Merge commit '7f808ff6e9148f1cfe1e16d000e2405b6e31f243' into bark-prod

2024-06-03 10:37:00 +02:00 · 2024-06-03 10:37:00 +02:00 · f64f159c17
commit f64f159c17
parent d6433a9aff 7f808ff6e9
532 changed files with 8597 additions and 3776 deletions
--- a/.devcontainer/docker-compose.yml
+++ b/.devcontainer/docker-compose.yml
@ -2,6 +2,7 @@ version: '3'

 services:
  app:
+    working_dir: /workspaces/mastodon/
    build:
      context: .
      dockerfile: Dockerfile
@ -70,7 +71,7 @@ services:
        hard: -1

  libretranslate:
-    image: libretranslate/libretranslate:v1.5.6
+    image: libretranslate/libretranslate:v1.5.7
    restart: unless-stopped
    volumes:
      - lt-data:/home/libretranslate/.local
--- a/.env.test
+++ b/.env.test
@ -4,7 +4,8 @@ NODE_ENV=production
 LOCAL_DOMAIN=cb6e6126.ngrok.io
 LOCAL_HTTPS=true

-# Required by ActiveRecord encryption feature
-ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=fkSxKD2bF396kdQbrP1EJ7WbU7ZgNokR
-ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=r0hvVmzBVsjxC7AMlwhOzmtc36ZCOS1E
-ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=PhdFyyfy5xJ7WVd2lWBpcPScRQHzRTNr
+# Secret values required by ActiveRecord encryption feature
+# Use `bin/rails db:encryption:init` to generate fresh secrets
+ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=test_determinist_key_DO_NOT_USE_IN_PRODUCTION
+ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=test_salt_DO_NOT_USE_IN_PRODUCTION
+ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=test_primary_key_DO_NOT_USE_IN_PRODUCTION
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@ -141,6 +141,13 @@
      matchUpdateTypes: ['patch', 'minor'],
      groupName: 'RSpec (non-major)',
    },
+    {
+      // Group all opentelemetry-ruby packages in the same PR
+      matchManagers: ['bundler'],
+      matchPackagePrefixes: ['opentelemetry-'],
+      matchUpdateTypes: ['patch', 'minor'],
+      groupName: 'opentelemetry-ruby (non-major)',
+    },
    // Add labels depending on package manager
    { matchManagers: ['npm', 'nvm'], addLabels: ['javascript'] },
    { matchManagers: ['bundler', 'ruby-version'], addLabels: ['ruby'] },
--- a/.github/stylelint-matcher.json
+++ b/.github/stylelint-matcher.json
@ -1,21 +0,0 @@
-{
-  "problemMatcher": [
-    {
-      "owner": "stylelint",
-      "pattern": [
-        {
-          "regexp": "^([^\\s].*)$",
-          "file": 1
-        },
-        {
-          "regexp": "^\\s+((\\d+):(\\d+))?\\s+(✖|×)\\s+(.*)\\s{2,}(.*)$",
-          "line": 2,
-          "column": 3,
-          "message": 5,
-          "code": 6,
-          "loop": true
-        }
-      ]
-    }
-  ]
-}
--- a/.github/workflows/crowdin-download.yml
+++ b/.github/workflows/crowdin-download.yml
@ -52,7 +52,7 @@ jobs:

      # Create or update the pull request
      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v6.0.4
+        uses: peter-evans/create-pull-request@v6.0.5
        with:
          commit-message: 'New Crowdin translations'
          title: 'New Crowdin Translations (automated)'
--- a/.github/workflows/lint-css.yml
+++ b/.github/workflows/lint-css.yml
@ -38,9 +38,5 @@ jobs:
      - name: Set up Javascript environment
        uses: ./.github/actions/setup-javascript

-      - uses: xt0rted/stylelint-problem-matcher@v1
-
-      - run: echo "::add-matcher::.github/stylelint-matcher.json"
-
      - name: Stylelint
-        run: yarn lint:css
+        run: yarn lint:css -f github
--- a/.github/workflows/test-ruby.yml
+++ b/.github/workflows/test-ruby.yml
@ -115,8 +115,8 @@ jobs:
      matrix:
        ruby-version:
          - '3.1'
+          - '3.2'
          - '.ruby-version'
-          - '3.3'
    steps:
      - uses: actions/checkout@v4

@ -145,6 +145,8 @@ jobs:
        uses: codecov/codecov-action@v4
        with:
          files: coverage/lcov/mastodon.lcov
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  test-e2e:
    name: End to End testing
@ -184,14 +186,16 @@ jobs:
      DISABLE_SIMPLECOV: true
      RAILS_ENV: test
      BUNDLE_WITH: test
+      LOCAL_DOMAIN: localhost:3000
+      LOCAL_HTTPS: false

    strategy:
      fail-fast: false
      matrix:
        ruby-version:
          - '3.1'
+          - '3.2'
          - '.ruby-version'
-          - '3.3'

    steps:
      - uses: actions/checkout@v4
@ -213,7 +217,7 @@ jobs:
      - name: Load database schema
        run: './bin/rails db:create db:schema:load db:seed'

-      - run: bundle exec rake spec:system
+      - run: bin/rspec spec/system --tag streaming --tag js

      - name: Archive logs
        uses: actions/upload-artifact@v4
@ -260,8 +264,8 @@ jobs:
        ports:
          - 6379:6379

-      search:
-        image: ${{ matrix.search-image }}
+      elasticsearch:
+        image: ${{ contains(matrix.search-image, 'elasticsearch') && matrix.search-image || '' }}
        env:
          discovery.type: single-node
          xpack.security.enabled: false
@ -273,6 +277,20 @@ jobs:
        ports:
          - 9200:9200

+      opensearch:
+        image: ${{ contains(matrix.search-image, 'opensearch') && matrix.search-image || '' }}
+        env:
+          discovery.type: single-node
+          DISABLE_INSTALL_DEMO_CONFIG: true
+          DISABLE_SECURITY_PLUGIN: true
+        options: >-
+          --health-cmd "curl http://localhost:9200/_cluster/health"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+        ports:
+          - 9200:9200
+
    env:
      DB_HOST: localhost
      DB_USER: postgres
@ -289,13 +307,15 @@ jobs:
      matrix:
        ruby-version:
          - '3.1'
+          - '3.2'
          - '.ruby-version'
-          - '3.3'
        search-image:
          - docker.elastic.co/elasticsearch/elasticsearch:7.17.13
        include:
          - ruby-version: '.ruby-version'
            search-image: docker.elastic.co/elasticsearch/elasticsearch:8.10.2
+          - ruby-version: '.ruby-version'
+            search-image: opensearchproject/opensearch:2

    steps:
      - uses: actions/checkout@v4
--- a/.nvmrc
+++ b/.nvmrc
@ -1 +1 @@
-20.12
+20.13
--- a/.rubocop.yml
+++ b/.rubocop.yml
@ -211,6 +211,11 @@ Style/PercentLiteralDelimiters:
 Style/RedundantBegin:
  Enabled: false

+# Reason: Prevailing style choice
+# https://docs.rubocop.org/rubocop/cops_style.html#styleredundantfetchblock
+Style/RedundantFetchBlock:
+  Enabled: false
+
 # Reason: Overridden to reduce implicit StandardError rescues
 # https://docs.rubocop.org/rubocop/cops_style.html#stylerescuestandarderror
 Style/RescueStandardError:
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@ -1,6 +1,6 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config --auto-gen-only-exclude --no-exclude-limit --no-offense-counts --no-auto-gen-timestamp`
-# using RuboCop version 1.62.1.
+# using RuboCop version 1.63.5.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
@ -42,14 +42,6 @@ RSpec/MultipleMemoizedHelpers:
 RSpec/NestedGroups:
  Max: 6

-# Configuration parameters: Include.
-# Include: app/models/**/*.rb
-Rails/HasAndBelongsToMany:
-  Exclude:
-    - 'app/models/concerns/account/associations.rb'
-    - 'app/models/status.rb'
-    - 'app/models/tag.rb'
-
 Rails/OutputSafety:
  Exclude:
    - 'config/initializers/simple_form.rb'
@ -62,10 +54,6 @@ Style/ClassEqualityComparison:
    - 'app/helpers/jsonld_helper.rb'
    - 'app/serializers/activitypub/outbox_serializer.rb'

-Style/ClassVars:
-  Exclude:
-    - 'config/initializers/devise.rb'
-
 # This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: AllowedVars.
 Style/FetchEnvVar:
@ -82,7 +70,7 @@ Style/FetchEnvVar:
    - 'config/initializers/vapid.rb'
    - 'lib/mastodon/redis_config.rb'
    - 'lib/tasks/repo.rake'
-    - 'spec/features/profile_spec.rb'
+    - 'spec/system/profile_spec.rb'

 # This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: EnforcedStyle, MaxUnannotatedPlaceholdersAllowed, AllowedMethods, AllowedPatterns.
@ -134,13 +122,6 @@ Style/HashTransformValues:
    - 'app/serializers/rest/web_push_subscription_serializer.rb'
    - 'app/services/import_service.rb'

-# This cop supports safe autocorrection (--autocorrect).
-Style/IfUnlessModifier:
-  Exclude:
-    - 'config/environments/production.rb'
-    - 'config/initializers/devise.rb'
-    - 'config/initializers/ffmpeg.rb'
-
 # This cop supports unsafe autocorrection (--autocorrect-all).
 Style/MapToHash:
  Exclude:
@ -188,16 +169,6 @@ Style/RedundantConstantBase:
    - 'config/environments/production.rb'
    - 'config/initializers/sidekiq.rb'

-# This cop supports unsafe autocorrection (--autocorrect-all).
-# Configuration parameters: SafeForConstants.
-Style/RedundantFetchBlock:
-  Exclude:
-    - 'config/initializers/1_hosts.rb'
-    - 'config/initializers/chewy.rb'
-    - 'config/initializers/devise.rb'
-    - 'config/initializers/paperclip.rb'
-    - 'config/puma.rb'
-
 # This cop supports unsafe autocorrection (--autocorrect-all).
 # Configuration parameters: ConvertCodeThatCanStartToReturnNil, AllowedMethods, MaxChainLength.
 # AllowedMethods: present?, blank?, presence, try, try!
@ -205,20 +176,6 @@ Style/SafeNavigation:
  Exclude:
    - 'app/models/concerns/account/finder_concern.rb'

-# This cop supports safe autocorrection (--autocorrect).
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: only_raise, only_fail, semantic
-Style/SignalException:
-  Exclude:
-    - 'lib/devise/strategies/two_factor_ldap_authenticatable.rb'
-    - 'lib/devise/strategies/two_factor_pam_authenticatable.rb'
-
-# This cop supports unsafe autocorrection (--autocorrect-all).
-# Configuration parameters: Mode.
-Style/StringConcatenation:
-  Exclude:
-    - 'config/initializers/paperclip.rb'
-
 # This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: WordRegex.
 # SupportedStyles: percent, brackets
--- a/.ruby-version
+++ b/.ruby-version
@ -1 +1 @@
-3.2.4
+3.3.1
--- a/.simplecov
+++ b/.simplecov
@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-if ENV['CI']
-  require 'simplecov-lcov'
-  SimpleCov::Formatter::LcovFormatter.config.report_with_single_file = true
-  SimpleCov.formatter = SimpleCov::Formatter::LcovFormatter
-else
-  SimpleCov.formatter = SimpleCov::Formatter::HTMLFormatter
-end
-
-SimpleCov.start 'rails' do
-  enable_coverage :branch
-
-  add_filter 'lib/linter'
-
-  add_group 'Libraries', 'lib'
-  add_group 'Policies', 'app/policies'
-  add_group 'Presenters', 'app/presenters'
-  add_group 'Serializers', 'app/serializers'
-  add_group 'Services', 'app/services'
-  add_group 'Validators', 'app/validators'
-end
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -2,6 +2,61 @@

 All notable changes to this project will be documented in this file.

+## [4.2.9] - 2024-05-30
+
+### Security
+
+- Update dependencies
+- Fix private mention filtering ([GHSA-5fq7-3p3j-9vrf](https://github.com/mastodon/mastodon/security/advisories/GHSA-5fq7-3p3j-9vrf))
+- Fix password change endpoint not being rate-limited ([GHSA-q3rg-xx5v-4mxh](https://github.com/mastodon/mastodon/security/advisories/GHSA-q3rg-xx5v-4mxh))
+- Add hardening around rate-limit bypass ([GHSA-c2r5-cfqr-c553](https://github.com/mastodon/mastodon/security/advisories/GHSA-c2r5-cfqr-c553))
+
+### Added
+
+- Add rate-limit on OAuth application registration ([ThisIsMissEm](https://github.com/mastodon/mastodon/pull/30316))
+- Add fallback redirection when getting a webfinger query `WEB_DOMAIN@WEB_DOMAIN` ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/28592))
+- Add `digest` attribute to `Admin::DomainBlock` entity in REST API ([ThisIsMissEm](https://github.com/mastodon/mastodon/pull/29092))
+
+### Removed
+
+- Remove superfluous application-level caching in some controllers ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/29862))
+- Remove aggressive OAuth application vacuuming ([ThisIsMissEm](https://github.com/mastodon/mastodon/pull/30316))
+
+### Fixed
+
+- Fix leaking Elasticsearch connections in Sidekiq processes ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/30450))
+- Fix language of remote posts not being recognized when using unusual casing ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/30403))
+- Fix off-by-one in `tootctl media` commands ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/30306))
+- Fix removal of allowed domains (in `LIMITED_FEDERATION_MODE`) not being recorded in the audit log ([ThisIsMissEm](https://github.com/mastodon/mastodon/pull/30125))
+- Fix not being able to block a subdomain of an already-blocked domain through the API ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/30119))
+- Fix `Idempotency-Key` being ignored when scheduling a post ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/30084))
+- Fix crash when supplying the `FFMPEG_BINARY` environment variable ([timothyjrogers](https://github.com/mastodon/mastodon/pull/30022))
+- Fix improper email address validation ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/29838))
+- Fix results/query in `api/v1/featured_tags/suggestions` ([mjankowski](https://github.com/mastodon/mastodon/pull/29597))
+- Fix unblocking internationalized domain names under certain conditions ([tribela](https://github.com/mastodon/mastodon/pull/29530))
+- Fix admin account created by `mastodon:setup` not being auto-approved ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/29379))
+- Fix reference to non-existent var in CLI maintenance command ([mjankowski](https://github.com/mastodon/mastodon/pull/28363))
+
+## [4.2.8] - 2024-02-23
+
+### Added
+
+- Add hourly task to automatically require approval for new registrations in the absence of moderators ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/29318), [ClearlyClaire](https://github.com/mastodon/mastodon/pull/29355))
+  In order to prevent future abandoned Mastodon servers from being used for spam, harassment and other malicious activity, Mastodon will now automatically switch new user registrations to require moderator approval whenever they are left open and no activity (including non-moderation actions from apps) from any logged-in user with permission to access moderation reports has been detected in a full week.
+  When this happens, users with the permission to change server settings will receive an email notification.
+  This feature is disabled when `EMAIL_DOMAIN_ALLOWLIST` is used, and can also be disabled with `DISABLE_AUTOMATIC_SWITCHING_TO_APPROVED_REGISTRATIONS=true`.
+
+### Changed
+
+- Change registrations to be closed by default on new installations ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/29280))
+  If you are running a server and never changed your registrations mode from the default, updating will automatically close your registrations.
+  Simply re-enable them through the administration interface or using `tootctl settings registrations open` if you want to enable them again.
+
+### Fixed
+
+- Fix processing of remote ActivityPub actors making use of `Link` objects as `Image` `url` ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/29335))
+- Fix link verifications when page size exceeds 1MB ([ClearlyClaire](https://github.com/mastodon/mastodon/pull/29358))
+
 ## [4.2.7] - 2024-02-16

 ### Fixed
--- a/6
+++ b/6
@ -7,15 +7,15 @@
 ARG TARGETPLATFORM=${TARGETPLATFORM}
 ARG BUILDPLATFORM=${BUILDPLATFORM}

-# Ruby image to use for base image, change with [--build-arg RUBY_VERSION="3.2.4"]
-ARG RUBY_VERSION="3.2.4"
+# Ruby image to use for base image, change with [--build-arg RUBY_VERSION="3.3.1"]
+ARG RUBY_VERSION="3.3.1"
 # # Node version to use in base image, change with [--build-arg NODE_MAJOR_VERSION="20"]
 ARG NODE_MAJOR_VERSION="20"
 # Debian image to use for base image, change with [--build-arg DEBIAN_VERSION="bookworm"]
 ARG DEBIAN_VERSION="bookworm"
 # Node image to use for base image based on combined variables (ex: 20-bookworm-slim)
 FROM docker.io/node:${NODE_MAJOR_VERSION}-${DEBIAN_VERSION}-slim as node
-# Ruby image to use for base image based on combined variables (ex: 3.2.4-slim-bookworm)
+# Ruby image to use for base image based on combined variables (ex: 3.3.1-slim-bookworm)
 FROM docker.io/ruby:${RUBY_VERSION}-slim-${DEBIAN_VERSION} as ruby

 # Resulting version string is vX.X.X-MASTODON_VERSION_PRERELEASE+MASTODON_VERSION_METADATA
--- a/28
+++ b/28
@ -31,7 +31,7 @@ gem 'browser'
 gem 'charlock_holmes', '~> 0.7.7'
 gem 'chewy', '~> 7.3'
 gem 'devise', '~> 4.9'
-gem 'devise-two-factor', '~> 4.1'
+gem 'devise-two-factor'

 group :pam_authentication, optional: true do
  gem 'devise_pam_authenticatable2', '~> 9.2'
@ -57,7 +57,7 @@ gem 'htmlentities', '~> 4.3'
 gem 'http', '~> 5.2.0'
 gem 'http_accept_language', '~> 2.1'
 gem 'httplog', '~> 1.6.2'
-gem 'i18n', '1.14.1' # TODO: Remove version when resolved: https://github.com/glebm/i18n-tasks/issues/552 / https://github.com/ruby-i18n/i18n/pull/688
+gem 'i18n'
 gem 'idn-ruby', require: 'idn'
 gem 'inline_svg'
 gem 'kaminari', '~> 1.2'
@ -103,6 +103,26 @@ gem 'rdf-normalize', '~> 0.5'

 gem 'private_address_check', '~> 0.5'

+gem 'opentelemetry-api', '~> 1.2.5'
+
+group :opentelemetry do
+  gem 'opentelemetry-exporter-otlp', '~> 0.26.3', require: false
+  gem 'opentelemetry-instrumentation-active_job', '~> 0.7.1', require: false
+  gem 'opentelemetry-instrumentation-active_model_serializers', '~> 0.20.1', require: false
+  gem 'opentelemetry-instrumentation-concurrent_ruby', '~> 0.21.2', require: false
+  gem 'opentelemetry-instrumentation-excon', '~> 0.22.0', require: false
+  gem 'opentelemetry-instrumentation-faraday', '~> 0.24.1', require: false
+  gem 'opentelemetry-instrumentation-http', '~> 0.23.2', require: false
+  gem 'opentelemetry-instrumentation-http_client', '~> 0.22.3', require: false
+  gem 'opentelemetry-instrumentation-net_http', '~> 0.22.4', require: false
+  gem 'opentelemetry-instrumentation-pg', '~> 0.27.1', require: false
+  gem 'opentelemetry-instrumentation-rack', '~> 0.24.1', require: false
+  gem 'opentelemetry-instrumentation-rails', '~> 0.30.0', require: false
+  gem 'opentelemetry-instrumentation-redis', '~> 0.25.3', require: false
+  gem 'opentelemetry-instrumentation-sidekiq', '~> 0.25.2', require: false
+  gem 'opentelemetry-sdk', '~> 1.4', require: false
+end
+
 group :test do
  # Adds RSpec Error/Warning annotations to GitHub PRs on the Files tab
  gem 'rspec-github', '~> 2.4', require: false
@ -114,7 +134,7 @@ group :test do
  gem 'email_spec'

  # Extra RSpec extension methods and helpers for sidekiq
-  gem 'rspec-sidekiq', '~> 4.0'
+  gem 'rspec-sidekiq', '~> 5.0'

  # Browser integration testing
  gem 'capybara', '~> 3.39'
@ -160,7 +180,7 @@ group :development do

  # Preview mail in the browser
  gem 'letter_opener', '~> 1.8'
-  gem 'letter_opener_web', '~> 2.0'
+  gem 'letter_opener_web', '~> 3.0'

