From ced6b10c70769e39ee7d3b6a3fe63b8c2aea3ec0 Mon Sep 17 00:00:00 2001
From: feld <feld@feld.me>
Date: Mon, 12 Aug 2024 19:52:37 +0000
Subject: [PATCH 1/8] Merge branch 'swoosh-mailgun' into 'develop'

Fix Swoosh Mailgun support

See merge request pleroma/pleroma!4217
---
 changelog.d/mailgun.fix | 1 +
 mix.exs                 | 1 +
 mix.lock                | 1 +
 3 files changed, 3 insertions(+)
 create mode 100644 changelog.d/mailgun.fix

diff --git a/changelog.d/mailgun.fix b/changelog.d/mailgun.fix
new file mode 100644
index 0000000000..8555887526
--- /dev/null
+++ b/changelog.d/mailgun.fix
@@ -0,0 +1 @@
+The Swoosh email adapter for Mailgun was missing a new dependency on :multipart
diff --git a/mix.exs b/mix.exs
index 69e52e5264..e3c8559baf 100644
--- a/mix.exs
+++ b/mix.exs
@@ -202,6 +202,7 @@ defp deps do
       {:bandit, "~> 1.5.2"},
       {:websock_adapter, "~> 0.5.6"},
       {:oban_live_dashboard, "~> 0.1.1"},
+      {:multipart, "~> 0.4.0", optional: true},
 
       ## dev & test
       {:phoenix_live_reload, "~> 1.3.3", only: :dev},
diff --git a/mix.lock b/mix.lock
index 61ede9e5eb..37ac1768b4 100644
--- a/mix.lock
+++ b/mix.lock
@@ -84,6 +84,7 @@
   "mock": {:hex, :mock, "0.3.8", "7046a306b71db2488ef54395eeb74df0a7f335a7caca4a3d3875d1fc81c884dd", [:mix], [{:meck, "~> 0.9.2", [hex: :meck, repo: "hexpm", optional: false]}], "hexpm", "7fa82364c97617d79bb7d15571193fc0c4fe5afd0c932cef09426b3ee6fe2022"},
   "mogrify": {:hex, :mogrify, "0.8.0", "3506f3ca3f7b95a155f3b4ef803b5db176f5a0633723e3fe85e0d6399e3b11c8", [:mix], [], "hexpm", "2278d245f07056ea3b586e98801e933695147066fa4cf563f552c1b4f0ff8ad9"},
   "mox": {:hex, :mox, "1.1.0", "0f5e399649ce9ab7602f72e718305c0f9cdc351190f72844599545e4996af73c", [:mix], [], "hexpm", "d44474c50be02d5b72131070281a5d3895c0e7a95c780e90bc0cfe712f633a13"},
+  "multipart": {:hex, :multipart, "0.4.0", "634880a2148d4555d050963373d0e3bbb44a55b2badd87fa8623166172e9cda0", [:mix], [{:mime, "~> 1.2 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}], "hexpm", "3c5604bc2fb17b3137e5d2abdf5dacc2647e60c5cc6634b102cf1aef75a06f0a"},
   "nimble_options": {:hex, :nimble_options, "1.1.1", "e3a492d54d85fc3fd7c5baf411d9d2852922f66e69476317787a7b2bb000a61b", [:mix], [], "hexpm", "821b2470ca9442c4b6984882fe9bb0389371b8ddec4d45a9504f00a66f650b44"},
   "nimble_parsec": {:hex, :nimble_parsec, "0.6.0", "32111b3bf39137144abd7ba1cce0914533b2d16ef35e8abc5ec8be6122944263", [:mix], [], "hexpm", "27eac315a94909d4dc68bc07a4a83e06c8379237c5ea528a9acff4ca1c873c52"},
   "nimble_pool": {:hex, :nimble_pool, "0.2.6", "91f2f4c357da4c4a0a548286c84a3a28004f68f05609b4534526871a22053cde", [:mix], [], "hexpm", "1c715055095d3f2705c4e236c18b618420a35490da94149ff8b580a2144f653f"},

From 2977779e94cb34610d0c2369ecacf7d721ebc5ab Mon Sep 17 00:00:00 2001
From: feld <feld@feld.me>
Date: Fri, 6 Sep 2024 16:30:07 +0000
Subject: [PATCH 2/8] Merge branch 'well-known' into 'develop'

