Skip to content

feat(oci/gotosocial): update 0.21.3 ➼ 0.22.2 - #6313

Open
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/docker.io-superseriousbusiness-gotosocial-0.x
Open

tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/docker.io-superseriousbusiness-gotosocial-0.x

Conversation

@tinfoild

@tinfoild tinfoild Bot commented Jun 29, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
docker.io/superseriousbusiness/gotosocial (source) minor 0.21.3 → 0.22.2

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

superseriousbusiness/gotosocial (docker.io/superseriousbusiness/gotosocial)

v0.22.2: Shrubbiest Sloth 🌿🌿🌿

Compare Source

Here's a bugfix release! v0.22.2 Shrubbiest Sloth 🌿🌿🌿!

If you're updating to this version from v0.22.x, it's a very easy update with no db migrations.

If you're updating to this version from a version before v0.22.0, please follow the update instructions from v0.22.0, but replace 0.22.0 with 0.22.2 throughout. Be aware that the update to 0.22.x contains some serious database migrations. Please do read the notes carefully!

If you're on current main/snapshot, stay there. You already have bugfixes from here, and going backwards won't work.

Release highlights
  • Update dependencies to allow building on Go v1.27.
  • Tighten some auth functions to fix a two-factor authentication (2FA) security bug whereby an attacker who already knows a victim's email address + password, ie., the first factor authentication, could bypass having to input a code from an authenticator app, ie., the second factor of authentication, and obtain an OAuth token for that account. This bug only affects 2FA, and again, only in cases where an attacker already knows their victim's email address + password.
Migration notes
Upgrading

To upgrade to v0.22.2 from a previous release:

Binary/tar
  1. Stop GoToSocial.
  2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup. On Postgres you can do this with pg_dump.
  3. Download and untar the new release, including the web assets and html templates, not just the binary.
  4. Edit your config.yaml file if necessary (see below).
  5. Start GoToSocial.
  6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
  7. Enjoy your updated instance.
Docker
  1. Stop GoToSocial.
  2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup. On Postgres you can do this with pg_dump.
  3. Pull the new docker container with docker pull docker.io/superseriousbusiness/gotosocial:0.22.2 or docker pull docker.io/superseriousbusiness/gotosocial:latest if this is a stable release and not a release candidate.
  4. Edit your config.yaml file or environment variables if necessary (see below).
  5. Start GoToSocial.
  6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
  7. Enjoy your updated instance.
config.yaml

No changes since v0.22.x.

Database Migrations

No migrations since v0.22.x.

Which release archive/container should I use?

GoToSocial releases binary builds for 64-bit Linux, FreeBSD, and NetBSD operating systems. We also release Docker builds for 64-bit Linux.

OS Architecture Support level Binary archive Docker
Linux x86-64/AMD64 (64-bit) 🟢 Full linux_amd64.tar.gz docker.io/superseriousbusiness/gotosocial:0.22.2
Linux Armv8/ARM64 (64-bit) 🟢 Full linux_arm64.tar.gz docker.io/superseriousbusiness/gotosocial:0.22.2
FreeBSD x86-64/AMD64 (64-bit) 🟢 Full freebsd_amd64.tar.gz Not provided
FreeBSD Armv8/ARM64 (64-bit) 🟢 Full freebsd_arm64.tar.gz Not provided
NetBSD x86-64/AMD64 (64-bit) 🟢 Full netbsd_amd64.tar.gz Not provided
NetBSD Armv8/ARM64 (64-bit) 🟢 Full netbsd_arm64.tar.gz Not provided
nowasm

For your convenience, we also provide UNSUPPORTED, EXPERIMENTAL BUILDS, created using the nowasm tag, in the downloads list below. There is no Docker build for nowasm.

GoToSocial releases built with nowasm use the Go-native, modernc version of SQLite instead of the WASM one, and will use on-system ffmpeg and ffprobe binaries for media processing.

Using a nowasm build is currently the only way to run GoToSocial on a 32-bit system.

For more information on running a nowasm build, see the nowasm documentation page.

Changelog
Bug fixes
  • fb2bf13 [bugfix] tighten auth requirements for mustUserFromSession
Other

v0.22.1: Shrubbier Sloth 🌿🌿

Compare Source

Hello hello, here's a bugfix release! v0.22.1 Shrubbier Sloth 🌿🌿!

If you're updating to this version from v0.22.0, it's a very easy update with no db migrations.

