From f198ec7c1cb9c13fea42ad1b6062ede5d8198fb8 Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Wed, 4 Mar 2026 12:18:28 +0100
Subject: [PATCH 01/11] Fix existing posts not being removed from lists when a
 list member is unfollowed (#38048)

---
 app/services/unfollow_service.rb       | 43 +++++++++-------
 spec/services/unfollow_service_spec.rb | 69 ++++++++++++++------------
 2 files changed, 60 insertions(+), 52 deletions(-)

diff --git a/app/services/unfollow_service.rb b/app/services/unfollow_service.rb
index 1ea8af6992..385aa0c7b1 100644
--- a/app/services/unfollow_service.rb
+++ b/app/services/unfollow_service.rb
@@ -6,16 +6,16 @@ class UnfollowService < BaseService
   include Lockable
 
   # Unfollow and notify the remote user
-  # @param [Account] source_account Where to unfollow from
-  # @param [Account] target_account Which to unfollow
+  # @param [Account] follower Where to unfollow from
+  # @param [Account] followee Which to unfollow
   # @param [Hash] options
   # @option [Boolean] :skip_unmerge
-  def call(source_account, target_account, options = {})
-    @source_account = source_account
-    @target_account = target_account
-    @options        = options
+  def call(follower, followee, options = {})
+    @follower = follower
+    @followee = followee
+    @options  = options
 
-    with_redis_lock("relationship:#{[source_account.id, target_account.id].sort.join(':')}") do
+    with_redis_lock("relationship:#{[follower.id, followee.id].sort.join(':')}") do
       unfollow! || undo_follow_request!
     end
   end
@@ -23,19 +23,25 @@ class UnfollowService < BaseService
   private
 
   def unfollow!
-    follow = Follow.find_by(account: @source_account, target_account: @target_account)
-
+    follow = Follow.find_by(account: @follower, target_account: @followee)
     return unless follow
 
+    # List members are removed immediately with the follow relationship removal,
+    # so we need to fetch the list IDs first
+    list_ids = @follower.owned_lists.with_list_account(@followee).pluck(:list_id) unless @options[:skip_unmerge]
+
     follow.destroy!
 
-    create_notification(follow) if !@target_account.local? && @target_account.activitypub?
-    create_reject_notification(follow) if @target_account.local? && !@source_account.local? && @source_account.activitypub?
+    if @followee.local? && @follower.remote? && @follower.activitypub?
+      send_reject_follow(follow)
+    elsif @followee.remote? && @followee.activitypub?
+      send_undo_follow(follow)
+    end
 
     unless @options[:skip_unmerge]
-      UnmergeWorker.perform_async(@target_account.id, @source_account.id, 'home')
-      UnmergeWorker.push_bulk(@source_account.owned_lists.with_list_account(@target_account).pluck(:list_id)) do |list_id|
-        [@target_account.id, list_id, 'list']
+      UnmergeWorker.perform_async(@followee.id, @follower.id, 'home')
+      UnmergeWorker.push_bulk(list_ids) do |list_id|
+        [@followee.id, list_id, 'list']
       end
     end
 
@@ -43,22 +49,21 @@ class UnfollowService < BaseService
   end
 
   def undo_follow_request!
-    follow_request = FollowRequest.find_by(account: @source_account, target_account: @target_account)
-
+    follow_request = FollowRequest.find_by(account: @follower, target_account: @followee)
     return unless follow_request
 
     follow_request.destroy!
 
