What's Changed
- Harden message content filtering + bump thruster to 0.1.23 by @jeremy in #237
- feat: Add bot API endpoints for reading messages and adding reactions by @jpshackelford in #190
- Allow bots to update and destroy their own messages by @ronaldlokers in #239
- Allow bots to delete their own boosts by @monorkin in #242
- Bump json from 2.20.0 to 2.21.2 by @dependabot[bot] in #238
- dep: update sqlite3 to 2.9.6 by @flavorjones in #243
- Update mail to 2.9.1 for GHSA-mvxr-6m87-mv2q by @jeremy in #248
- Bump brakeman to 8.0.6 and stop --ensure-latest reddening CI by @jeremy in #249
- Take the SSRF address policy from surfguard instead of keeping our own copy by @jeremy in #241
- Bump actionlint and zizmor-action to current releases by @jeremy in #250
- Fix the dependabot.yml validation error that has kept version updates from ever running by @jeremy in #251
- Retire the inert docker updater, bump setup-ruby, and put every Ruby pin on 3.4.10 by @jeremy in #258
- build(deps): bump the github-actions group across 1 directory with 7 updates by @dependabot[bot] in #259
- Guard push-subscription endpoints against SSRF by @jeremy in #265
- Require authentication for Active Storage direct uploads by @jeremy in #267
- Close live Action Cable connections on sign out by @jeremy in #268
- Redact bot key from request logs by @jeremy in #269
- Escape the OpenGraph image URL in link previews by @rosa in #274
- Test that a markup-only OpenGraph title or description produces no link preview by @rosa in #275
- Render link previews only from web URLs by @rosa in #276
- Mint the tampered sgid without extending a Room by @rubys in #279
- build(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 in the github-actions group by @dependabot[bot] in #277
- Bump surfguard to the published 0.2.0 by @jeremy in #271
- Keep .claude out of the Docker build context by @jeremy in #266
- Mint the tampered attachable sgid without extending a Room by @rubys in #280
- Support Redis configuration with REDIS_URL env var by @excid3 in #262
- build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #281
- build(deps-dev): bump rubyzip from 3.0.2 to 3.4.0 by @dependabot[bot] in #282
- Replace Trix with Lexxy by @monorkin in #224
- build(deps-dev): bump mocha from 2.7.1 to 3.1.0 by @dependabot[bot] in #257
- build(deps): bump web-push from 3.0.2 to 3.1.0 by @dependabot[bot] in #254
- Keep an unsent message as a draft while switching rooms by @monorkin in #283
New Contributors
- @jpshackelford made their first contribution in #190
- @ronaldlokers made their first contribution in #239
- @rubys made their first contribution in #279
- @excid3 made their first contribution in #262
Full Changelog: v1.4.9...v1.5.0