Release: 2026.5.4

Merge commit from fork
This issue was originally reported by sururu-k as part of a series of ai slop public pull requests. Although the original pull request was closed as ai slop, I later confirmed one described a real security issue.
2026-07-01 10:34:58 +02:00 · 2026-05-21 00:31:56 +00:00 · 2026-05-21 08:50:43 +09:00
3 changed files with 7 additions and 6 deletions
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "misskey",
-	"version": "2026.5.4-beta.0",
+	"version": "2026.5.4",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",
--- a/packages/backend/src/core/AnnouncementService.ts
+++ b/packages/backend/src/core/AnnouncementService.ts
@@ -182,11 +182,12 @@ export class AnnouncementService {
 	@bindThis
 	public async getAnnouncement(announcementId: MiAnnouncement['id'], me: MiUser | null): Promise<Packed<'Announcement'>> {
 		const announcement = await this.announcementsRepository.findOneByOrFail({ id: announcementId });
-		if (me) {
-			if (announcement.userId && announcement.userId !== me.id) {
-				throw new EntityNotFoundError(this.announcementsRepository.metadata.target, { id: announcementId });
-			}

+		if (announcement.userId && (me == null || announcement.userId !== me.id)) {
+			throw new EntityNotFoundError(this.announcementsRepository.metadata.target, { id: announcementId });
+		}
+
+		if (me) {
 			const read = await this.announcementReadsRepository.findOneBy({
 				announcementId: announcement.id,
 				userId: me.id,
--- a/packages/misskey-js/package.json
+++ b/packages/misskey-js/package.json
@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "misskey-js",
-	"version": "2026.5.4-beta.0",
+	"version": "2026.5.4",
 	"description": "Misskey SDK for JavaScript",
 	"license": "MIT",
 	"main": "./built/index.js",