# Discourse Version 2.2

**URL:** https://meta.discourse.org/t/discourse-version-2-2/95438
**Category:** Announcements
**Tags:** release-notes
**Created:** [August 22, 2018, 10:58pm UTC](https://meta.discourse.org/t/discourse-version-2-2/95438 "2018-08-22T22:58:26Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 22, 2018, 10:58pm UTC](https://meta.discourse.org/t/discourse-version-2-2/95438/1 "2018-08-22T22:58:26Z")

</div>

### Focus

- ✅ Richer handling and tracking (admin and end user) of current logged in sessions and history. see: [Store more than one IP address per user - #6 by sam](https://meta.discourse.org/t/store-more-than-one-ip-address-per-user/24155/6) @nbianca

- ✅ improved category and tag topnav UX design to emphasize input and reduce “greyness”

- ✅ Notify users on conflict when saving a revision of a post that has changed [Editing wiki posts at same time as someone else sometimes loses revisions - #13 by sam](https://meta.discourse.org/t/editing-wiki-posts-at-same-time-as-someone-else-sometimes-loses-revisions/30741/13) @nbianca

- ✅ redesign search results UX to multi-pane view @awesomerobot

- ✅ Add wiki editor badge @nbianca

- ✅ For _some_ but not _all_ languages, accented characters might need to be ignored in search? (keep excerpts in tact) [Discourse should ignore if a character is accented when doing a search](https://meta.discourse.org/t/discourse-should-ignore-if-a-character-is-accented-when-doing-a-search/90198) @zogstrip

- ✅ Optional site setting to [prevent multiple sequential replies](https://meta.discourse.org/t/allow-only-x-consecutive-replies-in-the-same-topic/69756) by the same poster @nbianca

- ✅ Update Font Awesome to V5 and SVGs @awesomerobot / @pmusaraj

- ✅ Refactor poll storage to use proper database tables; add option to hide poll results until poll closes @zogstrip

- ✅ Fully support [CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) in Discourse for enhanced security @xrav3nz

- ✅ Move [category under topic title](https://meta.discourse.org/t/the-topic-list-doesnt-need-a-category-column/101352) in topic lists by default @awesomerobot

- ✅ [Allow disabling activation email for invited users](https://meta.discourse.org/t/allow-disabling-activation-email-for-invited-users/88426) @gerhard

- ✅ Ember 3.x upgrade @j.jaffeux

- ✅ full lazy loading of topic images, including low res blur placeholders @eviltrout

- ✅ [Discourse local dates need better presentation in emails](https://meta.discourse.org/t/discourse-local-dates-need-better-presentation-in-emails/87785) @j.jaffeux

- ✅ Move posts to new/existing personal messages @techAPJ

- ✅ Per-user font size selector @david

- ✅ reasonable theme export zip archive with metadata @david

### Codename

- ~~[Bhimbetka](https://meta.discourse.org/t/discourse-version-2-1/86339) v2.1~~
- [La Pasiega](https://en.wikipedia.org/wiki/Cave_of_La_Pasiega) v2.2 ←

### Start date

September 11th, 2018

### Planned release date

January 31, 2019

---

<div class="post-metadata">

### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil)
#### Post date: [February 1, 2019, 3:41pm UTC](https://meta.discourse.org/t/discourse-version-2-2/95438/4 "2019-02-01T15:41:47Z")

</div>

## NEW FEATURES

- When only option is “existing topic”, autofocus input field
- Fallback to logo\_url as last resort for opengraph image url
- Add the show user action to the user-card-after-username plugin outlet
- Add topic list before status plugin outlet for mobile
- Allow overriding text size from a different device (#6955)
- Allow setting font size per-device using a cookie (#6947)
- Support additional metadata in theme about.json (#6944)
- Add recipient avatars in PM topic list even if they not yet replied
- Import and export themes in a .tar.gz format (#6916)
- List unused theme components (#6924)
- Default block ahrefsbot crawler
- Default block semrushbot crawler
- Add total on stacked-chart tooltip (#6917)
- Do not autoclose topics due to user flagging that are authored by staff
- Adds a new chart report to track pageviews (#6913)
- Support for localized themes (#6848)
- Introduce ultra\_low priority queue
- Remove full quotes only from new posts. (#6862)
- Allow calling user destroyer without a transaction
- Consolidate likes notifications. (#6879)
- Enable CSP by default on new sites (#6873)
- Allow the base font size to be changed on a per-user basis (#6859)
- Allow staff to select existing message via ID or URL
- Plugin support for custom icons
- Allow extending CSP base-uri and object-src
- Set CSP base-uri and object-src to none (#6863)
- Remove option for Google Plus sharing (#6864)
- PWA compatibility checks in the Dashboard (#6850)
- Push post rebake regular task to low priority queue
- Keep the topic in closed status until the community flags are handled
- Add support for Twitter cards.
- Use email\_site\_title in From of digest emails
- Include “via `<site_name>`” in email From header
- Allow plugins to add custom emoji translations
- Topic timer for bumping a topic in the future
- Add S3 etag value to uploads table (#6795)
- Add setting to bypass sending redis CLIENT commands
- Remove global settings for redis sentinels
- Make auth\_redirect param options on user\_api\_keys
- Tighter limits on per cluster post rebakes
- Add rake task that resets ACL on every object in S3
- Display error message when category restriction is applied for tags
- Force rebake of all posts with images
- Store thumbnail algorithm version in optimized image table
- Allow custom HighlightJS languages
- Allow TL4 users to reset bump date
- Introduce lossy color optimization on resized pngs
- Move posts to new/existing PM (#6802)
- Poll’s min can be 0.
- Display avatars of PM recepients in small topic header when scrolling down
- Add `Top Uploads` report (#6825)
- Invalidate broken images cache on Rebuild HTML action
- Allow for custom excerpt BBCODE
- Support YouTube `rel` parameter
- Don’t create PM for successful automatic backups
- Add /conduct as an alias for /guidelines
- Show a blurry preview when lazy loading images
- Remove full quote only if first paragraph. (#6793)
- Prohibit S3 bucket reusage
- Improve backup stats on admin dashboard
- Rake task to list users which have been staff in the past month
- Adds security tab to dashboard (#6768)
- Require admins to re-validate their email addresses if they haven’t been seen for a number of days, configurable with the invalidate\_inactive\_admin\_email\_after\_days site setting. Social logins are also revoked. Default is 365 days.
- Adds site setting to let quotes on direct replies.
- Add short\_site\_description setting to be included in title tag on homepage
- Check if draft exists before starting a new one (#6755)
- Polyfill intersection observer for IE11 / iOS Safari
- Lazily Load Images as they scroll into the viewport.
- Full height swipe enabled menus
- Allow connecting associated accounts when two-factor is enabled (#6754)
- Activate users invited via email when invite is redeemed
- Option to use ruby-bbcode-to-md in bulk import script
- Web Share Target Support
- Remove full quotes of direct replies. (#6729)
- Improved deprecation warnings (#6722)
- Discourse.deprecate can report version
- Show avatar flair on group, badges and directory pages (#6732)
- Show autocomplete when enable\_inline\_emoji\_translation is true.
- Add support for inline emoji translation.
- Add ‘Advanced Test’ for admin panel.
- Filter topic and post web hook events by tags (#6726)
- Multisite support for S3 backup store (#6700)
- Disable notifications for small actions that are whispers
- Allow advanced specification of excerpts for posts
- Do not check consecutive replies for original poster. (#6714)
- Allow plugins and themes to extend the default CSP (#6704)
- Multisite support for S3 image stores (#6689)
- Setting for short title used by Android on homescreen
- Reimplement `SiteSetting.max_oneboxes_per_post`. (#6668)
- Make uploads:missing task compatible with s3 uploads
- If PM email bounced for staged user then alert in whisper reply (#6648)
- Refactoring and better handling of special cases (#6666)
- Allows html tooltips (#6665)
- Allows plugins to register no module files (#6664)
- Use translated name for ‘your email has been authenticated by’ (#6649)
- Allow logo URLs to be overridden easily using `reopenWidget()`
- Show post approvals in Moderation History (#6643)
- Scroll-based logo on mobile (#6632)
- Show change name of user in staff logs (#6647)
- Do not switch to JPEG unless you meet 75k byte savings
- Terms of Service v1.0.0
- Plugin outlets on about page
- Add new setting to force user edit last post. (#6571)
- Compute distance between logins to generate login alerts. (#6562)
- Report edit conflicts when saving draft. (#6585)
- Upload Site Settings. (#6573)
- Log password changes in UserHistory (#6600)
- Allow expanded posts to return user custom fields
- Add button to delete unused tags (#6587)
- Better handling of quotation marks in site text search
- Additional “related messages” section
- Update Font Awesome to v5.4.1 and SVGs (#6557)
- Adds ignored flags to most\_disagreed\_flags report (#6554)
- Add Noindex to robots.txt for disallowed routes
- Track how many user flags are agreed/disagreed/ignored
- Show added date when looking at group members
- New ‘simultaneous\_uploads’ site setting
- Add download script for Google Groups
- Suspicious logins report. (#6544)
- Revamps search-menu layout (#6543)
- Special offline support restricted to Android only
- Push related PMs to take first 3 slots
- Allow admins to control PWA display mode per user agent
- Adds a most disagreed flaggers report
- Hide muted categories from /categories list (#6531)
- Warn users via email about suspicious logins. (#6520)
- Add server:before-head-close-crawler outlet for plugins
- `[Experimental]` Content Security Policy (#6514)
- `[Experimental]` Content Security Policy (#6504)
- Add Wiki Editor badge. (#6511)
- Adds latest to user-api-key session scope
- New plugin outlets for user card customization
- Allow plugins to whitelist user custom fields for public display (#6499)
- Adds list#(unread|new) to user api key routes (#6494)
- New rake task to anonymize all users
- Upload tags from CSV (#6484)
- Allow multiple secrets for [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) provider
- Fullscreen composer mode on desktop
- Support backup uploads/downloads directly to/from S3.
- Log long running jobs in the defer queue
- Allow bulk removing users from a group
- XenForo importer can import categories from the xf\_node table and convert sub-categories beyond second level to tags
- Automatically hide non-TL4 posts when flagged by a TL4 user
- Add boxes with subcategories option for desktop categories page (#6471)
- Option to disable user presence and profile
- Support category slug when creating new topic via URL
- Show “Recently used devices” in user preferences (#6335)
- Added MaxMindDb to resolve IP information.
- Added browser detection based on user agent.
- Added recently used devices in user preferences.
- Add branch option to remote theme import
- Adds header text/background color to site (#6462)
- Post deployment migrations. (#6406)
- Only export settings that changed via rake task
- Mixed case tagging (#6454)
- Add indication if incoming email attachment was rejected and inform sender about it (#6376)
- Add indication if incoming email attachment was rejected and inform sender about it
- Enable the notification prompt by default
- Add support for responsive images in posts
- Change default to enable login by email out-of-the-box
- Notify admins when scheduling of backup fails
- Add Lithuanian locale
- Display trust level descriptions in site settings (#6421)
- Auto grant an available title when removing old title
- Do not allow moderators to export user list (#6418)
- Add external details to user fields
- Log entity export in staff logs
- New ‘search\_ignore\_accents’ site setting
- Match user title when primary group changes
- Unconditionally omit no-follow for staff
- Updated CORS config to explicitly specifyhttp methods
- Add SiteSetting for s3\_configure\_tombstone\_policy
- Don’t blow up when can’t reach theme’s repo, show problem themes on dashboard
- Updated IPB import script

---

<div class="post-metadata">

### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil)
#### Post date: [February 1, 2019, 3:42pm UTC](https://meta.discourse.org/t/discourse-version-2-2/95438/5 "2019-02-01T15:42:09Z")

</div>

## BUG FIXES

- Mobile button colors
- `PostActionCreator` was not checking the guardian properly
- Refresh admin/customize/themes route after import
- Imported themes should set their color scheme automatically
- Exporting themes when uploads are on S3
- New mailgun webhooks
- Google `HD` and `Prompt` settings should be checked at runtime
- Use absolute url for `/images/example.png` links
- Do not send welcome message to staged users
- Regression with composer warnings
- Email domain whitelist prevented user anonymizing
- Secondary email addresses were not deleted during anonymizing
- User\_id attribute not found in posters array
- Return 400 when username params is invalid.
- User and group mentions in subfolder installs
- Better error handling if a file cannot be sent
- More resilient lookup in plugin-api (#6961)
- Add autocomplete=off to composer textarea
- Class name for external-link on customize page
- More link in topic page search shouldn’t navigate to full page result
- Don’t duplicate attachments
- Support application/gzip theme imports, and improve error message
- Convert lightbox html into proper image markdown
- Javascript error when opening rename tag modal
- Heisentest
- Match drafts using key when deleting
- Prevents race condition where the same report is loaded multiple times (#6953)
- Properly handle attachments in received emails
- Circular argument reference
- Fix [safe mode](https://meta.discourse.org/t/53504?silent=true) regression
- Respect min\_flags\_staff\_visibility for new flags too
- Ensures ordering set in tags-show queryString works at first load (#6951)
- Makes staff\_logins show only admins (#6948)
- User\_id handling on remove user from group
- Do not show backups stored in subfolder of bucket
- Raise or log error when deleting of backup fails
- Use context sensitive “create topic” via keyboard if possible
- Ensures correct scroll position of textarea after autocomplete (#6942)
- Discourse-poll-option test wasn’t working
- Includes staff in staff\_logins report (#6945)
- Link to the user preferences page is incorrect in user admin page
- Replaces inline button message with d-button
- Allow sending PMs to staff via flag even when PMs are disabled (#6938)
- Allow sending PMs to staff via flag even when PMs are disabled
- Allow sending PMs to staff via flag even if the user trust level is insufficient
- Displays user-card when clicking on avatar of post small action (#6941)
- Lazy Loading: copy only present srcset
- Fix URL to user profile. (#6881)
- SiteNavigationElement was reversed (#6934)
- Stop propagating keyboard event when replying to topic/post (#6930)
- Corrects selector for move-to modal styles
- `migrate_to_s3` task not setting the right content\_disposition.
- ‘anon’ css class is missing for anonymous users
- Icon missing due to typo
- Keep tags when switching to shared draft
- Don’t notify of pending flags if min\_flags\_staff\_visibility not met
- Improves stacked-chart layout on ie11 (#6922)
- Better handling of resizing in stacked charts (#6921)
- Don’t update `User#last_seen_at` when PG is in readonly take 3.
- Don’t clear connections on failover.
- Clear connections before disabling readonly mode.
- Fallback Redis by checking status on master instead of slave.
- Clear anon cache when clearing recently readonly.
- Alignment for small-actions, gap, removing unneeded clearfix
- Whitespace breaks activity column in Firefox
- Badges appeared in wrong badge group
- IE11 layout glitches
- Don’t override user flair styles in topic map
- Better legend labels for stacked-charts (#6914)
- Incorrect subscription in `PostgreSQLFallbackHandler`.
- `ForumsController` doesn’t need to inherit from `ApplicationController`.
- Don’t update `User#last_seen_at` when PG is readonly take 2.
- Don’t update `User#last_seen_at` when PG is in readonly.
- Avoid throwing an error when processing PG down message.
- Don’t log request when Discourse is in readonly due to PG.
- Use ENV values instead of ‘S3Helper.s3\_options’ in migrate\_to\_s3
- Changing owner of small action post failed
- Update about/license URLs when updating theme from remote source
- Ensures visits reports are correcttly differencing mobile/all (#6905)
- PostLabel was not working for totals (#6904)
- Correct deprecated theme settings in handlebars templates
- Correctly import theme assets with spaces in filename
- Mods weren’t able to see emails in admin user list
- Keep original subject in emails to staged users
- Since Ember 3 interceptClick was not working on buffered links (#6898)
- Remove old reference and use `MiniScheduler::Stat`.
- Text logo does not show up on non ember pages.
- Refresh “/categories” on logo click (#6891)
- Refresh discovery categories on logo click
- Use ordered\_posts for last post check, not the posts relation
- Do not hide posts automatically when flagged by staff user
- Navigate to full page search when enter key used in topic
- Wrap theme javascript inside IIFE to prevent using global namespace
- Theme settings are referenced in JS by `settings`, not `themeSetting`
- Regression lead to a 404 when trying to filter user posts (#6893)
- Avoid rescuing error in login hint initializer.
- Liked notification consolidation has to account for user like frequency setting.
- Improve rake emails:test task
- Rake emails:test to bypass the “STARTTLS required” message
- Too much j
- Properly clean out post and user actions on destroy user
- Sort topics/posts/links in descending order in user summaries
- `Ember.warn` needs an `id`
- Makes click-interceptor working with touchstart (#6890)
- Makes whisper state more resilient (#6889)
- Only add the trust level name for numeric trust levels
- Add watching\_first\_post to NOTIFIABLE\_TYPES (#6887)
- Tweaking topic footer dropdowns (#6882)
- Use GlobalSetting values instead of ENV variables in migrate\_to\_s3
- Don’t show liked consolidated notification when frequency is never.
- Allow liked notifications consolidation to be disabled.
- Consolidated like notifications links to wrong user on user page.
- Liked notifications should not be consolidated across multiple users.
- Profile picture not showing up on user admin page
- Refresh topic list on logo click
- Prevent layout changes while images are lazy-loading
- Tooltip for unlisted topics wasn’t shown in topic list
- Prefix should precede folder path (follow-up on 10fbb07e)
- Call method only if it exists
- Include folder name in prefix for listing files on S3 (follow-up on 3ec38f5a)
- `expandAllPinned` was not resetting after visiting a category
- Use Handlebars 4.0.12
- List staff users within the last month
- Add meta details for user summary page
- Do not show PM topics when moving posts to an existing public topic (#6876)
- Do not show full name on summary page unless the setting is enabled
- Fix registration dialog popup for ‘full screen’ social logins
- CheckEmail was calling itself (#6878)
- Previous annotations were broken
- Show user avatar on User summary page (#6872)
- Correct copy for flag\_sockpuppets site setting
- Use correct version when generating file path for optimized image (#6871)
- Show title as home logo if title has been set and logo is blank.
- Use discourse route\_for function to check url route
- Prensence was overlapping with full-screen icon
- Ember3 regression, uses model as bufferedProperty for badges (#6875)
- Add missing “merge selected posts” icon
- Minor regression when acting on queued post
- Remove google+ from share\_links site setting
- Add missing copyright icon
- Remove expired subscription for push notifications
- Uses compiler version to force rebaking of themes (#6870)
- Show lock glyph to a user without permissions to see quote (#6854)
- Partial reply key search in email sent logs.
- Searching email logs by reply key (#6868)
- Push notifications didn’t work anymore
- Multisite DB was leaving old data in test mode
- Bump onebox version for gfycat aspect ratio fix
- Apply classes when lazily loading images
- Match default `<code>` padding to highlightjs padding
- Gyfcat onebox should have fixed aspect ratio videos
- Add topic status to flagged topics list
- Full page search results are unclickable
- Do not show #Uncategorized in category drop if setting is disabled (#6856)
- Ensure ember transitions do not get hijacked by discourse intercept-click
- Migrate\_to\_s3 rake task with folder path
- Enforce a fixed height on generic oneboxed videos
- Add compatibility for bucket folder paths in migrate\_to\_s3 task (#6855)
- Add compatibility for bucket folder paths in migrate\_to\_s3 task
- Remove trailing whitespace to fix build
- Always serve new avatar for previous version
- Set unique post key for a user outside of transaction.
- Use absolute URL for twitter:image tag
- Add more https hosts
- Properly escape embed url
- Better accept invite flow when user is invited via a link
- Improve topic small header alignment in mobile
- Emojis are hard :shrug:
- BuildTranslationTree was erroring when translations overlapped (ie. “:-)” and “:-))”)
- Emoji translations wasn’t working properly when translations overlapped
- Prevent error when badge has already been awarded
- Upload method in S3Helper will expect a file object param
- Image rendered temporarily in wrong position while loading
- Incorrect CDN URL for site setting uploads when s3 is enabled.
- Posting without bump raised an error for TL4
- Trim trailing slash from topic links
- Show accurate error message based on invite token validity
- Make full height menu and cloak respect custom headers (#6845)
- “Toggle topic bump” wasn’t visible for TL4 users
- Make full height menu and cloak respect custom headers
- Polls didn’t work in imported posts
- Make test less fragile.
- Pass all necessary options in `migrate_to_s3` rake task.
- Quote selection in IE11
- Validate poll arguments. (#6740)
- Validate number poll.
- Fix URL to user profile.
- Show error msg on grant badge if message available from backend (#6801)
- Calendar range was too wide (#6829)
- Reports issues with ie11 (#6828)
- Composer css fixes for ie11 (#6827)
- Uses `flex: 1 0 0;` instead of `flex: 1;` for better browser compat (#6826)
- Better left/right positioning in select-kit components (#6824)
- Less fancy pages computation for browser compatibility (#6823)
- RouteToTag mini-fix for IE11
- Limit previous IE SVG click event fix
- Recurrence was not applied when selected in the form (#6820)
- Optimize collapse/expand select-kit codepath (#6818)
- Remove storage\_stats from the list of reports, too specific (#6817)
- Delete dataset doesn’t work on safari
- Dates should also store recurring (#6814)
- Hashtags should work for non-english characters
- Don’t use `Redis#keys` in production.
- Validate YAML before save to avoid race condition
- Do not raise error if most liked user is deleted
- Hide group membership request button for existing members
- Gfycat oneboxing
- Show popup before bulk invite
- Resetting bump date shouldn’t fail when first post is hidden
- Narrative bot should ignore action on deleted post
- Subfolder path is missing in category permalinks after slug update
- Workaround for Edge issue with clicks on SVGs
- Raises an error if q param is empty in search page
- Use one-way binding to prevent unnecessary updates in site.periods
- Use correct post object when logging exception
- Skip adding sso diagnostics if sso object is nil
- Copy old status to new poll. (#6788)
- Bypass draft check when switching to shared draft. (#6782)
- Hide emails on admin user list for moderators (#6781)
- Move sso provider into its own class so it doesn’t interfere with sso client (#6767)
- Use CDN for logos and icons. (#6698)
- Preserve github fragment URL
- Ensure that multisite s3 uploads are tombstoned correctly (#6769)
- Ensure that multisite uploads are tombstoned into the correct paths
- Broken spec
- Allow sending test e-mails to any email address when disable\_email is set to non-staff (#6792)
- Disable multipart backup uploads to S3
- Font tag resulted in wrong email trimming
- Weird mixture of line breaks resulted in wrong email trimming
- Enabling readonly mode should clear anon cache as well.
- Rescue errors in job. (#6745)
- Properly reset controller of admin-user-index. (#6760)
- Strip remote url before import. (#6762)
- Adusts select-kit position even if not expanded (#6785)
- Ensures nothing is triggering rendering loop in after render (#6784)
- Clear anon cache when disabling readonly mode.
- Switch recently readonly mdoe cache to a `DistributedCache`.
- Use new key for delete topic to make it lowercased as all other buttons label around it (#6778)
- Create CORS rule on S3 only before a backup upload
- Makes more resilient select-kit positioning (#6776)
- Consistency about our response for invalid user id in `Admin::UsersController`.
- Clear the site\_contact\_username setting if the user’s staff privileges are revoked
- Use find\_by\_id method to prevent record not found exception
- Suspicious login detection (#6772)
- Only serialize group membership domains for administrators (#6771)
- Delete all posts in batches without hijack (#6747)
- Incorrect translation key on admin search logs.
- Apply original margin-bottom to fix position placeholder (#6764)
- Define actions on connector class early (#6763)
- Incorrect arguments were being passed to `Jobs::ClosePoll`.
- Remove slow platform detection from server side
- Always show filtered site settings
- Invalidating inactive admin emails should mark them as not active
- Do not bump topic when removing full quotes.
- Makes charts more resilient to resizing (#6758)
- Sidekiq fails to start if any of the multisite has problems.
- Support RTL languages in header menu
- Return authenticated=true when reconnecting
- Do not convert quote tags to markdown
- Show every voter only once. (#6746)
- URLs containing two # would fail to work
- Redirect to default homepage when visiting `/login`
- Use database to persist metadata during social registration (#6750)
- Category-drop initial state was incorrect (#6743)
- Don’t double add users to topic allowed users
- Exec\_params needs instrumentation
- Support connecting GitHub with existing accounts
- Add missing android icon
- Prioritize explicit ‘connect’ over matching by email
- Return 422 instead of 500 for invalid SSO signature (#6738)
- Only hide shared draft topics from `latest` (#6737)
- Do not serialize user fields unless they are specified for display (#6736)
- Posts would not auto rebake unless gravatar download was enabled
- Refactor lightbox mobile icon
- Wizard tries harder to find existing Welcome Topic
- `UserNotificationsHelper#logo\_url’ to work with S3 based uploads.
- Always allow admins upload selectable avatars.
- Properly secure poll message bus
- Ignore query parameters when displaying counter on internal links
- Do not reset link counts when post is rebaked
- Method extraction caused push notifications to include incorrect post
- Variable name typo in subcategory image
- Clamp integers to prevent ‘PG::NumericValueOutOfRange’ errors
- Improve avatar loading, and add tests
- Increase timeout when trying to reload unicorn.
- Use safe navigation operator throughout statement
- Topic is nil when first post is being created
- Use safe navigation operator when looking for avatar URL
- Tooltip regression in admin dashboard
- Fixed tests. (#6716)
- Raise exception when getting dimensions of missing image
- Don’t steal focus when text in editor is replaced (#6712)
- All multisite upload paths should start with /uploads/default/.. (#6707)
- Make staff\_edit\_locks\_post work with download\_remote\_images\_to\_local
- Show generic title when quoting off-topic secure category posts
- Do not store key tracking last seen time indefinitely
- Lightbox expand icon on mobile
- Add vkontakte icon alias
- Log name changes only when the name is actually updated
- Incoming email matches the wrong user if null bounce key available in db
- Redis leak when visiting large amounts of topics
- `Jobs::CleanUpUploads` fails when value of upload data\_type is an empty string.
- Refactor commit a8c3ca, add test
- Limit SvgSprite scan to string setting values
- Refactor ImageSizer.resize
- Call ImageSizer only if width/height are available
- Defer flags (only) when handling a flag and deleting replies (#6702)
- Prevent minimum\_required\_tags on category being set to null (#6703)
- Prevent minimum\_required\_tags on category being set to null
- More resilient whisper state between composer states (#6687)
- Call onSelect plugin callbacks for noop rows (#6682)
- Always prepend watching user timezone to previews (#6695)
- Error with tags enabled and no tags created (#6701)
- Fix query selecting users not accepting PMs.
- Use File.join for relative\_base\_url, fix spec
- Map discord/patreon FA5 icons for login buttons correctly
- Restrict logo width for small screens
- Throw error when link in reason for grant badge is an external link (#6690)
- Positioning issues with local-dates (#6693)
- Add FA Discourse icon, update setting instructions
- Get email address from email\_log if bounced with verp
- Script was missing newlines when generating hosts
- Create whisper post in PMs when bounces with verp and user is staged
- Title was repeating on about page
- Static page title should be consistent on client side and server side
- Makes sure we have a zone (#6686)
- Better fix for #ca84c06 (#6684)
- Fix editing built-in badges after removing `_.include`
- Revert to using \_.each (#6683)
- Better handling of same offset timezones (#6680)
- Set overridden param for customize site text query only when checkbox value changes
- Popular posts font weight in summary email
- Compares timezones on utc offset and not name (#6672)
- Removes country from timezone indicator (#6677)
- Resets timezone default after callback (#6675)
- Randomly failing QUnit test.
- Do not agree flags by default when deleting posts
- Enable caching on SVG sprites
- Uses appropriate z-index for tooltips (#6674)
- Notify only invited users about mentions in PMs
- Upwards scrolling occasionally broken
- Fix mentions for mixed case group names
- Bug and typo in admin user badges
- Group mentions missing after post processing.
- Incorrect “rel” used for apple icons in `<head>`.
- Alignment issue in PM inbox when bulk selecting
- Validate topic deletion when acting on a flag
- Properly migrate polls/votes stored as array
- Fix routes ending in `:username` for usernames containing periods (#6660)
- Auto-closing poll wasn’t working
- Fix broken theme field URLs. (#6622)
- Couldn’t delete users who voted on a poll
- Ensure poll options keep their order
- Don’t trigger header:hide-topic at the bottom on desktops
- Categories/delete\_categories can be undefined (#6657)
- Improves code, tests and utc handling of local-dates (#6644)
- Broken badge groupings modal UI (#6653)
- Use `Discourse.deprecate` instead of `Rails.logger.warn`
- Better alignment of badge selector and edit btn (#6651)
- Better alignment of groups header filters (#6650)
- Failed to delete post belonging to non-existent topic
- Remove unneeded keys from failed response
- Mention lookup should be case insensitive.
- Check whether group is mentionable by user when cooking post.
- Assign default value for category.findByIds method
- Staged users should not be mentionable.
- Wizard icons step fields have incorrect values.
- Give up migrating url site setting if endpoint doesn’t return data.
- Give up migration of URL site settings if there is an SSL error.
- Setting DISCOURSE\_S3\_REGION env variable had no effect
- A search term containing '& could lead to errors
- Make danger locale warning work with plugin locales (#6639)
- Raise `Discourse::NotFound` unless the user is present
- Respond with proper error message if user not found
- Raise `Discourse::NotFound` unless the topic is present
- Browser infinite recursion when editing post
- Never attempt to log invalid post numbers
- Handle nil topic value when removing allowed users
- Properly disable serializable attributes when poll plugin is disabled
- Handle nil user value on password reset
- Escape sso\_secret string when migrating to sso\_provider\_secret (#6634)
- Use count variable for pluralized string.
- Skip gsub for normalizing whitespaces when text is nil (#6631)
- Remove site settings override for deprecated url site settings.
- Clear theme cache when restoring
- Adds support for missing reports from old dashboard (#6624)
- Do not show nested user cards. (#6621)
- Show Google video preview on iOS devices
- Convert relative image url to absolute url
- Don’t show the Quote popup if posting is disabled
- Clear uploads cache on `SiteSetting.refresh!`.
- Job to clean up old URL settings when new setting has been set.
- S3 CDN for markdown it bundle
- S/save/finish for wizard exit early button (#6614)
- Select-kit items shouldn’t have flex-grow
- Improves category/tag drops header shortcuts (#6610)
- Avoid using absolute positioning for box category style in emails (#6607)
- Only use blockquote which is immediate child of aside
- Better handling of missing welcome topic in wizard (#6606)
- Make Discobot image tutorial accept URL that points to images.
- Only check for conflict on edit drafts
- Makes sure an hex is always at 6 chars (#6608)
- Change ‘max\_consecutive\_replies’ default to 3
- Reset bump date resets bumped\_at to the last regular post in topic (#6605)
- Only send originalText when we need to
- Don’t hide information from the card that is visible in the topic
- Change title when primary group changes (#6602)
- Category row title (#6597)
- ‘migrate\_from\_s3’ rake task should respect max sizes (#6598)
- Update logster to handle logging of invalid encoding strings
- Prevent uploads used in site settings from being deleted.
- Stricter `window.opener` checks (#6578)
- Cache url data for failed inline oneboxes
- Translation improvements for unused tags (d89ffbe)
- Opts is a hash in ‘log\_on\_user’
- Do not check for suspicious login when impersonating. (#6534)
- Do not check for suspicious login when impersonating.
- Handles not found reports in bulk loading (#6582)
- Improve performance for `Group.posts_for` (#6588)
- Don’t enqueue topics if the user can’t create them
- Fix/removes broken elements of old dashboard
- Fix vertical scrolling in modals
- Never redirect back to `/sso` it will cause a loop
- Ensure we never cache login redirects by mistake
- Relative links in translations should work with subfolder
- Do not display broken image on crawler/print view (#6575)
- Relative links in templates should work with subfolders
- Correct svg handling for images
- Clarify User.group\_locked\_trust\_level.
- Search within topic not working correctly in CJK
- Edit category tags select-kit inputs width were wrong (#6568)
- Disable flagging hidden posts
- Uses hex to compare images
- Don’t allow adding a value containing vertical bar char to the secret list
- Topic-map spec with VDOM and i18n plural (#6564)
- Don’t strip eml attachments from received emails
- Disables dates filtering on most\_disagreed\_flags report (#6556)
- Uses more semantically correct spans in post map (#6555)
- Use ‘require’ for dependencies. (#6552)
- Translation error
- Only extract script tags with certain types (#6553)
- We shouldn’t include topics when mobile view is enabled
- Do not create superflous sessions when logged on
- Do not leak information about post revisions. (#6536)
- Correct bookmark button class
- Return 400 for missing required params (#6546)
- Improve error handling for missing maxmind dbs
- Add ‘log in via link’ to email templates. (#6545)
- Fix ‘New Login Alert’ message. (#6539)
- Uploads didn’t work for subfolder anymore
- Sso provider copyedit
- Prevents y-axis labels to show useless/wrong values
- Flash authentication data not rendered in latest iOS safari browser
- Add `String.includes` polyfill for IE11
- Remove orientation from the webmanifest
- Add polyfill so that `Array.includes` works in IE11
- Ensures reports links are correct on subfolder installs
- Don’t seed flags if ids don’t exist
- Don’t use srcset on cropped thumbnails
- Do not update `last_seen` for API access
- Do not track right clicks. (#6530)
- Support comma in ‘sso\_provider\_secrets’ site setting
- Ensure the like button always has a title, for accessibility (#6525)
- GlobalPath#upload\_cdn\_path when S3 bucket has a folder (#6523)
- If poll has not options do not break serializer
- Remove duplicate referrer policy
- Strip accents from search query
- Validates import theme form (#6513)
- Stop logging every 404 error when searching for gravatars
- Fix order of recently connected devices. (#6517)
- Proper naming for the GNU/Linux OS
- Fix browser detection for Microsoft Edge. (#6516)
- Clean tag before searching for matches
- Sanitize tags before creation
- Count emoji shortcuts in topic title
- Prevent duplicate tags in tag-choosers (#6512)
- Prevent duplicate tags in tag-choosers
- Strip @ when searching for users and groups. (#6506)
- User `AvatarLookup` for looking up avatar details (#6508)
- Lowercase username for add/rem group members
- Always update ‘last\_gravatar\_download\_attempt’ when updating gravatar
- Properly import vBulletin’s hashed password
- Extracted theme JavaScripts for multisite (#6502)
- Extracted theme javascripts for multisite
- Wrap custom fields database statements in a transaction.
- Don’t rescue `PG::UniqueViolation` within a transaction.
- Discourse script didn’t allow backups with paths anymore
- Mbox importer and rake task were broken
- Use topic summary for meta description if topic excerpt is blank
- Closing an empty fullscreen composer with toggler prevents scrolling
- Support for local-date email preview without time attribute
- Do not set null value to remove cookie
- Clear color scheme cache when clearing theme cache
- Force enable a user’s email\_private\_messages option when user replies via email (#6478)
- Do not award badges for links in restricted categories. (#6492)
- Reduce amount of work onceoff does
- SSO provider secrets - check wildcard domains last, toggle secrets visibility
- Can’t clean a tag if the given string is frozen.
- Remove code that restricted “header” theme field from admin
- Keep emoji syntax for custom emojis in quotes (#6488)
- Don’t show empty user stats in the card when profile is hidden
- Make time attribute as optional for local-dates bbcode
- Do not allow revoking the token of current session. (#6472)
- Do not allow revoking the token of current session.
- Email preview content not updated in second local date
- Error looking at users in admin when tl3\_promotion\_min\_duration is set to a very high value
- Typo, should be `authentication`
- Do not use force timezone value in display timezone
- Don’t reply to Unsubscribe email sent to mailing list mirror
- Groups list does not refresh when query changes. (#6481)
- Allow theme edit route name to be overridden
- Fix open quote links in new window. (#6477)
- Properly escape name of custom emoji
- Strip null bytes in mail subjects.
- Multiple loadScript to the same url may resolve prematurely (#6474)
- Do not add lightbox to onebox images (#6479)
- ‘none’ tag page would not load
- Generate Onebox for posts of type moderator\_action. (#6466)
- `upload:migrate_to_s3` rake task not remapping properly.
- When associating Github account disassociate others
- Maxmind download task does not need environment
- Make error in Discourse Hub more descriptive. (#6438)
- Add missing variable in params
- Add missing param for import\_theme method
- Add missing space to scss style
- Add missing div start tag
- Allow\_uppercase\_posts didn’t work for topic titles
- Adds a title attribute on value list input (#6463)
- Raise if staged user creation failed (#6461)
- Convert tag string to array when filtering topic list by tags
- Safari issue with some emojis (#6456)
- Display large/broken image placeholders for image oneboxes
- Topic admin menu was clipped on short posts due to overflow hidden
- Redirect users to top when `latest` is the homepage
- Generate webhook payloads before destroy events (#6325)
- Stop logging every time invalid params are sent
- Redirect users to SSO client URL after social login
- Retry sending email in case of temporary issue. (#6375)
- Correctly censor strings starting or ending with non-word characters (#6445)
- Avoid redirection when not leaving forum. (#6419)
- Avoid redirection when not leaving forum.
- No longer educate users who are editing
- Edit checks for editing posts with no topic
- Display errors in single theme pages (#6449)
- Move overflow from cooked to parent element to allow for slight overflow of blur/italic/shadow
- Limit concurrent `assets:precompile` to number of available cores.
- `unicorn_launcher` should shut down unicorn gracefully.
- Keep files in order when adding multiple uploads (#6306)
- Keep files in order when adding multiple uploads
- Recover public actions (likes) when recovering a post (#6412)
- Corrects typo and adds a spec for likes report (#6439)
- Corrects typo and adds a spec for likes report
- `s3BaseUrl` with small s
- Sync client & server rules regarding tag names. (#6400)
- Force enable user PM emails option when user posts to a group by email.
- Don’t send multiple requests when changing category notification (#6435)
- Async reload of locales could result in missing translations
- Hide Delete Category button while creating a new category
- Onceoff job to fix missing user profile backgrounds.
- Close `data-preloaded` div tag
- Don’t update user\_profile URLs unless upload is persisted.
- Dashboard test depended on the last month has 31 days
- Advanced search ordering broken when using tags
- Correct compilation issues on clang 10
- Corrected copy on post\_edit\_time\_limit site setting
- Validate auto\_close\_hours category setting
- Make theme import’s public key field `readonly` (#6424)
- Links in TL1 promotion system message for subfolder installs
- Links in narrative bot messages for subfolder installs
- Do not revise post if post revision is not present
- Improved category merging in discourse\_merger. Use full paths to look for uniqueness instead of category names.
- Don’t try to recover an invalid sha1.
- Correct readonly timeout
- Avoid race condition when enqueuing job.
- Do not send tl1 welcome message when a user has the basic user badge
- Always unpause Sidekiq after backup and restore
- Backup logs were usually missing the first few lines
- Use a tmp file in `UploadRecovery` for local store.
- In redis readonly raise an exception from DistributedMutex
- User correct steam placeholder image url
- `UploadRecovery` should look at links too.
- Ensures onSelect/onDeselect are called
- Do not treat ignore\_redirects domains as blacklisted
- Moving upload to tombstone should update modification time.
- Tag groups page should only be visible to staff
- Error because last\_id is nil in discourse\_merger script
- Improves themes/components UI on mobile
- Allowes forcing timezone displayed in local-dates
- Permit unpinning an unlisted topic.
- Error in response body to blocked crawlers, showing 500 Internal Server Error with status of 403
- Don’t block api requests when whitelisted\_crawler\_user\_agents is set
- Poll modal date selector width
- Correctly keep stylesheet cache entries
- Onceoff job to recover missing post uploads.
- Don’t index urls to local files
- Ensures errors in report initialization fail nicely (#6392)
- Ensures we have a color for reports (#6396)
- Treats users\_(by\_type|tl) as other reports (#6391)
- Update PG gem
- Ignore and log bad json values for custom fields
- Do not try to recover invalid `Upload#short_url` in `UploadRecovery`.
- Remove div used to measure textarea position
- Allows forcing unsafe string in select-kit (#6386)
- Uploads not being linked correctly to posts.
- Display a correct error when attempting to agree on a deferred flag
- Use current user color scheme when filling `theme-color` attribute (#6384)
- Use current user color scheme when filling `meta` attribute `theme-color`
- Rescue ActiveRecord::RecordInvalid in find\_or\_create\_by\_safe! (#6385)
- “false” didn’t work as locale\_default
- Pop3 polling password and mailgun API key should be secret

---

<div class="post-metadata">

### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil)
#### Post date: [February 1, 2019, 3:42pm UTC](https://meta.discourse.org/t/discourse-version-2-2/95438/6 "2019-02-01T15:42:22Z")

</div>

## UX CHANGES

- Badge checkmarks should be round
- Overflow hidden was causing some icons to be cropped
- Make button icons use lighter color instead of opacity
- Add post action text in non-JS topic view
- Do not prepend `discourse` to theme filename if it’s already there
- Improves copy of various reports (#6950)
- Bump up notification panel width to accommodate larger text
- Improve global notice description
- Change topic reminder notification icon
- Removes width constraint in user-card badge section
- Use solid circle to indicate selected option in polls
- Protection for very wide category-logo images on narrow screens
- Removes margins from categories in suggested topics message
- Admin badge page improvements
- Improving aligment within topic timer modal
- Invert pikaday png for dark themes
- We don’t have bulk select on mobile, so we should hide the button
- Improve button alignment, fix invite header
- Improve alignment of new post badge on mobile
- Correct innacurate descriptions for short\_title, pwa\_config\_title\_warning
- Remove unused translations (#6885)
- Improving user stream alignment and spacing
- Badge alignment adjustments
- Bump up base font size 1px, add smaller text size option
- Improve short\_title SiteSetting description
- Improve logo setting texts to hint that dimensions are a requirement (#6892)
- Improve logo setting texts to hint that dimensions are a requirement
- Normalize all SiteSetting text dimensions to use the ‘512 × 512’ format
- Larger/Largest font-sizes should be 1px larger on mobile
- Soften dashboard warning PM
- Soften the “problems” alert on dashboard
- Improves dates display in emails (#6805)
- Sort admins and moderators by last seen date on /about page
- Only show active admins and moderators on /about page
- Use generic label for S3-compatible storage provider
- Better help text for private invite-only instance
- Reducing usage of btn-small, simplifying styles
- Don’t save automatically when resetting site settings in admin page.
- Close button shouldn’t get :visited color
- Always scope the composer categories dropdown to current category
- Search all categories even if category-chooser is scoped to particular category
- Use default H2 and H3 sizes on user profiles for better hierarchy
- Tag container should wrap if there’s a large number of tags
- Moves topic-list excerpts out of category / tag div
- Default search log index to yearly.
- No need for margin if participants is first-child
- Display user and group cards over the small PM header
- Improve PM small header alignment with recipient avatars
- Excerpts don’t wrap on IE11 (#6847)
- Update site setting description to match current function
- Remove gray background from lighbox
- Add group name next to PM recipient avatar
- Show generic message when reloading ‘activation email resent’ page
- Aligns categories and tags in topic lists
- Header needs a bit of padding on narrow screens
- Removes unnecessary margin in header tag wrapper
- Improves help text for admin and wizard logo settings
- Improves flags-status report (#6773)
- New site setting to define activity metrics displayed on dashboard
- Show lazy loaded images while they are downloading
- Adds missing wizard icons
- Switch placeholder to an SSH url if importing a private theme
- Adding reports dashboard tab, new layout, report descriptions (#6790)
- Use new FA5 icons on Backups tab
- Change default date range of dashboard trending search report to a month
- Improve dashboard report title copy
- Removes superfluous posters column header (#6765)
- Increase selector specificity so that “inline” lightboxes in quotes don’t get backgrounds
- Fix cropped image thumbnails
- Reduce show dismiss.. at top of unread/new to 15
- More consistent category lock and topic-status styles
- Add styling for updated twitter status icons in onebox
- Globally dim categories slightly
- When composer is minimized, let user open composer in regular size instead of full screen
- Dim visited post info along with title
- Add missing icons
- Refactoring topic statuses for consistent icon sizes & colors
- Make shared drafts behaviour consistent for non-staff users (#6734)
- Improve code highlighting diffs for dark themes
- Show smaller Emojis within some HTML elements
- Moving categories under topic title in topic list, removing category column (#6731)
- Wrap pre element.
- Truncate long topic tiles to prevent badges and date from wrapping
- Replace FA5 compress/expand icons
- Do not restrict width of category image, only height
- Strip class when link is not oneboxed due to site setting limits.
- Use aspect ratio to calculate width and height precisely
- Style group flair in /groups same as in topic avatars
- Topic stats were hard to translate
- Category images have no sizes (#6662)
- Better handling of logo size
- Add height attribute to logo on error pages
- Ensure unstyled `.btn-social` elements have a contrasting background
- Improving theme upload modal alignment, markup
- Contain site setting uploads within the div.
- More consistent category setting layout
- Leave room for floated radio input on mobile
- Fixes display issues in split to existing topic modal
- Better related messages condensed layout
- Shows a save changes for intermediate steps (#6612)
- Improve category reordering functionality
- Maintain aspect ratio of cropped image thumbnails
- Don’t show 0 vote count in crawler or print view
- Switch to neutral background color for image uploader in site settings.
- Improve copy for tag upload
- Condense layout when suggested and related messages are available
- Use header top to calculate docking position
- Minor tweaks to theme components selection UI (#6596)
- Take custom markup into account when docking header
- Improving group directory layout for small screens
- Rename Most Disagreed Flaggers report to “User Flagging Ratio”
- Inform users old dashboard is going to b removed (#6592)
- Trash icon displaying when there is no upload take 2.
- Trash icon displaying when there is no upload.
- Make long sign-up forms scrollable in modal
- Make the edits indicator a real link for accessibility (#6570)
- Adds new categories layouts to the wizard (#6569)
- Minor copyedit.
- Uses presentation role for accessibility in topic map (#6561)
- Don’t show crawler navigation in print view (#6551)
- Adds CSS classes to crawler navigation links
- Hide crawler navigation in print view
- Include subcategories in search result of all categories drop down
- Updates category muting instructions
- Remove “at” word from relative dates in local dates
- Use latitude and longitude for more precision.
- Use user locale for locations. (#6527)
- Use user locale for locations.
- Bumps the user-api-key version to 3 (#6526)
- Bumps the user-api-key version to 3
- Make title on Instagram less redundant
- Adding Google-compliant logo
- Increase size of topic title tap target on mobile
- Improve spacing on composer controls
- Allow vertical timeline to fit on narrower screens
- Show error when hitting the rate limit on password reset
- Warn users if the post that’s currently edited has changed. (#6498)
- Header items wrap on small screens for anon
- Presence-users overlaps with composer toggles
- Images should be responsive in embedded comments
- Add link to Groups in admin dashboard. (#6480)
- Add link to Groups in admin dashboard.
- Site settings have immediate effect.
- Make time attribute optional and set default timezones
- Use dashed underline for local dates
- Move Recently Used Devices to the bottom. (#6483)
- Use local timezone for “Insert date” modal result
- Use local timezone for insert date modal result
- Do not show ‘Show more’ button if there aren’t more tokens.
- Changes CSS class added to local dates
- Prompt for custom invite message was hard to translate
- Change staff actions logs user label
- Use ‘trash’ icon instead of ‘times’ for deleting small actions
- Disable button hover effects on touch devices
- Category colorpicker restyle
- Improve custom field layout on signup
- Make responsive\_post\_image\_sizes a visible site setting
- When admin is deleted, make it clear in staff action logs when records belong to a deleted user and show their username in the details
- Label of checkbox site setting needs a span for nested HTML
- Slightly taller progress bar for mobile
- Makes reports fade in when loading is done (#6440)
- Improve error messages for minimum and maximum username lengths.
- Confirmation before changing group membership in admin (#6426)
- Remove flex basis from first item
- Correct ordering of username / fullname in UX
- Updating style of mobile navigation dropdown
- Improve spacing & alignment for Category edit modal (#6432)
- Improve shared\_drafts\_category description
- Improve owner\_groups text to fit combo-box in a single line
- Improves topic-title flexbox alignment
- Remove double scrollbars from backup logs
- Removes bottom margins from inputs in admin controls
- Ensure ac-wrap input height matches other inputs
- Better padding for multi-select items
- Label alignment for Firefox / IE
- Select-kit filter input size fix
- Radio / checkbox inputs margin fix
- Last-seen input alignment fix
- Multi-select items alignment fixes
- General cleanup of inputs, buttons and select elements - part 1
- Lighter style for category and tag dropdown nav
- Improvements to admin theme UI

## SECURITY CHANGES

- Fix possible XSS with badges (#6912)
- Escape title HTML for inline onebox
- Users can pick non-avatar uploads.
- User could non-avatar uploads.
- Do not delete avatars uploads when deleting accounts
- Require groups to be given when inviting to a restricted category. (#6715)
- Enforce hostname to match discourse hostname
- Update rack from 2.0.5 to 2.0.6
- Add CSRF protections to OpenID callback
- Update loofah for CVE-2018-16468
- Only allow picking of avatars created by self (#6417)
- Only allow picking of avatars created by self
- Correct XSS on long topic titles
- Remove admin memory diagnostics routes

## PERFORMANCE

- Add index on `user_id` to `single_sign_on_records`.
- Delete potentially large associated tables before user\_destroyer.destroy transaction
- Bulk feature topic users & reset topic counters after an import
- Delete user and post actions vs destroy on user destroy
- Reduce workload when optimizing images
- Run sidekiq with nice 5
- Run ImageMagick conversions with nice 10
- Index on topic\_id for user\_histories table
- Remove image optimization throttling from Sidekiq
- New ‘migrate\_to\_s3’ rake task
- Automatic upload size calculation not persisted
- Eradicate N+1 queries from the theme admin page
- Use JSONP for SVG sprites so they are served from CDN
- Move processing of inline onebox out of V8 context. (#6658)
- Move mention lookups out of the V8 context. (#6640)
- Fix N+1 for non-staff users when tagging is enabled.
- Cache path for svg-sprite in upcoming FA5
- Try to match users before groups.
- Avoid left joins and distinct on posts\_for query
- Speed up `migrate_to_s3` rake task.
- Exclude tables when remapping in `migrate_to_s3` rake task.
- Reduce number of database queries for `DbHelper.remap`
- Use mini\_sql for the query
- Avoid DNS lookups when getting IP info
- Remove total unread notifications from message bus (#6529)
- Limit unread count to 99 in blue circle
- Limit unread count to 99 in the blue circle
- User imports would slow down the more users were imported
- Quit out of the email job quickly if disabled (#6423)

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 1, 2019, 9:45pm UTC](https://meta.discourse.org/t/discourse-version-2-2/95438/7 "2019-02-01T21:45:00Z")

</div>


