NodeBB

Release build (patch) of NodeBB @ 2026-08-10T22:23:12.115Z

v4.14.9 (2026-08-10)

New Features

• changing others emails requires password reauth, closes #14575 (4ea6f9e3)
• don’t display tokens on /admin/api page (b7e5d85c)
• require password for creating master token (7b7b7d28)

Bug Fixes

• selector in chats & modals (56c6115a)
• closes #14591, remove tokens if email removed (349797ac)
• closes #14590 (ce2f54ec)
• bring back logout message pretranslate (3f7e6bf7)
• api chat test (3e51dcd8)
• redirect to account handling only /login (9d0c76e6)
• password confirm modals for admin add/remove (9b72ca37)
• closes #14569, prevent socket.emit(‘admin.xxx’) if (0d073823)
• ajaxify.data in admin pages, move scripts to footer.tpl (5e3d1a93)
• revalidate deleted state before edit broadcast (#14574) (0ed9157a)
• extra param (bcd1925c)
• 401 response (a033e7d8)
• dont parse ajaxify.data from element with id (35fdeddd)
• moderation note privileges (2d06a075)
• revalidate pending registration policy (#14571) (9db146c9)
• closes #14572 (de5f8699)
• reject SSO auth via callback handler, if state parameter isn’t passed in by client (unless checkState is false) (c408d1dc)
• block off access to Announce(anything but object) from non-cids (f7f071e3)
• socket.io ip resolution (a95db1e9)
• directory traversal in post uploads (9970c9f1)
• stale group members cache after group deletion (7a1358e6)
• change to isAdmin || isGlobalMod for (f1a0fa88)
• use more recent deleted data on edit post (e6be0bfb)
• closes #14568, add read check to bookmarks/votes (a2350338)
• closes #14566, fix topics:tag privilege (427d86fd)
• dont allow creating custom fields that overwrite (84483ef5)
• path resolution on windows (cbaa6dfb)
• closes #14565 (5ae326c2)
• the admin setting hideEmail/hideFullname (fddbb629)
• closes #14561, don’t show voters for soft deleted topics (38239a1c)
• don’t send notifications for new topics (c8764dc3)
• move socket.io group search to use api (b15b28f7)
• closes #14560, check every pid belongs to fromTid (79917868)
• double escape of displayname (1154c95a)
• #14555 (e192f39f)
• escape src on wrapImage (62e05f39)
• escape title in taskbar (268b0c84)
• remove relative_path (f96dace1)
• add missing awaits (8cdf3cdc)
• privileges: route ActivityPub URIs to fediverse pseudo-user check (13631036)
• activitypub: reject array-valued attributedTo in inbox origin check (813c37a6)
• post-queue: remove socket call for custom reasons by fetching in controller (#14573) (df95202a)

Refactors

• move temp file deletion to multer middleware, closes #14593 (815e4c2b)
• change to verified (1881c08e)
• allow changing admin pwds from cli (1033760e)
• get rid of password in routes, use a reauth route to redirect to login if needed (f0c9d70d)
• default prompt text (91a8ef5c)
• increase error timeout (7bdc3ff0)
• load searchDict if user focuses search input (e5f1cbfa)
• remove the socket method (b6b03425)
• make requirePassword middleware (ae87aea4)
• require reauth on generateToken (989ef49e)
• guard path traversal (edc1a8ad)

Tests

• cover cross-user re-login session tracking (#14595) (91d4e64b)
• cover reset cleanup on email removal (#14592) (ac40019a)
• fix tag test (26583b99)
• spec fixes (bcd4ed49)
• test fixes (9d92f04a)
• add test updates (145c6d16)
• fix tests (5de18d54)
• fix tests (74086f18)