Merge pull request #2279 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes
Merge branch 'main' into glitch-soc/merge-upstream
Conflicts:
- `.github/workflows/build-image.yml`:
Upstream attempted something with tags.
Kept our version.
Bump version to v4.1.4 (#25805)
Tag images with the latest tag only when running against the latest stable branch (#25803)
Fix crash in admin interface when viewing a remote user with verified links (#25796)
Fix branding:generate_app_icons failing because of disallowed ICO coder (#25794)
Fix typo in CHANGELOG.md (#25764)
Update dependency sanitize to v6.0.2 [SECURITY] (#25777)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Fix processing of media files with unusual names (#25788)
Fix incorrect secondary button size (#2276)
Merge pull request #2274 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes
Merge branch 'main' into glitch-soc/merge-upstream
Bump version to v4.1.3 (#25757)
Merge pull request from GHSA-55j9-c3mp-6fcq
Merge pull request from GHSA-9pxv-6qvf-pjwc
* Fix timeout handling of outbound HTTP requests
* Use CLOCK_MONOTONIC instead of Time.now
Merge pull request from GHSA-9928-3cp5-93fm
* Fix attachments getting processed despite failing content-type validation
* Add a restrictive ImageMagick security policy tailored for Mastodon
* Fix misdetection of MP3 files with large cover art
* Reject unprocessable audio/video files instead of keeping them unchanged
Merge pull request from GHSA-ccm4-vgcc-73hp
* Tighten allowed HTML in oEmbed-based preview cards
* Sanitize preview cards at render time
* Add `sandbox` attribute to preview card iframes
Add hardened headers to user-uploaded files (#25756)
Merge pull request #2272 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes