Hi, we've just made a critical security update for Sharkey- version 2024.9.3. This release contains fixes for the previously announced security vulnerabilities affecting Misskey, Sharkey, IceShrimp.js, and Firefish.
IMPORTANT: Misskey, Iceshrimp.js, and Firefish users should also look for the security release for your software, as they are also affected by these CVEs!
Hello everyone, the Sharkey project has been quiet due to our ongoing efforts to patch major security vulnerabilities in coordination with Firefish, Iceshrimp.js, and upstream Misskey. On Wednesday, November 20th, 2024, our efforts will be finalized with a security release for all affected projects. It is of upmost importance to update your instance(s) to the latest version if you utilize any of the aforementioned software once the patches are released.
Reminder: Do not put your Listenbrainz Token in the Listenbrainz field, put your username there it will not work otherwise, also if u did put your token there, reset it, that value federates and is public just like your display name
Currently we are doing some reorganization of how sharkey development is done:
this includes but is not limited to:
1. Making all future dev discussions channels public, for increased transparency and community involvement
2. adding a new voting system, which will also be public, developers need to vote on new features before any major changes can be made, the vote needs to have a majority to pass, each member of the dev team can block a vote with valid reasoning, such as the feature increasing merging effort resulting in keeping up with misskey changes being hard
3. logging of inactivity of team members
4. Merge requests now require the approval of at least 2 devs, with a dev having the ability to block a merge request, if its a major feature it also requires a vote
5. new team members can now be voted in
6. Project Leads can no be elected in-case they go inactive or leave the team
8. Project Lead can be force fully replaced by a vote, in case a Project Lead, goes inactive for a while without any notice or they do something harmful to the project on purpose
9. a merge request can be merged without approval in emergency cases should an exploit happen that requires quick action, and non of the other team members are available a dev can merge security fixes without approval, this is only for upmost emergencys and should not happen
Other changes that will be done:
- reworking the contributing.md to be in english and have good instructions
- setting up crowdin for translations
- inviting more active contributors
Note: this is not final yet some things may change
Currently we are doing some reorganization of how sharkey development is done:
this includes but is not limited to:
1. Making all future dev discussions channels public, for increased transparency and community involvement
2. adding a new voting system, which will also be public, developers need to vote on new features before any major changes can be made, the vote needs to have a majority to pass, each member of the dev team can block a vote with valid reasoning, such as the feature increasing merging...
Gregory's Server