Heya Fediverse, long time no see ! Thanks to @neillans@infosec.exchange for these two new updates :) They should cover the latest security issues ! v0.15.2-glitch.1.13.0 Syncs Glitch with upstream Pixelfed v0.15.2 (Laravel 13, rewritten direct messages, and several upstream default changes). Back up the database before upgrading. Breaking Changes : - PHP 8.4 or newer is required (upstream dropped 8.3). Glitch Docker images now ship PHP 8.5 (1fc73b2ed) - Major library bumps: Laravel 13, Guzzle 8, phpseclib 4, Symfony 8, brick/math 1.0, Pest 5 (42620e584, ae1616622, 0f824f36a) - Direct messages rewritten with new dm_* tables and limits in config/dm.php. Existing DMs convert during migration when there are 25,000 or fewer (DM_BACKFILL_INLINE_THRESHOLD); above that, run php artisan dm:backfill-conversations (resumable, safe while live) (9c81a75ad, bb7856387) - Home timeline is always Redis-backed: EXP_CHT, EXP_CPT and INSTANCE_NETWORK_TIMELINE_CACHED are gone, and each user's feed is rebuilt in Redis on first visit, so expect more Redis memory use (71c801d16) - PF_LOCAL_AVATAR_TO_CLOUD removed: with cloud storage enabled, avatars are always stored in the cloud (d860e0ec5) - Horizon moved to /admin/horizon (/horizon redirects) and Pulse to /admin/pulse (no redirect) (139b29733) - hCaptcha keys renamed from CAPTCHA_SITEKEY/CAPTCHA_SECRET to CAPTCHA_H_SITEKEY/CAPTCHA_H_SECRET, alongside new Turnstile and Cap providers (9ec46005d) - Locales moved to BCP 47 tags (en to en-US). Existing two-letter APP_LOCALE values are mapped for now (bc61db4d3) https://github.com/pixelfed-glitch/pixelfed/releases/tag/v0.15.2-glitch.1.13.0