NodeInfo: Accept application/activity+json requests

See merge request pleroma/pleroma!4242
---
 changelog.d/well-known.change       |  1 +
 lib/pleroma/web/router.ex           |  2 +-
 test/pleroma/web/node_info_test.exs | 13 +++++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/well-known.change

diff --git a/changelog.d/well-known.change b/changelog.d/well-known.change
new file mode 100644
index 0000000000..e928124fbc
--- /dev/null
+++ b/changelog.d/well-known.change
@@ -0,0 +1 @@
+Accept application/activity+json for requests to .well-known/nodeinfo
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index fc40a11432..4294dffa57 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -189,7 +189,7 @@ defmodule Pleroma.Web.Router do
   end
 
   pipeline :well_known do
-    plug(:accepts, ["json", "jrd", "jrd+json", "xml", "xrd+xml"])
+    plug(:accepts, ["activity+json", "json", "jrd", "jrd+json", "xml", "xrd+xml"])
   end
 
   pipeline :config do
diff --git a/test/pleroma/web/node_info_test.exs b/test/pleroma/web/node_info_test.exs
index f474220be4..afe4ebb36d 100644
--- a/test/pleroma/web/node_info_test.exs
+++ b/test/pleroma/web/node_info_test.exs
@@ -24,6 +24,19 @@ test "GET /.well-known/nodeinfo", %{conn: conn} do
       |> get(href)
       |> json_response(200)
     end)
+
+    accept_types = [
+      "application/activity+json",
+      "application/json",
+      "application/jrd+json"
+    ]
+
+    for type <- accept_types do
+      conn
+      |> put_req_header("accept", type)
+      |> get("/.well-known/nodeinfo")
+      |> json_response(200)
+    end
   end
 
   test "nodeinfo shows staff accounts", %{conn: conn} do

From a6e97c497b5ac418d9825200542d4d4d273f91f7 Mon Sep 17 00:00:00 2001
From: feld <feld@feld.me>
Date: Fri, 6 Sep 2024 13:27:06 +0000
Subject: [PATCH 3/8] Merge branch 'following-state-bug' into 'develop'

Fix Following status bug

See merge request pleroma/pleroma!4251
---
 changelog.d/following-state.fix               |  1 +
 .../web/mastodon_api/views/account_view.ex    | 19 +++++----
 mix.lock                                      |  2 +-
 .../mastodon_api/views/account_view_test.exs  | 39 +++++++++++++++++++
 4 files changed, 50 insertions(+), 11 deletions(-)
 create mode 100644 changelog.d/following-state.fix

diff --git a/changelog.d/following-state.fix b/changelog.d/following-state.fix
new file mode 100644
index 0000000000..314ea62102
--- /dev/null
+++ b/changelog.d/following-state.fix
@@ -0,0 +1 @@
+Resolved edge case where the API can report you are following a user but the relationship is not fully established.
diff --git a/lib/pleroma/web/mastodon_api/views/account_view.ex b/lib/pleroma/web/mastodon_api/views/account_view.ex
index 6976ca6e5e..298c739867 100644
--- a/lib/pleroma/web/mastodon_api/views/account_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/account_view.ex
@@ -92,14 +92,13 @@ def render(
         User.get_follow_state(reading_user, target)
       end
 
-    followed_by =
-      if following_relationships do
-        case FollowingRelationship.find(following_relationships, target, reading_user) do
-          %{state: :follow_accept} -> true
-          _ -> false
-        end
-      else
-        User.following?(target, reading_user)
+    followed_by = FollowingRelationship.following?(target, reading_user)
+    following = FollowingRelationship.following?(reading_user, target)
+
+    requested =
+      cond do
+        following -> false
+        true -> match?(:follow_pending, follow_state)
       end
 