If you're updating to this version from a version before v0.22.0, please follow the update instructions from v0.22.0, but replace 0.22.0 with 0.22.1 throughout. Be aware that the update to 0.22.x contains some serious database migrations. Please do read the notes carefully!

If you're on current main/snapshot, stay there. You already have all the bugfixes from here, and going backwards won't work.

Release highlights
  • Bug fixes!
  • Hide instance directory link when directory is not enabled.
  • Few dependency updates.
  • Add more gay kissing to the code.
Migration notes
Upgrading

To upgrade to v0.22.1 from a previous release:

Binary/tar
  1. Stop GoToSocial.
  2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup. On Postgres you can do this with pg_dump.
  3. Download and untar the new release, including the web assets and html templates, not just the binary.
  4. Edit your config.yaml file if necessary (see below).
  5. Start GoToSocial.
  6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
  7. Enjoy your updated instance.
Docker
  1. Stop GoToSocial.
  2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup. On Postgres you can do this with pg_dump.
  3. Pull the new docker container with docker pull docker.io/superseriousbusiness/gotosocial:0.22.1 or docker pull docker.io/superseriousbusiness/gotosocial:latest if this is a stable release and not a release candidate.
  4. Edit your config.yaml file or environment variables if necessary (see below).
  5. Start GoToSocial.
  6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
  7. Enjoy your updated instance.
config.yaml

No changes since v0.22.x.

Database Migrations

No migrations since v0.22.x.

Which release archive/container should I use?

GoToSocial releases binary builds for 64-bit Linux, FreeBSD, and NetBSD operating systems. We also release Docker builds for 64-bit Linux.

OS Architecture Support level Binary archive Docker
Linux x86-64/AMD64 (64-bit) 🟢 Full linux_amd64.tar.gz docker.io/superseriousbusiness/gotosocial:0.22.1
Linux Armv8/ARM64 (64-bit) 🟢 Full linux_arm64.tar.gz docker.io/superseriousbusiness/gotosocial:0.22.1
FreeBSD x86-64/AMD64 (64-bit) 🟢 Full freebsd_amd64.tar.gz Not provided
FreeBSD Armv8/ARM64 (64-bit) 🟢 Full freebsd_arm64.tar.gz Not provided
NetBSD x86-64/AMD64 (64-bit) 🟢 Full netbsd_amd64.tar.gz Not provided
NetBSD Armv8/ARM64 (64-bit) 🟢 Full netbsd_arm64.tar.gz Not provided
nowasm

For your convenience, we also provide UNSUPPORTED, EXPERIMENTAL BUILDS, created using the nowasm tag, in the downloads list below. There is no Docker build for nowasm.

GoToSocial releases built with nowasm use the Go-native, modernc version of SQLite instead of the WASM one, and will use on-system ffmpeg and ffprobe binaries for media processing.

Using a nowasm build is currently the only way to run GoToSocial on a 32-bit system.

For more information on running a nowasm build, see the nowasm documentation page.

Changelog
Bug fixes
  • 26b61ae [bugfix] Restore accidentally-removed outgoing http proxy config (#​4954)
  • 1764961 [bugfix] recent tweaking broke the pollJustClosed() heuristic by forgetting a time.Time{}.IsZero() check, this fixes that (#​4938)
  • 2813e6c [bugfix] add checks for status creation date to status timelining, to prevent notifications of new-old statuses (#​4935)
  • 086c6fb [bugfix] old (expired) remote polls awaiting dereference still show as votable (#​4927)
  • 0605b8f [bugfix] Include instance.domain in undeliverable instances query for Postgres (#​4926)
  • d1107d2 [bugfix/frontend] don't link to /directory when it is disabled (#​4917)
  • e54e92c [bugfix] Set status_id to NULL when unattaching attachments from deleted local statuses (#​4922)
Chores & version bumps
  • fdff42b [chore/v0.22.1 back compat] Remove stray line in internal/api/client/polls
  • 809723c [chore] update dependencies (#​4933)
  • 9d162cb [chore] Pointless emoji comment formatting to trigger a snapshot (#​4956)
  • 19bb83b [chore] Update gotosocial-woodpecker-build to v0.13.0; use git for changelog instead of gitea (#​4955)
Documentation

v0.22.0: Shrubby Sloth 🌿

Compare Source

Hello! Hello! Is it sloth you're looking for? I can see it in your eyes!

