superseriousbusiness/gotosocial v0.19.0

v0.19.0 Seditious Sloth 😈

on Codeberg

What's that coming over the hill, is it a monster? Is it a monster?

Yes, it's version 0.19.0 of GoToSocial, aka Seditious Sloth 😈!

Please read the migration notes carefully for instructions on how to upgrade to this version.

The update contains several database migrations, so please check the database migration section closely, and make sure you've backed up your database before updating, so that you can restore from backup if something goes wrong!

Release highlights

• OAuth token scope enforcement: Token scopes (read, write etc) now actually do stuff! So we removed the big "scopes don't do stuff!" warning in the docs. The enforced scopes match the Mastodon API token scopes, so there shouldn't be any surprises for bot owners / app developers.
  See https://docs.gotosocial.org/en/latest/api/swagger/ for more info.
• Token review / invalidation: You can now review and invalidate tokens issued for your account in the settings panel, to help keep your account secure.
  Docs: https://docs.gotosocial.org/en/latest/user_guide/settings/#access-tokens
• Create and manage applications in the settings panel: Handy for people who want to run bots and applications with GoToSocial!
  Docs: https://docs.gotosocial.org/en/latest/user_guide/settings/#applications
• Gallery-style profile layout option: You can now choose to lay out the web view of your profile in a 'gram style gallery. Good for people who mostly post media and want to put that at the forefront.
  Docs: https://docs.gotosocial.org/en/latest/user_guide/settings/#select-layout
• Support for two-factor authentication (aka 2FA): If your instance isn't configured to use an OIDC provider, you can now secure your account with 2FA via a QR code and an authenticator app. When logging in with 2FA enabled, you will have to provide a time-based one-time password. Security!
  Docs: https://docs.gotosocial.org/en/latest/user_guide/settings/#two-factor-authentication
• Lots of web view tweaks including nicer media rendering on chrome, proper blurhash support, much better support for keyboard-based page navigation, wider font support for different scripts, tidier status info bar, and more.
• OAuth bugfixes should allow more flexibility and compatibility when logging in with or authorizing third-party applications.
• **bandwagon.fm compatibility fixes: you can now follow Bandwagon.fm artists from your GoToSocial account and receive posts / announcements from them.
• Edit domain permissions: you can now edit the obfuscate and public and private comment fields in domain permissions (blocks/allows) instead of having to remove and recreate the permission to update the comments.

Migration notes

Upgrading

To upgrade to v0.19.0 from a previous release:

Binary/tar

1. Stop GoToSocial.
2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup.
3. Download and untar the new release, including the web assets and html templates.
4. Edit your config.yaml file if necessary (see below).
5. Start GoToSocial.
6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
7. Enjoy your updated instance.

Docker

1. Stop GoToSocial.
2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup.
3. Pull the new docker container (superseriousbusiness/gotosocial:0.19.0 or superseriousbusiness/gotosocial:latest)
4. Edit your config.yaml file or environment variables if necessary (see below).
5. Start GoToSocial.
6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
7. Enjoy your updated instance.

config.yaml

No changes since 0.18.3.

Database Migrations

⚠️⚠️⚠️

This release contains database migrations which will run the first time you start up this new version.

Before running the update and its migrations, try to ensure you have disk space remaining equal to 1x your current database size, for safety. Eg., if you have a 10gb database file, you should aim to have 10gb of disk space still available. This is because the migrations need to copy and modify the entire accounts table, which occupies a decent chunk of database space.

Be sure not to interrupt this migration process.

This will take anywhere between a couple seconds and ten minutes or more (on slower hardware). You can follow the migration process in the GoToSocial logs.

Please be patient!

⚠️⚠️⚠️

Settings panel

Because of updates to the way the settings panel stores its OAuth access tokens, after updating you will be logged out of your GtS settings panel and will have to log in again.

Which release archive/container should I use?

