21.json (4589B)
1 { 2 "number": 21, 3 "title": "chore(deps): update ghcr.io/t2bot/matrix-media-repo docker tag to v1.3.8", 4 "state": "merged", 5 "diff_file": "21.diff", 6 "author": "renovate[bot]", 7 "created_at": "2025-12-07T20:08:35Z", 8 "closed_at": "2025-12-07T20:41:22Z", 9 "merged_at": "2025-12-07T20:41:22Z", 10 "base_ref": "main", 11 "head_ref": "renovate/security-updates", 12 "labels": [ 13 "type/patch-update" 14 ], 15 "assignees": [], 16 "requested_reviewers": [], 17 "body": "This PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [ghcr.io/t2bot/matrix-media-repo](https://redirect.github.com/t2bot/matrix-media-repo) | patch | `v1.3.7` -> `v1.3.8` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>t2bot/matrix-media-repo (ghcr.io/t2bot/matrix-media-repo)</summary>\n\n### [`v1.3.8`](https://redirect.github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8)\n\n[Compare Source](https://redirect.github.com/t2bot/matrix-media-repo/compare/v1.3.7...v1.3.8)\n\n##### Security\n\n- Limit untrusted decoders during thumbnailing ([GHSA-rcxc-wjgw-579r](https://redirect.github.com/t2bot/matrix-media-repo/security/advisories/GHSA-rcxc-wjgw-579r) / [CVE-2024-56515](https://www.cve.org/CVERecord?id=CVE-2024-56515))\n- Improve handling of JSON ([GHSA-gp86-q8hg-fpxj](https://redirect.github.com/t2bot/matrix-media-repo/security/advisories/GHSA-gp86-q8hg-fpxj) / [CVE-2024-52791](https://www.cve.org/CVERecord?id=CVE-2024-52791))\n- Fix SSRF issues ([GHSA-r6jg-jfv6-2fjv](https://redirect.github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2fjv) / [CVE-2024-52602](https://www.cve.org/CVERecord?id=CVE-2024-52602))\n\n##### Added\n\n- Allow guests to access uploaded media, as per [MSC4189](https://redirect.github.com/matrix-org/matrix-spec-proposals/pull/4189).\n- The thumbnailer can now be run independently with the `thumbnailer` binary. See `thumbnailer -help` for details.\n\n##### Changed\n\n- MMR now requires Go 1.22 for compilation.\n- MMR now builds on a base image of `alpine:3.21`.\n- The global `repo.freezeUnauthenticatedMedia` option now defaults to `true`, enabling authenticated media by default. A future release will remove this option, requiring the freeze behaviour. See `config.sample.yaml` for details.\n- For SVG and JPEGXL files, ImageMagick 7 is now required.\n- For MP4 files, ffmpeg 6 or 7 (use 7 for best results) is now required.\n\n##### Fixed\n\n- Return a 404 instead of 500 when clients access media which is frozen.\n- Return a 403 instead of 500 when guests access endpoints that are for registered users only.\n- Ensure the request parameters are correctly set for authenticated media client requests.\n- Ensure remote signing keys expire after at most 7 days.\n- Fixed parsing of `Authorization` headers for federated servers.\n- Ensure `ignoredHosts` is applied to unauthenticated requests.\n\n</details>\n\n---\n\n### Configuration\n\n\ud83d\udcc5 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).\n\n\ud83d\udea6 **Automerge**: Enabled.\n\n\u267b **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\ud83d\udd15 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/MTRNord/cluster).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4zMi4yIiwidXBkYXRlZEluVmVyIjoiNDIuMzIuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9wYXRjaC11cGRhdGUiXX0=-->\n", 18 "comments": [ 19 { 20 "author": "github-advanced-security[bot]", 21 "created_at": "2025-12-07T20:09:21Z", 22 "body": "This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/MTRNord/cluster/security/code-scanning?query=pr%3A21+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). " 23 } 24 ], 25 "review_comments": [] 26 }