Release: 25.0-lts

.github/actions/setup-ruby/action.yml

@@ -13,6 +13,7 @@ runs:
     - name: Install system dependencies
       shell: bash
       run: |
+        sudo sed -i s:azure\.archive\.ubuntu\.com:archive.ubuntu.com:g /etc/apt/apt-mirrors.txt
         sudo apt-get update
         sudo apt-get install --no-install-recommends -y \
           libicu-dev \

.github/renovate.json5

@@ -8,7 +8,8 @@
     ':enableVulnerabilityAlertsWithLabel(security)',
   ],
   rebaseWhen: 'conflicted',
-  minimumReleaseAge: '3', // Wait 3 days after the package has been published before upgrading it
+  minimumReleaseAge: '3 days', // Wait 3 days after the package has been published before upgrading it
+  prCreation: 'not-pending',
   // packageRules order is important, they are applied from top to bottom and are merged,
   // meaning the most important ones must be at the bottom, for example grouping rules
   // If we do not want a package to be grouped with others, we need to set its groupName
@@ -24,7 +25,18 @@
   },
   // The types are now included in recent versions,we ignore them here until we upgrade and remove the dependency
   ignoreDeps: ['@types/emoji-mart'],
+  lockFileMaintenance: {
+    enabled: true,
+    schedule: ['before 8am on monday'],
+  },
   packageRules: [
+    {
+      // Disable lock file maintenance for bundler for now, as we do not yet pin gems to their exact versions
+      matchManagers: ['bundler'],
+      lockFileMaintenance: {
+        enabled: false,
+      },
+    },
     {
       // Require Dependency Dashboard Approval for major version bumps of these node packages
       matchManagers: ['npm'],

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 All notable changes to this project will be documented in this file.
 
-## [4.7.0] - UNRELEASED
+## [4.7.0] - 2026-08-20
 
 ### Added
 
@@ -39,6 +39,10 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
+- Fix autosuggestions overstaying their welcome in languages that don't use spaces (#40217 by @Gargron)
+- Fix error when processing remote actors with `null` public keys (#40194 by @ClearlyClaire)
+- Fix various off-by-one errors in statistics time ranges (#40193 by @ClearlyClaire)
+- Fix `/deck` being removed from path when resizing window (#40180 by @ClearlyClaire)
 - Fix error in `tootctl media refresh` when cleaning some incompletely processed files (#40056 by @shleeable)
 - Fix plain-text formatter not treating `<BR>` as newline (#40079 by @shleeable)
 - Fix performance of listing follow requests by adding appropriate index (#40033 by @ClearlyClaire)

Gemfile.lock

@@ -592,7 +592,7 @@ GEM
     pastel (0.8.0)
       tty-color (~> 0.5)
     pg (1.6.3)
-    pghero (4.0.0)
+    pghero (4.0.1)
       activerecord (>= 7.2)
     playwright-ruby-client (1.62.0)
       base64
@@ -623,7 +623,7 @@ GEM
       activesupport (>= 3.0.0)
     raabro (1.5.0)
     racc (1.8.1)
-    rack (3.2.6)
+    rack (3.2.7)
     rack-attack (6.8.0)
       rack (>= 1.0, < 4)
     rack-cors (3.0.0)
@@ -774,15 +774,15 @@ GEM
     rubocop-i18n (3.3.0)
       lint_roller (~> 1.1)
       rubocop (>= 1.72.1)
-    rubocop-performance (1.26.1)
+    rubocop-performance (1.27.0)
       lint_roller (~> 1.1)
-      rubocop (>= 1.75.0, < 2.0)
+      rubocop (>= 1.89.0, < 2.0)
       rubocop-ast (>= 1.47.1, < 2.0)
-    rubocop-rails (2.36.0)
+    rubocop-rails (2.37.0)
       activesupport (>= 4.2.0)
       lint_roller (~> 1.1)
       rack (>= 1.1)
-      rubocop (>= 1.75.0, < 2.0)
+      rubocop (>= 1.89.0, < 2.0)
       rubocop-ast (>= 1.44.0, < 2.0)
     rubocop-rspec (3.10.2)
       lint_roller (~> 1.1)

app/controllers/admin/dashboard_controller.rb

@@ -12,7 +12,7 @@ def index
       @pending_tags_count    = pending_tags.async_count
       @pending_users_count   = User.pending.async_count
       @system_checks         = Admin::SystemCheck.perform(current_user)
-      @time_period           = (29.days.ago.to_date...Time.now.utc.to_date)
+      @time_period           = (29.days.ago.to_date..Time.now.utc.to_date)
     end
 
