fix(deps): update dependency nodemailer to v9 [security]

.github/workflows/frontend-js-size-comment.yml

@@ -1,206 +0,0 @@
-name: Frontend JS size comment
-
-on:
-  workflow_run:
-    workflows:
-      - Frontend JS size
-    types:
-      - completed
-  pull_request_target:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-    paths:
-      - packages/frontend/**
-      - packages/frontend-shared/**
-      - packages/frontend-builder/**
-      - packages/i18n/**
-      - packages/icons-subsetter/**
-      - packages/misskey-js/**
-      - packages/misskey-reversi/**
-      - packages/misskey-bubble-game/**
-      - package.json
-      - pnpm-lock.yaml
-      - pnpm-workspace.yaml
-      - .node-version
-      - .github/workflows/frontend-js-size.yml
-      - .github/workflows/frontend-js-size-comment.yml
-
-permissions:
-  actions: read
-  contents: read
-  issues: write
-  pull-requests: write
-
-jobs:
-  comment:
-    name: Comment frontend JS size
-    if: github.event_name == 'pull_request_target' || (github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success')
-    runs-on: ubuntu-latest
-    concurrency:
-      group: frontend-js-size-comment-${{ github.event.pull_request.number || github.event.workflow_run.id }}
-      cancel-in-progress: true
-    steps:
-      - name: Find size report run
-        if: github.event_name == 'pull_request_target'
-        id: find-report-run
-        uses: actions/github-script@v9
-        with:
-          script: |
-            const workflow_id = 'frontend-js-size.yml';
-            const artifactName = 'frontend-js-size-report';
-            const headSha = context.payload.pull_request.head.sha;
-            const prNumber = context.payload.pull_request.number;
-            const pollIntervalMs = 30_000;
-            const timeoutMs = 90 * 60_000;
-            const startedAt = Date.now();
-            const { owner, repo } = context.repo;
-
-            async function listSizeWorkflowRuns() {
-              const runsForHead = await github.paginate(github.rest.actions.listWorkflowRuns, {
-                owner,
-                repo,
-                workflow_id,
-                event: 'pull_request',
-                head_sha: headSha,
-                per_page: 100,
-              });
-
-              if (runsForHead.length > 0) {
-                return runsForHead;
-              }
-
-              const recentRuns = await github.paginate(github.rest.actions.listWorkflowRuns, {
-                owner,
-                repo,
-                workflow_id,
-                event: 'pull_request',
-                per_page: 100,
-              });
-              return recentRuns.filter((run) =>
-                run.pull_requests?.some((pullRequest) => pullRequest.number === prNumber));
-            }
-
-            async function findReportRun() {
-              const runs = (await listSizeWorkflowRuns())
-                .sort((a, b) => new Date(b.updated_at) - new Date(a.updated_at));
-
-              for (const run of runs) {
-                if (run.status !== 'completed') continue;
-                if (run.conclusion !== 'success') {
-                  core.warning(`Frontend JS size run ${run.id} completed with conclusion: ${run.conclusion}`);
-                  return { done: true, run: null };
-                }
-
-                const artifacts = await github.paginate(github.rest.actions.listWorkflowRunArtifacts, {
-                  owner,
-                  repo,
-                  run_id: run.id,
-                  per_page: 100,
-                });
-                const report = artifacts.find((artifact) => artifact.name === artifactName && !artifact.expired);
-                if (report) return { done: true, run };
-              }
-
-              return { done: false, run: null };
-            }
-
-            while (Date.now() - startedAt < timeoutMs) {
-              const { done, run } = await findReportRun();
-              if (run) {
-                core.info(`Found frontend JS size report on workflow run ${run.id}.`);
-                core.setOutput('run-id', String(run.id));
-                return;
-              }
-              if (done) {
-                return;
-              }
-
-              core.info('Waiting for frontend JS size report artifact...');
-              await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
-            }
-
-            core.warning(`Timed out waiting for ${artifactName} from ${workflow_id} for ${headSha}.`);
-
-      - name: Download size report from workflow_run
-        if: github.event_name == 'workflow_run'
-        uses: actions/download-artifact@v8
-        with:
-          name: frontend-js-size-report
-          path: ${{ runner.temp }}/frontend-js-size-report
-          github-token: ${{ github.token }}
-          repository: ${{ github.repository }}
-          run-id: ${{ github.event.workflow_run.id }}
-
-      - name: Download size report from pull_request_target
-        if: github.event_name == 'pull_request_target' && steps.find-report-run.outputs.run-id != ''
-        uses: actions/download-artifact@v8
-        with:
-          name: frontend-js-size-report
-          path: ${{ runner.temp }}/frontend-js-size-report
-          github-token: ${{ github.token }}
-          repository: ${{ github.repository }}
-          run-id: ${{ steps.find-report-run.outputs.run-id }}
-
-      - name: Comment on pull request
-        if: github.event_name == 'workflow_run' || steps.find-report-run.outputs.run-id != ''
-        uses: actions/github-script@v9
-        with:
-          github-token: ${{ secrets.FRONTEND_JS_SIZE_COMMENT_TOKEN || github.token }}
-          script: |
-            const fs = require('node:fs');
-            const path = require('node:path');
-
-            const marker = '<!-- misskey-frontend-js-size -->';
-            const reportDir = path.join(process.env.RUNNER_TEMP, 'frontend-js-size-report');
-            const reportPath = [
-              path.join(reportDir, 'report.md'),
-              path.join(reportDir, 'frontend-js-size-report.md'),
-            ].find((file) => fs.existsSync(file));
-            if (reportPath == null) {
-              core.setFailed('The frontend JS size report artifact does not contain a report markdown file.');
-              return;
-            }
-
-            const body = fs.readFileSync(reportPath, 'utf8');
-            const prNumberPath = path.join(reportDir, 'pr-number.txt');
-            let issue_number = fs.existsSync(prNumberPath)
-              ? Number(fs.readFileSync(prNumberPath, 'utf8').trim())
-              : context.payload.pull_request?.number;
-            if (!body.includes(marker)) {
-              core.setFailed('The frontend JS size report is missing the expected marker.');
-              return;
-            }
-            if (!Number.isInteger(issue_number)) {
-              core.setFailed('The frontend JS size report is missing a valid pull request number.');
-              return;
-            }
-
-            const { owner, repo } = context.repo;
-
-            const comments = await github.paginate(github.rest.issues.listComments, {
-              owner,
-              repo,
-              issue_number,
-              per_page: 100,
-            });
-            const previous = comments.find((comment) =>
-              comment.user?.type === 'Bot' && comment.body?.includes(marker));
-
-            if (previous) {
-              await github.rest.issues.updateComment({
-                owner,
-                repo,
-                comment_id: previous.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner,
-                repo,
-                issue_number,
-                body,
-              });
-            }

