datakollektivet/systemer
Watch
10
0
Fork
You've already forked systemer
 0
Code Issues 2 Pull requests 4 Projects Releases Packages Wiki Activity Actions

Oppgraderer Loomio fra v3.0.14 til v3.0.24 #26

Open
gingermusketeer wants to merge 6 commits from oppgrader-loomio into main
pull from: oppgrader-loomio
merge into: datakollektivet:main
Conversation 4 Commits 6 Files changed 2 +8 -22
gingermusketeer commented 2026-04-10 12:59:47 +00:00
Owner
Copy link

Release Summaries

loomio-deploy (481288689fe54bded0689ba1c31aff319b018541 -> c976fbd20ad4c457c50e6b629b65c8128a1f96c0)

  • Add guidance for disabling a feature.
  • Add WEB_CONCURRENCY=auto Puma setting.
  • Remove unused flag FEATURES_DISABLE_PUBLIC_GROUPS (commented as disable /explore in env_template).
  • Add env option to prevent users editing profile attributes when SSO controls identity (LOOMIO_SSO_FORCE_USER_ATTRS).
  • Consolidate containers by removing channels container and running hocuspocus from the Loomio image.
  • Add LOOMIO_VERIFY_PARTICIPANTS_ADMIN_ONLY env option.
  • Add persistent volume for JS assets so assets survive deploys.
  • Update OAuth env docs to include OAUTH_ATTR_PICTURE and document OIDC defaults.
  • Files changed in compare: README.md, docker-compose.yml, env_template.

Loomio (v3.0.15 -> v3.0.24)

  • v3.0.15:
    • Rails 8 upgrade and SSO feature updates.
    • With FEATURES_DISABLE_EMAIL_LOGIN=1, first-time SSO users are created and signed in directly (no link/create account screen and no Terms acceptance step).
    • Add LOOMIO_SSO_FORCE_USER_ATTRS=1 option to prevent users changing SSO-controlled profile fields (name, email, username).
    • Group settings behavior updates:
      • "Anyone can join" flow supported for registered users.
      • Explore/directory listing behavior configurable with FEATURES_EXPLORE_PUBLIC_GROUPS=1.
    • Upgrade note repeated in release: loomio-deploy needs Redis 8.4.
  • v3.0.16:
    • Fixes issues that broke v3.0.15.
    • App boot fix for Redis and Sidekiq connection_pool incompatibility.
    • Google SSO fix.
    • Upgrade note repeated: loomio-deploy needs Redis 8.4.
  • v3.0.17:
    • Fix duplicate-email crashes in OAuth and SAML SSO authentication.
    • Remove unused canViewPublicGroups code.
    • Prevent non-members from seeing tags on closed groups.
    • Remove hiredis gem.
  • v3.0.18:
    • Rewrites SSO sign-in/sign-up linking flow:
      • Existing Loomio sessions no longer auto-link to SSO identities.
      • First-time SSO sign-ins create a new account directly.
    • Add LOOMIO_RESTRICT_EXPLORE_TO_SIGNED_IN_USERS.
    • Add polls to vote-on page.
    • Replace "invite-only" terminology with "direct discussions" wording.
    • Fix missing translation on invite-only discussions page.
  • v3.0.19:
    • Remove ability to set profile picture from SSO provider list on change picture form.
    • Large test-suite migration from rspec to minitest, reducing CI runtime significantly.
    • Release note caveat: app version string still reported 3.0.18 in that release.
  • v3.0.20:
    • Convert HAML server-rendered templates to Phlex.
    • Replace SocketIO with ActionCable and remove loomio_channel_server dependency.
    • Move hocuspocus server into main Loomio repository.
    • Move Matrix bot notification handling into Rails app.
    • Deployment note: old server setup can still work but may leave unused services.
    • Architectural simplification direction noted (fewer repos/containers; future path toward SolidCache/SolidQueue).
    • Bugfixes/improvements listed in release:
      • Fix OAuth login selecting orphan identities instead of linked identities.
      • Use user name rather than initials in avatar email/print partial.
      • Add LOOMIO_VERIFY_PARTICIPANTS_ADMIN_ONLY to restrict "verify participants" to admins.
      • Show specific error details in flash messages instead of generic form errors.
      • Add ability to remove group logo and cover photo in group settings.
  • v3.0.21:
    • Discussion and poll template UX updates.
    • New template button opens example templates as a starting point.
    • Fewer discussion templates by default.
    • Sense Check poll option updates.
    • Materialize default discussion templates as DB records.
    • Add opening_at for scheduled poll voting.
    • Poll template updates.
    • Fix minor security issue where group members could infer secret subgroup names via reports controller responses.
  • v3.0.22
    • New: STV (Single Transferable Vote) poll type — beta. Anonymous by default, results hidden until the poll closes. The form shows a warning asking users to report bugs and feedback on
    • New: GitHub.
    • New: Cloudflare Turnstile challenge on password sign-in, login-token requests, signup, and trial creation. Admin login-link sign-in bypasses the challenge; sign-in with a login code also
    • New: bypasses it.
    • New: Profile pictures via OAuth (OIDC defaults) on the OAuth client.
    • New: Track email bounces separately from complaints.
    • New: API v2b: new list endpoints for discussions and polls; limit/offset as the primary pagination params (per/from kept as aliases).
    • New: Rails Pulse added for request monitoring (Blazer removed).
    • Security: Hardened OAuth/SAML authentication flows; added Google and Nextcloud OAuth controller tests; trust SSO providers fully on auto-link.
    • Security: Fixed SQL injection in HasTimeframe via timeframe_for.
    • Security: Blocked SSRF in the link preview service; link previews now require auth and are throttled to 20/hour per user.
    • Security: Fixed operator precedence in the Group create ability.
    • Security: Restricted sensitive fields in serializers.
    • Security: Fixed trial email enumeration.
    • Security: Direct upload size limit (25 MB trial, 1 GB paid); blocked dangerous uploads.
    • Security: Stopped leaking errors in API responses; removed debug logging of secret tokens and emails from the hocuspocus controller.
    • Security: X-Robots-Tag: noindex header for non-public instances.
    • Security: Bumped vue-i18n to 9.14.5 (XSS + prototype pollution).
    • Security: Added Brakeman + bundler-audit to CI.
    • Security: Sent rate-limit events to Sentry (grouped by rule+IP to cut noise).
    • Security: Safelisted private-network IPs in rack_attack.
    • Security: Split the profile GET throttle (tight on email_status, looser elsewhere).
    • Security: Gave /bug_tunnel its own throttle and skipped Sentry alerts for it.
    • Fixes: Refresh a user's groups after joining or being added to a group.
