X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;ds=sidebyside;f=CHANGELOG.md;h=14c0252f73bf7d393af95aea3284107ea977bc39;hb=c6647c08e10a45aedcd77258a0e71c41d213eaa6;hp=cfe0651c84ba56ba2b0aecd69b5d8139d2d72bdc;hpb=fa347b9c2f416cd2c402e3e6eebb561dfc0ee8a8;p=akkoma

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cfe0651c8..14c0252f7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,26 +5,40 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
 
+### Changed
+
+- Renamed `:await_up_timeout` in `:connections_pool` namespace to `:connect_timeout`, old name is deprecated.
+- Renamed `:timeout` in `pools` namespace to `:recv_timeout`, old name is deprecated.
+
 ### Removed
 
 - **Breaking:** Removed `Pleroma.Workers.Cron.StatsWorker` setting from Oban `:crontab`.
+- **Breaking:** Removed `Pleroma.Workers.Cron.ClearOauthTokenWorker` setting from Oban `:crontab` config.
 
+## [2.1.1] - 2020-09-08
 
-## unreleased-patch - ???
+### Security
+- Fix possible DoS in Mastodon API user search due to an error in match clauses, leading to an infinite recursion and subsequent OOM with certain inputs.
+- Fix metadata leak for accounts and statuses on private instances.
+- Fix possible DoS in Admin API search using an atom leak vulnerability. Authentication with admin rights was required to exploit.
 
-### Added
+### Changed
 
-- Rich media failure tracking (along with `:failure_backoff` option)
+- **Breaking:** The metadata providers RelMe and Feed are no longer configurable. RelMe should always be activated and Feed only provides a <link> header tag for the actual RSS/Atom feed when the instance is public.
+- Improved error message when cmake is not available at build stage.
 
-### Fixed
+### Added
+- Rich media failure tracking (along with `:failure_backoff` option).
 
-- Possible OOM errors with the default HTTP adapter
+### Fixed
+- Default HTTP adapter not respecting pool setting, leading to possible OOM.
+- Fixed uploading webp images when the Exiftool Upload Filter is enabled by skipping them
 - Mastodon API: Search parameter `following` now correctly returns the followings rather than the followers
 - Mastodon API: Timelines hanging for (`number of posts with links * rich media timeout`) in the worst case.
   Reduced to just rich media timeout.
-- Mastodon API: Cards being wrong for preview statuses due to cache key collision
-- Password resets no longer processed for deactivated accounts
-
+- Mastodon API: Cards being wrong for preview statuses due to cache key collision.
+- Password resets no longer processed for deactivated accounts.
+- Favicon scraper raising exceptions on URLs longer than 255 characters.
 
 ## [2.1.0] - 2020-08-28
 
@@ -138,7 +152,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Fix whole_word always returning false on filter get requests
 - Migrations not working on OTP releases if the database was connected over ssl
 - Fix relay following
-- Fixed uploading webp images when the Exiftool Upload Filter is enabled
 
 ## [2.0.7] - 2020-06-13