getfider/fider v0.39.0

on GitHub

TL;DR

Quite a lot going on here - security fixes worth upgrading for, some bugs new and old sorted, and some new stuff - an option to disable sign-up, and some UI improvements :)

Upgrade notes

• LOG_SQL now defaults to false (#1688). Fider no longer writes every log entry to the logs table, which was never pruned and could grow to many GB. Console logging is unchanged. If you read logs from the database, set LOG_SQL=true. To reclaim the space on an existing install, run TRUNCATE logs; once.
• Node 24 (#1640). The Docker image and CI now build with Node 24 LTS. This only matters if you build Fider from source.
• A database migration runs automatically on start-up (it adds the sign-up setting below).

Security

• GHSA-f9m2-vm33-7hvh: a blocked administrator's API key still worked when combined with the X-Fider-UserID impersonation header (#1751)
• OAuth sign-in rejects redirect targets that start with several slashes (#1737)
• DOMPurify updated to 3.4.17 (#1743)

Thanks to @wyx200612 for reporting this responsibly.

New

• Disable sign-ups (#1732): a new toggle under Site Settings > Privacy stops visitors creating their own accounts, so a public board can be invite-only. Trusted OAuth providers can still create accounts. Thanks @kevinpapst.
• Post actions have moved into a 3-dot menu at the top of the post (#1725)
• The members menu lists every user level (Administrator, Collaborator, Trusted member, Member, Blocked) and you can move a user between any of them. The API roles filter also accepts member, trusted and blocked (#1726)

Fixes

• Fider stops responding (#1744, fixes #1042): the SQL blob storage opened a second database connection for every image request, so a few concurrent image requests could use up the connection pool and hang every request after that. Thanks @kevinpapst for tracking this one down.
• Mobile layout fixes for posts, comments, modals and sign-in (#1720)
• Browsers can autofill email and name fields (#1722)
• Deleting a post removes its web notifications (#1723)
• Visitors get mention notifications by default (#1730, thanks @pvarshh)
• Page descriptions no longer show HTML entities such as & (#1734, thanks @sap1110)
• Declining a post takes you back to the home page instead of a 404 (#1746, thanks @kevinpapst)
• Improved Chinese (zh-CN) translations (#1485, thanks @qiujiejun)

Plus dependency, build and CI housekeeping (#1715, #1724, #1727, #1728, #1731, #1745, #1749, #1750, #1752).

Full Changelog: v0.38.2...v0.39.0