    • Fixes: Fix translator-mangled i18n interpolation vars + a CI check to catch regressions.
    • Fixes: Handle legacy ImageMagick-style variation keys and Vips::Error in the ActiveStorage variation translator.
    • Fixes: Return a token error on session failure when a login token is pending; translate sessions errors server-side; surface server errors on login code entry.
    • Fixes: Guard Events::PollExpired and real_participant fallback against nil / non-participant eventables.
    • Fixes: Fix demo poll cloning (missing opening_at/opened_at).
    • Fixes: Translation fixes: needs_a_rethink_meaning, "vote in" → "vote on", German typo in discard.
    • Internal: Ruby 4.0.2; Puma 8; Vite 8; Vue Router 5; many dep bumps.
    • Internal: Switched to Minitest/fixtures for group export and OAuth controller tests.
  • v3.0.23
    • Fixed: Do not notify the actor when they @mention their own group.
    • Fixed: Improved German discussion context-menu translations and documented known translation traps.
    • Fixed: Make received-email allow/block actions idempotent.
    • Fixed: Retry mark-as-seen when concurrent requests hit a unique-constraint race.
    • Fixed: Guard transcription analysis against detached blobs and non-rich-text records.
    • Improved: Migrated legacy Document records to ActiveStorage attachments and removed the legacy Document model/workers.
    • Improved: Removed Rails Pulse and related schema/dependency leftovers.
    • Improved: Removed legacy loomio_channel_server setup.
    • Improved: Raised the global request-per-IP throttle from 300 to 900 per 5 minutes.
    • Improved: Made demo cloning more reliable by skipping Rails Pulse and bulk-writing translations.
    • Maintenance: Updated dependencies including Nokogiri and Puma.
  • v3.0.24
    • Fixed: Prevent comment authors from editing or restoring comments that an admin has discarded.
    • Fixed: Preserve group ownership when creating discussions from templates in grouped contexts.
    • Improved: Hardened deployment/runtime behavior with trusted ingress IP allowlisting and exec-based Docker startup processes.
    • Improved: Removed obsolete hocuspocus SQLite persistence and legacy document-list template calls.
    • Improved: Background jobs now avoid retrying forever for records that have already been deleted.
    • Maintenance: Updated dependencies including Devise, Vite, Bootsnap, Rollup, Sentry, Nokogiri, Puma, and tzinfo-data.
## Release Summaries ### loomio-deploy (481288689fe54bded0689ba1c31aff319b018541 -> c976fbd20ad4c457c50e6b629b65c8128a1f96c0) - Add guidance for disabling a feature. - Add WEB_CONCURRENCY=auto Puma setting. - Remove unused flag FEATURES_DISABLE_PUBLIC_GROUPS (commented as disable /explore in env_template). - Add env option to prevent users editing profile attributes when SSO controls identity (LOOMIO_SSO_FORCE_USER_ATTRS). - Consolidate containers by removing channels container and running hocuspocus from the Loomio image. - Add LOOMIO_VERIFY_PARTICIPANTS_ADMIN_ONLY env option. - Add persistent volume for JS assets so assets survive deploys. - Update OAuth env docs to include OAUTH_ATTR_PICTURE and document OIDC defaults. - Files changed in compare: README.md, docker-compose.yml, env_template. ### Loomio (v3.0.15 -> v3.0.24) - v3.0.15: - Rails 8 upgrade and SSO feature updates. - With FEATURES_DISABLE_EMAIL_LOGIN=1, first-time SSO users are created and signed in directly (no link/create account screen and no Terms acceptance step). - Add LOOMIO_SSO_FORCE_USER_ATTRS=1 option to prevent users changing SSO-controlled profile fields (name, email, username). - Group settings behavior updates: - "Anyone can join" flow supported for registered users. - Explore/directory listing behavior configurable with FEATURES_EXPLORE_PUBLIC_GROUPS=1. - Upgrade note repeated in release: loomio-deploy needs Redis 8.4. - v3.0.16: - Fixes issues that broke v3.0.15. - App boot fix for Redis and Sidekiq connection_pool incompatibility. - Google SSO fix. - Upgrade note repeated: loomio-deploy needs Redis 8.4. - v3.0.17: - Fix duplicate-email crashes in OAuth and SAML SSO authentication. - Remove unused canViewPublicGroups code. - Prevent non-members from seeing tags on closed groups. - Remove hiredis gem. - v3.0.18: - Rewrites SSO sign-in/sign-up linking flow: - Existing Loomio sessions no longer auto-link to SSO identities. - First-time SSO sign-ins create a new account directly. - Add LOOMIO_RESTRICT_EXPLORE_TO_SIGNED_IN_USERS. - Add polls to vote-on page. - Replace "invite-only" terminology with "direct discussions" wording. - Fix missing translation on invite-only discussions page. - v3.0.19: - Remove ability to set profile picture from SSO provider list on change picture form. - Large test-suite migration from rspec to minitest, reducing CI runtime significantly. - Release note caveat: app version string still reported 3.0.18 in that release. - v3.0.20: - Convert HAML server-rendered templates to Phlex. - Replace SocketIO with ActionCable and remove loomio_channel_server dependency. - Move hocuspocus server into main Loomio repository. - Move Matrix bot notification handling into Rails app. - Deployment note: old server setup can still work but may leave unused services. - Architectural simplification direction noted (fewer repos/containers; future path toward