessary data.
    • MRF: Support for priming the mediaproxy cache (Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy)
    • MRF: Support for excluding specific domains from Transparency.
    • MRF: Support for filtering posts based on who they mention (Pleroma.Web.ActivityPub.MRF.MentionPolicy)
    • Mastodon API: Support for the tagged filter in GET /api/v1/accounts/:id/statuses
    • Mastodon API, streaming: Add support for passing the token in the Sec-WebSocket-Protocol header
    • Mastodon API, extension: Ability to reset avatar, profile banner, and background
    • Mastodon API: Add support for fields_attributes API parameter (setting custom fields)
    • Mastodon API: Add support for categories for custom emojis by reusing the group feature. https://github.com/tootsuite/mastodon/pull/11196
    • Mastodon API: Add support for muting/unmuting notifications
    • Mastodon API: Add support for the blocked_by attribute in the relationship API (GET /api/v1/accounts/relationships). https://github.com/tootsuite/mastodon/pull/10373
    • Mastodon API: Add support for the domain_blocking attribute in the relationship API (GET /api/v1/accounts/relationships).
    • Mastodon API: Add pleroma.deactivated to the Account entity
    • Mastodon API: added /auth/password endpoint for password reset with rate limit.
    • Mastodon API: /api/v1/accounts/:id/statuses now supports nicknames or user id
    • Mastodon API: Improve support for the user profile custom fields
    • Mastodon API: Add support for fields_attributes API parameter (setting custom fields)
    • Mastodon API: Added an endpoint to get multiple statuses by IDs (GET /api/v1/statuses/?ids[]=1&ids[]=2)
    • Admin API: Return users' tags when querying reports
    • Admin API: Return avatar and display name when querying users
    • Admin API: Allow querying user by ID
    • Admin API: Added support for tuples.
    • Admin API: Added endpoints to run mix tasks pleroma.config migrate_to_db & pleroma.config migrate_from_db
    • Added synchronization of following/followers counters for external users
    • Configuration: enabled option for Pleroma.Emails.Mailer, defaulting to false.
    • Configuration: Pleroma.Plugs.RateLimiter bucket_name, params options.
    • Configuration: user_bio_length and user_name_length options.
    • Addressable lists
    • Twitter API: added rate limit for /api/account/password_reset endpoint.
    • ActivityPub: Add an internal service actor for fetching ActivityPub objects.
    • ActivityPub: Optional signing of ActivityPub object fetches.
    • Admin API: Endpoint for fetching latest user's statuses
    • Pleroma API: Add /api/v1/pleroma/accounts/confirmation_resend?email=<email> for resending account confirmation.
    • Pleroma API: Email change endpoint.
    • Admin API: Added moderation log
    • Web response cache (currently, enabled for ActivityPub)
    • Reverse Proxy: Do not retry failed requests to limit pressure on the peer

    Changed

    • Configuration: Filter.AnonymizeFilename added ability to retain file extension with custom text
    • Admin API: changed json structure for saving config settings.
    • RichMedia: parsers and their order are configured in rich_media config.
    • RichMedia: add the rich media ttl based on image expiration time.
  • v1.0.91
    Release v1.0.91

    [1.0.91] - 2019-10-06

    Added

    • Reverse Proxy: Do not retry failed requests to limit pressure on the peer
    • Mastodon API: Add support for fields_attributes API parameter (setting custom fields)

    Fixed

    • Mastodon API: Inability to get some local users by nickname in /api/v1/accounts/:id_or_nickname
    • Mastodon API: Blocks are now treated consistently between the Streaming API and the Timeline APIs
    • ActivityPub: Correct addressing of Undo.
    • ActivityPub: Correct addressing of profile update activities.
    • ActivityPub: Polls are now refreshed when necessary.
    • Mastodon API: Ensure the account field is not empty when rendering Notification entities.
    • Report emails now include functional links to profiles of remote user accounts
    • Mastodon API: Fix private and direct statuses not being filtered out from the public timeline for an authenticated user (GET /api/v1/timelines/public)

    Removed

    • ActivityPub: The /objects/:uuid/likes endpoint.

    Changed

    • The Pleroma.FlakeId module has been replaced with the flake_id library.
  • v1.0.90
    Release v1.0.90

    [1.0.90] - 2019-09-30

    Warning: This is the first 1.1.x release candidate and may be unstable. It is recommended to use 1.0.7 instead if stability is required.

    Security

    • OStatus: eliminate the possibility of a protocol downgrade attack.
    • OStatus: prevent following locked accounts, bypassing the approval process.
    • Mastodon API: respect post privacy in /api/v1/statuses/:id/{favourited,reblogged}_by

    Removed

    • Breaking: GNU Social API with Qvitter extensions support
    • Breaking: ActivityPub: The accept_blocks configuration setting.
    • Emoji: Remove longfox emojis.
    • Remove Reply-To header from report emails for admins.

    Changed

    • Breaking: Configuration: A setting to explicitly disable the mailer was added, defaulting to true, if you are using a mailer add config :pleroma, Pleroma.Emails.Mailer, enabled: true to your config
    • Breaking: Configuration: /media/ is now removed when base_url is configured, append /media/ to your base_url config to keep the old behaviour if desired
    • Breaking: /api/pleroma/notifications/read is moved to /api/v1/pleroma/notifications/read and now supports max_id and responds with Mastodon API entities.
    • Configuration: OpenGraph and TwitterCard providers enabled by default
    • Configuration: Filter.AnonymizeFilename added ability to retain file extension with custom text
    • Configuration: added config/description.exs, from which docs/config.md is generated
    • Federation: Return 403 errors when trying to request pages from a user's follower/following collections if they have hide_followers/hide_follows set
    • NodeInfo: Return skipThreadContainment in metadata for the skip_thread_containment option
    • NodeInfo: Return mailerEnabled in metadata
    • Mastodon API: Unsubscribe followers when they unfollow a user
    • Mastodon API: pleroma.thread_muted key in the Status entity
    • AdminAPI: Add "godmode" while fetching user statuses (i.e. admin can see private statuses)
    • Improve digest email template – Pagination: (optional) return total alongside with items when paginating
    • ActivityPub: The first page in inboxes/outboxes is no longer embedded.

    Fixed

    • Following from Osada
    • Not being able to pin unlisted posts
    • Objects being re-embedded to activities after being updated (e.g faved/reposted). Running 'mix pleroma.database prune_objects' again is advised.
    • Favorites timeline doing database-intensive queries
    • Metadata rendering errors resulting in the entire page being inaccessible
    • federation_incoming_replies_max_depth option being ignored in certain cases
    • Federation/MediaProxy not working with instances that have wrong certificate order
    • Mastodon API: Handling of search timeouts (/api/v1/search and /api/v2/search)
    • Mastodon API: Misskey's endless polls being unable to render
    • Mastodon API: Embedded relationships not being properly rendered in the Account entity of Status entity
    • Mastodon API: Notifications endpoint crashing if one notification failed to render
    • Mastodon API: follower/following counters not being nullified, when hide_follows/hide_followers is set
    • Mastodon API: muted in the Status entity, using author's account to determine if the tread was muted
    • Mastodon API: Add account_id, type, offset, and limit to search API (/api/v1/search and /api/v2/search)
    • Mastodon API, streaming: Fix filtering of notifications based on blocks/mutes/thread mutes
    • ActivityPub C2S: follower/following collection pages being inaccessible even when authentifucated if hide_followers/ hide_follows was set
    • Existing user id not being preserved on insert conflict
    • Rich Media: Parser failing when no TTL can be found by image TTL setters
    • Rich Media: The crawled URL is now spliced into the rich media data.
    • ActivityPub S2S: sharedInbox usage has been mostly aligned with the rules in the AP specification.
    • ActivityPub S2S: remote user deletions now work the same as local user deletions.
    • ActivityPub S2S: POST requests are now signed with (request-target) pseudo-header.
    • Not being able to access the Mastodon FE login page on private instances
    • Invalid SemVer version generation, when the current branch does not have commits ahead of tag/checked out on a tag
    • Pleroma.Upload base_url was not automatically whitelisted by MediaProxy. Now your custom CDN or file hosting will be accessed directly as expected.
    • Report email not being sent to admins when the reporter is a remote user
    • MRF: ensure that subdomain_match calls are case-insensitive
    • Reverse Proxy limiting max_body_length was incorrectly defined and only checked Content-Length headers which may not be sufficient in some circumstances
    • MRF: fix use of unserializable keyword lists in describe() implementations
    • ActivityPub: Deactivated user deletion
    • ActivityPub: Fix /users/:nickname/inbox crashing without an authenticated user
    • MRF: fix ability to follow a relay when AntiFollowbotPolicy was enabled