-    create_notification(follow_request) unless @target_account.local?
+    send_undo_follow(follow_request) unless @followee.local?
 
     follow_request
   end
 
-  def create_notification(follow)
+  def send_undo_follow(follow)
     ActivityPub::DeliveryWorker.perform_async(build_json(follow), follow.account_id, follow.target_account.inbox_url)
   end
 
-  def create_reject_notification(follow)
+  def send_reject_follow(follow)
     ActivityPub::DeliveryWorker.perform_async(build_reject_json(follow), follow.target_account_id, follow.account.inbox_url)
   end
 
diff --git a/spec/services/unfollow_service_spec.rb b/spec/services/unfollow_service_spec.rb
index 6cf24ca5e1..365468e432 100644
--- a/spec/services/unfollow_service_spec.rb
+++ b/spec/services/unfollow_service_spec.rb
@@ -5,54 +5,57 @@ require 'rails_helper'
 RSpec.describe UnfollowService do
   subject { described_class.new }
 
-  let(:sender) { Fabricate(:account, username: 'alice') }
+  let(:follower) { Fabricate(:account) }
+  let(:followee) { Fabricate(:account) }
 
-  describe 'local' do
-    let(:bob) { Fabricate(:account, username: 'bob') }
+  before do
+    follower.follow!(followee)
+  end
 
-    before { sender.follow!(bob) }
+  shared_examples 'when the followee is in a list' do
+    let(:list) { Fabricate(:list, account: follower) }
 
-    it 'destroys the following relation' do
-      subject.call(sender, bob)
+    before do
+      list.accounts << followee
+    end
 
-      expect(sender)
-        .to_not be_following(bob)
+    it 'schedules removal of posts from this user from the list' do
+      expect { subject.call(follower, followee) }
+        .to enqueue_sidekiq_job(UnmergeWorker).with(followee.id, list.id, 'list')
     end
   end
 
-  describe 'remote ActivityPub', :inline_jobs do
-    let(:bob) { Fabricate(:account, username: 'bob', protocol: :activitypub, domain: 'example.com', inbox_url: 'http://example.com/inbox') }
-
-    before do
-      sender.follow!(bob)
-      stub_request(:post, 'http://example.com/inbox').to_return(status: 200)
+  describe 'a local user unfollowing another local user' do
+    it 'destroys the following relation and unmerge from home' do
+      expect { subject.call(follower, followee) }
+        .to change { follower.following?(followee) }.from(true).to(false)
+        .and enqueue_sidekiq_job(UnmergeWorker).with(followee.id, follower.id, 'home')
     end
 
-    it 'destroys the following relation and sends unfollow activity' do
-      subject.call(sender, bob)
-
-      expect(sender)
-        .to_not be_following(bob)
-      expect(a_request(:post, 'http://example.com/inbox'))
-        .to have_been_made.once
-    end
+    it_behaves_like 'when the followee is in a list'
   end
 
-  describe 'remote ActivityPub (reverse)', :inline_jobs do
-    let(:bob) { Fabricate(:account, username: 'bob', protocol: :activitypub, domain: 'example.com', inbox_url: 'http://example.com/inbox') }
+  describe 'a local user unfollowing a remote ActivityPub user' do
+    let(:followee) { Fabricate(:account, username: 'bob', protocol: :activitypub, domain: 'example.com', inbox_url: 'http://example.com/inbox') }
 
-    before do
-      bob.follow!(sender)
-      stub_request(:post, 'http://example.com/inbox').to_return(status: 200)
+    it 'destroys the following relation, unmerge from home and sends undo activity' do
+      expect { subject.call(follower, followee) }
+        .to change { follower.following?(followee) }.from(true).to(false)
+        .and enqueue_sidekiq_job(UnmergeWorker).with(followee.id, follower.id, 'home')
+        .and enqueue_sidekiq_job(ActivityPub::DeliveryWorker).with(match_json_values(type: 'Undo'), follower.id, followee.inbox_url)
     end
 
-    it 'destroys the following relation and sends a reject activity' do
-      subject.call(bob, sender)
+    it_behaves_like 'when the followee is in a list'
+  end
 