  # Security analysis CLI tools
  gem 'brakeman', '~> 6.0', require: false
--- a/Gemfile.lock
+++ b/Gemfile.lock
@ -10,35 +10,35 @@ GIT
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actioncable (7.1.3.3)
+      actionpack (= 7.1.3.3)
+      activesupport (= 7.1.3.3)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
-    actionmailbox (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activejob (= 7.1.3.2)
-      activerecord (= 7.1.3.2)
-      activestorage (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actionmailbox (7.1.3.3)
+      actionpack (= 7.1.3.3)
+      activejob (= 7.1.3.3)
+      activerecord (= 7.1.3.3)
+      activestorage (= 7.1.3.3)
+      activesupport (= 7.1.3.3)
      mail (>= 2.7.1)
      net-imap
      net-pop
      net-smtp
-    actionmailer (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      actionview (= 7.1.3.2)
-      activejob (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actionmailer (7.1.3.3)
+      actionpack (= 7.1.3.3)
+      actionview (= 7.1.3.3)
+      activejob (= 7.1.3.3)
+      activesupport (= 7.1.3.3)
      mail (~> 2.5, >= 2.5.4)
      net-imap
      net-pop
      net-smtp
      rails-dom-testing (~> 2.2)
-    actionpack (7.1.3.2)
-      actionview (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actionpack (7.1.3.3)
+      actionview (= 7.1.3.3)
+      activesupport (= 7.1.3.3)
      nokogiri (>= 1.8.5)
      racc
      rack (>= 2.2.4)
@ -46,15 +46,15 @@ GEM
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    actiontext (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activerecord (= 7.1.3.2)
-      activestorage (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actiontext (7.1.3.3)
+      actionpack (= 7.1.3.3)
+      activerecord (= 7.1.3.3)
+      activestorage (= 7.1.3.3)
+      activesupport (= 7.1.3.3)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actionview (7.1.3.3)
+      activesupport (= 7.1.3.3)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
@ -64,22 +64,22 @@ GEM
      activemodel (>= 4.1)
      case_transform (>= 0.2)
      jsonapi-renderer (>= 0.1.1.beta1, < 0.3)
-    activejob (7.1.3.2)
-      activesupport (= 7.1.3.2)
+    activejob (7.1.3.3)
+      activesupport (= 7.1.3.3)
      globalid (>= 0.3.6)
-    activemodel (7.1.3.2)
-      activesupport (= 7.1.3.2)
-    activerecord (7.1.3.2)
-      activemodel (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    activemodel (7.1.3.3)
+      activesupport (= 7.1.3.3)
+    activerecord (7.1.3.3)
+      activemodel (= 7.1.3.3)
+      activesupport (= 7.1.3.3)
      timeout (>= 0.4.0)
-    activestorage (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activejob (= 7.1.3.2)
-      activerecord (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    activestorage (7.1.3.3)
+      actionpack (= 7.1.3.3)
+      activejob (= 7.1.3.3)
+      activerecord (= 7.1.3.3)
+      activesupport (= 7.1.3.3)
      marcel (~> 1.0)
-    activesupport (7.1.3.2)
+    activesupport (7.1.3.3)
      base64
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
@ -97,22 +97,20 @@ GEM
      activerecord (>= 3.2, < 8.0)
      rake (>= 10.4, < 14.0)
    ast (2.4.2)
-    attr_encrypted (4.0.0)
-      encryptor (~> 3.0.0)
    attr_required (1.0.2)
    awrence (1.2.1)
    aws-eventstream (1.3.0)
-    aws-partitions (1.916.0)
-    aws-sdk-core (3.192.1)
+    aws-partitions (1.929.0)
+    aws-sdk-core (3.196.1)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.651.0)
      aws-sigv4 (~> 1.8)
      jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.79.0)
-      aws-sdk-core (~> 3, >= 3.191.0)
+    aws-sdk-kms (1.81.0)
+      aws-sdk-core (~> 3, >= 3.193.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.147.0)
-      aws-sdk-core (~> 3, >= 3.192.0)
+    aws-sdk-s3 (1.151.0)
+      aws-sdk-core (~> 3, >= 3.194.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.8)
    aws-sigv4 (1.8.0)
@ -132,14 +130,7 @@ GEM
      erubi (>= 1.0.0)
      rack (>= 0.9.0)
      rouge (>= 1.0.0)
-    better_html (2.1.1)
-      actionview (>= 6.0)
-      activesupport (>= 6.0)
-      ast (~> 2.0)
-      erubi (~> 1.4)
-      parser (>= 2.4)
-      smart_properties
-    bigdecimal (3.1.7)
+    bigdecimal (3.1.8)
    bindata (2.5.0)
    binding_of_caller (1.0.1)
      debug_inspector (>= 1.2.0)
@ -169,9 +160,9 @@ GEM
      activesupport
    cbor (0.5.9.8)
    charlock_holmes (0.7.7)
-    chewy (7.5.1)
+    chewy (7.6.0)
      activesupport (>= 5.2)
-      elasticsearch (>= 7.12.0, < 7.14.0)
+      elasticsearch (>= 7.14.0, < 8)
      elasticsearch-dsl
    chunky_png (1.4.0)
    climate_control (1.2.0)
@ -204,9 +195,8 @@ GEM
      railties (>= 4.1.0)
      responders
      warden (~> 1.2.3)
-    devise-two-factor (4.1.1)
+    devise-two-factor (5.0.0)
      activesupport (~> 7.0)
-      attr_encrypted (>= 1.3, < 5, != 2)
      devise (~> 4.0)
      railties (~> 7.0)
      rotp (~> 6.0)
@ -220,29 +210,28 @@ GEM
    domain_name (0.6.20240107)
    doorkeeper (5.6.9)
      railties (>= 5)
-    dotenv (3.1.0)
+    dotenv (3.1.2)
    drb (2.2.1)
    ed25519 (1.3.0)
-    elasticsearch (7.13.3)
-      elasticsearch-api (= 7.13.3)
-      elasticsearch-transport (= 7.13.3)
-    elasticsearch-api (7.13.3)
+    elasticsearch (7.17.10)
+      elasticsearch-api (= 7.17.10)
+      elasticsearch-transport (= 7.17.10)
+    elasticsearch-api (7.17.10)
      multi_json
    elasticsearch-dsl (0.1.10)
-    elasticsearch-transport (7.13.3)
-      faraday (~> 1)
+    elasticsearch-transport (7.17.10)
+      faraday (>= 1, < 3)
      multi_json
    email_spec (2.2.2)
      htmlentities (~> 4.3.3)
      launchy (~> 2.1)
      mail (~> 2.7)
-    encryptor (3.0.0)
    erubi (1.12.0)
    et-orbi (1.2.11)
      tzinfo
    excon (0.110.0)
    fabrication (2.31.0)
-    faker (3.3.1)
+    faker (3.4.1)
      i18n (>= 1.8.11, < 2)
    faraday (1.10.3)
      faraday-em_http (~> 1.0)
@ -283,7 +272,7 @@ GEM
    fog-json (1.2.0)
      fog-core
      multi_json (~> 1.10)
-    fog-openstack (1.1.0)
+    fog-openstack (1.1.1)
      fog-core (~> 2.1)
      fog-json (>= 1.0)
    formatador (1.1.0)
@ -295,6 +284,9 @@ GEM
      ruby-progressbar (~> 1.4)
    globalid (1.2.1)
      activesupport (>= 6.1)
+    google-protobuf (3.25.3)
+    googleapis-common-protos-types (1.14.0)
+      google-protobuf (~> 3.18)
    haml (6.3.0)
      temple (>= 0.8.2)
      thor
@ -304,7 +296,7 @@ GEM
      activesupport (>= 5.1)
      haml (>= 4.0.6)
      railties (>= 5.1)
-    haml_lint (0.57.0)
+    haml_lint (0.58.0)
      haml (>= 5.0)
      parallel (~> 1.10)
      rainbow
@ -332,12 +324,11 @@ GEM
    httplog (1.6.3)
      rack (>= 2.0)
      rainbow (>= 2.0.0)
-    i18n (1.14.1)
+    i18n (1.14.5)
      concurrent-ruby (~> 1.0)
-    i18n-tasks (1.0.13)
+    i18n-tasks (1.0.14)
      activesupport (>= 4.0.2)
      ast (>= 2.1.0)
-      better_html (>= 1.0, < 3.0)
      erubi
      highline (>= 2.0.0)
      i18n
@ -350,8 +341,8 @@ GEM
      activesupport (>= 3.0)
      nokogiri (>= 1.6)
    io-console (0.7.2)
-    irb (1.12.0)
-      rdoc
+    irb (1.13.1)
+      rdoc (>= 4.0.0)
      reline (>= 0.4.2)
    jmespath (1.6.2)
    json (2.7.2)
@ -398,10 +389,10 @@ GEM
      addressable (~> 2.8)
    letter_opener (1.10.0)
      launchy (>= 2.2, < 4)
-    letter_opener_web (2.0.0)
-      actionmailer (>= 5.2)
-      letter_opener (~> 1.7)
-      railties (>= 5.2)
+    letter_opener_web (3.0.0)
+      actionmailer (>= 6.1)
+      letter_opener (~> 1.9)
+      railties (>= 6.1)
      rexml
    link_header (0.0.8)
    llhttp-ffi (0.5.0)
@ -431,10 +422,10 @@ GEM
    memory_profiler (1.0.1)
    mime-types (3.5.2)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2024.0305)
+    mime-types-data (3.2024.0507)
    mini_mime (1.1.5)
    mini_portile2 (2.8.6)
-    minitest (5.22.3)
+    minitest (5.23.1)
    msgpack (1.7.2)
    multi_json (1.15.0)
    multipart-post (2.4.0)
@ -443,7 +434,7 @@ GEM
      uri
    net-http-persistent (4.0.2)
      connection_pool (~> 2.2)
-    net-imap (0.4.10)
+    net-imap (0.4.11)
      date
      net-protocol
    net-ldap (0.19.0)
@ -453,8 +444,8 @@ GEM
      timeout
    net-smtp (0.5.0)
      net-protocol
-    nio4r (2.7.1)
-    nokogiri (1.16.4)
+    nio4r (2.7.3)
+    nokogiri (1.16.5)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    nsa (0.3.0)
@ -495,10 +486,100 @@ GEM
    openssl (3.2.0)
    openssl-signature_algorithm (1.3.0)
      openssl (> 2.0)
+    opentelemetry-api (1.2.5)
+    opentelemetry-common (0.20.1)
+      opentelemetry-api (~> 1.0)
+    opentelemetry-exporter-otlp (0.26.3)
+      google-protobuf (~> 3.14)
+      googleapis-common-protos-types (~> 1.3)
+      opentelemetry-api (~> 1.1)
+      opentelemetry-common (~> 0.20)
+      opentelemetry-sdk (~> 1.2)
+      opentelemetry-semantic_conventions
+    opentelemetry-helpers-sql-obfuscation (0.1.0)
+      opentelemetry-common (~> 0.20)
+    opentelemetry-instrumentation-action_pack (0.9.0)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+      opentelemetry-instrumentation-rack (~> 0.21)
+    opentelemetry-instrumentation-action_view (0.7.0)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-active_support (~> 0.1)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-active_job (0.7.1)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-active_model_serializers (0.20.1)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-active_record (0.7.2)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-active_support (0.5.1)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-base (0.22.3)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-registry (~> 0.1)
+    opentelemetry-instrumentation-concurrent_ruby (0.21.3)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-excon (0.22.1)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-common (~> 0.20.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-faraday (0.24.2)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-common (~> 0.20.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-http (0.23.3)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-http_client (0.22.4)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-common (~> 0.20.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-net_http (0.22.4)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-common (~> 0.20.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-pg (0.27.3)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-helpers-sql-obfuscation
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-rack (0.24.3)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-common (~> 0.20.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-rails (0.30.1)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-action_pack (~> 0.9.0)
+      opentelemetry-instrumentation-action_view (~> 0.7.0)
+      opentelemetry-instrumentation-active_job (~> 0.7.0)
+      opentelemetry-instrumentation-active_record (~> 0.7.0)
+      opentelemetry-instrumentation-active_support (~> 0.5.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-redis (0.25.4)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-common (~> 0.20.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-sidekiq (0.25.3)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-common (~> 0.20.0)
+      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-registry (0.3.1)
+      opentelemetry-api (~> 1.1)
+    opentelemetry-sdk (1.4.1)
+      opentelemetry-api (~> 1.1)
+      opentelemetry-common (~> 0.20)
+      opentelemetry-registry (~> 0.2)
+      opentelemetry-semantic_conventions
+    opentelemetry-semantic_conventions (1.10.0)
+      opentelemetry-api (~> 1.0)
    orm_adapter (0.5.0)
    ox (2.14.18)
    parallel (1.24.0)
-    parser (3.3.0.5)
+    parser (3.3.1.0)
      ast (~> 2.4.1)
      racc
    parslet (2.0.0)
@ -526,10 +607,10 @@ GEM
    public_suffix (5.0.5)
    puma (6.4.2)
      nio4r (~> 2.0)
-    pundit (2.3.1)
+    pundit (2.3.2)
      activesupport (>= 3.0.0)
    raabro (1.4.0)
-    racc (1.7.3)
+    racc (1.8.0)
    rack (2.2.9)
    rack-attack (6.7.0)
      rack (>= 1.0, < 4)
@ -553,20 +634,20 @@ GEM
    rackup (1.0.0)
      rack (< 3)
      webrick
-    rails (7.1.3.2)
-      actioncable (= 7.1.3.2)
-      actionmailbox (= 7.1.3.2)
-      actionmailer (= 7.1.3.2)
-      actionpack (= 7.1.3.2)
-      actiontext (= 7.1.3.2)
-      actionview (= 7.1.3.2)
-      activejob (= 7.1.3.2)
-      activemodel (= 7.1.3.2)
-      activerecord (= 7.1.3.2)
-      activestorage (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    rails (7.1.3.3)
+      actioncable (= 7.1.3.3)
+      actionmailbox (= 7.1.3.3)
+      actionmailer (= 7.1.3.3)
+      actionpack (= 7.1.3.3)
+      actiontext (= 7.1.3.3)
+      actionview (= 7.1.3.3)
+      activejob (= 7.1.3.3)
+      activemodel (= 7.1.3.3)
+      activerecord (= 7.1.3.3)
+      activestorage (= 7.1.3.3)
+      activesupport (= 7.1.3.3)
      bundler (>= 1.15.0)
-      railties (= 7.1.3.2)
+      railties (= 7.1.3.3)
    rails-controller-testing (1.0.5)
      actionpack (>= 5.0.1.rc1)
      actionview (>= 5.0.1.rc1)
@ -581,9 +662,9 @@ GEM
    rails-i18n (7.0.9)
      i18n (>= 0.7, < 2)
      railties (>= 6.0.0, < 8)
-    railties (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    railties (7.1.3.3)
+      actionpack (= 7.1.3.3)
+      activesupport (= 7.1.3.3)
      irb
      rackup (>= 1.0.0)
      rake (>= 12.2)
@ -604,15 +685,16 @@ GEM
      redis (>= 4)
    redlock (1.3.2)
      redis (>= 3.0.0, < 6.0)
-    regexp_parser (2.9.0)
-    reline (0.5.2)
+    regexp_parser (2.9.2)
+    reline (0.5.7)
      io-console (~> 0.5)
    request_store (1.6.0)
      rack (>= 1.4)
    responders (3.1.1)
      actionpack (>= 5.2)
      railties (>= 5.2)
-    rexml (3.2.6)
+    rexml (3.2.8)
+      strscan (>= 3.0.9)
    rotp (6.3.0)
    rouge (4.2.1)
    rpam2 (4.0.2)
@ -627,7 +709,7 @@ GEM
      rspec-support (~> 3.13.0)
    rspec-github (2.4.0)
      rspec-core (~> 3.0)
-    rspec-mocks (3.13.0)
+    rspec-mocks (3.13.1)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.13.0)
    rspec-rails (6.1.2)
@ -638,13 +720,13 @@ GEM
      rspec-expectations (~> 3.13)
      rspec-mocks (~> 3.13)
      rspec-support (~> 3.13)
-    rspec-sidekiq (4.2.0)
+    rspec-sidekiq (5.0.0)
      rspec-core (~> 3.0)
      rspec-expectations (~> 3.0)
      rspec-mocks (~> 3.0)
      sidekiq (>= 5, < 8)
    rspec-support (3.13.1)
-    rubocop (1.63.3)
+    rubocop (1.64.0)
      json (~> 2.3)
      language_server-protocol (>= 3.17.0)
      parallel (~> 1.10)
@ -655,8 +737,8 @@ GEM
      rubocop-ast (>= 1.31.1, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.31.2)
-      parser (>= 3.3.0.4)
+    rubocop-ast (1.31.3)
+      parser (>= 3.3.1.0)
    rubocop-capybara (2.20.0)
      rubocop (~> 1.41)
    rubocop-factory_bot (2.25.1)
@ -664,12 +746,12 @@ GEM
    rubocop-performance (1.21.0)
      rubocop (>= 1.48.1, < 2.0)
      rubocop-ast (>= 1.31.1, < 2.0)
-    rubocop-rails (2.24.1)
+    rubocop-rails (2.25.0)
      activesupport (>= 4.2.0)
      rack (>= 1.1)
      rubocop (>= 1.33.0, < 2.0)
      rubocop-ast (>= 1.31.1, < 2.0)
-    rubocop-rspec (2.29.1)
+    rubocop-rspec (2.29.2)
      rubocop (~> 1.40)
      rubocop-capybara (~> 2.17)
      rubocop-factory_bot (~> 2.22)
@ -693,7 +775,7 @@ GEM
    scenic (1.8.0)
      activerecord (>= 4.0.0)
      railties (>= 4.0.0)
-    selenium-webdriver (4.20.1)
+    selenium-webdriver (4.21.1)
      base64 (~> 0.2)
      rexml (~> 3.2, >= 3.2.5)
      rubyzip (>= 1.2.2, < 3.0)
@ -717,7 +799,7 @@ GEM
      thor (>= 0.20, < 3.0)
    simple-navigation (4.4.0)
      activesupport (>= 2.3.2)
-    simple_form (5.3.0)
+    simple_form (5.3.1)
      actionpack (>= 5.2)
      activemodel (>= 5.2)
    simplecov (0.22.0)
@ -727,7 +809,6 @@ GEM
    simplecov-html (0.12.3)
    simplecov-lcov (0.8.0)
    simplecov_json_formatter (0.1.4)
-    smart_properties (1.17.0)
    stackprof (0.2.26)
    statsd-ruby (1.5.0)
    stoplight (4.1.0)
@ -735,6 +816,7 @@ GEM
    stringio (3.1.0)
    strong_migrations (1.8.0)
      activerecord (>= 5.2)
+    strscan (3.1.0)
    swd (1.3.0)
      activesupport (>= 3)
      attr_required (>= 0.0.5)
@ -795,7 +877,7 @@ GEM
    webfinger (1.2.0)
      activesupport
      httpclient (>= 2.4)
-    webmock (3.23.0)
+    webmock (3.23.1)
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
@ -813,7 +895,7 @@ GEM
    xorcist (1.1.3)
    xpath (3.2.0)
      nokogiri (~> 1.8)
-    zeitwerk (2.6.13)
+    zeitwerk (2.6.14)

 PLATFORMS
  ruby
@ -842,7 +924,7 @@ DEPENDENCIES
  database_cleaner-active_record
  debug (~> 1.8)
  devise (~> 4.9)
-  devise-two-factor (~> 4.1)
+  devise-two-factor
  devise_pam_authenticatable2 (~> 9.2)
  discard (~> 1.2)
  doorkeeper (~> 5.6)
@ -864,7 +946,7 @@ DEPENDENCIES
  http (~> 5.2.0)
  http_accept_language (~> 2.1)
  httplog (~> 1.6.2)
-  i18n (= 1.14.1)
+  i18n
  i18n-tasks (~> 1.0)
  idn-ruby
  inline_svg
@ -875,7 +957,7 @@ DEPENDENCIES
  kaminari (~> 1.2)
  kt-paperclip (~> 7.2)
  letter_opener (~> 1.8)
-  letter_opener_web (~> 2.0)
+  letter_opener_web (~> 3.0)
  link_header (~> 0.0)
  lograge (~> 0.12)
  mail (~> 2.8)
@ -893,6 +975,22 @@ DEPENDENCIES
  omniauth-rails_csrf_protection (~> 1.0)
  omniauth-saml (~> 2.0)
  omniauth_openid_connect (~> 0.6.1)
+  opentelemetry-api (~> 1.2.5)
+  opentelemetry-exporter-otlp (~> 0.26.3)
+  opentelemetry-instrumentation-active_job (~> 0.7.1)
+  opentelemetry-instrumentation-active_model_serializers (~> 0.20.1)
+  opentelemetry-instrumentation-concurrent_ruby (~> 0.21.2)
+  opentelemetry-instrumentation-excon (~> 0.22.0)
+  opentelemetry-instrumentation-faraday (~> 0.24.1)
+  opentelemetry-instrumentation-http (~> 0.23.2)
+  opentelemetry-instrumentation-http_client (~> 0.22.3)
+  opentelemetry-instrumentation-net_http (~> 0.22.4)
+  opentelemetry-instrumentation-pg (~> 0.27.1)
+  opentelemetry-instrumentation-rack (~> 0.24.1)
+  opentelemetry-instrumentation-rails (~> 0.30.0)
+  opentelemetry-instrumentation-redis (~> 0.25.3)
+  opentelemetry-instrumentation-sidekiq (~> 0.25.2)
+  opentelemetry-sdk (~> 1.4)
  ox (~> 2.14)
  parslet
  pg (~> 1.5)
@ -917,7 +1015,7 @@ DEPENDENCIES
  rqrcode (~> 2.2)
  rspec-github (~> 2.4)
  rspec-rails (~> 6.0)
-  rspec-sidekiq (~> 4.0)
+  rspec-sidekiq (~> 5.0)
  rubocop
  rubocop-capybara
  rubocop-performance
@ -952,7 +1050,7 @@ DEPENDENCIES
  xorcist (~> 1.1)

 RUBY VERSION
-   ruby 3.2.3p157
+   ruby 3.3.1p55

 BUNDLED WITH
   2.5.9
--- a/README.md
+++ b/README.md
@ -70,7 +70,7 @@ Mastodon acts as an OAuth2 provider, so 3rd party apps can use the REST and Stre
 - **PostgreSQL** 12+
 - **Redis** 4+
 - **Ruby** 3.1+
- **Node.js** 16+
+- **Node.js** 18+

 The repository includes deployment configurations for **Docker and docker-compose** as well as specific platforms like **Heroku**, **Scalingo**, and **Nanobox**. For Helm charts, reference the [mastodon/chart repository](https://github.com/mastodon/chart). The [**standalone** installation guide](https://docs.joinmastodon.org/admin/install/) is available in the documentation.

