> \[!WARNING]
> **This release is an important security release fixing a major security issue.**
>
> A corresponding security release is available for the [4.1.x branch](https://togithub.com/mastodon/mastodon/releases/tag/v4.1.18).
> \[!NOTE]
> If you are using nightly builds, **do not use this release** but update to `nightly.2024-07-05-security` or newer instead. If you are on the `main` branch, update to the latest commit.
##### Changelog
##### Security
- Fix incorrect permission checking on multiple API endpoints ([GHSA-58x8-3qxw-6hm7](https://togithub.com/mastodon/mastodon/security/advisories/GHSA-58x8-3qxw-6hm7))
- Fix incorrect authorship checking when processing some activities (CVE-2024-37903, [GHSA-xjvf-fm67-4qc3](https://togithub.com/mastodon/mastodon/security/advisories/GHSA-xjvf-fm67-4qc3))
- Fix ongoing streaming sessions not being invalidated when application tokens get revoked ([GHSA-vp5r-5pgw-jwqx](https://togithub.com/mastodon/mastodon/security/advisories/GHSA-vp5r-5pgw-jwqx))
- Update dependencies
##### Added
- Add yarn version specification to avoid confusion with Yarn 3 and Yarn 4
##### Changed
- Change preview cards generation to skip unusually long URLs ([oneiros](https://togithub.com/mastodon/mastodon/pull/30854))
- Change search modifiers to be case-insensitive ([Gargron](https://togithub.com/mastodon/mastodon/pull/30865))
- Change `STATSD_ADDR` handling to emit a warning rather than crashing if the address is unreachable ([timothyjrogers](https://togithub.com/mastodon/mastodon/pull/30691))
- Change PWA start URL from `/home` to `/` ([ClearlyClaire](https://togithub.com/mastodon/mastodon/pull/27377))
##### Removed
- Removed dependency on `posix-spawn` ([ClearlyClaire](https://togithub.com/mastodon/mastodon/pull/18559))
##### Fixed
- Fix scheduled statuses scheduled in less than 5 minutes being immediately published ([danielmbrasil](https://togithub.com/mastodon/mastodon/pull/30584))
- Fix encoding detection for link cards ([oneiros](https://togithub.com/mastodon/mastodon/pull/30780))
- Fix `/admin/accounts/:account_id/statuses/:id` for edited posts with media attachments ([ClearlyClaire](https://togithub.com/mastodon/mastodon/pull/30819))
- Fix duplicate `@context` attribute in user archive export ([ClearlyClaire](https://togithub.com/mastodon/mastodon/pull/30653))
##### Upgrade notes
To get the code for v4.2.10, use `git fetch && git checkout v4.2.10`.
> \[!NOTE]
> As always, **make sure you have backups of the database before performing any upgrades**. If you are using docker-compose, this is how a backup command might look: `docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump`
> \[!IMPORTANT]
> Mastodon is now performing stricter checks to prevent client IP address spoofing. This means that if one of your reverse proxy is not on Mastodon's local network, you will need to set `TRUSTED_PROXY_IP` accordingly, listing the IP address of every trusted reverse-proxy (including local network ones). See [the documentation](https://docs.joinmastodon.org/admin/config/#trusted_proxy_ip) for more information.
##### Dependencies
With the exception of Ruby's recommended version, external dependencies have not changed since v4.2.0, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:
- Ruby: 3.0 to 3.2
- PostgreSQL: 10 or newer
- Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
- LibreTranslate (optional, for translations): 1.3.3 or newer
- Redis: 4 or newer
- Node: 16 or newer
- ImageMagick: 6.9.7-7 or newer
##### Update steps
> \[!TIP]
> The `charlock_holmes` gem may fail to build on some systems with recent versions of `gcc`.
> If you run into such an issue, try `BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install`.
The following instructions are for updating from 4.2.9.
If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.
**Non-Docker only:**
1. Install dependencies: `bundle install` and `yarn install --frozen-lockfile`
2. Restart all Mastodon processes
**Using Docker:**
1. Restart all Mastodon processes
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.