Here's version 0.22.0 of GoToSocial, aka Shrubby Sloth 🌿.

This is a big feature release that contains support for relay subscriptions and relay push connections, a new instance account directory, better threading using tombstones for deleted statuses,, and support for auto-cleanup of old remote statuses, among lots of other things!

⚠️⚠️⚠️ Please read the migration notes carefully for instructions on how to upgrade to this version, in particular note that there are several config file changes that need to be addressed when you're updating from a previous version of GoToSocial to this version.

This release also contains a long-ass database migration to move status boolean columns (like pinned, local, etc) to a single bitfield column. This saves a lot of space in the database, but it also means on startup the migration has to iterate through all statuses in your database and set the new field. Please be patient and don't interrupt this process! ⚠️⚠️⚠️

Release highlights
  • Relay support: GoToSocial now supports subscribing to relays (as an admin action), and pushing posts to relays (configured per-user, with filters available).
    Documentation for admin-level relay subscriptions.
    Documentation for user-level relays pushes.
  • Automated cleanup of old remote posts: you can now configure your instance to clean up threads of remote statuses that haven't been interacted with by anyone on your instance. This should save a lot of space in folks' databases!
    Documentation for post caching + pruning.
  • Delivery error tracking for remote instances: there's now a page in the settings panel where admin can view errors encountered while attempting delivery of posts to instances that may be experiencing technical difficulties or may have gone offline. You can use this to get a quick view on possible "dead" instances that you can then remove from your database with a domain block.
  • Accounts directory: there's a new setting to allow admins to expose (or not) a directory of accounts on the instance! Your account will only be shown in the directory if you opt in via your privacy settings.
    Documentation for inclusion in account directory.
  • Better tracking of deleted statuses/status tombstones: GtS now stores tombstones for deleted statuses, allowing threads to remain intact even when a status in the middle of the thread has been deleted.
  • Better status codes + info pages on deleted or hidden statuses: the old 404 page when you try to open a hidden status in the browser has been replaced with a more informative error page.
  • Way more configurable http server + client options: we've exposed a whole shitload of settings that you can tweak on the HTTP client + HTTP server that GoToSocial uses. We don't recommend changing these, but if you really want to, now you can.
  • Show your Träwelling status on your profile by setting your Träwelling page as a field value, similar to how our ListenBrainz integration already works.
  • Allow setting a name for your tokens, and sorting tokens by last used time in the token view of the settings page. Should make it a lot easier to track which tokens you've created, and when they were used by which apps!
  • Better layout for web view of profiles that hide all posts from the web: it just uses a single-column view now.
Migration notes
Upgrading

To upgrade to v0.22.0 from a previous release:

Binary/tar
  1. Stop GoToSocial.
  2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup. On Postgres you can do this with pg_dump.
  3. Download and untar the new release, including the web assets and html templates, not just the binary.
  4. Edit your config.yaml file if necessary (see below).
  5. Start GoToSocial.
  6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
  7. Enjoy your updated instance.
Docker
  1. Stop GoToSocial.
  2. Back up your database! If you're running on SQLite, this is as simple as copying your sqlite.db file, eg., cp sqlite.db sqlite.db.backup. On Postgres you can do this with pg_dump.
  3. Pull the new docker container with docker pull docker.io/superseriousbusiness/gotosocial:0.22.0 or docker pull docker.io/superseriousbusiness/gotosocial:latest if this is a stable release and not a release candidate.
  4. Edit your config.yaml file or environment variables if necessary (see below).
  5. Start GoToSocial.
  6. Wait patiently for any migrations to run, do not interrupt migrations or you could leave your db in a broken state and will have to restore from backup!
  7. Enjoy your updated instance.
config.yaml

The configuration file has changed since the previous release; you will need to update at least the config options that were removed + replaced (see below).

  • Removed instance-subscriptions-process-from and instance-subscriptions-process-every, replaced them with instance-subscriptions-process-cron with a default value of 0 23 * * * (every night @​ 11pm).
  • Removed media-cleanup-from and media-cleanup-every, replaced them with media-cleanup-cron with a default value of 0 0 * * * (every night @​ midnight).
  • Removed media-remote-cache-days, replaced with media-remote-cache-duration with a default value of 7 days.
  • Added instance-directory-mode set to webonly by default.
  • Added instance-robots-allow-indexing set to false by default.
  • Added storage-s3-region.
  • Added statuses-cleanup-cron with a default value of 0 1 * * 0, ie., at 1am every Sunday.
  • Added statuses-cleanup-remote-older-than with a default value of 0s (don't cleanup statuses).
  • Added smtp-from-display-name, allowing you to customize the display name used by sent admin emails.
  • Updated http-client.timeout default from 30s to 1m which was already used internally.
  • Added many more (commented out) http client options.
  • Added many (commented out) http server options.