     subscribing =
@@ -114,7 +113,7 @@ def render(
     # NOTE: adjust UserRelationship.view_relationships_option/2 on new relation-related flags
     %{
       id: to_string(target.id),
-      following: follow_state == :follow_accept,
+      following: following,
       followed_by: followed_by,
       blocking:
         UserRelationship.exists?(
@@ -150,7 +149,7 @@ def render(
         ),
       subscribing: subscribing,
       notifying: subscribing,
-      requested: follow_state == :follow_pending,
+      requested: requested,
       domain_blocking: User.blocks_domain?(reading_user, target),
       showing_reblogs:
         not UserRelationship.exists?(
diff --git a/mix.lock b/mix.lock
index 37ac1768b4..09db91ffe5 100644
--- a/mix.lock
+++ b/mix.lock
@@ -22,7 +22,7 @@
   "cowboy": {:hex, :cowboy, "2.12.0", "f276d521a1ff88b2b9b4c54d0e753da6c66dd7be6c9fca3d9418b561828a3731", [:make, :rebar3], [{:cowlib, "2.13.0", [hex: :cowlib, repo: "hexpm", optional: false]}, {:ranch, "1.8.0", [hex: :ranch, repo: "hexpm", optional: false]}], "hexpm", "8a7abe6d183372ceb21caa2709bec928ab2b72e18a3911aa1771639bef82651e"},
   "cowboy_telemetry": {:hex, :cowboy_telemetry, "0.4.0", "f239f68b588efa7707abce16a84d0d2acf3a0f50571f8bb7f56a15865aae820c", [:rebar3], [{:cowboy, "~> 2.7", [hex: :cowboy, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "7d98bac1ee4565d31b62d59f8823dfd8356a169e7fcbb83831b8a5397404c9de"},
   "cowlib": {:hex, :cowlib, "2.13.0", "db8f7505d8332d98ef50a3ef34b34c1afddec7506e4ee4dd4a3a266285d282ca", [:make, :rebar3], [], "hexpm", "e1e1284dc3fc030a64b1ad0d8382ae7e99da46c3246b815318a4b848873800a4"},
-  "credo": {:hex, :credo, "1.7.3", "05bb11eaf2f2b8db370ecaa6a6bda2ec49b2acd5e0418bc106b73b07128c0436", [:mix], [{:bunt, "~> 0.2.1 or ~> 1.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:file_system, "~> 0.2 or ~> 1.0", [hex: :file_system, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "35ea675a094c934c22fb1dca3696f3c31f2728ae6ef5a53b5d648c11180a4535"},
+  "credo": {:hex, :credo, "1.7.7", "771445037228f763f9b2afd612b6aa2fd8e28432a95dbbc60d8e03ce71ba4446", [:mix], [{:bunt, "~> 0.2.1 or ~> 1.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:file_system, "~> 0.2 or ~> 1.0", [hex: :file_system, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "8bc87496c9aaacdc3f90f01b7b0582467b69b4bd2441fe8aae3109d843cc2f2e"},
   "crontab": {:hex, :crontab, "1.1.8", "2ce0e74777dfcadb28a1debbea707e58b879e6aa0ffbf9c9bb540887bce43617", [:mix], [{:ecto, "~> 1.0 or ~> 2.0 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: true]}], "hexpm"},
   "custom_base": {:hex, :custom_base, "0.2.1", "4a832a42ea0552299d81652aa0b1f775d462175293e99dfbe4d7dbaab785a706", [:mix], [], "hexpm", "8df019facc5ec9603e94f7270f1ac73ddf339f56ade76a721eaa57c1493ba463"},
   "db_connection": {:hex, :db_connection, "2.7.0", "b99faa9291bb09892c7da373bb82cba59aefa9b36300f6145c5f201c7adf48ec", [:mix], [{:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "dcf08f31b2701f857dfc787fbad78223d61a32204f217f15e881dd93e4bdd3ff"},
diff --git a/test/pleroma/web/mastodon_api/views/account_view_test.exs b/test/pleroma/web/mastodon_api/views/account_view_test.exs
index f0711fa0d6..73ec67a3de 100644
--- a/test/pleroma/web/mastodon_api/views/account_view_test.exs
+++ b/test/pleroma/web/mastodon_api/views/account_view_test.exs
@@ -456,6 +456,45 @@ test "represent a relationship for the following and followed user" do
       test_relationship_rendering(user, other_user, expected)
     end
 
+    test "relationship does not indicate following if a FollowingRelationship is missing" do
+      user = insert(:user)
+      other_user = insert(:user, local: false)
+
+      # Create a follow relationship with the real Follow Activity and Accept it
+      assert {:ok, _, _, _} = CommonAPI.follow(other_user, user)
+      assert {:ok, _} = CommonAPI.accept_follow_request(user, other_user)
+
+      assert %{data: %{"state" => "accept"}} =
+               Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(user, other_user)
+
+      # Fetch the relationship and forcibly delete it to simulate
+      # a Follow Accept that did not complete processing
+      %{following_relationships: [relationship]} =
+        Pleroma.UserRelationship.view_relationships_option(user, [other_user])
+
+      assert {:ok, _} = Pleroma.Repo.delete(relationship)
+
+      assert %{following_relationships: [], user_relationships: []} ==
+               Pleroma.UserRelationship.view_relationships_option(user, [other_user])
+
+      expected =
+        Map.merge(
+          @blank_response,
+          %{
+            following: false,
+            followed_by: false,
+            muting: false,
+            muting_notifications: false,
+            subscribing: false,
+            notifying: false,
+            showing_reblogs: true,
+            id: to_string(other_user.id)
+          }
+        )
+
+      test_relationship_rendering(user, other_user, expected)
+    end
+
     test "represent a relationship for the blocking and blocked user" do
       user = insert(:user)
       other_user = insert(:user)

From f45f17b5ff4e0bc454d9340c500e8b923c9e57cb Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Thu, 8 Aug 2024 05:29:46 +0000
Subject: [PATCH 4/8] Merge branch 'follow-validator' into 'develop'

