Merge remote-tracking branch 'refs/remotes/misskey-dev/develop' into develop

# Conflicts:
#	CHANGELOG.md
#	package.json
#	packages/frontend/package.json

Author: mattyatea

.claude/skills/add-i18n-key/SKILL.md

@@ -26,7 +26,9 @@ _settings:
   general: "全般"
   appearance: "外観"
 
-# パラメータ付き (ICU MessageFormat 互換)
+# パラメータ付き (単純なプレースホルダ置換)
+# ICU MessageFormat の plural / select / number / date などは非対応
+# 使えるのは `{name}` のような単純な置換のみ
 greeting: "こんにちは、{name}さん"
 ```
 

.npmrc

@@ -1,12 +1,28 @@
 ## Unreleased
 
 ### General
+-
 
 ### Client
-- Enhance: デッキでハッシュタグタイムラインを登録できるように
-- Fix: チャンネルの共同管理者情報が不正な形式の場合にチャンネルページが開けない問題を修正
+-
 
 ### Server
+- Enhance: リモートノートクリーニングジョブのスキップ処理のパフォーマンス改善
+
+
+## 2026.5.4
+
+### General
+- セキュリティに関する修正
+
+### Client
+- Fix: ビルドに失敗することがある問題を修正
+
+
+## 2026.5.3
+
+### General
+- Fix: Dockerで起動に失敗する問題を修正
 
 
 ## 2026.5.2
@@ -19,7 +35,8 @@
 ### General
 - Enhance: Unicode 17.0 に収録されている絵文字の処理・表示に対応
   - Fluent Emojiや端末ネイティブの絵文字を利用している場合は、最新の絵文字に対応しておらず正しく表示できない可能性があります。絵文字が表示できない場合は、表示に使用する絵文字をTwemojiに切り替えてご利用ください。
-- 投稿通知設定したユーザーをリストで見ることができるように
+- Enhance: 投稿通知設定したユーザーをリストで見ることができるように
+- 依存関係の更新
 
 ### Client
 - Enhance: テーマのプレビュー時、リロードせずにもとのテーマに戻せるように
@@ -30,6 +47,8 @@
 - Fix: リスト編集画面におけるユーザー追加時のユーザー選択ダイアログにおいて、自身のアカウントが検索結果の一覧に表示されない問題を修正
 - Fix: デッキのカラムから開いたアンテナ・リストの編集ウィンドウを、"ポップアウト"、"新しいタブで表示"、"リンクをコピー"した場合に誤ったリンクが与えられる問題を修正
 - Fix: チャンネルの作成ロールポリシーにて、ヘッダーにロールポリシーの値が表示されない問題を修正
+- Enhance: デッキでハッシュタグタイムラインを登録できるように
+- Fix: チャンネルの共同管理者情報が不正な形式の場合にチャンネルページが開けない問題を修正
 
 ### Server
 - Enhance: RSA 署名処理のオフロード

CHANGELOG.md

@@ -189,6 +189,14 @@ pnpm migrate
 
 After finishing the migration, you can proceed.
 
+#### Cloudflare tunnel
+Cloudflare tunnelを使うとローカルのMisskeyサーバーをインターネットに公開できます。
+HTTPSでしか動作しない機能を検証したい時や、スマホなど別のデバイスからローカルのMisskeyサーバーを検証したい時に便利です。
+
+##### Cloudflare warpと併用する際のtips
+
+> cloudflared (Cloudflare Tunnel) は region1.v2.argotunnel.com / region2.v2.argotunnel.com に QUIC/HTTP2 でアウトバウンド接続するのですが、WARP を有効化するとこのトラフィックが WARP 経由になってループ/切断します。これら 2 ホストを WARP のトンネル除外（split tunnel）に追加することで、cloudflared だけは WARP をバイパスして直接 Cloudflare エッジへ接続できるようになります。
+
 ### Start developing
 During development, it is useful to use the
 ```

CONTRIBUTING.md

@@ -74,6 +74,8 @@ FROM --platform=$TARGETPLATFORM node:${NODE_VERSION}-slim AS runner
 ARG UID="991"
 ARG GID="991"
 
+ENV PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false
+
 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends \
 	ffmpeg tini curl libjemalloc-dev libjemalloc2 \

Dockerfile

@@ -1,12 +1,12 @@
 {
 	"name": "misskey",
-	"version": "2026.5.2-alpha.0-tp.0",
+	"version": "2026.5.4-tp.0",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/type4ny-project/misskey.git"
 	},
-	"packageManager": "pnpm@10.33.2",
+	"packageManager": "pnpm@11.1.2",
 	"workspaces": [
 		"packages/misskey-js",
 		"packages/i18n",
@@ -58,45 +58,34 @@
 		"cleanall": "pnpm clean-all"
 	},
 	"dependencies": {
-		"cssnano": "7.1.7",
+		"cssnano": "8.0.1",
 		"esbuild": "0.28.0",
 		"execa": "9.6.1",
 		"ignore-walk": "8.0.0",
 		"js-yaml": "4.1.1",
 		"portless": "0.12.0",
-		"postcss": "8.5.10",
-		"tar": "7.5.13",
-		"terser": "5.46.2"
+		"postcss": "8.5.14",
+		"tar": "7.5.15",
+		"terser": "5.47.1"
 	},
 	"devDependencies": {
 		"@eslint/js": "9.39.4",
 		"@misskey-dev/eslint-plugin": "2.1.0",
 		"@types/js-yaml": "4.0.9",
-		"@types/node": "24.12.2",
-		"@typescript-eslint/eslint-plugin": "8.59.0",
-		"@typescript-eslint/parser": "8.59.0",
+		"@types/node": "24.12.4",
+		"@typescript-eslint/eslint-plugin": "8.59.3",
+		"@typescript-eslint/parser": "8.59.3",
 		"@typescript/native-preview": "7.0.0-dev.20260426.1",
 		"cross-env": "10.1.0",
-		"cypress": "15.14.1",
+		"cypress": "15.15.0",
 		"eslint": "9.39.4",
-		"globals": "17.5.0",
+		"globals": "17.6.0",
 		"ncp": "2.0.0",
-		"pnpm": "10.33.2",
-		"start-server-and-test": "3.0.2",
+		"pnpm": "11.1.2",
+		"start-server-and-test": "3.0.5",
 		"typescript": "5.9.3"
 	},
 	"optionalDependencies": {
 		"@tensorflow/tfjs-core": "4.22.0"
-	},
-	"pnpm": {
-		"overrides": {
-			"@aiscript-dev/aiscript-languageserver": "-",
-			"chokidar": "5.0.0",
-			"lodash": "4.18.1"
-		},
-		"ignoredBuiltDependencies": [
-			"@sentry-internal/node-cpu-profiler",
-			"exifreader"
-		]
 	}
 }

package.json

@@ -54,8 +54,8 @@
 		"utf-8-validate": "6.0.6"
 	},
 	"dependencies": {
-		"@aws-sdk/client-s3": "3.1037.0",
-		"@aws-sdk/lib-storage": "3.1037.0",
+		"@aws-sdk/client-s3": "3.1047.0",
+		"@aws-sdk/lib-storage": "3.1047.0",
 		"@fastify/accepts": "5.0.4",
 		"@fastify/cors": "11.2.0",
 		"@fastify/express": "4.0.5",
@@ -67,25 +67,25 @@
 		"@misskey-dev/emoji-data": "17.0.3",
 		"@misskey-dev/sharp-read-bmp": "1.2.0",
 		"@misskey-dev/summaly": "5.3.0",
-		"@napi-rs/canvas": "0.1.100",
-		"@nestjs/common": "11.1.19",
-		"@nestjs/core": "11.1.19",
-		"@nestjs/testing": "11.1.19",
-		"@oxc-project/runtime": "0.127.0",
+		"@napi-rs/canvas": "1.0.0",
+		"@nestjs/common": "11.1.21",
+		"@nestjs/core": "11.1.21",
+		"@nestjs/testing": "11.1.21",
+		"@oxc-project/runtime": "0.130.0",
 		"@peertube/http-signature": "1.7.0",
-		"@sentry/node": "10.50.0",
-		"@sentry/profiling-node": "10.50.0",
+		"@sentry/node": "10.53.1",
+		"@sentry/profiling-node": "10.53.1",
 		"@simplewebauthn/server": "13.3.0",
-		"@sinonjs/fake-timers": "15.3.2",
-		"@smithy/node-http-handler": "4.6.1",
+		"@sinonjs/fake-timers": "15.4.0",
+		"@smithy/node-http-handler": "4.7.2",
 		"accepts": "1.3.8",
 		"ajv": "8.20.0",
 		"archiver": "7.0.1",
 		"async-mutex": "0.5.0",
 		"bcryptjs": "3.0.3",
 		"blurhash": "2.0.5",
 		"body-parser": "2.2.2",
-		"bullmq": "5.76.2",
+		"bullmq": "5.76.8",
 		"cacheable-lookup": "7.0.0",
 		"chalk": "5.6.2",
 		"chalk-template": "1.1.2",
@@ -100,68 +100,68 @@
 		"file-type": "22.0.1",
 		"fluent-ffmpeg": "2.1.3",
 		"form-data": "4.0.5",
-		"got": "15.0.3",
+		"got": "15.0.5",
 		"hpagent": "1.2.0",
 		"http-link-header": "1.1.3",
 		"i18n": "workspace:*",
 		"ioredis": "5.10.1",
 		"ip-cidr": "4.0.2",
-		"ipaddr.js": "2.3.0",
+		"ipaddr.js": "2.4.0",
 		"is-svg": "6.1.0",
 		"json5": "2.2.3",
 		"jsonld": "9.0.0",
 		"juice": "11.1.1",
-		"meilisearch": "0.57.0",
+		"meilisearch": "0.58.0",
 		"mfm-js": "0.26.0",
 		"mime-types": "3.0.2",
 		"misskey-js": "workspace:*",
 		"misskey-reversi": "workspace:*",
 		"ms": "3.0.0-canary.202508261828",
-		"nanoid": "5.1.9",
+		"nanoid": "5.1.11",
 		"nested-property": "4.0.0",
 		"node-fetch": "3.3.2",
 		"node-html-parser": "7.1.0",
-		"nodemailer": "8.0.6",
+		"nodemailer": "8.0.7",
 		"nsfwjs": "4.3.0",
 		"oauth2orize": "1.12.0",
 		"oauth2orize-pkce": "0.1.2",
 		"os-utils": "0.0.14",
 		"otpauth": "9.5.1",
 		"pg": "8.20.0",
 		"pkce-challenge": "6.0.0",
-		"probe-image-size": "7.2.3",
+		"probe-image-size": "7.3.0",
 		"promise-limit": "2.7.0",
 		"qrcode": "1.5.4",
 		"random-seed": "0.3.0",
 		"ratelimiter": "3.4.1",
-		"re2": "1.24.0",
+		"re2": "1.24.1",
 		"reflect-metadata": "0.2.2",
 		"rename": "1.0.4",
 		"rss-parser": "3.13.0",
 		"rxjs": "7.8.2",
-		"sanitize-html": "2.17.3",
+		"sanitize-html": "2.17.4",
 		"secure-json-parse": "4.1.0",
-		"semver": "7.7.4",
+		"semver": "7.8.0",
 		"sharp": "0.33.5",
 		"slacc": "0.1.5",
 		"strict-event-emitter-types": "2.0.0",
 		"stringz": "2.1.0",
-		"systeminformation": "5.31.5",
+		"systeminformation": "5.31.6",
 		"tinycolor2": "1.6.0",
 		"tmp": "0.2.5",
-		"tsc-alias": "1.8.16",
-		"typeorm": "0.3.28",
+		"tsc-alias": "1.8.17",
+		"typeorm": "0.3.30",
 		"ulid": "3.0.2",
 		"vary": "1.1.2",
 		"web-push": "3.6.7",
-		"ws": "8.20.0",
+		"ws": "8.20.1",
 		"xev": "3.0.2"
 	},
 	"devDependencies": {
 		"@kitajs/ts-html-plugin": "4.1.4",
-		"@nestjs/platform-express": "11.1.19",
+		"@nestjs/platform-express": "11.1.21",
 		"@rollup/plugin-esm-shim": "0.1.8",
-		"@sentry/vue": "10.50.0",
+		"@sentry/vue": "10.53.1",
 		"@types/accepts": "1.3.7",
 		"@types/archiver": "7.0.0",
 		"@types/body-parser": "1.19.6",
@@ -173,7 +173,7 @@
 		"@types/jsonld": "1.5.15",
 		"@types/mime-types": "3.0.1",
 		"@types/ms": "2.1.0",
-		"@types/node": "24.12.2",
+		"@types/node": "24.12.4",
 		"@types/nodemailer": "8.0.0",
 		"@types/oauth2orize": "1.11.5",
 		"@types/oauth2orize-pkce": "0.1.2",
@@ -192,9 +192,9 @@
 		"@types/vary": "1.1.3",
 		"@types/web-push": "3.6.4",
 		"@types/ws": "8.18.1",
-		"@typescript-eslint/eslint-plugin": "8.59.0",
-		"@typescript-eslint/parser": "8.59.0",
-		"@vitest/coverage-v8": "4.1.5",
+		"@typescript-eslint/eslint-plugin": "8.59.3",
+		"@typescript-eslint/parser": "8.59.3",
+		"@vitest/coverage-v8": "4.1.6",
 		"aws-sdk-client-mock": "4.1.0",
 		"cbor": "10.0.12",
 		"cross-env": "10.1.0",
@@ -203,11 +203,11 @@
 		"fkill": "10.0.3",
 		"js-yaml": "4.1.1",
 		"pid-port": "2.1.1",
-		"rolldown": "1.0.0-rc.15",
+		"rolldown": "1.0.1",
 		"simple-oauth2": "5.1.0",
 		"supertest": "7.2.2",
-		"vite": "8.0.10",
-		"vitest": "4.1.5",
+		"vite": "8.0.13",
+		"vitest": "4.1.6",
 		"vitest-mock-extended": "4.0.0"
 	}
 }

packages/backend/package.json

@@ -182,11 +182,12 @@ export class AnnouncementService {
 	@bindThis
 	public async getAnnouncement(announcementId: MiAnnouncement['id'], me: MiUser | null): Promise<Packed<'Announcement'>> {
 		const announcement = await this.announcementsRepository.findOneByOrFail({ id: announcementId });
-		if (me) {
-			if (announcement.userId && announcement.userId !== me.id) {
-				throw new EntityNotFoundError(this.announcementsRepository.metadata.target, { id: announcementId });
-			}
 
+		if (announcement.userId && (me == null || announcement.userId !== me.id)) {
+			throw new EntityNotFoundError(this.announcementsRepository.metadata.target, { id: announcementId });
+		}
+
+		if (me) {
 			const read = await this.announcementReadsRepository.findOneBy({
 				announcementId: announcement.id,
 				userId: me.id,

packages/backend/src/core/AnnouncementService.ts

@@ -572,6 +572,27 @@ export class ChatService {
 		return created;
 	}
 
+	@bindThis
+	public async hasPermissionToViewRoomInfo(meId: MiUser['id'], room: MiChatRoom) {
+		if (room.ownerId === meId) {
+			return true;
+		}
+
+		if (await this.isRoomMember(room, meId)) {
+			return true;
+		}
+
+		if (await this.chatRoomInvitationsRepository.findOneBy({ roomId: room.id, userId: meId })) {
+			return true;
+		}
+
+		if (await this.roleService.isModerator({ id: meId })) {
+			return true;
+		}
+
+		return false;
+	}
+
 	@bindThis
 	public async hasPermissionToDeleteRoom(meId: MiUser['id'], room: MiChatRoom) {
 		if (room.ownerId === meId) {