This release is all about security! We've been through a big list of security issues that have been identified and fixed them. We've also upgraded the security of ActivityPub federation with RFC9421 signing and verification. Hopefully though, you won't notice any of that, because it's all behind the scenes!
There's one visible thing if you have a recent Prusa printer; you should be able to now use it via the modern API - before, we only had support for the legacy API.
What's Changed
✨ New Features ✨
- RFC9421 HTTP signature/verification via Fedipub by @Floppy in #7118
- Print via new prusalink api by @samuel-sarmah in #7157
🔒 Security 🔒
- Prevent moderators from editing administrators' user settings (including setting password) by @Floppy in #7119
- Correctly sanitize markdown to remove unsafe HTML output by @Floppy in #7120
- Fix possible conversion of unauthorized files by @Floppy in #7121
- Fix sending out of user invitations before group permissions check by @Floppy in #7122
- Prevent moderators from managing administrator's OAuth applications/tokens by @Floppy in #7127
- Apply complete sandboxing to files displayed in frames, including HTML by @Floppy in #7128
- Fix OAuth privilege escalation by @Floppy in #7129
- Require user authentication for new follow page by @Floppy in #7131
- Add proper permission checks to all associations in form deserializers by @Floppy in #7150
🐛 Bug Fixes 🐛
- Upgrade activity records to work with Fedipub name change by @Floppy in #7091
- Fix occasional sync errors from MyMiniFactory by @Floppy in #7156
🌍 Internationalization 🌏
🛠️ Other Improvements 🛠️
- Add tests for report creation permissions by @Floppy in #7132
- Add note about CVE fishing bans in security file by @Floppy in #7149
New Contributors
- @samuel-sarmah made their first contribution in #7157
Full Changelog: v0.149.0...v0.150.0