Do not require a cc field when validating an incoming Follow activity

See merge request pleroma/pleroma!4212
---
 changelog.d/follow-validator.fix                       |  1 +
 .../object_validators/accept_reject_validator.ex       |  2 +-
 .../activity_pub/object_validators/block_validator.ex  |  2 +-
 .../activity_pub/object_validators/follow_validator.ex |  2 +-
 .../object_validators/follow_validation_test.exs       | 10 ++++++++++
 5 files changed, 14 insertions(+), 3 deletions(-)
 create mode 100644 changelog.d/follow-validator.fix

diff --git a/changelog.d/follow-validator.fix b/changelog.d/follow-validator.fix
new file mode 100644
index 0000000000..d49932b7b3
--- /dev/null
+++ b/changelog.d/follow-validator.fix
@@ -0,0 +1 @@
+Improve the FollowValidator to successfully incoming activities with an errant cc field.
diff --git a/lib/pleroma/web/activity_pub/object_validators/accept_reject_validator.ex b/lib/pleroma/web/activity_pub/object_validators/accept_reject_validator.ex
index d611da0516..03ab83347f 100644
--- a/lib/pleroma/web/activity_pub/object_validators/accept_reject_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/accept_reject_validator.ex
@@ -29,7 +29,7 @@ def cast_data(data) do
 
   defp validate_data(cng) do
     cng
-    |> validate_required([:id, :type, :actor, :to, :cc, :object])
+    |> validate_required([:id, :type, :actor, :to, :object])
     |> validate_inclusion(:type, ["Accept", "Reject"])
     |> validate_actor_presence()
     |> validate_object_presence(allowed_types: ["Follow"])
diff --git a/lib/pleroma/web/activity_pub/object_validators/block_validator.ex b/lib/pleroma/web/activity_pub/object_validators/block_validator.ex
index 0de87a27ef..98340545cc 100644
--- a/lib/pleroma/web/activity_pub/object_validators/block_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/block_validator.ex
@@ -29,7 +29,7 @@ def cast_data(data) do
 
   defp validate_data(cng) do
     cng
-    |> validate_required([:id, :type, :actor, :to, :cc, :object])
+    |> validate_required([:id, :type, :actor, :to, :object])
     |> validate_inclusion(:type, ["Block"])
     |> CommonValidations.validate_actor_presence()
     |> CommonValidations.validate_actor_presence(field_name: :object)
diff --git a/lib/pleroma/web/activity_pub/object_validators/follow_validator.ex b/lib/pleroma/web/activity_pub/object_validators/follow_validator.ex
index b3ca5b6910..e4e97bf72a 100644
--- a/lib/pleroma/web/activity_pub/object_validators/follow_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/follow_validator.ex
@@ -29,7 +29,7 @@ def cast_data(data) do
 
   defp validate_data(cng) do
     cng
-    |> validate_required([:id, :type, :actor, :to, :cc, :object])
+    |> validate_required([:id, :type, :actor, :to, :object])
     |> validate_inclusion(:type, ["Follow"])
     |> validate_inclusion(:state, ~w{pending reject accept})
     |> validate_actor_presence()
diff --git a/test/pleroma/web/activity_pub/object_validators/follow_validation_test.exs b/test/pleroma/web/activity_pub/object_validators/follow_validation_test.exs
index 371368e0e0..acf6e8d8fe 100644
--- a/test/pleroma/web/activity_pub/object_validators/follow_validation_test.exs
+++ b/test/pleroma/web/activity_pub/object_validators/follow_validation_test.exs
@@ -22,5 +22,15 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.FollowValidationTest do
     test "validates a basic follow object", %{valid_follow: valid_follow} do
       assert {:ok, _follow, []} = ObjectValidator.validate(valid_follow, [])
     end
+
+    test "supports a nil cc", %{valid_follow: valid_follow} do
+      valid_follow_with_nil_cc = Map.put(valid_follow, "cc", nil)
+      assert {:ok, _follow, []} = ObjectValidator.validate(valid_follow_with_nil_cc, [])
+    end
+
+    test "supports an empty cc", %{valid_follow: valid_follow} do
+      valid_follow_with_empty_cc = Map.put(valid_follow, "cc", [])
+      assert {:ok, _follow, []} = ObjectValidator.validate(valid_follow_with_empty_cc, [])
+    end
   end
 end

From 53c2d2cd87d35094b0ae623b8daab4d303ed5fcb Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 13 Nov 2024 08:22:44 +0000
Subject: [PATCH 5/8] Merge branch 'mastodon-websocket-fix' into 'develop'

