superseriousbusiness/gotosocial v0.19.0-rc3

on Codeberg

Third and hopefully final release candidate for v0.19.0!

Please read the migration notes carefully for instructions on how to upgrade to this version.

For instructions to update to this release candidate from versions < v0.19.0-rc1, see the v0.19.0-rc1 release candidate notes, but replace v0.19.0-rc1 with v0.19.0-rc3 throughout.

Release highlights

Compared to rc2:

• Bump some dependency versions.
• Reorder javascript a bit.
• Fix a bug with importing domain permissions.

Migration notes

Upgrading

To upgrade to v0.19.0-rc3 from a previous release:

Binary/tar

1. Stop GoToSocial.
2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup.
3. Download and untar the new release, including the web assets and html templates.
4. Edit your config.yaml file if necessary (see below).
5. Start GoToSocial.
6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
7. Enjoy your updated instance.

Docker

1. Stop GoToSocial.
2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup.
3. Pull the new docker container (superseriousbusiness/gotosocial:0.19.0-rc3 or superseriousbusiness/gotosocial:latest)
4. Edit your config.yaml file or environment variables if necessary (see below).
5. Start GoToSocial.
6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
7. Enjoy your updated instance.

config.yaml

No changes since v0.19.0-rc1.

Database Migrations

None since v0.19.0-rc1.

Which release archive/container should I use?

GoToSocial releases binary builds for 64-bit Linux, FreeBSD, and NetBSD operating systems. We also release Docker builds for 64-bit Linux.

nowasm

For your convenience, we also provide UNSUPPORTED, EXPERIMENTAL BUILDS, created using the nowasm tag, in the downloads list below. There is no Docker build for nowasm.

GoToSocial releases built with nowasm use the Go-native, modernc version of SQLite instead of the WASM one, and will use on-system ffmpeg and ffprobe binaries for media processing.

Using a nowasm build is currently the only way to run GoToSocial on a 32-bit system.

For more information on running a nowasm build, see the nowasm documentation page.

Changelog

Features and performance

• eb720241da3d786c6ec79f2325277fa4af23846f: [feature] Enforce OAuth token scopes (#3835) (@tsmethurst)
• 46862171e0b7c9ad088157f385b07c092cd4ac05: [feature] Added an extra CSS class name to the About This Instance and Register an Account sections in the root index template to allow for easier targeting with custom CSS. (#3843) (@VirtualWolf)
• 0118e03cdaae5a378d6995cd1a49411a1132b8d7: [feature] Implement CSV import for mutes (#3696) (@xvello)
• b4bb97225e7dd8906484b09b4f736395e779eead: [feature/frontend] use localized time string in status & poll info page (#3821) (@cdn0x12)
• e78e817057e01ce0cd2e3d532e4ca9ded8b88b73: [feature] add microformat support (#3848) (@AnInternetTroll)
• 1b37944f8b8eccc2afcfb0f603786209a3b7402d: [feature] Refactor tokens, allow multiple app redirect_uris (#3849) (@tsmethurst)
• 829143d2636d4c0d274bf2ab4559912f472a2bc4: [feature] Add token review / delete to backend + settings panel (#3845) (@tsmethurst)
• d8113c11e4d84a6d04d56b58d337c235154a535b: [feature] Parse content warning to HTML, serialize via client API as plaintext (#3876) (@tsmethurst)
• 0c72282559fffa06e533de9eed375c9130c0e7a3: [performance] Optimize local timeline + local status count queries (#3892) (@tsmethurst)
• d3c3d34aaee220f1d3a9ba7bd8d0f9dc5e9c6b79: [feature/frontend] Add visibility icon for posts (#3908) (@tsmethurst)
• d5847e2d2b68a1eb41d43be170cd4ddff9003cff: [feature] Application creation + management via API + settings panel (#3906) (@tsmethurst)
• 59aac290e4ae8454ef8589b3f6a0442f2fdfeb90: [performance] reindex public timeline + tinker with query a bit (#3918) (@tsmethurst)
• 27171a78ded38a7142aecfcaa75ede86f73b7a5b: [feature] Parse funkwhale Album as Statusable to allow barebones interacting with bandwagon (#3931) (@tsmethurst)
• b6e481d63eec15191f2717957682c13ee8a68308: [feature] Allow user to choose "gallery" style layout for web view of profile (#3917) (@tsmethurst)
• 3949117be01ac8aca7e41a7179506f27627654e5: [feature] Use blurhashes in frontend, tidy up gallery view a bit (#3948) (@tsmethurst)
• b1844323314dd1f0832f1fcdb765a7f67ca01dbc: [feature] Allow editing domain blocks/allows, fix comment import (#3967) (@tsmethurst)
• 650be1e8d0a805ab41ea9ce599023b87fffa18a3: [feature] Allow deleting avatar + header via settings panel (#3970) (@tsmethurst)
• 365b5753419238bb96bc3f9b744d380ff20cbafc: [feature] add TOTP two-factor authentication (2FA) (#3960) (@tsmethurst)
• e032c959e13bc276d8517a51857e1c772c151f95: [feature] Implement /oauth/revoke for token revocation (#3983) (@tsmethurst)
• 6ff0d3355c487dbdc13403ec32f5e587c7f93073: [feature/frontend] Add visibility icon for posts (#4005) (@tsmethurst)
• 2fce02780876d5e4c4f32e0ca341c43a5d8b21a8: [feature/frontend] Hide "engagement" stats, edits, and other info under a little drop down to unclutter status info bar (#4021) (@tsmethurst)
• a87be80c902d947fe1737c5e5e82d69a8a132273: [feature/frontend] add autocomplete + other helpful attributes to auth html pages (#4029) (@tsmethurst)

