Merge branch 'develop' into minify-backend

.config/example.yml

@@ -107,13 +107,51 @@ port: 3000
 
 # Proxy trust settings
 #
-# Changes how the server interpret the origin IP of the request.
+# Specifies the IP addresses that Misskey will use as trusted
+# reverse proxies (e.g., nginx, Cloudflare). This affects how
+# Misskey determines the source IP for each request and is used
+# for important rate limiting and security features. If the value
+# is not set correctly, Misskey may use the IP address of the
+# reverse proxy instead of the actual source IP, which may lead to
+# unintended rate limiting or security vulnerabilities.
+# By default, the loopback network and private network address
+# ranges shown below are trusted.
+# If you are using a single reverse proxy and it is on the same
+# machine or the same private network as Misskey, it is unlikely you
+# need to change this setting, and the default setting is fine.
+# Also, if you are using multiple reverse proxy servers and they are
+# all on the same private network as Misskey, the default setting
+# is fine.
+# However, if you are using a reverse proxy server that accesses
+# Misskey web servers and streaming servers via public IP addresses
+# (for example, Cloudflare), you must set this variable.
+# When changing this setting, you can use one of the following values:
 #
-# Any format supported by Fastify is accepted.
+# - true: Trust all proxies
-# Default: trust all proxies (i.e. trustProxy: true)
+# - false: Do not trust any proxies
-# See: https://fastify.dev/docs/latest/reference/server/#trustproxy
+# - IP address, IP address range, or array of them: Trust hops that
+#   match the specified criteria.
+# - Integer: Trust the nth hop from the front-facing proxy server as
+#   the client.
+# For more information on how to configure this setting, please refer
+# to the Fastify documentation:
+# https://fastify.dev/docs/latest/Reference/Server/#trustproxy
 #
-# trustProxy: 1
+# Note that if this variable is set, it overrides the default range,
+# so if you have both an external reverse proxy and a proxy on the
+# local host, you must include both IPs (or IP ranges).
+#
+#trustProxy:
+#  - '10.0.0.0/8'
+#  - '172.16.0.0/12'
+#  - '192.168.0.0/16'
+#  - '127.0.0.1/32'
+#  - '::1/128'
+#  - 'fc00::/7'
+#  # Example: If you are using some external reverse proxies like CDNs,
+#  # you may need to add the CDN IP ranges here.
+#  # If you're using Cloudflare, you can find IP Ranges at:
+#  # https://www.cloudflare.com/ips/
 
 #   ┌──────────────────────────┐
 #───┘ PostgreSQL configuration └────────────────────────────────
@@ -283,6 +321,10 @@ id: 'aidx'
 # Whether disable HSTS
 #disableHsts: true
 
+# Enable internal IP-based rate limiting (default: true)
+# To configure them in reverse proxy instead, set this to false.
+#enableIpRateLimit: true
+
 # Number of worker processes
 #clusterLimit: 1
 

.devcontainer/devcontainer.json

@@ -5,7 +5,7 @@
 	"workspaceFolder": "/workspace",
 	"features": {
 		"ghcr.io/devcontainers/features/node:1": {
-			"version": "24.10.0"
+			"version": "22.15.0"
 		},
 		"ghcr.io/devcontainers-extra/features/pnpm:2": {
 			"version": "10.10.0"

.github/workflows/api-misskey-js.yml

@@ -16,13 +16,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4.2.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.1.0
         with:
           node-version-file: '.node-version'
           cache: 'pnpm'

.github/workflows/changelog-check.yml

@@ -12,9 +12,9 @@ jobs:
 
     steps:
       - name: Checkout head
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
       - name: Setup Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.1.0
         with:
           node-version-file: '.node-version'
 

.github/workflows/check-misskey-js-autogen.yml

@@ -18,7 +18,7 @@ jobs:
     if: ${{ github.event.pull_request.mergeable == null || github.event.pull_request.mergeable == true }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
         with:
           submodules: true
           persist-credentials: false
@@ -29,7 +29,7 @@ jobs:
 
       - name: setup node
         id: setup-node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.1.0
         with:
           node-version-file: '.node-version'
           cache: pnpm
@@ -53,7 +53,7 @@ jobs:
 
       # packages/misskey-js/generator/built/autogen
       - name: Upload Generated
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: generated-misskey-js
           path: packages/misskey-js/generator/built/autogen
@@ -66,14 +66,14 @@ jobs:
     if: ${{ github.event.pull_request.mergeable == null || github.event.pull_request.mergeable == true }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
         with:
           submodules: true
           persist-credentials: false
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
 
       - name: Upload From Merged
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: actual-misskey-js
           path: packages/misskey-js/src/autogen
@@ -86,13 +86,13 @@ jobs:
       pull-requests: write
     steps:
       - name: download generated-misskey-js
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: generated-misskey-js
           path: misskey-js-generated
 
       - name: download actual-misskey-js
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: actual-misskey-js
           path: misskey-js-actual
@@ -113,9 +113,9 @@ jobs:
 
       - name: send message
         if: steps.check-changes.outputs.changes == 'true'
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@v3
         with:
-          comment_tag: check-misskey-js-autogen
+          comment-tag: check-misskey-js-autogen
           message: |-
             Thank you for sending us a great Pull Request! 👍
             Please regenerate misskey-js type definitions! 🙏
@@ -127,9 +127,9 @@ jobs:
 
       - name: send message
         if: steps.check-changes.outputs.changes == 'false'
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@v3
         with:
-          comment_tag: check-misskey-js-autogen
+          comment-tag: check-misskey-js-autogen
           mode: delete
           message: "Thank you!"
           create_if_not_exists: false

.github/workflows/check-misskey-js-version.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
       - name: Check version
         run: |
           if [ "$(jq -r '.version' package.json)" != "$(jq -r '.version' packages/misskey-js/package.json)" ]; then

.github/workflows/check-spdx-license-id.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
       - name: Check
         run: |
           counter=0

.github/workflows/check_copyright_year.yml

@@ -10,7 +10,7 @@ jobs:
   check_copyright_year:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
     - run: |
         if [ "$(grep Copyright COPYING | sed -e 's/.*2014-\([0-9]*\) .*/\1/g')" -ne "$(date +%Y)" ]; then
           echo "Please change copyright year!"

.github/workflows/deploy-test-environment.yml

@@ -28,7 +28,7 @@ jobs:
       wait_time: ${{ steps.get-wait-time.outputs.wait_time }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
 
       - name: Check allowed users
         id: check-allowed-users

.github/workflows/docker-develop.yml

@@ -27,7 +27,7 @@ jobs:
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
       - name: Check out the repo
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Log in to Docker Hub
@@ -53,7 +53,7 @@ jobs:
           digest="${{ steps.build.outputs.digest }}"
           touch "/tmp/digests/${digest#sha256:}"
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: digests-${{ env.PLATFORM_PAIR }}
           path: /tmp/digests/*
@@ -66,7 +66,7 @@ jobs:
       - build
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           path: /tmp/digests
           pattern: digests-*

.github/workflows/docker.yml

@@ -32,7 +32,7 @@ jobs:
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
       - name: Check out the repo
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Docker meta
@@ -64,7 +64,7 @@ jobs:
           digest="${{ steps.build.outputs.digest }}"
           touch "/tmp/digests/${digest#sha256:}"
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: digests-${{ env.PLATFORM_PAIR }}
           path: /tmp/digests/*
@@ -77,7 +77,7 @@ jobs:
       - build
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           path: /tmp/digests
           pattern: digests-*

.github/workflows/dockle.yml

@@ -11,38 +11,43 @@ on:
 jobs:
   dockle:
     runs-on: ubuntu-latest
+
     env:
       DOCKER_CONTENT_TRUST: 1
       DOCKLE_VERSION: 0.4.15
 
     steps:
-      - uses: actions/checkout@v4.3.0
+      - uses: actions/checkout@v6.0.1
 
       - name: Download and install dockle v${{ env.DOCKLE_VERSION }}
         run: |
+          set -eux
           curl -L -o dockle.deb "https://github.com/goodwithtech/dockle/releases/download/v${DOCKLE_VERSION}/dockle_${DOCKLE_VERSION}_Linux-64bit.deb"
           sudo dpkg -i dockle.deb
 
-      - run: |
+      - name: Build web image (docker build)
-          cp .config/docker_example.env .config/docker.env
-          cp ./compose_example.yml ./compose.yml
-
-      - run: |
-          docker compose up -d web
-          IMAGE_ID=$(docker compose images --format json web | jq -r '.[0].ID')
-          docker tag "${IMAGE_ID}" misskey-web:latest
-
-      - name: Prune docker junk (optional but recommended)
         run: |
-          docker system prune -af
+          set -eux
-          docker volume prune -f
+          docker build -t "misskey-web:ci" .
+          docker image ls
 
-      - name: Save image for Dockle
+      - name: Mount tmpfs for Dockle tar
+        env:
+          TMPFS_SIZE: 8G
         run: |
-          docker save misskey-web:latest -o ./misskey-web.tar
+          set -eux
-          ls -lh ./misskey-web.tar
+          sudo mkdir -p /mnt/dockle-tmp
+          sudo mount -t tmpfs -o size=${{ env.TMPFS_SIZE }} tmpfs /mnt/dockle-tmp
+          free -h
+          df -h
 
-      - name: Run Dockle with tar input
+      - name: Save image tar into tmpfs
         run: |
-          dockle --exit-code 1 --input ./misskey-web.tar
+          set -eux
+          docker save misskey-web:ci -o /mnt/dockle-tmp/misskey-web.tar
+          ls -lh /mnt/dockle-tmp/misskey-web.tar
 
+      - name: Run Dockle Scan (tar input)
+        run: |
+          set -eux
+          dockle --exit-code 1 --input /mnt/dockle-tmp/misskey-web.tar

.github/workflows/get-api-diff.yml

@@ -25,14 +25,14 @@ jobs:
             ref: refs/pull/${{ github.event.number }}/merge
 
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       with:
         ref: ${{ matrix.ref }}
         submodules: true
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.2.0
     - name: Use Node.js
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@v6.1.0
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'
@@ -48,7 +48,7 @@ jobs:
     - name: Copy API.json
       run: cp packages/backend/built/api.json ${{ matrix.api-json-name }}
     - name: Upload Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: api-artifact-${{ matrix.api-json-name }}
         path: ${{ matrix.api-json-name }}
@@ -61,7 +61,7 @@ jobs:
           PR_NUMBER: ${{ github.event.number }}
         run: |
           echo "$PR_NUMBER" > ./pr_number
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: api-artifact-pr-number
           path: pr_number

.github/workflows/get-backend-memory.yml

@@ -0,0 +1,87 @@
+# this name is used in report-backend-memory.yml so be careful when change name
+name: Get backend memory usage
+
+on:
+  pull_request:
+    branches:
+      - master
+      - develop
+    paths:
+      - packages/backend/**
+      - packages/misskey-js/**
+      - .github/workflows/get-backend-memory.yml
+
+jobs:
+  get-memory-usage:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    strategy:
+      matrix:
+        memory-json-name: [memory-base.json, memory-head.json]
+        include:
+          - memory-json-name: memory-base.json
+            ref: ${{ github.base_ref }}
+          - memory-json-name: memory-head.json
+            ref: refs/pull/${{ github.event.number }}/merge
+
+    services:
+      postgres:
+        image: postgres:18
+        ports:
+          - 54312:5432
+        env:
+          POSTGRES_DB: test-misskey
+          POSTGRES_HOST_AUTH_METHOD: trust
+      redis:
+        image: redis:7
+        ports:
+          - 56312:6379
+
+    steps:
+    - uses: actions/checkout@v6.0.1
+      with:
+        ref: ${{ matrix.ref }}
+        submodules: true
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v4.2.0
+    - name: Use Node.js
+      uses: actions/setup-node@v6.1.0
+      with:
+        node-version-file: '.node-version'
+        cache: 'pnpm'
+    - run: pnpm i --frozen-lockfile
+    - name: Check pnpm-lock.yaml
+      run: git diff --exit-code pnpm-lock.yaml
+    - name: Copy Configure
+      run: cp .github/misskey/test.yml .config/default.yml
+    - name: Compile Configure
+      run: pnpm compile-config
+    - name: Build
+      run: pnpm build
+    - name: Run migrations
+      run: pnpm --filter backend migrate
+    - name: Measure memory usage
+      run: |
+        # Start the server and measure memory usage
+        node packages/backend/scripts/measure-memory.mjs > ${{ matrix.memory-json-name }}
+    - name: Upload Artifact
+      uses: actions/upload-artifact@v6
+      with:
+        name: memory-artifact-${{ matrix.memory-json-name }}
+        path: ${{ matrix.memory-json-name }}
+
+  save-pr-number:
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Save PR number
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+        run: |
+          echo "$PR_NUMBER" > ./pr_number
+      - uses: actions/upload-artifact@v6
+        with:
+          name: memory-artifact-pr-number
+          path: pr_number

.github/workflows/labeler.yml

@@ -11,6 +11,6 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@v6
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/lint.yml

@@ -36,13 +36,13 @@ jobs:
   pnpm_install:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       with:
         fetch-depth: 0
         submodules: true
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.2.0
-    - uses: actions/setup-node@v4.4.0
+    - uses: actions/setup-node@v6.1.0
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'
@@ -69,13 +69,13 @@ jobs:
       eslint-cache-version: v1
       eslint-cache-path: ${{ github.workspace }}/node_modules/.cache/eslint-${{ matrix.workspace }}
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       with:
         fetch-depth: 0
         submodules: true
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.2.0
-    - uses: actions/setup-node@v4.4.0
+    - uses: actions/setup-node@v6.1.0
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'
@@ -100,13 +100,13 @@ jobs:
         - sw
         - misskey-js
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       with:
         fetch-depth: 0
         submodules: true
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.2.0
-    - uses: actions/setup-node@v4.4.0
+    - uses: actions/setup-node@v6.1.0
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'

.github/workflows/locale.yml

@@ -16,13 +16,13 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4.3.0
+      - uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
           submodules: true
       - name: Setup pnpm
         uses: pnpm/action-setup@v4.2.0
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/setup-node@v6.1.0
         with:
           node-version-file: ".node-version"
           cache: "pnpm"

.github/workflows/on-release-created.yml

@@ -16,13 +16,13 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4.3.0
+      - uses: actions/checkout@v6.0.1
         with:
           submodules: true
       - name: Setup pnpm
         uses: pnpm/action-setup@v4.2.0
       - name: Use Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.1.0
         with:
           node-version-file: '.node-version'
           cache: 'pnpm'

.github/workflows/release-edit-with-push.yml

@@ -19,7 +19,7 @@ jobs:
   edit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       # headが$GITHUB_REF_NAME, baseが$STABLE_BRANCHかつopenのPRを1つ取得
       - name: Get PR
         run: |

.github/workflows/release-with-dispatch.yml

@@ -36,7 +36,7 @@ jobs:
     outputs:
       pr_number: ${{ steps.get_pr.outputs.pr_number }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       # headが$GITHUB_REF_NAME, baseが$STABLE_BRANCHかつopenのPRを1つ取得
       - name: Get PRs
         run: |

.github/workflows/report-api-diff.yml

@@ -16,7 +16,7 @@ jobs:
 # api-artifact
     steps:
       - name: Download artifact
-        uses: actions/github-script@v7.1.0
+        uses: actions/github-script@v8.0.0
         with:
           script: |
             const fs = require('fs');
@@ -60,7 +60,7 @@ jobs:
       - name: Echo full diff
         run: cat ./api-full.json.diff
       - name: Upload full diff to Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: api-artifact
           path: |
@@ -89,16 +89,16 @@ jobs:
           fi
 
           echo "$FOOTER" >> ./output.md
-      - uses: thollander/actions-comment-pull-request@v2
+      - uses: thollander/actions-comment-pull-request@v3
         with:
-          pr_number: ${{ steps.load-pr-num.outputs.pr-number }}
+          pr-number: ${{ steps.load-pr-num.outputs.pr-number }}
-          comment_tag: show_diff
+          comment-tag: show_diff
-          filePath: ./output.md
+          file-path: ./output.md
       - name: Tell error to PR
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@v3
         if: failure() && steps.load-pr-num.outputs.pr-number
         with:
-          pr_number: ${{ steps.load-pr-num.outputs.pr-number }}
+          pr-number: ${{ steps.load-pr-num.outputs.pr-number }}
-          comment_tag: show_diff_error
+          comment-tag: show_diff_error
           message: |
             api.jsonの差分作成中にエラーが発生しました。詳細は[Workflowのログ](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})を確認してください。

.github/workflows/report-backend-memory.yml

@@ -0,0 +1,122 @@
+name: Report backend memory
+
+on:
+  workflow_run:
+    types: [completed]
+    workflows:
+      - Get backend memory usage # get-backend-memory.yml
+
+jobs:
+  compare-memory:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Download artifact
+        uses: actions/github-script@v8.0.0
+        with:
+          script: |
+            const fs = require('fs');
+            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: context.payload.workflow_run.id,
+            });
+            let matchArtifacts = allArtifacts.data.artifacts.filter((artifact) => {
+              return artifact.name.startsWith("memory-artifact-") || artifact.name == "memory-artifact"
+            });
+            await Promise.all(matchArtifacts.map(async (artifact) => {
+              let download = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: artifact.id,
+                archive_format: 'zip',
+              });
+              await fs.promises.writeFile(`${process.env.GITHUB_WORKSPACE}/${artifact.name}.zip`, Buffer.from(download.data));
+            }));
+      - name: Extract all artifacts
+        run: |
+          find . -mindepth 1 -maxdepth 1 -type f -name '*.zip' -exec unzip {} -d artifacts ';'
+          ls -la artifacts/
+      - name: Load PR Number
+        id: load-pr-num
+        run: echo "pr-number=$(cat artifacts/pr_number)" >> "$GITHUB_OUTPUT"
+
+      - name: Output base
+        run: cat ./artifacts/memory-base.json
+      - name: Output head
+        run: cat ./artifacts/memory-head.json
+      - name: Compare memory usage
+        id: compare
+        run: |
+          BASE_MEMORY=$(cat ./artifacts/memory-base.json)
+          HEAD_MEMORY=$(cat ./artifacts/memory-head.json)
+
+          BASE_RSS=$(echo "$BASE_MEMORY" | jq -r '.memory.rss // 0')
+          HEAD_RSS=$(echo "$HEAD_MEMORY" | jq -r '.memory.rss // 0')
+
+          # Calculate difference
+          if [ "$BASE_RSS" -gt 0 ] && [ "$HEAD_RSS" -gt 0 ]; then
+            DIFF=$((HEAD_RSS - BASE_RSS))
+            DIFF_PERCENT=$(echo "scale=2; ($DIFF * 100) / $BASE_RSS" | bc)
+
+            # Convert to MB for readability
+            BASE_MB=$(echo "scale=2; $BASE_RSS / 1048576" | bc)
+            HEAD_MB=$(echo "scale=2; $HEAD_RSS / 1048576" | bc)
+            DIFF_MB=$(echo "scale=2; $DIFF / 1048576" | bc)
+
+            echo "base_mb=$BASE_MB" >> "$GITHUB_OUTPUT"
+            echo "head_mb=$HEAD_MB" >> "$GITHUB_OUTPUT"
+            echo "diff_mb=$DIFF_MB" >> "$GITHUB_OUTPUT"
+            echo "diff_percent=$DIFF_PERCENT" >> "$GITHUB_OUTPUT"
+            echo "has_data=true" >> "$GITHUB_OUTPUT"
+
+            # Determine if this is a significant change (more than 5% increase)
+            if [ "$(echo "$DIFF_PERCENT > 5" | bc)" -eq 1 ]; then
+              echo "significant_increase=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "significant_increase=false" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "has_data=false" >> "$GITHUB_OUTPUT"
+          fi
+      - id: build-comment
+        name: Build memory comment
+        run: |
+          HEADER="## Backend Memory Usage Comparison"
+          FOOTER="[See workflow logs for details](https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID})"
+
+          echo "$HEADER" > ./output.md
+          echo >> ./output.md
+
+          if [ "${{ steps.compare.outputs.has_data }}" == "true" ]; then
+            echo "| Metric | base | head | Diff |" >> ./output.md
+            echo "|--------|------|------|------|" >> ./output.md
+            echo "| RSS | ${{ steps.compare.outputs.base_mb }} MB | ${{ steps.compare.outputs.head_mb }} MB | ${{ steps.compare.outputs.diff_mb }} MB (${{ steps.compare.outputs.diff_percent }}%) |" >> ./output.md
+            echo >> ./output.md
+
+            if [ "${{ steps.compare.outputs.significant_increase }}" == "true" ]; then
+              echo "⚠️ **Warning**: Memory usage has increased by more than 5%. Please verify this is not an unintended change." >> ./output.md
+              echo >> ./output.md
+            fi
+          else
+            echo "Could not retrieve memory usage data." >> ./output.md
+            echo >> ./output.md
+          fi
+
+          echo "$FOOTER" >> ./output.md
+      - uses: thollander/actions-comment-pull-request@v3
+        with:
+          pr-number: ${{ steps.load-pr-num.outputs.pr-number }}
+          comment-tag: show_memory_diff
+          file-path: ./output.md
+      - name: Tell error to PR
+        uses: thollander/actions-comment-pull-request@v3
+        if: failure() && steps.load-pr-num.outputs.pr-number
+        with:
+          pr-number: ${{ steps.load-pr-num.outputs.pr-number }}
+          comment-tag: show_memory_diff_error
+          message: |
+            An error occurred while comparing backend memory usage. See [workflow logs](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details.

.github/workflows/request-release-review.yml

@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Reply
-        uses: actions/github-script@v6
+        uses: actions/github-script@v8
         with:
           script: |
             const body = `To dev team (@misskey-dev/dev):

.github/workflows/storybook.yml

@@ -22,12 +22,12 @@ jobs:
       NODE_OPTIONS: "--max_old_space_size=7168"
 
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       if: github.event_name != 'pull_request_target'
       with:
         fetch-depth: 0
         submodules: true
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       if: github.event_name == 'pull_request_target'
       with:
         fetch-depth: 0
@@ -39,7 +39,7 @@ jobs:
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.2.0
     - name: Use Node.js
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@v6.1.0
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'
@@ -90,7 +90,7 @@ jobs:
       env:
         CHROMATIC_PROJECT_TOKEN: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
     - name: Notify that Chromatic detects changes
-      uses: actions/github-script@v7.1.0
+      uses: actions/github-script@v8.0.0
       if: github.event_name != 'pull_request_target' && steps.chromatic_push.outputs.success == 'false'
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -102,7 +102,7 @@ jobs:
             body: 'Chromatic detects changes. Please [review the changes on Chromatic](https://www.chromatic.com/builds?appId=6428f7d7b962f0b79f97d6e4).'
           })
     - name: Upload Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: storybook
         path: packages/frontend/storybook-static

.github/workflows/test-backend.yml

@@ -50,7 +50,7 @@ jobs:
           - 56312:6379
 
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       with:
         submodules: true
     - name: Setup pnpm
@@ -86,7 +86,7 @@ jobs:
           fi
         done
     - name: Use Node.js
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@v6.1.0
       with:
         node-version-file: ${{ matrix.node-version-file }}
         cache: 'pnpm'
@@ -129,13 +129,13 @@ jobs:
           - 56312:6379
 
     steps:
-      - uses: actions/checkout@v4.3.0
+      - uses: actions/checkout@v6.0.1
         with:
           submodules: true
       - name: Setup pnpm
         uses: pnpm/action-setup@v4.2.0
       - name: Use Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.1.0
         with:
           node-version-file: ${{ matrix.node-version-file }}
           cache: 'pnpm'
@@ -173,7 +173,7 @@ jobs:
           POSTGRES_HOST_AUTH_METHOD: trust
 
     steps:
-      - uses: actions/checkout@v4.3.0
+      - uses: actions/checkout@v6.0.1
         with:
           submodules: true
       - name: Setup pnpm
@@ -182,7 +182,7 @@ jobs:
         id: current-date
         run: echo "today=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
       - name: Use Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.1.0
         with:
           node-version-file: ${{ matrix.node-version-file }}
           cache: 'pnpm'

.github/workflows/test-federation.yml

@@ -32,7 +32,7 @@ jobs:
           - .node-version
           - .github/min.node-version
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: true
       - name: Setup pnpm
@@ -68,7 +68,7 @@ jobs:
             fi
           done
       - name: Use Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.1.0
         with:
           node-version-file: ${{ matrix.node-version-file }}
           cache: 'pnpm'

.github/workflows/test-frontend.yml

@@ -28,13 +28,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       with:
         submodules: true
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.2.0
     - name: Use Node.js
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@v6.1.0
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'
@@ -76,7 +76,7 @@ jobs:
           - 56312:6379
 
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       with:
         submodules: true
     # https://github.com/cypress-io/cypress-docker-images/issues/150
@@ -88,7 +88,7 @@ jobs:
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.2.0
     - name: Use Node.js
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@v6.1.0
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'
@@ -113,12 +113,12 @@ jobs:
         wait-on: 'http://localhost:61812'
         headed: true
         browser: ${{ matrix.browser }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v6
       if: failure()
       with:
         name: ${{ matrix.browser }}-cypress-screenshots
         path: cypress/screenshots
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v6
       if: always()
       with:
         name: ${{ matrix.browser }}-cypress-videos

.github/workflows/test-misskey-js.yml

@@ -22,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.3.0
+        uses: actions/checkout@v6.0.1
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4.2.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.1.0
         with:
           node-version-file: '.node-version'
           cache: 'pnpm'

.github/workflows/test-production.yml

@@ -16,13 +16,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       with:
         submodules: true
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.2.0
     - name: Use Node.js
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@v6.1.0
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'

.github/workflows/validate-api-json.yml

@@ -17,13 +17,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4.3.0
+    - uses: actions/checkout@v6.0.1
       with:
         submodules: true
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.2.0
     - name: Use Node.js
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@v6.1.0
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'

.node-version

@@ -1 +1 @@
-24.10.0
+22.15.0

.vscode/settings.json

@@ -3,6 +3,7 @@
 		"**/node_modules": true
 	},
 	"typescript.tsdk": "node_modules/typescript/lib",
+	"typescript.enablePromptUseWorkspaceTsdk": true,
 	"files.associations": {
 		"*.test.ts": "typescript"
 	},

CHANGELOG.md

@@ -1,4 +1,4 @@
-## 2025.11.2
+## Unreleased
 
 ### General
 -
@@ -6,11 +6,65 @@
 ### Client
 -
 
+### Server
+-
+
+
+## 2025.12.2
+
+### Note
+v2025.12.0で行われた「configの`trustProxy`のデフォルト値を`false`に変更」について、正しく環境に応じた設定を行わないとサインインが困難になるといった状態を緩和するために、以下の対応を行いました。
+
+**正しく設定しないと、上記のような不具合の原因となったり、セキュリティリスクが高まったりする可能性があります。必ず現在のconfigをご確認の上、必要に応じて値を変更してください。**
+
+- `trustProxy`について、デフォルト（configに値が設定されていない状態）ではループバックアドレスとローカルIPアドレス空間を信頼するようにしました。
+- `trustProxy`の設定方法について、より詳細に記述しました。
+- リバースプロキシやCDNなどのより上流のレイヤでレートリミットを設定したい場合や、緊急時の一時的な緩和策として、Misskey内部でのIPアドレスペースでのレートリミットを無効化できるようにしました。
+
+### General
+- 依存関係の更新
+
+### Client
+- Enhance: デッキのUI説明を追加
+- Enhance: 設定がブラウザによって消去されないようにするオプションを追加
+- Fix: バージョン表記のないPlayが正しく動作しない問題を修正  
+  バージョン表記のないものは v0.x 系として実行されます。v1.x 系で動作させたい場合は必ずバージョン表記を含めてください。
+- Fix: デッキUIでメニュー位置を下にしているとプロファイル削除ボタンが表示されないのを修正  
+- Fix: 一部のUnicode絵文字のリアクションがボタンにならない問題を修正
+
+### Server
+- Enhance: Misskey内部でのIPアドレスペースでのレートリミットを無効化できるように
+  - リバースプロキシやCDNなど別のレイヤで別途レートリミットを設定する場合や、ローカルでのテスト用途等として利用することを想定しています。
+  - デフォルトは `enableIpRateLimit: true`（Misskey内部でのIPアドレスペースでのレートリミットは有効）です。
+- Fix: コントロールパネルのジョブキューページで使用される一部APIの応答速度を改善
+
+## 2025.12.1
+
+### Client
+- Fix: 特定の条件下でMisskeyが起動せず空白のページが表示されることがある問題を軽減
+- Fix: 初回読み込み時などに、言語設定で不整合が発生することがある問題を修正
+- Fix: 削除されたノートのリノートが正しく動作されない問題を修正
+- Fix: チャンネルオーナーが削除済みの時にチャンネルのヘッダーメニューが表示されない不具合を修正
+- Fix: ドライブで登録日以外でソートする場合は月でグループ化して表示しないように
+- Fix: `null` を返す note_view_intrruptor プラグインが動作しない問題を修正
+
+### Server
+- Fix: ジョブキューでSentryが有効にならない問題を修正
+
+
+## 2025.12.0
+
+### Note
+- configの`trustProxy`のデフォルト値を`false`に変更しました。アップデート前に現在のconfigをご確認の上、必要に応じて値を変更してください。
+
+### Client
+- Fix: stacking router viewで連続して戻る操作を行うと何も表示されなくなる問題を修正
+
 ### Server
 - Enhance: メモリ使用量を削減しました
 - Enhance: ActivityPubアクティビティを送信する際のパフォーマンス向上
 - Enhance: 依存関係の更新
-
+- Fix: セキュリティに関する修正
 
 ## 2025.11.1
 

Dockerfile

@@ -1,6 +1,6 @@
 # syntax = docker/dockerfile:1.4
 
-ARG NODE_VERSION=24.10.0-bookworm
+ARG NODE_VERSION=22.15.0-bookworm
 
 # build assets & compile TypeScript
 

README.md

@@ -24,6 +24,8 @@
 <a href="https://www.patreon.com/syuilo">
 		<img src="https://custom-icon-badges.herokuapp.com/badge/become_a-patron-F96854?logoColor=F96854&style=for-the-badge&logo=patreon&labelColor=363B40" alt="become a patron"/></a>
 
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/misskey-dev/misskey)
+
 </div>
 
 ## Thanks

compose.local-db.yml

@@ -21,7 +21,7 @@ services:
     env_file:
       - .config/docker.env
     volumes:
-      - ./db:/var/lib/postgresql/data
+      - ./db:/var/lib/postgresql
     healthcheck:
       test: "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"
       interval: 5s

compose_example.yml

@@ -43,7 +43,7 @@ services:
     env_file:
       - .config/docker.env
     volumes:
-      - ./db:/var/lib/postgresql/data
+      - ./db:/var/lib/postgresql
     healthcheck:
       test: "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"
       interval: 5s

locales/de-DE.yml

@@ -83,6 +83,7 @@ files: "Dateien"
 download: "Herunterladen"
 driveFileDeleteConfirm: "Möchtest du die Datei „{name}“ wirklich löschen? Einige Inhalte, die diese Datei verwenden, werden auch verschwinden."
 unfollowConfirm: "Möchtest du {name} wirklich nicht mehr folgen?"
+rejectFollowRequestConfirm: "Möchtest du die Follow-Anfrage von {name} ablehnen?"
 exportRequested: "Du hast einen Export angefragt. Dies kann etwas Zeit in Anspruch nehmen. Sobald der Export abgeschlossen ist, wird er deiner Drive hinzugefügt."
 importRequested: "Du hast einen Import angefragt. Dies kann etwas Zeit in Anspruch nehmen."
 lists: "Listen"
@@ -1018,6 +1019,7 @@ pushNotificationAlreadySubscribed: "Push-Benachrichtigungen sind bereits aktivie
 pushNotificationNotSupported: "Entweder dein Browser oder deine Instanz unterstützt Push-Benachrichtigungen nicht"
 sendPushNotificationReadMessage: "Push-Benachrichtigungen löschen, sobald sie gelesen wurden"
 sendPushNotificationReadMessageCaption: "Dies kann gegebenenfalls den Batterieverbrauch deines Gerätes erhöhen."
+pleaseAllowPushNotification: "Bitte erlauben Sie Benachrichtigungen in Ihrem Browser."
 windowMaximize: "Maximieren"
 windowMinimize: "Minimieren"
 windowRestore: "Wiederherstellen"
@@ -1054,6 +1056,7 @@ permissionDeniedError: "Aktion verweigert"
 permissionDeniedErrorDescription: "Dieses Benutzerkonto besitzt nicht die Berechtigung, um diese Aktion auszuführen."
 preset: "Vorlage"
 selectFromPresets: "Aus Vorlagen wählen"
+custom: "Benutzerdefiniert"
 achievements: "Errungenschaften"
 gotInvalidResponseError: "Ungültige Antwort des Servers"
 gotInvalidResponseErrorDescription: "Eventuell ist der Server momentan nicht erreichbar oder untergeht Wartungsarbeiten. Bitte versuche es später noch einmal."
@@ -1243,6 +1246,7 @@ releaseToRefresh: "Zum Aktualisieren loslassen"
 refreshing: "Wird aktualisiert..."
 pullDownToRefresh: "Zum Aktualisieren ziehen"
 useGroupedNotifications: "Benachrichtigungen gruppieren"
+emailVerificationFailedError: "Es gab ein Problem bei der Überprüfung Ihrer E-Mail-Adresse. Der Link ist möglicherweise abgelaufen."
 cwNotationRequired: "Ist \"Inhaltswarnung verwenden\" aktiviert, muss eine Beschreibung gegeben werden."
 doReaction: "Reagieren"
 code: "Code"
@@ -1370,7 +1374,12 @@ defaultImageCompressionLevel: "Standard-Bildkomprimierungsstufe"
 defaultImageCompressionLevel_description: "Ein niedrigerer Wert erhält die Bildqualität, erhöht aber die Dateigröße. <br>Höhere Werte reduzieren die Dateigröße, verringern aber die Bildqualität."
 inMinutes: "Minute(n)"
 inDays: "Tag(en)"
+safeModeEnabled: "Der abgesicherte Modus ist aktiviert."
+schedule: "Planen"
+scheduled: "Geplant"
 widgets: "Widgets"
+deviceInfo: "Geräteinformation"
+youAreAdmin: "Sie sind ein Administrator"
 presets: "Vorlage"
 _imageEditing:
   _vars:

locales/en-US.yml

@@ -83,6 +83,8 @@ files: "Files"
 download: "Download"
 driveFileDeleteConfirm: "Are you sure you want to delete \"{name}\"? All notes with this file attached will also be deleted."
 unfollowConfirm: "Are you sure you want to unfollow {name}?"
+cancelFollowRequestConfirm: "Are you sure that you want to cancel your follow request to {name}?"
+rejectFollowRequestConfirm: "Are you sure that you want to reject the follow request from {name}?"
 exportRequested: "You've requested an export. This may take a while. It will be added to your Drive once completed."
 importRequested: "You've requested an import. This may take a while."
 lists: "Lists"

locales/es-ES.yml

@@ -319,10 +319,10 @@ remoteUserCaution: "Para el usuario remoto, la información está incompleta"
 activity: "Actividad"
 images: "Imágenes"
 image: "Imágenes"
-birthday: "Fecha de nacimiento"
+birthday: "Cumpleaños"
 yearsOld: "{age} años"
 registeredDate: "Fecha de registro"
-location: "Lugar"
+location: "Ubicación"
 theme: "Tema"
 themeForLightMode: "Tema para usar en Modo Linterna"
 themeForDarkMode: "Tema para usar en Modo Oscuro"
@@ -579,7 +579,7 @@ objectStorageSetPublicRead: "Seleccionar \"public-read\" al subir "
 s3ForcePathStyleDesc: "Si s3ForcePathStyle esta habilitado el nombre del bucket debe ser especificado como parte de la URL en lugar del nombre de host en la URL. Puede ser necesario activar esta opción cuando se utilice, por ejemplo, Minio en un servidor propio."
 serverLogs: "Registros del servidor"
 deleteAll: "Eliminar todos"
-showFixedPostForm: "Mostrar el formulario de las entradas encima de la línea de tiempo"
+showFixedPostForm: "Visualizar la ventana de publicación en la parte superior de la línea de tiempo."
 showFixedPostFormInChannel: "Mostrar el formulario de publicación por encima de la cronología (Canales)"
 withRepliesByDefaultForNewlyFollowed: "Incluir por defecto respuestas de usuarios recién seguidos en la línea de tiempo"
 newNoteRecived: "Tienes una nota nueva"
@@ -844,7 +844,7 @@ jumpToSpecifiedDate: "Saltar a una fecha específica"
 showingPastTimeline: "Mostrar líneas de tiempo antiguas"
 clear: "Limpiar"
 markAllAsRead: "Marcar todo como leído"
-goBack: "Deseleccionar"
+goBack: "Anterior"
 unlikeConfirm: "¿Quitar como favorito?"
 fullView: "Vista completa"
 quitFullView: "quitar vista completa"
@@ -1252,7 +1252,7 @@ detachAll: "Quitar todo"
 angle: "Ángulo"
 flip: "Echar de un capirotazo"
 showAvatarDecorations: "Mostrar decoraciones de avatar"
-releaseToRefresh: "Soltar para recargar"
+releaseToRefresh: "Suelta para recargar"
 refreshing: "Recargando..."
 pullDownToRefresh: "Tira hacia abajo para recargar"
 useGroupedNotifications: "Mostrar notificaciones agrupadas"
@@ -1511,7 +1511,7 @@ _emojiPalette:
   palettes: "Paleta\n"
   enableSyncBetweenDevicesForPalettes: "Activar la sincronización de paletas entre dispositivos"
   paletteForMain: "Paleta principal"
-  paletteForReaction: "Paleta de reacción"
+  paletteForReaction: "Paleta utilizada para las reacciones"
 _settings:
   driveBanner: "Puedes gestionar y configurar la unidad, comprobar su uso y configurar los ajustes de carga de archivos."
   pluginBanner: "Puedes ampliar las funciones del cliente con plugins. Puedes instalar plugins, configurarlos y gestionarlos individualmente."
@@ -1523,7 +1523,7 @@ _settings:
   accountData: "Datos de la cuenta"
   accountDataBanner: "Exportación e importación para gestionar los datos de la cuenta."
   muteAndBlockBanner: "Puedes configurar y gestionar ajustes para ocultar contenidos y restringir acciones a usuarios específicos."
-  accessibilityBanner: "Puedes personalizar los visuales y el comportamiento del cliente, y configurar los ajustes para optimizar el uso."
+  accessibilityBanner: "Puedes personalizar el aspecto y el comportamiento del cliente y configurar los ajustes para optimizar su uso."
   privacyBanner: "Puedes configurar opciones relacionadas con la privacidad de la cuenta, como la visibilidad del contenido, la posibilidad de descubrir la cuenta y la aprobación de seguimiento."
   securityBanner: "Puedes configurar opciones relacionadas con la seguridad de la cuenta, como la contraseña, los métodos de inicio de sesión, las aplicaciones de autenticación y Passkeys."
   preferencesBanner: "Puedes configurar el comportamiento general del cliente según tus preferencias."
@@ -1540,7 +1540,7 @@ _settings:
   ifOff: "Si está desactivado"
   enableSyncThemesBetweenDevices: "Sincronizar los temas instalados entre dispositivos."
   enablePullToRefresh: "Tirar para actualizar"
-  enablePullToRefresh_description: "Si utiliza un ratón, arrastre mientras pulsa la rueda de desplazamiento."
+  enablePullToRefresh_description: "Si utilizas un ratón, arrastra mientras pulsas la rueda de desplazamiento."
   realtimeMode_description: "Establece una conexión con el servidor y actualiza el contenido en tiempo real. Esto puede aumentar el tráfico y el consumo de memoria."
   contentsUpdateFrequency: "Frecuencia de adquisición del contenido."
   contentsUpdateFrequency_description: "Cuanto mayor sea el valor, más se actualiza el contenido, pero disminuye el rendimiento y aumenta el tráfico y el consumo de memoria."
@@ -2156,7 +2156,7 @@ _accountDelete:
   started: "El proceso de eliminación ha comenzado."
   inProgress: "La eliminación está en proceso."
 _ad:
-  back: "Deseleccionar"
+  back: "Anterior"
   reduceFrequencyOfThisAd: "Mostrar menos este anuncio."
   hide: "No mostrar"
   timezoneinfo: "El día de la semana está determidado por la zona horaria del servidor."
@@ -2610,10 +2610,10 @@ _profile:
   name: "Nombre"
   username: "Nombre de usuario"
   description: "Descripción"
-  youCanIncludeHashtags: "Puedes añadir hashtags"
+  youCanIncludeHashtags: "También puedes incluir hashtags en tu biografía"
   metadata: "información adicional"
   metadataEdit: "Editar información adicional"
-  metadataDescription: "Muestra la información adicional en el perfil"
+  metadataDescription: "Usando esto puedes mostrar campos de información adicionales en tu perfil."
   metadataLabel: "Etiqueta"
   metadataContent: "Contenido"
   changeAvatar: "Cambiar avatar"

locales/it-IT.yml

@@ -83,6 +83,8 @@ files: "Allegati"
 download: "Scarica"
 driveFileDeleteConfirm: "Vuoi davvero eliminare il file \"{name}\", e le Note a cui è stato allegato?"
 unfollowConfirm: "Vuoi davvero togliere il Following a {name}?"
+cancelFollowRequestConfirm: "Vuoi annullare la tua richiesta di follow inviata a {name}?"
+rejectFollowRequestConfirm: "Vuoi rifiutare la richiesta di follow ricevuta da {name}?"
 exportRequested: "Hai richiesto un'esportazione, e potrebbe volerci tempo. Quando sarà compiuta, il file verrà aggiunto direttamente al Drive."
 importRequested: "Hai richiesto un'importazione. Potrebbe richiedere un po' di tempo."
 lists: "Liste"
@@ -2350,13 +2352,13 @@ _ago:
   yearsAgo: "{n} anni fa"
   invalid: "Niente da visualizzare"
 _timeIn:
-  seconds: "Dopo {n} secondi"
+  seconds: "Tra {n} secondi"
-  minutes: "Dopo {n} minuti"
+  minutes: "Tra {n} minuti"
-  hours: "Dopo {n} ore"
+  hours: "Tra {n} ore"
-  days: "Dopo {n} giorni"
+  days: "Tra {n} giorni"
-  weeks: "Dopo {n} settimane"
+  weeks: "Tra {n} settimane"
-  months: "Dopo {n} mesi"
+  months: "Tra {n} mesi"
-  years: "Dopo {n} anni"
+  years: "Tra {n} anni"
 _time:
   second: "s"
   minute: "min"

locales/ja-JP.yml

@@ -1557,6 +1557,9 @@ _settings:
   showPageTabBarBottom: "ページのタブバーを下部に表示"
   emojiPaletteBanner: "絵文字ピッカーに固定表示するプリセットをパレットとして登録したり、ピッカーの表示方法をカスタマイズしたりできます。"
   enableAnimatedImages: "アニメーション画像を有効にする"
+  settingsPersistence_title: "設定の永続化"
+  settingsPersistence_description1: "設定の永続化を有効にすると、設定情報が失われるのを防止できます。"
+  settingsPersistence_description2: "環境によっては有効化できない場合があります。"
 
   _chat:
     showSenderName: "送信者の名前を表示"
@@ -2890,6 +2893,15 @@ _deck:
   usedAsMinWidthWhenFlexible: "「幅を自動調整」が有効の場合、これが幅の最小値となります"
   flexible: "幅を自動調整"
   enableSyncBetweenDevicesForProfiles: "プロファイル情報のデバイス間同期を有効にする"
+  showHowToUse: "UIの説明を見る"
+
+  _howToUse:
+    addColumn_title: "カラム追加"
+    addColumn_description: "カラムの種類を選んで追加できます。"
+    settings_title: "UI設定"
+    settings_description: "デッキUIの詳細設定を行えます。"
+    switchProfile_title: "プロファイル切り替え"
+    switchProfile_description: "UIのレイアウトをプロファイルとして保存し、いつでも切り替えられるようにできます。"
 
   _columns:
     main: "メイン"

locales/zh-CN.yml

@@ -53,7 +53,7 @@ copyRemoteLink: "复制远程链接"
 copyLinkRenote: "复制转帖链接"
 delete: "删除"
 deleteAndEdit: "删除并编辑"
-deleteAndEditConfirm: "要删除此帖并再次编辑吗？对此帖的所有回应、转发和回复也将被删除。"
+deleteAndEditConfirm: "要删除此帖并再次编辑吗？此帖下所有的回应、转发和回复也将被删除。"
 addToList: "添加至列表"
 addToAntenna: "添加到天线"
 sendMessage: "发送消息"
@@ -136,7 +136,7 @@ emojiPicker: "表情符号选择器"
 pinnedEmojisForReactionSettingDescription: "可以设置发表回应时置顶显示的表情符号"
 pinnedEmojisSettingDescription: "可以设置输入表情符号时置顶显示的表情符号"
 emojiPickerDisplay: "选择器显示设置"
-overwriteFromPinnedEmojisForReaction: "从「置顶（回应）」设置覆盖"
+overwriteFromPinnedEmojisForReaction: "使用「置顶（回应）」设置覆盖"
 overwriteFromPinnedEmojis: "从全局设置覆盖"
 reactionSettingDescription2: "拖动重新排序，单击删除，点击 + 添加。"
 rememberNoteVisibility: "保存上次设置的可见性"
@@ -153,8 +153,8 @@ block: "拉黑"
 unblock: "取消拉黑"
 suspend: "冻结"
 unsuspend: "解除冻结"
-blockConfirm: "确定要拉黑吗？"
+blockConfirm: "确定要屏蔽吗？"
-unblockConfirm: "确定要取消拉黑吗？"
+unblockConfirm: "确定要取消屏蔽吗？"
 suspendConfirm: "要冻结吗？"
 unsuspendConfirm: "要解除冻结吗？"
 selectList: "选择列表"
@@ -174,7 +174,7 @@ emojiUrl: "emoji 地址"
 addEmoji: "添加表情符号"
 settingGuide: "推荐配置"
 cacheRemoteFiles: "缓存远程文件"
-cacheRemoteFilesDescription: "启用此设定时，将在此服务器上缓存远程文件。虽然可以加快图片显示的速度，但是相对的会消耗大量的服务器存储空间。用户角色内的网盘容量决定了这个远程用户能在服务器上保留多少缓存。当超出了这个限制时，旧的文件将从缓存中被删除，成为链接。当禁用此设定时，则是从一开始就将远程文件保留为链接。此时推荐将 default.yml 的 proxyRemoteFiles 设置为 true 以优化缩略图生成及保护用户隐私。"
+cacheRemoteFilesDescription: "启用此设定时，将在此服务器上缓存远程文件。虽然可以加快图片显示的速度，但是相对的会消耗大量的服务器存储空间。用户角色内的网盘容量决定了这个远程用户能在服务器上保留多少缓存。当超出了这个限制时，旧的文件将从缓存中被删除，成为链接。当禁用此设定时，则是从一开始就将远程文件保留为链接。此时推荐将  的 proxyRemoteFiles 设置为 true 以优化缩略图生成及保护用户隐私。"
 youCanCleanRemoteFilesCache: "可以使用文件管理的🗑️按钮来删除所有的缓存。"
 cacheRemoteSensitiveFiles: "缓存远程敏感媒体文件"
 cacheRemoteSensitiveFilesDescription: "如果禁用这项设定，远程服务器的敏感媒体将不会被缓存，而是直接链接。"
@@ -184,7 +184,7 @@ flagAsCat: "喵！！！！！！！！！！！！"
 flagAsCatDescription: "喵喵喵？？"
 flagShowTimelineReplies: "在时间线上显示帖子的回复"
 flagShowTimelineRepliesDescription: "启用时，时间线除了显示用户的帖子外，还会显示其他用户对帖子的回复。"
-autoAcceptFollowed: "自动允许来自我关注的用户对我的关注请求"
+autoAcceptFollowed: "自动允许回关请求"
 addAccount: "添加账户"
 reloadAccountsList: "更新账户列表"
 loginFailed: "登录失败"
@@ -247,8 +247,8 @@ mediaSilencedInstancesDescription: "设置要隐藏媒体文件的服务器，
 federationAllowedHosts: "允许联合的服务器"
 federationAllowedHostsDescription: "设定允许联合的服务器，以换行分隔。"
 muteAndBlock: "屏蔽/拉黑"
-mutedUsers: "已屏蔽用户"
+mutedUsers: "已静音的用户"
-blockedUsers: "已拉黑的用户"
+blockedUsers: "已屏蔽的用户"
 noUsers: "无用户"
 editProfile: "编辑资料"
 noteDeleteConfirm: "确定要删除该帖子吗？"
@@ -1344,7 +1344,7 @@ skip: "跳过"
 restore: "恢复"
 syncBetweenDevices: "设备间同步"
 preferenceSyncConflictTitle: "服务器上已存在设定值"
-preferenceSyncConflictText: "服务器上已有此设置的设定值。要覆盖哪个设定值？"
+preferenceSyncConflictText: "即将保存设定值到服务器，但检测到服务器上已有此设置的设定值。要使用哪个设定值？"
 preferenceSyncConflictChoiceMerge: "合并"
 preferenceSyncConflictChoiceServer: "服务器上的设定值"
 preferenceSyncConflictChoiceDevice: "设备上的设定值"
@@ -3270,7 +3270,7 @@ _watermarkEditor:
   driveFileTypeWarn: "不支持此文件"
   driveFileTypeWarnDescription: "请选择图像文件"
   title: "编辑水印"
-  cover: "覆盖全体"
+  cover: "覆盖所有"
   repeat: "平铺"
   preserveBoundingRect: "调整为旋转时不超出范围"
   opacity: "不透明度"

package.json

@@ -1,12 +1,12 @@
 {
 	"name": "misskey",
-	"version": "2025.11.2-alpha.1",
+	"version": "2025.12.2",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/misskey-dev/misskey.git"
 	},
-	"packageManager": "pnpm@10.23.0",
+	"packageManager": "pnpm@10.25.0",
 	"workspaces": [
 		"packages/misskey-js",
 		"packages/i18n",
@@ -22,14 +22,15 @@
 	],
 	"private": true,
 	"scripts": {
+		"compile-config": "cd packages/backend && pnpm compile-config",
 		"build-pre": "node ./scripts/build-pre.js",
 		"build-assets": "node ./scripts/build-assets.mjs",
 		"build": "pnpm build-pre && pnpm -r build && pnpm build-assets",
 		"build-storybook": "pnpm --filter frontend build-storybook",
 		"build-misskey-js-with-types": "pnpm build-pre && pnpm --filter backend... --filter=!misskey-js build && pnpm --filter backend generate-api-json --no-build && ncp packages/backend/built/api.json packages/misskey-js/generator/api.json && pnpm --filter misskey-js update-autogen-code && pnpm --filter misskey-js build && pnpm --filter misskey-js api",
-		"start": "cd packages/backend && node ./built/entry.js",
+		"start": "pnpm check:connect && cd packages/backend && pnpm compile-config && node ./built/boot/entry.js",
-		"start:inspect": "cd packages/backend && node --inspect ./built/entry.js",
+		"start:inspect": "cd packages/backend && pnpm compile-config && node --inspect ./built/boot/entry.js",
-		"start:test": "ncp ./.github/misskey/test.yml ./.config/test.yml && cd packages/backend && cross-env NODE_ENV=test node ./built/entry.js",
+		"start:test": "ncp ./.github/misskey/test.yml ./.config/test.yml && cd packages/backend && cross-env NODE_ENV=test pnpm compile-config && cross-env NODE_ENV=test node ./built/boot/entry.js",
 		"cli": "cd packages/backend && pnpm cli",
 		"init": "pnpm migrate",
 		"migrate": "cd packages/backend && pnpm migrate",
@@ -52,36 +53,34 @@
 		"cleanall": "pnpm clean-all"
 	},
 	"resolutions": {
-		"chokidar": "4.0.3",
+		"chokidar": "5.0.0",
 		"lodash": "4.17.21"
 	},
 	"dependencies": {
 		"cssnano": "7.1.2",
-		"esbuild": "0.27.0",
+		"esbuild": "0.27.1",
-		"execa": "9.6.0",
+		"execa": "9.6.1",
-		"fast-glob": "3.3.3",
-		"glob": "13.0.0",
 		"ignore-walk": "8.0.0",
 		"js-yaml": "4.1.1",
 		"postcss": "8.5.6",
 		"tar": "7.5.2",
-		"terser": "5.44.1",
+		"terser": "5.44.1"
-		"typescript": "5.9.3"
 	},
 	"devDependencies": {
 		"@eslint/js": "9.39.1",
-		"i18n": "workspace:*",
 		"@misskey-dev/eslint-plugin": "2.2.0",
 		"@types/js-yaml": "4.0.9",
-		"@types/node": "24.10.1",
+		"@types/node": "24.10.2",
-		"@typescript-eslint/eslint-plugin": "8.47.0",
+		"@typescript-eslint/eslint-plugin": "8.49.0",
-		"@typescript-eslint/parser": "8.47.0",
+		"@typescript-eslint/parser": "8.49.0",
+		"@typescript/native-preview": "7.0.0-dev.20251206.1",
 		"cross-env": "10.1.0",
-		"cypress": "15.7.0",
+		"cypress": "15.7.1",
 		"eslint": "9.39.1",
 		"globals": "16.5.0",
 		"ncp": "2.0.0",
-		"pnpm": "10.23.0",
+		"pnpm": "10.25.0",
+		"typescript": "5.9.3",
 		"start-server-and-test": "2.1.3"
 	},
 	"optionalDependencies": {

packages/backend/.swcrc

@@ -3,12 +3,17 @@
 	"jsc": {
 		"parser": {
 			"syntax": "typescript",
+			"jsx": true,
 			"dynamicImport": true,
 			"decorators": true
 		},
 		"transform": {
 			"legacyDecorator": true,
-			"decoratorMetadata": true
+			"decoratorMetadata": true,
+			"react": {
+				"runtime": "automatic",
+				"importSource": "@kitajs/html"
+			}
 		},
 		"experimental": {
 			"keepImportAssertions": true

packages/backend/assets/misc/flush.js

@@ -0,0 +1,46 @@
+(async () => {
+	const msg = document.getElementById('msg');
+	const successText = `\nSuccess Flush! <a href="/">Back to Misskey</a>\n成功しました。<a href="/">Misskeyを開き直してください。</a>`;
+
+	if (!document.cookie) {
+		message('Your site data is fully cleared by your browser.');
+		message(successText);
+	} else {
+		message('Your browser does not support Clear-Site-Data header. Start opportunistic flushing.');
+		try {
+			localStorage.clear();
+			message('localStorage cleared.');
+
+			const idbPromises = ['MisskeyClient', 'keyval-store'].map((name, i, arr) => new Promise((res, rej) => {
+				const delidb = indexedDB.deleteDatabase(name);
+				delidb.onsuccess = () => res(message(`indexedDB "${name}" cleared. (${i + 1}/${arr.length})`));
+				delidb.onerror = e => rej(e)
+			}));
+
+			await Promise.all(idbPromises);
+
+			if (navigator.serviceWorker.controller) {
+				navigator.serviceWorker.controller.postMessage('clear');
+				await navigator.serviceWorker.getRegistrations()
+					.then(registrations => {
+						return Promise.all(registrations.map(registration => registration.unregister()));
+					})
+					.catch(e => { throw new Error(e) });
+			}
+
+			message(successText);
+		} catch (e) {
+			message(`\n${e}\n\nFlush Failed. <a href="/flush">Please retry.</a>\n失敗しました。<a href="/flush">もう一度試してみてください。</a>`);
+			message(`\nIf you retry more than 3 times, try manually clearing the browser cache or contact to instance admin.\n3回以上試しても失敗する場合、ブラウザのキャッシュを手動で消去し、それでもだめならインスタンス管理者に連絡してみてください。\n`)
+
+			console.error(e);
+			setTimeout(() => {
+				location = '/';
+			}, 10000)
+		}
+	}
+
+	function message(text) {
+		msg.insertAdjacentHTML('beforeend', `<p>[${(new Date()).toString()}] ${text.replace(/\n/g,'<br>')}</p>`)
+	}
+})();

packages/backend/assets/misc/info-card.css

@@ -0,0 +1,35 @@
+html,
+body {
+	margin: 0;
+	padding: 0;
+	min-height: 100vh;
+	background: #fff;
+}
+
+#a {
+	display: block;
+}
+
+#banner {
+	background-size: cover;
+	background-position: center center;
+}
+
+#title {
+	display: inline-block;
+	margin: 24px;
+	padding: 0.5em 0.8em;
+	color: #fff;
+	background: rgba(0, 0, 0, 0.5);
+	font-weight: bold;
+	font-size: 1.3em;
+}
+
+#content {
+	overflow: auto;
+	color: #353c3e;
+}
+
+#description {
+	margin: 24px;
+}

packages/backend/jest.config.cjs

@@ -205,7 +205,7 @@ module.exports = {
 	// Whether to use watchman for file crawling
 	// watchman: true,
 
-	extensionsToTreatAsEsm: ['.ts'],
+	extensionsToTreatAsEsm: ['.ts', '.tsx'],
 
 	testTimeout: 60000,
 

packages/backend/jsconfig.json

@@ -1,13 +0,0 @@
-{
-	"compilerOptions": {
-		"target": "es6",
-		"module": "commonjs",
-		"allowSyntheticDefaultImports": true
-	},
-	"exclude": [
-		"node_modules",
-		"jspm_packages",
-		"tmp",
-		"temp"
-	]
-}

packages/backend/migration/1745378064470-composite-note-index.js

@@ -3,14 +3,14 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
-import { isConcurrentIndexMigrationEnabled } from "./js/migration-config.js";
+const isConcurrentIndexMigrationEnabled = process.env.MISSKEY_MIGRATION_CREATE_INDEX_CONCURRENTLY === '1';
 
 export class CompositeNoteIndex1745378064470 {
 	name = 'CompositeNoteIndex1745378064470';
-	transaction = isConcurrentIndexMigrationEnabled() ? false : undefined;
+	transaction = isConcurrentIndexMigrationEnabled ? false : undefined;
 
 	async up(queryRunner) {
-		const concurrently = isConcurrentIndexMigrationEnabled();
+		const concurrently = isConcurrentIndexMigrationEnabled;
 
 		if (concurrently) {
 			const hasValidIndex = await queryRunner.query(`SELECT indisvalid FROM pg_index INNER JOIN pg_class ON pg_index.indexrelid = pg_class.oid WHERE pg_class.relname = 'IDX_724b311e6f883751f261ebe378'`);
@@ -29,7 +29,7 @@ export class CompositeNoteIndex1745378064470 {
 	}
 
 	async down(queryRunner) {
-		const mayConcurrently = isConcurrentIndexMigrationEnabled() ? 'CONCURRENTLY' : '';
+		const mayConcurrently = isConcurrentIndexMigrationEnabled ? 'CONCURRENTLY' : '';
 		await queryRunner.query(`DROP INDEX IF EXISTS "IDX_724b311e6f883751f261ebe378"`);
 		await queryRunner.query(`CREATE INDEX ${mayConcurrently} "IDX_5b87d9d19127bd5d92026017a7" ON "note" ("userId")`);
 	}

packages/backend/migration/1746949539915-migrateSomeConfigFileSettingsToMeta.js

@@ -3,17 +3,15 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
-import {loadConfig} from "./js/migration-config.js";
 
 export class MigrateSomeConfigFileSettingsToMeta1746949539915 {
     name = 'MigrateSomeConfigFileSettingsToMeta1746949539915'
 
     async up(queryRunner) {
-        const config = loadConfig();
         // $1 cannot be used in ALTER TABLE queries
-        await queryRunner.query(`ALTER TABLE "meta" ADD "proxyRemoteFiles" boolean NOT NULL DEFAULT ${config.proxyRemoteFiles}`);
+        await queryRunner.query(`ALTER TABLE "meta" ADD "proxyRemoteFiles" boolean NOT NULL DEFAULT TRUE`);
-        await queryRunner.query(`ALTER TABLE "meta" ADD "signToActivityPubGet" boolean NOT NULL DEFAULT ${config.signToActivityPubGet}`);
+        await queryRunner.query(`ALTER TABLE "meta" ADD "signToActivityPubGet" boolean NOT NULL DEFAULT TRUE`);
-        await queryRunner.query(`ALTER TABLE "meta" ADD "allowExternalApRedirect" boolean NOT NULL DEFAULT ${!config.disallowExternalApRedirect}`);
+        await queryRunner.query(`ALTER TABLE "meta" ADD "allowExternalApRedirect" boolean NOT NULL DEFAULT TRUE`);
     }
 
     async down(queryRunner) {

packages/backend/migration/js/migration-config.js

@@ -1,31 +0,0 @@
-/*
- * SPDX-FileCopyrightText: syuilo and misskey-project
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-import { path as configYamlPath } from '../../built/config.js';
-import * as yaml from 'js-yaml';
-import fs from "node:fs";
-
-export function isConcurrentIndexMigrationEnabled() {
-	return process.env.MISSKEY_MIGRATION_CREATE_INDEX_CONCURRENTLY === '1';
-}
-
-let loadedConfigCache = undefined;
-
-function loadConfigInternal() {
-	const config = yaml.load(fs.readFileSync(configYamlPath, 'utf-8'));
-
-	return {
-		disallowExternalApRedirect: Boolean(config.disallowExternalApRedirect ?? false),
-		proxyRemoteFiles: Boolean(config.proxyRemoteFiles ?? false),
-		signToActivityPubGet: Boolean(config.signToActivityPubGet ?? true),
-	}
-}
-
-export function loadConfig() {
-	if (loadedConfigCache === undefined) {
-		loadedConfigCache = loadConfigInternal();
-	}
-	return loadedConfigCache;
-}

packages/backend/ormconfig.js

@@ -1,7 +1,8 @@
 import { DataSource } from 'typeorm';
 import { loadConfig } from './built/config.js';
 import { entities } from './built/postgres.js';
-import { isConcurrentIndexMigrationEnabled } from "./migration/js/migration-config.js";
+
+const isConcurrentIndexMigrationEnabled = process.env.MISSKEY_MIGRATION_CREATE_INDEX_CONCURRENTLY === '1';
 
 const config = loadConfig();
 
@@ -15,5 +16,5 @@ export default new DataSource({
 	extra: config.db.extra,
 	entities: entities,
 	migrations: ['migration/*.js'],
-	migrationsTransactionMode: isConcurrentIndexMigrationEnabled() ? 'each' : 'all',
+	migrationsTransactionMode: isConcurrentIndexMigrationEnabled ? 'each' : 'all',
 });

packages/backend/package.json

@@ -7,36 +7,37 @@
 		"node": "^22.15.0 || ^24.10.0"
 	},
 	"scripts": {
-		"start": "node ./built/boot/entry.js",
+		"start": "pnpm compile-config && node ./built/boot/entry.js",
-		"start:inspect": "node --inspect ./built/boot/entry.js",
+		"start:inspect": "pnpm compile-config && node --inspect ./built/boot/entry.js",
-		"start:test": "cross-env NODE_ENV=test node ./built/boot/entry.js",
+		"start:test": "cross-env NODE_ENV=test pnpm compile-config && cross-env NODE_ENV=test node ./built/boot/entry.js",
-		"migrate": "pnpm typeorm migration:run -d ormconfig.js",
+		"migrate": "pnpm compile-config && pnpm typeorm migration:run -d ormconfig.js",
-		"revert": "pnpm typeorm migration:revert -d ormconfig.js",
+		"revert": "pnpm compile-config && pnpm typeorm migration:revert -d ormconfig.js",
-		"cli": "node ./built/boot/cli.js",
+		"cli": "pnpm compile-config && node ./built/boot/cli.js",
-		"check:connect": "node ./scripts/check_connect.js",
+		"check:connect": "pnpm compile-config && node ./scripts/check_connect.js",
+		"compile-config": "node ./scripts/compile_config.js",
 		"build": "node ./build.js",
 		"build:test": "swc test-server -d built-test -D --config-file test-server/.swcrc --strip-leading-paths",
 		"watch:swc": "swc src -d built -D -w --strip-leading-paths",
-		"build:tsc": "tsc -p tsconfig.json && tsc-alias -p tsconfig.json",
+		"build:tsc": "tsgo -p tsconfig.json && tsc-alias -p tsconfig.json",
-		"watch": "node ./scripts/watch.mjs",
+		"watch": "pnpm compile-config && node ./scripts/watch.mjs",
 		"restart": "pnpm build && pnpm start",
-		"dev": "node ./scripts/dev.mjs",
+		"dev": "pnpm compile-config && node ./scripts/dev.mjs",
-		"typecheck": "tsc --noEmit && tsc -p test --noEmit && tsc -p test-federation --noEmit",
+		"typecheck": "tsgo --noEmit && tsgo -p test --noEmit && tsgo -p test-federation --noEmit",
 		"eslint": "eslint --quiet \"{src,test-federation}/**/*.ts\"",
 		"lint": "pnpm typecheck && pnpm eslint",
-		"jest": "cross-env NODE_ENV=test node ./jest.js --forceExit --config jest.config.unit.cjs",
+		"jest": "cross-env NODE_ENV=test pnpm compile-config && cross-env NODE_ENV=test node ./jest.js --forceExit --config jest.config.unit.cjs",
-		"jest:e2e": "cross-env NODE_ENV=test node ./jest.js --forceExit --config jest.config.e2e.cjs",
+		"jest:e2e": "cross-env NODE_ENV=test pnpm compile-config && cross-env NODE_ENV=test node ./jest.js --forceExit --config jest.config.e2e.cjs",
-		"jest:fed": "node ./jest.js --forceExit --config jest.config.fed.cjs",
+		"jest:fed": "pnpm compile-config && node ./jest.js --forceExit --config jest.config.fed.cjs",
-		"jest-and-coverage": "cross-env NODE_ENV=test node ./jest.js --coverage --forceExit --config jest.config.unit.cjs",
+		"jest-and-coverage": "cross-env NODE_ENV=test pnpm compile-config && cross-env NODE_ENV=test node ./jest.js --coverage --forceExit --config jest.config.unit.cjs",
-		"jest-and-coverage:e2e": "cross-env NODE_ENV=test node ./jest.js --coverage --forceExit --config jest.config.e2e.cjs",
+		"jest-and-coverage:e2e": "cross-env NODE_ENV=test pnpm compile-config && cross-env NODE_ENV=test node ./jest.js --coverage --forceExit --config jest.config.e2e.cjs",
-		"jest-clear": "cross-env NODE_ENV=test node ./jest.js --clearCache",
+		"jest-clear": "cross-env NODE_ENV=test pnpm compile-config && cross-env NODE_ENV=test node ./jest.js --clearCache",
 		"test": "pnpm jest",
 		"test:e2e": "pnpm build && pnpm build:test && pnpm jest:e2e",
 		"test:fed": "pnpm jest:fed",
 		"test-and-coverage": "pnpm jest-and-coverage",
 		"test-and-coverage:e2e": "pnpm build && pnpm build:test && pnpm jest-and-coverage:e2e",
 		"check-migrations": "node scripts/check_migrations_clean.js",
-		"generate-api-json": "node ./scripts/generate_api_json.js"
+		"generate-api-json": "pnpm compile-config && node ./scripts/generate_api_json.js"
 	},
 	"optionalDependencies": {
 		"@swc/core-android-arm64": "1.3.11",
@@ -70,26 +71,25 @@
 		"utf-8-validate": "6.0.5"
 	},
 	"dependencies": {
-		"@aws-sdk/client-s3": "3.937.0",
+		"@aws-sdk/client-s3": "3.948.0",
-		"@aws-sdk/lib-storage": "3.937.0",
+		"@aws-sdk/lib-storage": "3.948.0",
 		"@discordapp/twemoji": "16.0.1",
-		"@fastify/accepts": "5.0.3",
+		"@fastify/accepts": "5.0.4",
-		"@fastify/cookie": "11.0.2",
+		"@fastify/cors": "11.2.0",
-		"@fastify/cors": "11.1.0",
 		"@fastify/express": "4.0.2",
-		"@fastify/http-proxy": "11.3.0",
+		"@fastify/http-proxy": "11.4.1",
 		"@fastify/multipart": "9.3.0",
 		"@fastify/static": "8.3.0",
-		"@fastify/view": "11.1.1",
+		"@kitajs/html": "4.2.11",
 		"@misskey-dev/sharp-read-bmp": "1.2.0",
 		"@misskey-dev/summaly": "5.2.5",
-		"@napi-rs/canvas": "0.1.82",
+		"@napi-rs/canvas": "0.1.84",
 		"@nestjs/common": "11.1.9",
 		"@nestjs/core": "11.1.9",
 		"@nestjs/testing": "11.1.9",
 		"@peertube/http-signature": "1.7.0",
-		"@sentry/node": "10.26.0",
+		"@sentry/node": "10.29.0",
-		"@sentry/profiling-node": "10.26.0",
+		"@sentry/profiling-node": "10.29.0",
 		"@simplewebauthn/server": "13.2.2",
 		"@sinonjs/fake-timers": "15.0.0",
 		"@smithy/node-http-handler": "4.4.5",
@@ -103,13 +103,12 @@
 		"async-mutex": "0.5.0",
 		"bcryptjs": "3.0.3",
 		"blurhash": "2.0.5",
-		"body-parser": "2.2.0",
+		"body-parser": "2.2.1",
-		"bullmq": "5.64.1",
+		"bullmq": "5.65.1",
 		"cacheable-lookup": "7.0.0",
-		"cbor": "10.0.11",
 		"chalk": "5.6.2",
 		"chalk-template": "1.1.2",
-		"chokidar": "4.0.3",
+		"chokidar": "5.0.0",
 		"color-convert": "3.1.3",
 		"content-disposition": "1.0.1",
 		"date-fns": "4.1.0",
@@ -120,21 +119,19 @@
 		"file-type": "21.1.1",
 		"fluent-ffmpeg": "2.1.3",
 		"form-data": "4.0.5",
-		"got": "14.6.4",
+		"got": "14.6.5",
 		"hpagent": "1.2.0",
 		"http-link-header": "1.1.3",
+		"i18n": "workspace:*",
 		"ioredis": "5.8.2",
 		"ip-cidr": "4.0.2",
-		"ipaddr.js": "2.2.0",
+		"ipaddr.js": "2.3.0",
 		"is-svg": "6.1.0",
-		"js-yaml": "4.1.1",
 		"json5": "2.2.3",
 		"jsonld": "9.0.0",
-		"jsrsasign": "11.1.0",
 		"juice": "11.0.3",
 		"meilisearch": "0.54.0",
 		"mfm-js": "0.25.0",
-		"microformats-parser": "2.0.4",
 		"mime-types": "3.0.2",
 		"misskey-js": "workspace:*",
 		"misskey-reversi": "workspace:*",
@@ -143,18 +140,16 @@
 		"nested-property": "4.0.0",
 		"node-fetch": "3.3.2",
 		"node-html-parser": "7.0.1",
-		"nodemailer": "7.0.10",
+		"nodemailer": "7.0.11",
 		"nsfwjs": "4.2.0",
-		"oauth": "0.10.2",
 		"oauth2orize": "1.12.0",
 		"oauth2orize-pkce": "0.1.2",
 		"os-utils": "0.0.14",
 		"otpauth": "9.4.1",
 		"pg": "8.16.3",
-		"pkce-challenge": "5.0.0",
+		"pkce-challenge": "5.0.1",
 		"probe-image-size": "7.2.3",
 		"promise-limit": "2.7.0",
-		"pug": "3.0.3",
 		"qrcode": "1.5.4",
 		"random-seed": "0.3.0",
 		"ratelimiter": "3.4.1",
@@ -171,14 +166,12 @@
 		"slacc": "0.0.10",
 		"strict-event-emitter-types": "2.0.0",
 		"stringz": "2.1.0",
-		"systeminformation": "5.27.11",
+		"systeminformation": "5.27.14",
 		"tinycolor2": "1.6.0",
 		"tmp": "0.2.5",
 		"tsc-alias": "1.8.16",
-		"tsconfig-paths": "4.2.0",
+		"typeorm": "0.3.28",
-		"typeorm": "0.3.27",
+		"ulid": "3.0.2",
-		"typescript": "5.9.3",
-		"ulid": "3.0.1",
 		"vary": "1.1.2",
 		"web-push": "3.6.7",
 		"ws": "8.18.3",
@@ -186,8 +179,9 @@
 	},
 	"devDependencies": {
 		"@jest/globals": "29.7.0",
+		"@kitajs/ts-html-plugin": "4.1.3",
 		"@nestjs/platform-express": "11.1.9",
-		"@sentry/vue": "10.26.0",
+		"@sentry/vue": "10.29.0",
 		"@simplewebauthn/types": "12.0.0",
 		"@swc/jest": "0.2.39",
 		"@types/accepts": "1.3.7",
@@ -198,25 +192,21 @@
 		"@types/fluent-ffmpeg": "2.1.28",
 		"@types/http-link-header": "1.0.7",
 		"@types/jest": "29.5.14",
-		"@types/js-yaml": "4.0.9",
 		"@types/jsonld": "1.5.15",
-		"@types/jsrsasign": "10.5.15",
 		"@types/mime-types": "3.0.1",
 		"@types/ms": "2.1.0",
-		"@types/node": "24.10.1",
+		"@types/node": "24.10.2",
 		"@types/nodemailer": "7.0.4",
-		"@types/oauth": "0.9.6",
 		"@types/oauth2orize": "1.11.5",
 		"@types/oauth2orize-pkce": "0.1.2",
 		"@types/pg": "8.15.6",
-		"@types/pug": "2.0.10",
 		"@types/qrcode": "1.5.6",
 		"@types/random-seed": "0.3.5",
 		"@types/ratelimiter": "3.4.6",
 		"@types/rename": "1.0.7",
 		"@types/sanitize-html": "2.16.0",
 		"@types/semver": "7.7.1",
-		"@types/simple-oauth2": "5.0.7",
+		"@types/simple-oauth2": "5.0.8",
 		"@types/sinonjs__fake-timers": "15.0.1",
 		"@types/supertest": "6.0.3",
 		"@types/tinycolor2": "1.4.6",
@@ -224,19 +214,21 @@
 		"@types/vary": "1.1.3",
 		"@types/web-push": "3.6.4",
 		"@types/ws": "8.18.1",
-		"@typescript-eslint/eslint-plugin": "8.47.0",
+		"@typescript-eslint/eslint-plugin": "8.49.0",
-		"@typescript-eslint/parser": "8.47.0",
+		"@typescript-eslint/parser": "8.49.0",
 		"aws-sdk-client-mock": "4.1.0",
+		"cbor": "10.0.11",
 		"cross-env": "10.1.0",
 		"eslint-plugin-import": "2.32.0",
-		"execa": "9.6.0",
+		"execa": "9.6.1",
 		"fkill": "10.0.1",
 		"jest": "29.7.0",
 		"jest-mock": "29.7.0",
-		"jest-util": "29.7.0",
+		"js-yaml": "4.1.1",
 		"nodemon": "3.1.11",
 		"pid-port": "2.0.0",
 		"simple-oauth2": "5.1.0",
-		"supertest": "7.1.4"
+		"supertest": "7.1.4",
+		"vite": "7.2.7"
 	}
 }

packages/backend/scripts/compile_config.js

@@ -0,0 +1,54 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and misskey-project
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+/**
+ * YAMLファイルをJSONファイルに変換するスクリプト
+ * ビルド前に実行し、ランタイムにjs-yamlを含まないようにする
+ */
+
+import fs from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import yaml from 'js-yaml';
+
+const _filename = fileURLToPath(import.meta.url);
+const _dirname = dirname(_filename);
+
+const configDir = resolve(_dirname, '../../../.config');
+const OUTPUT_PATH = resolve(_dirname, '../../../built/.config.json');
+
+// TODO: yamlのパースに失敗したときのエラーハンドリング
+
+/**
+ * YAMLファイルをJSONファイルに変換
+ * @param {string} ymlPath - YAMLファイルのパス
+ */
+function yamlToJson(ymlPath) {
+	if (!fs.existsSync(ymlPath)) {
+		console.warn(`YAML file not found: ${ymlPath}`);
+		return;
+	}
+
+	console.log(`${ymlPath} → ${OUTPUT_PATH}`);
+
+	const yamlContent = fs.readFileSync(ymlPath, 'utf-8');
+	const jsonContent = yaml.load(yamlContent);
+	if (!fs.existsSync(dirname(OUTPUT_PATH))) {
+		fs.mkdirSync(dirname(OUTPUT_PATH), { recursive: true });
+	}
+	fs.writeFileSync(OUTPUT_PATH, JSON.stringify({
+		'_NOTE_': 'This file is auto-generated from YAML file. DO NOT EDIT.',
+		...jsonContent,
+	}), 'utf-8');
+}
+
+if (process.env.MISSKEY_CONFIG_YML) {
+	const customYmlPath = resolve(configDir, process.env.MISSKEY_CONFIG_YML);
+	yamlToJson(customYmlPath);
+} else {
+	yamlToJson(resolve(configDir, process.env.NODE_ENV === 'test' ? 'test.yml' : 'default.yml'));
+}
+
+console.log('Configuration compiled ✓');

packages/backend/scripts/dev.mjs

@@ -42,7 +42,7 @@ async function killProc() {
 		'./node_modules/nodemon/bin/nodemon.js',
 		[
 			'-w', 'src',
-			'-e', 'ts,js,mjs,cjs,json,pug',
+			'-e', 'ts,js,mjs,cjs,tsx,json,pug',
 			'--exec', 'pnpm', 'run', 'build',
 		],
 		{

packages/backend/scripts/measure-memory.mjs

@@ -0,0 +1,152 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and misskey-project
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+/**
+ * This script starts the Misskey backend server, waits for it to be ready,
+ * measures memory usage, and outputs the result as JSON.
+ *
+ * Usage: node scripts/measure-memory.mjs
+ */
+
+import { fork } from 'node:child_process';
+import { setTimeout } from 'node:timers/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+const STARTUP_TIMEOUT = 120000; // 120 seconds timeout for server startup
+const MEMORY_SETTLE_TIME = 10000; // Wait 10 seconds after startup for memory to settle
+
+async function measureMemory() {
+	const startTime = Date.now();
+
+	// Start the Misskey backend server using fork to enable IPC
+	const serverProcess = fork(join(__dirname, '../built/boot/entry.js'), [], {
+		cwd: join(__dirname, '..'),
+		env: {
+			...process.env,
+			NODE_ENV: 'test',
+		},
+		stdio: ['pipe', 'pipe', 'pipe', 'ipc'],
+	});
+
+	let serverReady = false;
+
+	// Listen for the 'ok' message from the server indicating it's ready
+	serverProcess.on('message', (message) => {
+		if (message === 'ok') {
+			serverReady = true;
+		}
+	});
+
+	// Handle server output
+	serverProcess.stdout?.on('data', (data) => {
+		process.stderr.write(`[server stdout] ${data}`);
+	});
+
+	serverProcess.stderr?.on('data', (data) => {
+		process.stderr.write(`[server stderr] ${data}`);
+	});
+
+	// Handle server error
+	serverProcess.on('error', (err) => {
+		process.stderr.write(`[server error] ${err}\n`);
+	});
+
+	// Wait for server to be ready or timeout
+	const startupStartTime = Date.now();
+	while (!serverReady) {
+		if (Date.now() - startupStartTime > STARTUP_TIMEOUT) {
+			serverProcess.kill('SIGTERM');
+			throw new Error('Server startup timeout');
+		}
+		await setTimeout(100);
+	}
+
+	const startupTime = Date.now() - startupStartTime;
+	process.stderr.write(`Server started in ${startupTime}ms\n`);
+
+	// Wait for memory to settle
+	await setTimeout(MEMORY_SETTLE_TIME);
+
+	// Get memory usage from the server process via /proc
+	const pid = serverProcess.pid;
+	let memoryInfo;
+
+	try {
+		const fs = await import('node:fs/promises');
+
+		// Read /proc/[pid]/status for detailed memory info
+		const status = await fs.readFile(`/proc/${pid}/status`, 'utf-8');
+		const vmRssMatch = status.match(/VmRSS:\s+(\d+)\s+kB/);
+		const vmDataMatch = status.match(/VmData:\s+(\d+)\s+kB/);
+		const vmSizeMatch = status.match(/VmSize:\s+(\d+)\s+kB/);
+
+		memoryInfo = {
+			rss: vmRssMatch ? parseInt(vmRssMatch[1], 10) * 1024 : null,
+			heapUsed: vmDataMatch ? parseInt(vmDataMatch[1], 10) * 1024 : null,
+			vmSize: vmSizeMatch ? parseInt(vmSizeMatch[1], 10) * 1024 : null,
+		};
+	} catch (err) {
+		// Fallback: use ps command
+		process.stderr.write(`Warning: Could not read /proc/${pid}/status: ${err}\n`);
+
+		const { execSync } = await import('node:child_process');
+		try {
+			const ps = execSync(`ps -o rss= -p ${pid}`, { encoding: 'utf-8' });
+			const rssKb = parseInt(ps.trim(), 10);
+			memoryInfo = {
+				rss: rssKb * 1024,
+				heapUsed: null,
+				vmSize: null,
+			};
+		} catch {
+			memoryInfo = {
+				rss: null,
+				heapUsed: null,
+				vmSize: null,
+				error: 'Could not measure memory',
+			};
+		}
+	}
+
+	// Stop the server
+	serverProcess.kill('SIGTERM');
+
+	// Wait for process to exit
+	let exited = false;
+	await new Promise((resolve) => {
+		serverProcess.on('exit', () => {
+			exited = true;
+			resolve(undefined);
+		});
+		// Force kill after 10 seconds if not exited
+		setTimeout(10000).then(() => {
+			if (!exited) {
+				serverProcess.kill('SIGKILL');
+			}
+			resolve(undefined);
+		});
+	});
+
+	const result = {
+		timestamp: new Date().toISOString(),
+		startupTimeMs: startupTime,
+		memory: memoryInfo,
+	};
+
+	// Output as JSON to stdout
+	console.log(JSON.stringify(result, null, 2));
+}
+
+measureMemory().catch((err) => {
+	console.error(JSON.stringify({
+		error: err.message,
+		timestamp: new Date().toISOString(),
+	}));
+	process.exit(1);
+});

packages/backend/scripts/watch.mjs

@@ -21,7 +21,7 @@ import { execa } from 'execa';
 		});
 	}, 3000);
 
-	execa('tsc', ['-w', '-p', 'tsconfig.json'], {
+	execa('tsgo', ['-w', '-p', 'tsconfig.json'], {
 		stdout: process.stdout,
 		stderr: process.stderr,
 	});

packages/backend/src/config.ts

@@ -6,11 +6,11 @@
 import * as fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve } from 'node:path';
-import * as yaml from 'js-yaml';
 import { type FastifyServerOptions } from 'fastify';
 import type * as Sentry from '@sentry/node';
 import type * as SentryVue from '@sentry/vue';
 import type { RedisOptions } from 'ioredis';
+import type { ManifestChunk } from 'vite';
 
 type RedisOptionsSource = Partial<RedisOptions> & {
 	host: string;
@@ -30,6 +30,7 @@ type Source = {
 	socket?: string;
 	trustProxy?: FastifyServerOptions['trustProxy'];
 	chmodSocket?: string;
+	enableIpRateLimit?: boolean;
 	disableHsts?: boolean;
 	db: {
 		host: string;
@@ -120,8 +121,9 @@ export type Config = {
 	url: string;
 	port: number;
 	socket: string | undefined;
-	trustProxy: FastifyServerOptions['trustProxy'];
+	trustProxy: NonNullable<FastifyServerOptions['trustProxy']>;
 	chmodSocket: string | undefined;
+	enableIpRateLimit: boolean;
 	disableHsts: boolean | undefined;
 	db: {
 		host: string;
@@ -187,9 +189,9 @@ export type Config = {
 	authUrl: string;
 	driveUrl: string;
 	userAgent: string;
-	frontendEntry: { file: string | null };
+	frontendEntry: ManifestChunk;
 	frontendManifestExists: boolean;
-	frontendEmbedEntry: { file: string | null };
+	frontendEmbedEntry: ManifestChunk;
 	frontendEmbedManifestExists: boolean;
 	mediaProxy: string;
 	externalMediaProxyEnabled: boolean;
@@ -217,21 +219,15 @@ export type FulltextSearchProvider = 'sqlLike' | 'sqlPgroonga' | 'meilisearch';
 const _filename = fileURLToPath(import.meta.url);
 const _dirname = dirname(_filename);
 
-/**
+const compiledConfigFilePathForTest = resolve(_dirname, '../../../built/._config_.json');
- * Path of configuration directory
- */
-const dir = `${_dirname}/../../../.config`;
 
-/**
+export const compiledConfigFilePath = fs.existsSync(compiledConfigFilePathForTest) ? compiledConfigFilePathForTest : resolve(_dirname, '../../../built/.config.json');
- * Path of configuration file
- */
-export const path = process.env.MISSKEY_CONFIG_YML
-	? resolve(dir, process.env.MISSKEY_CONFIG_YML)
-	: process.env.NODE_ENV === 'test'
-		? resolve(dir, 'test.yml')
-		: resolve(dir, 'default.yml');
 
 export function loadConfig(): Config {
+	if (!fs.existsSync(compiledConfigFilePath)) {
+		throw new Error('Compiled configuration file not found. Try running \'pnpm compile-config\'.');
+	}
+
 	const meta = JSON.parse(fs.readFileSync(`${_dirname}/../../../built/meta.json`, 'utf-8'));
 
 	const frontendManifestExists = fs.existsSync(_dirname + '/../../../built/_frontend_vite_/manifest.json');
@@ -243,7 +239,7 @@ export function loadConfig(): Config {
 		JSON.parse(fs.readFileSync(`${_dirname}/../../../built/_frontend_embed_vite_/manifest.json`, 'utf-8'))
 		: { 'src/boot.ts': { file: null } };
 
-	const config = yaml.load(fs.readFileSync(path, 'utf-8')) as Source;
+	const config = JSON.parse(fs.readFileSync(compiledConfigFilePath, 'utf-8')) as Source;
 
 	const url = tryCreateUrl(config.url ?? process.env.MISSKEY_URL ?? '');
 	const version = meta.version;
@@ -269,9 +265,17 @@ export function loadConfig(): Config {
 		url: url.origin,
 		port: config.port ?? parseInt(process.env.PORT ?? '', 10),
 		socket: config.socket,
-		trustProxy: config.trustProxy,
+		trustProxy: config.trustProxy ?? [
+			'10.0.0.0/8',
+			'172.16.0.0/12',
+			'192.168.0.0/16',
+			'127.0.0.1/32',
+			'::1/128',
+			'fc00::/7',
+		],
 		chmodSocket: config.chmodSocket,
 		disableHsts: config.disableHsts,
+		enableIpRateLimit: config.enableIpRateLimit ?? true,
 		host,
 		hostname,
 		scheme,

packages/backend/src/core/AiService.ts

@@ -7,7 +7,6 @@ import * as fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname } from 'node:path';
 import { Injectable } from '@nestjs/common';
-import si from 'systeminformation';
 import { Mutex } from 'async-mutex';
 import fetch from 'node-fetch';
 import { bindThis } from '@/decorators.js';
@@ -84,6 +83,7 @@ export class AiService {
 
 	@bindThis
 	private async getCpuFlags(): Promise<string[]> {
+		const si = await import('systeminformation');
 		const str = await si.cpuFlags();
 		return str.split(/\s+/);
 	}

packages/backend/src/core/CoreModule.ts

@@ -141,7 +141,7 @@ import { ApLoggerService } from './activitypub/ApLoggerService.js';
 import { ApMfmService } from './activitypub/ApMfmService.js';
 import { ApRendererService } from './activitypub/ApRendererService.js';
 import { ApRequestService } from './activitypub/ApRequestService.js';
-import { ApResolverService } from './activitypub/ApResolverService.js';
+import { ApResolverService, Resolver } from './activitypub/ApResolverService.js';
 import { JsonLdService } from './activitypub/JsonLdService.js';
 import { RemoteLoggerService } from './RemoteLoggerService.js';
 import { RemoteUserResolveService } from './RemoteUserResolveService.js';
@@ -447,6 +447,7 @@ const $ApQuestionService: Provider = { provide: 'ApQuestionService', useExisting
 		ApRendererService,
 		ApRequestService,
 		ApResolverService,
+		Resolver,
 		JsonLdService,
 		RemoteLoggerService,
 		RemoteUserResolveService,
@@ -745,6 +746,7 @@ const $ApQuestionService: Provider = { provide: 'ApQuestionService', useExisting
 		ApRendererService,
 		ApRequestService,
 		ApResolverService,
+		Resolver,
 		JsonLdService,
 		RemoteLoggerService,
 		RemoteUserResolveService,

packages/backend/src/core/activitypub/ApInboxService.ts

@@ -95,7 +95,7 @@ export class ApInboxService {
 		if (isCollectionOrOrderedCollection(activity)) {
 			const results = [] as [string, string | void][];
 			// eslint-disable-next-line no-param-reassign
-			resolver ??= this.apResolverService.createResolver();
+			resolver ??= await this.apResolverService.createResolver();
 
 			const items = toArray(isCollection(activity) ? activity.items : activity.orderedItems);
 			if (items.length >= resolver.getRecursionLimit()) {
@@ -221,7 +221,7 @@ export class ApInboxService {
 		this.logger.info(`Accept: ${uri}`);
 
 		// eslint-disable-next-line no-param-reassign
-		resolver ??= this.apResolverService.createResolver();
+		resolver ??= await this.apResolverService.createResolver();
 
 		const object = await resolver.resolve(activity.object).catch(err => {
 			this.logger.error(`Resolution failed: ${err}`);
@@ -284,7 +284,7 @@ export class ApInboxService {
 		this.logger.info(`Announce: ${uri}`);
 
 		// eslint-disable-next-line no-param-reassign
-		resolver ??= this.apResolverService.createResolver();
+		resolver ??= await this.apResolverService.createResolver();
 
 		if (!activity.object) return 'skip: activity has no object property';
 		const targetUri = getApId(activity.object);
@@ -406,7 +406,7 @@ export class ApInboxService {
 		}
 
 		// eslint-disable-next-line no-param-reassign
-		resolver ??= this.apResolverService.createResolver();
+		resolver ??= await this.apResolverService.createResolver();
 
 		const object = await resolver.resolve(activity.object).catch(e => {
 			this.logger.error(`Resolution failed: ${e}`);
@@ -575,7 +575,7 @@ export class ApInboxService {
 		this.logger.info(`Reject: ${uri}`);
 
 		// eslint-disable-next-line no-param-reassign
-		resolver ??= this.apResolverService.createResolver();
+		resolver ??= await this.apResolverService.createResolver();
 
 		const object = await resolver.resolve(activity.object).catch(e => {
 			this.logger.error(`Resolution failed: ${e}`);
@@ -642,7 +642,7 @@ export class ApInboxService {
 		this.logger.info(`Undo: ${uri}`);
 
 		// eslint-disable-next-line no-param-reassign
-		resolver ??= this.apResolverService.createResolver();
+		resolver ??= await this.apResolverService.createResolver();
 
 		const object = await resolver.resolve(activity.object).catch(e => {
 			this.logger.error(`Resolution failed: ${e}`);
@@ -774,7 +774,7 @@ export class ApInboxService {
 		this.logger.debug('Update');
 
 		// eslint-disable-next-line no-param-reassign
-		resolver ??= this.apResolverService.createResolver();
+		resolver ??= await this.apResolverService.createResolver();
 
 		const object = await resolver.resolve(activity.object).catch(e => {
 			this.logger.error(`Resolution failed: ${e}`);

packages/backend/src/core/activitypub/ApResolverService.ts

@@ -3,10 +3,17 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
-import { Inject, Injectable } from '@nestjs/common';
+import { Inject, Injectable, Scope } from '@nestjs/common';
 import { IsNull, Not } from 'typeorm';
 import type { MiLocalUser, MiRemoteUser } from '@/models/User.js';
-import type { NotesRepository, PollsRepository, NoteReactionsRepository, UsersRepository, FollowRequestsRepository, MiMeta } from '@/models/_.js';
+import type {
+	FollowRequestsRepository,
+	MiMeta,
+	NoteReactionsRepository,
+	NotesRepository,
+	PollsRepository,
+	UsersRepository
+} from '@/models/_.js';
 import type { Config } from '@/config.js';
 import { HttpRequestService } from '@/core/HttpRequestService.js';
 import { DI } from '@/di-symbols.js';
@@ -16,26 +23,43 @@ import { LoggerService } from '@/core/LoggerService.js';
 import type Logger from '@/logger.js';
 import { SystemAccountService } from '@/core/SystemAccountService.js';
 import { IdentifiableError } from '@/misc/identifiable-error.js';
+import type { ICollection, IObject, IOrderedCollection } from './type.js';
 import { isCollectionOrOrderedCollection } from './type.js';
 import { ApDbResolverService } from './ApDbResolverService.js';
 import { ApRendererService } from './ApRendererService.js';
 import { ApRequestService } from './ApRequestService.js';
 import { FetchAllowSoftFailMask } from './misc/check-against-url.js';
-import type { IObject, ICollection, IOrderedCollection } from './type.js';
+import { ModuleRef } from '@nestjs/core';
 
+@Injectable({ scope: Scope.TRANSIENT })
 export class Resolver {
 	private history: Set<string>;
 	private user?: MiLocalUser;
 	private logger: Logger;
+	private recursionLimit = 256;
 
 	constructor(
+		@Inject(DI.config)
 		private config: Config,
+
+		@Inject(DI.meta)
 		private meta: MiMeta,
+
+		@Inject(DI.usersRepository)
 		private usersRepository: UsersRepository,
+
+		@Inject(DI.notesRepository)
 		private notesRepository: NotesRepository,
+
+		@Inject(DI.pollsRepository)
 		private pollsRepository: PollsRepository,
+
+		@Inject(DI.noteReactionsRepository)
 		private noteReactionsRepository: NoteReactionsRepository,
+
+		@Inject(DI.followRequestsRepository)
 		private followRequestsRepository: FollowRequestsRepository,
+
 		private utilityService: UtilityService,
 		private systemAccountService: SystemAccountService,
 		private apRequestService: ApRequestService,
@@ -43,7 +67,6 @@ export class Resolver {
 		private apRendererService: ApRendererService,
 		private apDbResolverService: ApDbResolverService,
 		private loggerService: LoggerService,
-		private recursionLimit = 256,
 	) {
 		this.history = new Set();
 		this.logger = this.loggerService.getLogger('ap-resolve');
@@ -180,54 +203,12 @@ export class Resolver {
 @Injectable()
 export class ApResolverService {
 	constructor(
-		@Inject(DI.config)
+		private moduleRef: ModuleRef,
-		private config: Config,
-
-		@Inject(DI.meta)
-		private meta: MiMeta,
-
-		@Inject(DI.usersRepository)
-		private usersRepository: UsersRepository,
-
-		@Inject(DI.notesRepository)
-		private notesRepository: NotesRepository,
-
-		@Inject(DI.pollsRepository)
-		private pollsRepository: PollsRepository,
-
-		@Inject(DI.noteReactionsRepository)
-		private noteReactionsRepository: NoteReactionsRepository,
-
-		@Inject(DI.followRequestsRepository)
-		private followRequestsRepository: FollowRequestsRepository,
-
-		private utilityService: UtilityService,
-		private systemAccountService: SystemAccountService,
-		private apRequestService: ApRequestService,
-		private httpRequestService: HttpRequestService,
-		private apRendererService: ApRendererService,
-		private apDbResolverService: ApDbResolverService,
-		private loggerService: LoggerService,
 	) {
 	}
 
 	@bindThis
-	public createResolver(): Resolver {
+	public async createResolver(): Promise<Resolver> {
-		return new Resolver(
+		return await this.moduleRef.create(Resolver);
-			this.config,
-			this.meta,
-			this.usersRepository,
-			this.notesRepository,
-			this.pollsRepository,
-			this.noteReactionsRepository,
-			this.followRequestsRepository,
-			this.utilityService,
-			this.systemAccountService,
-			this.apRequestService,
-			this.httpRequestService,
-			this.apRendererService,
-			this.apDbResolverService,
-			this.loggerService,
-		);
 	}
 }

packages/backend/src/core/activitypub/models/ApImageService.ts

@@ -46,7 +46,7 @@ export class ApImageService {
 			throw new Error('actor has been suspended');
 		}
 
-		const image = await this.apResolverService.createResolver().resolve(value);
+		const image = await (await this.apResolverService.createResolver()).resolve(value);
 
 		if (!isDocument(image)) return null;
 

packages/backend/src/core/activitypub/models/ApNoteService.ts

@@ -128,7 +128,7 @@ export class ApNoteService {
 	@bindThis
 	public async createNote(value: string | IObject, actor?: MiRemoteUser, resolver?: Resolver, silent = false): Promise<MiNote | null> {
 		// eslint-disable-next-line no-param-reassign
-		if (resolver == null) resolver = this.apResolverService.createResolver();
+		if (resolver == null) resolver = await this.apResolverService.createResolver();
 
 		const object = await resolver.resolve(value);
 

packages/backend/src/core/activitypub/models/ApPersonService.ts

@@ -310,7 +310,7 @@ export class ApPersonService implements OnModuleInit {
 		}
 
 		// eslint-disable-next-line no-param-reassign
-		if (resolver == null) resolver = this.apResolverService.createResolver();
+		if (resolver == null) resolver = await this.apResolverService.createResolver();
 
 		const object = await resolver.resolve(uri);
 		if (object.id == null) throw new Error('invalid object.id: ' + object.id);
@@ -500,7 +500,7 @@ export class ApPersonService implements OnModuleInit {
 		//#endregion
 
 		// eslint-disable-next-line no-param-reassign
-		if (resolver == null) resolver = this.apResolverService.createResolver();
+		if (resolver == null) resolver = await this.apResolverService.createResolver();
 
 		const object = hint ?? await resolver.resolve(uri);
 
@@ -678,7 +678,7 @@ export class ApPersonService implements OnModuleInit {
 
 		// リモートサーバーからフェッチしてきて登録
 		// eslint-disable-next-line no-param-reassign
-		if (resolver == null) resolver = this.apResolverService.createResolver();
+		if (resolver == null) resolver = await this.apResolverService.createResolver();
 		return await this.createPerson(uri, resolver);
 	}
 
@@ -707,7 +707,7 @@ export class ApPersonService implements OnModuleInit {
 
 		this.logger.info(`Updating the featured: ${user.uri}`);
 
-		const _resolver = resolver ?? this.apResolverService.createResolver();
+		const _resolver = resolver ?? await this.apResolverService.createResolver();
 
 		// Resolve to (Ordered)Collection Object
 		const collection = await _resolver.resolveCollection(user.featured);

packages/backend/src/core/activitypub/models/ApQuestionService.ts

@@ -45,7 +45,7 @@ export class ApQuestionService {
 	@bindThis
 	public async extractPollFromQuestion(source: string | IObject, resolver?: Resolver): Promise<IPoll> {
 		// eslint-disable-next-line no-param-reassign
-		if (resolver == null) resolver = this.apResolverService.createResolver();
+		if (resolver == null) resolver = await this.apResolverService.createResolver();
 
 		const question = await resolver.resolve(source);
 		if (!isQuestion(question)) throw new Error('invalid type');
@@ -91,7 +91,7 @@ export class ApQuestionService {
 
 		// resolve new Question object
 		// eslint-disable-next-line no-param-reassign
-		if (resolver == null) resolver = this.apResolverService.createResolver();
+		if (resolver == null) resolver = await this.apResolverService.createResolver();
 		const question = await resolver.resolve(value);
 		this.logger.debug(`fetched question: ${JSON.stringify(question, null, 2)}`);
 

packages/backend/src/core/entities/NoteEntityService.ts

@@ -15,6 +15,7 @@ import type { UsersRepository, NotesRepository, FollowingsRepository, PollsRepos
 import { bindThis } from '@/decorators.js';
 import { DebounceLoader } from '@/misc/loader.js';
 import { IdService } from '@/core/IdService.js';
+import { shouldHideNoteByTime } from '@/misc/should-hide-note-by-time.js';
 import { ReactionsBufferingService } from '@/core/ReactionsBufferingService.js';
 import type { OnModuleInit } from '@nestjs/common';
 import type { CustomEmojiService } from '../CustomEmojiService.js';
@@ -116,12 +117,7 @@ export class NoteEntityService implements OnModuleInit {
 	private treatVisibility(packedNote: Packed<'Note'>): Packed<'Note'>['visibility'] {
 		if (packedNote.visibility === 'public' || packedNote.visibility === 'home') {
 			const followersOnlyBefore = packedNote.user.makeNotesFollowersOnlyBefore;
-			if ((followersOnlyBefore != null)
+			if (shouldHideNoteByTime(followersOnlyBefore, packedNote.createdAt)) {
-				&& (
-					(followersOnlyBefore <= 0 && (Date.now() - new Date(packedNote.createdAt).getTime() > 0 - (followersOnlyBefore * 1000)))
-					|| (followersOnlyBefore > 0 && (new Date(packedNote.createdAt).getTime() < followersOnlyBefore * 1000))
-				)
-			) {
 				packedNote.visibility = 'followers';
 			}
 		}
@@ -141,12 +137,7 @@ export class NoteEntityService implements OnModuleInit {
 
 		if (!hide) {
 			const hiddenBefore = packedNote.user.makeNotesHiddenBefore;
-			if ((hiddenBefore != null)
+			if (shouldHideNoteByTime(hiddenBefore, packedNote.createdAt)) {
-				&& (
-					(hiddenBefore <= 0 && (Date.now() - new Date(packedNote.createdAt).getTime() > 0 - (hiddenBefore * 1000)))
-					|| (hiddenBefore > 0 && (new Date(packedNote.createdAt).getTime() < hiddenBefore * 1000))
-				)
-			) {
 				hide = true;
 			}
 		}

packages/backend/src/daemons/ServerStatsService.ts

@@ -4,13 +4,12 @@
  */
 
 import { Inject, Injectable } from '@nestjs/common';
-import si from 'systeminformation';
 import Xev from 'xev';
 import * as osUtils from 'os-utils';
 import { bindThis } from '@/decorators.js';
-import type { OnApplicationShutdown } from '@nestjs/common';
 import { MiMeta } from '@/models/_.js';
 import { DI } from '@/di-symbols.js';
+import type { OnApplicationShutdown } from '@nestjs/common';
 
 const ev = new Xev();
 
@@ -97,12 +96,14 @@ function cpuUsage(): Promise<number> {
 
 // MEMORY STAT
 async function mem() {
+	const si = await import('systeminformation');
 	const data = await si.mem();
 	return data;
 }
 
 // NETWORK STAT
 async function net() {
+	const si = await import('systeminformation');
 	const iface = await si.networkInterfaceDefault();
 	const data = await si.networkStats(iface);
 	return data[0];
@@ -110,5 +111,6 @@ async function net() {
 
 // FS STAT
 async function fs() {
+	const si = await import('systeminformation');
 	return await si.disksIO().catch(() => ({ rIO_sec: 0, wIO_sec: 0 }));
 }

packages/backend/src/misc/json-stringify-html-safe.ts

@@ -0,0 +1,18 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and misskey-project
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+const ESCAPE_LOOKUP = {
+	'&': '\\u0026',
+	'>': '\\u003e',
+	'<': '\\u003c',
+	'\u2028': '\\u2028',
+	'\u2029': '\\u2029',
+} as Record<string, string>;
+
+const ESCAPE_REGEX = /[&><\u2028\u2029]/g;
+
+export function htmlSafeJsonStringify(obj: any): string {
+	return JSON.stringify(obj).replace(ESCAPE_REGEX, x => ESCAPE_LOOKUP[x]);
+}

packages/backend/src/misc/should-hide-note-by-time.ts

@@ -0,0 +1,29 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and misskey-project
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+/**
+ * ノートが指定された時間条件に基づいて非表示対象かどうかを判定する
+ * @param hiddenBefore 非表示条件（負の値: 作成からの経過秒数、正の値: UNIXタイムスタンプ秒、null: 判定しない）
+ * @param createdAt ノートの作成日時（ISO 8601形式の文字列 または Date オブジェクト）
+ * @returns 非表示にすべき場合は true
+ */
+export function shouldHideNoteByTime(hiddenBefore: number | null | undefined, createdAt: string | Date): boolean {
+	if (hiddenBefore == null) {
+		return false;
+	}
+
+	const createdAtTime = typeof createdAt === 'string' ? new Date(createdAt).getTime() : createdAt.getTime();
+
+	if (hiddenBefore <= 0) {
+		// 負の値: 作成からの経過時間(秒)で判定
+		const elapsedSeconds = (Date.now() - createdAtTime) / 1000;
+		const hideAfterSeconds = Math.abs(hiddenBefore);
+		return elapsedSeconds >= hideAfterSeconds;
+	} else {
+		// 正の値: 絶対的なタイムスタンプ(秒)で判定
+		const createdAtSeconds = createdAtTime / 1000;
+		return createdAtSeconds <= hiddenBefore;
+	}
+}

packages/backend/src/misc/show-machine-info.ts

@@ -4,15 +4,11 @@
  */
 
 import * as os from 'node:os';
-import sysUtils from 'systeminformation';
 import type Logger from '@/logger.js';
 
 export async function showMachineInfo(parentLogger: Logger) {
 	const logger = parentLogger.createSubLogger('machine');
 	logger.debug(`Hostname: ${os.hostname()}`);
 	logger.debug(`Platform: ${process.platform} Arch: ${process.arch}`);
-	const mem = await sysUtils.mem();
+	logger.debug(`CPU: ${os.cpus().length} core MEM: ${(os.totalmem() / 1024 / 1024 / 1024).toFixed(1)}GB (available: ${(os.freemem() / 1024 / 1024 / 1024).toFixed(1)}GB)`);
-	const totalmem = (mem.total / 1024 / 1024 / 1024).toFixed(1);
-	const availmem = (mem.available / 1024 / 1024 / 1024).toFixed(1);
-	logger.debug(`CPU: ${os.cpus().length} core MEM: ${totalmem}GB (available: ${availmem}GB)`);
 }

packages/backend/src/queue/QueueProcessorService.ts

@@ -157,7 +157,7 @@ export class QueueProcessorService implements OnApplicationShutdown {
 		}
 
 		let Sentry: typeof import('@sentry/node') | undefined;
-		if (Sentry != null) {
+		if (this.config.sentryForBackend) {
 			import('@sentry/node').then((mod) => {
 				Sentry = mod;
 			});

packages/backend/src/queue/processors/ExportClipsProcessorService.ts

@@ -5,21 +5,20 @@
 
 import * as fs from 'node:fs';
 import { Writable } from 'node:stream';
-import { Inject, Injectable, StreamableFile } from '@nestjs/common';
+import { Inject, Injectable } from '@nestjs/common';
-import { MoreThan } from 'typeorm';
 import { format as dateFormat } from 'date-fns';
 import { DI } from '@/di-symbols.js';
-import type { ClipNotesRepository, ClipsRepository, MiClip, MiClipNote, MiUser, NotesRepository, PollsRepository, UsersRepository } from '@/models/_.js';
+import type { ClipNotesRepository, ClipsRepository, MiClip, MiClipNote, MiUser, PollsRepository, UsersRepository } from '@/models/_.js';
 import type Logger from '@/logger.js';
 import { DriveService } from '@/core/DriveService.js';
 import { createTemp } from '@/misc/create-temp.js';
 import type { MiPoll } from '@/models/Poll.js';
 import type { MiNote } from '@/models/Note.js';
 import { bindThis } from '@/decorators.js';
-import { DriveFileEntityService } from '@/core/entities/DriveFileEntityService.js';
-import { Packed } from '@/misc/json-schema.js';
 import { IdService } from '@/core/IdService.js';
 import { NotificationService } from '@/core/NotificationService.js';
+import { QueryService } from '@/core/QueryService.js';
+import { shouldHideNoteByTime } from '@/misc/should-hide-note-by-time.js';
 import { QueueLoggerService } from '../QueueLoggerService.js';
 import type * as Bull from 'bullmq';
 import type { DbJobDataWithUser } from '../types.js';
@@ -43,6 +42,7 @@ export class ExportClipsProcessorService {
 
 		private driveService: DriveService,
 		private queueLoggerService: QueueLoggerService,
+		private queryService: QueryService,
 		private idService: IdService,
 		private notificationService: NotificationService,
 	) {
@@ -100,16 +100,16 @@ export class ExportClipsProcessorService {
 		});
 
 		while (true) {
-			const clips = await this.clipsRepository.find({
+			const query = this.clipsRepository.createQueryBuilder('clip')
-				where: {
+				.where('clip.userId = :userId', { userId: user.id })
-					userId: user.id,
+				.orderBy('clip.id', 'ASC')
-					...(cursor ? { id: MoreThan(cursor) } : {}),
+				.take(100);
-				},
+
-				take: 100,
+			if (cursor) {
-				order: {
+				query.andWhere('clip.id > :cursor', { cursor });
-					id: 1,
+			}
-				},
+
-			});
+			const clips = await query.getMany();
 
 			if (clips.length === 0) {
 				job.updateProgress(100);
@@ -124,7 +124,7 @@ export class ExportClipsProcessorService {
 				const isFirst = exportedClipsCount === 0;
 				await writer.write(isFirst ? content : ',\n' + content);
 
-				await this.processClipNotes(writer, clip.id);
+				await this.processClipNotes(writer, clip.id, user.id);
 
 				await writer.write(']}');
 				exportedClipsCount++;
@@ -134,22 +134,25 @@ export class ExportClipsProcessorService {
 		}
 	}
 
-	async processClipNotes(writer: WritableStreamDefaultWriter, clipId: string): Promise<void> {
+	async processClipNotes(writer: WritableStreamDefaultWriter, clipId: string, userId: string): Promise<void> {
 		let exportedClipNotesCount = 0;
 		let cursor: MiClipNote['id'] | null = null;
 
 		while (true) {
-			const clipNotes = await this.clipNotesRepository.find({
+			const query = this.clipNotesRepository.createQueryBuilder('clipNote')
-				where: {
+				.leftJoinAndSelect('clipNote.note', 'note')
-					clipId,
+				.leftJoinAndSelect('note.user', 'user')
-					...(cursor ? { id: MoreThan(cursor) } : {}),
+				.where('clipNote.clipId = :clipId', { clipId })
-				},
+				.orderBy('clipNote.id', 'ASC')
-				take: 100,
+				.take(100);
-				order: {
+
-					id: 1,
+			if (cursor) {
-				},
+				query.andWhere('clipNote.id > :cursor', { cursor });
-				relations: ['note', 'note.user'],
+			}
-			}) as (MiClipNote & { note: MiNote & { user: MiUser } })[];
+
+			this.queryService.generateVisibilityQuery(query, { id: userId });
+
+			const clipNotes = await query.getMany() as (MiClipNote & { note: MiNote & { user: MiUser } })[];
 
 			if (clipNotes.length === 0) {
 				break;
@@ -158,6 +161,11 @@ export class ExportClipsProcessorService {
 			cursor = clipNotes.at(-1)?.id ?? null;
 
 			for (const clipNote of clipNotes) {
+				const noteCreatedAt = this.idService.parse(clipNote.note.id).date;
+				if (shouldHideNoteByTime(clipNote.note.user.makeNotesHiddenBefore, noteCreatedAt)) {
+					continue;
+				}
+
 				let poll: MiPoll | undefined;
 				if (clipNote.note.hasPoll) {
 					poll = await this.pollsRepository.findOneByOrFail({ noteId: clipNote.note.id });

packages/backend/src/queue/processors/ExportFavoritesProcessorService.ts

@@ -5,7 +5,6 @@
 
 import * as fs from 'node:fs';
 import { Inject, Injectable } from '@nestjs/common';
-import { MoreThan } from 'typeorm';
 import { format as dateFormat } from 'date-fns';
 import { DI } from '@/di-symbols.js';
 import type { MiNoteFavorite, NoteFavoritesRepository, PollsRepository, MiUser, UsersRepository } from '@/models/_.js';
@@ -17,6 +16,8 @@ import type { MiNote } from '@/models/Note.js';
 import { bindThis } from '@/decorators.js';
 import { IdService } from '@/core/IdService.js';
 import { NotificationService } from '@/core/NotificationService.js';
+import { QueryService } from '@/core/QueryService.js';
+import { shouldHideNoteByTime } from '@/misc/should-hide-note-by-time.js';
 import { QueueLoggerService } from '../QueueLoggerService.js';
 import type * as Bull from 'bullmq';
 import type { DbJobDataWithUser } from '../types.js';
@@ -37,6 +38,7 @@ export class ExportFavoritesProcessorService {
 
 		private driveService: DriveService,
 		private queueLoggerService: QueueLoggerService,
+		private queryService: QueryService,
 		private idService: IdService,
 		private notificationService: NotificationService,
 	) {
@@ -83,17 +85,20 @@ export class ExportFavoritesProcessorService {
 			});
 
 			while (true) {
-				const favorites = await this.noteFavoritesRepository.find({
+				const query = this.noteFavoritesRepository.createQueryBuilder('favorite')
-					where: {
+					.leftJoinAndSelect('favorite.note', 'note')
-						userId: user.id,
+					.leftJoinAndSelect('note.user', 'user')
-						...(cursor ? { id: MoreThan(cursor) } : {}),
+					.where('favorite.userId = :userId', { userId: user.id })
-					},
+					.orderBy('favorite.id', 'ASC')
-					take: 100,
+					.take(100);
-					order: {
+
-						id: 1,
+				if (cursor) {
-					},
+					query.andWhere('favorite.id > :cursor', { cursor });
-					relations: ['note', 'note.user'],
+				}
-				}) as (MiNoteFavorite & { note: MiNote & { user: MiUser } })[];
+
+				this.queryService.generateVisibilityQuery(query, { id: user.id });
+
+				const favorites = await query.getMany() as (MiNoteFavorite & { note: MiNote & { user: MiUser } })[];
 
 				if (favorites.length === 0) {
 					job.updateProgress(100);
@@ -103,6 +108,11 @@ export class ExportFavoritesProcessorService {
 				cursor = favorites.at(-1)?.id ?? null;
 
 				for (const favorite of favorites) {
+					const noteCreatedAt = this.idService.parse(favorite.note.id).date;
+					if (shouldHideNoteByTime(favorite.note.user.makeNotesHiddenBefore, noteCreatedAt)) {
+						continue;
+					}
+
 					let poll: MiPoll | undefined;
 					if (favorite.note.hasPoll) {
 						poll = await this.pollsRepository.findOneByOrFail({ noteId: favorite.note.id });

packages/backend/src/server/ServerModule.ts

@@ -13,7 +13,6 @@ import { NodeinfoServerService } from './NodeinfoServerService.js';
 import { ServerService } from './ServerService.js';
 import { WellKnownServerService } from './WellKnownServerService.js';
 import { GetterService } from './api/GetterService.js';
-import { ChannelsService } from './api/stream/ChannelsService.js';
 import { ActivityPubServerService } from './ActivityPubServerService.js';
 import { ApiLoggerService } from './api/ApiLoggerService.js';
 import { ApiServerService } from './api/ApiServerService.js';
@@ -25,29 +24,31 @@ import { SignupApiService } from './api/SignupApiService.js';
 import { StreamingApiServerService } from './api/StreamingApiServerService.js';
 import { OpenApiServerService } from './api/openapi/OpenApiServerService.js';
 import { ClientServerService } from './web/ClientServerService.js';
+import { HtmlTemplateService } from './web/HtmlTemplateService.js';
 import { FeedService } from './web/FeedService.js';
 import { UrlPreviewService } from './web/UrlPreviewService.js';
 import { ClientLoggerService } from './web/ClientLoggerService.js';
 import { OAuth2ProviderService } from './oauth/OAuth2ProviderService.js';
 
-import { MainChannelService } from './api/stream/channels/main.js';
+import MainStreamConnection from '@/server/api/stream/Connection.js';
-import { AdminChannelService } from './api/stream/channels/admin.js';
+import { MainChannel } from './api/stream/channels/main.js';
-import { AntennaChannelService } from './api/stream/channels/antenna.js';
+import { AdminChannel } from './api/stream/channels/admin.js';
-import { ChannelChannelService } from './api/stream/channels/channel.js';
+import { AntennaChannel } from './api/stream/channels/antenna.js';
-import { DriveChannelService } from './api/stream/channels/drive.js';
+import { ChannelChannel } from './api/stream/channels/channel.js';
-import { GlobalTimelineChannelService } from './api/stream/channels/global-timeline.js';
+import { DriveChannel } from './api/stream/channels/drive.js';
-import { HashtagChannelService } from './api/stream/channels/hashtag.js';
+import { GlobalTimelineChannel } from './api/stream/channels/global-timeline.js';
-import { HomeTimelineChannelService } from './api/stream/channels/home-timeline.js';
+import { HashtagChannel } from './api/stream/channels/hashtag.js';
-import { HybridTimelineChannelService } from './api/stream/channels/hybrid-timeline.js';
+import { HomeTimelineChannel } from './api/stream/channels/home-timeline.js';
-import { LocalTimelineChannelService } from './api/stream/channels/local-timeline.js';
+import { HybridTimelineChannel } from './api/stream/channels/hybrid-timeline.js';
-import { QueueStatsChannelService } from './api/stream/channels/queue-stats.js';
+import { LocalTimelineChannel } from './api/stream/channels/local-timeline.js';
-import { ServerStatsChannelService } from './api/stream/channels/server-stats.js';
+import { QueueStatsChannel } from './api/stream/channels/queue-stats.js';
-import { UserListChannelService } from './api/stream/channels/user-list.js';
+import { ServerStatsChannel } from './api/stream/channels/server-stats.js';
-import { RoleTimelineChannelService } from './api/stream/channels/role-timeline.js';
+import { UserListChannel } from './api/stream/channels/user-list.js';
-import { ChatUserChannelService } from './api/stream/channels/chat-user.js';
+import { RoleTimelineChannel } from './api/stream/channels/role-timeline.js';
-import { ChatRoomChannelService } from './api/stream/channels/chat-room.js';
+import { ChatUserChannel } from './api/stream/channels/chat-user.js';
-import { ReversiChannelService } from './api/stream/channels/reversi.js';
+import { ChatRoomChannel } from './api/stream/channels/chat-room.js';
-import { ReversiGameChannelService } from './api/stream/channels/reversi-game.js';
+import { ReversiChannel } from './api/stream/channels/reversi.js';
+import { ReversiGameChannel } from './api/stream/channels/reversi-game.js';
 import { SigninWithPasskeyApiService } from './api/SigninWithPasskeyApiService.js';
 
 @Module({
@@ -58,6 +59,7 @@ import { SigninWithPasskeyApiService } from './api/SigninWithPasskeyApiService.j
 	providers: [
 		ClientServerService,
 		ClientLoggerService,
+		HtmlTemplateService,
 		FeedService,
 		HealthServerService,
 		UrlPreviewService,
@@ -67,7 +69,7 @@ import { SigninWithPasskeyApiService } from './api/SigninWithPasskeyApiService.j
 		ServerService,
 		WellKnownServerService,
 		GetterService,
-		ChannelsService,
+		MainStreamConnection,
 		ApiCallService,
 		ApiLoggerService,
 		ApiServerService,
@@ -78,24 +80,24 @@ import { SigninWithPasskeyApiService } from './api/SigninWithPasskeyApiService.j
 		SigninService,
 		SignupApiService,
 		StreamingApiServerService,
-		MainChannelService,
+		MainChannel,
-		AdminChannelService,
+		AdminChannel,
-		AntennaChannelService,
+		AntennaChannel,
-		ChannelChannelService,
+		ChannelChannel,
-		DriveChannelService,
+		DriveChannel,
-		GlobalTimelineChannelService,
+		GlobalTimelineChannel,
-		HashtagChannelService,
+		HashtagChannel,
-		RoleTimelineChannelService,
+		RoleTimelineChannel,
-		ChatUserChannelService,
+		ChatUserChannel,
-		ChatRoomChannelService,
+		ChatRoomChannel,
-		ReversiChannelService,
+		ReversiChannel,
-		ReversiGameChannelService,
+		ReversiGameChannel,
-		HomeTimelineChannelService,
+		HomeTimelineChannel,
-		HybridTimelineChannelService,
+		HybridTimelineChannel,
-		LocalTimelineChannelService,
+		LocalTimelineChannel,
-		QueueStatsChannelService,
+		QueueStatsChannel,
-		ServerStatsChannelService,
+		ServerStatsChannel,
-		UserListChannelService,
+		UserListChannel,
 		OpenApiServerService,
 		OAuth2ProviderService,
 	],

packages/backend/src/server/ServerService.ts

@@ -75,7 +75,7 @@ export class ServerService implements OnApplicationShutdown {
 	@bindThis
 	public async launch(): Promise<void> {
 		const fastify = Fastify({
-			trustProxy: this.config.trustProxy ?? true,
+			trustProxy: this.config.trustProxy,
 			logger: false,
 		});
 		this.#fastify = fastify;

packages/backend/src/server/api/ApiCallService.ts

@@ -313,11 +313,14 @@ export class ApiCallService implements OnApplicationShutdown {
 		}
 
 		if (ep.meta.limit) {
-			// koa will automatically load the `X-Forwarded-For` header if `proxy: true` is configured in the app.
+			let limitActor: string | null = null;
-			let limitActor: string;
 			if (user) {
 				limitActor = user.id;
-			} else {
+			} else if (this.config.enableIpRateLimit) {
+				if (process.env.NODE_ENV === 'production' && (request.ip === '::1' || request.ip === '127.0.0.1')) {
+					this.logger.warn('Recieved API request from localhost IP address for rate limiting in production environment. This is likely due to an improper trustProxy setting in the config file.');
+				}
+
 				limitActor = getIpHash(request.ip);
 			}
 
@@ -330,7 +333,7 @@ export class ApiCallService implements OnApplicationShutdown {
 			// TODO: 毎リクエスト計算するのもあれだしキャッシュしたい
 			const factor = user ? (await this.roleService.getUserPolicies(user.id)).rateLimitFactor : 1;
 
-			if (factor > 0) {
+			if (limitActor != null && factor > 0) {
 				// Rate limit
 				const rateLimit = await this.rateLimiterService.limit(limit as IEndpointMeta['limit'] & { key: NonNullable<string> }, limitActor, factor);
 				if (rateLimit != null) {

packages/backend/src/server/api/SigninApiService.ts

@@ -15,6 +15,7 @@ import type {
 	UserSecurityKeysRepository,
 	UsersRepository,
 } from '@/models/_.js';
+import type Logger from '@/logger.js';
 import type { Config } from '@/config.js';
 import { getIpHash } from '@/misc/get-ip-hash.js';
 import type { MiLocalUser } from '@/models/User.js';
@@ -23,6 +24,7 @@ import { bindThis } from '@/decorators.js';
 import { WebAuthnService } from '@/core/WebAuthnService.js';
 import { UserAuthService } from '@/core/UserAuthService.js';
 import { CaptchaService } from '@/core/CaptchaService.js';
+import { LoggerService } from '@/core/LoggerService.js';
 import { FastifyReplyError } from '@/misc/fastify-reply-error.js';
 import { RateLimiterService } from './RateLimiterService.js';
 import { SigninService } from './SigninService.js';
@@ -31,6 +33,8 @@ import type { FastifyReply, FastifyRequest } from 'fastify';
 
 @Injectable()
 export class SigninApiService {
+	private logger: Logger;
+
 	constructor(
 		@Inject(DI.config)
 		private config: Config,
@@ -50,6 +54,7 @@ export class SigninApiService {
 		@Inject(DI.signinsRepository)
 		private signinsRepository: SigninsRepository,
 
+		private loggerService: LoggerService,
 		private idService: IdService,
 		private rateLimiterService: RateLimiterService,
 		private signinService: SigninService,
@@ -57,6 +62,7 @@ export class SigninApiService {
 		private webAuthnService: WebAuthnService,
 		private captchaService: CaptchaService,
 	) {
+		this.logger = this.loggerService.getLogger('Signin');
 	}
 
 	@bindThis
@@ -90,16 +96,21 @@ export class SigninApiService {
 		}
 
 		// not more than 1 attempt per second and not more than 10 attempts per hour
-		const rateLimit = await this.rateLimiterService.limit({ key: 'signin', duration: 60 * 60 * 1000, max: 10, minInterval: 1000 }, getIpHash(request.ip));
+		if (this.config.enableIpRateLimit) {
-		if (rateLimit != null) {
+			if (process.env.NODE_ENV === 'production' && (request.ip === '::1' || request.ip === '127.0.0.1')) {
-			reply.code(429);
+				this.logger.warn('Recieved signin request from localhost IP address for rate limiting in production environment. This is likely due to an improper trustProxy setting in the config file.');
-			return {
+			}
-				error: {
+			const rateLimit = await this.rateLimiterService.limit({ key: 'signin', duration: 60 * 60 * 1000, max: 10, minInterval: 1000 }, getIpHash(request.ip));
-					message: 'Too many failed attempts to sign in. Try again later.',
+			if (rateLimit != null) {
-					code: 'TOO_MANY_AUTHENTICATION_FAILURES',
+				reply.code(429);
-					id: '22d05606-fbcf-421a-a2db-b32610dcfd1b',
+				return {
-				},
+					error: {
-			};
+						message: 'Too many failed attempts to sign in. Try again later.',
+						code: 'TOO_MANY_AUTHENTICATION_FAILURES',
+						id: '22d05606-fbcf-421a-a2db-b32610dcfd1b',
+					},
+				};
+			}
 		}
 
 		if (typeof username !== 'string') {

packages/backend/src/server/api/SigninWithPasskeyApiService.ts

@@ -84,19 +84,25 @@ export class SigninWithPasskeyApiService {
 			return error(status ?? 500, failure ?? { id: '4e30e80c-e338-45a0-8c8f-44455efa3b76' });
 		};
 
-		try {
+		if (this.config.enableIpRateLimit) {
+			if (process.env.NODE_ENV === 'production' && (request.ip === '::1' || request.ip === '127.0.0.1')) {
+				this.logger.warn('Recieved signin with passkey request from localhost IP address for rate limiting in production environment. This is likely due to an improper trustProxy setting in the config file.');
+			}
+
+			try {
 			// Not more than 1 API call per 250ms and not more than 100 attempts per 30min
 			// NOTE: 1 Sign-in require 2 API calls
-			await this.rateLimiterService.limit({ key: 'signin-with-passkey', duration: 60 * 30 * 1000, max: 200, minInterval: 250 }, getIpHash(request.ip));
+				await this.rateLimiterService.limit({ key: 'signin-with-passkey', duration: 60 * 30 * 1000, max: 200, minInterval: 250 }, getIpHash(request.ip));
-		} catch (err) {
+			} catch (err) {
-			reply.code(429);
+				reply.code(429);
-			return {
+				return {
-				error: {
+					error: {
-					message: 'Too many failed attempts to sign in. Try again later.',
+						message: 'Too many failed attempts to sign in. Try again later.',
-					code: 'TOO_MANY_AUTHENTICATION_FAILURES',
+						code: 'TOO_MANY_AUTHENTICATION_FAILURES',
-					id: '22d05606-fbcf-421a-a2db-b32610dcfd1b',
+						id: '22d05606-fbcf-421a-a2db-b32610dcfd1b',
-				},
+					},
-			};
+				};
+			}
 		}
 
 		// Initiate Passkey Auth challenge with context

packages/backend/src/server/api/StreamingApiServerService.ts

@@ -8,18 +8,14 @@ import { Inject, Injectable } from '@nestjs/common';
 import * as Redis from 'ioredis';
 import * as WebSocket from 'ws';
 import { DI } from '@/di-symbols.js';
-import type { UsersRepository, MiAccessToken } from '@/models/_.js';
+import type { MiAccessToken } from '@/models/_.js';
-import { NotificationService } from '@/core/NotificationService.js';
 import { bindThis } from '@/decorators.js';
-import { CacheService } from '@/core/CacheService.js';
 import { MiLocalUser } from '@/models/User.js';
 import { UserService } from '@/core/UserService.js';
-import { ChannelFollowingService } from '@/core/ChannelFollowingService.js';
-import { ChannelMutingService } from '@/core/ChannelMutingService.js';
 import { AuthenticateService, AuthenticationError } from './AuthenticateService.js';
-import MainStreamConnection from './stream/Connection.js';
+import MainStreamConnection, { ConnectionRequest } from './stream/Connection.js';
-import { ChannelsService } from './stream/ChannelsService.js';
 import type * as http from 'node:http';
+import { ContextIdFactory, ModuleRef } from '@nestjs/core';
 
 @Injectable()
 export class StreamingApiServerService {
@@ -31,16 +27,9 @@ export class StreamingApiServerService {
 		@Inject(DI.redisForSub)
 		private redisForSub: Redis.Redis,
 
-		@Inject(DI.usersRepository)
+		private moduleRef: ModuleRef,
-		private usersRepository: UsersRepository,
-
-		private cacheService: CacheService,
 		private authenticateService: AuthenticateService,
-		private channelsService: ChannelsService,
-		private notificationService: NotificationService,
 		private usersService: UserService,
-		private channelFollowingService: ChannelFollowingService,
-		private channelMutingService: ChannelMutingService,
 	) {
 	}
 
@@ -94,14 +83,12 @@ export class StreamingApiServerService {
 				return;
 			}
 
-			const stream = new MainStreamConnection(
+			const contextId = ContextIdFactory.create();
-				this.channelsService,
+			this.moduleRef.registerRequestByContextId<ConnectionRequest>({
-				this.notificationService,
+				user,
-				this.cacheService,
+				token: app,
-				this.channelFollowingService,
+			}, contextId);
-				this.channelMutingService,
+			const stream = await this.moduleRef.create(MainStreamConnection, contextId);
-				user, app,
-			);
 
 			await stream.init();
 

packages/backend/src/server/api/endpoints/admin/queue/deliver-delayed.ts

@@ -52,18 +52,14 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 		super(meta, paramDef, async (ps, me) => {
 			const jobs = await this.deliverQueue.getJobs(['delayed']);
 
-			const res = [] as [string, number][];
+			const counts = new Map<string, number>();
 
 			for (const job of jobs) {
 				const host = new URL(job.data.to).host;
-				if (res.find(x => x[0] === host)) {
+				counts.set(host, (counts.get(host) ?? 0) + 1);
-					res.find(x => x[0] === host)![1]++;
-				} else {
-					res.push([host, 1]);
-				}
 			}
 
-			res.sort((a, b) => b[1] - a[1]);
+			const res = [...counts.entries()].sort((a, b) => b[1] - a[1]);
 
 			return res;
 		});

packages/backend/src/server/api/endpoints/admin/queue/inbox-delayed.ts

@@ -52,18 +52,14 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 		super(meta, paramDef, async (ps, me) => {
 			const jobs = await this.inboxQueue.getJobs(['delayed']);
 
-			const res = [] as [string, number][];
+			const counts = new Map<string, number>();
 
 			for (const job of jobs) {
 				const host = new URL(job.data.signature.keyId).host;
-				if (res.find(x => x[0] === host)) {
+				counts.set(host, (counts.get(host) ?? 0) + 1);
-					res.find(x => x[0] === host)![1]++;
-				} else {
-					res.push([host, 1]);
-				}
 			}
 
-			res.sort((a, b) => b[1] - a[1]);
+			const res = [...counts.entries()].sort((a, b) => b[1] - a[1]);
 
 			return res;
 		});

packages/backend/src/server/api/endpoints/admin/server-info.ts

@@ -4,7 +4,6 @@
  */
 
 import * as os from 'node:os';
-import si from 'systeminformation';
 import { Inject, Injectable } from '@nestjs/common';
 import { DataSource } from 'typeorm';
 import * as Redis from 'ioredis';
@@ -112,6 +111,8 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 
 	) {
 		super(meta, paramDef, async () => {
+			const si = await import('systeminformation');
+
 			const memStats = await si.mem();
 			const fsStats = await si.fsSize();
 			const netInterface = await si.networkInterfaceDefault();

packages/backend/src/server/api/endpoints/ap/get.ts

@@ -43,7 +43,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 		private apResolverService: ApResolverService,
 	) {
 		super(meta, paramDef, async (ps, me) => {
-			const resolver = this.apResolverService.createResolver();
+			const resolver = await this.apResolverService.createResolver();
 			const object = await resolver.resolve(ps.uri);
 			return object;
 		});

packages/backend/src/server/api/endpoints/ap/show.ts

@@ -148,7 +148,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 		if (this.utilityService.isSelfHost(host)) return null;
 
 		// リモートから一旦オブジェクトフェッチ
-		const resolver = this.apResolverService.createResolver();
+		const resolver = await this.apResolverService.createResolver();
 		// allow ap/show exclusively to lookup URLs that are cross-origin or non-canonical (like https://alice.example.com/@bob@bob.example.com -> https://bob.example.com/@bob)
 		const object = await resolver.resolve(uri, FetchAllowSoftFailMask.CrossOrigin | FetchAllowSoftFailMask.NonCanonicalId).catch((err) => {
 			if (err instanceof IdentifiableError) {

packages/backend/src/server/api/endpoints/server-info.ts

@@ -4,7 +4,6 @@
  */
 
 import * as os from 'node:os';
-import si from 'systeminformation';
 import { Inject, Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import { MiMeta } from '@/models/_.js';
@@ -93,6 +92,8 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				},
 			};
 
+			const si = await import('systeminformation');
+
 			const memStats = await si.mem();
 			const fsStats = await si.fsSize();
 

packages/backend/src/server/api/stream/ChannelsService.ts

@@ -4,72 +4,54 @@
  */
 
 import { Injectable } from '@nestjs/common';
+import { HybridTimelineChannel } from './channels/hybrid-timeline.js';
+import { LocalTimelineChannel } from './channels/local-timeline.js';
+import { HomeTimelineChannel } from './channels/home-timeline.js';
+import { GlobalTimelineChannel } from './channels/global-timeline.js';
+import { MainChannel } from './channels/main.js';
+import { ChannelChannel } from './channels/channel.js';
+import { AdminChannel } from './channels/admin.js';
+import { ServerStatsChannel } from './channels/server-stats.js';
+import { QueueStatsChannel } from './channels/queue-stats.js';
+import { UserListChannel } from './channels/user-list.js';
+import { AntennaChannel } from './channels/antenna.js';
+import { DriveChannel } from './channels/drive.js';
+import { HashtagChannel } from './channels/hashtag.js';
+import { RoleTimelineChannel } from './channels/role-timeline.js';
+import { ChatUserChannel } from './channels/chat-user.js';
+import { ChatRoomChannel } from './channels/chat-room.js';
+import { ReversiChannel } from './channels/reversi.js';
+import { ReversiGameChannel } from './channels/reversi-game.js';
+import type { ChannelConstructor } from './channel.js';
 import { bindThis } from '@/decorators.js';
-import { HybridTimelineChannelService } from './channels/hybrid-timeline.js';
-import { LocalTimelineChannelService } from './channels/local-timeline.js';
-import { HomeTimelineChannelService } from './channels/home-timeline.js';
-import { GlobalTimelineChannelService } from './channels/global-timeline.js';
-import { MainChannelService } from './channels/main.js';
-import { ChannelChannelService } from './channels/channel.js';
-import { AdminChannelService } from './channels/admin.js';
-import { ServerStatsChannelService } from './channels/server-stats.js';
-import { QueueStatsChannelService } from './channels/queue-stats.js';
-import { UserListChannelService } from './channels/user-list.js';
-import { AntennaChannelService } from './channels/antenna.js';
-import { DriveChannelService } from './channels/drive.js';
-import { HashtagChannelService } from './channels/hashtag.js';
-import { RoleTimelineChannelService } from './channels/role-timeline.js';
-import { ChatUserChannelService } from './channels/chat-user.js';
-import { ChatRoomChannelService } from './channels/chat-room.js';
-import { ReversiChannelService } from './channels/reversi.js';
-import { ReversiGameChannelService } from './channels/reversi-game.js';
-import { type MiChannelService } from './channel.js';
 
 @Injectable()
 export class ChannelsService {
 	constructor(
-		private mainChannelService: MainChannelService,
-		private homeTimelineChannelService: HomeTimelineChannelService,
-		private localTimelineChannelService: LocalTimelineChannelService,
-		private hybridTimelineChannelService: HybridTimelineChannelService,
-		private globalTimelineChannelService: GlobalTimelineChannelService,
-		private userListChannelService: UserListChannelService,
-		private hashtagChannelService: HashtagChannelService,
-		private roleTimelineChannelService: RoleTimelineChannelService,
-		private antennaChannelService: AntennaChannelService,
-		private channelChannelService: ChannelChannelService,
-		private driveChannelService: DriveChannelService,
-		private serverStatsChannelService: ServerStatsChannelService,
-		private queueStatsChannelService: QueueStatsChannelService,
-		private adminChannelService: AdminChannelService,
-		private chatUserChannelService: ChatUserChannelService,
-		private chatRoomChannelService: ChatRoomChannelService,
-		private reversiChannelService: ReversiChannelService,
-		private reversiGameChannelService: ReversiGameChannelService,
 	) {
 	}
 
 	@bindThis
-	public getChannelService(name: string): MiChannelService<boolean> {
+	public getChannelConstructor(name: string): ChannelConstructor<boolean> {
 		switch (name) {
-			case 'main': return this.mainChannelService;
+			case 'main': return MainChannel;
-			case 'homeTimeline': return this.homeTimelineChannelService;
+			case 'homeTimeline': return HomeTimelineChannel;
-			case 'localTimeline': return this.localTimelineChannelService;
+			case 'localTimeline': return LocalTimelineChannel;
-			case 'hybridTimeline': return this.hybridTimelineChannelService;
+			case 'hybridTimeline': return HybridTimelineChannel;
-			case 'globalTimeline': return this.globalTimelineChannelService;
+			case 'globalTimeline': return GlobalTimelineChannel;
-			case 'userList': return this.userListChannelService;
+			case 'userList': return UserListChannel;
-			case 'hashtag': return this.hashtagChannelService;
+			case 'hashtag': return HashtagChannel;
-			case 'roleTimeline': return this.roleTimelineChannelService;
+			case 'roleTimeline': return RoleTimelineChannel;
-			case 'antenna': return this.antennaChannelService;
+			case 'antenna': return AntennaChannel;
-			case 'channel': return this.channelChannelService;
+			case 'channel': return ChannelChannel;
-			case 'drive': return this.driveChannelService;
+			case 'drive': return DriveChannel;
-			case 'serverStats': return this.serverStatsChannelService;
+			case 'serverStats': return ServerStatsChannel;
-			case 'queueStats': return this.queueStatsChannelService;
+			case 'queueStats': return QueueStatsChannel;
-			case 'admin': return this.adminChannelService;
+			case 'admin': return AdminChannel;
-			case 'chatUser': return this.chatUserChannelService;
+			case 'chatUser': return ChatUserChannel;
-			case 'chatRoom': return this.chatRoomChannelService;
+			case 'chatRoom': return ChatRoomChannel;
-			case 'reversi': return this.reversiChannelService;
+			case 'reversi': return ReversiChannel;
-			case 'reversiGame': return this.reversiGameChannelService;
+			case 'reversiGame': return ReversiGameChannel;
 
 			default:
 				throw new Error(`no such channel: ${name}`);

packages/backend/src/server/api/stream/Connection.ts

@@ -6,19 +6,39 @@
 import * as WebSocket from 'ws';
 import type { MiUser } from '@/models/User.js';
 import type { MiAccessToken } from '@/models/AccessToken.js';
-import type { Packed } from '@/misc/json-schema.js';
+import { NotificationService } from '@/core/NotificationService.js';
-import type { NotificationService } from '@/core/NotificationService.js';
 import { bindThis } from '@/decorators.js';
 import { CacheService } from '@/core/CacheService.js';
 import { MiFollowing, MiUserProfile } from '@/models/_.js';
 import type { GlobalEvents, StreamEventEmitter } from '@/core/GlobalEventService.js';
 import { ChannelFollowingService } from '@/core/ChannelFollowingService.js';
 import { ChannelMutingService } from '@/core/ChannelMutingService.js';
-import { isJsonObject } from '@/misc/json-value.js';
 import type { JsonObject, JsonValue } from '@/misc/json-value.js';
-import type { ChannelsService } from './ChannelsService.js';
+import { isJsonObject } from '@/misc/json-value.js';
 import type { EventEmitter } from 'events';
 import type Channel from './channel.js';
+import type { ChannelConstructor } from './channel.js';
+import type { ChannelRequest } from './channel.js';
+import { ContextIdFactory, ModuleRef, REQUEST } from '@nestjs/core';
+import { Inject, Injectable, Scope } from '@nestjs/common';
+import { MainChannel } from '@/server/api/stream/channels/main.js';
+import { HomeTimelineChannel } from '@/server/api/stream/channels/home-timeline.js';
+import { LocalTimelineChannel } from '@/server/api/stream/channels/local-timeline.js';
+import { HybridTimelineChannel } from '@/server/api/stream/channels/hybrid-timeline.js';
+import { GlobalTimelineChannel } from '@/server/api/stream/channels/global-timeline.js';
+import { UserListChannel } from '@/server/api/stream/channels/user-list.js';
+import { HashtagChannel } from '@/server/api/stream/channels/hashtag.js';
+import { RoleTimelineChannel } from '@/server/api/stream/channels/role-timeline.js';
+import { AntennaChannel } from '@/server/api/stream/channels/antenna.js';
+import { ChannelChannel } from '@/server/api/stream/channels/channel.js';
+import { DriveChannel } from '@/server/api/stream/channels/drive.js';
+import { ServerStatsChannel } from '@/server/api/stream/channels/server-stats.js';
+import { QueueStatsChannel } from '@/server/api/stream/channels/queue-stats.js';
+import { AdminChannel } from '@/server/api/stream/channels/admin.js';
+import { ChatUserChannel } from '@/server/api/stream/channels/chat-user.js';
+import { ChatRoomChannel } from '@/server/api/stream/channels/chat-room.js';
+import { ReversiChannel } from '@/server/api/stream/channels/reversi.js';
+import { ReversiGameChannel } from '@/server/api/stream/channels/reversi-game.js';
 
 const MAX_CHANNELS_PER_CONNECTION = 32;
 
@@ -26,6 +46,7 @@ const MAX_CHANNELS_PER_CONNECTION = 32;
  * Main stream connection
  */
 // eslint-disable-next-line import/no-default-export
+@Injectable({ scope: Scope.TRANSIENT })
 export default class Connection {
 	public user?: MiUser;
 	public token?: MiAccessToken;
@@ -44,16 +65,16 @@ export default class Connection {
 	private fetchIntervalId: NodeJS.Timeout | null = null;
 
 	constructor(
-		private channelsService: ChannelsService,
+		private moduleRef: ModuleRef,
 		private notificationService: NotificationService,
 		private cacheService: CacheService,
 		private channelFollowingService: ChannelFollowingService,
 		private channelMutingService: ChannelMutingService,
-		user: MiUser | null | undefined,
+		@Inject(REQUEST)
-		token: MiAccessToken | null | undefined,
+		request: ConnectionRequest,
 	) {
-		if (user) this.user = user;
+		if (request.user) this.user = request.user;
-		if (token) this.token = token;
+		if (request.token) this.token = request.token;
 	}
 
 	@bindThis
@@ -232,28 +253,34 @@ export default class Connection {
 	 * チャンネルに接続
 	 */
 	@bindThis
-	public connectChannel(id: string, params: JsonObject | undefined, channel: string, pong = false) {
+	public async connectChannel(id: string, params: JsonObject | undefined, channel: string, pong = false) {
 		if (this.channels.length >= MAX_CHANNELS_PER_CONNECTION) {
 			return;
 		}
 
-		const channelService = this.channelsService.getChannelService(channel);
+		const channelConstructor = this.getChannelConstructor(channel);
 
-		if (channelService.requireCredential && this.user == null) {
+		if (channelConstructor.requireCredential && this.user == null) {
 			return;
 		}
 
-		if (this.token && ((channelService.kind && !this.token.permission.some(p => p === channelService.kind))
+		if (this.token && ((channelConstructor.kind && !this.token.permission.some(p => p === channelConstructor.kind))
-			|| (!channelService.kind && channelService.requireCredential))) {
+			|| (!channelConstructor.kind && channelConstructor.requireCredential))) {
 			return;
 		}
 
 		// 共有可能チャンネルに接続しようとしていて、かつそのチャンネルに既に接続していたら無意味なので無視
-		if (channelService.shouldShare && this.channels.some(c => c.chName === channel)) {
+		if (channelConstructor.shouldShare && this.channels.some(c => c.chName === channel)) {
 			return;
 		}
 
-		const ch: Channel = channelService.create(id, this);
+		const contextId = ContextIdFactory.create();
+		this.moduleRef.registerRequestByContextId<ChannelRequest>({
+			id: id,
+			connection: this,
+		}, contextId);
+		const ch: Channel = await this.moduleRef.create<Channel>(channelConstructor, contextId);
+
 		this.channels.push(ch);
 		ch.init(params ?? {});
 
@@ -264,6 +291,33 @@ export default class Connection {
 		}
 	}
 
+	@bindThis
+	public getChannelConstructor(name: string): ChannelConstructor<boolean> {
+		switch (name) {
+			case 'main': return MainChannel;
+			case 'homeTimeline': return HomeTimelineChannel;
+			case 'localTimeline': return LocalTimelineChannel;
+			case 'hybridTimeline': return HybridTimelineChannel;
+			case 'globalTimeline': return GlobalTimelineChannel;
+			case 'userList': return UserListChannel;
+			case 'hashtag': return HashtagChannel;
+			case 'roleTimeline': return RoleTimelineChannel;
+			case 'antenna': return AntennaChannel;
+			case 'channel': return ChannelChannel;
+			case 'drive': return DriveChannel;
+			case 'serverStats': return ServerStatsChannel;
+			case 'queueStats': return QueueStatsChannel;
+			case 'admin': return AdminChannel;
+			case 'chatUser': return ChatUserChannel;
+			case 'chatRoom': return ChatRoomChannel;
+			case 'reversi': return ReversiChannel;
+			case 'reversiGame': return ReversiGameChannel;
+
+			default:
+				throw new Error(`no such channel: ${name}`);
+		}
+	}
+
 	/**
 	 * チャンネルから切断
 	 * @param id チャンネルコネクションID
@@ -306,3 +360,8 @@ export default class Connection {
 		}
 	}
 }
+
+export interface ConnectionRequest {
+	user: MiUser | null | undefined,
+	token: MiAccessToken | null | undefined,
+}

packages/backend/src/server/api/stream/channel.ts

@@ -22,7 +22,7 @@ export default abstract class Channel {
 	public abstract readonly chName: string;
 	public static readonly shouldShare: boolean;
 	public static readonly requireCredential: boolean;
-	public static readonly kind?: string | null;
+	public static readonly kind: string | null;
 
 	protected get user() {
 		return this.connection.user;
@@ -85,9 +85,9 @@ export default abstract class Channel {
 		return false;
 	}
 
-	constructor(id: string, connection: Connection) {
+	constructor(request: ChannelRequest) {
-		this.id = id;
+		this.id = request.id;
-		this.connection = connection;
+		this.connection = request.connection;
 	}
 
 	public send(payload: { type: string, body: JsonValue }): void;
@@ -111,9 +111,14 @@ export default abstract class Channel {
 	public onMessage?(type: string, body: JsonValue): void;
 }
 
-export type MiChannelService<T extends boolean> = {
+export interface ChannelRequest {
+	id: string,
+	connection: Connection,
+}
+
+export interface ChannelConstructor<T extends boolean> {
+	new(...args: any[]): Channel;
 	shouldShare: boolean;
 	requireCredential: T;
 	kind: T extends true ? string : string | null | undefined;
-	create: (id: string, connection: Connection) => Channel;
+}
-};

packages/backend/src/server/api/stream/channels/admin.ts

@@ -3,17 +3,26 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
-import { Injectable } from '@nestjs/common';
+import { Inject, Injectable, Scope } from '@nestjs/common';
 import { bindThis } from '@/decorators.js';
 import type { JsonObject } from '@/misc/json-value.js';
-import Channel, { type MiChannelService } from '../channel.js';
+import Channel, { type ChannelRequest } from '../channel.js';
+import { REQUEST } from '@nestjs/core';
 
-class AdminChannel extends Channel {
+@Injectable({ scope: Scope.TRANSIENT })
+export class AdminChannel extends Channel {
 	public readonly chName = 'admin';
 	public static shouldShare = true;
 	public static requireCredential = true as const;
 	public static kind = 'read:admin:stream';
 
+	constructor(
+		@Inject(REQUEST)
+		request: ChannelRequest,
+	) {
+		super(request);
+	}
+
 	@bindThis
 	public async init(params: JsonObject) {
 		// Subscribe admin stream
@@ -22,22 +31,3 @@ class AdminChannel extends Channel {
 		});
 	}
 }
-
-@Injectable()
-export class AdminChannelService implements MiChannelService<true> {
-	public readonly shouldShare = AdminChannel.shouldShare;
-	public readonly requireCredential = AdminChannel.requireCredential;
-	public readonly kind = AdminChannel.kind;
-
-	constructor(
-	) {
-	}
-
-	@bindThis
-	public create(id: string, connection: Channel['connection']): AdminChannel {
-		return new AdminChannel(
-			id,
-			connection,
-		);
-	}
-}

packages/backend/src/server/api/stream/channels/antenna.ts

@@ -3,14 +3,16 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
-import { Injectable } from '@nestjs/common';
+import { Inject, Injectable, Scope } from '@nestjs/common';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
 import type { GlobalEvents } from '@/core/GlobalEventService.js';
 import type { JsonObject } from '@/misc/json-value.js';
-import Channel, { type MiChannelService } from '../channel.js';
+import Channel, { type ChannelRequest } from '../channel.js';
+import { REQUEST } from '@nestjs/core';
 
-class AntennaChannel extends Channel {
+@Injectable({ scope: Scope.TRANSIENT })
+export class AntennaChannel extends Channel {
 	public readonly chName = 'antenna';
 	public static shouldShare = false;
 	public static requireCredential = true as const;
@@ -18,12 +20,12 @@ class AntennaChannel extends Channel {
 	private antennaId: string;
 
 	constructor(
-		private noteEntityService: NoteEntityService,
+		@Inject(REQUEST)
+		request: ChannelRequest,
 
-		id: string,
+		private noteEntityService: NoteEntityService,
-		connection: Channel['connection'],
 	) {
-		super(id, connection);
+		super(request);
 		//this.onEvent = this.onEvent.bind(this);
 	}
 
@@ -55,24 +57,3 @@ class AntennaChannel extends Channel {
 		this.subscriber.off(`antennaStream:${this.antennaId}`, this.onEvent);
 	}
 }
-
-@Injectable()
-export class AntennaChannelService implements MiChannelService<true> {
-	public readonly shouldShare = AntennaChannel.shouldShare;
-	public readonly requireCredential = AntennaChannel.requireCredential;
-	public readonly kind = AntennaChannel.kind;
-
-	constructor(
-		private noteEntityService: NoteEntityService,
-	) {
-	}
-
-	@bindThis
-	public create(id: string, connection: Channel['connection']): AntennaChannel {
-		return new AntennaChannel(
-			this.noteEntityService,
-			id,
-			connection,
-		);
-	}
-}

packages/backend/src/server/api/stream/channels/channel.ts

@@ -3,7 +3,7 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
-import { Injectable } from '@nestjs/common';
+import { Inject, Injectable, Scope } from '@nestjs/common';
 import type { Packed } from '@/misc/json-schema.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
@@ -11,20 +11,23 @@ import { isRenotePacked, isQuotePacked } from '@/misc/is-renote.js';
 import { isInstanceMuted } from '@/misc/is-instance-muted.js';
 import { isUserRelated } from '@/misc/is-user-related.js';
 import type { JsonObject } from '@/misc/json-value.js';
-import Channel, { type MiChannelService } from '../channel.js';
+import Channel, { type ChannelRequest } from '../channel.js';
+import { REQUEST } from '@nestjs/core';
 
-class ChannelChannel extends Channel {
+@Injectable({ scope: Scope.TRANSIENT })
+export class ChannelChannel extends Channel {
 	public readonly chName = 'channel';
 	public static shouldShare = false;
 	public static requireCredential = false as const;
 	private channelId: string;
 
 	constructor(
+		@Inject(REQUEST)
+		request: ChannelRequest,
+
 		private noteEntityService: NoteEntityService,
-		id: string,
-		connection: Channel['connection'],
 	) {
-		super(id, connection);
+		super(request);
 		//this.onNote = this.onNote.bind(this);
 	}
 
@@ -92,24 +95,3 @@ class ChannelChannel extends Channel {
 		this.subscriber.off('notesStream', this.onNote);
 	}
 }
-
-@Injectable()
-export class ChannelChannelService implements MiChannelService<false> {
-	public readonly shouldShare = ChannelChannel.shouldShare;
-	public readonly requireCredential = ChannelChannel.requireCredential;
-	public readonly kind = ChannelChannel.kind;
-
-	constructor(
-		private noteEntityService: NoteEntityService,
-	) {
-	}
-
-	@bindThis
-	public create(id: string, connection: Channel['connection']): ChannelChannel {
-		return new ChannelChannel(
-			this.noteEntityService,
-			id,
-			connection,
-		);
-	}
-}

packages/backend/src/server/api/stream/channels/chat-room.ts

@@ -3,14 +3,16 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
-import { Injectable } from '@nestjs/common';
+import { Inject, Injectable, Scope } from '@nestjs/common';
 import { bindThis } from '@/decorators.js';
 import type { GlobalEvents } from '@/core/GlobalEventService.js';
 import type { JsonObject } from '@/misc/json-value.js';
 import { ChatService } from '@/core/ChatService.js';
-import Channel, { type MiChannelService } from '../channel.js';
+import Channel, { type ChannelRequest } from '../channel.js';
+import { REQUEST } from '@nestjs/core';
 
-class ChatRoomChannel extends Channel {
+@Injectable({ scope: Scope.TRANSIENT })
+export class ChatRoomChannel extends Channel {
 	public readonly chName = 'chatRoom';
 	public static shouldShare = false;
 	public static requireCredential = true as const;
@@ -18,12 +20,12 @@ class ChatRoomChannel extends Channel {
 	private roomId: string;
 
 	constructor(
-		private chatService: ChatService,
+		@Inject(REQUEST)
+		request: ChannelRequest,
 
-		id: string,
+		private chatService: ChatService,
-		connection: Channel['connection'],
 	) {
-		super(id, connection);
+		super(request);
 	}
 
 	@bindThis
@@ -55,24 +57,3 @@ class ChatRoomChannel extends Channel {
 		this.subscriber.off(`chatRoomStream:${this.roomId}`, this.onEvent);
 	}
 }
-
-@Injectable()
-export class ChatRoomChannelService implements MiChannelService<true> {
-	public readonly shouldShare = ChatRoomChannel.shouldShare;
-	public readonly requireCredential = ChatRoomChannel.requireCredential;
-	public readonly kind = ChatRoomChannel.kind;
-
-	constructor(
-		private chatService: ChatService,
-	) {
-	}
-
-	@bindThis
-	public create(id: string, connection: Channel['connection']): ChatRoomChannel {
-		return new ChatRoomChannel(
-			this.chatService,
-			id,
-			connection,
-		);
-	}
-}