Merge pull request #3553 from glitch-soc/glitch-soc/merge-4.6

Merge upstream changes up to 70d39d364ba6183a2b6e2f763204fe2c21e0ca42 into stable-4.6

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [4.6.2] - 2026-06-25
+
+### Security
+
+- Update FFMpeg version used in the container image to fix [CVE-2026-8461](https://github.com/advisories/GHSA-qff7-4q6c-m8h6) (critical severity)
+
 ## [4.6.1] - 2026-06-24
 
 ### Security

Dockerfile

@@ -234,7 +234,7 @@ FROM media-build AS ffmpeg
 
 # ffmpeg version to compile, change with [--build-arg FFMPEG_VERSION="7.0.x"]
 # renovate: datasource=github-tags depName=FFmpeg/FFmpeg extractVersion=^n(?<version>\d+\.\d+(\.\d+)?)$
-ARG FFMPEG_VERSION=8.1.1
+ARG FFMPEG_VERSION=8.1.2
 # ffmpeg download URL, change with [--build-arg FFMPEG_URL="https://ffmpeg.org/releases"]
 ARG FFMPEG_URL=https://github.com/FFmpeg/FFmpeg/archive/refs/tags
 

docker-compose.yml

@@ -60,7 +60,7 @@ services:
   web:
     # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes
     # build: .
-    image: ghcr.io/glitch-soc/mastodon:v4.6.1
+    image: ghcr.io/glitch-soc/mastodon:v4.6.2
     restart: always
     env_file: .env.production
     command: bundle exec puma -C config/puma.rb
@@ -84,7 +84,7 @@ services:
     # build:
     #   dockerfile: ./streaming/Dockerfile
     #   context: .
-    image: ghcr.io/glitch-soc/mastodon-streaming:v4.6.1
+    image: ghcr.io/glitch-soc/mastodon-streaming:v4.6.2
     restart: always
     env_file: .env.production
     command: node ./streaming/index.js
@@ -103,7 +103,7 @@ services:
   sidekiq:
     # You can uncomment the following line if you want to not use the prebuilt image, for example if you have local code changes
     # build: .
-    image: ghcr.io/glitch-soc/mastodon:v4.6.1
+    image: ghcr.io/glitch-soc/mastodon:v4.6.2
     restart: always
     env_file: .env.production
     command: bundle exec sidekiq

lib/mastodon/version.rb

@@ -13,7 +13,7 @@ module Mastodon
     end
 
     def patch
-      1
+      2
     end
 
     def default_prerelease