     private

app/controllers/admin/instances/moderation_notes_controller.rb

@@ -13,7 +13,7 @@ def create
       redirect_to admin_instance_path(@instance.domain, anchor: helpers.dom_id(@instance_moderation_note)), notice: I18n.t('admin.instances.moderation_notes.created_msg')
     else
       @instance_moderation_notes = @instance.moderation_notes.includes(:account).chronological
-      @time_period = (6.days.ago.to_date...Time.now.utc.to_date)
+      @time_period = (6.days.ago.to_date..Time.now.utc.to_date)
       @action_logs = Admin::ActionLogFilter.new(target_domain: @instance.domain).results.limit(5)
 
       render 'admin/instances/show'

app/controllers/admin/instances_controller.rb

@@ -17,7 +17,7 @@ def show
 
       @instance_moderation_note = @instance.moderation_notes.new
       @instance_moderation_notes = @instance.moderation_notes.includes(:account).chronological
-      @time_period = (6.days.ago.to_date...Time.now.utc.to_date)
+      @time_period = (6.days.ago.to_date..Time.now.utc.to_date)
       @action_logs = Admin::ActionLogFilter.new(target_domain: @instance.domain).results.limit(LOGS_LIMIT)
     end
 

app/controllers/admin/tags_controller.rb

@@ -48,7 +48,7 @@ def set_tag
     end
 
     def report_range
-      (PERIOD_DAYS.ago.to_date...Time.now.utc.to_date)
+      (PERIOD_DAYS.ago.to_date..Time.now.utc.to_date)
     end
 
     def tag_params

app/javascript/mastodon/components/autosuggest/utils.test.ts

@@ -6,6 +6,14 @@ describe('textAtCursorMatchesToken', () => {
       ['#hashtag', 7, ['#']],
       [1, '#hashtag'],
     ],
+    [
+      ['@alice', 6, ['@']],
+      [1, '@alice'],
+    ],
+    [
+      ['＠alice', 6, ['＠']],
+      [1, '＠alice'],
+    ],
     [
       ['#hash tag', 8, ['#']],
       [1, '#hash tag'],
@@ -24,7 +32,35 @@ describe('textAtCursorMatchesToken', () => {
     ],
     [
       ['#ハッシュ タグ', 7, ['#']],
-      [1, '#ハッシュ タグ'],
+      [null, null],
+    ],
+    [
+      ['@alice reply', 12, ['@']],
+      [1, '@alice reply'],
+    ],
+    [
+      ['@alice 这是我输入的回复内容', 17, ['@']],
+      [null, null],
+    ],
+    [
+      ['@alice これは本文', 12, ['@']],
+      [null, null],
+    ],
+    [
+      ['@alice 이것은답변입니다', 15, ['@']],
+      [null, null],
+    ],
+    [
+      ['@alice　これは本文', 12, ['@']],
+      [null, null],
+    ],
+    [
+      ['@алиса', 6, ['@']],
+      [1, '@алиса'],
+    ],
+    [
+      ['@алиса пример', 13, ['@']],
+      [1, '@алиса пример'],
     ],
   ] as const)(
     'textAtCursorMatchesToken(%s) is %o',

app/javascript/mastodon/components/autosuggest/utils.ts

@@ -8,7 +8,7 @@ export const textAtCursorMatchesToken = (
   let word: string;
 
   const regex = new RegExp(
-    `[${searchTokens.join('')}${WORD}+-]+(\\s[${WORD}]+)?$`,
+    `[${searchTokens.join('')}${WORD}+-]+(\\s[\\p{Script=Latin}\\p{Script=Cyrillic}\\p{M}]+)?$`,
     'iu',
   );
   const left = str.slice(0, caretPosition).search(regex);

app/javascript/mastodon/components/router.tsx

@@ -11,9 +11,10 @@ import type {
 } from 'history';
 import { createBrowserHistory } from 'history';
 
-import { layoutFromWindow } from 'mastodon/is_mobile';
 import { isDevelopment } from 'mastodon/utils/environment';
 