SolidCache/SolidQueue). - Bugfixes/improvements listed in release: - Fix OAuth login selecting orphan identities instead of linked identities. - Use user name rather than initials in avatar email/print partial. - Add LOOMIO_VERIFY_PARTICIPANTS_ADMIN_ONLY to restrict "verify participants" to admins. - Show specific error details in flash messages instead of generic form errors. - Add ability to remove group logo and cover photo in group settings. - v3.0.21: - Discussion and poll template UX updates. - New template button opens example templates as a starting point. - Fewer discussion templates by default. - Sense Check poll option updates. - Materialize default discussion templates as DB records. - Add opening_at for scheduled poll voting. - Poll template updates. - Fix minor security issue where group members could infer secret subgroup names via reports controller responses. - v3.0.22 - New: STV (Single Transferable Vote) poll type — beta. Anonymous by default, results hidden until the poll closes. The form shows a warning asking users to report bugs and feedback on - New: GitHub. - New: Cloudflare Turnstile challenge on password sign-in, login-token requests, signup, and trial creation. Admin login-link sign-in bypasses the challenge; sign-in with a login code also - New: bypasses it. - New: Profile pictures via OAuth (OIDC defaults) on the OAuth client. - New: Track email bounces separately from complaints. - New: API v2b: new list endpoints for discussions and polls; limit/offset as the primary pagination params (per/from kept as aliases). - New: Rails Pulse added for request monitoring (Blazer removed). - Security: Hardened OAuth/SAML authentication flows; added Google and Nextcloud OAuth controller tests; trust SSO providers fully on auto-link. - Security: Fixed SQL injection in HasTimeframe via timeframe_for. - Security: Blocked SSRF in the link preview service; link previews now require auth and are throttled to 20/hour per user. - Security: Fixed operator precedence in the Group create ability. - Security: Restricted sensitive fields in serializers. - Security: Fixed trial email enumeration. - Security: Direct upload size limit (25 MB trial, 1 GB paid); blocked dangerous uploads. - Security: Stopped leaking errors in API responses; removed debug logging of secret tokens and emails from the hocuspocus controller. - Security: X-Robots-Tag: noindex header for non-public instances. - Security: Bumped vue-i18n to 9.14.5 (XSS + prototype pollution). - Security: Added Brakeman + bundler-audit to CI. - Security: Sent rate-limit events to Sentry (grouped by rule+IP to cut noise). - Security: Safelisted private-network IPs in rack_attack. - Security: Split the profile GET throttle (tight on email_status, looser elsewhere). - Security: Gave /bug_tunnel its own throttle and skipped Sentry alerts for it. - Fixes: Refresh a user's groups after joining or being added to a group. - Fixes: Fix translator-mangled i18n interpolation vars + a CI check to catch regressions. - Fixes: Handle legacy ImageMagick-style variation keys and Vips::Error in the ActiveStorage variation translator. - Fixes: Return a token error on session failure when a login token is pending; translate sessions errors server-side; surface server errors on login code entry. - Fixes: Guard Events::PollExpired and real_participant fallback against nil / non-participant eventables. - Fixes: Fix demo poll cloning (missing opening_at/opened_at). - Fixes: Translation fixes: needs_a_rethink_meaning, "vote in" → "vote on", German typo in discard. - Internal: Ruby 4.0.2; Puma 8; Vite 8; Vue Router 5; many dep bumps. - Internal: Switched to Minitest/fixtures for group export and OAuth controller tests. - v3.0.23 - Fixed: Do not notify the actor when they @mention their own group. - Fixed: Improved German discussion context-menu translations and documented known translation traps. - Fixed: Make received-email allow/block actions idempotent. - Fixed: Retry mark-as-seen when concurrent requests hit a unique-constraint race. - Fixed: Guard transcription analysis against detached blobs and non-rich-text records. - Improved: Migrated legacy Document records to ActiveStorage attachments and removed the legacy Document model/workers. - Improved: Removed Rails Pulse and related schema/dependency leftovers. - Improved: Removed legacy loomio_channel_server setup. - Improved: Raised the global request-per-IP throttle from 300 to 900 per 5 minutes. - Improved: Made demo cloning more reliable by skipping Rails Pulse and bulk-writing translations. - Maintenance: Updated dependencies including Nokogiri and Puma. - v3.0.24 - Fixed: Prevent comment authors from editing or restoring comments that an admin has discarded. - Fixed: Preserve group ownership when creating discussions from templates in grouped contexts. - Improved: Hardened deployment/runtime behavior with trusted ingress IP allowlisting and exec-based Docker startup processes. - Improved: Removed obsolete hocuspocus SQLite persistence and legacy document-list template calls. - Improved: Background jobs now avoid retrying forever for records that have already been deleted. - Maintenance: Updated dependencies including Devise, Vite, Bootsnap, Rollup, Sentry, Nokogiri, Puma, and tzinfo-data.
papiris commented 2026-04-10 16:45:50 +00:00
Owner
Copy link

