develop #7881

Merged

lambadalambda merged 20 commits from develop into stable 2026-05-03 16:28:17 +00:00

Conversation 0 Commits 20 Files changed 19 +1529 -239

lambadalambda commented 2026-05-03 16:28:06 +00:00

Owner

Copy link

Checklist

• Adding a changelog: In the changelog.d directory, create a file named <code>.<type>.

### Checklist - [ ] Adding a changelog: In the `changelog.d` directory, create a file named `<code>.<type>`. <!-- `<code>` can be anything, but we recommend using a more or less unique identifier to avoid collisions, such as the branch name. `<type>` can be `add`, `change`, `remove`, `fix`, `security` or `skip`. `skip` is only used if there is no user-visible change in the PR (for example, only editing comments in the code). Otherwise, choose a type that corresponds to your change. In the file, write the changelog entry. For example, if a PR adds group functionality, we can create a file named `group.add` and write `Add group functionality` in it. If one changelog entry is not enough, you may add more. But that might mean you can split it into two PRs. Only use more than one changelog entry if you really need to (for example, when one change in the code fix two different bugs, or when refactoring). -->

lambadalambda added 20 commits 2026-05-03 16:28:07 +00:00

UpdateValidator: fix tests cb2271978e

UpdateValidator: Check Actor owns Object or updates itself af6d12c0a5

ReceiverWorker: Add cancels on actor does not match signature test da28a4c441

ReceiverWorker: Check that signature matches actor 42683e79df

Add spoofing regression tests 80e72b79f5

Use Mox in spoofing regression tests 9c540995b4

Clarify cross-domain spoofing regressions bd45704dba

Split failed-signature inbox retries ... 7756f491d5

Route failed-signature ActivityPub inbox retries through a dedicated worker so legacy and malformed retry jobs fail closed before processing.

Fail closed on unresolved signed payloads ... 4337e0eb1b

Reject unknown remote Update targets and invalidate signed payloads when their signer identity cannot be mapped, avoiding crashes and fail-open signature state.

Add spoofing fixes changelog entry 99b614a52e

Fix Woodpecker path filters a35aa6551e

Merge branch 'develop' of https://git.pleroma.social/pleroma/pleroma into update-spoofing a1f7413832

Log failed-signature retry rejections 4acd8c4e72

Add failed-signature retry regression tests 00dd1b5103

Align inbox controller tests with signer mapping 6ae02d71bd

Validate WebFinger nicknames against actors 621d86a31d

Merge branch 'update-spoofing' of ssh://git.pleroma.social:22/pleroma-secteam/pleroma into develop 78a41dfdcd

Merge branch 'stable' of ssh://git.pleroma.com/pleroma/pleroma into develop 78aef1b875

Prepare 2.10.2 release 8ccdd98914

Merge pull request 'Prepare 2.10.2 release' (#7880) from release/2.10.2 into develop ... 4230887d7e

Reviewed-on: #7880

lambadalambda merged commit cd8816ecce into stable 2026-05-03 16:28:17 +00:00

lambadalambda referenced this pull request from a commit 2026-05-03 16:28:17 +00:00

Merge pull request 'develop' (#7881) from develop into stable

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

AP C2S

  

AdminAPI

  

Breaking API

Affects clients

  

Breaks existing config

  

Check if still valid

  

Data Protection

  

Do not merge

  

Document in the changelog

  

Doing

  

Feature Request / Enhancement

  

MastoAPI

  

NL2

Improved Mobile Experience

  

NL4

Improved instance customization and QoL options

  

OStatus

  

OTP Releases

  

Refactor

  

Security

  

To Do

  

TwitterAPI

  

bug

  

complicated

  

confirmed

  

deps

  

discussion

  

documentation

  

easy

  

feature: to be merged in stable

  

fix: to be merged in stable

  

incident

Denotes a disruption to IT services and the associated issues require immediate attention

  

needs to be backported to maint

  

needs-changes

  

needs-info

  

needs-review

  

performance

  

regression

  

unclear

No labels

AP C2S

AdminAPI

Breaking API

Breaks existing config

Check if still valid

Data Protection

Do not merge

Document in the changelog

Doing

Feature Request / Enhancement

MastoAPI

NL2

NL4

OStatus

OTP Releases

Refactor

Security

To Do

TwitterAPI

bug

complicated

confirmed

deps

discussion

documentation

easy

feature: to be merged in stable

fix: to be merged in stable

incident

needs to be backported to maint

needs-changes

needs-info

needs-review

performance

regression

unclear

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

pleroma/pleroma!7881

No description provided.