cluster.meta

Issues/PRs archive for MTRNord/cluster
git clone git://archive.git.mtrnord.blog/MTRNord/cluster.meta.git
Log | Files | Refs

21.md (4260B)

      1 # PR #21 chore(deps): update ghcr.io/t2bot/matrix-media-repo docker tag to v1.3.8
      2 
      3 - **Status:** merged
      4 - **Author:** @renovate[bot]
      5 - **Created:** 2025-12-07T20:08:35Z
      6 - **Branch:** renovate/security-updates → main
      7 - **Merged:** 2025-12-07T20:41:22Z
      8 - **Labels:** type/patch-update
      9 - **Diff:** [21.diff](./21.diff)
     10 
     11 ---
     12 
     13 This PR contains the following updates:
     14 
     15 | Package | Update | Change |
     16 |---|---|---|
     17 | [ghcr.io/t2bot/matrix-media-repo](https://redirect.github.com/t2bot/matrix-media-repo) | patch | `v1.3.7` -> `v1.3.8` |
     18 
     19 ---
     20 
     21 ### Release Notes
     22 
     23 <details>
     24 <summary>t2bot/matrix-media-repo (ghcr.io/t2bot/matrix-media-repo)</summary>
     25 
     26 ### [`v1.3.8`](https://redirect.github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8)
     27 
     28 [Compare Source](https://redirect.github.com/t2bot/matrix-media-repo/compare/v1.3.7...v1.3.8)
     29 
     30 ##### Security
     31 
     32 - Limit untrusted decoders during thumbnailing ([GHSA-rcxc-wjgw-579r](https://redirect.github.com/t2bot/matrix-media-repo/security/advisories/GHSA-rcxc-wjgw-579r) / [CVE-2024-56515](https://www.cve.org/CVERecord?id=CVE-2024-56515))
     33 - Improve handling of JSON ([GHSA-gp86-q8hg-fpxj](https://redirect.github.com/t2bot/matrix-media-repo/security/advisories/GHSA-gp86-q8hg-fpxj) / [CVE-2024-52791](https://www.cve.org/CVERecord?id=CVE-2024-52791))
     34 - Fix SSRF issues ([GHSA-r6jg-jfv6-2fjv](https://redirect.github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2fjv) / [CVE-2024-52602](https://www.cve.org/CVERecord?id=CVE-2024-52602))
     35 
     36 ##### Added
     37 
     38 - Allow guests to access uploaded media, as per [MSC4189](https://redirect.github.com/matrix-org/matrix-spec-proposals/pull/4189).
     39 - The thumbnailer can now be run independently with the `thumbnailer` binary. See `thumbnailer -help` for details.
     40 
     41 ##### Changed
     42 
     43 - MMR now requires Go 1.22 for compilation.
     44 - MMR now builds on a base image of `alpine:3.21`.
     45 - The global `repo.freezeUnauthenticatedMedia` option now defaults to `true`, enabling authenticated media by default. A future release will remove this option, requiring the freeze behaviour. See `config.sample.yaml` for details.
     46 - For SVG and JPEGXL files, ImageMagick 7 is now required.
     47 - For MP4 files, ffmpeg 6 or 7 (use 7 for best results) is now required.
     48 
     49 ##### Fixed
     50 
     51 - Return a 404 instead of 500 when clients access media which is frozen.
     52 - Return a 403 instead of 500 when guests access endpoints that are for registered users only.
     53 - Ensure the request parameters are correctly set for authenticated media client requests.
     54 - Ensure remote signing keys expire after at most 7 days.
     55 - Fixed parsing of `Authorization` headers for federated servers.
     56 - Ensure `ignoredHosts` is applied to unauthenticated requests.
     57 
     58 </details>
     59 
     60 ---
     61 
     62 ### Configuration
     63 
     64 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
     65 
     66 🚦 **Automerge**: Enabled.
     67 
     68 ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
     69 
     70 🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
     71 
     72 ---
     73 
     74  - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
     75 
     76 ---
     77 
     78 This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/MTRNord/cluster).
     79 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4zMi4yIiwidXBkYXRlZEluVmVyIjoiNDIuMzIuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9wYXRjaC11cGRhdGUiXX0=-->
     80 
     81 
     82 
     83 ## Comments
     84 
     85 ### @github-advanced-security[bot] — 2025-12-07T20:09:21Z
     86 
     87 This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/MTRNord/cluster/security/code-scanning?query=pr%3A21+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). 
     88