@ -91,10 +91,12 @@ A **Vagrant** configuration is included for development purposes. To use it, com
 To set up **MacOS** for native development, complete the following steps:

 - Use a Ruby version manager to install the specified version from `.ruby-version`
+- Run `bundle` to install required gems
 - Run `brew install postgresql@14 redis imagemagick libidn` to install required dependencies
 - Navigate to Mastodon's root directory and run `brew install nvm` then `nvm use` to use the version from `.nvmrc`
+- Run `yarn` to install required packages
 - Run `corepack enable && corepack prepare`
- Run `bundle exec rails db:setup` (optionally prepend `RAILS_ENV=development` to target the dev environment)
+- Run `RAILS_ENV=development bundle exec rails db:setup`
 - Finally, run `bin/dev` which will launch the local services via `overmind` (if installed) or `foreman`

 ### Docker
--- a/app/controllers/accounts_controller.rb
+++ b/app/controllers/accounts_controller.rb
@ -25,7 +25,7 @@ class AccountsController < ApplicationController

        limit     = params[:limit].present? ? [params[:limit].to_i, PAGE_SIZE_MAX].min : PAGE_SIZE
        @statuses = filtered_statuses.without_reblogs.limit(limit)
-        @statuses = cache_collection(@statuses, Status)
+        @statuses = preload_collection(@statuses, Status)
      end

      format.json do
--- a/app/controllers/activitypub/collections_controller.rb
+++ b/app/controllers/activitypub/collections_controller.rb
@ -18,7 +18,7 @@ class ActivityPub::CollectionsController < ActivityPub::BaseController
  def set_items
    case params[:id]
    when 'featured'
-      @items = for_signed_account { cache_collection(@account.pinned_statuses, Status) }
+      @items = for_signed_account { preload_collection(@account.pinned_statuses, Status) }
      @items = @items.map { |item| item.distributable? ? item : ActivityPub::TagManager.instance.uri_for(item) }
    when 'tags'
      @items = for_signed_account { @account.featured_tags }
--- a/app/controllers/activitypub/outboxes_controller.rb
+++ b/app/controllers/activitypub/outboxes_controller.rb
@ -60,7 +60,7 @@ class ActivityPub::OutboxesController < ActivityPub::BaseController
  def set_statuses
    return unless page_requested?

-    @statuses = cache_collection_paginated_by_id(
+    @statuses = preload_collection_paginated_by_id(
      AccountStatusesFilter.new(@account, signed_request_account).results,
      Status,
      LIMIT,
--- a/app/controllers/admin/accounts_controller.rb
+++ b/app/controllers/admin/accounts_controller.rb
@ -128,7 +128,7 @@ module Admin
    def unblock_email
      authorize @account, :unblock_email?

-      CanonicalEmailBlock.matching_account(@account).delete_all
+      CanonicalEmailBlock.where(reference_account: @account).delete_all

      log_action :unblock_email, @account

--- a/app/controllers/admin/domain_allows_controller.rb
+++ b/app/controllers/admin/domain_allows_controller.rb
@ -25,6 +25,8 @@ class Admin::DomainAllowsController < Admin::BaseController
  def destroy
    authorize @domain_allow, :destroy?
    UnallowDomainService.new.call(@domain_allow)
+    log_action :destroy, @domain_allow
+
    redirect_to admin_instances_path, notice: I18n.t('admin.domain_allows.destroyed_msg')
  end

--- a/app/controllers/admin/site_uploads_controller.rb
+++ b/app/controllers/admin/site_uploads_controller.rb
@ -9,7 +9,7 @@ module Admin

      @site_upload.destroy!

-      redirect_to admin_settings_path, notice: I18n.t('admin.site_uploads.destroyed_msg')
+      redirect_back fallback_location: admin_settings_path, notice: I18n.t('admin.site_uploads.destroyed_msg')
    end

    private
--- a/app/controllers/api/v1/accounts/statuses_controller.rb
+++ b/app/controllers/api/v1/accounts/statuses_controller.rb
@ -19,11 +19,11 @@ class Api::V1::Accounts::StatusesController < Api::BaseController
  end

  def load_statuses
-    @account.unavailable? ? [] : cached_account_statuses
+    @account.unavailable? ? [] : preloaded_account_statuses
  end

-  def cached_account_statuses
-    cache_collection_paginated_by_id(
+  def preloaded_account_statuses
+    preload_collection_paginated_by_id(
      AccountStatusesFilter.new(@account, current_account, params).results,
      Status,
      limit_param(DEFAULT_STATUSES_LIMIT),
--- a/app/controllers/api/v1/accounts_controller.rb
+++ b/app/controllers/api/v1/accounts_controller.rb
@ -9,16 +9,22 @@ class Api::V1::AccountsController < Api::BaseController
  before_action -> { doorkeeper_authorize! :follow, :write, :'write:blocks' }, only: [:block, :unblock]
  before_action -> { doorkeeper_authorize! :write, :'write:accounts' }, only: [:create]

-  before_action :require_user!, except: [:show, :create]
-  before_action :set_account, except: [:create]
-  before_action :check_account_approval, except: [:create]
-  before_action :check_account_confirmation, except: [:create]
+  before_action :require_user!, except: [:index, :show, :create]
+  before_action :set_account, except: [:index, :create]
+  before_action :set_accounts, only: [:index]
+  before_action :check_account_approval, except: [:index, :create]
+  before_action :check_account_confirmation, except: [:index, :create]
  before_action :check_enabled_registrations, only: [:create]
+  before_action :check_accounts_limit, only: [:index]

  skip_before_action :require_authenticated_user!, only: :create

  override_rate_limit_headers :follow, family: :follows

+  def index
+    render json: @accounts, each_serializer: REST::AccountSerializer
+  end
+
  def show
    cache_if_unauthenticated!
    render json: @account, serializer: REST::AccountSerializer
@ -79,6 +85,10 @@ class Api::V1::AccountsController < Api::BaseController
    @account = Account.find(params[:id])
  end

+  def set_accounts
+    @accounts = Account.where(id: account_ids).without_unapproved
+  end
+
  def check_account_approval
    raise(ActiveRecord::RecordNotFound) if @account.local? && @account.user_pending?
  end
@ -87,10 +97,22 @@ class Api::V1::AccountsController < Api::BaseController
    raise(ActiveRecord::RecordNotFound) if @account.local? && !@account.user_confirmed?
  end

+  def check_accounts_limit
+    raise(Mastodon::ValidationError) if account_ids.size > DEFAULT_ACCOUNTS_LIMIT
+  end
+
  def relationships(**options)
    AccountRelationshipsPresenter.new([@account], current_user.account_id, **options)
  end

+  def account_ids
+    Array(accounts_params[:id]).uniq.map(&:to_i)
+  end
+
+  def accounts_params
+    params.permit(id: [])
+  end
+
  def account_params
    params.permit(:username, :email, :password, :agreement, :locale, :reason, :time_zone, :invite_code)
  end
--- a/app/controllers/api/v1/admin/domain_blocks_controller.rb
+++ b/app/controllers/api/v1/admin/domain_blocks_controller.rb
@ -29,10 +29,11 @@ class Api::V1::Admin::DomainBlocksController < Api::BaseController
  def create
    authorize :domain_block, :create?

+    @domain_block = DomainBlock.new(resource_params)
    existing_domain_block = resource_params[:domain].present? ? DomainBlock.rule_for(resource_params[:domain]) : nil
-    return render json: existing_domain_block, serializer: REST::Admin::ExistingDomainBlockErrorSerializer, status: 422 if existing_domain_block.present?
+    return render json: existing_domain_block, serializer: REST::Admin::ExistingDomainBlockErrorSerializer, status: 422 if conflicts_with_existing_block?(@domain_block, existing_domain_block)

-    @domain_block = DomainBlock.create!(resource_params)
+    @domain_block.save!
    DomainBlockWorker.perform_async(@domain_block.id)
    log_action :create, @domain_block
    render json: @domain_block, serializer: REST::Admin::DomainBlockSerializer
@ -55,6 +56,10 @@ class Api::V1::Admin::DomainBlocksController < Api::BaseController

  private

+  def conflicts_with_existing_block?(domain_block, existing_domain_block)
+    existing_domain_block.present? && (existing_domain_block.domain == TagManager.instance.normalize_domain(domain_block.domain) || !domain_block.stricter_than?(existing_domain_block))
+  end
+
  def set_domain_blocks
    @domain_blocks = filtered_domain_blocks.order(id: :desc).to_a_paginated_by_id(limit_param(LIMIT), params_slice(:max_id, :since_id, :min_id))
  end
--- a/app/controllers/api/v1/apps/credentials_controller.rb
+++ b/app/controllers/api/v1/apps/credentials_controller.rb
@ -4,6 +4,6 @@ class Api::V1::Apps::CredentialsController < Api::BaseController
  def show
    return doorkeeper_render_error unless valid_doorkeeper_token?

-    render json: doorkeeper_token.application, serializer: REST::ApplicationSerializer, fields: %i(name website vapid_key client_id scopes)
+    render json: doorkeeper_token.application, serializer: REST::ApplicationSerializer
  end
 end
--- a/app/controllers/api/v1/apps_controller.rb
+++ b/app/controllers/api/v1/apps_controller.rb
@ -5,7 +5,7 @@ class Api::V1::AppsController < Api::BaseController

  def create
    @app = Doorkeeper::Application.create!(application_options)
-    render json: @app, serializer: REST::ApplicationSerializer
+    render json: @app, serializer: REST::CredentialApplicationSerializer
  end

  private
@ -24,6 +24,6 @@ class Api::V1::AppsController < Api::BaseController
  end

  def app_params
-    params.permit(:client_name, :redirect_uris, :scopes, :website)
+    params.permit(:client_name, :scopes, :website, :redirect_uris, redirect_uris: [])
  end
 end
--- a/app/controllers/api/v1/bookmarks_controller.rb
+++ b/app/controllers/api/v1/bookmarks_controller.rb
@ -13,11 +13,11 @@ class Api::V1::BookmarksController < Api::BaseController
  private

  def load_statuses
-    cached_bookmarks
+    preloaded_bookmarks
  end

-  def cached_bookmarks
-    cache_collection(results.map(&:status), Status)
+  def preloaded_bookmarks
+    preload_collection(results.map(&:status), Status)
  end

  def results
--- a/app/controllers/api/v1/conversations_controller.rb
+++ b/app/controllers/api/v1/conversations_controller.rb
@ -38,15 +38,15 @@ class Api::V1::ConversationsController < Api::BaseController
  def paginated_conversations
    AccountConversation.where(account: current_account)
                       .includes(
-                         account: :account_stat,
+                         account: [:account_stat, user: :role],
                         last_status: [
                           :media_attachments,
                           :status_stat,
                           :tags,
                           {
-                             preview_cards_status: :preview_card,
-                             active_mentions: [account: :account_stat],
-                             account: :account_stat,
+                             preview_cards_status: { preview_card: { author_account: [:account_stat, user: :role] } },
+                             active_mentions: :account,
+                             account: [:account_stat, user: :role],
                           },
                         ]
                       )
--- a/app/controllers/api/v1/favourites_controller.rb
+++ b/app/controllers/api/v1/favourites_controller.rb
@ -13,11 +13,11 @@ class Api::V1::FavouritesController < Api::BaseController
  private

  def load_statuses
-    cached_favourites
+    preloaded_favourites
  end

-  def cached_favourites
-    cache_collection(results.map(&:status), Status)
+  def preloaded_favourites
+    preload_collection(results.map(&:status), Status)
  end

  def results
--- a/app/controllers/api/v1/notifications/requests_controller.rb
+++ b/app/controllers/api/v1/notifications/requests_controller.rb
@ -41,7 +41,7 @@ class Api::V1::Notifications::RequestsController < Api::BaseController
    )

    NotificationRequest.preload_cache_collection(requests) do |statuses|
-      cache_collection(statuses, Status)
+      preload_collection(statuses, Status)
    end
  end

--- a/app/controllers/api/v1/notifications_controller.rb
+++ b/app/controllers/api/v1/notifications_controller.rb
@ -41,7 +41,7 @@ class Api::V1::NotificationsController < Api::BaseController
    )

    Notification.preload_cache_collection_target_statuses(notifications) do |target_statuses|
-      cache_collection(target_statuses, Status)
+      preload_collection(target_statuses, Status)
    end
  end

--- a/app/controllers/api/v1/push/subscriptions_controller.rb
+++ b/app/controllers/api/v1/push/subscriptions_controller.rb
@ -1,9 +1,12 @@
 # frozen_string_literal: true

 class Api::V1::Push::SubscriptionsController < Api::BaseController
+  include Redisable
+  include Lockable
+
  before_action -> { doorkeeper_authorize! :push }
  before_action :require_user!
-  before_action :set_push_subscription
+  before_action :set_push_subscription, only: [:show, :update]
  before_action :check_push_subscription, only: [:show, :update]

  def show
@ -11,16 +14,18 @@ class Api::V1::Push::SubscriptionsController < Api::BaseController
  end

  def create
-    @push_subscription&.destroy!
+    with_redis_lock("push_subscription:#{current_user.id}") do
+      destroy_web_push_subscriptions!

-    @push_subscription = Web::PushSubscription.create!(
-      endpoint: subscription_params[:endpoint],
-      key_p256dh: subscription_params[:keys][:p256dh],
-      key_auth: subscription_params[:keys][:auth],
-      data: data_params,
-      user_id: current_user.id,
-      access_token_id: doorkeeper_token.id
-    )
+      @push_subscription = Web::PushSubscription.create!(
+        endpoint: subscription_params[:endpoint],
+        key_p256dh: subscription_params[:keys][:p256dh],
+        key_auth: subscription_params[:keys][:auth],
+        data: data_params,
+        user_id: current_user.id,
+        access_token_id: doorkeeper_token.id
+      )
+    end

    render json: @push_subscription, serializer: REST::WebPushSubscriptionSerializer
  end
@ -31,14 +36,18 @@ class Api::V1::Push::SubscriptionsController < Api::BaseController
  end

  def destroy
-    @push_subscription&.destroy!
+    destroy_web_push_subscriptions!
    render_empty
  end

  private

+  def destroy_web_push_subscriptions!
+    doorkeeper_token.web_push_subscriptions.destroy_all
+  end
+
  def set_push_subscription
-    @push_subscription = Web::PushSubscription.find_by(access_token_id: doorkeeper_token.id)
+    @push_subscription = doorkeeper_token.web_push_subscriptions.first
  end

  def check_push_subscription
--- a/app/controllers/api/v1/statuses_controller.rb
+++ b/app/controllers/api/v1/statuses_controller.rb
@ -5,9 +5,11 @@ class Api::V1::StatusesController < Api::BaseController

  before_action -> { authorize_if_got_token! :read, :'read:statuses' }, except: [:create, :update, :destroy]
  before_action -> { doorkeeper_authorize! :write, :'write:statuses' }, only:   [:create, :update, :destroy]
-  before_action :require_user!, except:  [:show, :context]
-  before_action :set_status, only:       [:show, :context]
-  before_action :set_thread, only:       [:create]
+  before_action :require_user!, except:      [:index, :show, :context]
+  before_action :set_statuses, only:         [:index]
+  before_action :set_status, only:           [:show, :context]
+  before_action :set_thread, only:           [:create]
+  before_action :check_statuses_limit, only: [:index]

  override_rate_limit_headers :create, family: :statuses
  override_rate_limit_headers :update, family: :statuses
@ -23,9 +25,14 @@ class Api::V1::StatusesController < Api::BaseController
  DESCENDANTS_LIMIT       = 60
  DESCENDANTS_DEPTH_LIMIT = 20

+  def index
+    @statuses = preload_collection(@statuses, Status)
+    render json: @statuses, each_serializer: REST::StatusSerializer
+  end
+
  def show
    cache_if_unauthenticated!
-    @status = cache_collection([@status], Status).first
+    @status = preload_collection([@status], Status).first
    render json: @status, serializer: REST::StatusSerializer
  end

@ -44,8 +51,8 @@ class Api::V1::StatusesController < Api::BaseController

    ancestors_results   = @status.in_reply_to_id.nil? ? [] : @status.ancestors(ancestors_limit, current_account)
    descendants_results = @status.descendants(descendants_limit, current_account, descendants_depth_limit)
-    loaded_ancestors    = cache_collection(ancestors_results, Status)
-    loaded_descendants  = cache_collection(descendants_results, Status)
+    loaded_ancestors    = preload_collection(ancestors_results, Status)
+    loaded_descendants  = preload_collection(descendants_results, Status)

    @context = Context.new(ancestors: loaded_ancestors, descendants: loaded_descendants)
    statuses = [@status] + @context.ancestors + @context.descendants
@ -111,6 +118,10 @@ class Api::V1::StatusesController < Api::BaseController

  private

+  def set_statuses
+    @statuses = Status.permitted_statuses_from_ids(status_ids, current_account)
+  end
+
  def set_status
    @status = Status.find(params[:id])
    authorize @status, :show?
@ -125,6 +136,18 @@ class Api::V1::StatusesController < Api::BaseController
    render json: { error: I18n.t('statuses.errors.in_reply_not_found') }, status: 404
  end

+  def check_statuses_limit
+    raise(Mastodon::ValidationError) if status_ids.size > DEFAULT_STATUSES_LIMIT
+  end
+
+  def status_ids
+    Array(statuses_params[:id]).uniq.map(&:to_i)
+  end
+
+  def statuses_params
+    params.permit(id: [])
+  end
+
  def status_params
    params.permit(
      :status,
--- a/app/controllers/api/v1/timelines/home_controller.rb
+++ b/app/controllers/api/v1/timelines/home_controller.rb
@ -21,11 +21,11 @@ class Api::V1::Timelines::HomeController < Api::V1::Timelines::BaseController
  private

  def load_statuses
-    cached_home_statuses
+    preloaded_home_statuses
  end

-  def cached_home_statuses
-    cache_collection home_statuses, Status
+  def preloaded_home_statuses
+    preload_collection home_statuses, Status
  end

  def home_statuses
--- a/app/controllers/api/v1/timelines/list_controller.rb
+++ b/app/controllers/api/v1/timelines/list_controller.rb
@ -21,11 +21,11 @@ class Api::V1::Timelines::ListController < Api::V1::Timelines::BaseController
  end

  def set_statuses
-    @statuses = cached_list_statuses
+    @statuses = preloaded_list_statuses
  end

