0.21.2

Breaking Changes

• The sample Compose configuration now binds PocketBase to 127.0.0.1:8090 and requires an explicit POCKETBASE_PROXY_SECRET shared by db and web. Update existing deployments to use the same local port binding. Replace a copied dev-proxy-secret-change-me value with your own random secret, for example with openssl rand -hex 32; the dashboard remains available through an SSH tunnel. The web interface and mobile app do not need port 8090.
• The sample web configuration now defaults to BODY_SIZE_LIMIT=2G, allowing a trail, summit log or waypoint to upload up to 99 default-sized photos in one request. This variable also controls the multipart upload limit; increase it when raising collection file limits. Existing Infinity settings allow uploads of any size after sign-in. The provided image starts through server.js, which uses 2G when the variable is unset; invalid values produce a warning and also use 2G at startup. Upload routes check authentication before reading or parsing the body. Other route limits remain 64 KiB for login, 2 MiB for ActivityPub inboxes and 1 MiB for ordinary requests. Configure reverse-proxy limits accordingly.

Security

• ActivityPub and remote data processing apply additional validation and resource limits.
• Updated ActivityPub content handling. (GHSA-fprh-3pp9-68m9, thanks @zer0d4y5)
• Updated remote attachment handling. (GHSA-j9m4-8qwf-jvx6, thanks @zaara2004)
• Updated remote file retrieval. (GHSA-3xp7-7492-j2q6, thanks @zaara2004)
• Remote ActivityPub deliveries use public inbox addresses. (GHSA-vprp-gr6m-j375)

Federation

• Incoming ActivityPub deliveries are only accepted with a signed body digest and a current signature date, as Mastodon requires. Deliveries from servers whose clock is off by more than an hour are rejected.
• Accounts registered before an ORIGIN hostname or port change cannot publish new federated content to updated peers. Changing only http to https remains supported.
• Trails and lists continue to synchronize with peers older than v0.20.0. Comments and summit logs from v0.19 peers are imported through their individual endpoints.
• Replies from other ActivityPub software are imported only when publicly addressed and available without a signed request. Reply object retrieval is capped at 30 per refresh, 256 KiB per object and 2 MiB over 10 seconds, with 2 seconds per request.
• Remote account deletions are applied once the account's origin confirms deletion with HTTP 410, or with HTTP 404 for wanderer accounts whose deletion is signed with their pre-upgrade key. Temporary origin errors leave the cached account in place.
• If a delivery is rejected shortly after upgrading, repeat the action on the sending instance. Existing wanderer senders do not retry rejected activities automatically.
• Trails in a remote list that are hosted on a third instance are loaded from that instance, up to 30 at a time; longer lists fill in with later refreshes. Trails that instance does not serve publicly are omitted, and trails it cannot serve at the moment appear once it responds again.
• Summit log entries, comments and trails in remote lists from accounts on other instances appear with a later refresh when a refresh cannot confirm them within its fetch limits.
• Activities between accounts on the same instance are delivered internally.
• Remote deliveries go only to public inbox addresses, do not follow redirects, and do not use HTTP_PROXY or HTTPS_PROXY.
• Incoming attachments are fetched only from public addresses, with a 30-second deadline per file. GPX and avatars default to 5 MiB and photos to 20 MiB; downloads follow the configured collection file limits.
• Loading remote content: New trails and lists from other instances load with limited parallelism. Many slow instances can delay the first view or cause it to fail temporarily; previously completed copies remain readable. Remote lists load up to about 1,000 trails. Documents are limited to 32 MiB and 1,000,000 JSON tokens. Larger content shows a message and a link to view it on its original instance.
• File downloads share a 30-second, 64 MiB budget per sync; metadata and completed files are retained, and later refreshes fill missing files. Concurrent refreshes are limited and child records are written in short batches. Previously completed copies remain readable when a refresh fails.
• Replies to this instance's own trails that were delivered directly to it before this update remain visible until removed, including replies that are not public at their origin.