Bug fixes

• 24da574684b965e2f98a04eae795cc70eff22c39: [bugfix] fix refreshed additional media info being ignored (#3867) (@NyaaaWhatsUpDoc)
• ab7ec43988c1e7e33d24dea351e34f1b4bdcd0c1: [bugfix] Fix app migration (#3868) (@tsmethurst)
• 69461c461b79dbeb9b55ba83d2b7308772194d7f: [bugfix] Return useful err on server start failure (#3879) (@tsmethurst)
• 424f62dd70d765673e7cacd5373728ba4762496b: [bugfix] Store and expose status content type (#3870) (@ewwwin)
• 35e94c8abd3767eb44620cdf7246ba04f9d9252c: [bugfix] Fix length for type varchar must be at least 1 on Postgres (#3885) (@tsmethurst)
• 0c49d5abb8c753f1c7e3628a9363c31589ad5de0: [bugfix] Fix panic when opening instance actor in web view (#3898) (@tsmethurst)
• 657e064bf6d619d836825c0ad56bb791875d102a: [bugfix] Avoid nil ptr if maintenance router can't be started (#3919) (@tsmethurst)
• cecb1fd00955ab8670d3099f016eeaa5af663dc5: [bugfix] Fix set obfuscate = null error in adoptPerm (#3922) (@tsmethurst)
• 57c5f68e1a6182c0fa476359742d15182f0a95cb: [bugfix] Fix update users query in migration (#3963) (@tsmethurst)
• 6473886c8e4c713a6f5686e289985a0ebf3e9a82: [bugfix] Fix Atkinson Hyperlegible font embedding on Ecks Pee theme. (#3964) (@kvibber)
• e263d236223defbbdf9762cca57720da1d77c3ca: [bugfix] Change email Date header to use RFC2822 (#3972) (@tsmethurst)
• 6f24205a26bde03e73055fd7af369352103c390f: [bugfix] Don't assume "manuallyApprovesFollowers": true if not set (#3978) (@tsmethurst)
• 19cfa8d126a2ff54298150529e58e5e4f5495f09: [bugfix] Fix a couple accessibility issues with :focus elements (#3979) (@tsmethurst)
• c8a780e12a8112a4d4cbe8ed72d241a382f73903: [bugfix] Fix setting bot on/off (#3986) (@tsmethurst)
• 36758ea0de6a7ce7b94d5db561fa1d81f37b96d0: [bugfix] media v2 endpoint fix unset url (#4008) (@NyaaaWhatsUpDoc)
• f5ce219844e0c6e80b1f1dfbbce1f96a6251448d: [bugfix] websocket header token not always returned (#4009) (@NyaaaWhatsUpDoc)
• b510f3c539fb6c71ffba6f32974193d6fb035165: [bugfix/frontend] Fix photoswipe layout issues, keyboard shortcuts (#4010) (@tsmethurst)
• 14899733c8c5962a8b4ed5c13836f86a34bd29a0: [bugfix] new token API issues (#4022) (@NyaaaWhatsUpDoc)
• e9f6d186dc947863a5dfc18c8d6f2016b8030c88: [bugfix] Fix '+'-separated scopes not being recognized (#4028) (@tsmethurst)
• 0992ffc0571561f354e05c8f12784cbb5c00ccc8: [bugfix] Use util.IsNil for checking DomainPermission (#4040) (@tsmethurst)