-      expect(sender)
-        .to_not be_following(bob)
-      expect(a_request(:post, 'http://example.com/inbox'))
-        .to have_been_made.once
+  describe 'a remote ActivityPub user unfollowing a local user' do
+    let(:follower) { Fabricate(:account, username: 'bob', protocol: :activitypub, domain: 'example.com', inbox_url: 'http://example.com/inbox') }
+
+    it 'destroys the following relation, unmerge from home and sends a reject activity' do
+      expect { subject.call(follower, followee) }
+        .to change { follower.following?(followee) }.from(true).to(false)
+        .and enqueue_sidekiq_job(UnmergeWorker).with(followee.id, follower.id, 'home')
+        .and enqueue_sidekiq_job(ActivityPub::DeliveryWorker).with(match_json_values(type: 'Reject'), followee.id, follower.inbox_url)
     end
   end
 end

From ba22c3f133599034c2f7b5bf4cbc1596c59399a4 Mon Sep 17 00:00:00 2001
From: diondiondion <mail@diondiondion.com>
Date: Tue, 3 Mar 2026 16:26:56 +0100
Subject: [PATCH 02/11] Prevent hover card from showing on touch devices
 (#38039)

---
 .../components/hover_card_controller.tsx      | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/app/javascript/mastodon/components/hover_card_controller.tsx b/app/javascript/mastodon/components/hover_card_controller.tsx
index 38c3306f30..43ca37f50f 100644
--- a/app/javascript/mastodon/components/hover_card_controller.tsx
+++ b/app/javascript/mastodon/components/hover_card_controller.tsx
@@ -23,6 +23,7 @@ export const HoverCardController: React.FC = () => {
   const [open, setOpen] = useState(false);
   const [accountId, setAccountId] = useState<string | undefined>();
   const [anchor, setAnchor] = useState<HTMLElement | null>(null);
+  const isUsingTouchRef = useRef(false);
   const cardRef = useRef<HTMLDivElement | null>(null);
   const [setLeaveTimeout, cancelLeaveTimeout] = useTimeout();
   const [setEnterTimeout, cancelEnterTimeout, delayEnterTimeout] = useTimeout();
@@ -60,6 +61,12 @@ export const HoverCardController: React.FC = () => {
       setAccountId(undefined);
     };
 
+    const handleTouchStart = () => {
+      // Keeping track of touch events to prevent the
+      // hover card from being displayed on touch devices
+      isUsingTouchRef.current = true;
+    };
+
     const handleMouseEnter = (e: MouseEvent) => {
       const { target } = e;
 
@@ -69,6 +76,11 @@ export const HoverCardController: React.FC = () => {
         return;
       }
 
+      // Bail out if a touch is active
+      if (isUsingTouchRef.current) {
+        return;
+      }
+
       // We've entered an anchor
       if (!isScrolling && isHoverCardAnchor(target)) {
         cancelLeaveTimeout();
@@ -127,9 +139,16 @@ export const HoverCardController: React.FC = () => {
     };
 
     const handleMouseMove = () => {
+      if (isUsingTouchRef.current) {
+        isUsingTouchRef.current = false;
+      }
       delayEnterTimeout(enterDelay);
     };
 
+    document.body.addEventListener('touchstart', handleTouchStart, {
+      passive: true,
+    });
+
     document.body.addEventListener('mouseenter', handleMouseEnter, {
       passive: true,
       capture: true,
@@ -151,6 +170,7 @@ export const HoverCardController: React.FC = () => {
     });
 
     return () => {
+      document.body.removeEventListener('touchstart', handleTouchStart);
       document.body.removeEventListener('mouseenter', handleMouseEnter);
       document.body.removeEventListener('mousemove', handleMouseMove);
       document.body.removeEventListener('mouseleave', handleMouseLeave);

From ed521e91e1c780d75374ca5e2ee51bf3bd71f73b Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Wed, 25 Feb 2026 15:30:01 +0100
Subject: [PATCH 03/11] Fix username availability check being wrongly applied
 on race conditions (#37975)

---
 app/javascript/entrypoints/public.tsx | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/app/javascript/entrypoints/public.tsx b/app/javascript/entrypoints/public.tsx
index dd1956446d..ff6819f8ac 100644
--- a/app/javascript/entrypoints/public.tsx
+++ b/app/javascript/entrypoints/public.tsx
@@ -183,15 +183,25 @@ function loaded() {
       ({ target }) => {
         if (!(target instanceof HTMLInputElement)) return;
 
-        if (target.value && target.value.length > 0) {
+        const checkedUsername = target.value;
+        if (checkedUsername && checkedUsername.length > 0) {
           axios
-            .get('/api/v1/accounts/lookup', { params: { acct: target.value } })
+            .get('/api/v1/accounts/lookup', {
+              params: { acct: checkedUsername },
+            })
             .then(() => {
-              target.setCustomValidity(formatMessage(messages.usernameTaken));
+              // Only update the validity if the result is for the currently-typed username
+              if (checkedUsername === target.value) {
+                target.setCustomValidity(formatMessage(messages.usernameTaken));
+              }
+
               return true;
             })
             .catch(() => {
-              target.setCustomValidity('');
+              // Only update the validity if the result is for the currently-typed username
+              if (checkedUsername === target.value) {
+                target.setCustomValidity('');
+              }
             });
         } else {
           target.setCustomValidity('');

From a3f0a0373dea75080cd471a0aab5fa39f290b53a Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Thu, 5 Mar 2026 10:10:49 +0100
Subject: [PATCH 04/11] =?UTF-8?q?Fix=20=E2=80=9CUnblock=E2=80=9D=20and=20?=
 =?UTF-8?q?=E2=80=9CUnmute=E2=80=9D=20actions=20being=20disabled=20when=20?=
 =?UTF-8?q?blocked=20(#38075)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/javascript/mastodon/components/follow_button.tsx | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/app/javascript/mastodon/components/follow_button.tsx b/app/javascript/mastodon/components/follow_button.tsx
index 97aaecd1aa..6efd37d16e 100644
--- a/app/javascript/mastodon/components/follow_button.tsx
+++ b/app/javascript/mastodon/components/follow_button.tsx
@@ -129,6 +129,8 @@ export const FollowButton: React.FC<{
     : messages.follow;
 
   let label;
+  let disabled =
+    relationship?.blocked_by || account?.suspended || !!account?.moved;
 
   if (!signedIn) {
     label = intl.formatMessage(followMessage);
@@ -138,12 +140,16 @@ export const FollowButton: React.FC<{
     label = <LoadingIndicator />;
   } else if (relationship.muting) {
     label = intl.formatMessage(messages.unmute);
+    disabled = false;
   } else if (relationship.following) {
     label = intl.formatMessage(messages.unfollow);
+    disabled = false;
   } else if (relationship.blocking) {
     label = intl.formatMessage(messages.unblock);
+    disabled = false;
   } else if (relationship.requested) {
     label = intl.formatMessage(messages.followRequestCancel);
+    disabled = false;
   } else if (relationship.followed_by && !account?.locked) {
     label = intl.formatMessage(messages.followBack);
   } else {
@@ -168,11 +174,7 @@ export const FollowButton: React.FC<{
   return (
     <Button
       onClick={handleClick}
-      disabled={
-        relationship?.blocked_by ||
-        (!(relationship?.following || relationship?.requested) &&
-          (account?.suspended || !!account?.moved))
-      }
+      disabled={disabled}
       secondary={following}
       compact={compact}
       className={classNames(className, { 'button--destructive': following })}

From a475f2ba395bcd8c5f9aa46ec430c1d28511dcb8 Mon Sep 17 00:00:00 2001
From: Matt Jankowski <matt@jankowski.online>
Date: Thu, 5 Mar 2026 05:37:12 -0500
Subject: [PATCH 05/11] Fix incorrect I18n string in webauthn mailers (#38062)

---
 app/views/user_mailer/webauthn_credential_added.text.erb | 4 ++--
 app/views/user_mailer/webauthn_enabled.text.erb          | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/views/user_mailer/webauthn_credential_added.text.erb b/app/views/user_mailer/webauthn_credential_added.text.erb
index 4319dddbfc..d4482a69bb 100644
--- a/app/views/user_mailer/webauthn_credential_added.text.erb
+++ b/app/views/user_mailer/webauthn_credential_added.text.erb
@@ -1,7 +1,7 @@
-<%= t 'devise.mailer.two_factor_enabled.title' %>
+<%= t 'devise.mailer.webauthn_credential.added.title' %>
 
 ===
 
-<%= t 'devise.mailer.two_factor_enabled.explanation' %>
+<%= t 'devise.mailer.webauthn_credential.added.explanation' %>
 
 => <%= edit_user_registration_url %>
diff --git a/app/views/user_mailer/webauthn_enabled.text.erb b/app/views/user_mailer/webauthn_enabled.text.erb
index d4482a69bb..ca8da30a42 100644
--- a/app/views/user_mailer/webauthn_enabled.text.erb
+++ b/app/views/user_mailer/webauthn_enabled.text.erb
@@ -1,7 +1,7 @@
-<%= t 'devise.mailer.webauthn_credential.added.title' %>
+<%= t 'devise.mailer.webauthn_enabled.title' %>
 
 ===
 
-<%= t 'devise.mailer.webauthn_credential.added.explanation' %>
+<%= t 'devise.mailer.webauthn_enabled.explanation' %>
 
 => <%= edit_user_registration_url %>

From 6fcdc05e4342df7294ceece00fa3f30acc218fce Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Thu, 5 Mar 2026 09:56:18 +0100
Subject: [PATCH 06/11] Add for searching already-known private GtS posts
 (#38057)

---
 app/services/resolve_url_service.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/services/resolve_url_service.rb b/app/services/resolve_url_service.rb
index 19a94e77ad..899f586b81 100644
--- a/app/services/resolve_url_service.rb
+++ b/app/services/resolve_url_service.rb
@@ -4,7 +4,7 @@ class ResolveURLService < BaseService
   include JsonLdHelper
   include Authorization
 
-  USERNAME_STATUS_RE = %r{/@(?<username>#{Account::USERNAME_RE})/(?<status_id>[0-9]+)\Z}
+  USERNAME_STATUS_RE = %r{/@(?<username>#{Account::USERNAME_RE})/(statuses/)?(?<status_id>[0-9a-zA-Z]+)\Z}
 
   def call(url, on_behalf_of: nil)
     @url          = url

From a7bfcf71311b552a48a0cfcda103b6dbf59ca57d Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Wed, 4 Mar 2026 18:44:27 +0100
Subject: [PATCH 07/11] Redirect to short account URLs when requesting HTML for
 one of the AP endpoints (#38056)

---
 app/controllers/accounts_controller.rb |  2 ++
 app/controllers/statuses_controller.rb |  2 ++
 spec/requests/accounts_spec.rb         | 16 +++++++++++++---
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/app/controllers/accounts_controller.rb b/app/controllers/accounts_controller.rb
index efd0c92cef..0deeb76e3e 100644
--- a/app/controllers/accounts_controller.rb
+++ b/app/controllers/accounts_controller.rb
@@ -18,6 +18,8 @@ class AccountsController < ApplicationController
     respond_to do |format|
       format.html do
         expires_in(15.seconds, public: true, stale_while_revalidate: 30.seconds, stale_if_error: 1.hour) unless user_signed_in?
+
+        redirect_to short_account_path(@account) if account_id_param.present? && username_param.blank?
       end
 
       format.rss do
diff --git a/app/controllers/statuses_controller.rb b/app/controllers/statuses_controller.rb
index 65db807d18..4bd9d45b7c 100644
--- a/app/controllers/statuses_controller.rb
+++ b/app/controllers/statuses_controller.rb
@@ -26,6 +26,8 @@ class StatusesController < ApplicationController
     respond_to do |format|
       format.html do
         expires_in 10.seconds, public: true if current_account.nil?
+
+        redirect_to short_account_status_path(@account, @status) if account_id_param.present? && username_param.blank?
       end
 
       format.json do
diff --git a/spec/requests/accounts_spec.rb b/spec/requests/accounts_spec.rb
index cc2a5be7c5..cd67e89d45 100644
--- a/spec/requests/accounts_spec.rb
+++ b/spec/requests/accounts_spec.rb
@@ -6,10 +6,20 @@ RSpec.describe 'Accounts show response' do
   let(:account) { Fabricate(:account) }
 
   context 'with numeric-based identifiers' do
-    it 'returns http success' do
-      get "/ap/users/#{account.id}"
+    context 'with JSON format' do
+      it 'returns http success' do
+        get "/ap/users/#{account.id}", headers: { 'ACCEPT' => 'application/json' }
 
-      expect(response).to have_http_status(200)
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'with HTML format' do
+      it 'redirects to success' do
+        get "/ap/users/#{account.id}", as: 'html'
+
+        expect(response).to redirect_to("/@#{account.username}")
+      end
     end
   end
 

From d7059dcf1c5fb4dcebd80e8033a455917d0a21d1 Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Thu, 5 Mar 2026 15:53:00 +0100
Subject: [PATCH 08/11] Fix poll expiration notification being re-triggered on
 implicit updates (#38078)

---
 .../process_status_update_service.rb          |  5 +++
 .../process_status_update_service_spec.rb     | 42 +++++++++++++++++++
 2 files changed, 47 insertions(+)

diff --git a/app/services/activitypub/process_status_update_service.rb b/app/services/activitypub/process_status_update_service.rb
index 2e87f850c7..1b8cdd68d9 100644
--- a/app/services/activitypub/process_status_update_service.rb
+++ b/app/services/activitypub/process_status_update_service.rb
@@ -410,6 +410,11 @@ class ActivityPub::ProcessStatusUpdateService < BaseService
 
     return unless poll.present? && poll.expires_at.present? && poll.votes.exists?
 
+    # If the poll had previously expired, notifications should have already been sent out (or scheduled),
+    # and re-scheduling them would cause duplicate notifications for people who had already dismissed them
+    # (see #37948)
+    return if @previous_expires_at&.past?
+
     PollExpirationNotifyWorker.remove_from_scheduled(poll.id) if @previous_expires_at.present? && @previous_expires_at > poll.expires_at
     PollExpirationNotifyWorker.perform_at(poll.expires_at + 5.minutes, poll.id)
   end
diff --git a/spec/services/activitypub/process_status_update_service_spec.rb b/spec/services/activitypub/process_status_update_service_spec.rb
index e568c90f2b..31e6ae2062 100644
--- a/spec/services/activitypub/process_status_update_service_spec.rb
+++ b/spec/services/activitypub/process_status_update_service_spec.rb
@@ -136,6 +136,48 @@ RSpec.describe ActivityPub::ProcessStatusUpdateService do
       end
     end
 
+    context 'with an implicit update of a poll that has already expired' do
+      let(:account) { Fabricate(:account, domain: 'example.com') }
+      let!(:expiration) { 10.days.ago.utc }
+      let!(:status) do
+        Fabricate(:status,
+                  text: 'Hello world',
+                  account: account,
+                  poll_attributes: {
+                    options: %w(Foo Bar),
+                    account: account,
+                    multiple: false,
+                    hide_totals: false,
+                    expires_at: expiration,
+                  })
+      end
+
+      let(:payload) do
+        {
+          '@context': 'https://www.w3.org/ns/activitystreams',
+          id: 'https://example.com/foo',
+          type: 'Question',
+          content: 'Hello world',
+          endTime: expiration.iso8601,
+          oneOf: [
+            poll_option_json('Foo', 4),
+            poll_option_json('Bar', 3),
+          ],
+        }
+      end
+
+      before do
+        travel_to(expiration - 1.day) do
+          Fabricate(:poll_vote, poll: status.poll)
+        end
+      end
+
+      it 'does not re-trigger notifications' do
+        expect { subject.call(status, json, json) }
+          .to_not enqueue_sidekiq_job(PollExpirationNotifyWorker)
+      end
+    end
+
     context 'when the status changes a poll despite being not explicitly marked as updated' do
       let(:account) { Fabricate(:account, domain: 'example.com') }
       let!(:expiration) { 10.days.from_now.utc }

From 1033029a6cac6b48997894c568fa68bbd7c7f138 Mon Sep 17 00:00:00 2001
From: diondiondion <mail@diondiondion.com>
Date: Tue, 3 Mar 2026 16:26:56 +0100
Subject: [PATCH 09/11] [Glitch] Prevent hover card from showing on touch
 devices

Port de4ee8565c658ae14aa5cc4504aa246694f92c1e to glitch-soc

Signed-off-by: Claire <claire.github-309c@sitedethib.com>
---
 .../components/hover_card_controller.tsx      | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/app/javascript/flavours/glitch/components/hover_card_controller.tsx b/app/javascript/flavours/glitch/components/hover_card_controller.tsx
index d2a636e939..d232b6760c 100644
--- a/app/javascript/flavours/glitch/components/hover_card_controller.tsx
+++ b/app/javascript/flavours/glitch/components/hover_card_controller.tsx
@@ -23,6 +23,7 @@ export const HoverCardController: React.FC = () => {
   const [open, setOpen] = useState(false);
   const [accountId, setAccountId] = useState<string | undefined>();
   const [anchor, setAnchor] = useState<HTMLElement | null>(null);
+  const isUsingTouchRef = useRef(false);
   const cardRef = useRef<HTMLDivElement | null>(null);
   const [setLeaveTimeout, cancelLeaveTimeout] = useTimeout();
   const [setEnterTimeout, cancelEnterTimeout, delayEnterTimeout] = useTimeout();
@@ -60,6 +61,12 @@ export const HoverCardController: React.FC = () => {
       setAccountId(undefined);
     };
 
+    const handleTouchStart = () => {
+      // Keeping track of touch events to prevent the
+      // hover card from being displayed on touch devices
+      isUsingTouchRef.current = true;
+    };
+
     const handleMouseEnter = (e: MouseEvent) => {
       const { target } = e;
 
@@ -69,6 +76,11 @@ export const HoverCardController: React.FC = () => {
         return;
       }
 
+      // Bail out if a touch is active
+      if (isUsingTouchRef.current) {
+        return;
+      }
+
       // We've entered an anchor
       if (!isScrolling && isHoverCardAnchor(target)) {
         cancelLeaveTimeout();
@@ -127,9 +139,16 @@ export const HoverCardController: React.FC = () => {
     };
 
     const handleMouseMove = () => {
+      if (isUsingTouchRef.current) {
+        isUsingTouchRef.current = false;
+      }
       delayEnterTimeout(enterDelay);
     };
 
+    document.body.addEventListener('touchstart', handleTouchStart, {
+      passive: true,
+    });
+
     document.body.addEventListener('mouseenter', handleMouseEnter, {
       passive: true,
       capture: true,
@@ -151,6 +170,7 @@ export const HoverCardController: React.FC = () => {
     });
 
     return () => {
+      document.body.removeEventListener('touchstart', handleTouchStart);
       document.body.removeEventListener('mouseenter', handleMouseEnter);
       document.body.removeEventListener('mousemove', handleMouseMove);
       document.body.removeEventListener('mouseleave', handleMouseLeave);

From c8a5c2c1212dd7d5284d778af90d5a64371f8100 Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Wed, 25 Feb 2026 15:30:01 +0100
Subject: [PATCH 10/11] [Glitch] Fix username availability check being wrongly
 applied on race conditions

Port ea34d35b32c41cedbddef7f57737da61d984a861 to glitch-soc

Signed-off-by: Claire <claire.github-309c@sitedethib.com>
---
 .../flavours/glitch/entrypoints/public.tsx     | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/app/javascript/flavours/glitch/entrypoints/public.tsx b/app/javascript/flavours/glitch/entrypoints/public.tsx
index 105b877bc7..e53e3b8416 100644
--- a/app/javascript/flavours/glitch/entrypoints/public.tsx
+++ b/app/javascript/flavours/glitch/entrypoints/public.tsx
@@ -183,15 +183,25 @@ function loaded() {
       ({ target }) => {
         if (!(target instanceof HTMLInputElement)) return;
 
-        if (target.value && target.value.length > 0) {
+        const checkedUsername = target.value;
+        if (checkedUsername && checkedUsername.length > 0) {
           axios
-            .get('/api/v1/accounts/lookup', { params: { acct: target.value } })
+            .get('/api/v1/accounts/lookup', {
+              params: { acct: checkedUsername },
+            })
             .then(() => {
-              target.setCustomValidity(formatMessage(messages.usernameTaken));
+              // Only update the validity if the result is for the currently-typed username
+              if (checkedUsername === target.value) {
+                target.setCustomValidity(formatMessage(messages.usernameTaken));
+              }
+
               return true;
             })
             .catch(() => {
-              target.setCustomValidity('');
+              // Only update the validity if the result is for the currently-typed username
+              if (checkedUsername === target.value) {
+                target.setCustomValidity('');
+              }
             });
         } else {
           target.setCustomValidity('');

From 436bf0590cee3a18089739012837164e32e60369 Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Thu, 5 Mar 2026 10:10:49 +0100
Subject: [PATCH 11/11] =?UTF-8?q?[Glitch]=20Fix=20=E2=80=9CUnblock?=
 =?UTF-8?q?=E2=80=9D=20and=20=E2=80=9CUnmute=E2=80=9D=20actions=20being=20?=
 =?UTF-8?q?disabled=20when=20blocked?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Port a3f0a0373dea75080cd471a0aab5fa39f290b53a to glitch-soc

Signed-off-by: Claire <claire.github-309c@sitedethib.com>
---
 .../flavours/glitch/components/follow_button.tsx     | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/app/javascript/flavours/glitch/components/follow_button.tsx b/app/javascript/flavours/glitch/components/follow_button.tsx
index c06bfe4c77..ba7d0a0df3 100644
--- a/app/javascript/flavours/glitch/components/follow_button.tsx
+++ b/app/javascript/flavours/glitch/components/follow_button.tsx
@@ -129,6 +129,8 @@ export const FollowButton: React.FC<{
     : messages.follow;
 
   let label;
+  let disabled =
+    relationship?.blocked_by || account?.suspended || !!account?.moved;
 
   if (!signedIn) {
     label = intl.formatMessage(followMessage);
@@ -138,12 +140,16 @@ export const FollowButton: React.FC<{
     label = <LoadingIndicator />;
   } else if (relationship.muting) {
     label = intl.formatMessage(messages.unmute);
+    disabled = false;
   } else if (relationship.following) {
     label = intl.formatMessage(messages.unfollow);
+    disabled = false;
   } else if (relationship.blocking) {
     label = intl.formatMessage(messages.unblock);
+    disabled = false;
   } else if (relationship.requested) {
     label = intl.formatMessage(messages.followRequestCancel);
+    disabled = false;
   } else if (relationship.followed_by && !account?.locked) {
     label = intl.formatMessage(messages.followBack);
   } else {
@@ -168,11 +174,7 @@ export const FollowButton: React.FC<{
   return (
     <Button
       onClick={handleClick}
-      disabled={
-        relationship?.blocked_by ||
-        (!(relationship?.following || relationship?.requested) &&
-          (account?.suspended || !!account?.moved))
-      }
+      disabled={disabled}
       secondary={following}
       compact={compact}
       className={classNames(className, { 'button--destructive': following })}