Back to Catalog
NodeBB logo

NodeBB

Node.js based forum software built for the modern web

app

Alternative to: discourse, vanilla forums, circle

Website Repository Docs
NodeBB screenshot
About Versions (112)
Back to Versions

v4.15.0

2026-08-12

Release build (minor) of NodeBB @ 2026-08-12T20:56:36.190Z

v4.15.0 (2026-08-12)

New Features
  • fediverse: allow chat and chat:privileged privileges for fediverse group (915b6acc)
  • update uploads to look nicer ™️ (5cdf3aa5)
  • when clicking group membership request notification (24b781c3)
  • pass opts to filter:user.create and action:user.create (95e7da9c)
  • add missing translations for admin restart/rebuild messages (fd3de041)
  • activitypub:
    • add ap-serve-cache for actors.note and actors.replies (632feba9)
    • opportunistically backfill remote topics on queue approval (cb893e19)
    • add global age cutoff for incoming post categorization (d8c7486d)
  • topic: instant vote UI with rollback for topic and world feed (9f09ee90)
  • settings: add toggle to disable IP address logging (db662ff6)
  • intents: gate intents logic behind activitypubEnabled config (acdd63dd)
Bug Fixes

  • activitypub:

    • use raw content for source in notes.private (3ddadff3)
    • add image attachments to chat message notes (abb9663b)
    • #14583, add join system messages in assertPrivate alongside addUsersToRoom (3481ca0e)
    • validate emoji icon URLs before rendering (7da65694)
    • always filter loopback URIs from remote actor persistence (b1222bfb)
    • gate TLD requirement on activitypubAllowLoopback (12896b06)
    • validate emoji icon URLs before rendering (c0d94a21)
    • align middleware keyId extraction with library last-wins behavior (d30f4c2f)
    • treat failed signed GET as anonymous instead of 400 (e11c9fc5)
    • align middleware keyId extraction with library last-wins behavior (219f0609)
    • return 404 for soft-deleted topics (ca48534e)
    • refetch object when Update arrives via Announce (c4813e42)
    • enforce chat policy in assertPrivate (1528c541)
    • reject array-valued attributedTo in inbox origin check (7a071a31)
    • reject actors with spoofed id hostname (c0d6d0e2)
    • use createtime check for Accept handler instead of follow target (6e7c057d)
    • fall through to getParentChain for local topic contexts (189d6366)
    • validate webfinger subject hostname to prevent cache poisoning (d3c82555)
    • treat failed signed GET as anonymous instead of 400 (44eade67)
    • always broadcast relay activities to relay followers (f82c7c8e)
    • add existence guards to announce functions (14cfd56f)
    • resolve actor from attributedTo in feps.announce (ffd1c50e)
    • skip re-broadcast for relayed activities and guard tid check (f18eebed)
    • wrap relay broadcast in Announce activity (c8dd4f18)
    • send full Follow activity as Accept object for unsolicited follows (9d44d1a5)
    • implement relay follower management and broadcast (e2f11847)
    • federate posts accepted from post queue (a46e2efe)
    • use raw body buffer for digest verification (2d0e90b8)
    • do not prune banned remote users (0ead3e37)
    • group cid check with createish in announce protection (935cb2a1)
    • enforce attributedTo origin check in inbox handlers (870ec669)
    • collapse nested Announces in inbox.announce handler (a1d3c492)
    • pass digest to _sendMessage in retryFailedMessages (aa072276)
    • validate attributedTo origin in assertPrivate (8df796ee)

  • don’t expose user existence if visitor can’t view users (#12447) (61a7a0aa)

  • api url in chats (10b56785)

  • non string messages (713069bf)

  • chat switch, and error display if route is 404 and its not a v3 route (6415d646)

  • wrap on groups (9e148758)

  • only load templates from templates folder (c17452e7)

  • closes #14600, supported nested translations in tx() (251903ef)

  • group descriptions that have links in them on groups listing (287f87d8)

  • padding and ff (d1806d49)

  • export request.check for use in web-push (280324e7)

  • translations (0fbb8616)

  • translation of admin reauth modal (c2fa1707)

  • reject SSO auth via callback handler, if state parameter isn’t passed in by client (unless checkState is false) (6ba24ed8)

  • block off access to Announce(anything but object) from non-cids (1b04a1ab)

  • user name (6f397572)

  • handle both local and remote users’ aboutme identically (488c24ec)

  • guard title regeneration in inbox.update behind posts.isMain (295cdef3)

  • replace outdated .includes() check for AP header in webfinger query method, in favour of Helpers.assertAccept (14c63234)

  • match cid checks in inbox.move with that of inbox.remove (60577d01)

  • restore old behaviour where AP requests to retrieve a note are always done as AP user (4e2fb6f9)

  • parse post data when sending notifications when schedule topics are posted (041f3ba7)

  • #14428, dont log ip in chats/posts/user login/events (455b9f59)

  • layout on errors/analytics (f0bb5f40)

  • save stack trace to db when AP sendError is called (c9d05b28)

  • notifications where bodyLong is a translation string (99691b2e)

  • handle relative_paths in signature verification (227a7e49)

  • on user deletion, remove any generated keys as well (8e35a15f)

  • swap order of checks (rfc first, then draft) (6f60d773)

  • add missing dependency, fix typo (9978f060)

  • signatures as part of ActivityPub object, make calculateDigest an internal method in signatures.js (62104963)

  • add translation for relays.stats—1 (d4906f99)

  • ghost button when data-bs-theme=“dark” is used (ac055a16)

  • mising translations (5aad9c1e)

  • add mb-2 on reject container (7ae6a65c)

