LoginSign Up
← Back to all sparks
P

Pixelfed

COMMS
Velocity5.0

Federated photo sharing platform you self-host

pixelfed.org ↗

Pixelfed 0.15.2 ships the PHP RCE patches and turns cached timelines on for everyone.

fediverseactivitypubphoto-sharingsecurityself-hosted
◆Current state
Pixelfed v0.15.2 is an urgent security update: Docker images pick up the patched PHP for this month's two remote code execution CVEs and are rebuilt with updated CAs after the eMudhra compromise. It also makes cached timelines the default, removing two experimental flags, and bundles timeline and WebFinger fixes.
◆Where it's heading
Pixelfed has moved quickly through 0.14.5 and 0.15 with federation fixes and new APIs, and now an upstream security patch. The notes say heavy refactoring will continue toward a Nuxt-based web UI, so the near term is more churn in the front end.
◆Prediction
Expect more 0.15.x patches for regressions from the refactor, with the Nuxt web UI as the next visible milestone.

◆Recent moves

  1. 7d ago

    v0.15.2 - Security Update: PHP RCE + CA Update Compromise

    A security release that pulls in patched PHP for the October RCE CVEs and rebuilt CA bundles, and makes cached timelines the default for all instances. Non-Docker admins are told to update packages immediately.

    View source ↗
  2. 11d ago

    v0.15.1 - Fix Languages regression

    v0.15.1 updates the translation files and bumps Laravel to fix a language regression in 0.15.0. Upgrading requires no migrations or extra steps.

    View source ↗
  3. 16d ago

    Pixelfed 0.15 RC adds account-delete API, drops PHP 8.3

    0.15.0-rc1 adds an account deletion API, quadruples the hashtag follow limit, fixes reblog display in Mastodon clients and drops PHP 8.3. The runtime bump is the main upgrade cost for self-hosters.

    View source ↗
  4. 22d ago

    Pixelfed 0.14.5 RC fixes boost federation, adds FEP-6757

    0.14.5-rc1 fixes boost federation, adds FEP-6757 support and preserves ICC color profiles on resize. It continues the run of federation correctness fixes.

    View source ↗
  5. 1mo ago

    v0.12.12

    0.12.12 fixes a language regression, moves locales to BCP 47 tags and refactors captchas to support hCaptcha, Turnstile and Cap. It renames the captcha environment variables, so admins need to update their config.

    View source ↗