Our latest patch version contains a critical security fix for closed-registration instances, along with some minor bug fixes and improvements to the UI. We recommend all admins update to this version as soon as possible.
Download v0.17.2 now, and read on to see what’s new in this version.
Security
This fixes a vulnerability where anyone could use an invalid invite code to create accounts on closed-registration instances (#1723). Fixed by @snullp in #1724.
User-Facing Changes
Fix Material icons in Safari by @thebaer in #1726
Fix collection / post rendering in Chorus mode by @thebaer in #1719
ActivityPub: Fix duplicated post signature and potential HTML entities in the title by @thebaer in #1720
Admin-Facing Changes
make OAuth Adapter RFC-compliant by @mpldr in #1679
Fix unquoted From address and phantom recipient in mailer by @thebaer in #1721
Developer-Facing Changes
Add tests for signup, templates, and mailer by @thebaer in #1725
Dependencies and minor fixes
Bump golang.org/x/net from 0.56.0 to 0.57.0 by @dependabot[bot] in #1715
Upgrading from v0.17.x or earlier
Download the latest release for your operating system and architecture
Stop running your writefreely server
Replace all files in your installation (except for the keys directory) with the ones in the archive
(Only when upgrading from < v0.17.0) Update your database by running: writefreely db migrate
Start your writefreely server again
If you're upgrading from a much earlier version, follow the instructions in each previous release.