GoToSocial releases binary builds for 64-bit Linux, FreeBSD, and NetBSD operating systems. We also release Docker builds for 64-bit Linux.

nowasm

For your convenience, we also provide UNSUPPORTED, EXPERIMENTAL BUILDS, created using the nowasm tag, in the downloads list below. There is no Docker build for nowasm.

GoToSocial releases built with nowasm use the Go-native, modernc version of SQLite instead of the WASM one, and will use on-system ffmpeg and ffprobe binaries for media processing.

Using a nowasm build is currently the only way to run GoToSocial on a 32-bit system.

For more information on running a nowasm build, see the nowasm documentation page.

Changelog

Features and performance

• eb720241da3d786c6ec79f2325277fa4af23846f: [feature] Enforce OAuth token scopes (#3835) (@tsmethurst)
• 46862171e0b7c9ad088157f385b07c092cd4ac05: [feature] Added an extra CSS class name to the About This Instance and Register an Account sections in the root index template to allow for easier targeting with custom CSS. (#3843) (@VirtualWolf)
• 0118e03cdaae5a378d6995cd1a49411a1132b8d7: [feature] Implement CSV import for mutes (#3696) (@xvello)
• b4bb97225e7dd8906484b09b4f736395e779eead: [feature/frontend] use localized time string in status & poll info page (#3821) (@cdn0x12)
• e78e817057e01ce0cd2e3d532e4ca9ded8b88b73: [feature] add microformat support (#3848) (@AnInternetTroll)
• 1b37944f8b8eccc2afcfb0f603786209a3b7402d: [feature] Refactor tokens, allow multiple app redirect_uris (#3849) (@tsmethurst)
• 829143d2636d4c0d274bf2ab4559912f472a2bc4: [feature] Add token review / delete to backend + settings panel (#3845) (@tsmethurst)
• d8113c11e4d84a6d04d56b58d337c235154a535b: [feature] Parse content warning to HTML, serialize via client API as plaintext (#3876) (@tsmethurst)
• 0c72282559fffa06e533de9eed375c9130c0e7a3: [performance] Optimize local timeline + local status count queries (#3892) (@tsmethurst)
• d3c3d34aaee220f1d3a9ba7bd8d0f9dc5e9c6b79: [feature/frontend] Add visibility icon for posts (#3908) (@tsmethurst)
• d5847e2d2b68a1eb41d43be170cd4ddff9003cff: [feature] Application creation + management via API + settings panel (#3906) (@tsmethurst)
• 59aac290e4ae8454ef8589b3f6a0442f2fdfeb90: [performance] reindex public timeline + tinker with query a bit (#3918) (@tsmethurst)
• 27171a78ded38a7142aecfcaa75ede86f73b7a5b: [feature] Parse funkwhale Album as Statusable to allow barebones interacting with bandwagon (#3931) (@tsmethurst)
• b6e481d63eec15191f2717957682c13ee8a68308: [feature] Allow user to choose "gallery" style layout for web view of profile (#3917) (@tsmethurst)
• 3949117be01ac8aca7e41a7179506f27627654e5: [feature] Use blurhashes in frontend, tidy up gallery view a bit (#3948) (@tsmethurst)
• b1844323314dd1f0832f1fcdb765a7f67ca01dbc: [feature] Allow editing domain blocks/allows, fix comment import (#3967) (@tsmethurst)
• 650be1e8d0a805ab41ea9ce599023b87fffa18a3: [feature] Allow deleting avatar + header via settings panel (#3970) (@tsmethurst)
• 365b5753419238bb96bc3f9b744d380ff20cbafc: [feature] add TOTP two-factor authentication (2FA) (#3960) (@tsmethurst)
• e032c959e13bc276d8517a51857e1c772c151f95: [feature] Implement /oauth/revoke for token revocation (#3983) (@tsmethurst)
• 6ff0d3355c487dbdc13403ec32f5e587c7f93073: [feature/frontend] Add visibility icon for posts (#4005) (@tsmethurst)
• 2fce02780876d5e4c4f32e0ca341c43a5d8b21a8: [feature/frontend] Hide "engagement" stats, edits, and other info under a little drop down to unclutter status info bar (#4021) (@tsmethurst)
• a87be80c902d947fe1737c5e5e82d69a8a132273: [feature/frontend] add autocomplete + other helpful attributes to auth html pages (#4029) (@tsmethurst)

