<![CDATA[NodeBB - Package Updates]]>This topic is to track NodeBB package updates.

Please open issues in a separate topic instead of replying here.

]]>https://forum.cloudron.io/topic/2480/nodebb-package-updatesRSS for NodeThu, 10 Sep 2026 01:07:51 GMTFri, 08 May 2020 00:00:42 GMT60<![CDATA[Reply to NodeBB - Package Updates on Mon, 07 Sep 2026 12:54:05 GMT]]>[2.32.4]

  • set minBoxVersion version to Cloudron 10 and redis maxmemoryPolicy to volatile-lru
]]>https://forum.cloudron.io/post/129125https://forum.cloudron.io/post/129125Mon, 07 Sep 2026 12:54:05 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 03 Sep 2026 07:30:28 GMT]]>[2.32.3]

  • Update NodeBB to 4.15.2
  • Full Changelog
  • shift-click range selection when selecting posts (#14727) (f7668bd)
  • add filter:privileges.posts.delete, fired ahead of the lock gate (#14722) (8d9d064)
  • expose topic lock state to filter:privileges.posts.edit (#14710) (61126cc)
  • allow disabling all notification emails, closes #5644 (46ac1ee)
  • uid can be a groupname in groups.join/leave (857680c)
  • do not expose raw content of deleted chat messages (#14709) (c5351fc)
  • restrict x-return-to to internal paths (67555b4)
  • check upload folder containment in admin uploadFile (#14693) (12230a3)
  • return error instead of redirect for banned uid on token-authenticated requests, closes #12739 (#14639) (2c8379b)
  • sync client category watch states with core so unread badge updates for watching users (#14648) (7751845)
]]>https://forum.cloudron.io/post/128948https://forum.cloudron.io/post/128948Thu, 03 Sep 2026 07:30:28 GMT<![CDATA[Reply to NodeBB - Package Updates on Wed, 26 Aug 2026 08:48:55 GMT]]>[2.32.2]

  • Fix plugin install/update from the admin panel
]]>https://forum.cloudron.io/post/128569https://forum.cloudron.io/post/128569Wed, 26 Aug 2026 08:48:55 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 20 Aug 2026 07:33:39 GMT]]>[2.32.1]

]]>https://forum.cloudron.io/post/128332https://forum.cloudron.io/post/128332Thu, 20 Aug 2026 07:33:39 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 13 Aug 2026 08:00:53 GMT]]>[2.32.0]

  • Update NodeBB to 4.15.0
  • Full Changelog
  • feat: allow chat and chat:privileged privileges for fediverse group (#915b6ac)
  • feat: update uploads to look nicer (#5cdf3aa)
  • feat: pass opts to filter:user.create and action:user.create (#95e7da9)
  • feat: add toggle to disable IP address logging (#db662ff)
  • fix: don't expose user existence if visitor can't view users (#12447) (#61a7a0a)
  • fix: reject SSO auth via callback handler, if state parameter isn't passed in by client (unless checkState is false) (#6ba24ed)
  • fix: remove rss_token from exported user profile data (#6776cc4)
  • fix: upgrade privilege check in api.users.addEmail to check admin:users instead of just privileges.users.canEdit (#35deb33)
  • fix: require admin:admins-mods to modify administrators group membership (#9ddaec7)
  • fix: add response size limit to prevent memory exhaustion (#0f2cc70)
]]>https://forum.cloudron.io/post/128124https://forum.cloudron.io/post/128124Thu, 13 Aug 2026 08:00:53 GMT<![CDATA[Reply to NodeBB - Package Updates on Wed, 12 Aug 2026 09:57:21 GMT]]>[2.31.10]

]]>https://forum.cloudron.io/post/128077https://forum.cloudron.io/post/128077Wed, 12 Aug 2026 09:57:21 GMT<![CDATA[Reply to NodeBB - Package Updates on Tue, 11 Aug 2026 08:06:57 GMT]]>The update 2.31.9/4.14.9 has been revoked due to an upstream regression blocking all new user registration.
See: https://community.nodebb.org/topic/19422/bug-registration-fails-with-csrf-forbidden-error-on-post-register-complete-after-updating-to-v4.14.9

]]>https://forum.cloudron.io/post/128021https://forum.cloudron.io/post/128021Tue, 11 Aug 2026 08:06:57 GMT<![CDATA[Reply to NodeBB - Package Updates on Tue, 11 Aug 2026 07:51:09 GMT]]>[2.31.9]

]]>https://forum.cloudron.io/post/128020https://forum.cloudron.io/post/128020Tue, 11 Aug 2026 07:51:09 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 06 Aug 2026 17:44:01 GMT]]>[2.31.8]

  • Update NodeBB to 4.14.8
  • Full Changelog
  • typo on reauthAt (f29db71)
  • don't save req into post queue (28899f7)
  • closes #14553, closes #14554 (37c1853)
  • sanitize system messages (f5be7f6)
  • handle both local and remote users' aboutme identically (3f18849)
  • validate group hex colors (a30dfd1)
  • add priv check to loading profile pictures (707bfe0)
  • reject invalid cid in topic post route (35c4975)
  • xss in room rename event in chat modals (55b1ea5)
  • api: exclude cookie header from buildReqObject to prevent session token exposure in post queue (e44d909)
]]>https://forum.cloudron.io/post/127835https://forum.cloudron.io/post/127835Thu, 06 Aug 2026 17:44:01 GMT<![CDATA[Reply to NodeBB - Package Updates on Wed, 05 Aug 2026 06:26:02 GMT]]>[2.31.7]

  • Update NodeBB to 4.14.7
  • Full Changelog
  • add a middleware to require reauth on api routes (69e749a)
  • use renderCategory for move event (6972b70)
  • closes #14550, closes #14549 (5f6ddbd)
  • closes #14548, wait for parsing of input elements before selecting (0d67edd)
  • hide URL profile upload when uploads are disabled (#14547) (fafced7)
  • use isSafeHref on user.url and category.url (26333b8)
  • privileges: route ActivityPub URIs to fediverse pseudo-user check (ab95445)
  • activitypub: enforce attributedTo origin check in inbox handlers (f93507a)
]]>https://forum.cloudron.io/post/127732https://forum.cloudron.io/post/127732Wed, 05 Aug 2026 06:26:02 GMT<![CDATA[Reply to NodeBB - Package Updates on Tue, 04 Aug 2026 00:18:31 GMT]]>[2.31.6]

  • Update NodeBB to 4.14.6
  • Full Changelog
  • tx.compile so arguments can't break out of the translation token (1205d0b)
  • dont leak ip in api/v3 replies and summary (fadb4e3)
  • escape uid in buildAvatar (f2615ed)
  • closes #14533, json.stringify and escape breadcrumbs structured data (433c768)
]]>https://forum.cloudron.io/post/127676https://forum.cloudron.io/post/127676Tue, 04 Aug 2026 00:18:31 GMT<![CDATA[Reply to NodeBB - Package Updates on Sat, 01 Aug 2026 06:54:00 GMT]]>[2.31.5]

  • Update NodeBB to 4.14.5
  • Full Changelog
  • clear session info when switching users in doLogin (bc206f6)
  • replace outdated .includes() check for AP header in webfinger query method, in favour of Helpers.assertAccept (2079ea0)
  • guard title regeneration in inbox.update behind posts.isMain (94feb90)
  • only allow self/admins/gmods to view/list emails (a018478)
  • enforce same checks on topic room enter as controller (54ff68b)
  • search by email array bypass (5029739)
  • dont return category if user doesnt have find privilege in getSelectedCategory (5a9d7f7)
  • rss feed privilege check for topic feeds (2cc3ae1)
  • private upload path bypass (35e7587)
  • closes #14528, encode uid in group calls (c857090)
]]>https://forum.cloudron.io/post/127573https://forum.cloudron.io/post/127573Sat, 01 Aug 2026 06:54:00 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 30 Jul 2026 07:15:48 GMT]]>[2.31.4]

  • Update NodeBB to 4.14.4
  • Full Changelog
  • trust_proxy upgrade script writes to wrong config.json when started with --config (breaks Docker logins) (#14527) (29f90de)
]]>https://forum.cloudron.io/post/127451https://forum.cloudron.io/post/127451Thu, 30 Jul 2026 07:15:48 GMT<![CDATA[Reply to NodeBB - Package Updates on Wed, 29 Jul 2026 17:43:20 GMT]]>[2.31.3]

]]>https://forum.cloudron.io/post/127417https://forum.cloudron.io/post/127417Wed, 29 Jul 2026 17:43:20 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 23 Jul 2026 14:23:47 GMT]]>[2.31.2]

]]>https://forum.cloudron.io/post/127101https://forum.cloudron.io/post/127101Thu, 23 Jul 2026 14:23:47 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 23 Jul 2026 07:42:19 GMT]]>[2.31.1]

  • Update NodeBB to 4.14.1
  • Full Changelog
  • add missing translations for admin restart/rebuild messages (ae76f5b)
  • hide unenterable rooms from the chat list (#14483) (2540ec8)
  • don't show bookmark alert when there is nothing to return to (#14476) (eb14adc)
  • #14473, don't subtract milliseconds to generate dates (9e34bab)
  • closes #14458, go back to using .translate for bodyShort (162cb67)
  • closes #14453 (597cdb4)
  • don't return ip of post on post edit (74360ec)
  • recognize non-ASCII webfinger handles (#14466) (5b9b174)
  • use raw body buffer for digest verification (6067a49)
  • mark notifications with matching roomId read when opening a room (#14450) (3a7497e)
]]>https://forum.cloudron.io/post/127085https://forum.cloudron.io/post/127085Thu, 23 Jul 2026 07:42:19 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 09 Jul 2026 16:15:15 GMT]]>[2.31.0]

  • Update NodeBB to 4.14.0
  • Full Changelog
  • add first-run modal for new installations (19e25f2)
  • add localhost and URL mismatch warnings to dashboard notices (644034d)
  • add reject all on registration queue (39f1115)
  • extend prune cutoff for followed remote categories (57e65d0)
  • make public key fetch rate limit configurable (471b827)
  • block re-queuing of rejected crossposts (b9473b9)
  • dont allow loading group list via api/v3 (3760c1e)
  • check topics:read privilege when loading post diffs (8467945)
  • closes #14432, dont show mobile nav on chat page (1633b47)
  • use dummy lockout key for non-existent users to prevent username enumeration (e65c23a)
]]>https://forum.cloudron.io/post/126605https://forum.cloudron.io/post/126605Thu, 09 Jul 2026 16:15:15 GMT<![CDATA[Reply to NodeBB - Package Updates on Mon, 29 Jun 2026 10:53:04 GMT]]>[2.30.0]

]]>https://forum.cloudron.io/post/126231https://forum.cloudron.io/post/126231Mon, 29 Jun 2026 10:53:04 GMT<![CDATA[Reply to NodeBB - Package Updates on Fri, 19 Jun 2026 11:14:20 GMT]]>[2.29.1]

  • Update NodeBB to 4.13.2
  • Full Changelog
  • register service worker on safari (2ec0987)
  • closes #14355 dont flash unread notif for topics (0e8544b)
  • uids used for priv check (bd7bf5b)
  • dont allow global mods gdpr export (39299bd)
  • prevent uploading thumbs if user does not have upload:image privilege (72defdc)
  • dont mark nids that you don't own read/unread (001e45d)
  • bind hooks module in admin/settings/email define() (#14352) (86fd621)
  • translator.escape chat messages & teasers (7ef400b)
  • closes #14346, make nodebb global available in src/cli (620ab63)
  • closes #14344, fix cron jobs (d23efb4)
]]>https://forum.cloudron.io/post/125904https://forum.cloudron.io/post/125904Fri, 19 Jun 2026 11:14:20 GMT<![CDATA[Reply to NodeBB - Package Updates on Mon, 15 Jun 2026 13:37:17 GMT]]>NodeBB Update 4.13.1 blocked by upstream issue: https://github.com/NodeBB/NodeBB/issues/14351

]]>https://forum.cloudron.io/post/125775https://forum.cloudron.io/post/125775Mon, 15 Jun 2026 13:37:17 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 11 Jun 2026 06:46:00 GMT]]>[2.29.0]

  • Update NodeBB to 4.13.0
  • Full Changelog
  • add core blocklist for domain management (fe48222)
  • add filter option to categorization rules for post queue gating (dfb108e)
  • add severity 3 (filter) queuing for blocklisted posts (80f40ae)
  • cross-check received payload against received digest header if present (590ac68)
  • upgrade to fa7 (4eec1d7)
  • prevent XSS via intent templates and plugin upgrade bypass (2ba4119)
  • reject POST requests without HTTP signature header (c4b9d03)
  • anchor actor/uid passthrough regexes to prevent inbox bypass (6fcc344)
  • replace user lockout with per-IP rate limit for RSS token failures (#14329) (bdac7a7)
  • dont allow returning notifications by nid (fb3a905)
]]>https://forum.cloudron.io/post/125688https://forum.cloudron.io/post/125688Thu, 11 Jun 2026 06:46:00 GMT<![CDATA[Reply to NodeBB - Package Updates on Wed, 27 May 2026 18:47:04 GMT]]>[2.28.0]

  • Update NodeBB to 4.12.0
  • Full Changelog
  • add privilege gate behind category outbox AP route (#14300)
  • add a nbbRequire that works with esm/cjs (56606f3)
  • allow owners to move misplaced topics (#14227)
  • add blocked file extensions (blacklist) to complement the existing allowlist (#14229)
  • add new localisation, Burmese (Myanmar) (b082d97)
  • #14202, naive fulltext search on chats list (3f31105)
  • don't escape [ & ] breaks nested translations (730e4da)
  • custom routes bypassing /admin checks (19c7473)
  • sanitize xml files in uploads (2bde875)
  • #14208, off-by-some error on getUsersFields (b8af937)
]]>https://forum.cloudron.io/post/125193https://forum.cloudron.io/post/125193Wed, 27 May 2026 18:47:04 GMT<![CDATA[Reply to NodeBB - Package Updates on Thu, 14 May 2026 07:54:50 GMT]]>[2.27.2]

  • Update NodeBB to 4.11.3
  • Full Changelog
  • add escaping to id/type/activityType in AP/errors ACP page to guard against improper user data (e95f5bc)
  • escape id, type, activityType, body on AP errors page (16bda6b)
  • #14250 (40b9414)
  • #14208, off-by-some error on getUsersFields (54df63c)
  • use configured forum URL for shared links (#14226) (bd4b34a)
  • hide current category from move topic selector (#14228) (bbdf05d)
  • remove msapplication-badge (00d3c87)
  • bypass self-edit reputation checks for privileged users (#14214) (164a3d4)
  • skip actor resolution when federation is disabled (a729d0a)
  • handle before cursor for upward infinite scroll navigation (0c6988c)
]]>https://forum.cloudron.io/post/124704https://forum.cloudron.io/post/124704Thu, 14 May 2026 07:54:50 GMT<![CDATA[Reply to NodeBB - Package Updates on Fri, 01 May 2026 17:45:23 GMT]]>[2.27.1]

]]>https://forum.cloudron.io/post/124268https://forum.cloudron.io/post/124268Fri, 01 May 2026 17:45:23 GMT