Update ghcr.io/writefreely/writefreely Docker tag to v0.17.0 #27

Merged

forgejo merged 0 commits from refs/pull/27/head into main

2026-07-20 08:56:50 +00:00

forgejo commented

2026-07-17 23:57:26 +00:00

(Migrated from git.smallhack.org)

This PR contains the following updates:

Package	Update	Change
ghcr.io/writefreely/writefreely	minor	`v0.16.0` → `v0.17.0`

⚠️ Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

writefreely/writefreely (ghcr.io/writefreely/writefreely)

`v0.17.0`: V0.17

Compare Source

WriteFreely v0.17 is here, includes some critical security fixes, along with a ton of quality-of-life improvements and fixes for users.

Security

Fix config.ini defaults to world-readable (by @thebaer, CVE-2025-24337)
Fix Cross-User IDOR: Subscriber List Disclosure (by @thebaer, GHSA-cfcq-76gr-62x8)
Prevent signups via /auth/signup with closed registrations by @thebaer in #1686

User-Facing Changes

Title fixes for ActivityPub by @thebaer in #1491
Fix collection Customize page header nav on single-user instances by @thebaer in #1505
Fix single-user blog URL on Customize page by @thebaer in #1508
Add support for alternative smallweb URL schemes by @smazmi in #1565
Fix font toggle in classic editor #876 by @vtyeh in #1135
Display stat numbers as monospace by @lolbinarycat in #1142
Support changing published post font on web by @thebaer in #1609
Fix character set for post signature column on MySQL / MariaDB instances by @thebaer in #1608
Redirect /read/feed to correct /read/feed/ URL by @thebaer in #1522
Fix ProseMirror HTML handling by @thebaer in #1644
Use datetime picker on Post Metadata page and fix API inconsistency by @thebaer in #1492
Markdown preview by @thebaer in #1647
Sort list of Fediverse followers by subscription date, descending by @thebaer in #1630
Limit password to max characters supported by bcrypt by @thebaer in #1664
Improve and fix up data exports by @thebaer in #1623
Fix missing user nav on blog Customize page by @thebaer in #1687

Admin-Facing Changes

Document MariaDB support in README by @robertsilen in #1665
Ignore missing socket file on shutdown by @thebaer in #1503
ActivityPub robustness and monitoring by @blacklight in #1437

Developer-Facing Changes

Don't add blank strings to mentioned users array in Activity object by @thebaer in #1575
Refactor: Email Subscription shortcode and form by @thebaer in #1646
Run goimports on project by @thebaer in #1559

Dependencies and minor fixes

Add missing hostName assignment in viewEditCollection by @thebaer in #1504
Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot[bot] in #1151
Bump docker/metadata-action from 4.6.0 to 5.8.0 by @dependabot[bot] in #1462
Bump docker/login-action from 3.0.0 to 3.5.0 by @dependabot[bot] in #1463
Bump docker/build-push-action from 5.0.0 to 6.18.0 by @dependabot[bot] in #1464
Bump docker/setup-buildx-action from 3.0.0 to 3.11.1 by @dependabot[bot] in #1465
Bump golang.org/x/net from 0.43.0 to 0.44.0 by @dependabot[bot] in #1500
Bump docker/login-action from 3.5.0 to 3.6.0 by @dependabot[bot] in #1497
Bump golang.org/x/crypto from 0.41.0 to 0.42.0 by @dependabot[bot] in #1499
Bump golang.org/x/net from 0.45.0 to 0.46.0 by @dependabot[bot] in #1509
Bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in #1528
Bump golang.org/x/net from 0.47.0 to 0.48.0 by @dependabot[bot] in #1548
Bump golang.org/x/crypto from 0.45.0 to 0.46.0 by @dependabot[bot] in #1546
Bump github.com/fatih/color from 1.17.0 to 1.18.0 by @dependabot[bot] in #1140
Bump github.com/gosimple/slug from 1.14.0 to 1.15.0 by @dependabot[bot] in #1232
Bump golang.org/x/net from 0.48.0 to 0.49.0 by @dependabot[bot] in #1571
Bump docker/login-action from 3.6.0 to 3.7.0 by @dependabot[bot] in #1567
Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @dependabot[bot] in #1541
Bump docker/metadata-action from 5.8.0 to 5.10.0 by @dependabot[bot] in #1525
Bump docker/setup-qemu-action from 3.0.0 to 3.7.0 by @dependabot[bot] in #1515
Bump docker/build-push-action from 6.18.0 to 6.19.2 by @dependabot[bot] in #1602
Bump golang.org/x/net from 0.49.0 to 0.51.0 by @dependabot[bot] in #1627
Bump docker/login-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #1631
Bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #1632
Bump docker/metadata-action from 5.10.0 to 6.0.0 by @dependabot[bot] in #1633
Bump docker/build-push-action from 6.19.2 to 7.0.0 by @dependabot[bot] in #1634
Bump golang.org/x/net from 0.51.0 to 0.53.0 by @dependabot[bot] in #1657
Bump github.com/fatih/color from 1.18.0 to 1.19.0 by @dependabot[bot] in #1641
Bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in #1653
Bump golang.org/x/net from 0.53.0 to 0.55.0 by @dependabot[bot] in #1673
Bump golang.org/x/crypto from 0.51.0 to 0.53.0 by @dependabot[bot] in #1674
Bump docker/setup-buildx-action from 3.12.0 to 4.1.0 by @dependabot[bot] in #1669
Bump actions/checkout from 4 to 7 by @dependabot[bot] in #1684
Bump docker/build-push-action from 7.0.0 to 7.2.0 by @dependabot[bot] in #1666
Bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in #1667
Bump docker/login-action from 4.0.0 to 4.2.0 by @dependabot[bot] in #1668
Bump github.com/gorilla/csrf from 1.7.2 to 1.7.3 by @dependabot[bot] in #1361
Bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in #1693
Bump docker/login-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #1695

