Hello hello, happy new year (it’s march) it’s the first release of the year (it’s march) for you!
This time being both a maintenance and a feature release. How fun.
The most obvious big change in this release is the replacement of the Direct Message timeline in the frontend with a conversations view, but there are many more small tweaks, compatibility improvements and bug fixes. Notably also two security fixes, so make sure to upgrade soon!
Here are some highlights for you, for more details see the backend CHANGELOG.md and frontend CHANGELOG.MD.
New stuff
Conversations
The old dm timeline API has been deprecated for a while and mixed all different DM chats you had into one common timeline making it confusing to follow a single thread, and on top of that it was bugged on large and/or old servers.
The new conversations view gives you a separate timeline for each thread and an overview over all threads with read markers. There may be more enhancements to this in the future, but it’s already much better than the old dm timeline (and allows us to get rid of some technical burdens next release when the dm timeline API will be removed).
If you use other clients than akkoma-fe you might have already used a variant of this,
but it turned out the existing implementation we inherited was quiiiittee buggy.
Things should be better now for you too.
Repeat date and visibility
A small one: repeats now show their date (as claimed by the originating server) and visibility in akkoma-fe.
WebFinger backlinks in AP actors (FEP-2c59)
This makes it easier for us and others to discover the preferred WebFinger domain.
I.e. if you set up your Akkoma instance which is available as fedi.example.org to use nicks like eri@example.org instead of eri@fedi.example.org for your users, this will now be obvious to other servers (if they read this property).
Miscellaneous
Some more noteworthy tweaks and fixes to highlight:
-
several compatability improvements with Mastodon-only clients for features originally introduced as *oma extensions and later adopted (similarly) by Mastodon under a different endpoint; many of them contributed by mkljczk, thanks!
-
notifications about muted entities are no longer streamed out
-
it is now possible to quote local and one’s own private posts provided a compatible scope is used
-
logs now tell you which activities couldn’t be delivered at all to a particular remote inbox
-
profile info updates are again actively federated out to followers; this accidentally broke last release… orz
Security
-
Fixed possible leakage of private posts to local users on your instance if they know the posts ID (again; last time hopefully)
-
Fixed WebFinger validation. It sometimes allowed unrelated domains to non-consensually assign nicknames to users, and users to usurp existing nicknames from unrelated domains. Now no longer. As a result some poorly setup custom WebFinger domain handles may cease to be respected falling back to the full instance domain in the nick. Instances supporting FEP-2c59 should basically always work unless the WebFinger setup is completely broken.
If you have any bad nicknames (and didn’t mess with undocumented config options), it will resolve itself at the next refresh of the affected user.
Technical notes
Elixir 1.14 EOL
To avoid a barrage of compiler warnings on newer Elixir, we had to drop support for 1.14.
However 1.14 is already EOL anyway (so in theory nobody should be using it anymore).
If for some reason you’re currently stuck at 1.14, can’t quickly upgrade but want the security fixes,
you can instead upgrade to the last commit before 1.14 support was dropped, and additionally cherry-pick this commit: 43d33d7cf59840bb27a128fb02f749fe34aedd57
Truncating embedded nodeinfo
The API used to return a full copy of each user’s instance nodeinfo in responses.
As far as we are aware akkoma-fe is the only user of this and only needs a few select fields.
Since the full version can blow up API response sizes significantly
(and made worse by some Masto-compat tweaks in this release) we now only return the actually used fields.
If you are using some client relying on more we are unaware of, there temporarily is a config setting to sent the full data again giving you a quick workaround. However, make sure to let us know so we can add the necessary fields by default. If we don’t hear anything, this setting will be removed very soon!
Reminder: deprecations
Small reminder about last release’s deprecations!
No complaints were raised, so we might start actually removing these configs and API endpoints soon now.
Upgrading
Same as ever! Updating your instance - Akkoma Documentation
Don’t forget to upgrade all your frontends too!
No database migrations this time!
Floti-postscript: As ever, my undying thanks for oneric for a lot of the backend stuff! I only wrote the tests for the webfinger stuff and my head could barely contain it, no clue how you do it but I am very grateful that you do.
Post-postscript who called it webfinger anyhow, like who thought “hm yes the verb we should use for looking someone up is ‘fingering’”? I just want to talk to them.