Mastodon - Package Updates

Reply to Mastodon - Package Updates on Fri, 14 Aug 2026 06:47:04 GMT

Package Updates — Fri, 14 Aug 2026 06:47:04 GMT

[1.18.7]

Update mastodon to 4.6.6
Full Changelog
Change mastodon:setup task warning about trademark to match masto but ignore subdomains (#40143 by @ClearlyClaire)
Fix connection errors when processing fediverse:creator preventing creation of preview cards (#40135 by @ClearlyClaire)
Fix Web UI being inaccessible with URLs ending with .zip (#40134 by @ClearlyClaire)
Fix semitransparent background of picture-in-picture video player (#40132 by @diondiondion)
Fix title tooltip appearing for fullscreen videos (#40127 by @diondiondion)
Fix image preview too dark in alt text editor dialog (#40126 by @diondiondion)
Fix domain block impact queries being rejected (#40122 by @ClearlyClaire)
Fix mobile navigation scrolling to top while opening (#40042 by @sharlayan)
Fix selected account being lost when creating a collection (#39897 and #40133 by @diondiondion and @sharlayan)

Reply to Mastodon - Package Updates on Thu, 06 Aug 2026 17:43:36 GMT

Package Updates — Thu, 06 Aug 2026 17:43:36 GMT

[1.18.6]

Update mastodon to 4.6.5
Full Changelog
Fix Collection items being rejected because of incorrect attribute being read (#40052 by @shleeable)
Fix typo in embedded quote handling code (#40049 by @shleeable)
Fix account merging worker incorrectly merging Appeal and AccountWarning records (#39982 by @shleeable)
Fix off-by-one in handling of updated remote posts allowing up to 5 attachments (#39978 by @shleeable)
Fix collection items limit not being consistently applied (#39969 by @oneiros)
Fix oversized profile image crop uploads (#39958 by @sharlayan)
Fix emoji autocomplete sometimes suggesting emojis for earlier keystrokes (#39947 by @ChaosExAnima)

Reply to Mastodon - Package Updates on Mon, 27 Jul 2026 22:21:30 GMT

Package Updates — Mon, 27 Jul 2026 22:21:30 GMT

[1.18.5]

Update mastodon to 4.6.4
Full Changelog
Fix incorrect permission enforcement (GHSA-7jvv-fhmg-wpfw, GHSA-hx34-2pfw-2qfj)
Fix SSRF protection bypass via IPv4-compatible IPv6 addresses (GHSA-vwhj-3g83-v276)
Change autosuggestions to include second word in web UI (#39622 and #39696 by @Gargron and @zunda)
Fix being unable to vote in polls without an expiration date (#39949 by @ClearlyClaire)
Fix "Hide media with a warning" filters not being applied correctly (#39946 by @ClearlyClaire)
Fix performance of user-focused queries in admin dashboard (#39929 by @ClearlyClaire)
Fix Web Push subscription deletion endpoint incorrectly expecting anti-CSRF tokens (#39918 by @ClearlyClaire)
Fix ActivityPub::Activity::Create trying to re-create known statuses when author changes (#39916 by @ClearlyClaire)
Fix swapped order of "accept/reject" actions in follow requests (#39862 by @diondiondion)
Fix followed tags not being properly cleaned up when an account is deleted (#39824 by @shleeable)

Reply to Mastodon - Package Updates on Sat, 04 Jul 2026 16:26:17 GMT

Package Updates — Sat, 04 Jul 2026 16:26:17 GMT

[1.18.4]

Also prune remote emojis in the cron job. This drastically reduces amount of cached files

Reply to Mastodon - Package Updates on Sat, 04 Jul 2026 00:50:05 GMT

Package Updates — Sat, 04 Jul 2026 00:50:05 GMT

[1.18.3]

Update mastodon to 4.6.3
Full Changelog
Update dependencies
Add "Update available" navigation item at top of navbar when new Mastodon versions are available (#39705 by @ClearlyClaire)
Add rendering of post images in emails (#39636 by @diondiondion)
Fix "view collection" menu item appearing on collection page (#39694 by @mkljczk)
Fix incorrect filter cache key sometimes causing incorrect filters to be applied (#39698 by @ClearlyClaire)
Fix missing to_json to publish announcement reaction worker (#39685 by @mjankowski)
Fix duplicate "clear" button shown in main search input in Chrome (#39679 by @diondiondion)
Fix visual glitch with the spoiler button (#39677 by @ChaosExAnima)
Fix invisible username during post highlight animation (#39659 by @diondiondion)
Fix follow button floating on profiles when overview landing page is enabled (#39650 by @FFederi)