Upgrading from v0.16.x or earlier

Download the latest release for your operating system and architecture
Stop running your writefreely server
Replace all files in your installation (except for the keys directory) with the ones in the archive
Update your database by running:
```
writefreely db migrate
```
Start your writefreely server again

If you're upgrading from a much earlier version, follow the instructions in each previous release.

New Contributors

Thank you to all who contributed to this release!

@smazmi made their first contribution in #1565
@blacklight made their first contribution in #1437
@lolbinarycat made their first contribution in #1142
@robertsilen made their first contribution in #1665

Full Changelog: https://github.com/writefreely/writefreely/compare/v0.16.0...v0.17.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/writefreely/writefreely](https://github.com/writefreely/writefreely) | minor | `v0.16.0` → `v0.17.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>writefreely/writefreely (ghcr.io/writefreely/writefreely)</summary> ### [`v0.17.0`](https://github.com/writefreely/writefreely/releases/tag/v0.17.0): V0.17 [Compare Source](https://github.com/writefreely/writefreely/compare/v0.16.0...v0.17.0) WriteFreely v0.17 is here, includes some **critical security fixes**, along with a ton of quality-of-life improvements and fixes for users. #### Security - Fix config.ini defaults to world-readable (by [@thebaer](https://github.com/thebaer), [CVE-2025-24337](https://github.com/writefreely/writefreely/security/advisories/GHSA-jgpr-4649-rf4p)) - Fix Cross-User IDOR: Subscriber List Disclosure (by [@thebaer](https://github.com/thebaer), [GHSA-cfcq-76gr-62x8](https://github.com/writefreely/writefreely/security/advisories/GHSA-cfcq-76gr-62x8)) - Prevent signups via /auth/signup with closed registrations by [@thebaer](https://github.com/thebaer) in [#1686](https://github.com/writefreely/writefreely/pull/1686) #### User-Facing Changes - Title fixes for ActivityPub by [@thebaer](https://github.com/thebaer) in [#1491](https://github.com/writefreely/writefreely/pull/1491) - Fix collection Customize page header nav on single-user instances by [@thebaer](https://github.com/thebaer) in [#1505](https://github.com/writefreely/writefreely/pull/1505) - Fix single-user blog URL on Customize page by [@thebaer](https://github.com/thebaer) in [#1508](https://github.com/writefreely/writefreely/pull/1508) - Add support for alternative smallweb URL schemes by [@smazmi](https://github.com/smazmi) in [#1565](https://github.com/writefreely/writefreely/pull/1565) - Fix font toggle in classic editor [#876](https://github.com/writefreely/writefreely/issues/876) by [@vtyeh](https://github.com/vtyeh) in [#1135](https://github.com/writefreely/writefreely/pull/1135) - Display stat numbers as monospace by [@lolbinarycat](https://github.com/lolbinarycat) in [#1142](https://github.com/writefreely/writefreely/pull/1142) - Support changing published post font on web by [@thebaer](https://github.com/thebaer) in [#1609](https://github.com/writefreely/writefreely/pull/1609) - Fix character set for post signature column on MySQL / MariaDB instances by [@thebaer](https://github.com/thebaer) in [#1608](https://github.com/writefreely/writefreely/pull/1608) - Redirect /read/feed to correct /read/feed/ URL by [@thebaer](https://github.com/thebaer) in [#1522](https://github.com/writefreely/writefreely/pull/1522) - Fix ProseMirror HTML handling by [@thebaer](https://github.com/thebaer) in [#1644](https://github.com/writefreely/writefreely/pull/1644) - Use datetime picker on Post Metadata page and fix API inconsistency by [@thebaer](https://github.com/thebaer) in [#1492](https://github.com/writefreely/writefreely/pull/1492) - Markdown preview by [@thebaer](https://github.com/thebaer) in [#1647](https://github.com/writefreely/writefreely/pull/1647) - Sort list of Fediverse followers by subscription date, descending by [@thebaer](https://github.com/thebaer) in [#1630](https://github.com/writefreely/writefreely/pull/1630) - Limit password to max characters supported by bcrypt by [@thebaer](https://github.com/thebaer) in [#1664](https://github.com/writefreely/writefreely/pull/1664) - Improve and fix up data exports by [@thebaer](https://github.com/thebaer) in [#1623](https://github.com/writefreely/writefreely/pull/1623) - Fix missing user nav on blog Customize page by [@thebaer](https://github.com/thebaer) in [#1687](https://github.com/writefreely/writefreely/pull/1687) #### Admin-Facing Changes - Document MariaDB support in README by [@robertsilen](https://github.com/robertsilen) in [#1665](https://github.com/writefreely/writefreely/pull/1665) - Ignore missing socket file on shutdown by [@thebaer](https://github.com/thebaer) in [#1503](https://github.com/writefreely/writefreely/pull/1503) - ActivityPub robustness and monitoring by [@blacklight](https://github.com/blacklight) in [#1437](https://github.com/writefreely/writefreely/pull/1437) #### Developer-Facing Changes - Don't add blank strings to mentioned users array in Activity object by [@thebaer](https://github.com/thebaer) in [#1575](https://github.com/writefreely/writefreely/pull/1575) - Refactor: Email Subscription shortcode and form by [@thebaer](https://github.com/thebaer) in [#1646](https://github.com/writefreely/writefreely/pull/1646) - Run goimports on project by [@thebaer](https://github.com/thebaer) in [#1559](https://github.com/writefreely/writefreely/pull/1559) ##### Dependencies and minor fixes - Add missing `hostName` assignment in viewEditCollection by [@thebaer](https://github.com/thebaer) in [#1504](https://github.com/writefreely/writefreely/pull/1504) - Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1151](https://github.com/writefreely/writefreely/pull/1151) - Bump docker/metadata-action from 4.6.0 to 5.8.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1462](https://github.com/writefreely/writefreely/pull/1462) - Bump docker/login-action from 3.0.0 to 3.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1463](https://github.com/writefreely/writefreely/pull/1463) - Bump docker/build-push-action from 5.0.0 to 6.18.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1464](https://github.com/writefreely/writefreely/pull/1464) - Bump docker/setup-buildx-action from 3.0.0 to 3.11.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#1465](https://github.com/writefreely/writefreely/pull/1465) - Bump golang.org/x/net from 0.43.0 to 0.44.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1500](https://github.com/writefreely/writefreely/pull/1500) - Bump docker/login-action from 3.5.0 to 3.6.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1497](https://github.com/writefreely/writefreely/pull/1497) - Bump golang.org/x/crypto from 0.41.0 to 0.42.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1499](https://github.com/writefreely/writefreely/pull/1499) - Bump golang.org/x/net from 0.45.0 to 0.46.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1509](https://github.com/writefreely/writefreely/pull/1509) - Bump golang.org/x/crypto from 0.43.0 to 0.45.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1528](https://github.com/writefreely/writefreely/pull/1528) - Bump golang.org/x/net from 0.47.0 to 0.48.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1548](https://github.com/writefreely/writefreely/pull/1548) - Bump golang.org/x/crypto from 0.45.0 to 0.46.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1546](https://github.com/writefreely/writefreely/pull/1546) - Bump github.com/fatih/color from 1.17.0 to 1.18.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1140](https://github.com/writefreely/writefreely/pull/1140) - Bump github.com/gosimple/slug from 1.14.0 to 1.15.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1232](https://github.com/writefreely/writefreely/pull/1232) - Bump golang.org/x/net from 0.48.0 to 0.49.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1571](https://github.com/writefreely/writefreely/pull/1571) - Bump docker/login-action from 3.6.0 to 3.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1567](https://github.com/writefreely/writefreely/pull/1567) - Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1541](https://github.com/writefreely/writefreely/pull/1541) - Bump docker/metadata-action from 5.8.0 to 5.10.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1525](https://github.com/writefreely/writefreely/pull/1525) - Bump docker/setup-qemu-action from 3.0.0 to 3.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1515](https://github.com/writefreely/writefreely/pull/1515) - Bump docker/build-push-action from 6.18.0 to 6.19.