.github/workflows/frontend-js-size.yml

@@ -1,455 +0,0 @@
-name: Frontend JS size
-
-on:
-  pull_request:
-    paths:
-      - packages/frontend/**
-      - packages/frontend-shared/**
-      - packages/frontend-builder/**
-      - packages/i18n/**
-      - packages/icons-subsetter/**
-      - packages/misskey-js/**
-      - packages/misskey-reversi/**
-      - packages/misskey-bubble-game/**
-      - package.json
-      - pnpm-lock.yaml
-      - pnpm-workspace.yaml
-      - .node-version
-      - .github/workflows/frontend-js-size.yml
-      - .github/workflows/frontend-js-size-comment.yml
-permissions:
-  contents: read
-  pull-requests: read
-
-concurrency:
-  group: frontend-js-size-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  measure:
-    name: Measure frontend JS size
-    runs-on: ubuntu-latest
-    env:
-      FRONTEND_JS_SIZE_LOCALE: ja-JP
-    steps:
-      - name: Checkout base
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: ${{ github.event.pull_request.base.repo.full_name }}
-          ref: ${{ github.event.pull_request.base.sha }}
-          path: before
-          submodules: true
-
-      - name: Checkout pull request
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: after
-          submodules: true
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6.0.3
-        with:
-          package_json_file: after/package.json
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6.4.0
-        with:
-          node-version-file: after/.node-version
-          cache: pnpm
-          cache-dependency-path: |
-            before/pnpm-lock.yaml
-            after/pnpm-lock.yaml
-
-      - name: Install dependencies for base
-        working-directory: before
-        run: pnpm i --frozen-lockfile
-
-      - name: Build frontend for base
-        working-directory: before
-        run: |
-          pnpm --filter "frontend^..." run build
-          pnpm --filter frontend run build
-
-      - name: Install dependencies for pull request
-        working-directory: after
-        run: pnpm i --frozen-lockfile
-
-      - name: Build frontend for pull request
-        working-directory: after
-        run: |
-          pnpm --filter "frontend^..." run build
-          pnpm --filter frontend run build
-
-      - name: Write report script
-        shell: bash
-        run: |
-          mkdir -p .github/tmp
-          cat > .github/tmp/frontend-js-size-report.mjs <<'NODE'
-          import { promises as fs } from 'node:fs';
-          import path from 'node:path';
-
-          const marker = '<!-- misskey-frontend-js-size -->';
-          const locale = process.env.FRONTEND_JS_SIZE_LOCALE || 'ja-JP';
-
-          function normalizePath(filePath) {
-            return filePath.split(path.sep).join('/');
-          }
-
-          async function exists(filePath) {
-            try {
-              await fs.access(filePath);
-              return true;
-            } catch {
-              return false;
-            }
-          }
-
-          async function fileSize(filePath) {
-            const stat = await fs.stat(filePath);
-            return stat.size;
-          }
-
-          async function* walk(dir) {
-            for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
-              const fullPath = path.join(dir, entry.name);
-              if (entry.isDirectory()) {
-                yield* walk(fullPath);
-              } else if (entry.isFile()) {
-                yield fullPath;
-              }
-            }
-          }
-
-          function formatBytes(size) {
-            if (size == null) return '-';
-            if (size < 1024) return `${size} B`;
-            if (size < 1024 * 1024) return `${stripTrailingZeros((size / 1024).toFixed(1))} KiB`;
-            return `${stripTrailingZeros((size / 1024 / 1024).toFixed(2))} MiB`;
-          }
-
-          function stripTrailingZeros(value) {
-            return value.replace(/\.0+$/, '').replace(/(\.\d*?)0+$/, '$1');
-          }
-
-          function formatMathText(text) {
-            return text
-              .replaceAll('\\', '\\\\')
-              .replaceAll('{', '\\{')
-              .replaceAll('}', '\\}')
-              .replaceAll('%', '\\\\%');
-          }
-