Bug fixes

• 24da574684b965e2f98a04eae795cc70eff22c39: [bugfix] fix refreshed additional media info being ignored (#3867) (@NyaaaWhatsUpDoc)
• ab7ec43988c1e7e33d24dea351e34f1b4bdcd0c1: [bugfix] Fix app migration (#3868) (@tsmethurst)
• 69461c461b79dbeb9b55ba83d2b7308772194d7f: [bugfix] Return useful err on server start failure (#3879) (@tsmethurst)
• 424f62dd70d765673e7cacd5373728ba4762496b: [bugfix] Store and expose status content type (#3870) (@ewwwin)
• 35e94c8abd3767eb44620cdf7246ba04f9d9252c: [bugfix] Fix length for type varchar must be at least 1 on Postgres (#3885) (@tsmethurst)
• 0c49d5abb8c753f1c7e3628a9363c31589ad5de0: [bugfix] Fix panic when opening instance actor in web view (#3898) (@tsmethurst)
• 657e064bf6d619d836825c0ad56bb791875d102a: [bugfix] Avoid nil ptr if maintenance router can't be started (#3919) (@tsmethurst)
• cecb1fd00955ab8670d3099f016eeaa5af663dc5: [bugfix] Fix set obfuscate = null error in adoptPerm (#3922) (@tsmethurst)
• 57c5f68e1a6182c0fa476359742d15182f0a95cb: [bugfix] Fix update users query in migration (#3963) (@tsmethurst)
• 6473886c8e4c713a6f5686e289985a0ebf3e9a82: [bugfix] Fix Atkinson Hyperlegible font embedding on Ecks Pee theme. (#3964) (@kvibber)
• e263d236223defbbdf9762cca57720da1d77c3ca: [bugfix] Change email Date header to use RFC2822 (#3972) (@tsmethurst)
• 6f24205a26bde03e73055fd7af369352103c390f: [bugfix] Don't assume "manuallyApprovesFollowers": true if not set (#3978) (@tsmethurst)
• 19cfa8d126a2ff54298150529e58e5e4f5495f09: [bugfix] Fix a couple accessibility issues with :focus elements (#3979) (@tsmethurst)
• c8a780e12a8112a4d4cbe8ed72d241a382f73903: [bugfix] Fix setting bot on/off (#3986) (@tsmethurst)
• 36758ea0de6a7ce7b94d5db561fa1d81f37b96d0: [bugfix] media v2 endpoint fix unset url (#4008) (@NyaaaWhatsUpDoc)
• f5ce219844e0c6e80b1f1dfbbce1f96a6251448d: [bugfix] websocket header token not always returned (#4009) (@NyaaaWhatsUpDoc)
• b510f3c539fb6c71ffba6f32974193d6fb035165: [bugfix/frontend] Fix photoswipe layout issues, keyboard shortcuts (#4010) (@tsmethurst)
• 14899733c8c5962a8b4ed5c13836f86a34bd29a0: [bugfix] new token API issues (#4022) (@NyaaaWhatsUpDoc)
• e9f6d186dc947863a5dfc18c8d6f2016b8030c88: [bugfix] Fix '+'-separated scopes not being recognized (#4028) (@tsmethurst)
• 0992ffc0571561f354e05c8f12784cbb5c00ccc8: [bugfix] Use util.IsNil for checking DomainPermission (#4040) (@tsmethurst)