Fix Mastodon WebSocket authentication

See merge request pleroma/pleroma!4206
---
 changelog.d/mastodon-websocket.fix                   |  1 +
 lib/pleroma/web/endpoint.ex                          |  1 +
 lib/pleroma/web/mastodon_api/websocket_handler.ex    | 11 ++++++++++-
 mix.exs                                              |  3 ++-
 mix.lock                                             |  2 +-
 test/pleroma/integration/mastodon_websocket_test.exs | 11 +++++++++++
 6 files changed, 26 insertions(+), 3 deletions(-)
 create mode 100644 changelog.d/mastodon-websocket.fix

diff --git a/changelog.d/mastodon-websocket.fix b/changelog.d/mastodon-websocket.fix
new file mode 100644
index 0000000000..2c4fe86ef6
--- /dev/null
+++ b/changelog.d/mastodon-websocket.fix
@@ -0,0 +1 @@
+Fix Mastodon WebSocket authentication
diff --git a/lib/pleroma/web/endpoint.ex b/lib/pleroma/web/endpoint.ex
index fef907ace6..bab3c9fd00 100644
--- a/lib/pleroma/web/endpoint.ex
+++ b/lib/pleroma/web/endpoint.ex
@@ -14,6 +14,7 @@ defmodule Pleroma.Web.Endpoint do
     websocket: [
       path: "/",
       compress: false,
+      connect_info: [:sec_websocket_protocol],
       error_handler: {Pleroma.Web.MastodonAPI.WebsocketHandler, :handle_error, []},
       fullsweep_after: 20
     ]
diff --git a/lib/pleroma/web/mastodon_api/websocket_handler.ex b/lib/pleroma/web/mastodon_api/websocket_handler.ex
index 730295a4ce..3ed1cdd6cd 100644
--- a/lib/pleroma/web/mastodon_api/websocket_handler.ex
+++ b/lib/pleroma/web/mastodon_api/websocket_handler.ex
@@ -22,7 +22,7 @@ def child_spec(_opts), do: :ignore
   # This only prepares the connection and is not in the process yet
   @impl Phoenix.Socket.Transport
   def connect(%{params: params} = transport_info) do
-    with access_token <- Map.get(params, "access_token"),
+    with access_token <- find_access_token(transport_info),
          {:ok, user, oauth_token} <- authenticate_request(access_token),
          {:ok, topic} <-
            Streamer.get_topic(params["stream"], user, oauth_token, params) do
@@ -244,4 +244,13 @@ def handle_error(conn, :unauthorized) do
   def handle_error(conn, _reason) do
     Plug.Conn.send_resp(conn, 404, "Not Found")
   end
+
+  defp find_access_token(%{
+         connect_info: %{sec_websocket_protocol: [token]}
+       }),
+       do: token
+
+  defp find_access_token(%{params: %{"access_token" => token}}), do: token
+
+  defp find_access_token(_), do: nil
 end
diff --git a/mix.exs b/mix.exs
index e3c8559baf..88140c69b3 100644
--- a/mix.exs
+++ b/mix.exs
@@ -132,7 +132,8 @@ defp logger_deps do
   # Type `mix help deps` for examples and options.
   defp deps do
     [
-      {:phoenix, "~> 1.7.3"},
+      {:phoenix,
+       git: "https://github.com/feld/phoenix", branch: "v1.7.14-websocket-headers", override: true},
       {:phoenix_ecto, "~> 4.4"},
       {:ecto_sql, "~> 3.10"},
       {:ecto_enum, "~> 1.4"},
diff --git a/mix.lock b/mix.lock
index 09db91ffe5..4d0b9003c5 100644
--- a/mix.lock
+++ b/mix.lock
@@ -95,7 +95,7 @@
   "open_api_spex": {:hex, :open_api_spex, "3.18.2", "8c855e83bfe8bf81603d919d6e892541eafece3720f34d1700b58024dadde247", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:plug, "~> 1.7", [hex: :plug, repo: "hexpm", optional: false]}, {:poison, "~> 3.0 or ~> 4.0 or ~> 5.0", [hex: :poison, repo: "hexpm", optional: true]}, {:ymlr, "~> 2.0 or ~> 3.0 or ~> 4.0", [hex: :ymlr, repo: "hexpm", optional: true]}], "hexpm", "aa3e6dcfc0ad6a02596b2172662da21c9dd848dac145ea9e603f54e3d81b8d2b"},
   "parse_trans": {:hex, :parse_trans, "3.4.1", "6e6aa8167cb44cc8f39441d05193be6e6f4e7c2946cb2759f015f8c56b76e5ff", [:rebar3], [], "hexpm", "620a406ce75dada827b82e453c19cf06776be266f5a67cff34e1ef2cbb60e49a"},