Chores & version bumps

• d8f96f81d645fe313f8759a4bf540ff5b0ed0644: [chore] Fix typo in common.tsx (#3834) (@PrivacyDragon)
• d2cf9de726c4b8b45a4b17f244e5e00f57f88c16: [chore]: Bump github.com/tetratelabs/wazero from 1.8.2 to 1.9.0 (#3827) (@dependabot[bot])
• e1ec904dd34ec4e40f35cb3b7bb02b28acc9150b: [chore]: Bump github.com/google/go-cmp from 0.6.0 to 0.7.0 (#3826) (@dependabot[bot])
• f734a94c1ca9bb732b2ae818098b48794e374c8a: [chore]: Bump golang.org/x/crypto from 0.33.0 to 0.34.0 (#3824) (@dependabot[bot])
• 8bc502ba6257158ff8f6eee1a2d9158c099dd6f3: [chore] Update KimMachineGun/automemlimit (#3841) (@tsmethurst)
• 1f38b7b48f26919451dcf9444165086d913b9108: [chore] Remove duplicate swagger docs build in Dockerfile (#3842) (@tsmethurst)
• a7485ae251af6c9cf930f2a4aefd02a11c710599: [chore]: Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 (#3831) (@dependabot[bot])
• 4c9901fc035ece13b2dbaca21465a534abb77a04: [chore] little frontend tweaks (#3852) (@tsmethurst)
• e2e185d10bdaaba85996069e9621963ad4d6f565: [chore] github.com/superseriousbusiness/activity -> codeberg.org/superseriousbusiness/activity (#3853) (@tsmethurst)
• 5d0e3d9c354906409a514b437d70f7a9db90703a: [chore] github.com/superseriousbusiness/httpsig -> codeberg.org/superseriousbusiness/httpsig (#3854) (@tsmethurst)
• d8bb1c391b06050d0cbde554d7ba2366384f2c7d: [chore] Update exif terminator version with codeberg libraries (#3855) (@tsmethurst)
• 49c12636c61f97ae2417a59a6f6fd5c0dd5ff8df: [chore] go-swagger -> codeberg (#3856) (@tsmethurst)
• 8488ac928651656c6f7bebf5eaabce62c2b9fb66: [chore] migrate oauth2 -> codeberg (#3857) (@tsmethurst)
• 0e2e8e54ab85889d3c42cf8b0744c3253065983b: [chore]: Bump github.com/ncruces/go-sqlite3 from 0.23.0 to 0.24.0 (#3862) (@dependabot[bot])
• ddd9210614fe377612fba9547af33dc677e7bca0: [chore]: Bump github.com/prometheus/client_golang from 1.20.5 to 1.21.0 (#3860) (@dependabot[bot])
• ee60732cf7ee64f0bc82095fd271d1ba34cd3eec: [chore] fixed email template to align with the new "Log in" button + separate page (#3871) (@wolfyjade)
• 98c4cae89ac6a6c24c3580d3cead31ac43376114: [chore] update links in CONTRIBUTING.md (#3881) (@cdn0x12)
• 719c92529996e72939d1886e93d96288591f4d8e: [chore]: Bump golang.org/x/crypto from 0.35.0 to 0.36.0 (#3887) (@dependabot[bot])
• 85e17b3e788ac19d8c1da7cd2d78208b11e3eea2: [chore]: Bump github.com/prometheus/client_golang from 1.21.0 to 1.21.1 (#3890) (@dependabot[bot])
• 252a17a691a316af8a1b0d960436c32257b4f66b: [chore]: Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (#3888) (@dependabot[bot])