+import { forceSingleColumn, hasMultiColumnPath } from '../initial_state';
+
 import type { FocusTarget } from './navigation_focus_target';
 
 interface MastodonLocationState {
@@ -63,7 +64,8 @@ function normalizePath(
   }
 
   if (
-    layoutFromWindow() === 'multi-column' &&
+    !forceSingleColumn &&
+    hasMultiColumnPath &&
     location.pathname &&
     !location.pathname.startsWith('/deck')
   ) {

app/javascript/mastodon/features/ui/index.jsx

@@ -21,7 +21,7 @@ import { Hotkeys } from 'mastodon/components/hotkeys';
 import { HoverCardController } from 'mastodon/components/hover_card_controller';
 import { PictureInPicture } from 'mastodon/features/picture_in_picture';
 import { identityContextPropShape, withIdentity } from 'mastodon/identity_context';
-import { layoutFromWindow } from 'mastodon/is_mobile';
+import { layoutFromWindow, transientSingleColumn } from 'mastodon/is_mobile';
 import { WithRouterPropTypes } from 'mastodon/utils/react_router';
 import { isRedesignEnabled } from '@/mastodon/utils/environment';
 import { checkAnnualReport } from '@/mastodon/reducers/slices/annual_report';
@@ -30,7 +30,7 @@ import { uploadCompose, resetCompose, changeComposeSpoilerness } from '../../act
 import { clearHeight } from '../../actions/height_cache';
 import { fetchServer, fetchServerTranslationLanguages } from '../../actions/server';
 import { expandHomeTimeline } from '../../actions/timelines';
-import { initialState, me, owner, singleUserMode, trendsEnabled, landingPage, localLiveFeedAccess, disableHoverCards, domain } from '../../initial_state';
+import { initialState, forceSingleColumn, me, owner, singleUserMode, trendsEnabled, landingPage, localLiveFeedAccess, disableHoverCards, domain } from '../../initial_state';
 
 import BundleColumnError from './components/bundle_column_error';
 import { NavigationBar } from './components/navigation_bar';
@@ -209,8 +209,8 @@ class SwitchingColumnsArea extends PureComponent {
           <WrappedSwitch>
             <Redirect from='/' to={{pathname: rootRedirect, state: {...this.props.location.state, focusTarget: false}}} exact />
 
-            {singleColumn ? <Redirect from='/deck' to='/home' exact /> : null}
-            {singleColumn && pathName.startsWith('/deck/') ? <Redirect from={pathName} to={{...this.props.location, pathname: pathName.slice(5)}} /> : null}
+            {forceSingleColumn || transientSingleColumn ? <Redirect from='/deck' to='/home' exact /> : null}
+            {(forceSingleColumn || transientSingleColumn) && pathName.startsWith('/deck/') ? <Redirect from={pathName} to={{...this.props.location, pathname: pathName.slice(5)}} /> : null}
             {/* Redirect old bookmarks (without /deck) with home-like routes to the advanced interface */}
             {!singleColumn && pathName === '/home' ? <Redirect from='/home' to='/deck/getting-started' exact /> : null}
             {pathName === '/getting-started' ? <Redirect from='/getting-started' to={singleColumn ? '/home' : '/deck/getting-started'} exact /> : null}

app/javascript/mastodon/features/ui/util/react_router_helpers.jsx

@@ -8,12 +8,13 @@ import StackTrace from 'stacktrace-js';
 import Bundle from '../components/bundle';
 import BundleColumnError from '../components/bundle_column_error';
 import { ColumnLoading } from '../components/column_loading';
+import { forceSingleColumn, hasMultiColumnPath } from '@/mastodon/initial_state';
 
 // Small wrapper to pass multiColumn to the route components
 export const WrappedSwitch = ({ multiColumn, children }) => {
   const  location = useLocation();
 
-  const decklessLocation = multiColumn && location.pathname.startsWith('/deck')
+  const decklessLocation = !forceSingleColumn && hasMultiColumnPath && location.pathname.startsWith('/deck')
     ? {...location, pathname: location.pathname.slice(5)}
     : location;
 