-          function formatDiff(diff) {
-            if (diff == null) return '-';
-            if (diff === 0) return '0 B';
-            const sign = diff > 0 ? '+' : '-';
-            const text = `${sign}${formatBytes(Math.abs(diff))}`;
-            const color = diff > 0 ? 'orange' : 'green';
-            return `$\\color{${color}}{\\text{${formatMathText(text)}}}$`;
-          }
-
-          function formatDiffPercent(beforeSize, afterSize) {
-            if (beforeSize == null || beforeSize === 0 || afterSize == null || afterSize === 0) return '-';
-            const diff = afterSize - beforeSize;
-            if (diff === 0) return `0%`;
-            const percent = Math.round(diff / beforeSize * 100);
-            const color = diff > 0 ? 'orange' : 'green';
-            return `$\\color{${color}}{\\text{${formatMathText(percent.toString() + '%')}}}$`;
-          }
-
-          function escapeCell(value) {
-            return String(value).replaceAll('|', '\\|').replaceAll('\n', '<br>');
-          }
-
-          function entryDisplayName(entry) {
-            if (!entry) return '';
-            return entry.displayName || entry.file;
-          }
-
-          function findEntryKey(manifest) {
-            const entries = Object.entries(manifest);
-            return entries.find(([key, chunk]) => key === 'src/_boot_.ts' || chunk.src === 'src/_boot_.ts')?.[0]
-              ?? entries.find(([, chunk]) => chunk.name === 'entry' && chunk.isEntry)?.[0]
-              ?? entries.find(([, chunk]) => chunk.isEntry)?.[0]
-              ?? null;
-          }
-
-          function stableChunkKey(manifestKey, chunk) {
-            return chunk.src ?? (chunk.name ? `chunk:${chunk.name}` : manifestKey);
-          }
-
-          function collectStartupKeys(manifest) {
-            const entryKey = findEntryKey(manifest);
-            const keys = new Set();
-            if (entryKey == null) return keys;
-
-            function visit(key) {
-              if (keys.has(key)) return;
-              const chunk = manifest[key];
-              if (!chunk || !chunk.file?.endsWith('.js')) return;
-              keys.add(stableChunkKey(key, chunk));
-              for (const importKey of chunk.imports ?? []) {
-                visit(importKey);
-              }
-            }
-
-            visit(entryKey);
-            return keys;
-          }
-
-          async function resolveBuiltFile(outDir, file) {
-            if (file.startsWith('scripts/')) {
-              const localizedFile = file.slice('scripts/'.length);
-              const localizedPath = path.join(outDir, locale, localizedFile);
-              if (await exists(localizedPath)) {
-                return {
-                  absolutePath: localizedPath,
-                  relativePath: `${locale}/${localizedFile}`,
-                };
-              }
-
-              throw new Error(`Expected ${locale} localized chunk for ${file}, but ${localizedPath} was not found.`);
-            }
-            return {
-              absolutePath: path.join(outDir, file),
-              relativePath: file,
-            };
-          }
-
-          async function collectReport(repoDir) {
-            const outDir = path.join(repoDir, 'built/_frontend_vite_');
-            const manifestPath = path.join(outDir, 'manifest.json');
-            const manifest = JSON.parse(await fs.readFile(manifestPath, 'utf8'));
-            const byKey = new Map();
-            const byFile = new Set();
-
-            for (const [key, chunk] of Object.entries(manifest)) {
-              if (!chunk.file?.endsWith('.js')) continue;
-              const builtFile = await resolveBuiltFile(outDir, chunk.file);
-              const size = await fileSize(builtFile.absolutePath);
-              const stableKey = stableChunkKey(key, chunk);
-              const displayName = chunk.src ?? chunk.name ?? key;
-              byKey.set(stableKey, {
-                key: stableKey,
-                displayName,
-                file: builtFile.relativePath,
-                size,
-              });
-              byFile.add(builtFile.relativePath);
-            }
-
-            const localeDir = path.join(outDir, locale);
-            if (await exists(localeDir)) {