• 95f88e5d939218b038ab8d0dd6776120aee53ceb: [chore] add warning message when wazero compiler not supported (#3894) (@NyaaaWhatsUpDoc)
• da462afce2f1ef66f866752c8f7b775a646a6beb: [chore]: Bump golang.org/x/net from 0.35.0 to 0.36.0 (#3905) (@dependabot[bot])
• 85ee7cca4721a97ea1763890e4d3d7b083deb163: [chore] Tweak "nothing here!" message (#3907) (@tsmethurst)
• 808031ca01be890a877214a71493a4dc3d24c2b4: [chore] Add extra org.opencontainers.image labels to docker build (#3930) (@tsmethurst)
• a2caa5fdbb2f610530ab1303c7376950b1a54080: [chore]: Bump golang.org/x/net from 0.36.0 to 0.37.0 (#3934) (@dependabot[bot])
• 18c8f85a3032fcc091b4c9e2be6cbe00f80b7f53: [chore]: Bump github.com/jackc/pgx/v5 from 5.7.2 to 5.7.3 (#3935) (@dependabot[bot])
• a844f322eebec4ece384aedeb54b7276bccd1884: [chore]: Bump github.com/miekg/dns from 1.1.63 to 1.1.64 (#3936) (@dependabot[bot])
• f7e5f31c6bc9adbcc9620f7dbb1be1820e3e0be6: [chore]: Bump github.com/tdewolff/minify/v2 from 2.21.3 to 2.22.3 (#3933) (@dependabot[bot])
• 4af8d1a2cb98ca39191e709d18519bc438153e12: [chore]: Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 (#3927) (@dependabot[bot])
• f46e490c304d7cdc366542b2db98782be33271bf: [chore] bumps our spf13/viper version (#3943) (@NyaaaWhatsUpDoc)
• b0873972ecb6d9977a36898d8281649d38c17df7: [chore] bump golang.org/x/net@v0.38.0, github.com/gin-contrib/cors@v1.7.4, github.com/spf13/viper@v1.20.1, github.com/tdewolff/minify/v2@v2.22.4 (#3959) (@NyaaaWhatsUpDoc)
• db4b85715966ee590c6cdff5cc52e592b66e3d17: [chore] bump ncruces/go-sqlite3 to v0.25.0 (#3966) (@NyaaaWhatsUpDoc)
• 8ae2440da3a9b66c379c5a9444b50e758deef61b: [chore] Migrate accounts to new table, relax uniqueness constraint of actor url and collections (#3928) (@tsmethurst)
• 2cc5d6269d2ad3326c4ba4c6378fb0e9404646d0: [chore]: Bump codeberg.org/gruf/go-structr from 0.9.0 to 0.9.6 (#3973) (@dependabot[bot])
• 4232d617823bff8905672b86748adb2b2461fa9a: [chore]: Bump codeberg.org/gruf/go-mutexes from 1.5.1 to 1.5.2 (#3976) (@dependabot[bot])
• 920e20c2d2cff73d6dbdba108e19bc50261d3003: [chore]: Bump golang.org/x/crypto from 0.36.0 to 0.37.0 (#3975) (@dependabot[bot])
• e0ea77b7306b959525a0d5c015f4c69832ce9f01: [chore]: Bump github.com/tdewolff/minify/v2 from 2.22.4 to 2.23.0 (#3974) (@dependabot[bot])
• bce643286c6a136db47f2cf7bf3c4fa16a9d6a00: [chore]: Bump github.com/minio/minio-go/v7 from 7.0.85 to 7.0.89 (#3977) (@dependabot[bot])
• b1a4d54c14647827aaf3c8174e2896b12d0f9608: [chore] add IPPrefixes type so we don't need separate rate limit parsed field (#3982) (@NyaaaWhatsUpDoc)