Chores & version bumps

• d8f96f81d645fe313f8759a4bf540ff5b0ed0644: [chore] Fix typo in common.tsx (#3834) (@PrivacyDragon)
• d2cf9de726c4b8b45a4b17f244e5e00f57f88c16: [chore]: Bump github.com/tetratelabs/wazero from 1.8.2 to 1.9.0 (#3827) (@dependabot[bot])
• e1ec904dd34ec4e40f35cb3b7bb02b28acc9150b: [chore]: Bump github.com/google/go-cmp from 0.6.0 to 0.7.0 (#3826) (@dependabot[bot])
• f734a94c1ca9bb732b2ae818098b48794e374c8a: [chore]: Bump golang.org/x/crypto from 0.33.0 to 0.34.0 (#3824) (@dependabot[bot])
• 8bc502ba6257158ff8f6eee1a2d9158c099dd6f3: [chore] Update KimMachineGun/automemlimit (#3841) (@tsmethurst)
• 1f38b7b48f26919451dcf9444165086d913b9108: [chore] Remove duplicate swagger docs build in Dockerfile (#3842) (@tsmethurst)
• a7485ae251af6c9cf930f2a4aefd02a11c710599: [chore]: Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 (#3831) (@dependabot[bot])
• 4c9901fc035ece13b2dbaca21465a534abb77a04: [chore] little frontend tweaks (#3852) (@tsmethurst)
• e2e185d10bdaaba85996069e9621963ad4d6f565: [chore] github.com/superseriousbusiness/activity -> codeberg.org/superseriousbusiness/activity (#3853) (@tsmethurst)
• 5d0e3d9c354906409a514b437d70f7a9db90703a: [chore] github.com/superseriousbusiness/httpsig -> codeberg.org/superseriousbusiness/httpsig (#3854) (@tsmethurst)
• d8bb1c391b06050d0cbde554d7ba2366384f2c7d: [chore] Update exif terminator version with codeberg libraries (#3855) (@tsmethurst)
• 49c12636c61f97ae2417a59a6f6fd5c0dd5ff8df: [chore] go-swagger -> codeberg (#3856) (@tsmethurst)
• 8488ac928651656c6f7bebf5eaabce62c2b9fb66: [chore] migrate oauth2 -> codeberg (#3857) (@tsmethurst)
• 0e2e8e54ab85889d3c42cf8b0744c3253065983b: [chore]: Bump github.com/ncruces/go-sqlite3 from 0.23.0 to 0.24.0 (#3862) (@dependabot[bot])
• ddd9210614fe377612fba9547af33dc677e7bca0: [chore]: Bump github.com/prometheus/client_golang from 1.20.5 to 1.21.0 (#3860) (@dependabot[bot])
• ee60732cf7ee64f0bc82095fd271d1ba34cd3eec: [chore] fixed email template to align with the new "Log in" button + separate page (#3871) (@wolfyjade)
• 98c4cae89ac6a6c24c3580d3cead31ac43376114: [chore] update links in CONTRIBUTING.md (#3881) (@cdn0x12)
• 719c92529996e72939d1886e93d96288591f4d8e: [chore]: Bump golang.org/x/crypto from 0.35.0 to 0.36.0 (#3887) (@dependabot[bot])
• 85e17b3e788ac19d8c1da7cd2d78208b11e3eea2: [chore]: Bump github.com/prometheus/client_golang from 1.21.0 to 1.21.1 (#3890) (@dependabot[bot])
• 252a17a691a316af8a1b0d960436c32257b4f66b: [chore]: Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (#3888) (@dependabot[bot])