You can see a diff of the config file here: https://codeberg.org/superseriousbusiness/gotosocial/compare/v0.21.3...v0.22.0#diff-c071e03510b2c57e193a44503fd9528a785f0f411497cc75841a9f8d0b1ac622

Database Migrations

⚠️⚠️⚠️ This release contains a long-ass database migration to move status boolean columns (like pinned, local, etc) to a single bitfield column. This saves a lot of space in the database, but it also means on startup the migration has to iterate through all statuses in your database and set the new field. Please be patient and don't interrupt this process! ⚠️⚠️⚠️

@​ Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check our Postgres database maintenance documentation for steps on how to do this using the psql tool.

Which release archive/container should I use?

GoToSocial releases binary builds for 64-bit Linux, FreeBSD, and NetBSD operating systems. We also release Docker builds for 64-bit Linux.

OS Architecture Support level Binary archive Docker
Linux x86-64/AMD64 (64-bit) 🟢 Full linux_amd64.tar.gz docker.io/superseriousbusiness/gotosocial:0.22.0
Linux Armv8/ARM64 (64-bit) 🟢 Full linux_arm64.tar.gz docker.io/superseriousbusiness/gotosocial:0.22.0
FreeBSD x86-64/AMD64 (64-bit) 🟢 Full freebsd_amd64.tar.gz Not provided
FreeBSD Armv8/ARM64 (64-bit) 🟢 Full freebsd_arm64.tar.gz Not provided
NetBSD x86-64/AMD64 (64-bit) 🟢 Full netbsd_amd64.tar.gz Not provided
NetBSD Armv8/ARM64 (64-bit) 🟢 Full netbsd_arm64.tar.gz Not provided
nowasm

For your convenience, we also provide UNSUPPORTED, EXPERIMENTAL BUILDS, created using the nowasm tag, in the downloads list below. There is no Docker build for nowasm.

GoToSocial releases built with nowasm use the Go-native, modernc version of SQLite instead of the WASM one, and will use on-system ffmpeg and ffprobe binaries for media processing.

Using a nowasm build is currently the only way to run GoToSocial on a 32-bit system.

For more information on running a nowasm build, see the nowasm documentation page.

