Merge remote-tracking branch 'upstream/main' into migration-runner

2024-12-23 11:21:32 +00:00 · 2024-08-21 14:19:06 -07:00 · 2024-08-21 14:19:06 -07:00 · ecb700ec6e
commit ecb700ec6e
parent 84b161ddd6 bd1b7aa6ef
74 changed files with 1458 additions and 766 deletions
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@ -2,9 +2,14 @@
 # See https://github.com/woodpecker-ci/woodpecker/issues/1677

 variables:
-  - &rust_image "rust:1.78"
+  - &rust_image "rust:1.80"
  - &rust_nightly_image "rustlang/rust:nightly"
  - &install_pnpm "corepack enable pnpm"
+  - &install_binstall "wget -O- https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz | tar -xvz -C /usr/local/cargo/bin"
+  - install_diesel_cli: &install_diesel_cli
+      - apt-get update && apt-get install -y postgresql-client
+      - cargo install diesel_cli --no-default-features --features postgres
+      - export PATH="$CARGO_HOME/bin:$PATH"
  - &slow_check_paths
    - event: pull_request
      path:
@ -25,17 +30,6 @@ variables:
            "diesel.toml",
            ".gitmodules",
          ]
-  - install_binstall: &install_binstall
-      - wget https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz
-      - tar -xvf cargo-binstall-x86_64-unknown-linux-musl.tgz
-      - cp cargo-binstall /usr/local/cargo/bin
-  - install_diesel_cli: &install_diesel_cli
-      - apt update && apt install -y lsb-release build-essential
-      - sh -c 'echo "deb https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
-      - wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
-      - apt update && apt install -y postgresql-client-16
-      - cargo install diesel_cli --no-default-features --features postgres
-      - export PATH="$CARGO_HOME/bin:$PATH"

 steps:
  prepare_repo:
@ -82,7 +76,7 @@ steps:
  cargo_machete:
    image: *rust_nightly_image
    commands:
-      - <<: *install_binstall
+      - *install_binstall
      - cargo binstall -y cargo-machete
      - cargo machete
    when:
@ -214,7 +208,7 @@ steps:
      DO_WRITE_HOSTS_FILE: "1"
    commands:
      - *install_pnpm
-      - apt update && apt install -y bash curl postgresql-client
+      - apt-get update && apt-get install -y bash curl postgresql-client
      - bash api_tests/prepare-drone-federation-test.sh
      - cd api_tests/
      - pnpm i
@ -261,7 +255,7 @@ steps:
  publish_to_crates_io:
    image: *rust_image
    commands:
-      - <<: *install_binstall
+      - *install_binstall
      # Install cargo-workspaces
      - cargo binstall -y cargo-workspaces
      - cp -r migrations crates/db_schema/
@ -289,7 +283,8 @@ steps:

 services:
  database:
-    image: pgautoupgrade/pgautoupgrade:16-alpine
+    # 15-alpine image necessary because of diesel tests
+    image: pgautoupgrade/pgautoupgrade:15-alpine
    environment:
      POSTGRES_DB: lemmy
      POSTGRES_USER: postgres
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@ -1,5 +1,5 @@
 [workspace.package]
-version = "0.19.5"
+version = "0.19.6-beta.6"
 edition = "2021"
 description = "A link aggregator for the fediverse"
 license = "AGPL-3.0"
@ -86,28 +86,29 @@ suspicious = { level = "deny", priority = -1 }
 uninlined_format_args = "allow"
 unused_self = "deny"
 unwrap_used = "deny"
+unimplemented = "deny"

 [workspace.dependencies]
-lemmy_api = { version = "=0.19.5", path = "./crates/api" }
-lemmy_api_crud = { version = "=0.19.5", path = "./crates/api_crud" }
-lemmy_apub = { version = "=0.19.5", path = "./crates/apub" }
-lemmy_utils = { version = "=0.19.5", path = "./crates/utils", default-features = false }
-lemmy_db_schema = { version = "=0.19.5", path = "./crates/db_schema" }
-lemmy_api_common = { version = "=0.19.5", path = "./crates/api_common" }
-lemmy_routes = { version = "=0.19.5", path = "./crates/routes" }
-lemmy_db_views = { version = "=0.19.5", path = "./crates/db_views" }
-lemmy_db_views_actor = { version = "=0.19.5", path = "./crates/db_views_actor" }
-lemmy_db_views_moderator = { version = "=0.19.5", path = "./crates/db_views_moderator" }
-lemmy_federate = { version = "=0.19.5", path = "./crates/federate" }
+lemmy_api = { version = "=0.19.6-beta.6", path = "./crates/api" }
+lemmy_api_crud = { version = "=0.19.6-beta.6", path = "./crates/api_crud" }
+lemmy_apub = { version = "=0.19.6-beta.6", path = "./crates/apub" }
+lemmy_utils = { version = "=0.19.6-beta.6", path = "./crates/utils", default-features = false }
+lemmy_db_schema = { version = "=0.19.6-beta.6", path = "./crates/db_schema" }
+lemmy_api_common = { version = "=0.19.6-beta.6", path = "./crates/api_common" }
+lemmy_routes = { version = "=0.19.6-beta.6", path = "./crates/routes" }
+lemmy_db_views = { version = "=0.19.6-beta.6", path = "./crates/db_views" }
+lemmy_db_views_actor = { version = "=0.19.6-beta.6", path = "./crates/db_views_actor" }
+lemmy_db_views_moderator = { version = "=0.19.6-beta.6", path = "./crates/db_views_moderator" }
+lemmy_federate = { version = "=0.19.6-beta.6", path = "./crates/federate" }
 activitypub_federation = { version = "0.5.8", default-features = false, features = [
  "actix-web",
 ] }
 diesel = "2.1.6"
 diesel_migrations = "2.1.0"
 diesel-async = "0.4.1"
-serde = { version = "1.0.203", features = ["derive"] }
-serde_with = "3.8.1"
-actix-web = { version = "4.6.0", default-features = false, features = [
+serde = { version = "1.0.204", features = ["derive"] }
+serde_with = "3.9.0"
+actix-web = { version = "4.8.0", default-features = false, features = [
  "macros",
  "rustls-0_23",
  "compress-brotli",
@ -120,7 +121,7 @@ tracing-actix-web = { version = "0.7.11", default-features = false }
 tracing-error = "0.2.0"
 tracing-log = "0.2.0"
 tracing-subscriber = { version = "0.3.18", features = ["env-filter"] }
-url = { version = "2.5.0", features = ["serde"] }
+url = { version = "2.5.2", features = ["serde"] }
 reqwest = { version = "0.11.27", default-features = false, features = [
  "json",
  "blocking",
@ -133,20 +134,19 @@ clokwerk = "0.4.0"
 doku = { version = "0.21.1", features = ["url-2"] }
 bcrypt = "0.15.1"
 chrono = { version = "0.4.38", features = ["serde"], default-features = false }
-serde_json = { version = "1.0.117", features = ["preserve_order"] }
+serde_json = { version = "1.0.121", features = ["preserve_order"] }
 base64 = "0.22.1"
-uuid = { version = "1.8.0", features = ["serde", "v4"] }
-async-trait = "0.1.80"
+uuid = { version = "1.10.0", features = ["serde", "v4"] }
+async-trait = "0.1.81"
 captcha = "0.0.9"
 anyhow = { version = "1.0.86", features = [
  "backtrace",
 ] } # backtrace is on by default on nightly, but not stable rust
 diesel_ltree = "0.3.1"
-typed-builder = "0.18.2"
+typed-builder = "0.19.1"
 serial_test = "3.1.1"
-tokio = { version = "1.38.0", features = ["full"] }
-regex = "1.10.4"
-once_cell = "1.19.0"
+tokio = { version = "1.39.2", features = ["full"] }
+regex = "1.10.5"
 diesel-derive-newtype = "2.1.2"
 diesel-derive-enum = { version = "2.1.0", features = ["postgres"] }
 strum = { version = "0.26.3", features = ["derive"] }
@ -161,15 +161,15 @@ ts-rs = { version = "7.1.1", features = [
  "chrono-impl",
  "no-serde-warnings",
 ] }
-rustls = { version = "0.23.9", features = ["ring"] }
+rustls = { version = "0.23.12", features = ["ring"] }
 futures-util = "0.3.30"
-tokio-postgres = "0.7.10"
+tokio-postgres = "0.7.11"
 tokio-postgres-rustls = "0.12.0"
 urlencoding = "2.1.3"
 enum-map = "2.7"
-moka = { version = "0.12.7", features = ["future"] }
+moka = { version = "0.12.8", features = ["future"] }
 i-love-jesus = { version = "0.1.0" }
-clap = { version = "4.5.6", features = ["derive", "env"] }
+clap = { version = "4.5.13", features = ["derive", "env"] }
 pretty_assertions = "1.4.0"
 derive-new = "0.6.0"

@ -199,9 +199,9 @@ clokwerk = { workspace = true }
 serde_json = { workspace = true }
 tracing-opentelemetry = { workspace = true, optional = true }
 opentelemetry = { workspace = true, optional = true }
-console-subscriber = { version = "0.3.0", optional = true }
+console-subscriber = { version = "0.4.0", optional = true }
 opentelemetry-otlp = { version = "0.12.0", optional = true }
-pict-rs = { version = "0.5.15", optional = true }
+pict-rs = { version = "0.5.16", optional = true }
 rustls = { workspace = true }
 tokio.workspace = true
 actix-cors = "0.7.0"
--- a/api_tests/package.json
+++ b/api_tests/package.json
@ -6,7 +6,7 @@
  "repository": "https://github.com/LemmyNet/lemmy",
  "author": "Dessalines",
  "license": "AGPL-3.0",
-  "packageManager": "pnpm@9.4.0",
+  "packageManager": "pnpm@9.6.0",
  "scripts": {
    "lint": "tsc --noEmit && eslint --report-unused-disable-directives && prettier --check 'src/**/*.ts'",
    "fix": "prettier --write src && eslint --fix src",
@ -21,17 +21,16 @@
  },
  "devDependencies": {
    "@types/jest": "^29.5.12",
-    "@types/node": "^20.12.4",
-    "@typescript-eslint/eslint-plugin": "^7.5.0",
-    "@typescript-eslint/parser": "^7.5.0",
-    "download-file-sync": "^1.0.4",
-    "eslint": "^9.0.0",
+    "@types/node": "^22.0.2",
+    "@typescript-eslint/eslint-plugin": "^8.0.0",
+    "@typescript-eslint/parser": "^8.0.0",
+    "eslint": "^9.8.0",
    "eslint-plugin-prettier": "^5.1.3",
    "jest": "^29.5.0",
    "lemmy-js-client": "0.19.5-alpha.1",
    "prettier": "^3.2.5",
    "ts-jest": "^29.1.0",
-    "typescript": "^5.4.4",
-    "typescript-eslint": "^7.13.0"
+    "typescript": "^5.5.4",
+    "typescript-eslint": "^8.0.0"
  }
 }
--- a/api_tests/pnpm-lock.yaml
+++ b/api_tests/pnpm-lock.yaml
--- a/api_tests/src/community.spec.ts
+++ b/api_tests/src/community.spec.ts
@ -1,5 +1,6 @@
 jest.setTimeout(120000);

+import { AddModToCommunity } from "lemmy-js-client/dist/types/AddModToCommunity";
 import { CommunityView } from "lemmy-js-client/dist/types/CommunityView";
 import {
  alpha,
@ -9,6 +10,7 @@ import {
  resolveCommunity,
  createCommunity,
  deleteCommunity,
+  delay,
  removeCommunity,
  getCommunity,
  followCommunity,
@ -533,3 +535,41 @@ test("Content in local-only community doesn't federate", async () => {
    Error("couldnt_find_object"),
  );
 });
+
+test("Remote mods can edit communities", async () => {
+  let communityRes = await createCommunity(alpha);
+
+  let betaCommunity = await resolveCommunity(
+    beta,
+    communityRes.community_view.community.actor_id,
+  );
+  if (!betaCommunity.community) {
+    throw "Missing beta community";
+  }
+  let betaOnAlpha = await resolvePerson(alpha, "lemmy_beta@lemmy-beta:8551");
+
+  let form: AddModToCommunity = {
+    community_id: communityRes.community_view.community.id,
+    person_id: betaOnAlpha.person?.person.id as number,
+    added: true,
+  };
+  alpha.addModToCommunity(form);
+
+  let form2: EditCommunity = {
+    community_id: betaCommunity.community?.community.id as number,
+    description: "Example description",
+  };
+
+  await editCommunity(beta, form2);
+  // give alpha time to get and process the edit
+  await delay(1000);
+
+  let alphaCommunity = await getCommunity(
+    alpha,
+    communityRes.community_view.community.id,
+  );
+
+  await expect(alphaCommunity.community_view.community.description).toBe(
+    "Example description",
+  );
+});
--- a/api_tests/src/image.spec.ts
+++ b/api_tests/src/image.spec.ts
@ -33,7 +33,6 @@ import {
  sampleImage,
  sampleSite,
 } from "./shared";
-const downloadFileSync = require("download-file-sync");

 beforeAll(setupLogins);

@ -57,7 +56,8 @@ test("Upload image and delete it", async () => {
  expect(upload.delete_url).toBeDefined();

  // ensure that image download is working. theres probably a better way to do this
-  const content = downloadFileSync(upload.url);
+  const response = await fetch(upload.url ?? "");
+  const content = await response.text();
  expect(content.length).toBeGreaterThan(0);

  // Ensure that it comes back with the list_media endpoint
@ -92,7 +92,8 @@ test("Upload image and delete it", async () => {
  expect(delete_).toBe(true);

  // ensure that image is deleted
-  const content2 = downloadFileSync(upload.url);
+  const response2 = await fetch(upload.url ?? "");
+  const content2 = await response2.text();
  expect(content2).toBe("");

  // Ensure that it shows the image is deleted
@ -120,7 +121,8 @@ test("Purge user, uploaded image removed", async () => {
  expect(upload.delete_url).toBeDefined();

  // ensure that image download is working. theres probably a better way to do this
-  const content = downloadFileSync(upload.url);
+  const response = await fetch(upload.url ?? "");
+  const content = await response.text();
  expect(content.length).toBeGreaterThan(0);

  // purge user
@ -132,7 +134,8 @@ test("Purge user, uploaded image removed", async () => {
  expect(delete_.success).toBe(true);

  // ensure that image is deleted
-  const content2 = downloadFileSync(upload.url);
+  const response2 = await fetch(upload.url ?? "");
+  const content2 = await response2.text();
  expect(content2).toBe("");
 });

@ -150,7 +153,8 @@ test("Purge post, linked image removed", async () => {
  expect(upload.delete_url).toBeDefined();

  // ensure that image download is working. theres probably a better way to do this
-  const content = downloadFileSync(upload.url);
+  const response = await fetch(upload.url ?? "");
+  const content = await response.text();
  expect(content.length).toBeGreaterThan(0);

  let community = await resolveBetaCommunity(user);
@ -170,7 +174,8 @@ test("Purge post, linked image removed", async () => {
  expect(delete_.success).toBe(true);

  // ensure that image is deleted
-  const content2 = downloadFileSync(upload.url);
+  const response2 = await fetch(upload.url ?? "");
+  const content2 = await response2.text();
  expect(content2).toBe("");
 });

--- a/api_tests/src/shared.ts
+++ b/api_tests/src/shared.ts
@ -197,7 +197,7 @@ export async function setupLogins() {
    // (because last_successful_id is set to current id when federation to an instance is first started)
    // only needed the first time so do in this try
    await delay(10_000);
-  } catch (_) {
+  } catch {
    console.log("Communities already exist");
  }
 }
@ -899,7 +899,6 @@ export async function deleteAllImages(api: LemmyHttp) {
  const imagesRes = await api.listAllMedia({
    limit: imageFetchLimit,
  });
-  imagesRes.images;
  Promise.all(
    imagesRes.images
      .map(image => {
--- a/crates/api/Cargo.toml
+++ b/crates/api/Cargo.toml
@ -35,11 +35,12 @@ chrono = { workspace = true }
 url = { workspace = true }
 hound = "3.5.1"
 sitemap-rs = "0.2.1"
-totp-rs = { version = "5.5.1", features = ["gen_secret", "otpauth"] }
-actix-web-httpauth = "0.8.1"
+totp-rs = { version = "5.6.0", features = ["gen_secret", "otpauth"] }
+actix-web-httpauth = "0.8.2"

 [dev-dependencies]
 serial_test = { workspace = true }
 tokio = { workspace = true }
 elementtree = "1.2.3"
 pretty_assertions = { workspace = true }
+lemmy_api_crud = { workspace = true }
--- a/crates/api/src/local_user/verify_email.rs
+++ b/crates/api/src/local_user/verify_email.rs
@ -5,12 +5,9 @@ use lemmy_api_common::{
  utils::send_new_applicant_email_to_admins,
  SuccessResponse,
 };
-use lemmy_db_schema::{
-  source::{
-    email_verification::EmailVerification,
-    local_user::{LocalUser, LocalUserUpdateForm},
-  },
-  RegistrationMode,
+use lemmy_db_schema::source::{
+  email_verification::EmailVerification,
+  local_user::{LocalUser, LocalUserUpdateForm},
 };
 use lemmy_db_views::structs::{LocalUserView, SiteView};
 use lemmy_utils::error::{LemmyErrorType, LemmyResult};
@ -41,9 +38,7 @@ pub async fn verify_email(
  EmailVerification::delete_old_tokens_for_local_user(&mut context.pool(), local_user_id).await?;

  // send out notification about registration application to admins if enabled
-  if site_view.local_site.registration_mode == RegistrationMode::RequireApplication
-    && site_view.local_site.application_email_admins
-  {
+  if site_view.local_site.application_email_admins {
    let local_user = LocalUserView::read(&mut context.pool(), local_user_id)
      .await?
      .ok_or(LemmyErrorType::CouldntFindPerson)?;
--- a/crates/api/src/post/get_link_metadata.rs
+++ b/crates/api/src/post/get_link_metadata.rs
@ -4,6 +4,7 @@ use lemmy_api_common::{
  post::{GetSiteMetadata, GetSiteMetadataResponse},
  request::fetch_link_metadata,
 };
+use lemmy_db_views::structs::LocalUserView;
 use lemmy_utils::{
  error::{LemmyErrorExt, LemmyResult},
  LemmyErrorType,
@ -14,6 +15,8 @@ use url::Url;
 pub async fn get_link_metadata(
  data: Query<GetSiteMetadata>,
  context: Data<LemmyContext>,
+  // Require an account for this API
+  _local_user_view: LocalUserView,
 ) -> LemmyResult<Json<GetSiteMetadataResponse>> {
  let url = Url::parse(&data.url).with_lemmy_type(LemmyErrorType::InvalidUrl)?;
  let metadata = fetch_link_metadata(&url, &context).await?;
--- a/crates/api/src/site/registration_applications/approve.rs
+++ b/crates/api/src/site/registration_applications/approve.rs
@ -1,4 +1,5 @@
-use actix_web::web::{Data, Json};
+use activitypub_federation::config::Data;
+use actix_web::web::Json;
 use lemmy_api_common::{
  context::LemmyContext,
  site::{ApproveRegistrationApplication, RegistrationApplicationResponse},
@ -10,10 +11,13 @@ use lemmy_db_schema::{
    registration_application::{RegistrationApplication, RegistrationApplicationUpdateForm},
  },
  traits::Crud,
-  utils::diesel_string_update,
+  utils::{diesel_string_update, get_conn},
 };
 use lemmy_db_views::structs::{LocalUserView, RegistrationApplicationView};
-use lemmy_utils::{error::LemmyResult, LemmyErrorType};
+use lemmy_utils::{
+  error::{LemmyError, LemmyResult},
+  LemmyErrorType,
+};

 pub async fn approve_registration_application(
  data: Json<ApproveRegistrationApplication>,
@ -25,34 +29,46 @@ pub async fn approve_registration_application(
  // Only let admins do this
  is_admin(&local_user_view)?;

-  // Update the registration with reason, admin_id
-  let deny_reason = diesel_string_update(data.deny_reason.as_deref());
-  let app_form = RegistrationApplicationUpdateForm {
-    admin_id: Some(Some(local_user_view.person.id)),
-    deny_reason,
-  };
+  let pool = &mut context.pool();
+  let conn = &mut get_conn(pool).await?;
+  let tx_data = data.clone();
+  let approved_user_id = conn
+    .build_transaction()
+    .run(|conn| {
+      Box::pin(async move {
+        // Update the registration with reason, admin_id
+        let deny_reason = diesel_string_update(tx_data.deny_reason.as_deref());
+        let app_form = RegistrationApplicationUpdateForm {
+          admin_id: Some(Some(local_user_view.person.id)),
+          deny_reason,
+        };

-  let registration_application =
-    RegistrationApplication::update(&mut context.pool(), app_id, &app_form).await?;
+        let registration_application =
+          RegistrationApplication::update(&mut conn.into(), app_id, &app_form).await?;

-  // Update the local_user row
-  let local_user_form = LocalUserUpdateForm {
-    accepted_application: Some(data.approve),
-    ..Default::default()
-  };
+        // Update the local_user row
+        let local_user_form = LocalUserUpdateForm {
+          accepted_application: Some(tx_data.approve),
+          ..Default::default()
+        };

-  let approved_user_id = registration_application.local_user_id;
-  LocalUser::update(&mut context.pool(), approved_user_id, &local_user_form).await?;
+        let approved_user_id = registration_application.local_user_id;
+        LocalUser::update(&mut conn.into(), approved_user_id, &local_user_form).await?;
+
+        Ok::<_, LemmyError>(approved_user_id)
+      }) as _
+    })
+    .await?;

  if data.approve {
    let approved_local_user_view = LocalUserView::read(&mut context.pool(), approved_user_id)
      .await?
      .ok_or(LemmyErrorType::CouldntFindLocalUser)?;
-
    if approved_local_user_view.local_user.email.is_some() {
+      // Email sending may fail, but this won't revert the application approval
      send_application_approved_email(&approved_local_user_view, context.settings()).await?;
    }
-  }
+  };

  // Read the view
  let registration_application = RegistrationApplicationView::read(&mut context.pool(), app_id)
--- a/crates/api/src/site/registration_applications/list.rs
+++ b/crates/api/src/site/registration_applications/list.rs
@ -1,4 +1,5 @@
-use actix_web::web::{Data, Json, Query};
+use activitypub_federation::config::Data;
+use actix_web::web::{Json, Query};
 use lemmy_api_common::{
  context::LemmyContext,
  site::{ListRegistrationApplications, ListRegistrationApplicationsResponse},
--- a/crates/api/src/site/registration_applications/mod.rs
+++ b/crates/api/src/site/registration_applications/mod.rs
@ -1,4 +1,6 @@
 pub mod approve;
 pub mod get;
 pub mod list;
+#[cfg(test)]
+mod tests;
 pub mod unread_count;
--- a/crates/api/src/site/registration_applications/tests.rs
+++ b/crates/api/src/site/registration_applications/tests.rs
@ -0,0 +1,428 @@
+use crate::site::registration_applications::{
+  approve::approve_registration_application,
+  list::list_registration_applications,
+  unread_count::get_unread_registration_application_count,
+};
+use activitypub_federation::config::Data;
+use actix_web::web::{Json, Query};
+use lemmy_api_common::{
+  context::LemmyContext,
+  site::{
+    ApproveRegistrationApplication,
+    EditSite,
+    GetUnreadRegistrationApplicationCountResponse,
+    ListRegistrationApplicationsResponse,
+  },
+};
+use lemmy_api_crud::site::update::update_site;
+use lemmy_db_schema::{
+  newtypes::InstanceId,
+  source::{
+    instance::Instance,
+    local_site::{LocalSite, LocalSiteInsertForm},
+    local_site_rate_limit::{LocalSiteRateLimit, LocalSiteRateLimitInsertForm},
+    local_user::{LocalUser, LocalUserInsertForm, LocalUserUpdateForm},
+    person::{Person, PersonInsertForm},
+    registration_application::{RegistrationApplication, RegistrationApplicationInsertForm},
+    site::{Site, SiteInsertForm},
+  },
+  traits::Crud,
+  utils::DbPool,
+  RegistrationMode,
+};
+use lemmy_db_views::structs::LocalUserView;
+use lemmy_utils::{error::LemmyResult, LemmyErrorType, CACHE_DURATION_API};
+use serial_test::serial;
+
+#[allow(clippy::unwrap_used)]
+async fn create_test_site(context: &Data<LemmyContext>) -> LemmyResult<(Instance, LocalUserView)> {
+  let pool = &mut context.pool();
+
+  let inserted_instance = Instance::read_or_create(pool, "my_domain.tld".to_string())
+    .await
+    .expect("Create test instance");
+
+  let admin_person = Person::create(
+    pool,
+    &PersonInsertForm::test_form(inserted_instance.id, "admin"),
+  )
+  .await?;
+  LocalUser::create(
+    pool,
+    &LocalUserInsertForm::test_form_admin(admin_person.id),
+    vec![],
+  )
+  .await?;
+
+  let admin_local_user_view = LocalUserView::read_person(pool, admin_person.id)
+    .await?
+    .unwrap();
+
+  let site_form = SiteInsertForm::builder()
+    .name("test site".to_string())
+    .instance_id(inserted_instance.id)
+    .build();
+  let site = Site::create(pool, &site_form).await.unwrap();
+
+  // Create a local site, since this is necessary for determining if email verification is
+  // required
+  let local_site_form = LocalSiteInsertForm::builder()
+    .site_id(site.id)
+    .require_email_verification(Some(true))
+    .application_question(Some(".".to_string()))
+    .registration_mode(Some(RegistrationMode::RequireApplication))
+    .site_setup(Some(true))
+    .build();
+  let local_site = LocalSite::create(pool, &local_site_form).await.unwrap();
+
+  // Required to have a working local SiteView when updating the site to change email verification
+  // requirement or registration mode
+  let rate_limit_form = LocalSiteRateLimitInsertForm::builder()
+    .local_site_id(local_site.id)
+    .build();
+  LocalSiteRateLimit::create(pool, &rate_limit_form)
+    .await
+    .unwrap();
+
+  Ok((inserted_instance, admin_local_user_view))
+}
+
+async fn signup(
+  pool: &mut DbPool<'_>,
+  instance_id: InstanceId,
+  name: &str,
+  email: Option<&str>,
+) -> LemmyResult<(LocalUser, RegistrationApplication)> {
+  let person_insert_form = PersonInsertForm::test_form(instance_id, name);
+  let person = Person::create(pool, &person_insert_form).await?;
+
+  let local_user_insert_form = match email {
+    Some(email) => LocalUserInsertForm {
+      email: Some(email.to_string()),
+      email_verified: Some(false),
+      ..LocalUserInsertForm::test_form(person.id)
+    },
+    None => LocalUserInsertForm::test_form(person.id),
+  };
+
+  let local_user = LocalUser::create(pool, &local_user_insert_form, vec![]).await?;
+
+  let application_insert_form = RegistrationApplicationInsertForm {
+    local_user_id: local_user.id,
+    answer: "x".to_string(),
+  };
+  let application = RegistrationApplication::create(pool, &application_insert_form).await?;
+
+  Ok((local_user, application))
+}
+
+#[allow(clippy::unwrap_used)]
+async fn get_application_statuses(
+  context: &Data<LemmyContext>,
+  admin: LocalUserView,
+) -> LemmyResult<(
+  Json<GetUnreadRegistrationApplicationCountResponse>,
+  Json<ListRegistrationApplicationsResponse>,
+  Json<ListRegistrationApplicationsResponse>,
+)> {
+  let application_count =
+    get_unread_registration_application_count(context.reset_request_count(), admin.clone()).await?;
+
+  let unread_applications = list_registration_applications(
+    Query::from_query("unread_only=true").unwrap(),
+    context.reset_request_count(),
+    admin.clone(),
+  )
+  .await?;
+
+  let all_applications = list_registration_applications(
+    Query::from_query("unread_only=false").unwrap(),
+    context.reset_request_count(),
+    admin,
+  )
+  .await?;
+
+  Ok((application_count, unread_applications, all_applications))
+}
+
+#[allow(clippy::indexing_slicing)]
+#[allow(clippy::unwrap_used)]
+#[tokio::test]
+#[serial]
+async fn test_application_approval() -> LemmyResult<()> {
+  let context = LemmyContext::init_test_context().await;
+  let pool = &mut context.pool();
+
+  let (instance, admin_local_user_view) = create_test_site(&context).await?;
+
+  // Non-unread counts unfortunately are duplicated due to different types (i64 vs usize)
+  let mut expected_total_applications = 0;
+  let mut expected_unread_applications = 0u8;
+
+  let (local_user_with_email, app_with_email) =
+    signup(pool, instance.id, "user_w_email", Some("lemmy@localhost")).await?;
+
+  let (application_count, unread_applications, all_applications) =
+    get_application_statuses(&context, admin_local_user_view.clone()).await?;
+
+  // When email verification is required and the email is not verified the application should not
+  // be visible to admins
+  assert_eq!(
+    application_count.registration_applications,
+    i64::from(expected_unread_applications),
+  );
+  assert_eq!(
+    unread_applications.registration_applications.len(),
+    usize::from(expected_unread_applications),
+  );
+  assert_eq!(
+    all_applications.registration_applications.len(),
+    expected_total_applications,
+  );
+
+  LocalUser::update(
+    pool,
+    local_user_with_email.id,
+    &LocalUserUpdateForm {
+      email_verified: Some(true),
+      ..Default::default()
+    },
+  )
+  .await?;
+
+  expected_total_applications += 1;
+  expected_unread_applications += 1;
+
+  let (application_count, unread_applications, all_applications) =
+    get_application_statuses(&context, admin_local_user_view.clone()).await?;
+
+  // When email verification is required and the email is verified the application should be
+  // visible to admins
+  assert_eq!(
+    application_count.registration_applications,
+    i64::from(expected_unread_applications),
+  );
+  assert_eq!(
+    unread_applications.registration_applications.len(),
+    usize::from(expected_unread_applications),
+  );
+  assert!(
+    !unread_applications.registration_applications[0]
+      .creator_local_user
+      .accepted_application
+  );
+  assert_eq!(
+    all_applications.registration_applications.len(),
+    expected_total_applications,
+  );
+
+  let approval = approve_registration_application(
+    Json(ApproveRegistrationApplication {
+      id: app_with_email.id,
+      approve: true,
+      deny_reason: None,
+    }),
+    context.reset_request_count(),
+    admin_local_user_view.clone(),
+  )
+  .await;
+  // Approval should be processed up until email sending is attempted
+  assert!(approval.is_err_and(|e| e.error_type == LemmyErrorType::NoEmailSetup));
+
+  expected_unread_applications -= 1;
+
+  let (application_count, unread_applications, all_applications) =
+    get_application_statuses(&context, admin_local_user_view.clone()).await?;
+
+  // When the application is approved it should only be returned for unread queries
+  assert_eq!(
+    application_count.registration_applications,
+    i64::from(expected_unread_applications),
+  );
+  assert_eq!(
+    unread_applications.registration_applications.len(),
+    usize::from(expected_unread_applications),
+  );
+  assert_eq!(
+    all_applications.registration_applications.len(),
+    expected_total_applications,
+  );
+  assert!(
+    all_applications.registration_applications[0]
+      .creator_local_user
+      .accepted_application
+  );
+
+  let (_local_user, app_with_email_2) = signup(
+    pool,
+    instance.id,
+    "user_w_email_2",
+    Some("lemmy2@localhost"),
+  )
+  .await?;
+  let (application_count, unread_applications, all_applications) =
+    get_application_statuses(&context, admin_local_user_view.clone()).await?;
+
+  // Email not verified, so application still not visible
+  assert_eq!(
+    application_count.registration_applications,
+    i64::from(expected_unread_applications),
+  );
+  assert_eq!(
+    unread_applications.registration_applications.len(),
+    usize::from(expected_unread_applications),
+  );
+  assert_eq!(
+    all_applications.registration_applications.len(),
+    expected_total_applications,
+  );
+
+  update_site(
+    Json(EditSite {
+      require_email_verification: Some(false),
+      ..Default::default()
+    }),
+    context.reset_request_count(),
+    admin_local_user_view.clone(),
+  )
+  .await?;
+
+  // TODO: There is probably a better way to ensure cache invalidation
+  tokio::time::sleep(CACHE_DURATION_API).await;
+
+  expected_total_applications += 1;
+  expected_unread_applications += 1;
+
+  let (application_count, unread_applications, all_applications) =
+    get_application_statuses(&context, admin_local_user_view.clone()).await?;
+
+  // After disabling email verification the application should now be visible
+  assert_eq!(
+    application_count.registration_applications,
+    i64::from(expected_unread_applications),
+  );
+  assert_eq!(
+    unread_applications.registration_applications.len(),
+    usize::from(expected_unread_applications),
+  );
+  assert_eq!(
+    all_applications.registration_applications.len(),
+    expected_total_applications,
+  );
+
+  approve_registration_application(
+    Json(ApproveRegistrationApplication {
+      id: app_with_email_2.id,
+      approve: false,
+      deny_reason: None,
+    }),
+    context.reset_request_count(),
+    admin_local_user_view.clone(),
+  )
+  .await?;
+
+  expected_unread_applications -= 1;
+
+  let (application_count, unread_applications, all_applications) =
+    get_application_statuses(&context, admin_local_user_view.clone()).await?;
+
+  // Denied applications should not be marked as unread
+  assert_eq!(
+    application_count.registration_applications,
+    i64::from(expected_unread_applications),
+  );
+  assert_eq!(
+    unread_applications.registration_applications.len(),
+    usize::from(expected_unread_applications),
+  );
+  assert_eq!(
+    all_applications.registration_applications.len(),
+    expected_total_applications,
+  );
+
+  signup(pool, instance.id, "user_wo_email", None).await?;
+
+  expected_total_applications += 1;
+  expected_unread_applications += 1;
+
+  let (application_count, unread_applications, all_applications) =
+    get_application_statuses(&context, admin_local_user_view.clone()).await?;
+
+  // New user without email should immediately be visible
+  assert_eq!(
+    application_count.registration_applications,
+    i64::from(expected_unread_applications),
+  );
+  assert_eq!(
+    unread_applications.registration_applications.len(),
+    usize::from(expected_unread_applications),
+  );
+  assert_eq!(
+    all_applications.registration_applications.len(),
+    expected_total_applications,
+  );
+
+  signup(pool, instance.id, "user_w_email_3", None).await?;
+
+  expected_total_applications += 1;
+  expected_unread_applications += 1;
+
+  let (application_count, unread_applications, all_applications) =
+    get_application_statuses(&context, admin_local_user_view.clone()).await?;
+
+  // New user with email should immediately be visible
+  assert_eq!(
+    application_count.registration_applications,
+    i64::from(expected_unread_applications),
+  );
+  assert_eq!(
+    unread_applications.registration_applications.len(),
+    usize::from(expected_unread_applications),
+  );
+  assert_eq!(
+    all_applications.registration_applications.len(),
+    expected_total_applications,
+  );
+
+  update_site(
+    Json(EditSite {
+      registration_mode: Some(RegistrationMode::Open),
+      ..Default::default()
+    }),
+    context.reset_request_count(),
+    admin_local_user_view.clone(),
+  )
+  .await?;
+
+  // TODO: There is probably a better way to ensure cache invalidation
+  tokio::time::sleep(CACHE_DURATION_API).await;
+
+  let (application_count, unread_applications, all_applications) =
+    get_application_statuses(&context, admin_local_user_view.clone()).await?;
+
+  // TODO: At this time applications do not get approved when switching to open registration, so the
+  //       numbers will not change. See https://github.com/LemmyNet/lemmy/issues/4969
+  // expected_application_count = 0;
+  // expected_unread_applications_len = 0;
+
+  // When applications are not required all previous applications should become approved but still
+  // visible
+  assert_eq!(
+    application_count.registration_applications,
+    i64::from(expected_unread_applications),
+  );
+  assert_eq!(
+    unread_applications.registration_applications.len(),
+    usize::from(expected_unread_applications),
+  );
+  assert_eq!(
+    all_applications.registration_applications.len(),
+    expected_total_applications,
+  );
+
+  LocalSite::delete(pool).await?;
+  // Instance deletion cascades cleanup of all created persons
+  Instance::delete(pool, instance.id).await?;
+
+  Ok(())
+}
--- a/crates/api/src/site/registration_applications/unread_count.rs
+++ b/crates/api/src/site/registration_applications/unread_count.rs
@ -1,4 +1,5 @@
-use actix_web::web::{Data, Json};
+use activitypub_federation::config::Data;
+use actix_web::web::Json;
 use lemmy_api_common::{
  context::LemmyContext,
  site::GetUnreadRegistrationApplicationCountResponse,
--- a/crates/api_common/Cargo.toml
+++ b/crates/api_common/Cargo.toml
@ -34,7 +34,6 @@ full = [
  "reqwest",
  "actix-web",
  "futures",
-  "once_cell",
  "jsonwebtoken",
  "mime",
 ]
@ -61,7 +60,6 @@ reqwest = { workspace = true, optional = true }
 ts-rs = { workspace = true, optional = true }
 moka.workspace = true
 anyhow.workspace = true
-once_cell = { workspace = true, optional = true }
 actix-web = { workspace = true, optional = true }
 enum-map = { workspace = true }
 urlencoding = { workspace = true }
--- a/crates/api_common/src/build_response.rs
+++ b/crates/api_common/src/build_response.rs
@ -100,15 +100,20 @@ pub async fn send_local_notifs(
  person: &Person,
  do_send_email: bool,
  context: &LemmyContext,
+  local_user_view: Option<&LocalUserView>,
 ) -> LemmyResult<Vec<LocalUserId>> {
  let mut recipient_ids = Vec::new();
  let inbox_link = format!("{}/inbox", context.settings().get_protocol_and_hostname());

  // let person = my_local_user.person;
  // Read the comment view to get extra info
-  let comment_view = CommentView::read(&mut context.pool(), comment_id, None)
-    .await?
-    .ok_or(LemmyErrorType::CouldntFindComment)?;
+  let comment_view = CommentView::read(
+    &mut context.pool(),
+    comment_id,
+    local_user_view.map(|view| &view.local_user),
+  )
+  .await?
+  .ok_or(LemmyErrorType::CouldntFindComment)?;
  let comment = comment_view.comment;
  let post = comment_view.post;
  let community = comment_view.community;
--- a/crates/api_common/src/request.rs
+++ b/crates/api_common/src/request.rs
@ -8,6 +8,7 @@ use crate::{
 use activitypub_federation::config::Data;
 use chrono::{DateTime, Utc};
 use encoding_rs::{Encoding, UTF_8};
+use futures::StreamExt;
 use lemmy_db_schema::{
  newtypes::DbUrl,
  source::{
@ -23,7 +24,12 @@ use lemmy_utils::{
  VERSION,
 };
 use mime::Mime;
-use reqwest::{header::CONTENT_TYPE, Client, ClientBuilder};
+use reqwest::{
+  header::{CONTENT_TYPE, RANGE},
+  Client,
+  ClientBuilder,
+  Response,
+};
 use reqwest_middleware::ClientWithMiddleware;
 use serde::{Deserialize, Serialize};
 use tracing::info;
@ -44,7 +50,17 @@ pub fn client_builder(settings: &Settings) -> ClientBuilder {
 #[tracing::instrument(skip_all)]
 pub async fn fetch_link_metadata(url: &Url, context: &LemmyContext) -> LemmyResult<LinkMetadata> {
  info!("Fetching site metadata for url: {}", url);
-  let response = context.client().get(url.as_str()).send().await?;
+  // We only fetch the first 64kB of data in order to not waste bandwidth especially for large
+  // binary files
+  let bytes_to_fetch = 64 * 1024;
+  let response = context
+    .client()
+    .get(url.as_str())
+    // we only need the first chunk of data. Note that we do not check for Accept-Range so the
+    // server may ignore this and still respond with the full response
+    .header(RANGE, format!("bytes=0-{}", bytes_to_fetch - 1)) /* -1 because inclusive */
+    .send()
+    .await?;

  let content_type: Option<Mime> = response
    .headers()
@ -52,19 +68,57 @@ pub async fn fetch_link_metadata(url: &Url, context: &LemmyContext) -> LemmyResu
    .and_then(|h| h.to_str().ok())
    .and_then(|h| h.parse().ok());

-  // Can't use .text() here, because it only checks the content header, not the actual bytes
-  // https://github.com/LemmyNet/lemmy/issues/1964
-  let html_bytes = response.bytes().await.map_err(LemmyError::from)?.to_vec();
+  let opengraph_data = {
+    // if the content type is not text/html, we don't need to parse it
+    let is_html = content_type
+      .as_ref()
+      .map(|c| {
+        (c.type_() == mime::TEXT && c.subtype() == mime::HTML)
+      ||
+      // application/xhtml+xml is a subset of HTML
+      (c.type_() == mime::APPLICATION && c.subtype() == "xhtml")
+      })
+      .unwrap_or(false);
+    if !is_html {
+      Default::default()
+    } else {
+      // Can't use .text() here, because it only checks the content header, not the actual bytes
+      // https://github.com/LemmyNet/lemmy/issues/1964
+      // So we want to do deep inspection of the actually returned bytes but need to be careful not
+      // spend too much time parsing binary data as HTML

-  let opengraph_data = extract_opengraph_data(&html_bytes, url)
-    .map_err(|e| info!("{e}"))
-    .unwrap_or_default();
+      // only take first bytes regardless of how many bytes the server returns
+      let html_bytes = collect_bytes_until_limit(response, bytes_to_fetch).await?;
+      extract_opengraph_data(&html_bytes, url)
+        .map_err(|e| info!("{e}"))
+        .unwrap_or_default()
+    }
+  };
  Ok(LinkMetadata {
    opengraph_data,
    content_type: content_type.map(|c| c.to_string()),
  })
 }

+async fn collect_bytes_until_limit(
+  response: Response,
+  requested_bytes: usize,
+) -> Result<Vec<u8>, LemmyError> {
+  let mut stream = response.bytes_stream();
+  let mut bytes = Vec::with_capacity(requested_bytes);
+  while let Some(chunk) = stream.next().await {
+    let chunk = chunk.map_err(LemmyError::from)?;
+    // we may go over the requested size here but the important part is we don't keep aggregating
+    // more chunks than needed
+    bytes.extend_from_slice(&chunk);
+    if bytes.len() >= requested_bytes {
+      bytes.truncate(requested_bytes);
+      break;
+    }
+  }
+  Ok(bytes)
+}
+
 /// Generates and saves a post thumbnail and metadata.
 ///
 /// Takes a callback to generate a send activity task, so that post can be federated with metadata.
--- a/crates/api_common/src/send_activity.rs
+++ b/crates/api_common/src/send_activity.rs
@ -13,7 +13,7 @@ use lemmy_db_schema::{
 };
 use lemmy_db_views::structs::PrivateMessageView;
 use lemmy_utils::error::LemmyResult;
-use once_cell::sync::{Lazy, OnceCell};
+use std::sync::{LazyLock, OnceLock};
 use tokio::{
  sync::{
    mpsc,
@ -28,7 +28,7 @@ type MatchOutgoingActivitiesBoxed =
  Box<for<'a> fn(SendActivityData, &'a Data<LemmyContext>) -> BoxFuture<'a, LemmyResult<()>>>;

 /// This static is necessary so that the api_common crates don't need to depend on lemmy_apub
-pub static MATCH_OUTGOING_ACTIVITIES: OnceCell<MatchOutgoingActivitiesBoxed> = OnceCell::new();
+pub static MATCH_OUTGOING_ACTIVITIES: OnceLock<MatchOutgoingActivitiesBoxed> = OnceLock::new();

 #[derive(Debug)]
 pub enum SendActivityData {
@ -101,7 +101,7 @@ pub enum SendActivityData {

 // TODO: instead of static, move this into LemmyContext. make sure that stopping the process with
 //       ctrl+c still works.
-static ACTIVITY_CHANNEL: Lazy<ActivityChannel> = Lazy::new(|| {
+static ACTIVITY_CHANNEL: LazyLock<ActivityChannel> = LazyLock::new(|| {
  let (sender, receiver) = mpsc::unbounded_channel();
  let weak_sender = sender.downgrade();
  ActivityChannel {
--- a/crates/api_common/src/utils.rs
+++ b/crates/api_common/src/utils.rs
@ -53,10 +53,9 @@ use lemmy_utils::{
  CACHE_DURATION_FEDERATION,
 };
 use moka::future::Cache;
-use once_cell::sync::Lazy;
 use regex::{escape, Regex, RegexSet};
 use rosetta_i18n::{Language, LanguageId};
-use std::collections::HashSet;
+use std::{collections::HashSet, sync::LazyLock};
 use tracing::warn;
 use url::{ParseError, Url};
 use urlencoding::encode;
@ -546,7 +545,7 @@ pub fn local_site_opt_to_sensitive(local_site: &Option<LocalSite>) -> bool {
 }

 pub async fn get_url_blocklist(context: &LemmyContext) -> LemmyResult<RegexSet> {
-  static URL_BLOCKLIST: Lazy<Cache<(), RegexSet>> = Lazy::new(|| {
+  static URL_BLOCKLIST: LazyLock<Cache<(), RegexSet>> = LazyLock::new(|| {
    Cache::builder()
      .max_capacity(1)
      .time_to_live(CACHE_DURATION_FEDERATION)
--- a/crates/api_crud/Cargo.toml
+++ b/crates/api_crud/Cargo.toml
@ -26,7 +26,6 @@ url = { workspace = true }
 futures.workspace = true
 uuid = { workspace = true }
 moka.workspace = true
-once_cell.workspace = true
 anyhow.workspace = true
 webmention = "0.5.0"
 accept-language = "3.1.0"
--- a/crates/api_crud/src/comment/create.rs
+++ b/crates/api_crud/src/comment/create.rs
@ -134,6 +134,7 @@ pub async fn create_comment(
    &local_user_view.person,
    true,
    &context,
+    Some(&local_user_view),
  )
  .await?;

--- a/crates/api_crud/src/comment/delete.rs
+++ b/crates/api_crud/src/comment/delete.rs
@ -59,8 +59,15 @@ pub async fn delete_comment(
  .await
  .with_lemmy_type(LemmyErrorType::CouldntUpdateComment)?;

-  let recipient_ids =
-    send_local_notifs(vec![], comment_id, &local_user_view.person, false, &context).await?;
+  let recipient_ids = send_local_notifs(
+    vec![],
+    comment_id,
+    &local_user_view.person,
+    false,
+    &context,
+    Some(&local_user_view),
+  )
+  .await?;
  let updated_comment_id = updated_comment.id;

  ActivityChannel::submit_activity(
--- a/crates/api_crud/src/comment/remove.rs
+++ b/crates/api_crud/src/comment/remove.rs
@ -81,8 +81,15 @@ pub async fn remove_comment(
  };
  ModRemoveComment::create(&mut context.pool(), &form).await?;

-  let recipient_ids =
-    send_local_notifs(vec![], comment_id, &local_user_view.person, false, &context).await?;
+  let recipient_ids = send_local_notifs(
+    vec![],
+    comment_id,
+    &local_user_view.person,
+    false,
+    &context,
+    Some(&local_user_view),
+  )
+  .await?;
  let updated_comment_id = updated_comment.id;

  ActivityChannel::submit_activity(
--- a/crates/api_crud/src/comment/update.rs
+++ b/crates/api_crud/src/comment/update.rs
@ -91,6 +91,7 @@ pub async fn update_comment(
    &local_user_view.person,
    false,
    &context,
+    Some(&local_user_view),
  )
  .await?;

--- a/crates/api_crud/src/post/create.rs
+++ b/crates/api_crud/src/post/create.rs
@ -35,11 +35,11 @@ use lemmy_utils::{
  utils::{
    slurs::check_slurs,
    validation::{
-      check_url_scheme,
      is_url_blocked,
      is_valid_alt_text_field,
      is_valid_body_field,
      is_valid_post_title,
+      is_valid_url,
    },
  },
 };
@ -69,11 +69,11 @@ pub async fn create_post(

  if let Some(url) = &url {
    is_url_blocked(url, &url_blocklist)?;
-    check_url_scheme(url)?;
+    is_valid_url(url)?;
  }

  if let Some(custom_thumbnail) = &custom_thumbnail {
-    check_url_scheme(custom_thumbnail)?;
+    is_valid_url(custom_thumbnail)?;
  }

  if let Some(alt_text) = &data.alt_text {
--- a/crates/api_crud/src/post/update.rs
+++ b/crates/api_crud/src/post/update.rs
@ -28,11 +28,11 @@ use lemmy_utils::{
  utils::{
    slurs::check_slurs,
    validation::{
-      check_url_scheme,
      is_url_blocked,
      is_valid_alt_text_field,
      is_valid_body_field,
      is_valid_post_title,
+      is_valid_url,
    },
  },
 };
@ -77,11 +77,11 @@ pub async fn update_post(

  if let Some(Some(url)) = &url {
    is_url_blocked(url, &url_blocklist)?;
-    check_url_scheme(url)?;
+    is_valid_url(url)?;
  }

  if let Some(Some(custom_thumbnail)) = &custom_thumbnail {
-    check_url_scheme(custom_thumbnail)?;
+    is_valid_url(custom_thumbnail)?;
  }

  let post_id = data.post_id;
--- a/crates/api_crud/src/site/create.rs
+++ b/crates/api_crud/src/site/create.rs
@ -1,6 +1,6 @@
 use crate::site::{application_question_check, site_default_post_listing_type_check};
-use activitypub_federation::http_signatures::generate_actor_keypair;
-use actix_web::web::{Data, Json};
+use activitypub_federation::{config::Data, http_signatures::generate_actor_keypair};
+use actix_web::web::Json;
 use lemmy_api_common::{
  context::LemmyContext,
  site::{CreateSite, SiteResponse},
--- a/crates/api_crud/src/site/read.rs
+++ b/crates/api_crud/src/site/read.rs
@ -24,14 +24,14 @@ use lemmy_utils::{
  VERSION,
 };
 use moka::future::Cache;
-use once_cell::sync::Lazy;
+use std::sync::LazyLock;

 #[tracing::instrument(skip(context))]
 pub async fn get_site(
  local_user_view: Option<LocalUserView>,
  context: Data<LemmyContext>,
 ) -> LemmyResult<Json<GetSiteResponse>> {
-  static CACHE: Lazy<Cache<(), GetSiteResponse>> = Lazy::new(|| {
+  static CACHE: LazyLock<Cache<(), GetSiteResponse>> = LazyLock::new(|| {
    Cache::builder()
      .max_capacity(1)
      .time_to_live(CACHE_DURATION_API)
--- a/crates/apub/Cargo.toml
+++ b/crates/apub/Cargo.toml
@ -40,7 +40,6 @@ uuid = { workspace = true }
 async-trait = { workspace = true }
 anyhow = { workspace = true }
 reqwest = { workspace = true }
-once_cell = { workspace = true }
 moka.workspace = true
 serde_with.workspace = true
 html2md = "0.2.14"
--- a/crates/apub/src/activities/block/mod.rs
+++ b/crates/apub/src/activities/block/mod.rs
@ -38,7 +38,6 @@ pub enum SiteOrCommunity {
  Site(ApubSite),
  Community(ApubCommunity),
 }
-
 #[derive(Deserialize)]
 #[serde(untagged)]
 pub enum InstanceOrGroup {
@ -74,12 +73,18 @@ impl Object for SiteOrCommunity {
    })
  }

-  async fn delete(self, _data: &Data<Self::DataType>) -> LemmyResult<()> {
-    unimplemented!()
+  async fn delete(self, data: &Data<Self::DataType>) -> LemmyResult<()> {
+    match self {
+      SiteOrCommunity::Site(i) => i.delete(data).await,
+      SiteOrCommunity::Community(c) => c.delete(data).await,
+    }
  }

-  async fn into_json(self, _data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
-    unimplemented!()
+  async fn into_json(self, data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
+    Ok(match self {
+      SiteOrCommunity::Site(i) => InstanceOrGroup::Instance(i.into_json(data).await?),
+      SiteOrCommunity::Community(c) => InstanceOrGroup::Group(c.into_json(data).await?),
+    })
  }

  #[tracing::instrument(skip_all)]
--- a/crates/apub/src/activities/create_or_update/comment.rs
+++ b/crates/apub/src/activities/create_or_update/comment.rs
@ -179,7 +179,7 @@ impl ActivityHandler for CreateOrUpdateNote {
    // TODO: for compatibility with other projects, it would be much better to read this from cc or
    // tags
    let mentions = scrape_text_for_mentions(&comment.content);
-    send_local_notifs(mentions, comment.id, &actor, do_send_email, context).await?;
+    send_local_notifs(mentions, comment.id, &actor, do_send_email, context, None).await?;
    Ok(())
  }
 }
--- a/crates/apub/src/activities/deletion/delete.rs
+++ b/crates/apub/src/activities/deletion/delete.rs
@ -175,8 +175,9 @@ pub(in crate::activities) async fn receive_remove_action(
      )
      .await?;
    }
-    DeletableObjects::PrivateMessage(_) => unimplemented!(),
-    DeletableObjects::Person { .. } => unimplemented!(),
+    // TODO these need to be implemented yet, for now, return errors
+    DeletableObjects::PrivateMessage(_) => Err(LemmyErrorType::CouldntFindPrivateMessage)?,
+    DeletableObjects::Person(_) => Err(LemmyErrorType::CouldntFindPerson)?,
  }
  Ok(())
 }
--- a/crates/apub/src/activities/deletion/undo_delete.rs
+++ b/crates/apub/src/activities/deletion/undo_delete.rs
@ -155,8 +155,9 @@ impl UndoDelete {
        )
        .await?;
      }
-      DeletableObjects::PrivateMessage(_) => unimplemented!(),
-      DeletableObjects::Person { .. } => unimplemented!(),
+      // TODO these need to be implemented yet, for now, return errors
+      DeletableObjects::PrivateMessage(_) => Err(LemmyErrorType::CouldntFindPrivateMessage)?,
+      DeletableObjects::Person(_) => Err(LemmyErrorType::CouldntFindPerson)?,
    }
    Ok(())
  }
--- a/crates/apub/src/activity_lists.rs
+++ b/crates/apub/src/activity_lists.rs
@ -26,7 +26,7 @@ use crate::{
 };
 use activitypub_federation::{config::Data, traits::ActivityHandler};
 use lemmy_api_common::context::LemmyContext;
-use lemmy_utils::error::LemmyResult;
+use lemmy_utils::{error::LemmyResult, LemmyErrorType};
 use serde::{Deserialize, Serialize};
 use url::Url;

@ -117,7 +117,7 @@ impl InCommunity for AnnouncableActivities {
      CollectionRemove(a) => a.community(context).await,
      LockPost(a) => a.community(context).await,
      UndoLockPost(a) => a.community(context).await,
-      Page(_) => unimplemented!(),
+      Page(_) => Err(LemmyErrorType::CouldntFindPost.into()),
    }
  }
 }
--- a/crates/apub/src/fetcher/post_or_comment.rs
+++ b/crates/apub/src/fetcher/post_or_comment.rs
@ -61,8 +61,11 @@ impl Object for PostOrComment {
    }
  }

-  async fn into_json(self, _data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
-    unimplemented!()
+  async fn into_json(self, data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
+    Ok(match self {
+      PostOrComment::Post(p) => PageOrNote::Page(Box::new(p.into_json(data).await?)),
+      PostOrComment::Comment(c) => PageOrNote::Note(c.into_json(data).await?),
+    })
  }

  #[tracing::instrument(skip_all)]
--- a/crates/apub/src/fetcher/search.rs
+++ b/crates/apub/src/fetcher/search.rs
@ -118,8 +118,17 @@ impl Object for SearchableObjects {
    }
  }

-  async fn into_json(self, _data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
-    unimplemented!()
+  async fn into_json(self, data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
+    Ok(match self {
+      SearchableObjects::Post(p) => SearchableKinds::Page(Box::new(p.into_json(data).await?)),
+      SearchableObjects::Comment(c) => SearchableKinds::Note(c.into_json(data).await?),
+      SearchableObjects::PersonOrCommunity(pc) => {
+        SearchableKinds::PersonOrGroup(Box::new(match *pc {
+          UserOrCommunity::User(p) => PersonOrGroup::Person(p.into_json(data).await?),
+          UserOrCommunity::Community(c) => PersonOrGroup::Group(c.into_json(data).await?),
+        }))
+      }
+    })
  }

  #[tracing::instrument(skip_all)]
--- a/crates/apub/src/fetcher/site_or_community_or_user.rs
+++ b/crates/apub/src/fetcher/site_or_community_or_user.rs
@ -1,6 +1,6 @@
 use crate::{
  fetcher::user_or_community::{PersonOrGroup, UserOrCommunity},
-  objects::instance::ApubSite,
+  objects::{community::ApubCommunity, instance::ApubSite, person::ApubPerson},
  protocol::objects::instance::Instance,
 };
 use activitypub_federation::{
@ -41,11 +41,14 @@ impl Object for SiteOrCommunityOrUser {
  }

  #[tracing::instrument(skip_all)]
-  async fn read_from_id(
-    _object_id: Url,
-    _data: &Data<Self::DataType>,
-  ) -> LemmyResult<Option<Self>> {
-    unimplemented!();
+  async fn read_from_id(object_id: Url, data: &Data<Self::DataType>) -> LemmyResult<Option<Self>> {
+    let site = ApubSite::read_from_id(object_id.clone(), data).await?;
+    Ok(match site {
+      Some(o) => Some(SiteOrCommunityOrUser::Site(o)),
+      None => UserOrCommunity::read_from_id(object_id, data)
+        .await?
+        .map(SiteOrCommunityOrUser::UserOrCommunity),
+    })
  }

  #[tracing::instrument(skip_all)]
@ -56,8 +59,13 @@ impl Object for SiteOrCommunityOrUser {
    }
  }

-  async fn into_json(self, _data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
-    unimplemented!()
+  async fn into_json(self, data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
+    Ok(match self {
+      SiteOrCommunityOrUser::Site(p) => SiteOrPersonOrGroup::Instance(p.into_json(data).await?),
+      SiteOrCommunityOrUser::UserOrCommunity(p) => {
+        SiteOrPersonOrGroup::PersonOrGroup(p.into_json(data).await?)
+      }
+    })
  }

  #[tracing::instrument(skip_all)]
@ -75,8 +83,18 @@ impl Object for SiteOrCommunityOrUser {
  }

  #[tracing::instrument(skip_all)]
-  async fn from_json(_apub: Self::Kind, _data: &Data<Self::DataType>) -> LemmyResult<Self> {
-    unimplemented!();
+  async fn from_json(apub: Self::Kind, data: &Data<Self::DataType>) -> LemmyResult<Self> {
+    Ok(match apub {
+      SiteOrPersonOrGroup::Instance(a) => {
+        SiteOrCommunityOrUser::Site(ApubSite::from_json(a, data).await?)
+      }
+      SiteOrPersonOrGroup::PersonOrGroup(a) => SiteOrCommunityOrUser::UserOrCommunity(match a {
+        PersonOrGroup::Person(p) => UserOrCommunity::User(ApubPerson::from_json(p, data).await?),
+        PersonOrGroup::Group(g) => {
+          UserOrCommunity::Community(ApubCommunity::from_json(g, data).await?)
+        }
+      }),
+    })
  }
 }

@ -103,6 +121,9 @@ impl Actor for SiteOrCommunityOrUser {
  }

  fn inbox(&self) -> Url {
-    unimplemented!()
+    match self {
+      SiteOrCommunityOrUser::Site(u) => u.inbox(),
+      SiteOrCommunityOrUser::UserOrCommunity(c) => c.inbox(),
+    }
  }
 }
--- a/crates/apub/src/fetcher/user_or_community.rs
+++ b/crates/apub/src/fetcher/user_or_community.rs
@ -65,8 +65,11 @@ impl Object for UserOrCommunity {
    }
  }

-  async fn into_json(self, _data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
-    unimplemented!()
+  async fn into_json(self, data: &Data<Self::DataType>) -> LemmyResult<Self::Kind> {
+    Ok(match self {
+      UserOrCommunity::User(p) => PersonOrGroup::Person(p.into_json(data).await?),
+      UserOrCommunity::Community(p) => PersonOrGroup::Group(p.into_json(data).await?),
+    })
  }

  #[tracing::instrument(skip_all)]
@ -115,7 +118,10 @@ impl Actor for UserOrCommunity {
  }

  fn inbox(&self) -> Url {
-    unimplemented!()
+    match self {
+      UserOrCommunity::User(p) => p.inbox(),
+      UserOrCommunity::Community(p) => p.inbox(),
+    }
  }
 }

--- a/crates/apub/src/lib.rs
+++ b/crates/apub/src/lib.rs
@ -14,9 +14,8 @@ use lemmy_utils::{
  CACHE_DURATION_FEDERATION,
 };
 use moka::future::Cache;
-use once_cell::sync::Lazy;
 use serde_json::Value;
-use std::sync::Arc;
+use std::sync::{Arc, LazyLock};
 use url::Url;

 pub mod activities;
@ -36,7 +35,7 @@ pub const FEDERATION_HTTP_FETCH_LIMIT: u32 = 100;
 /// Only include a basic context to save space and bandwidth. The main context is hosted statically
 /// on join-lemmy.org. Include activitystreams explicitly for better compat, but this could
 /// theoretically also be moved.
-pub static FEDERATION_CONTEXT: Lazy<Value> = Lazy::new(|| {
+pub static FEDERATION_CONTEXT: LazyLock<Value> = LazyLock::new(|| {
  Value::Array(vec![
    Value::String("https://join-lemmy.org/context.json".to_string()),
    Value::String("https://www.w3.org/ns/activitystreams".to_string()),
@ -129,7 +128,7 @@ pub(crate) async fn local_site_data_cached(
  // multiple times. This causes a huge number of database reads if we hit the db directly. So we
  // cache these values for a short time, which will already make a huge difference and ensures that
  // changes take effect quickly.
-  static CACHE: Lazy<Cache<(), Arc<LocalSiteData>>> = Lazy::new(|| {
+  static CACHE: LazyLock<Cache<(), Arc<LocalSiteData>>> = LazyLock::new(|| {
    Cache::builder()
      .max_capacity(1)
      .time_to_live(CACHE_DURATION_FEDERATION)
--- a/crates/apub/src/objects/instance.rs
+++ b/crates/apub/src/objects/instance.rs
@ -88,7 +88,7 @@ impl Object for ApubSite {
  }

  async fn delete(self, _data: &Data<Self::DataType>) -> LemmyResult<()> {
-    unimplemented!()
+    Err(LemmyErrorType::CantDeleteSite.into())
  }

  #[tracing::instrument(skip_all)]
--- a/crates/apub/src/objects/post.rs
+++ b/crates/apub/src/objects/post.rs
@ -41,7 +41,11 @@ use lemmy_db_views_actor::structs::CommunityModeratorView;
 use lemmy_utils::{
  error::{LemmyError, LemmyErrorType, LemmyResult},
  spawn_try_task,
-  utils::{markdown::markdown_to_html, slurs::check_slurs_opt, validation::check_url_scheme},
+  utils::{
+    markdown::markdown_to_html,
+    slurs::check_slurs_opt,
+    validation::{is_url_blocked, is_valid_url},
+  },
 };
 use std::ops::Deref;
 use stringreader::StringReader;
@ -180,8 +184,15 @@ impl Object for ApubPost {
    let creator = page.creator()?.dereference(context).await?;
    let community = page.community(context).await?;
    if community.posting_restricted_to_mods {
-      CommunityModeratorView::is_community_moderator(&mut context.pool(), community.id, creator.id)
-        .await?;
+      let is_mod = CommunityModeratorView::is_community_moderator(
+        &mut context.pool(),
+        community.id,
+        creator.id,
+      )
+      .await?;
+      if !is_mod {
+        Err(LemmyErrorType::OnlyModsCanPostInCommunity)?
+      }
    }
    let mut name = page
      .name
@ -220,14 +231,16 @@ impl Object for ApubPost {
      None
    };

+    let url_blocklist = get_url_blocklist(context).await?;
+
    if let Some(url) = &url {
-      check_url_scheme(url)?;
+      is_url_blocked(url, &url_blocklist)?;
+      is_valid_url(url)?;
    }

    let alt_text = first_attachment.cloned().and_then(Attachment::alt_text);

    let slur_regex = &local_site_opt_to_slur_regex(&local_site);
-    let url_blocklist = get_url_blocklist(context).await?;

    let body = read_from_string_or_source_opt(&page.content, &page.media_type, &page.source);
    let body = process_markdown_opt(&body, slur_regex, &url_blocklist, context).await?;
--- a/crates/apub/src/objects/private_message.rs
+++ b/crates/apub/src/objects/private_message.rs
@ -73,7 +73,7 @@ impl Object for ApubPrivateMessage {

  async fn delete(self, _context: &Data<Self::DataType>) -> LemmyResult<()> {
    // do nothing, because pm can't be fetched over http
-    unimplemented!()
+    Err(LemmyErrorType::CouldntFindPrivateMessage.into())
  }

  #[tracing::instrument(skip_all)]
--- a/crates/apub/src/protocol/objects/group.rs
+++ b/crates/apub/src/protocol/objects/group.rs
@ -7,7 +7,7 @@ use crate::{
    community_outbox::ApubCommunityOutbox,
  },
  local_site_data_cached,
-  objects::{community::ApubCommunity, read_from_string_or_source_opt, verify_is_remote_object},
+  objects::{community::ApubCommunity, read_from_string_or_source_opt},
  protocol::{
    objects::{Endpoints, LanguageTag},
    ImageObject,
@ -80,7 +80,6 @@ impl Group {
  ) -> LemmyResult<()> {
    check_apub_id_valid_with_strictness(self.id.inner(), true, context).await?;
    verify_domains_match(expected_domain, self.id.inner())?;
-    verify_is_remote_object(&self.id, context)?;

    let local_site_data = local_site_data_cached(&mut context.pool()).await?;
    let slur_regex = &local_site_opt_to_slur_regex(&local_site_data.local_site);
--- a/crates/apub/src/protocol/objects/page.rs
+++ b/crates/apub/src/protocol/objects/page.rs
@ -193,10 +193,12 @@ impl ActivityHandler for Page {
  type DataType = LemmyContext;
  type Error = LemmyError;
  fn id(&self) -> &Url {
-    unimplemented!()
+    self.id.inner()
  }
+
  fn actor(&self) -> &Url {
-    unimplemented!()
+    debug_assert!(false);
+    self.id.inner()
  }
  async fn verify(&self, data: &Data<Self::DataType>) -> LemmyResult<()> {
    ApubPost::verify(self, self.id.inner(), data).await
--- a/crates/db_schema/Cargo.toml
+++ b/crates/db_schema/Cargo.toml
@ -27,7 +27,6 @@ full = [
  "lemmy_utils",
  "activitypub_federation",
  "regex",
-  "once_cell",
  "serde_json",
  "diesel_ltree",
  "diesel-async",
@ -64,7 +63,6 @@ diesel-async = { workspace = true, features = [
  "deadpool",
 ], optional = true }
 regex = { workspace = true, optional = true }
-once_cell = { workspace = true, optional = true }
 diesel_ltree = { workspace = true, optional = true }
 typed-builder = { workspace = true }
 async-trait = { workspace = true }
--- a/crates/db_schema/src/impls/comment.rs
+++ b/crates/db_schema/src/impls/comment.rs
@ -117,7 +117,7 @@ impl Crud for Comment {
  type UpdateForm = CommentUpdateForm;
  type IdType = CommentId;

-  /// This is unimplemented, use [[Comment::create]]
+  /// Use [[Comment::create]]
  async fn create(pool: &mut DbPool<'_>, comment_form: &Self::InsertForm) -> Result<Self, Error> {
    debug_assert!(false);
    Comment::create(pool, comment_form, None).await
--- a/crates/db_schema/src/impls/local_site.rs
+++ b/crates/db_schema/src/impls/local_site.rs
@ -7,7 +7,7 @@ use diesel::{dsl::insert_into, result::Error};
 use diesel_async::RunQueryDsl;
 use lemmy_utils::{error::LemmyResult, CACHE_DURATION_API};
 use moka::future::Cache;
-use once_cell::sync::Lazy;
+use std::sync::LazyLock;

 impl LocalSite {
  pub async fn create(pool: &mut DbPool<'_>, form: &LocalSiteInsertForm) -> Result<Self, Error> {
@ -18,7 +18,7 @@ impl LocalSite {
      .await
  }
  pub async fn read(pool: &mut DbPool<'_>) -> LemmyResult<Self> {
-    static CACHE: Lazy<Cache<(), LocalSite>> = Lazy::new(|| {
+    static CACHE: LazyLock<Cache<(), LocalSite>> = LazyLock::new(|| {
      Cache::builder()
        .max_capacity(1)
        .time_to_live(CACHE_DURATION_API)
--- a/crates/db_schema/src/impls/local_user.rs
+++ b/crates/db_schema/src/impls/local_user.rs
@ -115,11 +115,11 @@ impl LocalUser {
    let conn = &mut get_conn(pool).await?;

    // Make sure:
-    // - The deny reason exists
+    // - An admin has interacted with the application
    // - The app is older than a week
    // - The accepted_application is false
    let old_denied_registrations = registration_application::table
-      .filter(registration_application::deny_reason.is_not_null())
+      .filter(registration_application::admin_id.is_not_null())
      .filter(registration_application::published.lt(now() - 1.week()))
      .select(registration_application::local_user_id);

--- a/crates/db_schema/src/impls/person.rs
+++ b/crates/db_schema/src/impls/person.rs
@ -191,9 +191,12 @@ impl Followable for PersonFollower {
      .get_result::<Self>(conn)
      .await
  }
+
+  /// Currently no user following
  async fn follow_accepted(_: &mut DbPool<'_>, _: CommunityId, _: PersonId) -> Result<Self, Error> {
-    unimplemented!()
+    Err(Error::NotFound)
  }
+
  async fn unfollow(pool: &mut DbPool<'_>, form: &PersonFollowerForm) -> Result<usize, Error> {
    let conn = &mut get_conn(pool).await?;
    diesel::delete(person_follower::table.find((form.follower_id, form.person_id)))
--- a/crates/db_schema/src/impls/private_message_report.rs
+++ b/crates/db_schema/src/impls/private_message_report.rs
@ -52,7 +52,7 @@ impl Reportable for PrivateMessageReport {
    _pm_id_: PrivateMessageId,
    _by_resolver_id: PersonId,
  ) -> Result<usize, Error> {
-    unimplemented!()
+    Err(Error::NotFound)
  }

  async fn unresolve(
--- a/crates/db_schema/src/impls/site.rs
+++ b/crates/db_schema/src/impls/site.rs
@ -20,7 +20,7 @@ impl Crud for Site {

  /// Use SiteView::read_local, or Site::read_from_apub_id instead
  async fn read(_pool: &mut DbPool<'_>, _site_id: SiteId) -> Result<Option<Self>, Error> {
-    unimplemented!()
+    Err(Error::NotFound)
  }

  async fn create(pool: &mut DbPool<'_>, form: &Self::InsertForm) -> Result<Self, Error> {
--- a/crates/db_schema/src/schema.rs
+++ b/crates/db_schema/src/schema.rs
@ -711,7 +711,7 @@ diesel::table! {
        id -> Int4,
        #[max_length = 200]
        name -> Varchar,
-        #[max_length = 512]
+        #[max_length = 2000]
        url -> Nullable<Varchar>,
        body -> Nullable<Text>,
        creator_id -> Int4,
--- a/crates/db_schema/src/utils.rs
+++ b/crates/db_schema/src/utils.rs
@ -32,7 +32,6 @@ use lemmy_utils::{
  settings::SETTINGS,
  utils::validation::clean_url_params,
 };
-use once_cell::sync::Lazy;
 use regex::Regex;
 use rustls::{
  client::danger::{
@ -49,7 +48,7 @@ use rustls::{
 };
 use std::{
  ops::{Deref, DerefMut},
-  sync::Arc,
+  sync::{Arc, LazyLock},
  time::Duration,
 };
 use tracing::error;
@ -478,7 +477,7 @@ pub fn post_to_comment_sort_type(sort: SortType) -> CommentSortType {
  }
 }

-static EMAIL_REGEX: Lazy<Regex> = Lazy::new(|| {
+static EMAIL_REGEX: LazyLock<Regex> = LazyLock::new(|| {
  Regex::new(r"^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$")
    .expect("compile email regex")
 });
--- a/crates/federate/Cargo.toml
+++ b/crates/federate/Cargo.toml
@ -27,7 +27,6 @@ futures.workspace = true
 chrono.workspace = true
 diesel = { workspace = true, features = ["postgres", "chrono", "serde_json"] }
 diesel-async = { workspace = true, features = ["deadpool", "postgres"] }
-once_cell.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
 tokio = { workspace = true, features = ["full"] }
@ -43,4 +42,4 @@ actix-web.workspace = true
 tracing-test = "0.2.5"
 uuid.workspace = true
 test-context = "0.3.0"
-mockall = "0.12.1"
+mockall = "0.13.0"
--- a/crates/federate/src/inboxes.rs
+++ b/crates/federate/src/inboxes.rs
@ -8,9 +8,11 @@ use lemmy_db_schema::{
  utils::{ActualDbPool, DbPool},
 };
 use lemmy_db_views_actor::structs::CommunityFollowerView;
-use once_cell::sync::Lazy;
 use reqwest::Url;
-use std::collections::{HashMap, HashSet};
+use std::{
+  collections::{HashMap, HashSet},
+  sync::LazyLock,
+};

 /// interval with which new additions to community_followers are queried.
 ///
@ -21,7 +23,7 @@ use std::collections::{HashMap, HashSet};
 /// currently fairly high because of the current structure of storing inboxes for every person, not
 /// having a separate list of shared_inboxes, and the architecture of having every instance queue be
 /// fully separate. (see https://github.com/LemmyNet/lemmy/issues/3958)
-static FOLLOW_ADDITIONS_RECHECK_DELAY: Lazy<chrono::TimeDelta> = Lazy::new(|| {
+static FOLLOW_ADDITIONS_RECHECK_DELAY: LazyLock<chrono::TimeDelta> = LazyLock::new(|| {
  if *LEMMY_TEST_FAST_FEDERATION {
    chrono::TimeDelta::try_seconds(1).expect("TimeDelta out of bounds")
  } else {
@ -31,8 +33,8 @@ static FOLLOW_ADDITIONS_RECHECK_DELAY: Lazy<chrono::TimeDelta> = Lazy::new(|| {
 /// The same as FOLLOW_ADDITIONS_RECHECK_DELAY, but triggering when the last person on an instance
 /// unfollows a specific remote community. This is expected to happen pretty rarely and updating it
 /// in a timely manner is not too important.
-static FOLLOW_REMOVALS_RECHECK_DELAY: Lazy<chrono::TimeDelta> =
-  Lazy::new(|| chrono::TimeDelta::try_hours(1).expect("TimeDelta out of bounds"));
+static FOLLOW_REMOVALS_RECHECK_DELAY: LazyLock<chrono::TimeDelta> =
+  LazyLock::new(|| chrono::TimeDelta::try_hours(1).expect("TimeDelta out of bounds"));

 #[async_trait]
 pub trait DataSource: Send + Sync {
--- a/crates/federate/src/util.rs
+++ b/crates/federate/src/util.rs
@ -18,10 +18,15 @@ use lemmy_db_schema::{
  utils::{get_conn, DbPool},
 };
 use moka::future::Cache;
-use once_cell::sync::Lazy;
 use reqwest::Url;
 use serde_json::Value;
-use std::{fmt::Debug, future::Future, pin::Pin, sync::Arc, time::Duration};
+use std::{
+  fmt::Debug,
+  future::Future,
+  pin::Pin,
+  sync::{Arc, LazyLock},
+  time::Duration,
+};
 use tokio::{task::JoinHandle, time::sleep};
 use tokio_util::sync::CancellationToken;

@ -29,7 +34,7 @@ use tokio_util::sync::CancellationToken;
 /// Should only be used for federation tests since it significantly increases CPU and DB load of the
 /// federation queue. This is intentionally a separate flag from other flags like debug_assertions,
 /// since this is a invasive change we only need rarely.
-pub(crate) static LEMMY_TEST_FAST_FEDERATION: Lazy<bool> = Lazy::new(|| {
+pub(crate) static LEMMY_TEST_FAST_FEDERATION: LazyLock<bool> = LazyLock::new(|| {
  std::env::var("LEMMY_TEST_FAST_FEDERATION")
    .map(|s| !s.is_empty())
    .unwrap_or(false)
@ -49,7 +54,7 @@ pub(crate) static LEMMY_TEST_FAST_FEDERATION: Lazy<bool> = Lazy::new(|| {
 /// If the delay is too short, the workers (one per federated instance) will wake up too
 /// often and consume a lot of CPU. If the delay is long, then activities on low-traffic instances
 /// will on average take delay/2 seconds to federate.
-pub(crate) static WORK_FINISHED_RECHECK_DELAY: Lazy<Duration> = Lazy::new(|| {
+pub(crate) static WORK_FINISHED_RECHECK_DELAY: LazyLock<Duration> = LazyLock::new(|| {
  if *LEMMY_TEST_FAST_FEDERATION {
    Duration::from_millis(100)
  } else {
@ -61,7 +66,7 @@ pub(crate) static WORK_FINISHED_RECHECK_DELAY: Lazy<Duration> = Lazy::new(|| {
 ///
 /// This cache is common to all the instance workers and prevents there from being more than one
 /// call per N seconds between each DB query to find max(activity_id).
-pub(crate) static CACHE_DURATION_LATEST_ID: Lazy<Duration> = Lazy::new(|| {
+pub(crate) static CACHE_DURATION_LATEST_ID: LazyLock<Duration> = LazyLock::new(|| {
  if *LEMMY_TEST_FAST_FEDERATION {
    // in test mode, we use the same cache duration as the recheck delay so when recheck happens
    // data is fresh, accelerating the time the tests take.
@ -132,8 +137,8 @@ pub(crate) async fn get_actor_cached(
  actor_type: ActorType,
  actor_apub_id: &Url,
 ) -> Result<Arc<SiteOrCommunityOrUser>> {
-  static CACHE: Lazy<Cache<Url, Arc<SiteOrCommunityOrUser>>> =
-    Lazy::new(|| Cache::builder().max_capacity(10000).build());
+  static CACHE: LazyLock<Cache<Url, Arc<SiteOrCommunityOrUser>>> =
+    LazyLock::new(|| Cache::builder().max_capacity(10000).build());
  CACHE
    .try_get_with(actor_apub_id.clone(), async {
      let url = actor_apub_id.clone().into();
@ -172,8 +177,8 @@ pub(crate) async fn get_activity_cached(
  pool: &mut DbPool<'_>,
  activity_id: ActivityId,
 ) -> Result<CachedActivityInfo> {
-  static ACTIVITIES: Lazy<Cache<ActivityId, CachedActivityInfo>> =
-    Lazy::new(|| Cache::builder().max_capacity(10000).build());
+  static ACTIVITIES: LazyLock<Cache<ActivityId, CachedActivityInfo>> =
+    LazyLock::new(|| Cache::builder().max_capacity(10000).build());
  ACTIVITIES
    .try_get_with(activity_id, async {
      let row = SentActivity::read(pool, activity_id)
@ -195,7 +200,7 @@ pub(crate) async fn get_activity_cached(

 /// return the most current activity id (with 1 second cache)
 pub(crate) async fn get_latest_activity_id(pool: &mut DbPool<'_>) -> Result<ActivityId> {
-  static CACHE: Lazy<Cache<(), ActivityId>> = Lazy::new(|| {
+  static CACHE: LazyLock<Cache<(), ActivityId>> = LazyLock::new(|| {
    Cache::builder()
      .time_to_live(*CACHE_DURATION_LATEST_ID)
      .build()
--- a/crates/routes/Cargo.toml
+++ b/crates/routes/Cargo.toml
@ -30,7 +30,6 @@ reqwest = { workspace = true, features = ["stream"] }
 reqwest-middleware = { workspace = true }
 serde = { workspace = true }
 url = { workspace = true }
-once_cell = { workspace = true }
 tracing = { workspace = true }
 tokio = { workspace = true }
 urlencoding = { workspace = true }
--- a/crates/routes/src/feeds.rs
+++ b/crates/routes/src/feeds.rs
@ -25,7 +25,6 @@ use lemmy_utils::{
  error::{LemmyError, LemmyErrorType, LemmyResult},
  utils::markdown::{markdown_to_html, sanitize_html},
 };
-use once_cell::sync::Lazy;
 use rss::{
  extension::{dublincore::DublinCoreExtension, ExtensionBuilder, ExtensionMap},
  Channel,
@ -34,7 +33,7 @@ use rss::{
  Item,
 };
 use serde::Deserialize;
-use std::{collections::BTreeMap, str::FromStr};
+use std::{collections::BTreeMap, str::FromStr, sync::LazyLock};

 const RSS_FETCH_LIMIT: i64 = 20;

@ -80,7 +79,7 @@ pub fn config(cfg: &mut web::ServiceConfig) {
  );
 }

-static RSS_NAMESPACE: Lazy<BTreeMap<String, String>> = Lazy::new(|| {
+static RSS_NAMESPACE: LazyLock<BTreeMap<String, String>> = LazyLock::new(|| {
  let mut h = BTreeMap::new();
  h.insert(
    "dc".to_string(),
--- a/crates/utils/Cargo.toml
+++ b/crates/utils/Cargo.toml
@ -39,7 +39,6 @@ full = [
  "dep:urlencoding",
  "dep:doku",
  "dep:url",
-  "dep:once_cell",
  "dep:smart-default",
  "dep:enum-map",
  "dep:futures",
@ -58,7 +57,6 @@ tracing-error = { workspace = true, optional = true }
 itertools = { workspace = true, optional = true }
 serde = { workspace = true }
 serde_json = { workspace = true, optional = true }
-once_cell = { workspace = true, optional = true }
 url = { workspace = true, optional = true }
 actix-web = { workspace = true, optional = true }
 anyhow = { workspace = true, optional = true }
@ -81,7 +79,7 @@ lettre = { version = "0.11.7", default-features = false, features = [
  "tokio1-rustls-tls",
  "smtp-transport",
 ], optional = true }
-markdown-it = { version = "0.6.0", optional = true }
+markdown-it = { version = "0.6.1", optional = true }
 ts-rs = { workspace = true, optional = true }
 enum-map = { workspace = true, optional = true }
 cfg-if = "1"
--- a/crates/utils/src/error.rs
+++ b/crates/utils/src/error.rs
@ -179,6 +179,8 @@ pub enum LemmyErrorType {
  UrlWithoutDomain,
  InboxTimeout,
  Unknown(String),
+  CantDeleteSite,
+  UrlLengthOverflow,
 }

 cfg_if! {
--- a/crates/utils/src/rate_limit/rate_limiter.rs
+++ b/crates/utils/src/rate_limit/rate_limiter.rs
@ -1,15 +1,15 @@
 use enum_map::EnumMap;
-use once_cell::sync::Lazy;
 use std::{
  collections::HashMap,
  hash::Hash,
  net::{IpAddr, Ipv4Addr, Ipv6Addr},
+  sync::LazyLock,
  time::Instant,
 };
 use strum::{AsRefStr, Display};
 use tracing::debug;

-static START_TIME: Lazy<Instant> = Lazy::new(Instant::now);
+static START_TIME: LazyLock<Instant> = LazyLock::new(Instant::now);

 /// Smaller than `std::time::Instant` because it uses a smaller integer for seconds and doesn't
 /// store nanoseconds
--- a/crates/utils/src/settings/mod.rs
+++ b/crates/utils/src/settings/mod.rs
@ -1,9 +1,8 @@
 use crate::{error::LemmyResult, location_info};
 use anyhow::{anyhow, Context};
 use deser_hjson::from_str;
-use once_cell::sync::Lazy;
 use regex::Regex;
-use std::{env, fs, io::Error};
+use std::{env, fs, io::Error, sync::LazyLock};
 use urlencoding::encode;

 pub mod structs;
@ -12,7 +11,7 @@ use structs::{DatabaseConnection, PictrsConfig, PictrsImageMode, Settings};

 static DEFAULT_CONFIG_FILE: &str = "config/config.hjson";

-pub static SETTINGS: Lazy<Settings> = Lazy::new(|| {
+pub static SETTINGS: LazyLock<Settings> = LazyLock::new(|| {
  if env::var("LEMMY_INITIALIZE_WITH_DEFAULT_SETTINGS").is_ok() {
    println!(
      "LEMMY_INITIALIZE_WITH_DEFAULT_SETTINGS was set, any configuration file has been ignored."
@ -24,7 +23,7 @@ pub static SETTINGS: Lazy<Settings> = Lazy::new(|| {
  }
 });

-static WEBFINGER_REGEX: Lazy<Regex> = Lazy::new(|| {
+static WEBFINGER_REGEX: LazyLock<Regex> = LazyLock::new(|| {
  Regex::new(&format!(
    "^acct:([a-zA-Z0-9_]{{3,}})@{}$",
    SETTINGS.hostname
--- a/crates/utils/src/utils/markdown/mod.rs
+++ b/crates/utils/src/utils/markdown/mod.rs
@ -1,14 +1,14 @@
 use crate::{error::LemmyResult, settings::SETTINGS, LemmyErrorType};
 use markdown_it::{plugins::cmark::inline::image::Image, MarkdownIt};
-use once_cell::sync::Lazy;
 use regex::RegexSet;
+use std::sync::LazyLock;
 use url::Url;
 use urlencoding::encode;

 mod link_rule;
 mod spoiler_rule;

-static MARKDOWN_PARSER: Lazy<MarkdownIt> = Lazy::new(|| {
+static MARKDOWN_PARSER: LazyLock<MarkdownIt> = LazyLock::new(|| {
  let mut parser = MarkdownIt::new();
  markdown_it::plugins::cmark::add(&mut parser);
  markdown_it::plugins::extra::add(&mut parser);
--- a/crates/utils/src/utils/markdown/spoiler_rule.rs
+++ b/crates/utils/src/utils/markdown/spoiler_rule.rs
@ -34,8 +34,8 @@ use markdown_it::{
  NodeValue,
  Renderer,
 };
-use once_cell::sync::Lazy;
 use regex::Regex;
+use std::sync::LazyLock;

 #[derive(Debug)]
 struct SpoilerBlock {
@ -46,8 +46,8 @@ const SPOILER_PREFIX: &str = "::: spoiler ";
 const SPOILER_SUFFIX: &str = ":::";
 const SPOILER_SUFFIX_NEWLINE: &str = ":::\n";

-static SPOILER_REGEX: Lazy<Regex> =
-  Lazy::new(|| Regex::new(r"^::: spoiler .*$").expect("compile spoiler markdown regex."));
+static SPOILER_REGEX: LazyLock<Regex> =
+  LazyLock::new(|| Regex::new(r"^::: spoiler .*$").expect("compile spoiler markdown regex."));

 impl NodeValue for SpoilerBlock {
  // Formats any node marked as a 'SpoilerBlock' into HTML.
--- a/crates/utils/src/utils/mention.rs
+++ b/crates/utils/src/utils/mention.rs
@ -1,8 +1,8 @@
 use itertools::Itertools;
-use once_cell::sync::Lazy;
 use regex::Regex;
+use std::sync::LazyLock;

-static MENTIONS_REGEX: Lazy<Regex> = Lazy::new(|| {
+static MENTIONS_REGEX: LazyLock<Regex> = LazyLock::new(|| {
  Regex::new(r"@(?P<name>[\w.]+)@(?P<domain>[a-zA-Z0-9._:-]+)").expect("compile regex")
 });
 // TODO nothing is done with community / group webfingers yet, so just ignore those for now
--- a/crates/utils/src/utils/validation.rs
+++ b/crates/utils/src/utils/validation.rs
@ -1,16 +1,16 @@
 use crate::error::{LemmyErrorExt, LemmyErrorType, LemmyResult};
 use itertools::Itertools;
-use once_cell::sync::Lazy;
 use regex::{Regex, RegexBuilder, RegexSet};
+use std::sync::LazyLock;
 use url::{ParseError, Url};

 // From here: https://github.com/vector-im/element-android/blob/develop/matrix-sdk-android/src/main/java/org/matrix/android/sdk/api/MatrixPatterns.kt#L35
-static VALID_MATRIX_ID_REGEX: Lazy<Regex> = Lazy::new(|| {
+static VALID_MATRIX_ID_REGEX: LazyLock<Regex> = LazyLock::new(|| {
  Regex::new(r"^@[A-Za-z0-9\x21-\x39\x3B-\x7F]+:[A-Za-z0-9.-]+(:[0-9]{2,5})?$")
    .expect("compile regex")
 });
 // taken from https://en.wikipedia.org/wiki/UTM_parameters
-static CLEAN_URL_PARAMS_REGEX: Lazy<Regex> = Lazy::new(|| {
+static CLEAN_URL_PARAMS_REGEX: LazyLock<Regex> = LazyLock::new(|| {
  Regex::new(
    r"^(utm_source|utm_medium|utm_campaign|utm_term|utm_content|gclid|gclsrc|dclid|fbclid)=",
  )
@ -21,6 +21,7 @@ const ALLOWED_POST_URL_SCHEMES: [&str; 3] = ["http", "https", "magnet"];
 const BODY_MAX_LENGTH: usize = 10000;
 const POST_BODY_MAX_LENGTH: usize = 50000;
 const BIO_MAX_LENGTH: usize = 300;
+const URL_MAX_LENGTH: usize = 2000;
 const ALT_TEXT_MAX_LENGTH: usize = 1500;
 const SITE_NAME_MAX_LENGTH: usize = 20;
 const SITE_NAME_MIN_LENGTH: usize = 1;
@ -87,12 +88,12 @@ fn has_newline(name: &str) -> bool {
 }

 pub fn is_valid_actor_name(name: &str, actor_name_max_length: usize) -> LemmyResult<()> {
-  static VALID_ACTOR_NAME_REGEX_EN: Lazy<Regex> =
-    Lazy::new(|| Regex::new(r"^[a-zA-Z0-9_]{3,}$").expect("compile regex"));
-  static VALID_ACTOR_NAME_REGEX_AR: Lazy<Regex> =
-    Lazy::new(|| Regex::new(r"^[\p{Arabic}0-9_]{3,}$").expect("compile regex"));
-  static VALID_ACTOR_NAME_REGEX_RU: Lazy<Regex> =
-    Lazy::new(|| Regex::new(r"^[\p{Cyrillic}0-9_]{3,}$").expect("compile regex"));
+  static VALID_ACTOR_NAME_REGEX_EN: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"^[a-zA-Z0-9_]{3,}$").expect("compile regex"));
+  static VALID_ACTOR_NAME_REGEX_AR: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"^[\p{Arabic}0-9_]{3,}$").expect("compile regex"));
+  static VALID_ACTOR_NAME_REGEX_RU: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"^[\p{Cyrillic}0-9_]{3,}$").expect("compile regex"));

  let check = name.chars().count() <= actor_name_max_length && !has_newline(name);

@ -284,11 +285,17 @@ pub fn check_site_visibility_valid(
  }
 }

-pub fn check_url_scheme(url: &Url) -> LemmyResult<()> {
+pub fn is_valid_url(url: &Url) -> LemmyResult<()> {
  if !ALLOWED_POST_URL_SCHEMES.contains(&url.scheme()) {
    Err(LemmyErrorType::InvalidUrlScheme)?
  }

+  max_length_check(
+    url.as_str(),
+    URL_MAX_LENGTH,
+    LemmyErrorType::UrlLengthOverflow,
+  )?;
+
  Ok(())
 }

@ -349,7 +356,6 @@ mod tests {
    utils::validation::{
      build_and_check_regex,
      check_site_visibility_valid,
-      check_url_scheme,
      check_urls_are_valid,
      clean_url_params,
      is_url_blocked,
@ -358,11 +364,13 @@ mod tests {
      is_valid_display_name,
      is_valid_matrix_id,
      is_valid_post_title,
+      is_valid_url,
      site_description_length_check,
      site_name_length_check,
      BIO_MAX_LENGTH,
      SITE_DESCRIPTION_MAX_LENGTH,
      SITE_NAME_MAX_LENGTH,
+      URL_MAX_LENGTH,
    },
  };
  use pretty_assertions::assert_eq;
@ -580,15 +588,27 @@ mod tests {
  }

  #[test]
-  fn test_check_url_scheme() -> LemmyResult<()> {
-    assert!(check_url_scheme(&Url::parse("http://example.com")?).is_ok());
-    assert!(check_url_scheme(&Url::parse("https://example.com")?).is_ok());
-    assert!(check_url_scheme(&Url::parse("https://example.com")?).is_ok());
-    assert!(check_url_scheme(&Url::parse("ftp://example.com")?).is_err());
-    assert!(check_url_scheme(&Url::parse("javascript:void")?).is_err());
+  fn test_check_url_valid() -> LemmyResult<()> {
+    assert!(is_valid_url(&Url::parse("http://example.com")?).is_ok());
+    assert!(is_valid_url(&Url::parse("https://example.com")?).is_ok());
+    assert!(is_valid_url(&Url::parse("https://example.com")?).is_ok());
+    assert!(is_valid_url(&Url::parse("ftp://example.com")?)
+      .is_err_and(|e| e.error_type.eq(&LemmyErrorType::InvalidUrlScheme)));
+    assert!(is_valid_url(&Url::parse("javascript:void")?)
+      .is_err_and(|e| e.error_type.eq(&LemmyErrorType::InvalidUrlScheme)));

    let magnet_link="magnet:?xt=urn:btih:4b390af3891e323778959d5abfff4b726510f14c&dn=Ravel%20Complete%20Piano%20Sheet%20Music%20-%20Public%20Domain&tr=udp%3A%2F%2Fopen.tracker.cl%3A1337%2Fannounce";
-    assert!(check_url_scheme(&Url::parse(magnet_link)?).is_ok());
+    assert!(is_valid_url(&Url::parse(magnet_link)?).is_ok());
+
+    // Also make sure the length overflow hits an error
+    let mut long_str = "http://example.com/test=".to_string();
+    for _ in 1..URL_MAX_LENGTH {
+      long_str.push('X');
+    }
+    let long_url = Url::parse(&long_str)?;
+    assert!(
+      is_valid_url(&long_url).is_err_and(|e| e.error_type.eq(&LemmyErrorType::UrlLengthOverflow))
+    );

    Ok(())
  }
--- a/crates/utils/translations
+++ b/crates/utils/translations
@ -1 +1 @@
-Subproject commit ee2cffac809ad466644f061ad79ac577b6c2e4fd
+Subproject commit bc9b5305769900c5a59d8f139f110e004085f92b
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@ -1,11 +1,11 @@
-# syntax=docker/dockerfile:1.8
-ARG RUST_VERSION=1.78
+# syntax=docker/dockerfile:1.9
+ARG RUST_VERSION=1.80
 ARG CARGO_BUILD_FEATURES=default
 ARG RUST_RELEASE_MODE=debug

 ARG AMD_BUILDER_IMAGE=rust:${RUST_VERSION}
 # Repo: https://github.com/raskyld/lemmy-cross-toolchains
-ARG ARM_BUILDER_IMAGE="ghcr.io/raskyld/aarch64-lemmy-linux-gnu:v0.3.0"
+ARG ARM_BUILDER_IMAGE="ghcr.io/raskyld/aarch64-lemmy-linux-gnu:v0.4.0"

 ARG AMD_RUNNER_IMAGE=debian:bookworm-slim
 ARG ARM_RUNNER_IMAGE=debian:bookworm-slim
--- a/docker/federation/docker-compose.yml
+++ b/docker/federation/docker-compose.yml
@ -20,7 +20,7 @@ x-lemmy-default: &lemmy-default
  restart: always

 x-postgres-default: &postgres-default
-  image: pgautoupgrade/pgautoupgrade:16-alpine
+  image: pgautoupgrade/pgautoupgrade:15-alpine
  environment:
    - POSTGRES_USER=lemmy
    - POSTGRES_PASSWORD=password
--- a/migrations/2024-08-03-155932_increase_post_url_max_length/down.sql
+++ b/migrations/2024-08-03-155932_increase_post_url_max_length/down.sql
@ -0,0 +1,3 @@
+ALTER TABLE post
+    ALTER COLUMN url TYPE varchar(512);
+
--- a/migrations/2024-08-03-155932_increase_post_url_max_length/up.sql
+++ b/migrations/2024-08-03-155932_increase_post_url_max_length/up.sql
@ -0,0 +1,5 @@
+-- Change the post url max limit to 2000
+-- From here: https://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers#417184
+ALTER TABLE post
+    ALTER COLUMN url TYPE varchar(2000);
+
--- a/renovate.json
+++ b/renovate.json
@ -1,5 +1,6 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
-  "schedule": ["before 4am on the first day of the month"]
+  "schedule": ["before 4am on the first day of the month"],
+  "automerge": true
 }