SECURITY
- Fix P2P segment validator to correctly reject invalid chunks
- Forbid embed for videos with embed restrictions if the referer header is not set
- Redact OAuth tokens in debug logs
- Add max depth when fixing ActivityPub object
Bug fixes
- Fix iOS mobile link for channels
- Fix input placeholder font size
- Correctly remove a private video linked to an abuse
- Do not validate search filters on "Enter" press in tag inputs
- Improve client notification if the backend returns a 502 HTTP error
- Fix various UI bugs/inconsistencies on RTL layout
- Fix watching password protected live
- Fix password submit button theme in embed
- Fix "Invalid width to find appropriate image" error in embed
- Fix responsive embed in custom markup (used to build the instance homepage)
- Prevent serving invalid segment JSON file for lives
- Fix broken control bar when hovering the progress bar on small players
- Correctly detect unlisted privacy from remote objects
- Abort request on invalid HTTP digest
- Correctly take into account
count: 0in SQL requests - Hide live scheduled date for past dates
- Fix infinite loop with S3 pagination
- Correctly dedupe refresh remote objects jobs
- Do not run scheduled jobs more than needed
- Consume all job attempts before throwing an error for move to object storage/file system job
- More robust live ending handler
- Fix TOCTOU race when starting a live session
- More precise live quota exceeded checker
- Fix live cleanup race issue
- Correctly cleanup tmp directory when handling runner job files
- Fix stalled request when rejecting auth for socket endpoints
- Fix non-settled promise in video download endpoint when the user closes the stream
- Correctly match plugin websocket routes
- Don't crash video import if youtube-dl doesn't return a date
- Correctly extract mentions followed by a punctuation/newline