• 95f88e5d939218b038ab8d0dd6776120aee53ceb: [chore] add warning message when wazero compiler not supported (#3894) (@NyaaaWhatsUpDoc)
• da462afce2f1ef66f866752c8f7b775a646a6beb: [chore]: Bump golang.org/x/net from 0.35.0 to 0.36.0 (#3905) (@dependabot[bot])
• 85ee7cca4721a97ea1763890e4d3d7b083deb163: [chore] Tweak "nothing here!" message (#3907) (@tsmethurst)
• 808031ca01be890a877214a71493a4dc3d24c2b4: [chore] Add extra org.opencontainers.image labels to docker build (#3930) (@tsmethurst)
• a2caa5fdbb2f610530ab1303c7376950b1a54080: [chore]: Bump golang.org/x/net from 0.36.0 to 0.37.0 (#3934) (@dependabot[bot])
• 18c8f85a3032fcc091b4c9e2be6cbe00f80b7f53: [chore]: Bump github.com/jackc/pgx/v5 from 5.7.2 to 5.7.3 (#3935) (@dependabot[bot])
• a844f322eebec4ece384aedeb54b7276bccd1884: [chore]: Bump github.com/miekg/dns from 1.1.63 to 1.1.64 (#3936) (@dependabot[bot])
• f7e5f31c6bc9adbcc9620f7dbb1be1820e3e0be6: [chore]: Bump github.com/tdewolff/minify/v2 from 2.21.3 to 2.22.3 (#3933) (@dependabot[bot])
• 4af8d1a2cb98ca39191e709d18519bc438153e12: [chore]: Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 (#3927) (@dependabot[bot])
• f46e490c304d7cdc366542b2db98782be33271bf: [chore] bumps our spf13/viper version (#3943) (@NyaaaWhatsUpDoc)
• b0873972ecb6d9977a36898d8281649d38c17df7: [chore] bump golang.org/x/net@v0.38.0, github.com/gin-contrib/cors@v1.7.4, github.com/spf13/viper@v1.20.1, github.com/tdewolff/minify/v2@v2.22.4 (#3959) (@NyaaaWhatsUpDoc)
• db4b85715966ee590c6cdff5cc52e592b66e3d17: [chore] bump ncruces/go-sqlite3 to v0.25.0 (#3966) (@NyaaaWhatsUpDoc)
• 8ae2440da3a9b66c379c5a9444b50e758deef61b: [chore] Migrate accounts to new table, relax uniqueness constraint of actor url and collections (#3928) (@tsmethurst)
• 2cc5d6269d2ad3326c4ba4c6378fb0e9404646d0: [chore]: Bump codeberg.org/gruf/go-structr from 0.9.0 to 0.9.6 (#3973) (@dependabot[bot])
• 4232d617823bff8905672b86748adb2b2461fa9a: [chore]: Bump codeberg.org/gruf/go-mutexes from 1.5.1 to 1.5.2 (#3976) (@dependabot[bot])
• 920e20c2d2cff73d6dbdba108e19bc50261d3003: [chore]: Bump golang.org/x/crypto from 0.36.0 to 0.37.0 (#3975) (@dependabot[bot])
• e0ea77b7306b959525a0d5c015f4c69832ce9f01: [chore]: Bump github.com/tdewolff/minify/v2 from 2.22.4 to 2.23.0 (#3974) (@dependabot[bot])
• bce643286c6a136db47f2cf7bf3c4fa16a9d6a00: [chore]: Bump github.com/minio/minio-go/v7 from 7.0.85 to 7.0.89 (#3977) (@dependabot[bot])
• b1a4d54c14647827aaf3c8174e2896b12d0f9608: [chore] add IPPrefixes type so we don't need separate rate limit parsed field (#3982) (@NyaaaWhatsUpDoc)
• be9e307418fdd60273f3a202a75249cbdaf4b499: [chore] render avatar in photoswipe slide, remove repeated alt text (#3985) (@tsmethurst)