-  def cached_list_statuses
-    cache_collection list_statuses, Status
+  def preloaded_list_statuses
+    preload_collection list_statuses, Status
  end

  def list_statuses
--- a/app/controllers/api/v1/timelines/public_controller.rb
+++ b/app/controllers/api/v1/timelines/public_controller.rb
@ -18,11 +18,11 @@ class Api::V1::Timelines::PublicController < Api::V1::Timelines::BaseController
  end

  def load_statuses
-    cached_public_statuses_page
+    preloaded_public_statuses_page
  end

-  def cached_public_statuses_page
-    cache_collection(public_statuses, Status)
+  def preloaded_public_statuses_page
+    preload_collection(public_statuses, Status)
  end

  def public_statuses
--- a/app/controllers/api/v1/timelines/tag_controller.rb
+++ b/app/controllers/api/v1/timelines/tag_controller.rb
@ -23,11 +23,11 @@ class Api::V1::Timelines::TagController < Api::V1::Timelines::BaseController
  end

  def load_statuses
-    cached_tagged_statuses
+    preloaded_tagged_statuses
  end

-  def cached_tagged_statuses
-    @tag.nil? ? [] : cache_collection(tag_timeline_statuses, Status)
+  def preloaded_tagged_statuses
+    @tag.nil? ? [] : preload_collection(tag_timeline_statuses, Status)
  end

  def tag_timeline_statuses
--- a/app/controllers/api/v1/trends/statuses_controller.rb
+++ b/app/controllers/api/v1/trends/statuses_controller.rb
@ -20,7 +20,7 @@ class Api::V1::Trends::StatusesController < Api::BaseController

  def set_statuses
    @statuses = if enabled?
-                  cache_collection(statuses_from_trends.offset(offset_param).limit(limit_param(DEFAULT_STATUSES_LIMIT)), Status)
+                  preload_collection(statuses_from_trends.offset(offset_param).limit(limit_param(DEFAULT_STATUSES_LIMIT)), Status)
                else
                  []
                end
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@ -9,6 +9,7 @@ class ApplicationController < ActionController::Base
  include UserTrackingConcern
  include SessionTrackingConcern
  include CacheConcern
+  include PreloadingConcern
  include DomainControlHelper
  include DatabaseHelper
  include AuthorizedFetchHelper
--- a/app/controllers/auth/registrations_controller.rb
+++ b/app/controllers/auth/registrations_controller.rb
@ -44,7 +44,7 @@ class Auth::RegistrationsController < Devise::RegistrationsController
  end

  def build_resource(hash = nil)
-    super(hash)
+    super

    resource.locale                 = I18n.locale
    resource.invite_code            = @invite&.code if resource.invite_code.blank?
--- a/app/controllers/concerns/cache_concern.rb
+++ b/app/controllers/concerns/cache_concern.rb
@ -45,20 +45,4 @@ module CacheConcern
      Rails.cache.write(key, response.body, expires_in: expires_in, raw: true)
    end
  end
-
-  # TODO: Rename this method, as it does not perform any caching anymore.
-  def cache_collection(raw, klass)
-    return raw unless klass.respond_to?(:preload_cacheable_associations)
-
-    records = raw.to_a
-
-    klass.preload_cacheable_associations(records)
-
-    records
-  end
-
-  # TODO: Rename this method, as it does not perform any caching anymore.
-  def cache_collection_paginated_by_id(raw, klass, limit, options)
-    cache_collection raw.to_a_paginated_by_id(limit, options), klass
-  end
 end
--- a/app/controllers/concerns/preloading_concern.rb
+++ b/app/controllers/concerns/preloading_concern.rb
@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module PreloadingConcern
+  extend ActiveSupport::Concern
+
+  def preload_collection(scope, klass)
+    return scope unless klass.respond_to?(:preload_cacheable_associations)
+
+    scope.to_a.tap do |records|
+      klass.preload_cacheable_associations(records)
+    end
+  end
+
+  def preload_collection_paginated_by_id(scope, klass, limit, options)
+    preload_collection scope.to_a_paginated_by_id(limit, options), klass
+  end
+end
--- a/app/controllers/settings/applications_controller.rb
+++ b/app/controllers/settings/applications_controller.rb
@ -13,7 +13,7 @@ class Settings::ApplicationsController < Settings::BaseController
  def new
    @application = Doorkeeper::Application.new(
      redirect_uri: Doorkeeper.configuration.native_redirect_uri,
-      scopes: 'read write follow'
+      scopes: 'read:me'
    )
  end

--- a/app/controllers/tags_controller.rb
+++ b/app/controllers/tags_controller.rb
@ -45,7 +45,7 @@ class TagsController < ApplicationController
  end

  def set_statuses
-    @statuses = cache_collection(TagFeed.new(@tag, nil, local: @local).get(limit_param), Status)
+    @statuses = preload_collection(TagFeed.new(@tag, nil, local: @local).get(limit_param), Status)
  end

  def limit_param
--- a/app/controllers/well_known/oauth_metadata_controller.rb
+++ b/app/controllers/well_known/oauth_metadata_controller.rb
@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module WellKnown
+  class OauthMetadataController < ActionController::Base # rubocop:disable Rails/ApplicationController
+    include CacheConcern
+
+    # Prevent `active_model_serializer`'s `ActionController::Serialization` from calling `current_user`
+    # and thus re-issuing session cookies
+    serialization_scope nil
+
+    def show
+      # Due to this document potentially changing between Mastodon versions (as
+      # new OAuth scopes are added), we don't use expires_in to cache upstream,
+      # instead just caching in the rails cache:
+      render_with_cache(
+        json: ::OauthMetadataPresenter.new,
+        serializer: ::OauthMetadataSerializer,
+        content_type: 'application/json',
+        expires_in: 15.minutes
+      )
+    end
+  end
+end
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@ -240,6 +240,22 @@ module ApplicationHelper
    EmojiFormatter.new(html, custom_emojis, other_options.merge(animate: prefers_autoplay?)).to_s
  end

+  def mascot_url
+    full_asset_url(instance_presenter.mascot&.file&.url || frontend_asset_path('images/elephant_ui_plane.svg'))
+  end
+
+  def instance_presenter
+    @instance_presenter ||= InstancePresenter.new
+  end
+
+  def favicon_path(size = '48')
+    instance_presenter.favicon&.file&.url(size)
+  end
+
+  def app_icon_path(size = '48')
+    instance_presenter.app_icon&.file&.url(size)
+  end
+
  private

  def storage_host_var
--- a/app/helpers/mascot_helper.rb
+++ b/app/helpers/mascot_helper.rb
@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-module MascotHelper
-  def mascot_url
-    full_asset_url(instance_presenter.mascot&.file&.url || frontend_asset_path('images/elephant_ui_plane.svg'))
-  end
-
-  def instance_presenter
-    @instance_presenter ||= InstancePresenter.new
-  end
-end
--- a/app/javascript/entrypoints/application.ts
+++ b/app/javascript/entrypoints/application.ts
@ -1,5 +1,5 @@
 import './public-path';
-import main from "mastodon/main";
+import main from 'mastodon/main';

 import { start } from '../mastodon/common';
 import { loadLocale } from '../mastodon/locales';
@ -10,6 +10,6 @@ start();
 loadPolyfills()
  .then(loadLocale)
  .then(main)
-  .catch(e => {
+  .catch((e: unknown) => {
    console.error(e);
  });
--- a/app/javascript/entrypoints/error.ts
+++ b/app/javascript/entrypoints/error.ts
@ -2,7 +2,9 @@ import './public-path';
 import ready from '../mastodon/ready';

 ready(() => {
-  const image = document.querySelector('img');
+  const image = document.querySelector<HTMLImageElement>('img');
+
+  if (!image) return;

  image.addEventListener('mouseenter', () => {
    image.src = '/oops.gif';
@ -11,4 +13,6 @@ ready(() => {
  image.addEventListener('mouseleave', () => {
    image.src = '/oops.png';
  });
+}).catch((e: unknown) => {
+  console.error(e);
 });
--- a/app/javascript/entrypoints/inert.ts
+++ b/app/javascript/entrypoints/inert.ts
--- a/app/javascript/entrypoints/mailer.ts
+++ b/app/javascript/entrypoints/mailer.ts
--- a/app/javascript/entrypoints/public-path.ts
+++ b/app/javascript/entrypoints/public-path.ts
@ -2,7 +2,7 @@
 // to share the same assets regardless of instance configuration.
 // See https://webpack.js.org/guides/public-path/#on-the-fly

-function removeOuterSlashes(string) {
+function removeOuterSlashes(string: string) {
  return string.replace(/^\/*/, '').replace(/\/*$/, '');
 }

@ -15,7 +15,9 @@ function formatPublicPath(host = '', path = '') {
  return `${formattedHost}/${formattedPath}/`;
 }

-const cdnHost = document.querySelector('meta[name=cdn-host]');
+const cdnHost = document.querySelector<HTMLMetaElement>('meta[name=cdn-host]');

-// eslint-disable-next-line no-undef
-__webpack_public_path__ = formatPublicPath(cdnHost ? cdnHost.content : '', process.env.PUBLIC_OUTPUT_PATH);
+__webpack_public_path__ = formatPublicPath(
+  cdnHost ? cdnHost.content : '',
+  process.env.PUBLIC_OUTPUT_PATH,
+);
--- a/app/javascript/entrypoints/public.tsx
+++ b/app/javascript/entrypoints/public.tsx
@ -65,7 +65,7 @@ window.addEventListener('message', (e) => {
      {
        type: 'setHeight',
        id: data.id,
-        height: document.getElementsByTagName('html')[0].scrollHeight,
+        height: document.getElementsByTagName('html')[0]?.scrollHeight,
      },
      '*',
    );
@ -135,7 +135,7 @@ function loaded() {
    );
  };
  const todayFormat = new IntlMessageFormat(
-    localeData['relative_format.today'] || 'Today at {time}',
+    localeData['relative_format.today'] ?? 'Today at {time}',
    locale,
  );

@ -288,13 +288,13 @@ function loaded() {
      if (statusEl.dataset.spoiler === 'expanded') {
        statusEl.dataset.spoiler = 'folded';
        this.textContent = new IntlMessageFormat(
-          localeData['status.show_more'] || 'Show more',
+          localeData['status.show_more'] ?? 'Show more',
          locale,
        ).format() as string;
      } else {
        statusEl.dataset.spoiler = 'expanded';
        this.textContent = new IntlMessageFormat(
-          localeData['status.show_less'] || 'Show less',
+          localeData['status.show_less'] ?? 'Show less',
          locale,
        ).format() as string;
      }
@ -316,8 +316,8 @@ function loaded() {

      const message =
        statusEl.dataset.spoiler === 'expanded'
-          ? localeData['status.show_less'] || 'Show less'
-          : localeData['status.show_more'] || 'Show more';
+          ? localeData['status.show_less'] ?? 'Show less'
+          : localeData['status.show_more'] ?? 'Show more';
      spoilerLink.textContent = new IntlMessageFormat(
        message,
        locale,
--- a/app/javascript/entrypoints/remote_interaction_helper.ts
+++ b/app/javascript/entrypoints/remote_interaction_helper.ts
@ -67,7 +67,9 @@ const fetchInteractionURLFailure = () => {
  );
 };

-const isValidDomain = (value: string) => {
+const isValidDomain = (value: unknown) => {
+  if (typeof value !== 'string') return false;
+
  const url = new URL('https:///path');
  url.hostname = value;
  return url.hostname === value;
@ -124,6 +126,11 @@ const fromAcct = (acct: string) => {
  const domain = segments[1];
  const fallbackTemplate = `https://${domain}/authorize_interaction?uri={uri}`;

+  if (!domain) {
+    fetchInteractionURLFailure();
+    return;
+  }
+
  axios
    .get(`https://${domain}/.well-known/webfinger`, {
      params: { resource: `acct:${acct}` },
--- a/app/javascript/entrypoints/share.tsx
+++ b/app/javascript/entrypoints/share.tsx
@ -2,7 +2,7 @@ import './public-path';
 import { createRoot } from 'react-dom/client';

 import { start } from '../mastodon/common';
-import ComposeContainer  from '../mastodon/containers/compose_container';
+import ComposeContainer from '../mastodon/containers/compose_container';
 import { loadPolyfills } from '../mastodon/polyfills';
 import ready from '../mastodon/ready';

@ -16,7 +16,7 @@ function loaded() {

    if (!attr) return;

-    const props = JSON.parse(attr);
+    const props = JSON.parse(attr) as object;
    const root = createRoot(mountNode);

    root.render(<ComposeContainer {...props} />);
@ -24,9 +24,13 @@ function loaded() {
 }

 function main() {
-  ready(loaded);
+  ready(loaded).catch((error: unknown) => {
+    console.error(error);
+  });
 }

-loadPolyfills().then(main).catch(error => {
-  console.error(error);
-});
+loadPolyfills()
+  .then(main)
+  .catch((error: unknown) => {
+    console.error(error);
+  });
--- a/app/javascript/entrypoints/sign_up.js
+++ b/app/javascript/entrypoints/sign_up.js
@ -1,42 +0,0 @@
-import './public-path';
-import axios from 'axios';
-
-import ready from '../mastodon/ready';
-
-ready(() => {
-  setInterval(() => {
-    axios.get('/api/v1/emails/check_confirmation').then((response) => {
-      if (response.data) {
-        window.location = '/start';
-      }
-    }).catch(error => {
-      console.error(error);
-    });
-  }, 5000);
-
-  document.querySelectorAll('.timer-button').forEach(button => {
-    let counter = 30;
-
-    const container = document.createElement('span');
-
-    const updateCounter = () => {
-      container.innerText = ` (${counter})`;
-    };
-
-    updateCounter();
-
-    const countdown = setInterval(() => {
-      counter--;
-
-      if (counter === 0) {
-        button.disabled = false;
-        button.removeChild(container);
-        clearInterval(countdown);
-      } else {
-        updateCounter();
-      }
-    }, 1000);
-
-    button.appendChild(container);
-  });
-});
--- a/app/javascript/entrypoints/sign_up.ts
+++ b/app/javascript/entrypoints/sign_up.ts
@ -0,0 +1,48 @@
+import './public-path';
+import axios from 'axios';
+
+import ready from '../mastodon/ready';
+
+async function checkConfirmation() {
+  const response = await axios.get('/api/v1/emails/check_confirmation');
+
+  if (response.data) {
+    window.location.href = '/start';
+  }
+}
+
+ready(() => {
+  setInterval(() => {
+    void checkConfirmation();
+  }, 5000);
+
+  document
+    .querySelectorAll<HTMLButtonElement>('button.timer-button')
+    .forEach((button) => {
+      let counter = 30;
+
+      const container = document.createElement('span');
+
+      const updateCounter = () => {
+        container.innerText = ` (${counter})`;
+      };
+
+      updateCounter();
+
+      const countdown = setInterval(() => {
+        counter--;
+
+        if (counter === 0) {
+          button.disabled = false;
+          button.removeChild(container);
+          clearInterval(countdown);
+        } else {
+          updateCounter();
+        }
+      }, 1000);
+
+      button.appendChild(container);
+    });
+}).catch((e: unknown) => {
+  throw e;
+});
--- a/app/javascript/entrypoints/two_factor_authentication.js
+++ b/app/javascript/entrypoints/two_factor_authentication.js
@ -1,119 +0,0 @@
-import * as WebAuthnJSON from '@github/webauthn-json';
-import axios from 'axios';
-
-import ready from '../mastodon/ready';
-import 'regenerator-runtime/runtime';
-
-function getCSRFToken() {
-  var CSRFSelector = document.querySelector('meta[name="csrf-token"]');
-  if (CSRFSelector) {
-    return CSRFSelector.getAttribute('content');
-  } else {
-    return null;
-  }
-}
-
-function hideFlashMessages() {
-  Array.from(document.getElementsByClassName('flash-message')).forEach(function(flashMessage) {
-    flashMessage.classList.add('hidden');
-  });
-}
-
-function callback(url, body) {
-  axios.post(url, JSON.stringify(body), {
-    headers: {
-      'Content-Type': 'application/json',
-      'Accept': 'application/json',
-      'X-CSRF-Token': getCSRFToken(),
-    },
-    credentials: 'same-origin',
-  }).then(function(response) {
-    window.location.replace(response.data.redirect_path);
-  }).catch(function(error) {
-    if (error.response.status === 422) {
-      const errorMessage = document.getElementById('security-key-error-message');
-      errorMessage.classList.remove('hidden');
-      console.error(error.response.data.error);
-    } else {
-      console.error(error);
-    }
-  });
-}
-
-ready(() => {
-  if (!WebAuthnJSON.supported()) {
-    const unsupported_browser_message = document.getElementById('unsupported-browser-message');
-    if (unsupported_browser_message) {
-      unsupported_browser_message.classList.remove('hidden');
-      document.querySelector('.btn.js-webauthn').disabled = true;
-    }
-  }
-
-
-  const webAuthnCredentialRegistrationForm = document.getElementById('new_webauthn_credential');
-  if (webAuthnCredentialRegistrationForm) {
-    webAuthnCredentialRegistrationForm.addEventListener('submit', (event) => {
-      event.preventDefault();
-
-      var nickname = event.target.querySelector('input[name="new_webauthn_credential[nickname]"]');
-      if (nickname.value) {
-        axios.get('/settings/security_keys/options')
-          .then((response) => {
-            const credentialOptions = response.data;
-
-            WebAuthnJSON.create({ 'publicKey': credentialOptions }).then((credential) => {
-              var params = { 'credential': credential, 'nickname': nickname.value };
-              callback('/settings/security_keys', params);
-            }).catch((error) => {
-              const errorMessage = document.getElementById('security-key-error-message');
-              errorMessage.classList.remove('hidden');
-              console.error(error);
-            });
-          }).catch((error) => {
-            console.error(error.response.data.error);
-          });
-      } else {
-        nickname.focus();
-      }
-    });
-  }
-
-  const webAuthnCredentialAuthenticationForm = document.getElementById('webauthn-form');
-  if (webAuthnCredentialAuthenticationForm) {
-    webAuthnCredentialAuthenticationForm.addEventListener('submit', (event) => {
-      event.preventDefault();
-
-      axios.get('sessions/security_key_options')
-        .then((response) => {
-          const credentialOptions = response.data;
-
-          WebAuthnJSON.get({ 'publicKey': credentialOptions }).then((credential) => {
-            var params = { 'user': { 'credential': credential } };
-            callback('sign_in', params);
-          }).catch((error) => {
-            const errorMessage = document.getElementById('security-key-error-message');
-            errorMessage.classList.remove('hidden');
-            console.error(error);
-          });
-        }).catch((error) => {
-          console.error(error.response.data.error);
-        });
-    });
-
-    const otpAuthenticationForm = document.getElementById('otp-authentication-form');
-
-    const linkToOtp = document.getElementById('link-to-otp');
-    linkToOtp.addEventListener('click', () => {
-      webAuthnCredentialAuthenticationForm.classList.add('hidden');
-      otpAuthenticationForm.classList.remove('hidden');
-      hideFlashMessages();
-    });
-
-    const linkToWebAuthn = document.getElementById('link-to-webauthn');
-    linkToWebAuthn.addEventListener('click', () => {
-      otpAuthenticationForm.classList.add('hidden');
-      webAuthnCredentialAuthenticationForm.classList.remove('hidden');
-      hideFlashMessages();
-    });
-  }
-});
--- a/app/javascript/entrypoints/two_factor_authentication.ts
+++ b/app/javascript/entrypoints/two_factor_authentication.ts
@ -0,0 +1,197 @@
+import * as WebAuthnJSON from '@github/webauthn-json';
+import axios, { AxiosError } from 'axios';
+
+import ready from '../mastodon/ready';
+
+import 'regenerator-runtime/runtime';
+
+type PublicKeyCredentialCreationOptionsJSON =
+  WebAuthnJSON.CredentialCreationOptionsJSON['publicKey'];
+
+function exceptionHasAxiosError(
+  error: unknown,
+): error is AxiosError<{ error: unknown }> {
+  return (
+    error instanceof AxiosError &&
+    typeof error.response?.data === 'object' &&
+    'error' in error.response.data
+  );
+}
+
+function logAxiosResponseError(error: unknown) {
+  if (exceptionHasAxiosError(error)) console.error(error);
+}
+
+function getCSRFToken() {
+  return document
+    .querySelector<HTMLMetaElement>('meta[name="csrf-token"]')
+    ?.getAttribute('content');
+}
+
+function hideFlashMessages() {
+  document.querySelectorAll('.flash-message').forEach((flashMessage) => {
+    flashMessage.classList.add('hidden');
+  });
+}
+
+async function callback(
+  url: string,
+  body:
+    | {
+        credential: WebAuthnJSON.PublicKeyCredentialWithAttestationJSON;
+        nickname: string;
+      }
+    | {
+        user: { credential: WebAuthnJSON.PublicKeyCredentialWithAssertionJSON };
+      },
+) {
+  try {
+    const response = await axios.post<{ redirect_path: string }>(
+      url,
+      JSON.stringify(body),
+      {
+        headers: {
+          'Content-Type': 'application/json',
+          Accept: 'application/json',
+          'X-CSRF-Token': getCSRFToken(),
+        },
+      },
+    );
+
+    window.location.replace(response.data.redirect_path);
+  } catch (error) {
+    if (error instanceof AxiosError && error.response?.status === 422) {
+      const errorMessage = document.getElementById(
+        'security-key-error-message',
+      );
+      errorMessage?.classList.remove('hidden');
+
+      logAxiosResponseError(error);
+    } else {
+      console.error(error);
+    }
+  }
+}
+
+async function handleWebauthnCredentialRegistration(nickname: string) {
+  try {
+    const response = await axios.get<PublicKeyCredentialCreationOptionsJSON>(
+      '/settings/security_keys/options',
+    );
+
+    const credentialOptions = response.data;
+
+    try {
+      const credential = await WebAuthnJSON.create({
+        publicKey: credentialOptions,
+      });
+
+      const params = {
+        credential: credential,
+        nickname: nickname,
+      };
+
+      await callback('/settings/security_keys', params);
+    } catch (error) {
+      const errorMessage = document.getElementById(
+        'security-key-error-message',
+      );
+      errorMessage?.classList.remove('hidden');
+      console.error(error);
+    }
+  } catch (error) {
+    logAxiosResponseError(error);
+  }
+}
+
+async function handleWebauthnCredentialAuthentication() {
+  try {
+    const response = await axios.get<PublicKeyCredentialCreationOptionsJSON>(
+      'sessions/security_key_options',
+    );
+
+    const credentialOptions = response.data;
+
+    try {
+      const credential = await WebAuthnJSON.get({
+        publicKey: credentialOptions,
+      });
+
+      const params = { user: { credential: credential } };
+      void callback('sign_in', params);
+    } catch (error) {
+      const errorMessage = document.getElementById(
+        'security-key-error-message',
+      );
+      errorMessage?.classList.remove('hidden');
+      console.error(error);
+    }
+  } catch (error) {
+    logAxiosResponseError(error);
+  }
+}
+
+ready(() => {
+  if (!WebAuthnJSON.supported()) {
+    const unsupported_browser_message = document.getElementById(
+      'unsupported-browser-message',
+    );
+    if (unsupported_browser_message) {
+      unsupported_browser_message.classList.remove('hidden');
+      const button = document.querySelector<HTMLButtonElement>(
+        'button.btn.js-webauthn',
+      );
+      if (button) button.disabled = true;
+    }
+  }
+
+  const webAuthnCredentialRegistrationForm =
+    document.querySelector<HTMLFormElement>('form#new_webauthn_credential');
+  if (webAuthnCredentialRegistrationForm) {
+    webAuthnCredentialRegistrationForm.addEventListener('submit', (event) => {
+      event.preventDefault();
+
+      if (!(event.target instanceof HTMLFormElement)) return;
+
+      const nickname = event.target.querySelector<HTMLInputElement>(
+        'input[name="new_webauthn_credential[nickname]"]',
+      );
+
+      if (nickname?.value) {
+        void handleWebauthnCredentialRegistration(nickname.value);
+      } else {
+        nickname?.focus();
+      }
+    });
+  }
+
+  const webAuthnCredentialAuthenticationForm =
+    document.getElementById('webauthn-form');
+  if (webAuthnCredentialAuthenticationForm) {
+    webAuthnCredentialAuthenticationForm.addEventListener('submit', (event) => {
+      event.preventDefault();
+      void handleWebauthnCredentialAuthentication();
+    });
+
+    const otpAuthenticationForm = document.getElementById(
+      'otp-authentication-form',
+    );
+
+    const linkToOtp = document.getElementById('link-to-otp');
+
+    linkToOtp?.addEventListener('click', () => {
+      webAuthnCredentialAuthenticationForm.classList.add('hidden');
+      otpAuthenticationForm?.classList.remove('hidden');
+      hideFlashMessages();
+    });
+
+    const linkToWebAuthn = document.getElementById('link-to-webauthn');
+    linkToWebAuthn?.addEventListener('click', () => {
+      otpAuthenticationForm?.classList.add('hidden');
+      webAuthnCredentialAuthenticationForm.classList.remove('hidden');
+      hideFlashMessages();
+    });
+  }
+}).catch((e: unknown) => {
+  throw e;
+});
--- a/app/javascript/mastodon/actions/account_notes.ts
+++ b/app/javascript/mastodon/actions/account_notes.ts
@ -1,18 +1,10 @@
-import type { ApiRelationshipJSON } from 'mastodon/api_types/relationships';
-import { createAppAsyncThunk } from 'mastodon/store/typed_functions';
+import { apiSubmitAccountNote } from 'mastodon/api/accounts';
+import { createDataLoadingThunk } from 'mastodon/store/typed_functions';

