NodeBB

Release build (minor) of NodeBB @ 2026-07-09T12:41:51.241Z

v4.14.0 (2026-07-09)

New Features

• categories: add first-run modal for new installations (19e25f20)
• admin: add localhost and URL mismatch warnings to dashboard notices (644034d4)
• add missing view-original key (66c0bc18)
• add reject all on registration queue (39f1115e)
• add confidence to title (cba42c4d)
• activitypub:
  • extend prune cutoff for followed remote categories (57e65d08)
  • make public key fetch rate limit configurable (471b827f)
• posts: block re-queuing of rejected crossposts (b9473b9d)
• acp/tokens: add link to write API docs (ed83e80f)

Bug Fixes

• throw in Mocks._normalize when attributedTo is not a URI. This normalization step is only run against incoming activities, so attributedTo should always be a URI (dc45bd7f)

• dont allow loading group list via api/v3 (3760c1e4)

• match topicsAPI.get and topic controller (c8072500)

• check topics:read privilege when loading post diffs (84679459)

• timeout method (a61e0c15)

• closes #14432, dont show mobile nav on chat page (1633b476)

• closes #14431, use lock when awarding rewards (80aeb631)

• relax overly-strict utils.isPEM logic (9095e0ab)

• skip signature verification for GET /actor (0e7fc1ab)

• borked translation string in ap relays acp page (92cb52f5)

• no-op on AP delete(object) that references an already-deleted message (90461e00)

• undo(like) targetting unknown pid no longer errors, is just ignored now (45997038)

• remove typo $ (2d58bccb)

• closes #14405, apply same checks to getRaw (da444dc5)

• closes #14429, dont load thumbs if privateUpload is on (c45dc245)

• silently return if ap Follow received targeting an object that is not a local user or category (1bae7ed6)

• return number for config.activitypub.probe (40297359)

• title generation error when empty postdata content was passed in to generateTitle (4a0e4ffd)

• unintentional origin mismatch error thrown when user deletes their own post and the community announces it (d19d0972)

• report config.activitypub.probe as false if guest (server-side restriction already in place) (3b69c7d9)

• url of hstspreload (45abe492)

• closes #14425, allow turning off strictTransportSecurity (4b045b5a)

• update dislike handler to use same logic as like handler (f9b687ad)

• move the rendering of post-queue-body to notification.tpl (8d61107a)

• post-queue notification body (c7d0939d)

• deletions must be made by an actor of the same origin (18b4d6c5)

• show recipient in ap errors page (66856467)

• show intended recipient in ap errors page if available (9ef5e8ba)

• set topic_count on recent/popular/topic/unread so topic tools is visible (ed642b96)

• pass unmodified request body into receiptError (and inbox._reject) (28d9f91a)

• clear stuck loading indicator on bfcache restore (#14419) (7862653c)

• btn-close color on skins (bc79f862)

• translate topic/post tools plugin entries (cffdf5b8)

• notif dropdown staying open after successive opens (2e5d640d)

• create tooltips on registration queue (db2e1d34)

• descriptionParsed (189ee51e)

• path to registration-queue and move client side js to front end (360c301c)

• closes #14405, check category disabled flag (7ea5e93d)

• let administrators bypass post length limits in quick reply (#14399) (909a6b36)

• let users who can approve requests join private groups directly (#14398) (2be954fa)

• show confirm dialog when plugin suggest returns null version (#14390) (db172637)

• chat page browser title (77075c22)

• closes #10501 (2d3d8830)

• parseInt on actor follower cache deletion (12dab1e4)

• tx.escape user.displayname when merging notifs (420b8238)

• modals need benchpress.render (fa77f1ee)

• translate chat room notif options (9658d253)

• use helpers.escape when creating markup (4dcfd152)

• #14379 (a2bc7b69)

• typo in post-queue.tpl (49db31e6)

• margin (e91ec695)

• invite table (b21207e3)

• registration table alignment (16d4de8a)