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#1602](https://github.com/writefreely/writefreely/pull/1602) - Bump golang.org/x/net from 0.49.0 to 0.51.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1627](https://github.com/writefreely/writefreely/pull/1627) - Bump docker/login-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1631](https://github.com/writefreely/writefreely/pull/1631) - Bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1632](https://github.com/writefreely/writefreely/pull/1632) - Bump docker/metadata-action from 5.10.0 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1633](https://github.com/writefreely/writefreely/pull/1633) - Bump docker/build-push-action from 6.19.2 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1634](https://github.com/writefreely/writefreely/pull/1634) - Bump golang.org/x/net from 0.51.0 to 0.53.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1657](https://github.com/writefreely/writefreely/pull/1657) - Bump github.com/fatih/color from 1.18.0 to 1.19.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1641](https://github.com/writefreely/writefreely/pull/1641) - Bump golang.org/x/crypto from 0.50.0 to 0.51.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1653](https://github.com/writefreely/writefreely/pull/1653) - Bump golang.org/x/net from 0.53.0 to 0.55.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1673](https://github.com/writefreely/writefreely/pull/1673) - Bump golang.org/x/crypto from 0.51.0 to 0.53.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1674](https://github.com/writefreely/writefreely/pull/1674) - Bump docker/setup-buildx-action from 3.12.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1669](https://github.com/writefreely/writefreely/pull/1669) - Bump actions/checkout from 4 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#1684](https://github.com/writefreely/writefreely/pull/1684) - Bump docker/build-push-action from 7.0.0 to 7.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1666](https://github.com/writefreely/writefreely/pull/1666) - Bump docker/metadata-action from 6.0.0 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1667](https://github.com/writefreely/writefreely/pull/1667) - Bump docker/login-action from 4.0.0 to 4.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1668](https://github.com/writefreely/writefreely/pull/1668) - Bump github.com/gorilla/csrf from 1.7.2 to 1.7.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#1361](https://github.com/writefreely/writefreely/pull/1361) - Bump golang.org/x/net from 0.55.0 to 0.56.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1693](https://github.com/writefreely/writefreely/pull/1693) - Bump docker/login-action from 4.2.0 to 4.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1695](https://github.com/writefreely/writefreely/pull/1695) #### Upgrading from v0.16.x or earlier 1. Download the latest release for your operating system and architecture 2. Stop running your `writefreely` server 3. Replace all files in your installation (**except** for the `keys` directory) with the ones in the archive 4. Update your database by running: ``` writefreely db migrate ``` 5. Start your `writefreely` server again If you're upgrading from a much earlier version, follow the instructions in each [previous release](https://blog.writefreely.org/tag:release). #### New Contributors Thank you to all who contributed to this release! - [@smazmi](https://github.com/smazmi) made their first contribution in [#1565](https://github.com/writefreely/writefreely/pull/1565) - [@blacklight](https://github.com/blacklight) made their first contribution in [#1437](https://github.com/writefreely/writefreely/pull/1437) - [@lolbinarycat](https://github.com/lolbinarycat) made their first contribution in [#1142](https://github.com/writefreely/writefreely/pull/1142) - [@robertsilen](https://github.com/robertsilen) made their first contribution in [#1665](https://github.com/writefreely/writefreely/pull/1665) **Full Changelog**: <https://github.com/writefreely/writefreely/compare/v0.16.0...v0.17.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

jessebot (Migrated from git.smallhack.org) approved these changes

2026-07-20 08:56:41 +00:00