-              for await (const fullPath of walk(localeDir)) {
-                if (!fullPath.endsWith('.js')) continue;
-                const relativePath = normalizePath(path.relative(outDir, fullPath));
-                if (byFile.has(relativePath)) continue;
-                const size = await fileSize(fullPath);
-                byKey.set(relativePath, {
-                  key: relativePath,
-                  displayName: relativePath,
-                  file: relativePath,
-                  size,
-                });
-              }
-            }
-
-            return {
-              manifest,
-              chunks: Object.fromEntries(byKey),
-              startupKeys: [...collectStartupKeys(manifest)],
-            };
-          }
-
-          function commonKeys(before, after) {
-            return Object.keys(before.chunks)
-              .filter((key) => after.chunks[key] != null);
-          }
-
-          function addedKeys(before, after) {
-            return Object.keys(after.chunks)
-              .filter((key) => before.chunks[key] == null);
-          }
-
-          function removedKeys(before, after) {
-            return Object.keys(before.chunks)
-              .filter((key) => after.chunks[key] == null);
-          }
-
-          function getChunkComparisonRows(keys, before, after) {
-            return keys.map((key) => {
-              const beforeEntry = before.chunks[key];
-              const afterEntry = after.chunks[key];
-              const beforeSize = beforeEntry?.size ?? 0;
-              const afterSize = afterEntry?.size ?? 0;
-              return {
-                key,
-                name: entryDisplayName(beforeEntry ?? afterEntry),
-                chunkFile: beforeEntry?.file ?? afterEntry?.file,
-                beforeSize,
-                afterSize,
-                sortSize: Math.max(beforeSize, afterSize),
-              };
-            });
-          }
-
-          function markdownTable(rows, total) {
-            if (rows.length === 0) return '_No data_';
-
-            const lines = [
-              '| Chunk | Before | After | Diff | Diff (%) |',
-              '| --- | ---: | ---: | ---: | ---: |',
-            ];
-            if (total != null) {
-              lines.push(`| (total) | ${formatBytes(total.beforeSize)} | ${formatBytes(total.afterSize)} | ${formatDiff(total.afterSize - total.beforeSize)} | ${formatDiffPercent(total.beforeSize, total.afterSize)} |`);
-              lines.push('| | | | | |');
-            }
-            for (const row of rows) {
-              lines.push(`| <details><summary>\`${escapeCell(row.name)}\`</summary> \`${escapeCell(row.chunkFile)}\` </details> | ${formatBytes(row.beforeSize)} | ${formatBytes(row.afterSize)} | ${formatDiff(row.afterSize - row.beforeSize)} | ${formatDiffPercent(row.beforeSize, row.afterSize)} |`);
-            }
-            return lines.join('\n');
-          }
-
-          function chunkRows(keys, report) {
-            return keys.map((key) => {
-              const entry = report.chunks[key];
-              return {
-                key,
-                name: entryDisplayName(entry),
-                chunkFile: entry.file,
-                size: entry.size,
-              };
-            });
-          }
-
-          function markdownChunkTable(rows) {
-            if (rows.length === 0) return '_No data_';
-
-            const lines = [
-              '| Chunk | Size |',
-              '| --- | ---: |',
-            ];
-            for (const row of rows) {
-              lines.push(`| <details><summary>\`${escapeCell(row.name)}\`</summary> \`${escapeCell(row.chunkFile)}\` </details> | ${formatBytes(row.size)} |`);
-            }
-            return lines.join('\n');
-          }
-
-          const beforeDir = process.argv[2];
-          const afterDir = process.argv[3];
-          const outFile = process.argv[4];
-          const beforeSha = process.env.BASE_SHA;
-          const afterSha = process.env.HEAD_SHA;
-
-          const before = await collectReport(beforeDir);
-          const after = await collectReport(afterDir);
-
-          const commonChunkKeys = commonKeys(before, after);
-          const comparisonRows = getChunkComparisonRows(commonChunkKeys, before, after);