• align invitations (d1f27173)

• tag notifications (a35bb311)

• txescape chat message parent and post parent (69f47f6c)

• notification email for post queue (c4a38e75)

• add missing tx string (cb3b935e)

• register (a9e94a8e)

• login and chat message scrollbar (d3e759bb)

• category label and breadcrumbs (065ea0fb)

• topic titles getting double escaped (da0f5c7e)

• title on /world page (0ec8c68d)

• notification email escaping and tx (fb9e6629)

• acp page titles (cd15bd88)

• add application/vnd.rar to mime mapping (6efa0963)

• regex (366a4a6d)

• activitypub:

  • handle duplicate votes in like and dislike (f875e918)
  • return early instead of throwing on invalid pid (25fd6799)
  • catch no-user error in prune and add to missing set (4119b2dc)
  • validate response body is JSON object in activitypub.get (97e1c6b6)
  • handle resolveObjects failures in like and flag handlers (e4d0e74b)
  • remove mutex lock from fetchPublicKey rate limiter and raise default to 256 (7f11768b)
  • #14385, skip outbound update for scheduled topic edits (61758eab)
  • guard against falsy cid in announce followers (3face39f)
  • resolve toMid from remote message URIs in assertPrivate (4ed6d845)
  • remove dead maxBodyLength option from actor fetch (0ce7e515)
  • make parent traversal depth configurable and add tests (73e3544c)

• chat: wire copy link/text handlers in minimized chat window (#14387) (0e231015)

• uploads:

  • handle application/octet-stream as reported by browsers (c383e8b3)
  • normalize cross-platform MIME type aliases before validation (385b32af)
  • replace extension-based MIME validation with content sniffing (66800601)

• acp/tokens: openapi schema (e9ac7b51)

• topics:

  • add source category privilege check to crossposts and fix system uid (7e6e9b94)
  • move queued post update before topic delete in merge (5847fb8d)

• world: unescape category name in selectedCategory (929f624a)

• auth: use dummy lockout key for non-existent users to prevent username enumeration (e65c23a3)

Refactors

• use desctructoring (b799d51d)
• split registration-queue message (7564afc5)
• refresh page after rejecting all registrations (09f96a96)
• only remove thumbs that are local uploads (cc0947c0)
• add noindex to remote topics and user profile pages (2518e718)
• remove parens (85146069)
• use als storage to get current user lang (66bc43ea)
• use tx helper (eaaefdde)
• use tx, dont parse description if cid == -1 (d4779f91)
• use modals module (e77e6714)
• move registration-queue out of ACP (42c51791)
• get rid of promiseParallel (eceb530c)
• use email used during registration (3882642d)
• dont throw errors for editTitle/editContent (e0c08a1c)
• add fallback to languages.getFull (6007af7a)
• when accepting/rejecting user register (8dc71a86)
• use double {{}} on tx (29dffc6c)
• if key is fasly use empty string (1cc93c56)
• split registration queue and invitations into tabs (625557d5)
• remove renderTitle/renderContent (4f4a97a9)
• move search, filters and results to core (8b00bf2c)
• move digest.tpl duplicated topics to partial (893796a3)
• failOnError deprecated (455c847b)
• use json2csv (c2e85bd6)
• activitypub: add action:userRemote.create/delete hooks and static:users.search short-circuit (0f983531)
• acp/tokens: move token management page out from under and into , this makes it administrator only (3feae91e)
• posts: remove superfluous removeFromQueueByTid method (e3fa2fb1)

Tests

• add some timeout to reward test to wait for action hooks to finish (7f6ed9ae)
• fix tests since helper translates now (28fa37ed)
• move config (ef42fadb)
• fix registration-queue lang config (6be0edd7)
• fix urls to registration-queue (991a5967)
• remove old route test (aefb7a22)
• add a test for single quotes (2fba9138)
• activitypub: ensure that when an Announce comes in after a note is asserted, it gets categorized properly (92f3b2bd)