Har lest gjennom og ser bra ut for meg, med forebehold om at jeg ikke er kjent med Ansible eller konfigurering av Loomio

Har lest gjennom og ser bra ut for meg, med forebehold om at jeg ikke er kjent med Ansible eller konfigurering av Loomio
luisa commented 2026-07-27 16:39:49 +00:00
Owner
Copy link

Det var ganske mange endringer for en patch-oppgraderingen. Bruker ikke Loomio semantisk versjonering?
Har du testet oppgraderingsprosessen? Jeg antar vi bare gjør en backup før?

Det var ganske mange endringer for en patch-oppgraderingen. Bruker ikke Loomio semantisk versjonering? Har du testet oppgraderingsprosessen? Jeg antar vi bare gjør en backup før?
gingermusketeer commented 2026-07-30 18:31:26 +00:00
Author
Owner
Copy link

@luisa wrote in #26 (comment):

Det var ganske mange endringer for en patch-oppgraderingen. Bruker ikke Loomio semantisk versjonering?

Usikker på om de bruker semantisk versjonering. Det kan bli en utfordring å versjonere et slutt produkt. Ofte er hver endring en breaking change hvis man tenker på folk med gamle SPA assets

Har du testet oppgraderingsprosessen? Jeg antar vi bare gjør en backup før?
Ja, det har jeg. Pleier å ta en backup og muligens et maskinsnapshot fra Gigahost-konsollen.

@luisa wrote in https://forge.hornwitser.no/datakollektivet/systemer/pulls/26#issuecomment-626: > Det var ganske mange endringer for en patch-oppgraderingen. Bruker ikke Loomio semantisk versjonering? Usikker på om de bruker semantisk versjonering. Det kan bli en utfordring å versjonere et slutt produkt. Ofte er hver endring en breaking change hvis man tenker på folk med gamle SPA assets > Har du testet oppgraderingsprosessen? Jeg antar vi bare gjør en backup før? Ja, det har jeg. Pleier å ta en backup og muligens et maskinsnapshot fra Gigahost-konsollen.
gingermusketeer changed title from Oppgraderer Loomio fra v3.0.14 til v3.0.21 to Oppgraderer Loomio fra v3.0.14 til v3.0.24 2026-07-30 18:52:59 +00:00
luisa approved these changes 2026-07-30 19:24:52 +00:00
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin oppgrader-loomio:oppgrader-loomio
git switch oppgrader-loomio
Sign in to join this conversation.
Reviewers
No reviewers
luisa
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
datakollektivet/systemer!26
No description provided.