Outstanding from 4.7.1

Nothing. Signing HTTP Message Signatures with Ed25519 or ML-DSA keys remains unimplemented, but so is it in Mastodon: local accounts' HTTP signatures are RSA on both sides. Both algorithms are verified inbound.

4.7.1 changed no schema — db/schema.rb is byte-identical to 4.7.0's, and the two migrations it touched only make an interrupted CREATE INDEX CONCURRENTLY re-runnable, which eunha's migration 008 avoids by building that index inside its transaction. Nor did it change a serializer, so entities.json is unchanged. It is three security fixes and five bug fixes, and none of them lands on code eunha has:

• Password bypass in 2FA for LDAP/PAM/SSO accounts (GHSA-vx32-x96w-qq65). external_or_valid_password? treated a blank encrypted_password as proof, so anyone could pass the first factor for an externally-authenticated account. Eunha authenticates against encrypted_password alone — no LDAP, no PAM, no SSO — and a blank hash parses as neither bcrypt nor argon2, so it fails rather than passes.

• Denial of service on pathological JSON-LD (GHSA-vgm8-frgh-rh2v). Upstream compacts a document carrying a signature before deciding whether to trust it, and the JSON-LD processor can be made to do unbounded work. Eunha does no JSON-LD expansion or compaction at all and processes no LD signature; what it reads of an inbound body is bounded by axum's 2MB default on the ActivityPub routes and serde_json's 128-deep recursion limit.

• Disabled staff keeping admin API access (GHSA-62j4-hvj7-px3f). The admin REST controllers never ran the permission check the web UI did, and the policy's role did not consider disabled. Eunha rejects a disabled user's token in middleware::authenticate, before routing — the account has no API access of any kind, not merely no admin API.

The rest are a Rails admin-UI form parameter, a Dockerfile Bootsnap path, and the mastodon:setup rake task, none of which eunha has. The one behavioural fix that touches something eunha does — invite_text_required? no longer treating any invite as reason enough to skip the invite text — lands on Setting.require_invite_text, which eunha does not implement.