-
-          const diffRows = comparisonRows
-            .filter((row) => row.beforeSize !== row.afterSize)
-            .sort((a, b) => Math.abs(b.afterSize - b.beforeSize) - Math.abs(a.afterSize - a.beforeSize)
-              || (b.afterSize - b.beforeSize) - (a.afterSize - a.beforeSize)
-              || b.sortSize - a.sortSize
-              || a.name.localeCompare(b.name))
-            .slice(0, 30);
-
-          const diffTotal = {
-            beforeSize: comparisonRows.reduce((sum, row) => sum + row.beforeSize, 0),
-            afterSize: comparisonRows.reduce((sum, row) => sum + row.afterSize, 0),
-          };
-
-          const addedRows = chunkRows(addedKeys(before, after), after)
-            .sort((a, b) => b.size - a.size || a.name.localeCompare(b.name));
-
-          const removedRows = chunkRows(removedKeys(before, after), before)
-            .sort((a, b) => b.size - a.size || a.name.localeCompare(b.name));
-
-          const startupKeys = new Set([
-            ...before.startupKeys,
-            ...after.startupKeys,
-          ]);
-          const startupComparisonRows = getChunkComparisonRows([...startupKeys], before, after);
-          const startupRows = startupComparisonRows
-            .sort((a, b) => Math.abs(b.afterSize - b.beforeSize) - Math.abs(a.afterSize - a.beforeSize)
-              || (b.afterSize - b.beforeSize) - (a.afterSize - a.beforeSize)
-              || b.sortSize - a.sortSize
-              || a.name.localeCompare(b.name));
-          const startupTotal = {
-            beforeSize: startupComparisonRows.reduce((sum, row) => sum + row.beforeSize, 0),
-            afterSize: startupComparisonRows.reduce((sum, row) => sum + row.afterSize, 0),
-          };
-
-          const largeRows = comparisonRows
-            .sort((a, b) => b.sortSize - a.sortSize || a.name.localeCompare(b.name))
-            .slice(0, 30);
-
-          const body = [
-            marker,
-            `## Frontend chunk size report (${locale})`,
-            '',
-            '<details open>',
-            `<summary>Diffs</summary>`,
-            '',
-            markdownTable(diffRows, diffTotal),
-            '',
-            '</details>',
-            '',
-            '<details>',
-            `<summary>Added (${addedRows.length})</summary>`,
-            '',
-            markdownChunkTable(addedRows),
-            '',
-            '</details>',
-            '',
-            '<details>',
-            `<summary>Removed (${removedRows.length})</summary>`,
-            '',
-            markdownChunkTable(removedRows),
-            '',
-            '</details>',
-            '',
-            '<details>',
-            `<summary>Startup</summary>`,
-            '',
-            markdownTable(startupRows, startupTotal),
-            '',
-            `_Only ${locale} localized chunks are reported. Size comparison tables include chunks that exist in both builds. Added and removed chunks are listed separately. Top 10 is sorted by max(before, after) size. Diff top 10 is sorted by absolute size diff. Startup chunks are the Vite entry for \`src/_boot_.ts\` and its static imports._`,
-            '',
-            '</details>',
-            '',
-            '<details>',
-            `<summary>Largest</summary>`,
-            '',
-            markdownTable(largeRows),
-            '',
-            '</details>',
-            '',
-          ].join('\n');
-
-          await fs.writeFile(outFile, body);
-          NODE
-
-      - name: Generate size report
-        shell: bash
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          mkdir -p frontend-js-size-report
-          node .github/tmp/frontend-js-size-report.mjs before after frontend-js-size-report.md
-          mv frontend-js-size-report.md frontend-js-size-report/report.md
-          printf '%s\n' "$PR_NUMBER" > frontend-js-size-report/pr-number.txt
-          cat frontend-js-size-report/report.md >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload size report
-        uses: actions/upload-artifact@v7
-        with:
-          name: frontend-js-size-report
-          path: frontend-js-size-report/
-          if-no-files-found: error
-          retention-days: 1

CHANGELOG.md

@@ -25,13 +25,11 @@
 - Enhance: リモートノートクリーニングジョブのスキップ処理のパフォーマンス改善
 - Enhance: リモートノートクリーニングジョブの削除対象検索処理のパフォーマンス改善
 - Enhance: ActivityPub の画像添付に width/height を含めるように
-- Enhance: URLプレビューのデフォルトの User Agent に Misskey サーバーのURLを含めるように
 - Fix: backend バンドルで `@tensorflow/tfjs-node` を external に含めず、起動時に `@mapbox/node-pre-gyp` の `find()` が backend の package.json を誤検出して `is not node-pre-gyp ready` エラーを永続的に吐く問題を修正
 - Fix: MemoryKVCacheのキャッシュGC処理において、更新されたキャッシュが期限切れにならないことがある問題を修正
 - Fix: PerUserDriveChart がシステム所有ファイル (userId が null) の更新で `"group"` の非NULL制約違反によりクラッシュする問題を修正 (#17498)
 - Fix: センシティブメディア自動検出周りの依存関係・ファイルの解決に失敗する問題を修正
 - Fix: フォロワー限定投稿を指名投稿で引用した際に、引用した投稿の公開範囲が意図せず変更される問題を修正
-- Fix: `actor` を持たない不正なInboxアクティビティを受信した際に配送ジョブが `TypeError` でクラッシュする問題を修正 (受信時に検証して400で返し、ジョブを積まないように変更)
 - Fix: Startup and shutdown failures (port-in-use, socket permission denied, plugin timeouts, leaked WebSocket connections) are now reported through the misskey logger instead of an UnhandledPromiseRejectionWarning stack trace
 - Fix: リモートのノートに対するメンション数制限が、サーバーが解決できたユーザー数ベースで行われていた問題を修正
 