app/javascript/mastodon/locales/gd.json

@@ -67,6 +67,7 @@
   "account.follows.empty": "Chan eil an cleachdaiche seo a’ leantainn neach sam bith fhathast.",
   "account.follows_you": "’Gad leantainn",
   "account.go_to_profile": "Tadhail air a’ phròifil",
+  "account.hame.invalid_handle": "Chan eil an t-aithnichear ri fhaighinn",
   "account.hide_reblogs": "Falaich na brosnachaidhean o @{name}",
   "account.in_memoriam": "Mar chuimhneachan.",
   "account.join_modal.day": "Latha",
@@ -98,6 +99,7 @@
   "account.menu.mute": "Mùch an cunntas",
   "account.menu.note.description": "Chan fhaic ach thu fhèin seo",
   "account.menu.open_original_page": "Seall air {domain}",
+  "account.menu.open_original_page_no_domain": "Seall air an fhrithealaiche tùsail",
   "account.menu.remove_follower": "Thoir an neach-leantainn air falbh",
   "account.menu.report": "Dèan gearan mun chunntas",
   "account.menu.share": "Co-roinn…",
@@ -116,6 +118,8 @@
   "account.name.help.domain_self": "Is {domain} am frithealaiche agad-sa a tha ag òstadh pròifil ’s postaichean agad-sa.",
   "account.name.help.footer": "Air an aon dòigh ’s a chuireas tu puist-d gu daoine le solaraichean puist-d eadar-dhealaichte, ’s urrainn dhut conaltradh le daoine air frithealaichean Mastodon eile ’s air aplacaidean eile a’ cho-shaoghail.",
   "account.name.help.header": "Tha aithnichear coltach ri seòladh puist-d",
+  "account.name.help.invalid_explanation": "Faodaidh seo tachairt nuair a dh’atharraicheas cuideigin ainm-cleachdaiche ’s cha mhair e sann fharsaingeachd. Ma mhaireas e, dh’fhaoidte gu cheil frithealaiche ann nach eil ri fhaighinn no droch-rèiteachadh ud thall.",
+  "account.name.help.invalid_header": "Tha aithnichear a’ chleachdaiche seo ’ga ùrachadh.",
   "account.name.help.username": "Is {username} ainm-cleachdaiche a’ chunntais seo air an fhrithealaiche aca-san. Dh’fhaoidte gu bheil an t-aon ainm-cleachdaiche le cuideigin air frithealaiche eile.",
   "account.name.help.username_self": "Is {username} d’ ainm-cleachdaiche air an fhrithealaiche seo. Dh’fhaoidte gu bheil an t-aon ainm-cleachdaiche le cuideigin air frithealaiche eile.",
   "account.name_info": "Dè ’s ciall dha seo?",
@@ -267,6 +271,7 @@
   "admin.impact_report.instance_followers": "An luchd-leantainn a chailleadh na cleachdaichean againn",
   "admin.impact_report.instance_follows": "An luchd-leantainn a chailleadh na cleachdaichean aca-san",
   "admin.impact_report.title": "Geàrr-chunntas na buaidhe",
+  "alert.need_reload.message": "Chaidh Mastodon ùrachadh. Dh’fhaoidte nach obraich a h-uile càil mar bu chòir gus an ath-luchdaich thu an duilleag.",
   "alert.rate_limited.message": "Feuch ris a-rithist às dèidh {retry_time, time, medium}.",
   "alert.rate_limited.title": "Cuingeachadh ùine",
   "alert.unexpected.message": "Thachair mearachd ris nach robh dùil.",
@@ -390,6 +395,7 @@
   "collections.create.basic_details_title": "Bun-fhiosrachadh",
   "collections.create.steps": "Ceum {step}/{total}",
   "collections.create_collection": "Cruthaich cruinneachadh",
+  "collections.create_new_collection": "Cruthaich cruinneachadh ùr",
   "collections.delete_collection": "Sguab an cruinneachadh às",
   "collections.description_length_hint": "Crìoch de 100 caractar",
   "collections.detail.author_added_you_on_date": "Chuir {author} ris thu {date}",
@@ -485,7 +491,7 @@
   "community.column_settings.local_only": "Feadhainn ionadail a-mhàin",
   "community.column_settings.media_only": "Meadhanan a-mhàin",
   "community.column_settings.remote_only": "Feadhainn chèin a-mhàin",
-  "compose.error.blank_post": "Chan urrrainn dho phost a bhith bàn.",
+  "compose.error.blank_post": "Chan urrainn dho phost a bhith bàn.",
   "compose.language.change": "Atharraich an cànan",
   "compose.language.search": "Lorg cànan…",
   "compose.published.body": "Chaidh am post fhoillseachadh.",
@@ -1230,6 +1236,7 @@
   "status.block": "Bac @{name}",
   "status.bookmark": "Cuir ris na comharran-lìn",
   "status.cancel_reblog_private": "Na brosnaich tuilleadh",
+  "status.cannot_edit": "Chan fhaod thu am post seo a dheasachadh",
   "status.cannot_quote": "Chan fhaod thu am post seo a luaidh",
   "status.cannot_reblog": "Cha ghabh am post seo brosnachadh",
   "status.contains_quote": "Tha luaidh na bhroinn",
@@ -1263,8 +1270,10 @@
   "status.more": "Barrachd",
   "status.mute": "Mùch @{name}",
   "status.mute_conversation": "Mùch an còmhradh",
+  "status.not_quoted": "Cha deach do luaidh sa phost seo",
   "status.open": "Leudaich am post seo",
   "status.pin": "Prìnich ris a’ phròifil",
+  "status.public_only": "Tha am post seo prìobhaideach",
   "status.quote": "Luaidh",
   "status.quote.cancel": "Sguir dhen luaidh",
   "status.quote_error.blocked_account_hint.title": "Tha am post seo falaichte on a bhac thu @{name}.",