Changelog
Features and performance
  • 0419b4d [performance] Use CROSS JOIN LATERAL for Postgres home timeline queries (#​4891)
  • 8737f05 [feature] Unfollow relay actor if no connections exist targeting that actor (#​4880)
  • 3fe273c [feature] Show explanation when user shows no posts on the web (#​4846)
  • a77b44c [feature] better error pages + handling for hidden or gone statuses (#​4840)
  • cc3af19 [feature] Allow sorting access tokens by last_used, allow setting name per access token (#​4833)
  • b765e74 [feature] Forward outgoing creates, updates, and deletes to relay pushes (#​4820)
  • bae8f07 [feature] add statuses multi GET endpoint (#​4814)
  • 126959d [feature/frontend] Add data-name="{{- .Name -}}" to fields to allow for per-field styling (#​4827)
  • a2266f2 [feature] add cleanup of old remote status threads (#​4808)
  • 12e6d0c [feature] Dereference + store statuses delivered by a followed relay actor (#​4810)
  • 603c849 [feature] Add button to clear instance delivery errors (#​4818)
  • 4e2589b [feature] make almost every http.Client{} and http.Server{} option configurable (#​4730)
  • 77059b4 [feature] add sqlite cli commands (#​4726)
  • f4bf4aa [performance] add configurables for timeline cache lengths (#​4807)
  • 39ad509 [feature] Add db functions, api endpoints, and settings panel sections for relay subscriptions + pushes (#​4796)
  • 0496504 [feature] Add storage-s3-region config option (#​4788)
  • 85050ee [feature] Serve instance actor AP representation without auth (#​4798)
  • cc1316b [feature] Store delivery errors, add remote instances overview to view stored errors (#​4741)
  • 40fff69 [feature] Add config option smtp-from-display-name for customization of email from address display name (#​4769)
  • 4e935d0 [performance] further index fiddling (#​4761)
  • ef60ffe [feature] hook up "log-db-queries" again and when enabled log at TRACE regardless of current "log-level" (#​4764)
  • 9972836 [performance] use CTE for home timeline query, allows postgres to make use of indices, thanks @​cdn0x12 (#​4760)
  • c40dbf0 [performance] don't block on media load on API endpoints to improve latency (#​4756)
  • 0415d71 [feature] implement status deletion via stubbing (#​4752)
  • 7362d55 [feature] add deleted flag to the statuses table to track tombstones (#​4716)
  • ea7e3c0 [feature/frontend] add Träwelling status to profile (#​4540)
  • ec69200 [feature] Add instance directory page for accounts that opt-in to discoverability (#​4707)
Bug fixes
  • 60b693f [bugfix/frontend] turn DateTimeMinute and DateTimeSecond into proper components (#​4911)
  • 867ce73 [bugfix] stricter property value counts (#​4905)
  • b2e789e [bugfix] Allow hyphen in usernameRelaxed regex (#​4902)
  • 5caf33d [bugfix] Ensure timeline side effects triggered for relayed Announces (#​4901)
  • 4bb89d2 [bugfix] Add support for public:remote stream type (#​4899)
  • d51bec4 [bugfix/frontend] Fix docs links + remove trailing code for some relay stuff (#​4898)
  • 9d03fc4 [bugfix] Depunify account domain in api instance response + web pages (#​4897)
  • ce6fd30 [bugfix] Don't return 500 on forwarded Update targeting an actor (#​4892)
  • 663d725 [bugfix] Call dereferencer hook for relayed status to put in timeline(s) (#​4887)
  • d40aefe [bugfix] fix erroneus use of RelayConnectionCreateRequest when updating a relay push (#​4884)
  • c53f27b [bugfix] don't error on db.ErrNoEntries in OnMediaDereference callback (#​4874)
  • 620bfa1 [bugfix] disable outgoing http2 requests until superseriousbusiness/httpsig is updated (#​4879)
  • ad9418c [bugfix] only mark status as edited for streaming hooks if edited_at column has changed (#​4867)
  • b201dbe [bugfix] Remove admin check on user-level relay push matchers (#​4870)
  • b833c96 [bugfix] set statuses-cleanup-remote-older-than to "0s", skip scheduling if 0 (#​4869)
  • aec4f46 [bugfix] Update go-sqlite3 to v0.35.1 to fix out of memory panic during migration (#​4864)
  • 1a58374 [bugfix] Fix account domain being used incorrectly in api instance responses (#​4863)
  • c35d2b7 [bugfix] temporarily removes the sqlite vacuum CLI action, as it seems to fail with i/o issues (#​4859)
  • f854121 [bugfix] nowasm: on context cancel hook, check that process is non-nil before calling Kill() (#​4855)
  • 4ce10bd [bugfix] Fix error message for account-domain/host validation being the wrong way around (#​4851)
  • de2e6a0 [bugfix] Always return 401 unauthorized when deref of pubkey fails (#​4836)
  • 1a0e3fd [bugfix] fix error format strings (#​4835)
  • e0bc24a [bugfix] don't return 500 error on unsupported Announce forwards (#​4828)
  • 6a5794e [bugfix] Check error type when dereferencing threads, to avoid spurious error messages (#​4824)
  • 8198126 [bugfix/frontend] Validate domain name for new domain perms earlier to avoid confusing err messages (#​4826)
  • ed6b737 [bugfix] Ignore extraneous data streams when processing videos (#​4819)
  • dd81a52 [bugfix] Fix logic error on outgoing poll votes (#​4813)
  • f20588d [bugfix]: make GET /api/v1/admin/reports match Mastodon admin API (#​4778)
  • a0d235b [bugfix] numerous media processing bug fixes (#​4771)
  • beb9281 [bugfix] Preescape backslashes when doing plaintext parsing (#​4770)
  • 80b8faa [bugfix] set deleted status placeholder serialization (#​4768)
  • bc19d7b [bugfix] fix media setting errors on codec unsupported or generic ffmpeg/ffprobe related errors (#​4749)
  • 085448e [bugfix] Only insert status pins if slice not empty (#​4743)
  • ad85f89 [bugfix] Fix 404 for local audio files with no cover image (#​4739)
  • b49939a [bugfix] Check replyAuthorization prop on statuses, fall back to deprecated approvedBy (#​4732)
  • dd7d659 [bugfix] catch empty media attachment URLs and set appropriate error text so they get replaced with placeholder text (#​4723)
  • 10afa76 [bugfix] ensure domain limit status filters get serialized the same as regular status filters (#​4722)
  • da22ce9 [bugfix] do not crash on null media.meta on reports page (#​4721)
  • d1f330e [bugfix] Fix missing prometheus go runtime metrics (#​4718)
Chores & version bumps
Documentation
  • 0b9a273 [docs] fix default param value definition (#​4886)
  • 4e47c76 [docs] Add note about Postgres docker shm-size parameter (#​4873)
  • 542c57f [docs] update list of supported platforms regarding recent changes to ncruces/go-sqlite3 and our build tag behaviour (#​4858)
  • 40ed945 [docs] Update db maintenance docs, add status cleanup docs, update media cleanup docs (#​4857)
  • 10244f0 [docs] Update database maintenance docs to specify using the gts binary to run analyze (#​4843)
  • bafe562 [docs] Update config examples for crons (#​4821)
  • a2cbe8c [docs/bugfix] Fix link to example systemctl file (#​4751)
Other