-import api from '../api';
-
-export const submitAccountNote = createAppAsyncThunk(
+export const submitAccountNote = createDataLoadingThunk(
  'account_note/submit',
-  async (args: { id: string; value: string }, { getState }) => {
-    const response = await api(getState).post<ApiRelationshipJSON>(
-      `/api/v1/accounts/${args.id}/note`,
-      {
-        comment: args.value,
-      },
-    );
-
-    return { relationship: response.data };
-  },
+  ({ accountId, note }: { accountId: string; note: string }) =>
+    apiSubmitAccountNote(accountId, note),
+  (relationship) => ({ relationship }),
+  { skipLoading: true },
 );
--- a/app/javascript/mastodon/actions/accounts.js
+++ b/app/javascript/mastodon/actions/accounts.js
@ -76,11 +76,11 @@ export const ACCOUNT_REVEAL = 'ACCOUNT_REVEAL';
 export * from './accounts_typed';

 export function fetchAccount(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchRelationships([id]));
    dispatch(fetchAccountRequest(id));

-    api(getState).get(`/api/v1/accounts/${id}`).then(response => {
+    api().get(`/api/v1/accounts/${id}`).then(response => {
      dispatch(importFetchedAccount(response.data));
      dispatch(fetchAccountSuccess());
    }).catch(error => {
@ -89,10 +89,10 @@ export function fetchAccount(id) {
  };
 }

-export const lookupAccount = acct => (dispatch, getState) => {
+export const lookupAccount = acct => (dispatch) => {
  dispatch(lookupAccountRequest(acct));

-  api(getState).get('/api/v1/accounts/lookup', { params: { acct } }).then(response => {
+  api().get('/api/v1/accounts/lookup', { params: { acct } }).then(response => {
    dispatch(fetchRelationships([response.data.id]));
    dispatch(importFetchedAccount(response.data));
    dispatch(lookupAccountSuccess());
@ -146,7 +146,7 @@ export function followAccount(id, options = { reblogs: true }) {

    dispatch(followAccountRequest({ id, locked }));

-    api(getState).post(`/api/v1/accounts/${id}/follow`, options).then(response => {
+    api().post(`/api/v1/accounts/${id}/follow`, options).then(response => {
      dispatch(followAccountSuccess({relationship: response.data, alreadyFollowing}));
    }).catch(error => {
      dispatch(followAccountFail({ id, error, locked }));
@ -158,7 +158,7 @@ export function unfollowAccount(id) {
  return (dispatch, getState) => {
    dispatch(unfollowAccountRequest(id));

-    api(getState).post(`/api/v1/accounts/${id}/unfollow`).then(response => {
+    api().post(`/api/v1/accounts/${id}/unfollow`).then(response => {
      dispatch(unfollowAccountSuccess({relationship: response.data, statuses: getState().get('statuses')}));
    }).catch(error => {
      dispatch(unfollowAccountFail({ id, error }));
@ -170,7 +170,7 @@ export function blockAccount(id) {
  return (dispatch, getState) => {
    dispatch(blockAccountRequest(id));

-    api(getState).post(`/api/v1/accounts/${id}/block`).then(response => {
+    api().post(`/api/v1/accounts/${id}/block`).then(response => {
      // Pass in entire statuses map so we can use it to filter stuff in different parts of the reducers
      dispatch(blockAccountSuccess({ relationship: response.data, statuses: getState().get('statuses') }));
    }).catch(error => {
@ -180,10 +180,10 @@ export function blockAccount(id) {
 }

 export function unblockAccount(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(unblockAccountRequest(id));

-    api(getState).post(`/api/v1/accounts/${id}/unblock`).then(response => {
+    api().post(`/api/v1/accounts/${id}/unblock`).then(response => {
      dispatch(unblockAccountSuccess({ relationship: response.data }));
    }).catch(error => {
      dispatch(unblockAccountFail({ id, error }));
@ -223,7 +223,7 @@ export function muteAccount(id, notifications, duration=0) {
  return (dispatch, getState) => {
    dispatch(muteAccountRequest(id));

-    api(getState).post(`/api/v1/accounts/${id}/mute`, { notifications, duration }).then(response => {
+    api().post(`/api/v1/accounts/${id}/mute`, { notifications, duration }).then(response => {
      // Pass in entire statuses map so we can use it to filter stuff in different parts of the reducers
      dispatch(muteAccountSuccess({ relationship: response.data, statuses: getState().get('statuses') }));
    }).catch(error => {
@ -233,10 +233,10 @@ export function muteAccount(id, notifications, duration=0) {
 }

 export function unmuteAccount(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(unmuteAccountRequest(id));

-    api(getState).post(`/api/v1/accounts/${id}/unmute`).then(response => {
+    api().post(`/api/v1/accounts/${id}/unmute`).then(response => {
      dispatch(unmuteAccountSuccess({ relationship: response.data }));
    }).catch(error => {
      dispatch(unmuteAccountFail({ id, error }));
@ -274,10 +274,10 @@ export function unmuteAccountFail(error) {


 export function fetchFollowers(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchFollowersRequest(id));

-    api(getState).get(`/api/v1/accounts/${id}/followers`).then(response => {
+    api().get(`/api/v1/accounts/${id}/followers`).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');

      dispatch(importFetchedAccounts(response.data));
@ -324,7 +324,7 @@ export function expandFollowers(id) {

    dispatch(expandFollowersRequest(id));

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');

      dispatch(importFetchedAccounts(response.data));
@ -361,10 +361,10 @@ export function expandFollowersFail(id, error) {
 }

 export function fetchFollowing(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchFollowingRequest(id));

-    api(getState).get(`/api/v1/accounts/${id}/following`).then(response => {
+    api().get(`/api/v1/accounts/${id}/following`).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');

      dispatch(importFetchedAccounts(response.data));
@ -411,7 +411,7 @@ export function expandFollowing(id) {

    dispatch(expandFollowingRequest(id));

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');

      dispatch(importFetchedAccounts(response.data));
@ -460,7 +460,7 @@ export function fetchRelationships(accountIds) {

    dispatch(fetchRelationshipsRequest(newAccountIds));

-    api(getState).get(`/api/v1/accounts/relationships?with_suspended=true&${newAccountIds.map(id => `id[]=${id}`).join('&')}`).then(response => {
+    api().get(`/api/v1/accounts/relationships?with_suspended=true&${newAccountIds.map(id => `id[]=${id}`).join('&')}`).then(response => {
      dispatch(fetchRelationshipsSuccess({ relationships: response.data }));
    }).catch(error => {
      dispatch(fetchRelationshipsFail(error));
@ -486,10 +486,10 @@ export function fetchRelationshipsFail(error) {
 }

 export function fetchFollowRequests() {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchFollowRequestsRequest());

-    api(getState).get('/api/v1/follow_requests').then(response => {
+    api().get('/api/v1/follow_requests').then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedAccounts(response.data));
      dispatch(fetchFollowRequestsSuccess(response.data, next ? next.uri : null));
@ -528,7 +528,7 @@ export function expandFollowRequests() {

    dispatch(expandFollowRequestsRequest());

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedAccounts(response.data));
      dispatch(expandFollowRequestsSuccess(response.data, next ? next.uri : null));
@ -558,10 +558,10 @@ export function expandFollowRequestsFail(error) {
 }

 export function authorizeFollowRequest(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(authorizeFollowRequestRequest(id));

-    api(getState)
+    api()
      .post(`/api/v1/follow_requests/${id}/authorize`)
      .then(() => dispatch(authorizeFollowRequestSuccess({ id })))
      .catch(error => dispatch(authorizeFollowRequestFail(id, error)));
@ -585,10 +585,10 @@ export function authorizeFollowRequestFail(id, error) {


 export function rejectFollowRequest(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(rejectFollowRequestRequest(id));

-    api(getState)
+    api()
      .post(`/api/v1/follow_requests/${id}/reject`)
      .then(() => dispatch(rejectFollowRequestSuccess({ id })))
      .catch(error => dispatch(rejectFollowRequestFail(id, error)));
@ -611,10 +611,10 @@ export function rejectFollowRequestFail(id, error) {
 }

 export function pinAccount(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(pinAccountRequest(id));

-    api(getState).post(`/api/v1/accounts/${id}/pin`).then(response => {
+    api().post(`/api/v1/accounts/${id}/pin`).then(response => {
      dispatch(pinAccountSuccess({ relationship: response.data }));
    }).catch(error => {
      dispatch(pinAccountFail(error));
@ -623,10 +623,10 @@ export function pinAccount(id) {
 }

 export function unpinAccount(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(unpinAccountRequest(id));

-    api(getState).post(`/api/v1/accounts/${id}/unpin`).then(response => {
+    api().post(`/api/v1/accounts/${id}/unpin`).then(response => {
      dispatch(unpinAccountSuccess({ relationship: response.data }));
    }).catch(error => {
      dispatch(unpinAccountFail(error));
@ -662,7 +662,7 @@ export function unpinAccountFail(error) {
  };
 }

-export const updateAccount = ({ displayName, note, avatar, header, discoverable, indexable }) => (dispatch, getState) => {
+export const updateAccount = ({ displayName, note, avatar, header, discoverable, indexable }) => (dispatch) => {
  const data = new FormData();

  data.append('display_name', displayName);
@ -672,7 +672,7 @@ export const updateAccount = ({ displayName, note, avatar, header, discoverable,
  data.append('discoverable', discoverable);
  data.append('indexable', indexable);

-  return api(getState).patch('/api/v1/accounts/update_credentials', data).then(response => {
+  return api().patch('/api/v1/accounts/update_credentials', data).then(response => {
    dispatch(importFetchedAccount(response.data));
  });
 };
--- a/app/javascript/mastodon/actions/announcements.js
+++ b/app/javascript/mastodon/actions/announcements.js
@ -26,10 +26,10 @@ export const ANNOUNCEMENTS_TOGGLE_SHOW = 'ANNOUNCEMENTS_TOGGLE_SHOW';

 const noOp = () => {};

-export const fetchAnnouncements = (done = noOp) => (dispatch, getState) => {
+export const fetchAnnouncements = (done = noOp) => (dispatch) => {
  dispatch(fetchAnnouncementsRequest());

-  api(getState).get('/api/v1/announcements').then(response => {
+  api().get('/api/v1/announcements').then(response => {
    dispatch(fetchAnnouncementsSuccess(response.data.map(x => normalizeAnnouncement(x))));
  }).catch(error => {
    dispatch(fetchAnnouncementsFail(error));
@ -61,10 +61,10 @@ export const updateAnnouncements = announcement => ({
  announcement: normalizeAnnouncement(announcement),
 });

-export const dismissAnnouncement = announcementId => (dispatch, getState) => {
+export const dismissAnnouncement = announcementId => (dispatch) => {
  dispatch(dismissAnnouncementRequest(announcementId));

-  api(getState).post(`/api/v1/announcements/${announcementId}/dismiss`).then(() => {
+  api().post(`/api/v1/announcements/${announcementId}/dismiss`).then(() => {
    dispatch(dismissAnnouncementSuccess(announcementId));
  }).catch(error => {
    dispatch(dismissAnnouncementFail(announcementId, error));
@ -103,7 +103,7 @@ export const addReaction = (announcementId, name) => (dispatch, getState) => {
    dispatch(addReactionRequest(announcementId, name, alreadyAdded));
  }

-  api(getState).put(`/api/v1/announcements/${announcementId}/reactions/${encodeURIComponent(name)}`).then(() => {
+  api().put(`/api/v1/announcements/${announcementId}/reactions/${encodeURIComponent(name)}`).then(() => {
    dispatch(addReactionSuccess(announcementId, name, alreadyAdded));
  }).catch(err => {
    if (!alreadyAdded) {
@ -134,10 +134,10 @@ export const addReactionFail = (announcementId, name, error) => ({
  skipLoading: true,
 });

-export const removeReaction = (announcementId, name) => (dispatch, getState) => {
+export const removeReaction = (announcementId, name) => (dispatch) => {
  dispatch(removeReactionRequest(announcementId, name));

-  api(getState).delete(`/api/v1/announcements/${announcementId}/reactions/${encodeURIComponent(name)}`).then(() => {
+  api().delete(`/api/v1/announcements/${announcementId}/reactions/${encodeURIComponent(name)}`).then(() => {
    dispatch(removeReactionSuccess(announcementId, name));
  }).catch(err => {
    dispatch(removeReactionFail(announcementId, name, err));
--- a/app/javascript/mastodon/actions/blocks.js
+++ b/app/javascript/mastodon/actions/blocks.js
@ -13,10 +13,10 @@ export const BLOCKS_EXPAND_SUCCESS = 'BLOCKS_EXPAND_SUCCESS';
 export const BLOCKS_EXPAND_FAIL    = 'BLOCKS_EXPAND_FAIL';

 export function fetchBlocks() {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchBlocksRequest());

-    api(getState).get('/api/v1/blocks').then(response => {
+    api().get('/api/v1/blocks').then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedAccounts(response.data));
      dispatch(fetchBlocksSuccess(response.data, next ? next.uri : null));
@ -56,7 +56,7 @@ export function expandBlocks() {

    dispatch(expandBlocksRequest());

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedAccounts(response.data));
      dispatch(expandBlocksSuccess(response.data, next ? next.uri : null));
--- a/app/javascript/mastodon/actions/bookmarks.js
+++ b/app/javascript/mastodon/actions/bookmarks.js
@ -18,7 +18,7 @@ export function fetchBookmarkedStatuses() {

    dispatch(fetchBookmarkedStatusesRequest());

-    api(getState).get('/api/v1/bookmarks').then(response => {
+    api().get('/api/v1/bookmarks').then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedStatuses(response.data));
      dispatch(fetchBookmarkedStatusesSuccess(response.data, next ? next.uri : null));
@ -59,7 +59,7 @@ export function expandBookmarkedStatuses() {

    dispatch(expandBookmarkedStatusesRequest());

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedStatuses(response.data));
      dispatch(expandBookmarkedStatusesSuccess(response.data, next ? next.uri : null));
--- a/app/javascript/mastodon/actions/compose.js
+++ b/app/javascript/mastodon/actions/compose.js
@ -196,7 +196,7 @@ export function submitCompose(routerHistory) {
      });
    }

-    api(getState).request({
+    api().request({
      url: statusId === null ? '/api/v1/statuses' : `/api/v1/statuses/${statusId}`,
      method: statusId === null ? 'post' : 'put',
      data: {
@ -304,7 +304,7 @@ export function uploadCompose(files) {
      const data = new FormData();
      data.append('file', file);

-      api(getState).post('/api/v2/media', data, {
+      api().post('/api/v2/media', data, {
        onUploadProgress: function({ loaded }){
          progress[i] = loaded;
          dispatch(uploadComposeProgress(progress.reduce((a, v) => a + v, 0), total));
@ -321,7 +321,7 @@ export function uploadCompose(files) {
          let tryCount = 1;

          const poll = () => {
-            api(getState).get(`/api/v1/media/${data.id}`).then(response => {
+            api().get(`/api/v1/media/${data.id}`).then(response => {
              if (response.status === 200) {
                dispatch(uploadComposeSuccess(response.data, file));
              } else if (response.status === 206) {
@ -343,7 +343,7 @@ export const uploadComposeProcessing = () => ({
  type: COMPOSE_UPLOAD_PROCESSING,
 });

-export const uploadThumbnail = (id, file) => (dispatch, getState) => {
+export const uploadThumbnail = (id, file) => (dispatch) => {
  dispatch(uploadThumbnailRequest());

  const total = file.size;
@ -351,7 +351,7 @@ export const uploadThumbnail = (id, file) => (dispatch, getState) => {

  data.append('thumbnail', file);

-  api(getState).put(`/api/v1/media/${id}`, data, {
+  api().put(`/api/v1/media/${id}`, data, {
    onUploadProgress: ({ loaded }) => {
      dispatch(uploadThumbnailProgress(loaded, total));
    },
@ -434,7 +434,7 @@ export function changeUploadCompose(id, params) {

      dispatch(changeUploadComposeSuccess(data, true));
    } else {
-      api(getState).put(`/api/v1/media/${id}`, params).then(response => {
+      api().put(`/api/v1/media/${id}`, params).then(response => {
        dispatch(changeUploadComposeSuccess(response.data, false));
      }).catch(error => {
        dispatch(changeUploadComposeFail(id, error));
@ -522,7 +522,7 @@ const fetchComposeSuggestionsAccounts = throttle((dispatch, getState, token) =>

  fetchComposeSuggestionsAccountsController = new AbortController();

-  api(getState).get('/api/v1/accounts/search', {
+  api().get('/api/v1/accounts/search', {
    signal: fetchComposeSuggestionsAccountsController.signal,

    params: {
@ -556,7 +556,7 @@ const fetchComposeSuggestionsTags = throttle((dispatch, getState, token) => {

  fetchComposeSuggestionsTagsController = new AbortController();

-  api(getState).get('/api/v2/search', {
+  api().get('/api/v2/search', {
    signal: fetchComposeSuggestionsTagsController.signal,

    params: {
--- a/app/javascript/mastodon/actions/conversations.js
+++ b/app/javascript/mastodon/actions/conversations.js
@ -28,13 +28,13 @@ export const unmountConversations = () => ({
  type: CONVERSATIONS_UNMOUNT,
 });

-export const markConversationRead = conversationId => (dispatch, getState) => {
+export const markConversationRead = conversationId => (dispatch) => {
  dispatch({
    type: CONVERSATIONS_READ,
    id: conversationId,
  });

-  api(getState).post(`/api/v1/conversations/${conversationId}/read`);
+  api().post(`/api/v1/conversations/${conversationId}/read`);
 };

 export const expandConversations = ({ maxId } = {}) => (dispatch, getState) => {
@ -48,7 +48,7 @@ export const expandConversations = ({ maxId } = {}) => (dispatch, getState) => {

  const isLoadingRecent = !!params.since_id;

-  api(getState).get('/api/v1/conversations', { params })
+  api().get('/api/v1/conversations', { params })
    .then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');

@ -88,10 +88,10 @@ export const updateConversations = conversation => dispatch => {
  });
 };

-export const deleteConversation = conversationId => (dispatch, getState) => {
+export const deleteConversation = conversationId => (dispatch) => {
  dispatch(deleteConversationRequest(conversationId));

-  api(getState).delete(`/api/v1/conversations/${conversationId}`)
+  api().delete(`/api/v1/conversations/${conversationId}`)
    .then(() => dispatch(deleteConversationSuccess(conversationId)))
    .catch(error => dispatch(deleteConversationFail(conversationId, error)));
 };
--- a/app/javascript/mastodon/actions/custom_emojis.js
+++ b/app/javascript/mastodon/actions/custom_emojis.js
@ -5,10 +5,10 @@ export const CUSTOM_EMOJIS_FETCH_SUCCESS = 'CUSTOM_EMOJIS_FETCH_SUCCESS';
 export const CUSTOM_EMOJIS_FETCH_FAIL = 'CUSTOM_EMOJIS_FETCH_FAIL';

 export function fetchCustomEmojis() {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchCustomEmojisRequest());

-    api(getState).get('/api/v1/custom_emojis').then(response => {
+    api().get('/api/v1/custom_emojis').then(response => {
      dispatch(fetchCustomEmojisSuccess(response.data));
    }).catch(error => {
      dispatch(fetchCustomEmojisFail(error));
--- a/app/javascript/mastodon/actions/directory.js
+++ b/app/javascript/mastodon/actions/directory.js
@ -11,10 +11,10 @@ export const DIRECTORY_EXPAND_REQUEST = 'DIRECTORY_EXPAND_REQUEST';
 export const DIRECTORY_EXPAND_SUCCESS = 'DIRECTORY_EXPAND_SUCCESS';
 export const DIRECTORY_EXPAND_FAIL    = 'DIRECTORY_EXPAND_FAIL';

-export const fetchDirectory = params => (dispatch, getState) => {
+export const fetchDirectory = params => (dispatch) => {
  dispatch(fetchDirectoryRequest());

-  api(getState).get('/api/v1/directory', { params: { ...params, limit: 20 } }).then(({ data }) => {
+  api().get('/api/v1/directory', { params: { ...params, limit: 20 } }).then(({ data }) => {
    dispatch(importFetchedAccounts(data));
    dispatch(fetchDirectorySuccess(data));
    dispatch(fetchRelationships(data.map(x => x.id)));
@ -40,7 +40,7 @@ export const expandDirectory = params => (dispatch, getState) => {

  const loadedItems = getState().getIn(['user_lists', 'directory', 'items']).size;

-  api(getState).get('/api/v1/directory', { params: { ...params, offset: loadedItems, limit: 20 } }).then(({ data }) => {
+  api().get('/api/v1/directory', { params: { ...params, offset: loadedItems, limit: 20 } }).then(({ data }) => {
    dispatch(importFetchedAccounts(data));
    dispatch(expandDirectorySuccess(data));
    dispatch(fetchRelationships(data.map(x => x.id)));
--- a/app/javascript/mastodon/actions/domain_blocks.js
+++ b/app/javascript/mastodon/actions/domain_blocks.js
@ -24,7 +24,7 @@ export function blockDomain(domain) {
  return (dispatch, getState) => {
    dispatch(blockDomainRequest(domain));

-    api(getState).post('/api/v1/domain_blocks', { domain }).then(() => {
+    api().post('/api/v1/domain_blocks', { domain }).then(() => {
      const at_domain = '@' + domain;
      const accounts = getState().get('accounts').filter(item => item.get('acct').endsWith(at_domain)).valueSeq().map(item => item.get('id'));

@ -54,7 +54,7 @@ export function unblockDomain(domain) {
  return (dispatch, getState) => {
    dispatch(unblockDomainRequest(domain));

-    api(getState).delete('/api/v1/domain_blocks', { params: { domain } }).then(() => {
+    api().delete('/api/v1/domain_blocks', { params: { domain } }).then(() => {
      const at_domain = '@' + domain;
      const accounts = getState().get('accounts').filter(item => item.get('acct').endsWith(at_domain)).valueSeq().map(item => item.get('id'));
      dispatch(unblockDomainSuccess({ domain, accounts }));
@ -80,10 +80,10 @@ export function unblockDomainFail(domain, error) {
 }

 export function fetchDomainBlocks() {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchDomainBlocksRequest());

-    api(getState).get('/api/v1/domain_blocks').then(response => {
+    api().get('/api/v1/domain_blocks').then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(fetchDomainBlocksSuccess(response.data, next ? next.uri : null));
    }).catch(err => {
@ -123,7 +123,7 @@ export function expandDomainBlocks() {

    dispatch(expandDomainBlocksRequest());

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(expandDomainBlocksSuccess(response.data, next ? next.uri : null));
    }).catch(err => {
--- a/app/javascript/mastodon/actions/favourites.js
+++ b/app/javascript/mastodon/actions/favourites.js
@ -18,7 +18,7 @@ export function fetchFavouritedStatuses() {

    dispatch(fetchFavouritedStatusesRequest());

-    api(getState).get('/api/v1/favourites').then(response => {
+    api().get('/api/v1/favourites').then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedStatuses(response.data));
      dispatch(fetchFavouritedStatusesSuccess(response.data, next ? next.uri : null));
@ -62,7 +62,7 @@ export function expandFavouritedStatuses() {

    dispatch(expandFavouritedStatusesRequest());

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedStatuses(response.data));
      dispatch(expandFavouritedStatusesSuccess(response.data, next ? next.uri : null));
--- a/app/javascript/mastodon/actions/featured_tags.js
+++ b/app/javascript/mastodon/actions/featured_tags.js
@ -11,7 +11,7 @@ export const fetchFeaturedTags = (id) => (dispatch, getState) => {

  dispatch(fetchFeaturedTagsRequest(id));

-  api(getState).get(`/api/v1/accounts/${id}/featured_tags`)
+  api().get(`/api/v1/accounts/${id}/featured_tags`)
    .then(({ data }) => dispatch(fetchFeaturedTagsSuccess(id, data)))
    .catch(err => dispatch(fetchFeaturedTagsFail(id, err)));
 };
--- a/app/javascript/mastodon/actions/filters.js
+++ b/app/javascript/mastodon/actions/filters.js
@ -23,13 +23,13 @@ export const initAddFilter = (status, { contextType }) => dispatch =>
    },
  }));

-export const fetchFilters = () => (dispatch, getState) => {
+export const fetchFilters = () => (dispatch) => {
  dispatch({
    type: FILTERS_FETCH_REQUEST,
    skipLoading: true,
  });

-  api(getState)
+  api()
    .get('/api/v2/filters')
    .then(({ data }) => dispatch({
      type: FILTERS_FETCH_SUCCESS,
@ -44,10 +44,10 @@ export const fetchFilters = () => (dispatch, getState) => {
    }));
 };

-export const createFilterStatus = (params, onSuccess, onFail) => (dispatch, getState) => {
+export const createFilterStatus = (params, onSuccess, onFail) => (dispatch) => {
  dispatch(createFilterStatusRequest());

-  api(getState).post(`/api/v2/filters/${params.filter_id}/statuses`, params).then(response => {
+  api().post(`/api/v2/filters/${params.filter_id}/statuses`, params).then(response => {
    dispatch(createFilterStatusSuccess(response.data));
    if (onSuccess) onSuccess();
  }).catch(error => {
@ -70,10 +70,10 @@ export const createFilterStatusFail = error => ({
  error,
 });

-export const createFilter = (params, onSuccess, onFail) => (dispatch, getState) => {
+export const createFilter = (params, onSuccess, onFail) => (dispatch) => {
  dispatch(createFilterRequest());

-  api(getState).post('/api/v2/filters', params).then(response => {
+  api().post('/api/v2/filters', params).then(response => {
    dispatch(createFilterSuccess(response.data));
    if (onSuccess) onSuccess(response.data);
  }).catch(error => {
--- a/app/javascript/mastodon/actions/history.js
+++ b/app/javascript/mastodon/actions/history.js
@ -15,7 +15,7 @@ export const fetchHistory = statusId => (dispatch, getState) => {

  dispatch(fetchHistoryRequest(statusId));

-  api(getState).get(`/api/v1/statuses/${statusId}/history`).then(({ data }) => {
+  api().get(`/api/v1/statuses/${statusId}/history`).then(({ data }) => {
    dispatch(importFetchedAccounts(data.map(x => x.account)));
    dispatch(fetchHistorySuccess(statusId, data));
  }).catch(error => dispatch(fetchHistoryFail(error)));
--- a/app/javascript/mastodon/actions/interactions.js
+++ b/app/javascript/mastodon/actions/interactions.js
@ -3,10 +3,6 @@ import api, { getLinks } from '../api';
 import { fetchRelationships } from './accounts';
 import { importFetchedAccounts, importFetchedStatus } from './importer';

-export const REBLOG_REQUEST = 'REBLOG_REQUEST';
-export const REBLOG_SUCCESS = 'REBLOG_SUCCESS';
-export const REBLOG_FAIL    = 'REBLOG_FAIL';
-
 export const REBLOGS_EXPAND_REQUEST = 'REBLOGS_EXPAND_REQUEST';
 export const REBLOGS_EXPAND_SUCCESS = 'REBLOGS_EXPAND_SUCCESS';
 export const REBLOGS_EXPAND_FAIL = 'REBLOGS_EXPAND_FAIL';
@ -15,10 +11,6 @@ export const FAVOURITE_REQUEST = 'FAVOURITE_REQUEST';
 export const FAVOURITE_SUCCESS = 'FAVOURITE_SUCCESS';
 export const FAVOURITE_FAIL    = 'FAVOURITE_FAIL';

-export const UNREBLOG_REQUEST = 'UNREBLOG_REQUEST';
-export const UNREBLOG_SUCCESS = 'UNREBLOG_SUCCESS';
-export const UNREBLOG_FAIL    = 'UNREBLOG_FAIL';
-
 export const UNFAVOURITE_REQUEST = 'UNFAVOURITE_REQUEST';
 export const UNFAVOURITE_SUCCESS = 'UNFAVOURITE_SUCCESS';
 export const UNFAVOURITE_FAIL    = 'UNFAVOURITE_FAIL';
@ -51,89 +43,13 @@ export const UNBOOKMARK_REQUEST = 'UNBOOKMARKED_REQUEST';
 export const UNBOOKMARK_SUCCESS = 'UNBOOKMARKED_SUCCESS';
 export const UNBOOKMARK_FAIL    = 'UNBOOKMARKED_FAIL';

-export function reblog(status, visibility) {
-  return function (dispatch, getState) {
-    dispatch(reblogRequest(status));
-
-    api(getState).post(`/api/v1/statuses/${status.get('id')}/reblog`, { visibility }).then(function (response) {
-      // The reblog API method returns a new status wrapped around the original. In this case we are only
-      // interested in how the original is modified, hence passing it skipping the wrapper
-      dispatch(importFetchedStatus(response.data.reblog));
-      dispatch(reblogSuccess(status));
-    }).catch(function (error) {
-      dispatch(reblogFail(status, error));
-    });
-  };
-}
-
-export function unreblog(status) {
-  return (dispatch, getState) => {
-    dispatch(unreblogRequest(status));
-
-    api(getState).post(`/api/v1/statuses/${status.get('id')}/unreblog`).then(response => {
-      dispatch(importFetchedStatus(response.data));
-      dispatch(unreblogSuccess(status));
-    }).catch(error => {
-      dispatch(unreblogFail(status, error));
-    });
-  };
-}
-
-export function reblogRequest(status) {
-  return {
-    type: REBLOG_REQUEST,
-    status: status,
-    skipLoading: true,
-  };
-}
-
-export function reblogSuccess(status) {
-  return {
-    type: REBLOG_SUCCESS,
-    status: status,
-    skipLoading: true,
-  };
-}
-
-export function reblogFail(status, error) {
-  return {
-    type: REBLOG_FAIL,
-    status: status,
-    error: error,
-    skipLoading: true,
-  };
-}
-
-export function unreblogRequest(status) {
-  return {
-    type: UNREBLOG_REQUEST,
-    status: status,
-    skipLoading: true,
-  };
-}
-
-export function unreblogSuccess(status) {
-  return {
-    type: UNREBLOG_SUCCESS,
-    status: status,
-    skipLoading: true,
-  };
-}
-
-export function unreblogFail(status, error) {
-  return {
-    type: UNREBLOG_FAIL,
-    status: status,
-    error: error,
-    skipLoading: true,
-  };
-}
+export * from "./interactions_typed";

 export function favourite(status) {
-  return function (dispatch, getState) {
+  return function (dispatch) {
    dispatch(favouriteRequest(status));

-    api(getState).post(`/api/v1/statuses/${status.get('id')}/favourite`).then(function (response) {
+    api().post(`/api/v1/statuses/${status.get('id')}/favourite`).then(function (response) {
      dispatch(importFetchedStatus(response.data));
      dispatch(favouriteSuccess(status));
    }).catch(function (error) {
@ -143,10 +59,10 @@ export function favourite(status) {
 }

 export function unfavourite(status) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(unfavouriteRequest(status));

-    api(getState).post(`/api/v1/statuses/${status.get('id')}/unfavourite`).then(response => {
+    api().post(`/api/v1/statuses/${status.get('id')}/unfavourite`).then(response => {
      dispatch(importFetchedStatus(response.data));
      dispatch(unfavouriteSuccess(status));
    }).catch(error => {
@ -206,10 +122,10 @@ export function unfavouriteFail(status, error) {
 }

 export function bookmark(status) {
-  return function (dispatch, getState) {
+  return function (dispatch) {
    dispatch(bookmarkRequest(status));

-    api(getState).post(`/api/v1/statuses/${status.get('id')}/bookmark`).then(function (response) {
+    api().post(`/api/v1/statuses/${status.get('id')}/bookmark`).then(function (response) {
      dispatch(importFetchedStatus(response.data));
      dispatch(bookmarkSuccess(status, response.data));
    }).catch(function (error) {
@ -219,10 +135,10 @@ export function bookmark(status) {
 }

 export function unbookmark(status) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(unbookmarkRequest(status));

-    api(getState).post(`/api/v1/statuses/${status.get('id')}/unbookmark`).then(response => {
+    api().post(`/api/v1/statuses/${status.get('id')}/unbookmark`).then(response => {
      dispatch(importFetchedStatus(response.data));
      dispatch(unbookmarkSuccess(status, response.data));
    }).catch(error => {
@ -278,10 +194,10 @@ export function unbookmarkFail(status, error) {
 }

 export function fetchReblogs(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchReblogsRequest(id));

-    api(getState).get(`/api/v1/statuses/${id}/reblogged_by`).then(response => {
+    api().get(`/api/v1/statuses/${id}/reblogged_by`).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedAccounts(response.data));
      dispatch(fetchReblogsSuccess(id, response.data, next ? next.uri : null));
@ -325,7 +241,7 @@ export function expandReblogs(id) {

    dispatch(expandReblogsRequest(id));

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');

      dispatch(importFetchedAccounts(response.data));
@ -360,10 +276,10 @@ export function expandReblogsFail(id, error) {
 }

 export function fetchFavourites(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchFavouritesRequest(id));

-    api(getState).get(`/api/v1/statuses/${id}/favourited_by`).then(response => {
+    api().get(`/api/v1/statuses/${id}/favourited_by`).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedAccounts(response.data));
      dispatch(fetchFavouritesSuccess(id, response.data, next ? next.uri : null));
@ -407,7 +323,7 @@ export function expandFavourites(id) {

    dispatch(expandFavouritesRequest(id));

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');

      dispatch(importFetchedAccounts(response.data));
@ -442,10 +358,10 @@ export function expandFavouritesFail(id, error) {
 }

 export function pin(status) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(pinRequest(status));

-    api(getState).post(`/api/v1/statuses/${status.get('id')}/pin`).then(response => {
+    api().post(`/api/v1/statuses/${status.get('id')}/pin`).then(response => {
      dispatch(importFetchedStatus(response.data));
      dispatch(pinSuccess(status));
    }).catch(error => {
@ -480,10 +396,10 @@ export function pinFail(status, error) {
 }

 export function unpin (status) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(unpinRequest(status));

-    api(getState).post(`/api/v1/statuses/${status.get('id')}/unpin`).then(response => {
+    api().post(`/api/v1/statuses/${status.get('id')}/unpin`).then(response => {
      dispatch(importFetchedStatus(response.data));
      dispatch(unpinSuccess(status));
    }).catch(error => {
--- a/app/javascript/mastodon/actions/interactions_typed.ts
+++ b/app/javascript/mastodon/actions/interactions_typed.ts
@ -0,0 +1,35 @@
+import { apiReblog, apiUnreblog } from 'mastodon/api/interactions';
+import type { StatusVisibility } from 'mastodon/models/status';
+import { createDataLoadingThunk } from 'mastodon/store/typed_functions';
+
+import { importFetchedStatus } from './importer';
+
+export const reblog = createDataLoadingThunk(
+  'status/reblog',
+  ({
+    statusId,
+    visibility,
+  }: {
+    statusId: string;
+    visibility: StatusVisibility;
+  }) => apiReblog(statusId, visibility),
+  (data, { dispatch, discardLoadData }) => {
+    // The reblog API method returns a new status wrapped around the original. In this case we are only
+    // interested in how the original is modified, hence passing it skipping the wrapper
+    dispatch(importFetchedStatus(data.reblog));
+
+    // The payload is not used in any actions
+    return discardLoadData;
+  },
+);
+
+export const unreblog = createDataLoadingThunk(
+  'status/unreblog',
+  ({ statusId }: { statusId: string }) => apiUnreblog(statusId),
+  (data, { dispatch, discardLoadData }) => {
+    dispatch(importFetchedStatus(data));
+
+    // The payload is not used in any actions
+    return discardLoadData;
+  },
+);
--- a/app/javascript/mastodon/actions/lists.js
+++ b/app/javascript/mastodon/actions/lists.js
@ -57,7 +57,7 @@ export const fetchList = id => (dispatch, getState) => {

  dispatch(fetchListRequest(id));

-  api(getState).get(`/api/v1/lists/${id}`)
+  api().get(`/api/v1/lists/${id}`)
    .then(({ data }) => dispatch(fetchListSuccess(data)))
    .catch(err => dispatch(fetchListFail(id, err)));
 };
@ -78,10 +78,10 @@ export const fetchListFail = (id, error) => ({
  error,
 });

-export const fetchLists = () => (dispatch, getState) => {
+export const fetchLists = () => (dispatch) => {
  dispatch(fetchListsRequest());

-  api(getState).get('/api/v1/lists')
+  api().get('/api/v1/lists')
    .then(({ data }) => dispatch(fetchListsSuccess(data)))
    .catch(err => dispatch(fetchListsFail(err)));
 };
@ -125,10 +125,10 @@ export const changeListEditorTitle = value => ({
  value,
 });

-export const createList = (title, shouldReset) => (dispatch, getState) => {
+export const createList = (title, shouldReset) => (dispatch) => {
  dispatch(createListRequest());

-  api(getState).post('/api/v1/lists', { title }).then(({ data }) => {
+  api().post('/api/v1/lists', { title }).then(({ data }) => {
    dispatch(createListSuccess(data));

    if (shouldReset) {
@ -151,10 +151,10 @@ export const createListFail = error => ({
  error,
 });

-export const updateList = (id, title, shouldReset, isExclusive, replies_policy) => (dispatch, getState) => {
+export const updateList = (id, title, shouldReset, isExclusive, replies_policy) => (dispatch) => {
  dispatch(updateListRequest(id));

-  api(getState).put(`/api/v1/lists/${id}`, { title, replies_policy, exclusive: typeof isExclusive === 'undefined' ? undefined : !!isExclusive }).then(({ data }) => {
+  api().put(`/api/v1/lists/${id}`, { title, replies_policy, exclusive: typeof isExclusive === 'undefined' ? undefined : !!isExclusive }).then(({ data }) => {
    dispatch(updateListSuccess(data));

    if (shouldReset) {
@ -183,10 +183,10 @@ export const resetListEditor = () => ({
  type: LIST_EDITOR_RESET,
 });

-export const deleteList = id => (dispatch, getState) => {
+export const deleteList = id => (dispatch) => {
  dispatch(deleteListRequest(id));

-  api(getState).delete(`/api/v1/lists/${id}`)
+  api().delete(`/api/v1/lists/${id}`)
    .then(() => dispatch(deleteListSuccess(id)))
    .catch(err => dispatch(deleteListFail(id, err)));
 };
@ -207,10 +207,10 @@ export const deleteListFail = (id, error) => ({
  error,
 });

-export const fetchListAccounts = listId => (dispatch, getState) => {
+export const fetchListAccounts = listId => (dispatch) => {
  dispatch(fetchListAccountsRequest(listId));

-  api(getState).get(`/api/v1/lists/${listId}/accounts`, { params: { limit: 0 } }).then(({ data }) => {
+  api().get(`/api/v1/lists/${listId}/accounts`, { params: { limit: 0 } }).then(({ data }) => {
    dispatch(importFetchedAccounts(data));
    dispatch(fetchListAccountsSuccess(listId, data));
  }).catch(err => dispatch(fetchListAccountsFail(listId, err)));
@ -234,7 +234,7 @@ export const fetchListAccountsFail = (id, error) => ({
  error,
 });

-export const fetchListSuggestions = q => (dispatch, getState) => {
+export const fetchListSuggestions = q => (dispatch) => {
  const params = {
    q,
    resolve: false,
@ -242,7 +242,7 @@ export const fetchListSuggestions = q => (dispatch, getState) => {
    following: true,
  };

-  api(getState).get('/api/v1/accounts/search', { params }).then(({ data }) => {
+  api().get('/api/v1/accounts/search', { params }).then(({ data }) => {
    dispatch(importFetchedAccounts(data));
    dispatch(fetchListSuggestionsReady(q, data));
  }).catch(error => dispatch(showAlertForError(error)));
@ -267,10 +267,10 @@ export const addToListEditor = accountId => (dispatch, getState) => {
  dispatch(addToList(getState().getIn(['listEditor', 'listId']), accountId));
 };

-export const addToList = (listId, accountId) => (dispatch, getState) => {
+export const addToList = (listId, accountId) => (dispatch) => {
  dispatch(addToListRequest(listId, accountId));

-  api(getState).post(`/api/v1/lists/${listId}/accounts`, { account_ids: [accountId] })
+  api().post(`/api/v1/lists/${listId}/accounts`, { account_ids: [accountId] })
    .then(() => dispatch(addToListSuccess(listId, accountId)))
    .catch(err => dispatch(addToListFail(listId, accountId, err)));
 };
@ -298,10 +298,10 @@ export const removeFromListEditor = accountId => (dispatch, getState) => {
  dispatch(removeFromList(getState().getIn(['listEditor', 'listId']), accountId));
 };

-export const removeFromList = (listId, accountId) => (dispatch, getState) => {
+export const removeFromList = (listId, accountId) => (dispatch) => {
  dispatch(removeFromListRequest(listId, accountId));

-  api(getState).delete(`/api/v1/lists/${listId}/accounts`, { params: { account_ids: [accountId] } })
+  api().delete(`/api/v1/lists/${listId}/accounts`, { params: { account_ids: [accountId] } })
    .then(() => dispatch(removeFromListSuccess(listId, accountId)))
    .catch(err => dispatch(removeFromListFail(listId, accountId, err)));
 };
@ -338,10 +338,10 @@ export const setupListAdder = accountId => (dispatch, getState) => {
  dispatch(fetchAccountLists(accountId));
 };

-export const fetchAccountLists = accountId => (dispatch, getState) => {
+export const fetchAccountLists = accountId => (dispatch) => {
  dispatch(fetchAccountListsRequest(accountId));

-  api(getState).get(`/api/v1/accounts/${accountId}/lists`)
+  api().get(`/api/v1/accounts/${accountId}/lists`)
    .then(({ data }) => dispatch(fetchAccountListsSuccess(accountId, data)))
    .catch(err => dispatch(fetchAccountListsFail(accountId, err)));
 };
@ -370,4 +370,3 @@ export const addToListAdder = listId => (dispatch, getState) => {
 export const removeFromListAdder = listId => (dispatch, getState) => {
  dispatch(removeFromList(listId, getState().getIn(['listAdder', 'accountId'])));
 };
-
--- a/app/javascript/mastodon/actions/markers.ts
+++ b/app/javascript/mastodon/actions/markers.ts
@ -1,21 +1,24 @@
-import { List as ImmutableList } from 'immutable';
-
 import { debounce } from 'lodash';

 import type { MarkerJSON } from 'mastodon/api_types/markers';
+import { getAccessToken } from 'mastodon/initial_state';
 import type { AppDispatch, RootState } from 'mastodon/store';
 import { createAppAsyncThunk } from 'mastodon/store/typed_functions';

-import api, { authorizationTokenFromState } from '../api';
+import api from '../api';
 import { compareId } from '../compare_id';

 export const synchronouslySubmitMarkers = createAppAsyncThunk(
  'markers/submit',
  async (_args, { getState }) => {
-    const accessToken = authorizationTokenFromState(getState);
+    const accessToken = getAccessToken();
    const params = buildPostMarkersParams(getState());

-    if (Object.keys(params).length === 0 || !accessToken) {
+    if (
+      Object.keys(params).length === 0 ||
+      !accessToken ||
+      accessToken === ''
+    ) {
      return;
    }

@ -71,19 +74,6 @@ interface MarkerParam {
  last_read_id?: string;
 }

-function getLastHomeId(state: RootState): string | undefined {
-  // eslint-disable-next-line @typescript-eslint/no-unsafe-return
-  return (
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-call
-    state
-      // @ts-expect-error state.timelines is not yet typed
-      .getIn(['timelines', 'home', 'items'], ImmutableList())
-      // @ts-expect-error state.timelines is not yet typed
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
-      .find((item) => item !== null)
-  );
-}
-
 function getLastNotificationId(state: RootState): string | undefined {
  // @ts-expect-error state.notifications is not yet typed
  // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-call
@ -93,15 +83,8 @@ function getLastNotificationId(state: RootState): string | undefined {
 const buildPostMarkersParams = (state: RootState) => {
  const params = {} as { home?: MarkerParam; notifications?: MarkerParam };

-  const lastHomeId = getLastHomeId(state);
  const lastNotificationId = getLastNotificationId(state);

-  if (lastHomeId && compareId(lastHomeId, state.markers.home) > 0) {
-    params.home = {
-      last_read_id: lastHomeId,
-    };
-  }
-
  if (
    lastNotificationId &&
    compareId(lastNotificationId, state.markers.notifications) > 0
@ -118,14 +101,14 @@ export const submitMarkersAction = createAppAsyncThunk<{
  home: string | undefined;
  notifications: string | undefined;
 }>('markers/submitAction', async (_args, { getState }) => {
-  const accessToken = authorizationTokenFromState(getState);
+  const accessToken = getAccessToken();
  const params = buildPostMarkersParams(getState());

-  if (Object.keys(params).length === 0 || accessToken === '') {
+  if (Object.keys(params).length === 0 || !accessToken || accessToken === '') {
    return { home: undefined, notifications: undefined };
  }

-  await api(getState).post<MarkerJSON>('/api/v1/markers', params);
+  await api().post<MarkerJSON>('/api/v1/markers', params);

  return {
    home: params.home?.last_read_id,
@ -155,14 +138,11 @@ export const submitMarkers = createAppAsyncThunk(
  },
 );

-export const fetchMarkers = createAppAsyncThunk(
-  'markers/fetch',
-  async (_args, { getState }) => {
-    const response = await api(getState).get<Record<string, MarkerJSON>>(
-      `/api/v1/markers`,
-      { params: { timeline: ['notifications'] } },
-    );
+export const fetchMarkers = createAppAsyncThunk('markers/fetch', async () => {
+  const response = await api().get<Record<string, MarkerJSON>>(
+    `/api/v1/markers`,
+    { params: { timeline: ['notifications'] } },
+  );

-    return { markers: response.data };
-  },
-);
+  return { markers: response.data };
+});
--- a/app/javascript/mastodon/actions/mutes.js
+++ b/app/javascript/mastodon/actions/mutes.js
@ -13,10 +13,10 @@ export const MUTES_EXPAND_SUCCESS = 'MUTES_EXPAND_SUCCESS';
 export const MUTES_EXPAND_FAIL    = 'MUTES_EXPAND_FAIL';

 export function fetchMutes() {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchMutesRequest());

-    api(getState).get('/api/v1/mutes').then(response => {
+    api().get('/api/v1/mutes').then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedAccounts(response.data));
      dispatch(fetchMutesSuccess(response.data, next ? next.uri : null));
@ -56,7 +56,7 @@ export function expandMutes() {

    dispatch(expandMutesRequest());

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(importFetchedAccounts(response.data));
      dispatch(expandMutesSuccess(response.data, next ? next.uri : null));
--- a/app/javascript/mastodon/actions/notifications.js
+++ b/app/javascript/mastodon/actions/notifications.js
@ -216,7 +216,7 @@ export function expandNotifications({ maxId, forceLoad } = {}, done = noOp) {

    dispatch(expandNotificationsRequest(isLoadingMore));

-    api(getState).get('/api/v1/notifications', { params, signal: expandNotificationsController.signal }).then(response => {
+    api().get('/api/v1/notifications', { params, signal: expandNotificationsController.signal }).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');

      dispatch(importFetchedAccounts(response.data.map(item => item.account)));
@ -262,12 +262,12 @@ export function expandNotificationsFail(error, isLoadingMore) {
 }

 export function clearNotifications() {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch({
      type: NOTIFICATIONS_CLEAR,
    });

-    api(getState).post('/api/v1/notifications/clear');
+    api().post('/api/v1/notifications/clear');
  };
 }

@ -346,10 +346,10 @@ export function setBrowserPermission (value) {
  };
 }

-export const fetchNotificationPolicy = () => (dispatch, getState) => {
+export const fetchNotificationPolicy = () => (dispatch) => {
  dispatch(fetchNotificationPolicyRequest());

-  api(getState).get('/api/v1/notifications/policy').then(({ data }) => {
+  api().get('/api/v1/notifications/policy').then(({ data }) => {
    dispatch(fetchNotificationPolicySuccess(data));
  }).catch(err => {
    dispatch(fetchNotificationPolicyFail(err));
@ -370,10 +370,10 @@ export const fetchNotificationPolicyFail = error => ({
  error,
 });

-export const updateNotificationsPolicy = params => (dispatch, getState) => {
+export const updateNotificationsPolicy = params => (dispatch) => {
  dispatch(fetchNotificationPolicyRequest());

-  api(getState).put('/api/v1/notifications/policy', params).then(({ data }) => {
+  api().put('/api/v1/notifications/policy', params).then(({ data }) => {
    dispatch(fetchNotificationPolicySuccess(data));
  }).catch(err => {
    dispatch(fetchNotificationPolicyFail(err));
@ -393,7 +393,7 @@ export const fetchNotificationRequests = () => (dispatch, getState) => {

  dispatch(fetchNotificationRequestsRequest());

-  api(getState).get('/api/v1/notifications/requests', { params }).then(response => {
+  api().get('/api/v1/notifications/requests', { params }).then(response => {
    const next = getLinks(response).refs.find(link => link.rel === 'next');
    dispatch(importFetchedAccounts(response.data.map(x => x.account)));
    dispatch(fetchNotificationRequestsSuccess(response.data, next ? next.uri : null));
@ -426,7 +426,7 @@ export const expandNotificationRequests = () => (dispatch, getState) => {

  dispatch(expandNotificationRequestsRequest());

-  api(getState).get(url).then(response => {
+  api().get(url).then(response => {
    const next = getLinks(response).refs.find(link => link.rel === 'next');
    dispatch(importFetchedAccounts(response.data.map(x => x.account)));
    dispatch(expandNotificationRequestsSuccess(response.data, next?.uri));
@ -459,7 +459,7 @@ export const fetchNotificationRequest = id => (dispatch, getState) => {

  dispatch(fetchNotificationRequestRequest(id));

-  api(getState).get(`/api/v1/notifications/requests/${id}`).then(({ data }) => {
+  api().get(`/api/v1/notifications/requests/${id}`).then(({ data }) => {
    dispatch(fetchNotificationRequestSuccess(data));
  }).catch(err => {
    dispatch(fetchNotificationRequestFail(id, err));
@ -482,10 +482,10 @@ export const fetchNotificationRequestFail = (id, error) => ({
  error,
 });

-export const acceptNotificationRequest = id => (dispatch, getState) => {
+export const acceptNotificationRequest = id => (dispatch) => {
  dispatch(acceptNotificationRequestRequest(id));

-  api(getState).post(`/api/v1/notifications/requests/${id}/accept`).then(() => {
+  api().post(`/api/v1/notifications/requests/${id}/accept`).then(() => {
    dispatch(acceptNotificationRequestSuccess(id));
  }).catch(err => {
    dispatch(acceptNotificationRequestFail(id, err));
@ -508,10 +508,10 @@ export const acceptNotificationRequestFail = (id, error) => ({
  error,
 });

-export const dismissNotificationRequest = id => (dispatch, getState) => {
+export const dismissNotificationRequest = id => (dispatch) => {
  dispatch(dismissNotificationRequestRequest(id));

-  api(getState).post(`/api/v1/notifications/requests/${id}/dismiss`).then(() =>{
+  api().post(`/api/v1/notifications/requests/${id}/dismiss`).then(() =>{
    dispatch(dismissNotificationRequestSuccess(id));
  }).catch(err => {
    dispatch(dismissNotificationRequestFail(id, err));
@ -550,7 +550,7 @@ export const fetchNotificationsForRequest = accountId => (dispatch, getState) =>

  dispatch(fetchNotificationsForRequestRequest());

-  api(getState).get('/api/v1/notifications', { params }).then(response => {
+  api().get('/api/v1/notifications', { params }).then(response => {
    const next = getLinks(response).refs.find(link => link.rel === 'next');
    dispatch(importFetchedAccounts(response.data.map(item => item.account)));
    dispatch(importFetchedStatuses(response.data.map(item => item.status).filter(status => !!status)));
@ -586,7 +586,7 @@ export const expandNotificationsForRequest = () => (dispatch, getState) => {

  dispatch(expandNotificationsForRequestRequest());

-  api(getState).get(url).then(response => {
+  api().get(url).then(response => {
    const next = getLinks(response).refs.find(link => link.rel === 'next');
    dispatch(importFetchedAccounts(response.data.map(item => item.account)));
    dispatch(importFetchedStatuses(response.data.map(item => item.status).filter(status => !!status)));
--- a/app/javascript/mastodon/actions/pin_statuses.js
+++ b/app/javascript/mastodon/actions/pin_statuses.js
@ -8,10 +8,10 @@ export const PINNED_STATUSES_FETCH_SUCCESS = 'PINNED_STATUSES_FETCH_SUCCESS';
 export const PINNED_STATUSES_FETCH_FAIL = 'PINNED_STATUSES_FETCH_FAIL';

 export function fetchPinnedStatuses() {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchPinnedStatusesRequest());

-    api(getState).get(`/api/v1/accounts/${me}/statuses`, { params: { pinned: true } }).then(response => {
+    api().get(`/api/v1/accounts/${me}/statuses`, { params: { pinned: true } }).then(response => {
      dispatch(importFetchedStatuses(response.data));
      dispatch(fetchPinnedStatusesSuccess(response.data, null));
    }).catch(error => {
--- a/app/javascript/mastodon/actions/polls.js
+++ b/app/javascript/mastodon/actions/polls.js
@ -10,10 +10,10 @@ export const POLL_FETCH_REQUEST = 'POLL_FETCH_REQUEST';
 export const POLL_FETCH_SUCCESS = 'POLL_FETCH_SUCCESS';
 export const POLL_FETCH_FAIL    = 'POLL_FETCH_FAIL';

-export const vote = (pollId, choices) => (dispatch, getState) => {
+export const vote = (pollId, choices) => (dispatch) => {
  dispatch(voteRequest());

-  api(getState).post(`/api/v1/polls/${pollId}/votes`, { choices })
+  api().post(`/api/v1/polls/${pollId}/votes`, { choices })
    .then(({ data }) => {
      dispatch(importFetchedPoll(data));
      dispatch(voteSuccess(data));
@ -21,10 +21,10 @@ export const vote = (pollId, choices) => (dispatch, getState) => {
    .catch(err => dispatch(voteFail(err)));
 };

-export const fetchPoll = pollId => (dispatch, getState) => {
+export const fetchPoll = pollId => (dispatch) => {
  dispatch(fetchPollRequest());

-  api(getState).get(`/api/v1/polls/${pollId}`)
+  api().get(`/api/v1/polls/${pollId}`)
    .then(({ data }) => {
      dispatch(importFetchedPoll(data));
      dispatch(fetchPollSuccess(data));
--- a/app/javascript/mastodon/actions/reports.js
+++ b/app/javascript/mastodon/actions/reports.js
@ -15,10 +15,10 @@ export const initReport = (account, status) => dispatch =>
    },
  }));

-export const submitReport = (params, onSuccess, onFail) => (dispatch, getState) => {
+export const submitReport = (params, onSuccess, onFail) => (dispatch) => {
  dispatch(submitReportRequest());