    Added

    • Expiring/ephemeral activites. All activities can have expires_at value set, which controls when they should be deleted automatically.
    • Mastodon API: in post_status, the expires_in parameter lets you set the number of seconds until an activity expires. It must be at least one hour.
    • Mastodon API: all status JSON responses contain a pleroma.expires_at item which states when an activity will expire. The value is only shown to the user who created the activity. To everyone else it's empty.
    • Configuration: ActivityExpiration.enabled controls whether expired activites will get deleted at the appropriate time. Enabled by default.
    • Conversations: Add Pleroma-specific conversation endpoints and status posting extensions. Run the bump_all_conversations task again to create the necessary data.
    • Breaking: MRF describe API, which adds support for exposing configuration information about MRF policies to NodeInfo. Custom modules will need to be updated by adding, at the very least, def describe, do: {:ok, %{}} to the MRF policy modules.
    • MRF: Support for priming the mediaproxy cache (Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy)
    • MRF: Support for excluding specific domains from Transparency.
    • MRF: Support for filtering posts based on who they mention (Pleroma.Web.ActivityPub.MRF.MentionPolicy)
    • MRF: Support for filtering posts based on ActivityStreams vocabulary (Pleroma.Web.ActivityPub.MRF.VocabularyPolicy)
    • MRF (Simple Policy): Support for wildcard domains.
    • Support for wildcard domains in user domain blocks setting.
    • Configuration: quarantined_instances support wildcard domains.
    • Configuration: federation_incoming_replies_max_depth option
    • Mastodon API: Support for the tagged filter in GET /api/v1/accounts/:id/statuses
    • Mastodon API, streaming: Add support for passing the token in the Sec-WebSocket-Protocol header
    • Mastodon API, extension: Ability to reset avatar, profile banner, and background
    • Mastodon API: Add support for categories for custom emojis by reusing the group feature. https://github.com/tootsuite/mastodon/pull/11196
    • Mastodon API: Add support for muting/unmuting notifications
    • Mastodon API: Add support for the blocked_by attribute in the relationship API (GET /api/v1/accounts/relationships). https://github.com/tootsuite/mastodon/pull/10373
    • Mastodon API: Add support for the domain_blocking attribute in the relationship API (GET /api/v1/accounts/relationships).
    • Mastodon API: Add pleroma.deactivated to the Account entity
    • Mastodon API: added /auth/password endpoint for password reset with rate limit.
    • Mastodon API: /api/v1/accounts/:id/statuses now supports nicknames or user id
    • Mastodon API: Improve support for the user profile custom fields
    • Admin API: Return users' tags when querying reports
    • Admin API: Return avatar and display name when querying users
    • Admin API: Allow querying user by ID
    • Admin API: Added support for tuples.
    • Admin API: Added endpoints to run mix tasks pleroma.config migrate_to_db & pleroma.config migrate_from_db
    • Added synchronization of following/followers counters for external users
    • Configuration: enabled option for Pleroma.Emails.Mailer, defaulting to false.
    • Configuration: Pleroma.Plugs.RateLimiter bucket_name, params options.
    • Configuration: user_bio_length and user_name_length options.
    • Addressable lists
    • Twitter API: added rate limit for /api/account/password_reset endpoint.
    • ActivityPub: Add an internal service actor for fetching ActivityPub objects.
    • ActivityPub: Optional signing of ActivityPub object fetches.
    • Admin API: Endpoint for fetching latest user's statuses
    • Pleroma API: Add /api/v1/pleroma/accounts/confirmation_resend?email=<email> for resending account confirmation.
    • Pleroma API: Email change endpoint.
    • Relays: Added a task to list relay subscriptions.
    • Mix Tasks: mix pleroma.database fix_likes_collections
    • Federation: Remove likes from objects.
    • Admin API: Added moderation log
    • Web response cache (currently, enabled for ActivityPub)
    • Mastodon API: Added an endpoint to get multiple statuses by IDs (GET /api/v1/statuses/?ids[]=1&ids[]=2)

    Changed

    • Configuration: Filter.AnonymizeFilename added ability to retain file extension with custom text
    • Admin API: changed json structure for saving config settings.
    • RichMedia: parsers and their order are configured in rich_media config.
    • RichMedia: add the rich media ttl based on image expiration time.
  • v1.0.7
    Release v1.0.7

    [1.0.7] - 2019-09-26

    Fixed

    • Broken federation on Erlang 22 (previous versions of hackney http client were using an option that got deprecated)

    Changed

    • ActivityPub: The first page in inboxes/outboxes is no longer embedded.
  • v1.0.6
    Release v1.0.6

    [1.0.6] - 2019-08-14

    Fixed

    • MRF: fix use of unserializable keyword lists in describe() implementations
    • ActivityPub S2S: POST requests are now signed with (request-target) pseudo-header.