• be9e307418fdd60273f3a202a75249cbdaf4b499: [chore] render avatar in photoswipe slide, remove repeated alt text (#3985) (@tsmethurst)
• eb4114bf1281e41b8ad8f560b7a28a3b7aeb3efc: [chore] Fix header insets (#3987) (@tsmethurst)
• 51b9ef5c346f333e558eca38fd954464322f3b7d: [chore]: Bump github.com/gin-contrib/gzip from 1.2.2 to 1.2.3 (#4000) (@dependabot[bot])
• 94963b0f240ee9a7a0a3e6898d3f9633de13948c: [chore]: Bump github.com/jackc/pgx/v5 from 5.7.3 to 5.7.4 (#4002) (@dependabot[bot])
• df5d8b42dad60d349dbe7326a3c9ba5bda54b53d: [chore]: Bump github.com/miekg/dns from 1.1.64 to 1.1.65 (#4001) (@dependabot[bot])
• f8d17a7e76d475e97580ef49fc076607d590bc27: [chore]: Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0 (#4003) (@dependabot[bot])
• a44065726c508c83fe75af1ae929b252a9046c49: [chore] Update + add fonts for additional scripts, use locally installed font if available (#3997) (@tsmethurst)
• 5b2fe1f9a0757b63dbc328c2493ad4bcfd5e7240: [chore/performance] Reuse Intl.DateTimeFormat for formatting times (#4013) (@tsmethurst)
• 2b98432ca2ea9a0f76c8564713b55c497926df31: [chore] Change "federating with" to "knows of" (#4014) (@tsmethurst)
• 0ce9bed3d170eae791d74b45525fe756315b664d: [chore/frontend] Fix id on recent posts/media heading (#4015) (@tsmethurst)
• 245d6db979531b89ccc266306c4929deb283c9b1: [chore/bugfix] fix import file on click (#4016) (@tsmethurst)
• d6946664362987dcdbe86315c0782a7a9b5400e4: [chore] Don't push latest Docker image on prerelease (#4017) (@tsmethurst)
• 2863561c8986c40f9f0d813e5b3ac6716ca070f4: [chore] Update robots.txt with latest ai bullshit (#4024) (@tsmethurst)
• d308fd0d0aa8779b0ed19a26b1825265205420ff: [chore] Little settings panel report view tweak (#4025) (@tsmethurst)
• 075cae3d55197b96d997d72cfb498c870788453a: [chore/frontend] Reorder JS a little bit to avoid visible text changes (#4039) (@tsmethurst)
• f170bbcd49411f9828b0ee55b16da9a1b698a2c2: [chore]: Bump github.com/yuin/goldmark from 1.7.8 to 1.7.10 (#4037) (@dependabot[bot])
• c670493ad9435f0ca7c62a56b950d59d6a9841aa: [chore]: Bump github.com/tdewolff/minify/v2 from 2.23.0 to 2.23.1 (#4036) (@dependabot[bot])
• 356c2adddc9c4f8efefdc0b59e5e790ce290a906: [chore]: Bump golang.org/x/oauth2 from 0.27.0 to 0.29.0 (#4035) (@dependabot[bot])
• d1abbd02906424f87b687ffde1f5ac8db457d7eb: [chore]: Bump github.com/gin-contrib/sessions from 1.0.2 to 1.0.3 (#4033) (@dependabot[bot])
• 355482baf645ede9796c04066b24fb200980359f: [chore]: Bump golang.org/x/net from 0.38.0 to 0.39.0 (#4034) (@dependabot[bot])