-  api(getState).post('/api/v1/reports', params).then(response => {
+  api().post('/api/v1/reports', params).then(response => {
    dispatch(submitReportSuccess(response.data));
    if (onSuccess) onSuccess();
  }).catch(error => {
--- a/app/javascript/mastodon/actions/search.js
+++ b/app/javascript/mastodon/actions/search.js
@ -46,7 +46,7 @@ export function submitSearch(type) {

    dispatch(fetchSearchRequest(type));

-    api(getState).get('/api/v2/search', {
+    api().get('/api/v2/search', {
      params: {
        q: value,
        resolve: signedIn,
@ -99,7 +99,7 @@ export const expandSearch = type => (dispatch, getState) => {

  dispatch(expandSearchRequest(type));

-  api(getState).get('/api/v2/search', {
+  api().get('/api/v2/search', {
    params: {
      q: value,
      type,
@ -156,7 +156,7 @@ export const openURL = (value, history, onFailure) => (dispatch, getState) => {

  dispatch(fetchSearchRequest());

-  api(getState).get('/api/v2/search', { params: { q: value, resolve: true } }).then(response => {
+  api().get('/api/v2/search', { params: { q: value, resolve: true } }).then(response => {
    if (response.data.accounts?.length > 0) {
      dispatch(importFetchedAccounts(response.data.accounts));
      history.push(`/@${response.data.accounts[0].acct}`);
--- a/app/javascript/mastodon/actions/server.js
+++ b/app/javascript/mastodon/actions/server.js
@ -25,7 +25,7 @@ export const fetchServer = () => (dispatch, getState) => {

  dispatch(fetchServerRequest());

-  api(getState)
+  api()
    .get('/api/v2/instance').then(({ data }) => {
      if (data.contact.account) dispatch(importFetchedAccount(data.contact.account));
      dispatch(fetchServerSuccess(data));
@ -46,10 +46,10 @@ const fetchServerFail = error => ({
  error,
 });

-export const fetchServerTranslationLanguages = () => (dispatch, getState) => {
+export const fetchServerTranslationLanguages = () => (dispatch) => {
  dispatch(fetchServerTranslationLanguagesRequest());

-  api(getState)
+  api()
    .get('/api/v1/instance/translation_languages').then(({ data }) => {
      dispatch(fetchServerTranslationLanguagesSuccess(data));
    }).catch(err => dispatch(fetchServerTranslationLanguagesFail(err)));
@ -76,7 +76,7 @@ export const fetchExtendedDescription = () => (dispatch, getState) => {

  dispatch(fetchExtendedDescriptionRequest());

-  api(getState)
+  api()
    .get('/api/v1/instance/extended_description')
    .then(({ data }) => dispatch(fetchExtendedDescriptionSuccess(data)))
    .catch(err => dispatch(fetchExtendedDescriptionFail(err)));
@ -103,7 +103,7 @@ export const fetchDomainBlocks = () => (dispatch, getState) => {

  dispatch(fetchDomainBlocksRequest());

-  api(getState)
+  api()
    .get('/api/v1/instance/domain_blocks')
    .then(({ data }) => dispatch(fetchDomainBlocksSuccess(true, data)))
    .catch(err => {
--- a/app/javascript/mastodon/actions/settings.js
+++ b/app/javascript/mastodon/actions/settings.js
@ -20,7 +20,7 @@ export function changeSetting(path, value) {
 }

 const debouncedSave = debounce((dispatch, getState) => {
-  if (getState().getIn(['settings', 'saved'])) {
+  if (getState().getIn(['settings', 'saved']) || !getState().getIn(['meta', 'me'])) {
    return;
  }

--- a/app/javascript/mastodon/actions/statuses.js
+++ b/app/javascript/mastodon/actions/statuses.js
@ -59,7 +59,7 @@ export function fetchStatus(id, forceFetch = false) {

    dispatch(fetchStatusRequest(id, skipLoading));

-    api(getState).get(`/api/v1/statuses/${id}`).then(response => {
+    api().get(`/api/v1/statuses/${id}`).then(response => {
      dispatch(importFetchedStatus(response.data));
      dispatch(fetchStatusSuccess(skipLoading));
    }).catch(error => {
@ -102,7 +102,7 @@ export const editStatus = (id, routerHistory) => (dispatch, getState) => {

  dispatch(fetchStatusSourceRequest());

-  api(getState).get(`/api/v1/statuses/${id}/source`).then(response => {
+  api().get(`/api/v1/statuses/${id}/source`).then(response => {
    dispatch(fetchStatusSourceSuccess());
    ensureComposeIsVisible(getState, routerHistory);
    dispatch(setComposeToStatus(status, response.data.text, response.data.spoiler_text));
@ -134,7 +134,7 @@ export function deleteStatus(id, routerHistory, withRedraft = false) {

    dispatch(deleteStatusRequest(id));

-    api(getState).delete(`/api/v1/statuses/${id}`).then(response => {
+    api().delete(`/api/v1/statuses/${id}`).then(response => {
      dispatch(deleteStatusSuccess(id));
      dispatch(deleteFromTimelines(id));
      dispatch(importFetchedAccount(response.data.account));
@ -175,10 +175,10 @@ export const updateStatus = status => dispatch =>
  dispatch(importFetchedStatus(status));

 export function fetchContext(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchContextRequest(id));

-    api(getState).get(`/api/v1/statuses/${id}/context`).then(response => {
+    api().get(`/api/v1/statuses/${id}/context`).then(response => {
      dispatch(importFetchedStatuses(response.data.ancestors.concat(response.data.descendants)));
      dispatch(fetchContextSuccess(id, response.data.ancestors, response.data.descendants));

@ -219,10 +219,10 @@ export function fetchContextFail(id, error) {
 }

 export function muteStatus(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(muteStatusRequest(id));

-    api(getState).post(`/api/v1/statuses/${id}/mute`).then(() => {
+    api().post(`/api/v1/statuses/${id}/mute`).then(() => {
      dispatch(muteStatusSuccess(id));
    }).catch(error => {
      dispatch(muteStatusFail(id, error));
@ -253,10 +253,10 @@ export function muteStatusFail(id, error) {
 }

 export function unmuteStatus(id) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(unmuteStatusRequest(id));

-    api(getState).post(`/api/v1/statuses/${id}/unmute`).then(() => {
+    api().post(`/api/v1/statuses/${id}/unmute`).then(() => {
      dispatch(unmuteStatusSuccess(id));
    }).catch(error => {
      dispatch(unmuteStatusFail(id, error));
@ -316,10 +316,10 @@ export function toggleStatusCollapse(id, isCollapsed) {
  };
 }

-export const translateStatus = id => (dispatch, getState) => {
+export const translateStatus = id => (dispatch) => {
  dispatch(translateStatusRequest(id));

-  api(getState).post(`/api/v1/statuses/${id}/translate`).then(response => {
+  api().post(`/api/v1/statuses/${id}/translate`).then(response => {
    dispatch(translateStatusSuccess(id, response.data));
  }).catch(error => {
    dispatch(translateStatusFail(id, error));
--- a/app/javascript/mastodon/actions/suggestions.js
+++ b/app/javascript/mastodon/actions/suggestions.js
@ -10,10 +10,10 @@ export const SUGGESTIONS_FETCH_FAIL    = 'SUGGESTIONS_FETCH_FAIL';
 export const SUGGESTIONS_DISMISS = 'SUGGESTIONS_DISMISS';

 export function fetchSuggestions(withRelationships = false) {
-  return (dispatch, getState) => {
+  return (dispatch) => {
    dispatch(fetchSuggestionsRequest());

-    api(getState).get('/api/v2/suggestions', { params: { limit: 20 } }).then(response => {
+    api().get('/api/v2/suggestions', { params: { limit: 20 } }).then(response => {
      dispatch(importFetchedAccounts(response.data.map(x => x.account)));
      dispatch(fetchSuggestionsSuccess(response.data));

@ -48,11 +48,11 @@ export function fetchSuggestionsFail(error) {
  };
 }

-export const dismissSuggestion = accountId => (dispatch, getState) => {
+export const dismissSuggestion = accountId => (dispatch) => {
  dispatch({
    type: SUGGESTIONS_DISMISS,
    id: accountId,
  });

-  api(getState).delete(`/api/v1/suggestions/${accountId}`).catch(() => {});
+  api().delete(`/api/v1/suggestions/${accountId}`).catch(() => {});
 };
--- a/app/javascript/mastodon/actions/tags.js
+++ b/app/javascript/mastodon/actions/tags.js
@ -20,10 +20,10 @@ export const HASHTAG_UNFOLLOW_REQUEST = 'HASHTAG_UNFOLLOW_REQUEST';
 export const HASHTAG_UNFOLLOW_SUCCESS = 'HASHTAG_UNFOLLOW_SUCCESS';
 export const HASHTAG_UNFOLLOW_FAIL    = 'HASHTAG_UNFOLLOW_FAIL';

-export const fetchHashtag = name => (dispatch, getState) => {
+export const fetchHashtag = name => (dispatch) => {
  dispatch(fetchHashtagRequest());

-  api(getState).get(`/api/v1/tags/${name}`).then(({ data }) => {
+  api().get(`/api/v1/tags/${name}`).then(({ data }) => {
    dispatch(fetchHashtagSuccess(name, data));
  }).catch(err => {
    dispatch(fetchHashtagFail(err));
@ -45,10 +45,10 @@ export const fetchHashtagFail = error => ({
  error,
 });

-export const fetchFollowedHashtags = () => (dispatch, getState) => {
+export const fetchFollowedHashtags = () => (dispatch) => {
  dispatch(fetchFollowedHashtagsRequest());

-  api(getState).get('/api/v1/followed_tags').then(response => {
+  api().get('/api/v1/followed_tags').then(response => {
    const next = getLinks(response).refs.find(link => link.rel === 'next');
    dispatch(fetchFollowedHashtagsSuccess(response.data, next ? next.uri : null));
  }).catch(err => {
@ -87,7 +87,7 @@ export function expandFollowedHashtags() {

    dispatch(expandFollowedHashtagsRequest());

-    api(getState).get(url).then(response => {
+    api().get(url).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');
      dispatch(expandFollowedHashtagsSuccess(response.data, next ? next.uri : null));
    }).catch(error => {
@ -117,10 +117,10 @@ export function expandFollowedHashtagsFail(error) {
  };
 }

-export const followHashtag = name => (dispatch, getState) => {
+export const followHashtag = name => (dispatch) => {
  dispatch(followHashtagRequest(name));

-  api(getState).post(`/api/v1/tags/${name}/follow`).then(({ data }) => {
+  api().post(`/api/v1/tags/${name}/follow`).then(({ data }) => {
    dispatch(followHashtagSuccess(name, data));
  }).catch(err => {
    dispatch(followHashtagFail(name, err));
@ -144,10 +144,10 @@ export const followHashtagFail = (name, error) => ({
  error,
 });

-export const unfollowHashtag = name => (dispatch, getState) => {
+export const unfollowHashtag = name => (dispatch) => {
  dispatch(unfollowHashtagRequest(name));

-  api(getState).post(`/api/v1/tags/${name}/unfollow`).then(({ data }) => {
+  api().post(`/api/v1/tags/${name}/unfollow`).then(({ data }) => {
    dispatch(unfollowHashtagSuccess(name, data));
  }).catch(err => {
    dispatch(unfollowHashtagFail(name, err));
--- a/app/javascript/mastodon/actions/timelines.js
+++ b/app/javascript/mastodon/actions/timelines.js
@ -114,7 +114,7 @@ export function expandTimeline(timelineId, path, params = {}, done = noOp) {

    dispatch(expandTimelineRequest(timelineId, isLoadingMore));

-    api(getState).get(path, { params }).then(response => {
+    api().get(path, { params }).then(response => {
      const next = getLinks(response).refs.find(link => link.rel === 'next');

      dispatch(importFetchedStatuses(response.data));
--- a/app/javascript/mastodon/actions/trends.js
+++ b/app/javascript/mastodon/actions/trends.js
@ -18,10 +18,10 @@ export const TRENDS_STATUSES_EXPAND_REQUEST = 'TRENDS_STATUSES_EXPAND_REQUEST';
 export const TRENDS_STATUSES_EXPAND_SUCCESS = 'TRENDS_STATUSES_EXPAND_SUCCESS';
 export const TRENDS_STATUSES_EXPAND_FAIL    = 'TRENDS_STATUSES_EXPAND_FAIL';

-export const fetchTrendingHashtags = () => (dispatch, getState) => {
+export const fetchTrendingHashtags = () => (dispatch) => {
  dispatch(fetchTrendingHashtagsRequest());

-  api(getState)
+  api()
    .get('/api/v1/trends/tags')
    .then(({ data }) => dispatch(fetchTrendingHashtagsSuccess(data)))
    .catch(err => dispatch(fetchTrendingHashtagsFail(err)));
@ -45,10 +45,10 @@ export const fetchTrendingHashtagsFail = error => ({
  skipAlert: true,
 });

-export const fetchTrendingLinks = () => (dispatch, getState) => {
+export const fetchTrendingLinks = () => (dispatch) => {
  dispatch(fetchTrendingLinksRequest());

-  api(getState)
+  api()
    .get('/api/v1/trends/links')
    .then(({ data }) => dispatch(fetchTrendingLinksSuccess(data)))
    .catch(err => dispatch(fetchTrendingLinksFail(err)));
@ -79,7 +79,7 @@ export const fetchTrendingStatuses = () => (dispatch, getState) => {

  dispatch(fetchTrendingStatusesRequest());

-  api(getState).get('/api/v1/trends/statuses').then(response => {
+  api().get('/api/v1/trends/statuses').then(response => {
    const next = getLinks(response).refs.find(link => link.rel === 'next');
    dispatch(importFetchedStatuses(response.data));
    dispatch(fetchTrendingStatusesSuccess(response.data, next ? next.uri : null));
@ -115,7 +115,7 @@ export const expandTrendingStatuses = () => (dispatch, getState) => {

  dispatch(expandTrendingStatusesRequest());

-  api(getState).get(url).then(response => {
+  api().get(url).then(response => {
    const next = getLinks(response).refs.find(link => link.rel === 'next');
    dispatch(importFetchedStatuses(response.data));
    dispatch(expandTrendingStatusesSuccess(response.data, next ? next.uri : null));
--- a/app/javascript/mastodon/api.ts
+++ b/app/javascript/mastodon/api.ts
@ -1,9 +1,9 @@
-import type { AxiosResponse, RawAxiosRequestHeaders } from 'axios';
+import type { AxiosResponse, Method, RawAxiosRequestHeaders } from 'axios';
 import axios from 'axios';
 import LinkHeader from 'http-link-header';

+import { getAccessToken } from './initial_state';
 import ready from './ready';
-import type { GetState } from './store';

 export const getLinks = (response: AxiosResponse) => {
  const value = response.headers.link as string | undefined;
@ -29,30 +29,22 @@ const setCSRFHeader = () => {

 void ready(setCSRFHeader);

-export const authorizationTokenFromState = (getState?: GetState) => {
-  return (
-    getState && (getState().meta.get('access_token', '') as string | false)
-  );
-};
+const authorizationTokenFromInitialState = (): RawAxiosRequestHeaders => {
+  const accessToken = getAccessToken();

-const authorizationHeaderFromState = (getState?: GetState) => {
-  const accessToken = authorizationTokenFromState(getState);
-
-  if (!accessToken) {
-    return {};
-  }
+  if (!accessToken) return {};

  return {
    Authorization: `Bearer ${accessToken}`,
-  } as RawAxiosRequestHeaders;
+  };
 };

 // eslint-disable-next-line import/no-default-export
-export default function api(getState: GetState) {
+export default function api(withAuthorization = true) {
  return axios.create({
    headers: {
      ...csrfHeader,
-      ...authorizationHeaderFromState(getState),
+      ...(withAuthorization ? authorizationTokenFromInitialState() : {}),
    },

    transformResponse: [
@ -66,3 +58,17 @@ export default function api(getState: GetState) {
    ],
  });
 }
+
+export async function apiRequest<ApiResponse = unknown>(
+  method: Method,
+  url: string,
+  params?: Record<string, unknown>,
+) {
+  const { data } = await api().request<ApiResponse>({
+    method,
+    url: '/api/' + url,
+    data: params,
+  });
+
+  return data;
+}
--- a/app/javascript/mastodon/api/accounts.ts
+++ b/app/javascript/mastodon/api/accounts.ts
@ -0,0 +1,7 @@
+import { apiRequest } from 'mastodon/api';
+import type { ApiRelationshipJSON } from 'mastodon/api_types/relationships';
+
+export const apiSubmitAccountNote = (id: string, value: string) =>
+  apiRequest<ApiRelationshipJSON>('post', `v1/accounts/${id}/note`, {
+    comment: value,
+  });
--- a/app/javascript/mastodon/api/interactions.ts
+++ b/app/javascript/mastodon/api/interactions.ts
@ -0,0 +1,10 @@
+import { apiRequest } from 'mastodon/api';
+import type { Status, StatusVisibility } from 'mastodon/models/status';
+
+export const apiReblog = (statusId: string, visibility: StatusVisibility) =>
+  apiRequest<{ reblog: Status }>('post', `v1/statuses/${statusId}/reblog`, {
+    visibility,
+  });
+
+export const apiUnreblog = (statusId: string) =>
+  apiRequest<Status>('post', `v1/statuses/${statusId}/unreblog`);
--- a/app/javascript/mastodon/components/account.jsx
+++ b/app/javascript/mastodon/components/account.jsx
@ -172,7 +172,6 @@ Account.propTypes = {
  onBlock: PropTypes.func,
  onMute: PropTypes.func,
  onMuteNotifications: PropTypes.func,
-  intl: PropTypes.object.isRequired,
  hidden: PropTypes.bool,
  minimal: PropTypes.bool,
  defaultAction: PropTypes.string,
--- a/app/javascript/mastodon/components/admin/Counter.jsx
+++ b/app/javascript/mastodon/components/admin/Counter.jsx
@ -48,7 +48,7 @@ export default class Counter extends PureComponent {
  componentDidMount () {
    const { measure, start_at, end_at, params } = this.props;

-    api().post('/api/v1/admin/measures', { keys: [measure], start_at, end_at, [measure]: params }).then(res => {
+    api(false).post('/api/v1/admin/measures', { keys: [measure], start_at, end_at, [measure]: params }).then(res => {
      this.setState({
        loading: false,
        data: res.data,
--- a/app/javascript/mastodon/components/admin/Dimension.jsx
+++ b/app/javascript/mastodon/components/admin/Dimension.jsx
@ -26,7 +26,7 @@ export default class Dimension extends PureComponent {
  componentDidMount () {
    const { start_at, end_at, dimension, limit, params } = this.props;

-    api().post('/api/v1/admin/dimensions', { keys: [dimension], start_at, end_at, limit, [dimension]: params }).then(res => {
+    api(false).post('/api/v1/admin/dimensions', { keys: [dimension], start_at, end_at, limit, [dimension]: params }).then(res => {
      this.setState({
        loading: false,
        data: res.data,
--- a/app/javascript/mastodon/components/admin/ImpactReport.jsx
+++ b/app/javascript/mastodon/components/admin/ImpactReport.jsx
@ -27,7 +27,7 @@ export default class ImpactReport extends PureComponent {
      include_subdomains: true,
    };

-    api().post('/api/v1/admin/measures', {
+    api(false).post('/api/v1/admin/measures', {
      keys: ['instance_accounts', 'instance_follows', 'instance_followers'],
      start_at: null,
      end_at: null,
--- a/app/javascript/mastodon/components/admin/ReportReasonSelector.jsx
+++ b/app/javascript/mastodon/components/admin/ReportReasonSelector.jsx
@ -105,7 +105,7 @@ class ReportReasonSelector extends PureComponent {
  };

  componentDidMount() {
-    api().get('/api/v1/instance').then(res => {
+    api(false).get('/api/v1/instance').then(res => {
      this.setState({
        rules: res.data.rules,
      });
@ -122,7 +122,7 @@ class ReportReasonSelector extends PureComponent {
      return;
    }

-    api().put(`/api/v1/admin/reports/${id}`, {
+    api(false).put(`/api/v1/admin/reports/${id}`, {
      category,
      rule_ids: category === 'violation' ? rule_ids : [],
    }).catch(err => {
--- a/Show more
+++ b/Show more
 @ -1 +1 @@
 .12
 .13
 @ -1 +1 @@
 .2.4
 .3.1