fwiw, instances that never updated to Mastodon 4.2.0 are not vulnerable to GHSA-hcqf-fw2r-52g4 (the URI validation/confused-deputy stuff)

and GHSA-2693-xr3m-jhqr (bad HTML sanitization) only applies if you have a translation service enabled

as such, only GHSA-v3xf-c9qf-j667 (the domain spoof) needs to be cherry-picked for sleeping.town, and I'm deploying that now — i've also gone ahead and cherry-picked the translation fix in the event someone else is running unstodon with translation enabled, but the uri validation fix does not even apply

commit is eeab3560fc