@freemo Oof, that's a bad one:
https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm
Are we safe yet?
🇳🇱
@admitsWrongIfProven Ill check it out, thanks.
@freemo Now that i look at it again... our server is too old to be affected...? Or is the 3.2.1 i see bottom left not the server version? Could be handy to know in the future.
@admitsWrongIfProven our version no longer tracks mastodon so thats not accurate. I need to dig into the code tonight to see if this is relevant.
No its not in sync, we pull in things piecemeal and the versions desynced a while back.
@freemo @admitsWrongIfProven I see. Shouldn't we worry about missing important security patches or features? Has your fork diverged so much that upstream can't be reconciled with it any more? I trust your admin decisions, just asking because if that's the case it sounds like you'll have increasing tech debt or maintenance overhead as time passes…
@freemo What does that mean? Isn't your fork in sync with changes upstream?
/cc @admitsWrongIfProven