Merge pull request #17458 from misskey-dev/develop

Release: 2026.5.4

CHANGELOG.md

@@ -1,10 +1,10 @@
 ## 2026.5.4
 
 ### General
--
+- セキュリティに関する修正
 
 ### Client
--
+- Fix: ビルドに失敗することがある問題を修正
 
 ### Server
 -

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "misskey",
-	"version": "2026.5.4-alpha.0",
+	"version": "2026.5.4",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",

packages/backend/src/core/AnnouncementService.ts

@@ -182,11 +182,12 @@ export class AnnouncementService {
 	@bindThis
 	public async getAnnouncement(announcementId: MiAnnouncement['id'], me: MiUser | null): Promise<Packed<'Announcement'>> {
 		const announcement = await this.announcementsRepository.findOneByOrFail({ id: announcementId });
-		if (me) {
-			if (announcement.userId && announcement.userId !== me.id) {
-				throw new EntityNotFoundError(this.announcementsRepository.metadata.target, { id: announcementId });
-			}
 
+		if (announcement.userId && (me == null || announcement.userId !== me.id)) {
+			throw new EntityNotFoundError(this.announcementsRepository.metadata.target, { id: announcementId });
+		}
+
+		if (me) {
 			const read = await this.announcementReadsRepository.findOneBy({
 				announcementId: announcement.id,
 				userId: me.id,

packages/backend/src/core/activitypub/JsonLdService.ts

@@ -35,7 +35,7 @@ export class JsonLdCacheFrozenError extends JsonLdError {
 	}
 }
 
-export class JsonLdForbiddenDriectiveError extends JsonLdError {
+export class JsonLdForbiddenDirectiveError extends JsonLdError {
 	constructor(public directive: string) {
 		super('0297f79b-0ed9-4b6c-875f-b0a82ff96781', `${directive} is forbidden by Misskey in ActivityPub documents`);
 	}
@@ -157,7 +157,7 @@ export class JsonLd {
 				const object = value;
 				for (const [key, value] of Object.entries(object)) {
 					if (JsonLd.forbiddenDirectives.has(key)) {
-						throw new JsonLdForbiddenDriectiveError(key);
+						throw new JsonLdForbiddenDirectiveError(key);
 					}
 
 					if (typeof value === 'object' && value !== null) {

packages/frontend-shared/js/theme.ts

@@ -29,7 +29,7 @@ export type Theme = {
 
 export type CompiledTheme = Record<string, string>;
 
-const MAX_THEME_REFERENCE_DEPTH = 4;
+const MAX_THEME_REFERENCE_DEPTH = 8;
 
 export const themeProps = Object.keys(lightTheme.props).filter(key => !key.startsWith('X'));
 
@@ -76,15 +76,15 @@ function getThemeReferenceColor(theme: Theme, key: string, stack: string[], dept
 }
 
 function getColor(theme: Theme, val: string, stack: string[] = [], depth = 0): tinycolor.Instance {
-	if (depth >= MAX_THEME_REFERENCE_DEPTH) {
-		throw new Error('Theme reference limit exceeded');
-	}
-
 	if (val[0] === '@') { // ref (prop)
 		return getThemeReferenceColor(theme, val.substring(1), stack, depth);
 	} else if (val[0] === '$') { // ref (const)
 		return getThemeReferenceColor(theme, val, stack, depth);
 	} else if (val[0] === ':') { // func
+		if (depth >= MAX_THEME_REFERENCE_DEPTH) {
+			throw new Error('Theme reference limit exceeded');
+		}
+
 		const parts = val.split('<');
 		const funcTxt = parts.shift();
 		const argTxt = parts.shift();

packages/misskey-js/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "misskey-js",
-	"version": "2026.5.4-alpha.0",
+	"version": "2026.5.4",
 	"description": "Misskey SDK for JavaScript",
 	"license": "MIT",
 	"main": "./built/index.js",