This PR contains the following updates:
v4.2.9->v4.2.10Release Notes
mastodon/mastodon (tootsuite/mastodon)
### [`v4.2.10`](https://togithub.com/mastodon/mastodon/releases/tag/v4.2.10) [Compare Source](https://togithub.com/mastodon/mastodon/compare/v4.2.9...v4.2.10)
> \[!WARNING] > **This release is an important security release fixing a major security issue.** > > A corresponding security release is available for the [4.1.x branch](https://togithub.com/mastodon/mastodon/releases/tag/v4.1.18). > \[!NOTE] > If you are using nightly builds, **do not use this release** but update to `nightly.2024-07-05-security` or newer instead. If you are on the `main` branch, update to the latest commit. ##### Changelog ##### Security - Fix incorrect permission checking on multiple API endpoints ([GHSA-58x8-3qxw-6hm7](https://togithub.com/mastodon/mastodon/security/advisories/GHSA-58x8-3qxw-6hm7)) - Fix incorrect authorship checking when processing some activities (CVE-2024-37903, [GHSA-xjvf-fm67-4qc3](https://togithub.com/mastodon/mastodon/security/advisories/GHSA-xjvf-fm67-4qc3)) - Fix ongoing streaming sessions not being invalidated when application tokens get revoked ([GHSA-vp5r-5pgw-jwqx](https://togithub.com/mastodon/mastodon/security/advisories/GHSA-vp5r-5pgw-jwqx)) - Update dependencies ##### Added - Add yarn version specification to avoid confusion with Yarn 3 and Yarn 4 ##### Changed - Change preview cards generation to skip unusually long URLs ([oneiros](https://togithub.com/mastodon/mastodon/pull/30854)) - Change search modifiers to be case-insensitive ([Gargron](https://togithub.com/mastodon/mastodon/pull/30865)) - Change `STATSD_ADDR` handling to emit a warning rather than crashing if the address is unreachable ([timothyjrogers](https://togithub.com/mastodon/mastodon/pull/30691)) - Change PWA start URL from `/home` to `/` ([ClearlyClaire](https://togithub.com/mastodon/mastodon/pull/27377)) ##### Removed - Removed dependency on `posix-spawn` ([ClearlyClaire](https://togithub.com/mastodon/mastodon/pull/18559)) ##### Fixed - Fix scheduled statuses scheduled in less than 5 minutes being immediately published ([danielmbrasil](https://togithub.com/mastodon/mastodon/pull/30584)) - Fix encoding detection for link cards ([oneiros](https://togithub.com/mastodon/mastodon/pull/30780)) - Fix `/admin/accounts/:account_id/statuses/:id` for edited posts with media attachments ([ClearlyClaire](https://togithub.com/mastodon/mastodon/pull/30819)) - Fix duplicate `@context` attribute in user archive export ([ClearlyClaire](https://togithub.com/mastodon/mastodon/pull/30653)) ##### Upgrade notes To get the code for v4.2.10, use `git fetch && git checkout v4.2.10`. > \[!NOTE] > As always, **make sure you have backups of the database before performing any upgrades**. If you are using docker-compose, this is how a backup command might look: `docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump` > \[!IMPORTANT] > Mastodon is now performing stricter checks to prevent client IP address spoofing. This means that if one of your reverse proxy is not on Mastodon's local network, you will need to set `TRUSTED_PROXY_IP` accordingly, listing the IP address of every trusted reverse-proxy (including local network ones). See [the documentation](https://docs.joinmastodon.org/admin/config/#trusted_proxy_ip) for more information. ##### Dependencies With the exception of Ruby's recommended version, external dependencies have not changed since v4.2.0, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is: - Ruby: 3.0 to 3.2 - PostgreSQL: 10 or newer - Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work) - LibreTranslate (optional, for translations): 1.3.3 or newer - Redis: 4 or newer - Node: 16 or newer - ImageMagick: 6.9.7-7 or newer ##### Update steps > \[!TIP] > The `charlock_holmes` gem may fail to build on some systems with recent versions of `gcc`. > If you run into such an issue, try `BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install`. The following instructions are for updating from 4.2.9. If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. **Non-Docker only:** 1. Install dependencies: `bundle install` and `yarn install --frozen-lockfile` 2. Restart all Mastodon processes **Using Docker:** 1. Restart all Mastodon processesConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.