app/javascript/mastodon/utils/hashtags.ts

@@ -1,5 +1,5 @@
 const HASHTAG_SEPARATORS = '_\\u00b7\\u200c';
-const ALPHA = '\\p{L}\\p{M}';
+export const ALPHA = '\\p{L}\\p{M}';
 export const WORD = '\\p{L}\\p{M}\\p{N}\\p{Pc}';
 
 const buildHashtagPatternRegex = () => {

app/lib/activity_tracker.rb

@@ -39,7 +39,7 @@ def get(start_at, end_at = Time.now.utc)
   end
 
   def sum(start_at, end_at = Time.now.utc)
-    keys = (start_at.to_date...end_at.to_date).flat_map { |date| [key_at(date.to_time(:utc)), legacy_key_at(date)] }.uniq
+    keys = (start_at.to_date..end_at.to_date).flat_map { |date| [key_at(date.to_time(:utc)), legacy_key_at(date)] }.uniq
 
     case @type
     when :basic

app/lib/admin/metrics/measure/base_measure.rb

@@ -97,7 +97,7 @@ def time_period
   end
 
   def previous_time_period
-    ((@start_at.to_date - length_of_period)..(@end_at.to_date - length_of_period))
+    ((@start_at.to_date - (length_of_period + 1))..(@end_at.to_date - (length_of_period + 1)))
   end
 
   def length_of_period

app/services/activitypub/process_account_service.rb

@@ -447,6 +447,8 @@ def legacy_public_keys
       next unless value['owner'] == @account.uri
 
       key = value['publicKeyPem']
+      next if key.nil?
+
       { type: :rsa, public_key: key, uri: key_id }
     end
   end
@@ -474,7 +476,7 @@ def fep_521a_public_keys
       next unless value['type'] == 'Multikey' && value['controller'] == @account.uri
 
       key_type, key = key_from_multikey(value['publicKeyMultibase'])
-      next if key_type.nil?
+      next if key_type.nil? || key.nil?
 
       { type: key_type, public_key: key, uri: key_id }
     end

config/locales/doorkeeper.be.yml

@@ -84,9 +84,10 @@ be:
         credential_flow_not_configured: Resource Owner Password Credentials flow не прайшоў з-за таго, што ўласцівасць Doorkeeper.configure.resource_owner_from_credentials была не вызначана.
         invalid_client: Збой аўтэнтыфікацыі кліента з-за невядомага кліента, адсутнасці аўтэнтыфікацыі кліента або метаду аўтэнтыфікацыі, які не падтрымліваецца.
         invalid_code_challenge_method:
+          few: code_challenge_method павінен быць адным з %{challenge_methods}.
+          many: code_challenge_method павінен быць адным з %{challenge_methods}.
           one: code_challenge_method павінен быць %{challenge_methods}.
           other: code_challenge_method павінен быць адным з %{challenge_methods}.
-          zero: Сервер аўтарызацыі не падтрымлівае PKCE, паколькі няма прынятых значэнняў у code_challenge_method.
         invalid_grant: Прадастаўлены дазвол на аўтарызацыю несапраўдны, пратэрмінованы, быў адкліканы, не адпавядае URI перанакіравання, які выкарыстоўваецца ў запыце аўтарызацыі або быў выдадзены іншаму кліенту.
         invalid_redirect_uri: Прадстаўлены URI перанакіравання не сапраўдны.
         invalid_request:

config/locales/doorkeeper.cs.yml

@@ -84,9 +84,10 @@ cs:
         credential_flow_not_configured: Proud Resource Owner Password Credentials selhal, protože Doorkeeper.configure.resource_owner_from_credentials nebylo nakonfigurováno.
         invalid_client: Ověření klienta selhalo kvůli neznámému klientovi, chybějící klientské autentizaci či nepodporované autentizační metodě.
         invalid_code_challenge_method:
+          few: code_challenge_method musí být jedna z %{challenge_methods}.
+          many: code_challenge_method musí být jedna z %{challenge_methods}.
           one: code_challenge_method musí být %{challenge_methods}.
           other: code_challenge_method musí být jedna z %{challenge_methods}.
-          zero: Autorizační server nepodporuje PKCE, protože neexistují žádné akceptované hodnoty kode_challenge_method.
         invalid_grant: Poskytnuté oprávnění je neplatné, vypršela jeho platnost, bylo odvoláno, neshoduje se s URI přesměrování použitým v požadavku o autorizaci, nebo bylo uděleno jinému klientu.
         invalid_redirect_uri: Zahrnutá přesměrovací URI není platná.
         invalid_request: