TL;DR
A security fix worth upgrading for if you use Google sign-in, plus a redesigned authentication settings page and a handful of fixes.
Security
- GHSA-mxx8-x4p9-c9c5: Google sign-in accepted unverified email addresses, which could link an attacker's Google account to an existing Fider account with the same email (#1765)
Thanks to @akash111-hue for reporting this responsibly.
New
- Authentication settings (#1758): email and the built-in OAuth providers now sit in one list with on/off switches, custom providers have their own section, and the custom provider form is tidier (role settings are under "Advanced").
Fixes
- GitHub sign-in without an email (#1765, fixes #1761): if a GitHub user keeps their email private, Fider now fetches their primary verified address. Existing users with no email get it filled in on their next sign-in. Thanks @kevinpapst for reporting.
- With content moderation on, pending posts and comments now only notify staff. Everyone else is notified, and webhooks fire, once the item is approved (#1762)
- The ping healthcheck sends the
BASE_URLhostname as SNI, so it works behind TLS proxies that route by hostname (#1754, thanks @sap1110) - Hosted billing: Stripe subscriptions stay in sync with tenants (#1760)
Plus dependency, build and CI housekeeping (#1747).
Full Changelog: v0.39.0...v0.40.0