Merge commit '144a406d332b034caa812ade2629df03ed4898d7' into glitch-soc/merge-upstream
Conflicts:
- `app/views/layouts/application.html.haml`:
Upstream removed the `crossorigin` attribute from `preload_pack_asset`.
Glitch-soc had different calls to `preload_pack_asset` because of the
different theming system.
Ported the change.
- `app/views/layouts/embedded.html.haml`:
Upstream removed the `crossorigin` attribute from `preload_pack_asset`.
Glitch-soc had different calls to `preload_pack_asset` because of the
different theming system.
Ported the change.
Bump version to v4.1.5 (#26108)
Fix the crossorigin attribute (#26096)
Merge pull request #2291 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes
Merge commit '82e477b184b5666fff7fb55933dce22ca2925db8' into glitch-soc/merge-upstream
Conflicts:
- `db/migrate/20180831171112_create_bookmarks.rb`:
Upstream ran a lint fix on this file, but this file is different in
glitch-soc because the feature was added much earlier.
Ran the lint fix on our own version of the file.
Refactor `Snowflake` to avoid brakeman sql injection warnings (#25879)
Fix `Style/SlicingWithRange` cop (#25923)
Enable Rubocop Style/FrozenStringLiteralComment (#23793)
Merge pull request #2279 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes
Merge branch 'main' into glitch-soc/merge-upstream
Conflicts:
- `.github/workflows/build-image.yml`:
Upstream attempted something with tags.
Kept our version.
Bump version to v4.1.4 (#25805)
Fix branding:generate_app_icons failing because of disallowed ICO coder (#25794)
Merge pull request #2274 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes
Merge branch 'main' into glitch-soc/merge-upstream
Bump version to v4.1.3 (#25757)
Merge pull request from GHSA-9928-3cp5-93fm
* Fix attachments getting processed despite failing content-type validation
* Add a restrictive ImageMagick security policy tailored for Mastodon
* Fix misdetection of MP3 files with large cover art
* Reject unprocessable audio/video files instead of keeping them unchanged
Merge pull request from GHSA-ccm4-vgcc-73hp
* Tighten allowed HTML in oEmbed-based preview cards
* Sanitize preview cards at render time
* Add `sandbox` attribute to preview card iframes
Add hardened headers to user-uploaded files (#25756)
Merge pull request #2256 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes