Ensure replied-to is a status not a boost (#9129)

* Ensure replied-to is a status not a boost

* Consider case of not a reply

* Add test case for replying to boost

* Move reblog-reply resolution to model

* Remove unnecessary comment

check_boxes label should use display: inline-block (#9348)

Sort self-replies to the top of descendants (#9320)

Fix #6463

Revert "Sort self-replies to the top of the thread (#9296)" (#9335)

This reverts commit 074960bb0fa59664c0ae1a35ef80301f5033700d.

Fix #9315

Bump simple_form from 4.0.1 to 4.1.0 (#9331)

Bumps [simple_form](https://github.com/plataformatec/simple_form) from 4.0.1 to 4.1.0.
- [Release notes](https://github.com/plataformatec/simple_form/releases)
- [Changelog](https://github.com/plataformatec/simple_form/blob/master/CHANGELOG.md)
- [Commits](https://github.com/plataformatec/simple_form/compare/v4.0.1...v4.1.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Fix connect timeout not being enforced (#9329)

* Fix connect timeout not being enforced

The loop was catching the timeout exception that should stop execution, so the next IP would no longer be within a timed block, which led to requests taking much longer than 10 seconds.

* Use timeout on each IP attempt, but limit to 2 attempts

* Fix code style issue

* Do not break Request#perform if no block given

* Update method stub in spec for Request

* Move timeout inside the begin/rescue block

* Use Resolv::DNS with timeout of 1 to get IP addresses

* Update Request spec to stub Resolv::DNS instead of Addrinfo

* Fix Resolve::DNS stubs in Request spec

Ignore JSON-LD profile in mime type comparison (#9179)

Ignore JSON-LD profile in mime type comparison

Bump sidekiq-bulk from 0.1.1 to 0.2.0 (#9306)

Bumps [sidekiq-bulk](https://github.com/aprescott/sidekiq-bulk) from 0.1.1 to 0.2.0.
- [Release notes](https://github.com/aprescott/sidekiq-bulk/releases)
- [Changelog](https://github.com/aprescott/sidekiq-bulk/blob/master/CHANGES.md)
- [Commits](https://github.com/aprescott/sidekiq-bulk/commits)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump aws-sdk-s3 from 1.24.0 to 1.25.0 (#9321)

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.24.0 to 1.25.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump capybara from 3.11.0 to 3.11.1 (#9305)

Bumps [capybara](https://github.com/teamcapybara/capybara) from 3.11.0 to 3.11.1.
- [Release notes](https://github.com/teamcapybara/capybara/releases)
- [Changelog](https://github.com/teamcapybara/capybara/blob/master/History.md)
- [Commits](https://github.com/teamcapybara/capybara/compare/3.11.0...3.11.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Include replies to list owner and replies to list members in list statuses (#9324)

Revert connect timeout from 1s to 10s (#9319)

The failure rate in Sidekiq is too high

Touch account on successful response, change char shown when culled (#9293)

Just the color is not enough change since not everyone uses colored
terminals.
Touching the account makes it so that the account is not in the
threshold window in case of running again

WebSub: ATOM before RSS (#9302)

Hello,
The ATOM feed contains the hub declaration for WebSub, but the RSS
version does not.
RSS/ATOM readers will typically pick whichever version comes first, and
will thus not see the WebSub feature.
I therefore suggest putting the ATOM version first, as it is more
feature-rich than its RSS counterpart is.

Clients not compatible with ATOM would not pick it anyway due to the
different type attribute.

A more complicated alternative would be to declare the WebSub feature in
the RSS version as well, using something like the following code, and
ensuring that clients subscribed to the RSS version would receive PuSH
updates just like those subscribed to the ATOM version.

````xml
<rss version="2.0" xmlns:webfeeds="http://webfeeds.org/rss/1.0"
xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
<atom:link rel="self" type="application/rss+xml"
href="https://diaspodon.fr/users/test.rss"/>
<atom:link rel="hub" href="https://diaspodon.fr/api/push"/>
</channel>
</rss>
```

Update Nginx config for Nanobox apps (#9310)

The Nanobox files have gotten out of sync, a touch, with what Masto needs for Nginx settings. This PR updates them accordingly.

Cast status_count to integer (#9314)

It is returned as a double because the sum is now over bigint columns

Fix #9312

Simplify hashtag query service, perf increase for 'any' tags (#9298)

Fix filter ID not being a string in REST API (#9303)

Extract counters from accounts table to account_stats table (#9295)

Deep compare tags for hashtag column reload (#9297)

* Deep compare tags for hashtag column reload

* Don't use global lodash

Prevent multiple handlers for Delete of Actor from running (#9292)

Sort self-replies to the top of the thread (#9296)

Fix #6463

Remove intermediary arrays when creating hash maps from results (#9291)

Bump aws-sdk-s3 from 1.23.1 to 1.24.0 (#9289)

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.23.1 to 1.24.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Change the password form order (#9267)

* Change order of password.

* Update Japanese translation for "Show thread".

* Separate the translation PR.

Fix "tootctl media remove" can't count the file size (#9288)

* Fixed an issue where "tootctl media remove" can not count the file size.

* Fixed the problem pointed out by codeclimate.

Update Japanese translation for "Show thread". (#9287)

Bump capybara from 3.10.1 to 3.11.0 (#9285)

Bumps [capybara](https://github.com/teamcapybara/capybara) from 3.10.1 to 3.11.0.
- [Release notes](https://github.com/teamcapybara/capybara/releases)
- [Changelog](https://github.com/teamcapybara/capybara/blob/master/History.md)
- [Commits](https://github.com/teamcapybara/capybara/compare/3.10.1...3.11.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Fix race condition causing shallow status with only a "favourited" attribute (#9272)

Fixes #9231

Fix null error introduced in #9270 (#9275)

Perform deep comparison for card data when receiving new props (#9270)

Fixes #9226

Bump parallel_tests from 2.26.2 to 2.27.0 (#9263)

Bumps [parallel_tests](https://github.com/grosser/parallel_tests) from 2.26.2 to 2.27.0.
- [Release notes](https://github.com/grosser/parallel_tests/releases)
- [Commits](https://github.com/grosser/parallel_tests/compare/v2.26.2...v2.27.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump thor from 0.20.0 to 0.20.3 (#9266)

Bumps [thor](https://github.com/wycats/thor) from 0.20.0 to 0.20.3.
- [Release notes](https://github.com/wycats/thor/releases)
- [Changelog](https://github.com/erikhuda/thor/blob/master/CHANGELOG.md)
- [Commits](https://github.com/wycats/thor/compare/v0.20.0...v0.20.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump oj from 3.7.0 to 3.7.1 (#9265)

Bumps [oj](https://github.com/ohler55/oj) from 3.7.0 to 3.7.1.
- [Release notes](https://github.com/ohler55/oj/releases)
- [Changelog](https://github.com/ohler55/oj/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ohler55/oj/compare/v3.7.0...v3.7.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump bullet from 5.8.1 to 5.9.0 (#9264)

Bumps [bullet](https://github.com/flyerhzm/bullet) from 5.8.1 to 5.9.0.
- [Release notes](https://github.com/flyerhzm/bullet/releases)
- [Changelog](https://github.com/flyerhzm/bullet/blob/master/CHANGELOG.md)
- [Commits](https://github.com/flyerhzm/bullet/compare/5.8.1...5.9.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Only consider mouse move in scrolling on item insertion (#9262)

Fixes #9259

i18n: Add ja translations (#9261)

* Run yarn manage:translations

* Add Japanese translations.

Fix emoji update date processing (#9255)

Check that twitter:player is valid before using it (#9254)

Fixes #9251

Fix loading indicator inconsistency (#9252)

* Use global loading indicator when loading more items

* Use local loading indicator for notifications

And remove global loading indicator for initial custom emojis load

Identify manual scrolling to cancel scroll to top reset on mouse idle (#9245)

Remove unused computation of reblog references from updateTimeline (#9244)

Improve ActiveRecord connection in on_worker_boot (#9238)

This is how it looks in the example in the Puma README

Bump tty-prompt from 0.17.1 to 0.17.2 (#9243)

Bumps [tty-prompt](https://github.com/piotrmurach/tty-prompt) from 0.17.1 to 0.17.2.
- [Release notes](https://github.com/piotrmurach/tty-prompt/releases)
- [Changelog](https://github.com/piotrmurach/tty-prompt/blob/master/CHANGELOG.md)
- [Commits](https://github.com/piotrmurach/tty-prompt/compare/v0.17.1...v0.17.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump sidekiq from 5.2.2 to 5.2.3 (#9241)

Bumps [sidekiq](https://github.com/mperham/sidekiq) from 5.2.2 to 5.2.3.
- [Release notes](https://github.com/mperham/sidekiq/releases)
- [Changelog](https://github.com/mperham/sidekiq/blob/master/Changes.md)
- [Commits](https://github.com/mperham/sidekiq/compare/v5.2.2...v5.2.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump pry-rails from 0.3.6 to 0.3.7 (#9242)

Bumps [pry-rails](https://github.com/rweng/pry-rails) from 0.3.6 to 0.3.7.
- [Release notes](https://github.com/rweng/pry-rails/releases)
- [Commits](https://github.com/rweng/pry-rails/compare/v0.3.6...v0.3.7)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump hiredis from 0.6.1 to 0.6.3 (#9240)

Bumps [hiredis](https://github.com/redis/hiredis-rb) from 0.6.1 to 0.6.3.
- [Release notes](https://github.com/redis/hiredis-rb/releases)
- [Changelog](https://github.com/redis/hiredis-rb/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/hiredis-rb/compare/v0.6.1...v0.6.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Fix nil error regression from #9229 in tootctl media remove (#9239)

Fix #9237

Reduce connect timeout limit and limit signature failures by source IP (#9236)

* Reduce connect timeout from 10s to 1s

* Limit failing signature verifications per source IP

Use local instead of global loading indicator for timelines, account timelines (#9224)

So that opening a profile feels faster. Also, pinned toots are not
shown before other toots have loaded. Also, if no toots are loaded,
added empty message

Bump bullet from 5.7.6 to 5.8.1 (#9156)

Bumps [bullet](https://github.com/flyerhzm/bullet) from 5.7.6 to 5.8.1.
- [Release notes](https://github.com/flyerhzm/bullet/releases)
- [Changelog](https://github.com/flyerhzm/bullet/blob/master/CHANGELOG.md)
- [Commits](https://github.com/flyerhzm/bullet/compare/5.7.6...5.8.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump parallel_tests from 2.26.0 to 2.26.2 (#9154)

Bumps [parallel_tests](https://github.com/grosser/parallel_tests) from 2.26.0 to 2.26.2.
- [Release notes](https://github.com/grosser/parallel_tests/releases)
- [Commits](https://github.com/grosser/parallel_tests/compare/v2.26.0...v2.26.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump aws-sdk-s3 from 1.23.0 to 1.23.1 (#9174)

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.23.0 to 1.23.1.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump capybara from 3.10.0 to 3.10.1 (#9216)

Bumps [capybara](https://github.com/teamcapybara/capybara) from 3.10.0 to 3.10.1.
- [Release notes](https://github.com/teamcapybara/capybara/releases)
- [Changelog](https://github.com/teamcapybara/capybara/blob/master/History.md)
- [Commits](https://github.com/teamcapybara/capybara/compare/3.10.0...3.10.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump pkg-config from 1.3.1 to 1.3.2 (#9215)

Bumps [pkg-config](https://github.com/ruby-gnome2/pkg-config) from 1.3.1 to 1.3.2.
- [Release notes](https://github.com/ruby-gnome2/pkg-config/releases)
- [Changelog](https://github.com/ruby-gnome2/pkg-config/blob/master/NEWS)
- [Commits](https://github.com/ruby-gnome2/pkg-config/compare/1.3.1...1.3.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Add "Show thread" link to self-replies (#9228)

Fix #4716

Display amount of freed disk space in tootctl media remove (#9229)

* Display amount of freed disk space in tootctl media remove

Fix #9213

* Fix code style issue

Fix form validation flash message color and input borders (#9235)

* Fix form validation flash message color and input borders

* Fix typo

Fix follow limit validator reporting lower number past threshold (#9230)

* Fix follow limit validator reporting lower number past threshold

* Avoid floating point follow limit

Optimize the process of following someone (#9220)

* Eliminate extra accounts select query from FollowService

* Optimistically update follow state in web UI and hide loading bar

Fix #6205

* Asynchronize NotifyService in FollowService

And fix failing test

* Skip Webfinger resolve routine when called from FollowService if possible

If an account is ActivityPub, then webfinger re-resolving is not necessary
when called from FollowService. Improve options of ResolveAccountService

Cancel list scroll reset after mouse move on wheel scroll (#9233)

- Use object properties rather than component state for
  mouseMovedRecently and scrollToTopOnMouseIdle flags

- Remove redundant scrollToTop prop call, also fixing an attempt to call
  an undefined prop.

Fixes #9217

Increase default column width from 330px to 350px (#9227)

[Security] Bump rack from 2.0.5 to 2.0.6 (#9214)

Bumps [rack](https://github.com/rack/rack) from 2.0.5 to 2.0.6. **This update includes security fixes.**
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rack/rack/compare/2.0.5...2.0.6)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump active_model_serializers from 0.10.7 to 0.10.8 (#9209)

Bumps [active_model_serializers](https://github.com/rails-api/active_model_serializers) from 0.10.7 to 0.10.8.
- [Release notes](https://github.com/rails-api/active_model_serializers/releases)
- [Changelog](https://github.com/rails-api/active_model_serializers/blob/master/CHANGELOG-0-10.md)
- [Commits](https://github.com/rails-api/active_model_serializers/compare/v0.10.7...v0.10.8)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Temporarily hold timeline if mouse moved recently (fixes #8630) (#9200)

- On recent mouse movement, hold timeline position so statuses remain in
  place for interactions in progress.

- If the timeline had been scrolled to the top before mouse movement,
  restore scroll on mouse idle.

Update resolve_url_service.rb (#9188)

Allow joining several hashtags in a single column (#8904)

* Nascent tag menu on frontend

* Hook up frontend to search

* Tag intersection backend first pass

* Update yarnlock

* WIP

* Fix for tags not searching correctly

* Make radio buttons function

* Simplify radio buttons with modeOption

* Better naming

* Rearrange options

* Add all/any/none functionality on backend

* Small PR cleanup

* Move to service from scope

* Small cleanup, add proper service tests

* Don't use send with user input :D

* Set appropriate column header

* Handle auto updating timeline

* Fix up toggle function

* Use tag value correctly

* A bit more correct to use 'self' rather than 'all' in status scope

* Fix some style issues

* Fix more code style issues

* Style select dropdown more better

* Only use to_id'ed value to ensure no SQL injection

* Revamp frontend to allow for multiple selects

* Update backend / col header to account for more flexible tagging

* Update brakeman ignore

* Codeclimate suggestions

* Fix presenter tag_url

* Implement initial PR feedback

* Handle additional tag streaming

* CodeClimate tweak

Implement adding a user to a list from their profile (#9062)

* Add add user to list from thier profile

* Fix listAdderCss

Check for empty "last_status" before sorting DM column (#9207)

* Check for empty "last_status" before sorting

* Small touchups for codeclimate

fix(reset): Property name for styled scrollbars (#9210)

https://webplatform.news/issues/2018-10-26

Bump rack-attack from 5.4.1 to 5.4.2 (#9186)

Bumps [rack-attack](https://github.com/kickstarter/rack-attack) from 5.4.1 to 5.4.2.
- [Release notes](https://github.com/kickstarter/rack-attack/releases)
- [Changelog](https://github.com/kickstarter/rack-attack/blob/master/CHANGELOG.md)
- [Commits](https://github.com/kickstarter/rack-attack/compare/v5.4.1...v5.4.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump redis from 4.0.2 to 4.0.3 (#9187)

Bumps [redis](https://github.com/redis/redis-rb) from 4.0.2 to 4.0.3.
- [Release notes](https://github.com/redis/redis-rb/releases)
- [Changelog](https://github.com/redis/redis-rb/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/redis-rb/compare/v4.0.2...v4.0.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump version to 2.6.1 (#9172)

Fix reducer error when conversation has no last status in web UI (#9173)

Fix #9170

Revert "Fix FetchAtomService  content type handling (#9132)" (#9171)

This reverts commit c36a4a16178441968715e13c77859b1eb813c2af.

Bump version to 2.6.0 (#9149)

* Bump version to 2.6.0

* Update CHANGELOG.md

[i18n] Update for Occitan (#9169)

* Update oc.json

* Update oc.yml

* Update simple_form.oc.yml

* Update simple_form.oc.yml

* Update oc.json

Remove progress estimate from MigrateAccountConversations (#9168)

Specify node version to not use node11 (#9166)

uWS has no support node11 yet.

Bump version to 2.6.0rc4 (#9164)

* Bump version to 2.6.0rc4

* Update CHANGELOG.md

Fix empty display name precedence over username in web UI (#9163)

Fix #9131

Fix td instead of th in sessions table header (#9162)

Fix #9130

Revert "feat(auth/session_controller): Send Clear-Site-Data when logging out (8627)" (#9161)

This reverts commit 10680f93e7d6333d43aabc4c6f251a076120231c.

Fix FetchAtomService  content type handling (#9132)

* Add profile to json+ld in Accept

It's required by the ActivityPub spec

* Use headers['Content-type'] instead of mime_type

mime_type strips the profile from the content type, but it's still available raw in the headers hash

* Add test for ld+json with profile

[i18n] Update for Occitan (#9157)

* Update oc.json

* Update devise.oc.yml

* Update oc.yml

* Update oc.json

Accept the same payload in multiple inboxes and deliver (#9150)

Always let through notifications from staff (#9152)

* Always let through notifications from staff

Follow-up to #8993

* Let messages from staff through, but no other notifications

Fix Pleroma mentions being fetched as preview cards (#9158)

[Security] Bump loofah from 2.2.2 to 2.2.3 (#9160)

Bumps [loofah](https://github.com/flavorjones/loofah) from 2.2.2 to 2.2.3. **This update includes security fixes.**
- [Release notes](https://github.com/flavorjones/loofah/releases)
- [Changelog](https://github.com/flavorjones/loofah/blob/master/CHANGELOG.md)
- [Commits](https://github.com/flavorjones/loofah/compare/v2.2.2...v2.2.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump oj from 3.6.12 to 3.7.0 (#9155)

Bumps [oj](https://github.com/ohler55/oj) from 3.6.12 to 3.7.0.
- [Release notes](https://github.com/ohler55/oj/releases)
- [Changelog](https://github.com/ohler55/oj/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ohler55/oj/compare/v3.6.12...v3.7.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Make detailed-status__wrapper actually wrap detailed status (#8547)

* Remove class from scrollable div

.detailed-status__wrapper does not actually wrap the detailed status here

* Re-add class to focusable div

.detailed-status__wrapper now wraps the detailed status instead of the entire scrollable area

Bump i18n-tasks from master to 0.9.28 (#9148)

RTL: fix toot privacy preferences radio buttonss (#9146)

RTL: fix preferences page checkbox margins (#9145)

* RTL: fix preferences page checkbox margins

* Update rtl.scss

Do not hide boost notifications from followed people with hidden boosts (#9147)

* Do not hide boost notifications from followed people with hidden boosts

Not displaying boosts from a followed user in the Home timeline and not
having notifications when they reblog your own content are two very
separate concerns, tying them together seem counter-intuitive and unwanted.

* Update specs accordingly

Bump version to 2.6.0rc3 (#9142)

* Bump version to 2.6.0rc3

* Update CHANGELOG.md

Update AUTHORS.md (#9141)

Bump sanitize from 4.6.6 to 5.0.0 (#9140)

Update i18n-tasks to master (#9139)

Improved grammar in German translation (#9092)

Just a grammar improvement.