Manyfold

This release is all about security! We’ve been through a big list of security issues that have been identified and fixed them. We’ve also upgraded the security of ActivityPub federation with RFC9421 signing and verification. Hopefully though, you won’t notice any of that, because it’s all behind the scenes!

There’s one visible thing if you have a recent Prusa printer; you should be able to now use it via the modern API - before, we only had support for the legacy API.

What’s Changed

✨ New Features ✨

• RFC9421 HTTP signature/verification via Fedipub by @Floppy in https://github.com/manyfold3d/manyfold/pull/7118
• Print via new prusalink api by @samuel-sarmah in https://github.com/manyfold3d/manyfold/pull/7157

🔒 Security 🔒

• Prevent moderators from editing administrators’ user settings (including setting password) by @Floppy in https://github.com/manyfold3d/manyfold/pull/7119
• Correctly sanitize markdown to remove unsafe HTML output by @Floppy in https://github.com/manyfold3d/manyfold/pull/7120
• Fix possible conversion of unauthorized files by @Floppy in https://github.com/manyfold3d/manyfold/pull/7121
• Fix sending out of user invitations before group permissions check by @Floppy in https://github.com/manyfold3d/manyfold/pull/7122
• Prevent moderators from managing administrator’s OAuth applications/tokens by @Floppy in https://github.com/manyfold3d/manyfold/pull/7127
• Apply complete sandboxing to files displayed in frames, including HTML by @Floppy in https://github.com/manyfold3d/manyfold/pull/7128
• Fix OAuth privilege escalation by @Floppy in https://github.com/manyfold3d/manyfold/pull/7129
• Require user authentication for new follow page by @Floppy in https://github.com/manyfold3d/manyfold/pull/7131
• Add proper permission checks to all associations in form deserializers by @Floppy in https://github.com/manyfold3d/manyfold/pull/7150

🐛 Bug Fixes 🐛

• Upgrade activity records to work with Fedipub name change by @Floppy in https://github.com/manyfold3d/manyfold/pull/7091
• Fix occasional sync errors from MyMiniFactory by @Floppy in https://github.com/manyfold3d/manyfold/pull/7156

🌍 Internationalization 🌏

• Translations updated: de by @Floppy in https://github.com/manyfold3d/manyfold/pull/7068
• Translations updated: es by @Floppy in https://github.com/manyfold3d/manyfold/pull/7029

🛠️ Other Improvements 🛠️

• Add tests for report creation permissions by @Floppy in https://github.com/manyfold3d/manyfold/pull/7132
• Add note about CVE fishing bans in security file by @Floppy in https://github.com/manyfold3d/manyfold/pull/7149

New Contributors

• @samuel-sarmah made their first contribution in https://github.com/manyfold3d/manyfold/pull/7157

Full Changelog: https://github.com/manyfold3d/manyfold/compare/v0.149.0…v0.150.0