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "misskey",
-	"version": "2026.6.0-beta.1",
+	"version": "2026.6.0-beta.0",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",

packages/backend/package.json

@@ -64,7 +64,7 @@
 		"@misskey-dev/emoji-assets": "17.0.3",
 		"@misskey-dev/emoji-data": "17.0.3",
 		"@misskey-dev/sharp-read-bmp": "1.2.0",
-		"@misskey-dev/summaly": "5.5.1",
+		"@misskey-dev/summaly": "5.3.0",
 		"@napi-rs/canvas": "1.0.0",
 		"@nestjs/common": "11.1.26",
 		"@nestjs/core": "11.1.26",
@@ -118,7 +118,7 @@
 		"nested-property": "4.0.0",
 		"node-fetch": "3.3.2",
 		"node-html-parser": "7.1.0",
-		"nodemailer": "8.0.10",
+		"nodemailer": "9.0.1",
 		"nsfwjs": "4.3.0",
 		"os-utils": "0.0.14",
 		"otpauth": "9.5.1",

packages/backend/rolldown.config.ts

@@ -1,5 +1,4 @@
 import { defineConfig } from 'rolldown';
-import { version as summalyVersion } from '@misskey-dev/summaly';
 import type { Plugin, ExternalOption } from 'rolldown';
 import { execa, execaNode } from 'execa';
 import type { ResultPromise } from 'execa';
@@ -85,11 +84,6 @@ export default defineConfig((args) => {
 		'file-type',
 	];
 
-	const define: Record<string, string> = {
-		// Summalyのバージョンを埋め込む
-		'_SUMMALY_VERSION_': JSON.stringify(summalyVersion),
-	};
-
 	if (isE2E) {
 		return {
 			input: './test-server/entry.ts',
@@ -98,9 +92,6 @@ export default defineConfig((args) => {
 			plugins: [
 				esmShim(),
 			],
-			transform: {
-				define,
-			},
 			output: {
 				keepNames: true,
 				sourcemap: true,
@@ -125,9 +116,6 @@ export default defineConfig((args) => {
 				esmShim(),
 				(isWatchMode ? backendDevServerPlugin() : undefined),
 			],
-			transform: {
-				define,
-			},
 			output: {
 				keepNames: true,
 				minify: !isWatchMode,

packages/backend/src/@types/global.d.ts

@@ -1,6 +0,0 @@
-/*
- * SPDX-FileCopyrightText: syuilo and misskey-project
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-declare const _SUMMALY_VERSION_: string;

packages/backend/src/core/activitypub/type.ts

@@ -58,10 +58,10 @@ export function getOneApId(value: ApObject): string {
 /**
  * Get ActivityStreams Object id
  */
-export function getApId(value: string | IObject | undefined): string {
+export function getApId(value: string | IObject): string {
 	if (typeof value === 'string') return value;
-	if (value != null && typeof value.id === 'string') return value.id;
-	throw new Error('cannot determine id');
+	if (typeof value.id === 'string') return value.id;
+	throw new Error('cannot detemine id');
 }
 
 /**

packages/backend/src/server/ActivityPubServerService.ts

@@ -174,17 +174,7 @@ export class ActivityPubServerService {
 			}
 		}
 
-		const body = request.body;
-
-		// Reject structurally invalid activities (e.g. missing actor) here instead
-		// of letting them fail deep inside the inbox processor. An actor-less
-		// activity can never be authenticated, so there is no point enqueueing it.
-		if (typeof body !== 'object' || body == null || !('actor' in body) || body.actor == null) {
-			reply.code(400);
-			return;
-		}
-
-		this.queueService.inbox(body as IActivity, signature);
+		this.queueService.inbox(request.body as IActivity, signature);
 
 		reply.code(202);
 	}

packages/backend/src/server/web/UrlPreviewService.ts

@@ -19,7 +19,6 @@ import type { FastifyRequest, FastifyReply } from 'fastify';
 @Injectable()
 export class UrlPreviewService {
 	private logger: Logger;
-	private readonly summalyDefaultUserAgent: string;
 
 	constructor(
 		@Inject(DI.config)
@@ -32,7 +31,6 @@ export class UrlPreviewService {
 		private loggerService: LoggerService,
 	) {
 		this.logger = this.loggerService.getLogger('url-preview');
-		this.summalyDefaultUserAgent = `SummalyBot/${_SUMMALY_VERSION_} (${this.config.url}; +https://github.com/misskey-dev/summaly/blob/master/README.md)`;
 	}
 
 	@bindThis
@@ -128,7 +126,7 @@ export class UrlPreviewService {
 			followRedirects: this.meta.urlPreviewAllowRedirect,
 			lang: lang ?? 'ja-JP',
 			agent: agent,
-			userAgent: meta.urlPreviewUserAgent ?? this.summalyDefaultUserAgent,
+			userAgent: meta.urlPreviewUserAgent ?? undefined,
 			operationTimeout: meta.urlPreviewTimeout,
 			contentLengthLimit: meta.urlPreviewMaximumContentLength,
 			contentLengthRequired: meta.urlPreviewRequireContentLength,
@@ -141,7 +139,7 @@ export class UrlPreviewService {
 			url: url,
 			lang: lang ?? 'ja-JP',
 			followRedirects: this.meta.urlPreviewAllowRedirect,
-			userAgent: meta.urlPreviewUserAgent ?? this.summalyDefaultUserAgent,
+			userAgent: meta.urlPreviewUserAgent ?? undefined,
 			operationTimeout: meta.urlPreviewTimeout,
 			contentLengthLimit: meta.urlPreviewMaximumContentLength,
 			contentLengthRequired: meta.urlPreviewRequireContentLength,

packages/frontend-embed/package.json

@@ -29,7 +29,7 @@
 	},
 	"devDependencies": {
 		"@misskey-dev/emoji-assets": "17.0.3",
-		"@misskey-dev/summaly": "5.5.1",
+		"@misskey-dev/summaly": "5.3.0",
 		"@tabler/icons-webfont": "3.35.0",
 		"@testing-library/vue": "8.1.0",
 		"@types/estree": "1.0.9",

packages/frontend-embed/vite.config.ts

@@ -153,10 +153,11 @@ export function getConfig(): UserConfig {
 							name: 'vue',
 							test: /node_modules[\\/]vue/,
 						}, {
-							// split i18n related module to distinct module
+							// split each i18n related module to each distinct module, deny hoisting
 							name: 'i18n',
-							includeDependenciesRecursively: false,
-							test: /i18n\.ts|locale\.ts/,
+							test: /i18n\.ts/,
+							minSize: 0,
+							maxSize: 1,
 						}],
 					},
 					entryFileNames: `scripts/${localesHash}-[hash:8].js`,

packages/frontend/package.json

@@ -72,7 +72,7 @@
 	},
 	"devDependencies": {
 		"@misskey-dev/emoji-assets": "17.0.3",
-		"@misskey-dev/summaly": "5.5.1",
+		"@misskey-dev/summaly": "5.3.0",
 		"@rollup/plugin-json": "6.1.0",
 		"@rollup/pluginutils": "5.4.0",
 		"@storybook/addon-essentials": "8.6.18",

packages/frontend/vite.config.ts

@@ -194,10 +194,11 @@ export function getConfig(): UserConfig {
 							name: 'photoswipe',
 							test: /node_modules[\\/]photoswipe/,
 						}, {
-							// split i18n related module to distinct module
+							// split each i18n related module to each distinct module, deny hoisting
 							name: 'i18n',
-							includeDependenciesRecursively: false,
-							test: /i18n\.ts|locale\.ts/,
+							test: /i18n\.ts/,
+							minSize: 0,
+							maxSize: 1,
 						}],
 					},
 					entryFileNames: `scripts/${localesHash}-[hash:8].js`,

packages/misskey-js/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "misskey-js",
-	"version": "2026.6.0-beta.1",
+	"version": "2026.6.0-beta.0",
 	"description": "Misskey SDK for JavaScript",
 	"license": "MIT",
 	"main": "./built/index.js",

pnpm-workspace.yaml

@@ -59,12 +59,12 @@ minimumReleaseAgeExclude:
   - vite # 脆弱性対応。そのうち消す
   - form-data # 脆弱性対応。そのうち消す
   - tar
+  # Renovate security update: nodemailer@9.0.1
+  - nodemailer@9.0.1
 overrides:
   '@aiscript-dev/aiscript-languageserver': '-'
   chokidar: 5.0.0
   lodash: 4.18.1
-  # remove when vite is updated to versions with rolldown > 1.1.0
-  vite>rolldown: "~1.1.0"
 engineStrict: true
 saveExact: true
 shellEmulator: true