  • client-side re-parsing translate bug, tests fix (d3c2327d)

  • vote tooltip, translateKey html escapes already (de00780d)

  • include bare announces in ‘createish’ conditional (e60e12f1)

  • translate (ae65675c)

  • translate test notif email bodyLong (2961473f)

  • notiication email (2fd8b67f)

  • don’t send null into filter:parse.raw (eb50f820)

  • move ban/mute lang keys to the client (4a6bdcd8)

  • encode uid in post queue author (1d96555b)

  • silent return when cid matching protection fails for inbox.announce (502b8149)

  • raise bodyParser limit to 1mb (32de3c00)

  • move post restoration earlier in the chain of events for inbox.update, because post editing is not allowed if a post is deleted (fae9946c)

  • object reference detection in inbox.announce (d03f54dd)

  • move back Annonce(Delete)-specific checks back into its own case (1aaba34b)

  • move Announce(Delete) protections upstream so they also cover Announce(Update) and Announce(Like)… or pretty much anything that isn’t an Announce(Create) or Announce(Note-ish) (ab8e7a48)

  • remove rss_token from exported user profile data (6776cc4d)

  • upgrade privilege check in api.users.addEmail to check admin:users instead of just privileges.users.canEdit, the former of which excludes global moderators (35deb33c)

  • tooltip display up themes (202472c9)

  • date selector modal (58b479f5)

  • widgets tx (22dfaa15)

  • dont award ap users (272e9524)

  • pass _18n to compileRender (21f1edc1)

  • use outerHTML so we dont lose wrapping element (c51285bd)

  • filter private category data from crossposts and events (4dfe3009)

  • topics:

    • check postingRestrictedToMods mask for remote categories (bfc559eb)
    • check postingRestrictedToMods mask for remote categories (6f5607e0)
    • require topics:read on source category for owner topic moves (42d6706e)

  • request: add response size limit to prevent memory exhaustion (0f2cc702)

  • post-queue:

    • remove socket call for custom reasons by fetching in controller (#14573) (f8d946c8)
    • correct category update logic and template regression (6b203c0f)

  • tests:

    • grant fediverse group global chat privileges (57b02015)
    • verify activitypub announce in crosspost controller flow (67e2f9cd)

  • privileges: route ActivityPub URIs to fediverse pseudo-user check (2da82dbb)

  • auth:

    • clear session info when switching users in doLogin (7ef88c37)
    • clear session info when switching users in doLogin (dbe448c3)

  • socket.io:

    • add topics:read privilege check to loadPostTools (060fb128)
    • restrict moderation note editing to admins and original authors (d92eb01d)

  • user: search local and remote users in parallel for partial queries (81323d34)

  • install: reword admin setup warning for clarity (fa5d97a7)

  • posts:

    • suppress edit notifications when content unchanged (0acf962d)
    • prevent phantom post objects when toPid references non-existent parent (228730f3)

  • minifier: wait for in-flight requests before killing children (23273831)

  • test: use nconf.get(‘url’) in relay broadcast test (b1ddbeb3)

  • cache: add resetAll() to tracker and use in test mock (c98f22f9)

  • users: bind email existence check to requested uid (53e3294e)

  • api:

    • exclude cookie header from buildReqObject to prevent session token exposure in post queue (a593b0b0)
    • require admin:admins-mods to modify administrators group membership (9ddaec72)
Refactors
  • dont crash if null user passed (b770c4d0)
  • change to exact match (32bfc96d)
  • require reauth on token routes (d87a51b3)
  • use write api instead of sockets (c6e8cd8e)
  • fallback error string (7bd73114)
  • reduce gap (99a4ea06)
  • show private/public badge and creation date (abee65d8)
  • remove unnecessary txEscapes for 4.15.0 (7a8cc077)
  • show stack trace of missing store (19ddee27)
  • use api module, get rid of old code (95a80611)
  • remove dupe (66ba2101)
  • make a single call (7c5422aa)
  • show postcount/reputation and group owner text (e9beb469)
  • remove world from tags unless requested (beac7c5e)
  • upgrade HTTP signature logic to RFC 9421 standard (fb27a657)
  • show extension (8fd62b15)
  • remove setting hours when updating graph (81b9d0ca)
  • getDailyStats (8618d403)
  • remove log (eaee9403)
  • get rid of unnecessary new Promise (808ad4fc)
  • remove datetime, it’s ovewritten in notifications.create (1c38912c)
  • translate chat system messages on the backend (6d702226)
  • rewards check (8641d47c)
  • #14376, migrate translations to use tx (64ed84e6)
  • use tx in all admin tpls (24825791)
  • federation: move blocklist view modal to a dedicated partial (1f78b445)
  • activitypub:
    • migrate HTTP message signatures to @misskey-dev library (a7af21a0)
    • unify relay state into single sorted set with signed scores (adaa376f)
    • replace filter with three-tier action system (ca93eda8)
    • privilege-filter outbox via category-driven post sets (765d39a4)
Tests
  • add missing 401 responses (42cf0443)
  • fix email test (5d32e427)
  • fix tests (bb00277e)
  • fix messaging test (ba47a299)
  • remove dupe test, was already added on develop (737b458d)
  • fix messaging tests (d90a0fb4)
  • create test users sequentially :facepalm: (5e46d284)
  • be more explicit about ownership test data (b628bfc7)
  • fix group ownership schema data for tests (aceea229)
  • inbox: fix ap inbox tests (580fd5b4)
  • activitypub: add cross-domain actorUri test for Helpers.query (26296e6c)
  • relays: test issue where an unecessarily strict .deepStrictEqual was causing test failures due to a race condition (a541c1fe)
Changelog on GitHub →