Documentation

• 1c049ba295fe27a513594264f50277aad91c0f9d: [docs] correct docker version format (#3832) (@elliotblackburn)
• 96d39155f25f0c39c43fec6a70069524b442d453: [docs] Fix swagger operation descriptions (#3830) (@mkljczk)
• 3db5bfa0f2d7528324c2fd6ae6d49d20da24eecf: [docs/zh] update zh docs: synced to 98c4cae + fix typo (#3884) (@cdn0x12)
• 6c5d369b05cf8eae86bcea5fdc85ebdd4dd2d901: [docs] Update swagger docs command (#3897) (@tsmethurst)
• 85fb63f46f7155f02ed2630f2301c0a1e59c6c59: [docs] Fix Swagger URL for the "edit status" operation (#3932) (@leonid-shevtsov)
• 0850a8f6466c2d1959b28740f6be913b2218ce8e: [docs] NLnet Grant Application - NGI Zero Commons 2025 (#3954) (@tsmethurst)
• 1e59795ff4ccc754a76025921ea60107964f5a8c: [docs] add instruction about postgres permission (#3981) (@heddxh)
• b51aa23458e52d9abfc50a40223ffa22ee372c17: [docs] add a command to know if the system is compatible with the standard builds (#3980) (@OniriCorpe)
• c803620531660428b0ac8057b105e3d34bb5c53c: [docs] Remind the user that password resets don't work without restarting. (#3998) (@technomancy)

Other

• d73acc70d5d7571e2171b6d57ea21adca0669e8e: Document importing posts (#3844) (@VyrCossont)
• 861b5cd920b861b9059391d6b388e20000550a48: bump our fork of modernc.org/sqlite to tag v1.36.0-concurrency-workaround (#3864) (@NyaaaWhatsUpDoc)
• 67a2b3650c5f586431c8559bc9b609699de8431d: bumps our uptrace/bun dependencies to v1.2.10 (#3865) (@NyaaaWhatsUpDoc)
• c80810eae80826cb3ac2db8a1ceaf0a33b25517f: bumps go-ffmpreg to v0.6.6 (#3866) (@NyaaaWhatsUpDoc)
• bad12a62e60bacf5222e39e26f7da97fdea23c15: bumps our uptrace/bun dependencies to v1.2.11 (#3895) (@NyaaaWhatsUpDoc)
• f30bb549aae20281e169d0e7eaf7d70730955f02: update go-structr to v0.9.0 with new Timeline{} cache type (#3903) (@NyaaaWhatsUpDoc)
• daf60f69a05c5c1a678dd9fd78e4724949e2f444: Bump @babel/helpers from 7.23.1 to 7.26.10 in /web/source (#3901) (@dependabot[bot])
• e7b46903183405e8af729b5eff1d703f1d4cd236: bumps modernc.org/sqlite to v1.36.1-concurrency-workaround (#3926) (@NyaaaWhatsUpDoc)
• 1bf40e755c897dfedcfa1b54a5598475b99099d4: feat: Relax URL matching (#3925) (@daenney)
• d49abd7bd79fd9a6e0ad10ca1544b309a9a81662: bump modernc.org/sqlite to v1.36.2-concurrency-workaround (#3945) (@NyaaaWhatsUpDoc)
• 13e7ac3e6a00de6b13532a4d3d73f52dd00a99e8: bump ffmpreg to v0.6.7 (#3947) (@NyaaaWhatsUpDoc)
• 9c31e213ca6592bde5656bc1d497166fdcae52c5: add a security.md stub, until (if) we determine a fancier security process :waves hands like a ghost: (#3955) (@NyaaaWhatsUpDoc)
• fdf23a91de791b813f65c244fd75e3262171f1b0: update modernc.org/sqlite to v1.37.0-concurrrency-workaround (#3958) (@NyaaaWhatsUpDoc)
• a07ca92752588adcb282144b75dc25fcc1db5cc2: don't panic on non-fully populated status edits, it may not always be possible (#4006) (@NyaaaWhatsUpDoc)
• 67fc1fd904c4227fbe187ad8dc962bab79cb5a3e: ensure 'none' gets included in serializable visibilities (#4007) (@NyaaaWhatsUpDoc)
• d6232663e38b441945defc5ec991257d07fc8025: Bump http-proxy-middleware from 2.0.7 to 2.0.9 in /web/source (#4041) (@dependabot[bot])