Reply to Mastodon - Package Updates on Fri, 26 Jun 2026 21:15:18 GMT

Package Updates — Fri, 26 Jun 2026 21:15:18 GMT

[1.18.2]

Update mastodon to 4.6.2
Full Changelog
Update FFMpeg version used in the container image to fix CVE-2026-8461 (critical severity)

Reply to Mastodon - Package Updates on Wed, 24 Jun 2026 18:02:01 GMT

Package Updates — Wed, 24 Jun 2026 18:02:01 GMT

[1.18.1]

Update mastodon to 4.6.1
Full Changelog
Add avatar_description and header_description to /api/v1/accounts/update_credentials (#39547 and #39574 by @ClearlyClaire and @mkljczk)
Fix combobox menu not closing after a selection (#39595 by @diondiondion)
Fix Emoji IndexedDB upgrades when multiple tabs are open (#39576 by @ChaosExAnima)
Fix combobox listbox not scrolling up when new suggestions have loaded (#39588 by @diondiondion)
Fix media modal navigation in RTL languages (#39587 by @diondiondion)
Fix accounts not visible in collection editor in advanced web interface (#39586 by @diondiondion)
Fix error on login with certain LDAP configurations (#39571 by @oneiros)
Fix simplified layout applying to other pages in web UI (#39570 by @Gargron)
Fix emoji database loading in web worker (#39558 and #39562 by @ChaosExAnima)
Fix display name length limit being incorrectly enforced in web UI (#39499 by @shleeable)

Reply to Mastodon - Package Updates on Thu, 18 Jun 2026 07:08:28 GMT

Package Updates — Thu, 18 Jun 2026 07:08:28 GMT

[1.18.0]

Update mastodon to 4.6.0
Full Changelog
Add collections (#37992 and others) - Create collections with up to 25 accounts each, then share them with others.
Add email subscriptions (#38163 and others) - Admins can allow specific roles to enable email subscriptions on their profile.
Add new overview landing page setting (#39074 and others) - Admins can choose a new frontpage for anonymous visitors.
Add ability to require 2FA for specific roles (including Everybody) (#37701 and others)
Remove support for EOL Node version 20 (#38926 by @mjankowski)
Remove support for Ruby 3.2 (#37476 by @mjankowski)
Remove support for ImageMagick (#37488 by @mjankowski)
Change invitations to only bypass sign-up approval setting when the issuer of the invitation has the invite_bypass_approval permission (#38278 by @ClearlyClaire)
Fix filters not being applied to search results in web UI (#36346 by @ClearlyClaire)
Fix remote posts with large media descriptions being rejected (#39135 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Wed, 03 Jun 2026 14:26:55 GMT

Package Updates — Wed, 03 Jun 2026 14:26:55 GMT

[1.17.12]

Update mastodon to 4.5.11
Full Changelog
Fix allowed attribution domains spoofing (GHSA-rwcw-vq68-g34p)
Fix uncaught exception in message sanitization causing Denial of Service (GHSA-qrgq-9fx2-vf2r)
Update dependencies
Fix remote statuses with large media descriptions being rejected (#39135 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Thu, 21 May 2026 08:05:58 GMT

Package Updates — Thu, 21 May 2026 08:05:58 GMT

[1.17.11]

Update mastodon to 4.5.10
Full Changelog
Fix SSRF protection bypass (GHSA-crr4-7rm4-8gpw, GHSA-xx55-4rrg-8xg6)
Fix Linked-Data Signature bypass through JSON-LD graph restructuring features (GHSA-53m7-2wrh-q839, GHSA-chgx-jx3p-rf73)
Updated dependencies
Fix type of interactingObject, interactionTarget and add missing QuoteAuthorization (#38940 by @ClearlyClaire)
Remove unused devise strategies (#38795 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Wed, 13 May 2026 12:39:54 GMT

Package Updates — Wed, 13 May 2026 12:39:54 GMT

[1.17.10]

fix: update doc links from /apps/ to /packages/

Reply to Mastodon - Package Updates on Thu, 16 Apr 2026 17:13:17 GMT

Package Updates — Thu, 16 Apr 2026 17:13:17 GMT

[1.17.9]

Update mastodon to 4.5.9
Full Changelog
Insufficient verification of email addresses (GHSA-5r37-qpwq-2jhh)
Updated dependencies
Add trademark warning to mastodon:setup task (#38548 by @ClearlyClaire)
Fix definition for quote in JSON-LD context (#38686 by @ClearlyClaire)
Fix being unable to disable sound for quote update notification (#38537 by @ClearlyClaire)
Fix being able to quote someone you blocked (#38608 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Tue, 24 Feb 2026 14:59:47 GMT

Package Updates — Tue, 24 Feb 2026 14:59:47 GMT

[1.17.7]

Update mastodon to 4.5.7
Full Changelog
Add --suspended-only option to tootctl emoji purge (#37828 and #37861 by @ClearlyClaire and @mjankowski)
Fix emoji data not being properly cached (#37858 by @ChaosExAnima)
Fix delete & redraft of pending posts (#37839 by @ClearlyClaire)
Fix processing separate key documents without the ActivityStreams context (#37826 by @ClearlyClaire)
Fix custom emojis not being purged on domain suspension (#37808 by @ClearlyClaire)
Fix users without special permissions being able to stream disabled timelines (#37791 by @ClearlyClaire)
Fix processing of object updates with duplicate hashtags (#37756 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Wed, 07 Jan 2026 16:35:14 GMT

Package Updates — Wed, 07 Jan 2026 16:35:14 GMT

[1.17.4]

Update mastodon to 4.5.4
Full Changelog
Fix custom emojis not being rendered in profile fields (#37365 by @ClearlyClaire)
Fix serialization of context pages (#37376 by @ClearlyClaire)
Fix quotes with CWs but no text not having fallback link (#37361 by @ClearlyClaire)
Fix outdated link target for locked warning (#37366 by @ClearlyClaire)
Fix local custom emojis sometimes being rendered in remote posts (#37284 by @ChaosExAnima)
Fix some assets not being loaded from configured CDN (#37310 by @ChaosExAnima)
Fix notifications page error in Tor browser (#37285 by @diondiondion)
Fix custom emojis not being displayed in CWs and fav/boost notifications (#37272 and #37306 by @ChaosExAnima and @ClearlyClaire)
Fix default Admin role not including view_feeds permission (#37301 by @ClearlyClaire)
Fix hashtag autocomplete replacing suggestion's first characters with input (#37281 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Tue, 09 Dec 2025 08:15:15 GMT

Package Updates — Tue, 09 Dec 2025 08:15:15 GMT

[1.17.3]

Update mastodon to 4.5.3
Full Changelog
Fix inconsistent error handling leaking information on existence of private posts (GHSA-gwhw-gcjx-72v8)
Fix Delete and Redraft on a non-quote being treated as a quote post in some cases (#37140 by @ClearlyClaire)
Fix YouTube embeds by sending referer (#37126 by @ChaosExAnima)
Fix streamed quoted polls not being hydrated correctly (#37118 by @ClearlyClaire)
Fix creation of duplicate conversations (#37108 by @oneiros)
Fix extraneous noreferrer in external links (#37107 by @ChaosExAnima)
Fix edge case error handling in some database migrations (#37079 by @ClearlyClaire)
Fix error handling when re-fetching already-known statuses (#37077 by @ClearlyClaire)
Fix post navigation in single-column mode when Advanced UI is enabled (#37044 by @diondiondion)
Fix tootctl status remove removing quoted posts and remote quotes of local posts (#37009 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Fri, 21 Nov 2025 08:12:03 GMT

Package Updates — Fri, 21 Nov 2025 08:12:03 GMT

[1.17.2]

Update mastodon to 4.5.2
Full Changelog
Change private quote education modal to not show up on self-quotes (#36926 by @ClearlyClaire)
Fix missing fallback link in CW-only quote posts (#36963 by @ClearlyClaire)
Fix statuses without text being hidden while loading (#36962 by @ClearlyClaire)
Fix g + h keyboard shortcut not working when a post is focused (#36935 by @diondiondion)
Fix quoting overwriting current content warning (#36934 by @ClearlyClaire)
Fix scroll-to-status in threaded view being unreliable (#36927 by @ClearlyClaire)
Fix path resolution for emoji worker (#36897 by @ChaosExAnima)
Fix tootctl upgrade storage-schema failing with ArgumentError (#36914 by @shugo)
Fix cross-origin handling of CSS modules (#36890 by @ClearlyClaire)
Fix error with remote tags including percent signs (#36886 and #36925 by @ChaosExAnima and @ClearlyClaire)

Reply to Mastodon - Package Updates on Fri, 14 Nov 2025 07:34:38 GMT

Package Updates — Fri, 14 Nov 2025 07:34:38 GMT

[1.17.1]

Update mastodon to 4.5.1
Full Changelog
Fix Cmd/Ctrl + Enter not submitting Alt text modal on some browsers (#36866 by @diondiondion)
Fix posts coming from public/hashtag streaming being marked as unquotable (#36860 and #36869 by @ClearlyClaire)
Fix old previously-undiscovered posts being treated as new when receiving an Update (#36848 by @ClearlyClaire)
Fix blank screen in browsers that don't support Intl.DisplayNames (#36847 by @diondiondion)
Fix filters not being applied to quotes in detailed view (#36843 by @ClearlyClaire)
Fix scroll shift caused by fetch-all-replies alerts (#36807 by @diondiondion)
Fix dropdown menu not focusing first item when opened via keyboard (#36804 by @diondiondion)
Fix assets build issue on arch64 (#36781 by @ClearlyClaire)
Fix /api/v1/statuses/:id/context sometimes returing Mastodon-Async-Refresh without result_count (#36779 by @ClearlyClaire)
Fix prepared quote not being discarded with contents when replying (#36778 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Thu, 06 Nov 2025 18:41:56 GMT

Package Updates — Thu, 06 Nov 2025 18:41:56 GMT

[1.17.0]

Update mastodon to 4.5.0
Full Changelog
Add support for allowing and authoring quotes (#35355, #35578, #35614, #35618, #35624, #35626, #35652, #35629, #35665, #35653, #35670, #35677, #35690, #35697, #35689, #35699, #35700, #35701, #35709, #35714, #35713, #35715, #35725, #35749, #35769, #35780, #35762, #35804, #35808, #35805, #35819, #35824, #35828, #35822, #35835, #35865, #35860, #35832, #35891, #35894, #35895, #35820, #35917, #35924, #35925, #35914, #35930, #35941, #35939, #35948, #35955, #35967, #35990, #35991, #35975, #35971, #36002, #35986, #36031, #36034, #36038, #36054, #36052, #36055, #36065, #36068, #36083, #36087, #36080, #36091, #36090, #36118, #36119, #36128, #36094, #36129, #36138, #36132, #36151, #36158, #36171, #36194, #36220, #36169, #36130, #36249, #36153, #36299, #36291, #36301, #36315, #36317, #36364, #36383, #36381, #36459, #36464, #36461, #36516, #36528, #36549, #36550, #36559, #36693, #36704, #36690, #36689, #36696, #36721, #36695 and #36736 by @ChaosExAnima, @ClearlyClaire, @Lycolia, @diondiondion, and @tribela)
Add support for fetching and refreshing replies to the web UI (#35210, #35496, #35575, #35500, #35577, #35602, #35603, #35654, #36141, #36237, #36172, #36256, #36271, #36334, #36382, #36239, #36484, #36481, #36583, #36627 and #36547 by @ClearlyClaire, @diondiondion, @Gargron and @renchap)
Add ability to block words in usernames (#35407, #35655, and #35806 by @ClearlyClaire and @Gargron)
Add ability to individually disable local or remote feeds for visitors or logged-in users disabled value to server setting for live and topic feeds, as well as user permission to bypass that (#36338, #36467, #36497, #36563, #36577, #36585, #36607 and #36703 by @ClearlyClaire)
Add support for displaying of quote posts in Moderator UI (#35964 by @ThisIsMissEm)
Add support for displaying link previews for Admin UI (#35958 by @ThisIsMissEm)
Add a new server setting to choose the server landing page (#36588 and #36602 by @ClearlyClaire and @renchap)
Add support for Update activities on converted object types (#36322 by @ClearlyClaire)
Add support for dynamic viewport height (#36272 by @e1berd)
Add support for numeric-based URIs for new local accounts (#32724, #36304, #36316, and #36365 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Tue, 21 Oct 2025 16:00:39 GMT

Package Updates — Tue, 21 Oct 2025 16:00:39 GMT

[1.16.8]

Update mastodon to 4.4.8
Full Changelog
Fix quote control bypass (GHSA-8h43-rcqj-wpc6)

Reply to Mastodon - Package Updates on Thu, 16 Oct 2025 06:41:17 GMT

Package Updates — Thu, 16 Oct 2025 06:41:17 GMT

[1.16.7]

Update mastodon to 4.4.7
Full Changelog
Fix forwarder being called with nil status when quote post is soft-deleted (#36463 by @ClearlyClaire)
Fix moderation warning e-mails that include posts (#36462 by @ClearlyClaire)
Fix allow_referrer_origin typo (#36460 by @ShadowJonathan)

Reply to Mastodon - Package Updates on Mon, 13 Oct 2025 18:38:18 GMT

Package Updates — Mon, 13 Oct 2025 18:38:18 GMT

[1.16.6]

Update mastodon to 4.4.6
Full Changelog
Update dependencies rack and uri
Fix streaming server connection not being closed on user suspension (by @ThisIsMissEm, GHSA-r2fh-jr9c-9pxh)
Fix password change through admin CLI not invalidating existing sessions and access tokens (by @ThisIsMissEm, GHSA-f3q3-rmf7-9655)
Fix streaming server allowing access to public timelines even without the read or read:statuses OAuth scopes (by @ThisIsMissEm, GHSA-7gwh-mw97-qjgp)
Add support for processing quotes of deleted posts signaled through a Tombstone (#36381 by @ClearlyClaire)
Fix quote post state sometimes not being updated through streaming server (#36408 by @ClearlyClaire)
Fix inconsistent pending tags count on admin dashboard (#36404 by @mjankowski)
Fix JSON payload being potentially mutated when processing interaction policies (#36392 by @ClearlyClaire)
Fix quotes not being displayed in email notifications (#36379 by @diondiondion)
Fix redirect to external object when URL is missing or malformed (#36347 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Wed, 24 Sep 2025 04:47:31 GMT

Package Updates — Wed, 24 Sep 2025 04:47:31 GMT

[1.16.5]

Update mastodon to 4.4.5
Full Changelog
Add support for has:quote in search (#36217 by @ClearlyClaire)
Change quoted posts from silenced accounts to use a click-through rather than being hidden (#36166 and #36167 by @ClearlyClaire)
Fix processing of out-of-order Update as implicit updates (#36190 by @ClearlyClaire)
Fix getting Create and Update out of order (#36176 by @ClearlyClaire)
Fix quotes with Content Warnings but no text being shown without Content Warnings (#36150 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Wed, 17 Sep 2025 08:20:16 GMT

Package Updates — Wed, 17 Sep 2025 08:20:16 GMT

[1.16.4]

Update mastodon to 4.4.4
Full Changelog
Fix missing memoization in Web::PushNotificationWorker (#36085 by @ClearlyClaire)
Fix unresponsive areas around GIFV modals in some cases (#36059 by @ClearlyClaire)
Fix missing beforeUnload confirmation when a poll is being authored (#36030 by @ClearlyClaire)
Fix processing of remote edited statuses with new media and no text (#35970 by @unfokus)
Fix polls not being displayed in moderation interface (#35644 and #35933 by @ThisIsMissEm)
Fix WebUI handling of deleted quoted posts (#35909 and #35918 by @ClearlyClaire and @diondiondion)
Fix Edit and Delete & Redraft on a poll not inserting empty option (#35892 by @ClearlyClaire)
Fix loading of some compatibility CSS on some configurations (#35876 by @shleeable)
Fix HttpLog not being enabled with RAILS_LOG_LEVEL=debug (#35833 by @mjankowski)
Fix self-destruct scheduler behavior on some Redis setups (#35823 by @ClearlyClaire)

Reply to Mastodon - Package Updates on Wed, 06 Aug 2025 04:50:10 GMT

Package Updates — Wed, 06 Aug 2025 04:50:10 GMT

[1.16.3]

Update mastodon to 4.4.3
Full Changelog
Update dependencies
Fix incorrect rate-limit handling GHSA-84ch-6436-c7mg
Fix race condition caused by ActiveRecord query cache in Create critical path (#35662 by @ClearlyClaire)
Fix race condition caused by quote post processing (#35657 by @ClearlyClaire)
Fix WebUI crashing for accounts with null URL (#35651 by @ClearlyClaire)
Fix friends-of-friends recommendations suggesting already-requested accounts (#35604 by @ClearlyClaire)
Fix synchronous recursive fetching of deeply-nested quoted posts (#35600 by @ClearlyClaire)
Fix Expand this post link including user @undefined (#35478 by @ClearlyClaire)
Change StatusReachFinder to consider quotes as well as reblogs (#35601 by @ClearlyClaire)
Add restrictions on which quote posts can trend (#35507 by @ClearlyClaire)