Configuration

📅 Schedule: (in timezone Asia/Singapore)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 29, 2026 •

Copy link
Copy Markdown

Deploying jjgadgets-biohazard with  Cloudflare Pages  Cloudflare Pages

Latest commit: b292de5
Status:🚫  Build failed.

View logs

@tinfoild

tinfoild Bot commented Jun 29, 2026 •

Copy link
Copy Markdown
Contributor Author

kube/helmrelease/out00

--- HelmRelease: gotosocial/gotosocial Deployment: gotosocial/gotosocial

+++ HelmRelease: gotosocial/gotosocial Deployment: gotosocial/gotosocial

@@ -122,13 +122,13 @@

           value: prometheus
         - name: TZ
           value: null
         envFrom:
         - secretRef:
             name: gotosocial-secrets
-        image: docker.io/superseriousbusiness/gotosocial:0.21.3@sha256:a031e18cf7d4315288b303a376c9d52f9d90a8fd66f3b084ffd6b0b39ae86b8e
+        image: docker.io/superseriousbusiness/gotosocial:0.22.2@sha256:43e5dd574c5d5f94238b73e2ce17cf5c778f763cebebf06cc7894623d151c78b
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 8080

@tinfoild
tinfoild Bot force-pushed the renovate/docker.io-superseriousbusiness-gotosocial-0.x branch from 5b7039c to fb73076 Compare July 20, 2026 10:12
@tinfoild

tinfoild Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

kube/kustomization/out00

--- kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config Kustomization: gotosocial/gotosocial-pvc

+++ kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config Kustomization: gotosocial/gotosocial-pvc

@@ -277,13 +277,13 @@

       RGID: '65534'
       RUID: '65534'
       SC: block
       SIZE: 50Gi
       SNAP: block
       SNAP_ACCESSMODE: ReadWriteOnce
-      VS_APP_CURRENT_VERSION: docker.io/superseriousbusiness/gotosocial:0.21.3@sha256:a031e18cf7d4315288b303a376c9d52f9d90a8fd66f3b084ffd6b0b39ae86b8e
+      VS_APP_CURRENT_VERSION: docker.io/superseriousbusiness/gotosocial:0.22.0@sha256:2a59e8d70c70ec51322a5be0bc5090a67eb55ea93f1fe556012192661ebe905f
     substituteFrom:
     - kind: Secret
       name: biohazard-vars
       optional: false
     - kind: Secret
       name: biohazard-secrets
--- kube/deploy/core/storage/volsync/template Kustomization: gotosocial/gotosocial-pvc ReplicationSource: gotosocial/gotosocial-data-r2-updates-restic

+++ kube/deploy/core/storage/volsync/template Kustomization: gotosocial/gotosocial-pvc ReplicationSource: gotosocial/gotosocial-data-r2-updates-restic

@@ -53,8 +53,8 @@

       daily: 14
       within: 7d
     storageClassName: block
     volumeSnapshotClassName: block
   sourcePVC: gotosocial-data
   trigger:
-    manual: docker.io/superseriousbusiness/gotosocial:0.21.3@sha256:a031e18cf7d4315288b303a376c9d52f9d90a8fd66f3b084ffd6b0b39ae86b8e
+    manual: docker.io/superseriousbusiness/gotosocial:0.22.0@sha256:2a59e8d70c70ec51322a5be0bc5090a67eb55ea93f1fe556012192661ebe905f
 
--- kube/deploy/core/storage/volsync/template Kustomization: gotosocial/gotosocial-pvc VolumeSnapshot: gotosocial/gotosocial-data-v0b39ae86b8e

+++ kube/deploy/core/storage/volsync/template Kustomization: gotosocial/gotosocial-pvc VolumeSnapshot: gotosocial/gotosocial-data-v0b39ae86b8e

@@ -1,16 +0,0 @@

----
-apiVersion: snapshot.storage.k8s.io/v1
-kind: VolumeSnapshot
-metadata:
-  labels:
-    app.kubernetes.io/name: gotosocial
-    kustomize.toolkit.fluxcd.io/name: gotosocial-pvc
-    kustomize.toolkit.fluxcd.io/namespace: gotosocial
-    pvc.home.arpa/volsync: 'true'
-  name: gotosocial-data-v0b39ae86b8e
-  namespace: gotosocial
-spec:
-  source:
-    persistentVolumeClaimName: gotosocial-data
-  volumeSnapshotClassName: block
-
--- kube/deploy/core/storage/volsync/template Kustomization: gotosocial/gotosocial-pvc VolumeSnapshot: gotosocial/gotosocial-data-v2661ebe905f

+++ kube/deploy/core/storage/volsync/template Kustomization: gotosocial/gotosocial-pvc VolumeSnapshot: gotosocial/gotosocial-data-v2661ebe905f

@@ -0,0 +1,16 @@

+---
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshot
+metadata:
+  labels:
+    app.kubernetes.io/name: gotosocial
+    kustomize.toolkit.fluxcd.io/name: gotosocial-pvc
+    kustomize.toolkit.fluxcd.io/namespace: gotosocial
+    pvc.home.arpa/volsync: 'true'
+  name: gotosocial-data-v2661ebe905f
+  namespace: gotosocial
+spec:
+  source:
+    persistentVolumeClaimName: gotosocial-data
+  volumeSnapshotClassName: block
+
--- kube/deploy/apps/gotosocial/app Kustomization: gotosocial/gotosocial-app HelmRelease: gotosocial/gotosocial

+++ kube/deploy/apps/gotosocial/app Kustomization: gotosocial/gotosocial-app HelmRelease: gotosocial/gotosocial

@@ -80,13 +80,13 @@

               TZ: null
             envFrom:
             - secretRef:
                 name: gotosocial-secrets
             image:
               repository: docker.io/superseriousbusiness/gotosocial
-              tag: 0.21.3@sha256:a031e18cf7d4315288b303a376c9d52f9d90a8fd66f3b084ffd6b0b39ae86b8e
+              tag: 0.22.0@sha256:2a59e8d70c70ec51322a5be0bc5090a67eb55ea93f1fe556012192661ebe905f
             probes:
               liveness:
                 enabled: true
               readiness:
                 enabled: true
               startup:

@tinfoild
tinfoild Bot force-pushed the renovate/docker.io-superseriousbusiness-gotosocial-0.x branch from fb73076 to 739c7e1 Compare July 20, 2026 15:14
@tinfoild tinfoild Bot changed the title feat(oci/gotosocial): update 0.21.3 ➼ 0.22.0 feat(oci/gotosocial): update 0.21.3 ➼ 0.22.1 Jul 20, 2026
@ciel-shieru

ciel-shieru commented Jul 23, 2026 •

Copy link
Copy Markdown
Contributor

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 08:02 SGT
🤖 Scanner: Ciel Security Scanner
🔗 PR: #6313 — feat(oci/gotosocial): update 0.21.3 ➼ 0.22.1
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 0


Severity Summary

Severity Count
CRITICAL 0
HIGH 0
MEDIUM / MODERATE 0
LOW 0
UNKNOWN / NEEDS VERIFICATION 0
Total 0

Results

Package: docker.io/superseriousbusiness/gotosocial

  • Ecosystem: Go (Docker image)
  • Old version: 0.21.3 — CLEAN
  • New version: 0.22.1 — CLEAN

Scanned Sources:

Source Old (0.21.3) New (0.22.1) Notes
OSV.dev ✅ No issues ✅ No issues Queried gotosocial + superseriousbusiness/gotosocial via Go & any ecosystem
NVD ✅ No CVEs ✅ No CVEs Keyword search: gotosocial, GoToSocial, superseriousbusiness
GHSA ✅ No advisories ✅ No advisories Global + repo-level checks
GHSL ✅ Not found ✅ Not found GitHub Security Lab — no GoToSocial publications
CISA KEV ✅ Not listed ✅ Not listed Vendor/product search
FortiGuard ✅ Not relevant ✅ Not relevant Fortinet products only
CVE.org ✅ No CVEs ✅ No CVEs CVE.org search
Changelog ✅ Security-relevant bug fixes present ✅ No new CVEs See analysis below

Notable changelog items (security-relevant bug fixes in 0.22.x):

  1. Always return 401 unauthorized when deref of pubkey fails — Ensures failed public key dereference returns proper 401 (hardens auth handling)
  2. Check replyAuthorization prop on statuses, fall back to deprecated approvedBy — Strengthens reply authorization checks
  3. disable outgoing http2 requests until superseriousbusiness/httpsig is updated — Proactive outbound request security measure
  4. fix error format strings / don't return 500 error on unsupported Announce forwards — Error handling hardening

Dependency CVE investigation:

  • CVE-2025-30204 (golang-jwt/jwt excessive memory allocation) — ❌ Not applicable: Both 0.21.3 and 0.22.1 use golang-jwt/jwt v5.3.1, which is newer than the fixed version (v5.2.2). Neither version is affected.
  • CVE-2026-56876 (extract-zip npm package symlink traversal) — ❌ Not applicable: This CVE targets a Node.js npm package. GoToSocial is a Go application and does not use this dependency.

Recommendations

  • Priority: Low
  • Merge recommendation: Safe to merge. No known vulnerabilities were found in either the old (0.21.3) or new (0.22.1) version from any of the 8 scanned sources.
  • This PR contains bug fixes, security hardening, and feature additions. There is no security urgency, but merging provides incremental security improvements.
  • Both old and new versions share the same dependency versions for security-critical packages (golang-jwt v5.3.1, etc.), so the update does not introduce regression risk.

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.

@ciel-shieru

Copy link
Copy Markdown
Contributor

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 01:06 UTC
🤖 Scanner: Ciel Security Scanner (fast mode: OSV.dev + NVD + GHSA)
🔗 PR: #6313 — feat(oci/gotosocial): update 0.21.3 ➼ 0.22.1
📦 Package: docker.io-superseriousbusiness-gotosocial (ecosystem: container)
📊 Versions: old=? → new=0.22.1


Severity Summary

Severity Count
CRITICAL 0
HIGH 0
MEDIUM / MODERATE 0
LOW 1
UNKNOWN / NEEDS VERIFICATION 0
Total 1

Results

Package: docker.io-superseriousbusiness-gotosocial

  • Old version: unknown
  • New version: 0.22.1
  • Ecosystem: container

Raw findings (truncated)

=== NEW: 0.22.1 ===
=== OSV.dev query for docker.io-superseriousbusiness-gotosocial@0.22.1 (ecosystem: container) ===
No vulnerabilities found on OSV.dev for docker.io-superseriousbusiness-gotosocial@0.22.1

=== NVD query for 'docker.io-superseriousbusiness-gotosocial' (version filter: 0.22.1) ===
No CVEs found on NVD for keyword: docker.io-superseriousbusiness-gotosocial

=== GHSA query for docker.io-superseriousbusiness-gotosocial (ecosystem: container) ===
{"message":"Invalid request.\n\nInvalid input: `container` is not a possible value. Must be one of the following: rubygems, npm, pip, maven, nuget, composer, go, rust, erlang, actions, pub, other, swift.","documentation_url":"https://docs.github.com/rest/security-advisories/global-advisories#list-global-security-advisories","status":"422"}No GHSA advisories found


Recommendations

  • Review the findings above before merging.
  • Verify version-range applicability of each CVE before treating as actionable.

⚠️ This comment was posted by an automated security scanner (Ciel, fast mode).
To re-scan, trigger the renovate-security-scanner skill.

@tinfoild
tinfoild Bot force-pushed the renovate/docker.io-superseriousbusiness-gotosocial-0.x branch from 739c7e1 to b292de5 Compare October 9, 2026 16:34
@tinfoild tinfoild Bot changed the title feat(oci/gotosocial): update 0.21.3 ➼ 0.22.1 feat(oci/gotosocial): update 0.21.3 ➼ 0.22.2 Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant