Mastodon

This release introduces a new update notification in the navbar, renders post images in emails, and includes various bug fixes and dependency updates.

Updates FFmpeg in docker container images to address a critical security vulnerability (CVE-2026-8461).

Updates FFmpeg in docker container images to fix a critical security vulnerability (CVE-2026-8461).

This release updates FFmpeg in docker container images to address a critical security vulnerability (CVE-2026-8461).

This patch release for 4.6 updates dependencies, fixes various web UI and API bugs, and adds avatar and header descriptions to the update_credentials API.

This release addresses a TLS certificate verification security vulnerability and fixes a media sensitivity marking issue in the web UI.

This release addresses a security vulnerability regarding TLS certificate verification and fixes an issue with marking media as sensitive.

Mastodon 4.6 introduces account collections, email subscriptions, a redesigned profile UI, and updated dependency requirements.

This pre-release introduces collections, email subscriptions, a redesigned profile UI, and updated system requirements including Ruby 3.3 and Node 22.

Introduces collections, email subscriptions, a redesigned profile UI, and updated system requirements including Ruby 3.3 and Node 22.

This pre-release introduces account collections, email subscriptions, a redesigned profile UI, and updated dependency requirements including Ruby 3.3 and Node 22.

This release addresses security vulnerabilities related to attribution domain spoofing and denial of service, updates dependencies, and fixes a bug regarding large media descriptions in remote statuses.

This update addresses security vulnerabilities related to attribution domain spoofing and DoS, updates dependencies, and fixes an issue with large media descriptions in remote statuses.

This release addresses security vulnerabilities related to SSRF and Linked-Data Signature bypass, fixes object types, and removes unused devise strategies.

This release addresses security vulnerabilities including SSRF and Linked-Data Signature bypasses, updates dependencies, and removes unused devise strategies.

This release addresses security vulnerabilities including SSRF protection and Linked-Data Signature bypasses, and updates dependencies.

This release addresses security vulnerabilities regarding email verification, updates dependencies, and fixes bugs related to quoting and notifications.

This release addresses a security vulnerability regarding email verification, updates dependencies, and fixes a JSON-LD context definition.

This release addresses a security vulnerability regarding email address verification, updates dependencies, and adds a trademark warning to the setup task.

This release addresses security vulnerabilities, increases remote media description limits, and includes various bug fixes and improvements.

Mastodon v4.4.15 includes security fixes for quote authorizations and open redirects, updates to media description limits, and various bug fixes across the platform.

This release addresses security vulnerabilities, updates dependencies, and includes various bug fixes and a small feature for searching private GtS posts.

This release addresses security vulnerabilities regarding FASP requests, fixes various bugs related to emojis and post processing, and adds a new option to the emoji purge command.

This release includes security fixes for FASP requests, a new emoji purge option for suspended accounts, and bug fixes for custom emojis and duplicate hashtags.

Mastodon v4.3.20 adds a suspended-only option to emoji purging and fixes hashtag processing for object updates.

This release fixes a security vulnerability regarding blocked accounts in ActivityPub caching and addresses several bugs related to account migrations and notifications.

This release addresses a security vulnerability regarding ActivityPub collection caching and fixes bugs related to relationship caches, invalid tags, and connection handling.

This release addresses a security vulnerability regarding blocked accounts in ActivityPub collection caching and fixes bugs related to relationship caches, invalid tags, and connection handling.

This release addresses several security vulnerabilities, fixes various bugs related to ActivityPub and UI, and requires assets recompilation.

This release addresses several security vulnerabilities, including missing limits on federated properties and user-provided fields, alongside various bug fixes and performance improvements.

This release addresses several security vulnerabilities related to federated properties and user fields, alongside various bug fixes for feed management and ActivityPub dispatch.

This release addresses several security vulnerabilities, including SSRF protection and ownership check bypasses, and includes numerous bug fixes for emojis, notifications, and permissions.

This update addresses security vulnerabilities regarding SSRF protection and relationship ownership checks, while fixing domain-blocked user mentions and HTTP Signature verification statuses.

This release addresses security vulnerabilities regarding SSRF protection and ownership checks, and fixes an issue with mentions of domain-blocked users.

This release fixes an SSRF protection bypass and resolves an issue where mentions of domain-blocked users were being processed.

This release addresses a security vulnerability regarding private post information leakage and includes various bug fixes for embeds, polls, and conversations.

This release addresses a security vulnerability regarding private post information leaks and fixes several bugs related to YouTube embeds, quoted polls, and S3 operations.

This release addresses a security vulnerability regarding private post information leaks and fixes issues with YouTube embeds and S3 batch delete operations.

This release fixes various bugs related to quote posts, keyboard shortcuts, hashtag completion, and storage schema upgrades, while requiring assets recompilation.

Mastodon v4.4.9 fixes issues with storage-schema upgrades, post updates, and quote filtering.

Mastodon v4.3.15 fixes an ArgumentError in tootctl upgrade storage-schema and resolves an issue where old posts were treated as new during updates.

This patch release for version 4.5 includes various fixes for the user interface, API responses, and asset builds.

Mastodon 4.5 introduces support for quote posts, improved feed visibility controls, and updated emoji rendering, while increasing minimum requirements for Redis, PostgreSQL, and Node.js.

This pre-release introduces quote posts, enhanced reply fetching in the web UI, the ability to block words in usernames, and updated emoji rendering, alongside several security and UI fixes.

This pre-release introduces quote posts, a revamped composer interface, and support for fetching and refreshing replies in the web UI.

This pre-release introduces quote posts, enhanced reply fetching in the web UI, and the ability to block words in usernames, alongside various security fixes and UI improvements.

This pre-release introduces quote posts, improved reply fetching in the web UI, the ability to block words in usernames, and updates to emoji rendering and security.

This release addresses a security vulnerability by fixing a quote control bypass.

This pre-release introduces support for quote posts, a revamped composer interface, and updated dependency requirements, including Redis 7.0 and Sidekiq 8.

This release fixes bugs related to soft-deleted quote posts, moderation warning emails, and a typo in allow_referrer_origin.

This release addresses several security vulnerabilities, adds support for deleted post quotes, and fixes various bugs related to quote posts and admin dashboard counts.

This release addresses several security vulnerabilities related to streaming server connections and OAuth scopes, updates dependencies, and fixes a redirect issue for malformed URLs.

This release addresses several security vulnerabilities related to streaming server connections, session invalidation, and OAuth scopes, and updates the rack and uri dependencies.

This release introduces search support for quoted posts, updates how silenced quoted posts are displayed, and fixes various update processing and content warning bugs.

This release includes security dependency updates and fixes for out-of-order Update and Create processing.

This release updates dependencies for security and fixes issues regarding the processing of out-of-order Create and Update events.

This release includes security dependency updates and various bug fixes for the WebUI, poll handling, and administrative tools.

This release includes security dependency updates and fixes for remote edited statuses, poll editing, and self-destruct scheduler behavior.

This release fixes the processing of remote edited statuses containing new media and no text.

This release addresses security vulnerabilities, fixes several race conditions and WebUI crashes, and updates quote post processing and trending restrictions.

This release includes security updates for rate-limit handling, dependency updates, and various fixes for race conditions, WebUI crashes, and recommendation logic.

This release includes security updates for dependencies and rate-limit handling, along with fixes for a race condition and WebUI crashes.

This release includes security dependency updates and various bug fixes for accessibility, styling, and quote processing, requiring assets recompilation.

This release includes security updates for dependencies.

This release focuses on security updates by updating dependencies.

This hotfix for version 4.4.1 addresses various build and deployment issues, including Vite build errors and asset compilation failures when Redis is unavailable.

Mastodon 4.4 introduces remote quote post support, new profile widgets, age verification on sign-up, and a transition from Webpack to Vite, while updating minimum dependency versions.

This release includes various bug fixes for emoji caching, moderation views, search operators, and video processing, along with improved handling of remote attachments and OIDC account creation.

This release includes various bug fixes for emoji caching, moderation views, search operators, and video processing, alongside updates to video dimension handling.

This pre-release introduces a new Web UI design, experimental remote quote post support, terms of service management, and updated dependency requirements.

This pre-release introduces experimental quote post support, a new featured tab for profiles, Terms of Service settings, age verification, and a migration from Webpack to Vite.

This pre-release introduces a featured tab for profiles, experimental remote quote post support, age verification on sign-up, and transitions the build system from Webpack to Vite.

This release includes security updates for URL scheme validation, dependency updates, and several bug fixes regarding API redirects and sign-up confirmation.

This release includes security updates for URL scheme validation, dependency updates, various bug fixes, and a deprecation warning for REDIS_NAMESPACE.

This release introduces profile update debouncing, improves account suspension federation, and fixes various bugs related to emojis, filters, and HTML handling.

This release introduces profile update debouncing, improved suspension federation, and pagination for partial collections, alongside various bug fixes and adjustments to URL TTLs.

This release adds support for paginating partial collections in SynchronizeFollowersService and fixes a cache busting URL issue.

This release includes critical security fixes for SAML single-sign-on, dependency updates, and a fix for Stoplight errors when using REDIS_NAMESPACE.

This release includes critical security fixes for SAML single-sign-on, updates dependencies, and fixes Stoplight errors when using REDIS_NAMESPACE.

This update includes security dependency updates and a fix for Stoplight errors when using REDIS_NAMESPACE.

This release improves hashtag suggestions and fixes bugs related to iOS 18 HEIF images, streaming server filtering, content warning previews, and the moderation interface.

This release improves hashtag suggestions and fixes issues with iOS 18 HEIF images and public timeline language filtering.

This release addresses several security vulnerabilities and includes numerous bug fixes and minor feature improvements.

This release provides critical security fixes and dependency updates, while removing support for Ruby 3.0.

This release includes critical security fixes for HTML sanitization, sign-up email verification, and domain block disclosure, along with several bug fixes for emojis, polls, and featured tags.

This release provides important security fixes for HTML sanitization and domain block disclosure, along with several bug fixes for emojis, HTTP redirects, polls, and featured tags.

This release addresses a security vulnerability regarding account URI validation, updates dependencies, and fixes several bugs related to notifications, migrations, and user management.

This release fixes insufficient validation of account URIs, resolves Dockerfile and user deletion bugs, and updates dependencies.

This release fixes an account URI validation security vulnerability and bugs related to Dockerfile builds and unconfirmed user deletion.

This release introduces a new tootctl feeds vacuum command, updates Content Warning designs, and includes numerous bug fixes across timeline delivery, notifications, and UI layout.

This release introduces a new tootctl feeds vacuum command and fixes several issues related to inactive user timelines and attachment deletion.

This release fixes issues with inactive users' timelines and direct inbox delivery, and updates dependencies for security.

Mastodon v4.3.1 introduces follow notification grouping, a 6-hour mute option, and numerous bug fixes, while removing the ability to get embed codes for remote posts.

This release introduces server-side notification grouping, enhanced notification filtering, a modernized web UI with Material Symbols, and support for libvips, while updating minimum requirements for Ruby, Node.js, and PostgreSQL.

This pre-release introduces server-side notification grouping, a redesigned web UI, OpenTelemetry integration, and updated minimum requirements for Ruby, Node.js, and PostgreSQL.

This update fixes a ReDoS security vulnerability, addresses various bugs in feed rebuilding and caching, and adds an update notification to the admin dashboard.

This release fixes a ReDoS vulnerability, improves HTTP signatures, and resolves caching and feed rebuild bugs.

This pre-release introduces server-side notification grouping, a redesigned web UI, and libvips support, while updating minimum requirements for Ruby, Node.js, and PostgreSQL.

This pre-release introduces server-side notification grouping, revamped notification policies, a redesigned web UI, and OpenTelemetry integration, while updating minimum requirements for Ruby, Node.js, and PostgreSQL.