2025.11.1

.config/cypress-devcontainer.yml

@@ -215,20 +215,9 @@ proxyBypassHosts:
 # Media Proxy
 #mediaProxy: https://example.com/proxy
 
-# Proxy remote files (default: true)
-proxyRemoteFiles: true
-
-# Sign to ActivityPub GET request (default: true)
-signToActivityPubGet: true
-
 allowedPrivateNetworks: [
   '127.0.0.1/32'
 ]
 
-# Disable automatic redirect for ActivityPub object lookup. (default: false)
-# This is a strong defense against potential impersonation attacks if the viewer instance has inadequate validation.
-# However it will make it impossible for other instances to lookup third-party user and notes through your URL.
-#disallowExternalApRedirect: true
-
 # Upload or download file size limits (bytes)
 #maxFileSize: 262144000

.config/docker_example.yml

@@ -227,24 +227,13 @@ proxyBypassHosts:
 # Media Proxy
 #mediaProxy: https://example.com/proxy
 
-# Proxy remote files (default: true)
-proxyRemoteFiles: true
-
-# Sign to ActivityPub GET request (default: true)
-signToActivityPubGet: true
-
 # For security reasons, uploading attachments from the intranet is prohibited,
 # but exceptions can be made from the following settings. Default value is "undefined".
 # Read changelog to learn more (Improvements of 12.90.0 (2021/09/04)).
 #allowedPrivateNetworks: [
 #  '127.0.0.1/32'
 #]
 
-# Disable automatic redirect for ActivityPub object lookup. (default: false)
-# This is a strong defense against potential impersonation attacks if the viewer instance has inadequate validation.
-# However it will make it impossible for other instances to lookup third-party user and notes through your URL.
-#disallowExternalApRedirect: true
-
 # Upload or download file size limits (bytes)
 #maxFileSize: 262144000
 

.config/example.yml

@@ -105,6 +105,16 @@ port: 3000
 # socket: /path/to/misskey.sock
 # chmodSocket: '777'
 
+# Proxy trust settings
+#
+# Changes how the server interpret the origin IP of the request.
+#
+# Any format supported by Fastify is accepted.
+# Default: trust all proxies (i.e. trustProxy: true)
+# See: https://fastify.dev/docs/latest/reference/server/#trustproxy
+#
+# trustProxy: 1
+
 #   ┌──────────────────────────┐
 #───┘ PostgreSQL configuration └────────────────────────────────
 
@@ -319,31 +329,19 @@ proxyBypassHosts:
 # * Perform image compression (on a different server resource than the main process)
 #mediaProxy: https://example.com/proxy
 
-# Proxy remote files (default: true)
-# Proxy remote files by this instance or mediaProxy to prevent remote files from running in remote domains.
-proxyRemoteFiles: true
-
 # Movie Thumbnail Generation URL
 # There is no reference implementation.
 # For example, Misskey will point to the following URL:
 #   https://example.com/thumbnail.webp?thumbnail=1&url=https%3A%2F%2Fstorage.example.com%2Fpath%2Fto%2Fvideo.mp4
 #videoThumbnailGenerator: https://example.com
 
-# Sign to ActivityPub GET request (default: true)
-signToActivityPubGet: true
-
 # For security reasons, uploading attachments from the intranet is prohibited,
 # but exceptions can be made from the following settings. Default value is "undefined".
 # Read changelog to learn more (Improvements of 12.90.0 (2021/09/04)).
 #allowedPrivateNetworks: [
 #  '127.0.0.1/32'
 #]
 
-# Disable automatic redirect for ActivityPub object lookup. (default: false)
-# This is a strong defense against potential impersonation attacks if the viewer instance has inadequate validation.
-# However it will make it impossible for other instances to lookup third-party user and notes through your URL.
-#disallowExternalApRedirect: true
-
 # Upload or download file size limits (bytes)
 #maxFileSize: 262144000
 

.devcontainer/Dockerfile

@@ -1 +1 @@
-FROM mcr.microsoft.com/devcontainers/javascript-node:22
+FROM mcr.microsoft.com/devcontainers/javascript-node:4.0.3-24-trixie

.devcontainer/compose.yml

@@ -30,7 +30,7 @@ services:
 
   db:
     restart: unless-stopped
-    image: postgres:17-alpine
+    image: postgres:18-alpine
     networks:
       - internal_network
     environment:

.devcontainer/devcontainer.json

@@ -4,8 +4,8 @@
 	"service": "app",
 	"workspaceFolder": "/workspace",
 	"features": {
-		"ghcr.io/devcontainers/features/node:latest": {
-			"version": "22"
+		"ghcr.io/devcontainers/features/node:1": {
+			"version": "24.10.0"
 		},
 		"ghcr.io/devcontainers-contrib/features/pnpm:latest": {}
 	},

.devcontainer/devcontainer.yml

@@ -202,12 +202,6 @@ proxyBypassHosts:
 # Media Proxy
 #mediaProxy: https://example.com/proxy
 
-# Proxy remote files (default: true)
-proxyRemoteFiles: true
-
-# Sign to ActivityPub GET request (default: true)
-signToActivityPubGet: true
-
 allowedPrivateNetworks: [
   '127.0.0.1/32'
 ]

.editorconfig

@@ -16,3 +16,7 @@ indent_style = space
 
 [*.{yml,yaml}]
 indent_style = space
+
+[packages/backend/migration/*.js]
+indent_style = space
+indent_size = 4

.github/ISSUE_TEMPLATE/01_bug-report.yml

@@ -74,9 +74,9 @@ body:
 
         Examples:
           * Installation Method or Hosting Service: docker compose, k8s/docker, systemd, "Misskey install shell script", development environment
-          * Misskey: 20xx.x.x
-          * Node: 22.x.x
-          * PostgreSQL: 17.x.x
+          * Misskey: 2025.x.x
+          * Node: 24.x.x
+          * PostgreSQL: 18.x.x
           * Redis: 7.x.x
           * OS and Architecture: Ubuntu 24.04 LTS aarch64
       value: |

.github/min.node-version

@@ -0,0 +1 @@
+22.21.0

.github/misskey/test.yml

@@ -15,3 +15,5 @@ redis:
   host: 127.0.0.1
   port: 56312
 id: aidx
+
+proxyRemoteFiles: true

.github/workflows/api-misskey-js.yml

@@ -20,13 +20,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4.3.0
         with:
           fetch-depth: 0
           submodules: true
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.2.0
         with:
           run_install: false
 

.github/workflows/check-misskey-js-version.yml

@@ -28,10 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-          submodules: true
+        uses: actions/checkout@v4.3.0
       - name: Check version
         run: |
           if [ "$(jq -r '.version' package.json)" != "$(jq -r '.version' packages/misskey-js/package.json)" ]; then

.github/workflows/lint.yml

@@ -12,7 +12,9 @@ on:
       - packages/backend/**
       - packages/frontend/**
       - packages/frontend-shared/**
+      - packages/frontend-builder/**
       - packages/frontend-embed/**
+      - packages/icons-subsetter/**
       - packages/sw/**
       - packages/misskey-js/**
       - packages/misskey-bubble-game/**
@@ -24,7 +26,9 @@ on:
       - packages/backend/**
       - packages/frontend/**
       - packages/frontend-shared/**
+      - packages/frontend-builder/**
       - packages/frontend-embed/**
+      - packages/icons-subsetter/**
       - packages/sw/**
       - packages/misskey-js/**
       - packages/shared/.eslintrc.js
@@ -40,19 +44,17 @@ jobs:
   pnpm_install:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
-      with:
-        fetch-depth: 0
-        submodules: true
-    - name: Setup pnpm
-      uses: pnpm/action-setup@v4
-      with:
-        run_install: false
-    - uses: actions/setup-node@v6
-      with:
-        node-version-file: '.node-version'
-        cache: 'pnpm'
-    - run: pnpm i --frozen-lockfile
+      - uses: actions/checkout@v4.3.0
+        with:
+          fetch-depth: 0
+          submodules: true
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.2.0
+      - uses: actions/setup-node@v4.4.0
+        with:
+          node-version-file: '.node-version'
+          cache: 'pnpm'
+      - run: pnpm i --frozen-lockfile
 
   lint:
     needs: [pnpm_install]
@@ -64,7 +66,9 @@ jobs:
         - backend
         - frontend
         - frontend-shared
+        - frontend-builder
         - frontend-embed
+        - icons-subsetter
         - sw
         - misskey-js
         - misskey-bubble-game
@@ -105,18 +109,19 @@ jobs:
         - sw
         - misskey-js
     steps:
-    - uses: actions/checkout@v6
-      with:
-        fetch-depth: 0
-        submodules: true
-    - name: Setup pnpm
-      uses: pnpm/action-setup@v4
-      with:
-        run_install: false
-    - uses: actions/setup-node@v6
-      with:
-        node-version-file: '.node-version'
-        cache: 'pnpm'
-    - run: pnpm i --frozen-lockfile
-    - run: pnpm --filter misskey-reversi --filter misskey-bubble-game --filter misskey-js run build
-    - run: pnpm --filter ${{ matrix.workspace }} run typecheck
+      - uses: actions/checkout@v4.3.0
+        with:
+          fetch-depth: 0
+          submodules: true
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.2.0
+      - uses: actions/setup-node@v4.4.0
+        with:
+          node-version-file: '.node-version'
+          cache: 'pnpm'
+      - run: pnpm i --frozen-lockfile
+      - run: pnpm --filter misskey-js run build
+        if: ${{ matrix.workspace == 'backend' || matrix.workspace == 'sw' }}
+      - run: pnpm --filter misskey-reversi run build
+        if: ${{ matrix.workspace == 'backend' }}
+      - run: pnpm --filter ${{ matrix.workspace }} run typecheck