   "pbkdf2_elixir": {:hex, :pbkdf2_elixir, "1.2.1", "9cbe354b58121075bd20eb83076900a3832324b7dd171a6895fab57b6bb2752c", [:mix], [{:comeonin, "~> 5.3", [hex: :comeonin, repo: "hexpm", optional: false]}], "hexpm", "d3b40a4a4630f0b442f19eca891fcfeeee4c40871936fed2f68e1c4faa30481f"},
-  "phoenix": {:hex, :phoenix, "1.7.14", "a7d0b3f1bc95987044ddada111e77bd7f75646a08518942c72a8440278ae7825", [:mix], [{:castore, ">= 0.0.0", [hex: :castore, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:phoenix_pubsub, "~> 2.1", [hex: :phoenix_pubsub, repo: "hexpm", optional: false]}, {:phoenix_template, "~> 1.0", [hex: :phoenix_template, repo: "hexpm", optional: false]}, {:phoenix_view, "~> 2.0", [hex: :phoenix_view, repo: "hexpm", optional: true]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}, {:plug_cowboy, "~> 2.7", [hex: :plug_cowboy, repo: "hexpm", optional: true]}, {:plug_crypto, "~> 1.2 or ~> 2.0", [hex: :plug_crypto, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}, {:websock_adapter, "~> 0.5.3", [hex: :websock_adapter, repo: "hexpm", optional: false]}], "hexpm", "c7859bc56cc5dfef19ecfc240775dae358cbaa530231118a9e014df392ace61a"},
+  "phoenix": {:git, "https://github.com/feld/phoenix", "fb6dc76c657422e49600896c64aab4253fceaef6", [branch: "v1.7.14-websocket-headers"]},
   "phoenix_ecto": {:hex, :phoenix_ecto, "4.4.3", "86e9878f833829c3f66da03d75254c155d91d72a201eb56ae83482328dc7ca93", [:mix], [{:ecto, "~> 3.5", [hex: :ecto, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 2.14.2 or ~> 3.0 or ~> 4.0", [hex: :phoenix_html, repo: "hexpm", optional: true]}, {:plug, "~> 1.9", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "d36c401206f3011fefd63d04e8ef626ec8791975d9d107f9a0817d426f61ac07"},
   "phoenix_html": {:hex, :phoenix_html, "3.3.4", "42a09fc443bbc1da37e372a5c8e6755d046f22b9b11343bf885067357da21cb3", [:mix], [{:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm", "0249d3abec3714aff3415e7ee3d9786cb325be3151e6c4b3021502c585bf53fb"},
   "phoenix_live_dashboard": {:hex, :phoenix_live_dashboard, "0.8.3", "7ff51c9b6609470f681fbea20578dede0e548302b0c8bdf338b5a753a4f045bf", [:mix], [{:ecto, "~> 3.6.2 or ~> 3.7", [hex: :ecto, repo: "hexpm", optional: true]}, {:ecto_mysql_extras, "~> 0.5", [hex: :ecto_mysql_extras, repo: "hexpm", optional: true]}, {:ecto_psql_extras, "~> 0.7", [hex: :ecto_psql_extras, repo: "hexpm", optional: true]}, {:ecto_sqlite3_extras, "~> 1.1.7 or ~> 1.2.0", [hex: :ecto_sqlite3_extras, repo: "hexpm", optional: true]}, {:mime, "~> 1.6 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 0.19 or ~> 1.0", [hex: :phoenix_live_view, repo: "hexpm", optional: false]}, {:telemetry_metrics, "~> 0.6 or ~> 1.0", [hex: :telemetry_metrics, repo: "hexpm", optional: false]}], "hexpm", "f9470a0a8bae4f56430a23d42f977b5a6205fdba6559d76f932b876bfaec652d"},
diff --git a/test/pleroma/integration/mastodon_websocket_test.exs b/test/pleroma/integration/mastodon_websocket_test.exs
index f499f54ade..88f32762d5 100644
--- a/test/pleroma/integration/mastodon_websocket_test.exs
+++ b/test/pleroma/integration/mastodon_websocket_test.exs
@@ -268,6 +268,17 @@ test "accepts the 'user:notification' stream", %{token: token} = _state do
       end)
     end
 
+    test "accepts valid token on Sec-WebSocket-Protocol header", %{token: token} do
+      assert {:ok, _} = start_socket("?stream=user", [{"Sec-WebSocket-Protocol", token.token}])
+
+      capture_log(fn ->
+        assert {:error, %WebSockex.RequestError{code: 401}} =
+                 start_socket("?stream=user", [{"Sec-WebSocket-Protocol", "I am a friend"}])
+
+        Process.sleep(30)
+      end)
+    end
+
     test "accepts valid token on client-sent event", %{token: token} do
       assert {:ok, pid} = start_socket()
 

From 6a0883e5d33bd03fb3d71ad3a3560adc5ce6d626 Mon Sep 17 00:00:00 2001
From: feld <feld@feld.me>
Date: Fri, 16 Aug 2024 00:37:10 +0000
Subject: [PATCH 6/8] Merge branch 'bugfix-truncate-remote-user-fields' into
 'develop'

User: truncate remote user fields instead of rejecting

See merge request pleroma/pleroma!4220
---
 .../bugfix-truncate-remote-user-fields.fix        |  1 +
 lib/pleroma/user.ex                               |  2 ++
 test/pleroma/user_test.exs                        | 15 +++++++++++++++
 .../transmogrifier/user_update_handling_test.exs  |  4 ++--
 4 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/bugfix-truncate-remote-user-fields.fix

diff --git a/changelog.d/bugfix-truncate-remote-user-fields.fix b/changelog.d/bugfix-truncate-remote-user-fields.fix
new file mode 100644
index 0000000000..239a3c2247
--- /dev/null
+++ b/changelog.d/bugfix-truncate-remote-user-fields.fix
@@ -0,0 +1 @@
+Truncate remote user fields, avoids them getting rejected
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index e28d76a7c8..4f6cdc03e7 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -463,6 +463,7 @@ defp fix_follower_address(params), do: params
   def remote_user_changeset(struct \\ %User{local: false}, params) do
     bio_limit = Config.get([:instance, :user_bio_length], 5000)
     name_limit = Config.get([:instance, :user_name_length], 100)
+    fields_limit = Config.get([:instance, :max_remote_account_fields], 0)
 
     name =
       case params[:name] do
@@ -476,6 +477,7 @@ def remote_user_changeset(struct \\ %User{local: false}, params) do
       |> Map.put_new(:last_refreshed_at, NaiveDateTime.utc_now())
       |> truncate_if_exists(:name, name_limit)
       |> truncate_if_exists(:bio, bio_limit)
+      |> Map.update(:fields, [], &Enum.take(&1, fields_limit))
       |> truncate_fields_param()
       |> fix_follower_address()
 
diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs
index 036ae78fbe..06afc0709b 100644
--- a/test/pleroma/user_test.exs
+++ b/test/pleroma/user_test.exs
@@ -1075,6 +1075,21 @@ test "it is invalid given a local user" do
 
       refute cs.valid?
     end
+
+    test "it truncates fields" do
+      clear_config([:instance, :max_remote_account_fields], 2)
+
+      fields = [
+        %{"name" => "One", "value" => "Uno"},
+        %{"name" => "Two", "value" => "Dos"},
+        %{"name" => "Three", "value" => "Tres"}
+      ]
+
+      cs = User.remote_user_changeset(@valid_remote |> Map.put(:fields, fields))
+
+      assert [%{"name" => "One", "value" => "Uno"}, %{"name" => "Two", "value" => "Dos"}] ==
+               Ecto.Changeset.get_field(cs, :fields)
+    end
   end
 
   describe "followers and friends" do
diff --git a/test/pleroma/web/activity_pub/transmogrifier/user_update_handling_test.exs b/test/pleroma/web/activity_pub/transmogrifier/user_update_handling_test.exs
index da46f063ac..851c60850a 100644
--- a/test/pleroma/web/activity_pub/transmogrifier/user_update_handling_test.exs
+++ b/test/pleroma/web/activity_pub/transmogrifier/user_update_handling_test.exs
@@ -119,8 +119,8 @@ test "it works with custom profile fields" do
     user = User.get_cached_by_ap_id(user.ap_id)
 
     assert user.fields == [
-             %{"name" => "foo", "value" => "updated"},
-             %{"name" => "foo1", "value" => "updated"}
+             %{"name" => "foo", "value" => "bar"},
+             %{"name" => "foo11", "value" => "bar11"}
            ]
 
     update_data =

From 7bb2dccc058cd1659ab21942b06657abf9127365 Mon Sep 17 00:00:00 2001
From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Date: Tue, 26 Nov 2024 14:09:09 +0100
Subject: [PATCH 7/8] Version 2.7.1

---
 CHANGELOG.md                                       | 12 ++++++++++++
 changelog.d/bugfix-truncate-remote-user-fields.fix |  1 -
 changelog.d/follow-validator.fix                   |  1 -
 changelog.d/following-state.fix                    |  1 -
 changelog.d/mailgun.fix                            |  1 -
 changelog.d/mastodon-websocket.fix                 |  1 -
 changelog.d/well-known.change                      |  1 -
 mix.exs                                            |  2 +-
 8 files changed, 13 insertions(+), 7 deletions(-)
 delete mode 100644 changelog.d/bugfix-truncate-remote-user-fields.fix
 delete mode 100644 changelog.d/follow-validator.fix
 delete mode 100644 changelog.d/following-state.fix
 delete mode 100644 changelog.d/mailgun.fix
 delete mode 100644 changelog.d/mastodon-websocket.fix
 delete mode 100644 changelog.d/well-known.change

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 61bb2ab543..424a9afbb3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2.7.1
+
+### Changed
+- Accept `application/activity+json` for requests to `/.well-known/nodeinfo`
+
+### Fixed
+- Truncate remote user fields, avoids them getting rejected
+- Improve the `FollowValidator` to successfully incoming activities with an errant `cc` field.
+- Resolved edge case where the API can report you are following a user but the relationship is not fully established.
+- The Swoosh email adapter for Mailgun was missing a new dependency on `:multipart`
+- Fix Mastodon WebSocket authentication
+
 ## 2.7.0
 
 ### Security
diff --git a/changelog.d/bugfix-truncate-remote-user-fields.fix b/changelog.d/bugfix-truncate-remote-user-fields.fix
deleted file mode 100644
index 239a3c2247..0000000000
--- a/changelog.d/bugfix-truncate-remote-user-fields.fix
+++ /dev/null
@@ -1 +0,0 @@
-Truncate remote user fields, avoids them getting rejected
diff --git a/changelog.d/follow-validator.fix b/changelog.d/follow-validator.fix
deleted file mode 100644
index d49932b7b3..0000000000
--- a/changelog.d/follow-validator.fix
+++ /dev/null
@@ -1 +0,0 @@
-Improve the FollowValidator to successfully incoming activities with an errant cc field.
diff --git a/changelog.d/following-state.fix b/changelog.d/following-state.fix
deleted file mode 100644
index 314ea62102..0000000000
--- a/changelog.d/following-state.fix
+++ /dev/null
@@ -1 +0,0 @@
-Resolved edge case where the API can report you are following a user but the relationship is not fully established.
diff --git a/changelog.d/mailgun.fix b/changelog.d/mailgun.fix
deleted file mode 100644
index 8555887526..0000000000
--- a/changelog.d/mailgun.fix
+++ /dev/null
@@ -1 +0,0 @@
-The Swoosh email adapter for Mailgun was missing a new dependency on :multipart
diff --git a/changelog.d/mastodon-websocket.fix b/changelog.d/mastodon-websocket.fix
deleted file mode 100644
index 2c4fe86ef6..0000000000
--- a/changelog.d/mastodon-websocket.fix
+++ /dev/null
@@ -1 +0,0 @@
-Fix Mastodon WebSocket authentication
diff --git a/changelog.d/well-known.change b/changelog.d/well-known.change
deleted file mode 100644
index e928124fbc..0000000000
--- a/changelog.d/well-known.change
+++ /dev/null
@@ -1 +0,0 @@
-Accept application/activity+json for requests to .well-known/nodeinfo
diff --git a/mix.exs b/mix.exs
index 88140c69b3..2448b0c662 100644
--- a/mix.exs
+++ b/mix.exs
@@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
   def project do
     [
       app: :pleroma,
-      version: version("2.7.0"),
+      version: version("2.7.1"),
       elixir: "~> 1.13",
       elixirc_paths: elixirc_paths(Mix.env()),
       compilers: Mix.compilers(),

From 3f98c8bd1b86a87e204879da4172178173050638 Mon Sep 17 00:00:00 2001
From: kPherox <kphrx@kpherox.dev>
Date: Wed, 27 Nov 2024 15:45:14 +0900
Subject: [PATCH 8/8] fix: skip directory entries

In OTP 27.1 or later, `:zip.unzip/2` without `:skip_directories` option returns directory entries.
However in OTP 26, passing `:skip_directories` returns a `:bad_option` error, so this option is not available for compatibility.
---
 lib/pleroma/frontend.ex | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/frontend.ex b/lib/pleroma/frontend.ex
index 8164999174..a4f427ae5e 100644
--- a/lib/pleroma/frontend.ex
+++ b/lib/pleroma/frontend.ex
@@ -74,11 +74,14 @@ def unzip(zip, dest) do
 
         new_file_path = Path.join(dest, path)
 
-        new_file_path
+        path
         |> Path.dirname()
+        |> then(&Path.join(dest, &1))
         |> File.mkdir_p!()
 
-        File.write!(new_file_path, data)
+        if not File.dir?(new_file_path) do
+          File.write!(new_file_path, data)
+        end
       end)
     end
   end