• eb4114bf1281e41b8ad8f560b7a28a3b7aeb3efc: [chore] Fix header insets (#3987) (@tsmethurst)
• 51b9ef5c346f333e558eca38fd954464322f3b7d: [chore]: Bump github.com/gin-contrib/gzip from 1.2.2 to 1.2.3 (#4000) (@dependabot[bot])
• 94963b0f240ee9a7a0a3e6898d3f9633de13948c: [chore]: Bump github.com/jackc/pgx/v5 from 5.7.3 to 5.7.4 (#4002) (@dependabot[bot])
• df5d8b42dad60d349dbe7326a3c9ba5bda54b53d: [chore]: Bump github.com/miekg/dns from 1.1.64 to 1.1.65 (#4001) (@dependabot[bot])
• f8d17a7e76d475e97580ef49fc076607d590bc27: [chore]: Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0 (#4003) (@dependabot[bot])
• a44065726c508c83fe75af1ae929b252a9046c49: [chore] Update + add fonts for additional scripts, use locally installed font if available (#3997) (@tsmethurst)
• 5b2fe1f9a0757b63dbc328c2493ad4bcfd5e7240: [chore/performance] Reuse Intl.DateTimeFormat for formatting times (#4013) (@tsmethurst)
• 2b98432ca2ea9a0f76c8564713b55c497926df31: [chore] Change "federating with" to "knows of" (#4014) (@tsmethurst)
• 0ce9bed3d170eae791d74b45525fe756315b664d: [chore/frontend] Fix id on recent posts/media heading (#4015) (@tsmethurst)
• 245d6db979531b89ccc266306c4929deb283c9b1: [chore/bugfix] fix import file on click (#4016) (@tsmethurst)
• d6946664362987dcdbe86315c0782a7a9b5400e4: [chore] Don't push latest Docker image on prerelease (#4017) (@tsmethurst)
• 2863561c8986c40f9f0d813e5b3ac6716ca070f4: [chore] Update robots.txt with latest ai bullshit (#4024) (@tsmethurst)
• d308fd0d0aa8779b0ed19a26b1825265205420ff: [chore] Little settings panel report view tweak (#4025) (@tsmethurst)
• 075cae3d55197b96d997d72cfb498c870788453a: [chore/frontend] Reorder JS a little bit to avoid visible text changes (#4039) (@tsmethurst)
• f170bbcd49411f9828b0ee55b16da9a1b698a2c2: [chore]: Bump github.com/yuin/goldmark from 1.7.8 to 1.7.10 (#4037) (@dependabot[bot])
• c670493ad9435f0ca7c62a56b950d59d6a9841aa: [chore]: Bump github.com/tdewolff/minify/v2 from 2.23.0 to 2.23.1 (#4036) (@dependabot[bot])
• 356c2adddc9c4f8efefdc0b59e5e790ce290a906: [chore]: Bump golang.org/x/oauth2 from 0.27.0 to 0.29.0 (#4035) (@dependabot[bot])
• d1abbd02906424f87b687ffde1f5ac8db457d7eb: [chore]: Bump github.com/gin-contrib/sessions from 1.0.2 to 1.0.3 (#4033) (@dependabot[bot])
• 355482baf645ede9796c04066b24fb200980359f: [chore]: Bump golang.org/x/net from 0.38.0 to 0.39.0 (#4034) (@dependabot[bot])
• 9241a0c337cbb992d1a65f42ae9e641b39902735: [chore/frontend] rejig server picker recommendations (#4042) (@tsmethurst)
• ab2044ef026878613e275b82e37f5dc0139073ac: [chore/frontend] Update skulk, caniuse (#4044) (@tsmethurst)

Documentation

• 1c049ba295fe27a513594264f50277aad91c0f9d: [docs] correct docker version format (#3832) (@elliotblackburn)
• 96d39155f25f0c39c43fec6a70069524b442d453: [docs] Fix swagger operation descriptions (#3830) (@mkljczk)
• 3db5bfa0f2d7528324c2fd6ae6d49d20da24eecf: [docs/zh] update zh docs: synced to 98c4cae + fix typo (#3884) (@cdn0x12)
• 6c5d369b05cf8eae86bcea5fdc85ebdd4dd2d901: [docs] Update swagger docs command (#3897) (@tsmethurst)
• 85fb63f46f7155f02ed2630f2301c0a1e59c6c59: [docs] Fix Swagger URL for the "edit status" operation (#3932) (@leonid-shevtsov)
• 0850a8f6466c2d1959b28740f6be913b2218ce8e: [docs] NLnet Grant Application - NGI Zero Commons 2025 (#3954) (@tsmethurst)
• 1e59795ff4ccc754a76025921ea60107964f5a8c: [docs] add instruction about postgres permission (#3981) (@heddxh)
• b51aa23458e52d9abfc50a40223ffa22ee372c17: [docs] add a command to know if the system is compatible with the standard builds (#3980) (@OniriCorpe)
• c803620531660428b0ac8057b105e3d34bb5c53c: [docs] Remind the user that password resets don't work without restarting. (#3998) (@technomancy)

Other

• d73acc70d5d7571e2171b6d57ea21adca0669e8e: Document importing posts (#3844) (@VyrCossont)
• 861b5cd920b861b9059391d6b388e20000550a48: bump our fork of modernc.org/sqlite to tag v1.36.0-concurrency-workaround (#3864) (@NyaaaWhatsUpDoc)
• 67a2b3650c5f586431c8559bc9b609699de8431d: bumps our uptrace/bun dependencies to v1.2.10 (#3865) (@NyaaaWhatsUpDoc)
• c80810eae80826cb3ac2db8a1ceaf0a33b25517f: bumps go-ffmpreg to v0.6.6 (#3866) (@NyaaaWhatsUpDoc)
• bad12a62e60bacf5222e39e26f7da97fdea23c15: bumps our uptrace/bun dependencies to v1.2.11 (#3895) (@NyaaaWhatsUpDoc)
• f30bb549aae20281e169d0e7eaf7d70730955f02: update go-structr to v0.9.0 with new Timeline{} cache type (#3903) (@NyaaaWhatsUpDoc)
• daf60f69a05c5c1a678dd9fd78e4724949e2f444: Bump @babel/helpers from 7.23.1 to 7.26.10 in /web/source (#3901) (@dependabot[bot])
• e7b46903183405e8af729b5eff1d703f1d4cd236: bumps modernc.org/sqlite to v1.36.1-concurrency-workaround (#3926) (@NyaaaWhatsUpDoc)
• 1bf40e755c897dfedcfa1b54a5598475b99099d4: feat: Relax URL matching (#3925) (@daenney)
• d49abd7bd79fd9a6e0ad10ca1544b309a9a81662: bump modernc.org/sqlite to v1.36.2-concurrency-workaround (#3945) (@NyaaaWhatsUpDoc)
• 13e7ac3e6a00de6b13532a4d3d73f52dd00a99e8: bump ffmpreg to v0.6.7 (#3947) (@NyaaaWhatsUpDoc)
• 9c31e213ca6592bde5656bc1d497166fdcae52c5: add a security.md stub, until (if) we determine a fancier security process :waves hands like a ghost: (#3955) (@NyaaaWhatsUpDoc)
• fdf23a91de791b813f65c244fd75e3262171f1b0: update modernc.org/sqlite to v1.37.0-concurrrency-workaround (#3958) (@NyaaaWhatsUpDoc)
• a07ca92752588adcb282144b75dc25fcc1db5cc2: don't panic on non-fully populated status edits, it may not always be possible (#4006) (@NyaaaWhatsUpDoc)
• 67fc1fd904c4227fbe187ad8dc962bab79cb5a3e: ensure 'none' gets included in serializable visibilities (#4007) (@NyaaaWhatsUpDoc)
• d6232663e38b441945defc5ec991257d07fc8025: Bump http-proxy-middleware from 2.0.7 to 2.0.9 in /web/source (#4041) (@dependabot[bot])