Mastodon Release Notes

Changelog

Fixed

Fix typo in embedded quote handling code (#40049 by @shleeable)

Fix account merging worker incorrectly merging Appeal and AccountWarning records (#39982 by @shleeable)

Fix off-by-one in handling of updated remote posts allowing up to 5 attachments (#39978 by @shleeable)

Upgrade notes

To get the code for v4.5.15, use git fetch && git checkout v4.5.15.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

Ruby: 3.2 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 20.19 or newer

libvips (optional, instead of ImageMagick): 8.13 or newer

ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.14.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Restart all Mastodon processes.

Original source

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.6 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.6 version when they can.

Changelog

Fixed

Fix typo in embedded quote handling code (#40049 by @shleeable)

Fix account merging worker incorrectly merging Appeal and AccountWarning records (#39982 by @shleeable)

Fix off-by-one in handling of updated remote posts allowing up to 5 attachments (#39978 by @shleeable)

Upgrade notes

To get the code for v4.4.22, use git fetch && git checkout v4.4.22.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.21.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Fixed

• Fix Collection items being rejected because of incorrect attribute being read (#40052 by @shleeable)
• Fix typo in embedded quote handling code (#40049 by @shleeable)
• Fix account merging worker incorrectly merging Appeal and AccountWarning records (#39982 by @shleeable)
• Fix off-by-one in handling of updated remote posts allowing up to 5 attachments (#39978 by @shleeable)
• Fix collection items limit not being consistently applied (#39969 by @oneiros)
• Fix oversized profile image crop uploads (#39958 by @sharlayan)
• Fix emoji autocomplete sometimes suggesting emojis for earlier keystrokes (#39947 by @ChaosExAnima)

Upgrade notes

To get the code for v4.6.5, use git fetch && git checkout v4.6.5.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.4.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Fix incorrect permission enforcement (GHSA-7jvv-fhmg-wpfw, GHSA-hx34-2pfw-2qfj)
• Fix SSRF protection bypass via IPv4-compatible IPv6 addresses (GHSA-vwhj-3g83-v276)
• Update dependencies

Changed

• Change autosuggestions to include second word in web UI (#39622 and #39696 by @Gargron and @zunda)

Fixed

• Fix being unable to vote in polls without an expiration date (#39949 by @ClearlyClaire)
• Fix performance of user-focused queries in admin dashboard (#39929 by @ClearlyClaire)
• Fix Web Push subscription deletion endpoint incorrectly expecting anti-CSRF tokens (#39918 by @ClearlyClaire)
• Fix ActivityPub::Activity::Create trying to re-create known statuses when author changes (#39916 by @ClearlyClaire)
• Fix typo in quotes list error handling (#39904 by @shleeable)
• Fix lax relevancy check in inbound activity processing (#39892 by @ClearlyClaire)
• Fix Account::Merging concern not supporting Quotes or Collections, refactor it (#39884 by @ClearlyClaire)
• Fix various emoji search issues (#39815 by @ChaosExAnima)
• Fix swapped order of "accept/reject" actions in follow requests (#39862 by @diondiondion)
• Fix suspended accounts not being removed from follow request count in /api/v1/accounts/verify_credentials (#39858 by @ClearlyClaire)
• Fix "Learn more" link target in column post privacy hint (#39829 by @diondiondion)
• Fix page refresh when trying to save custom profile fields (#39828 by @diondiondion)
• Fix followed tags not being properly cleaned up when an account is deleted (#39824 by @shleeable)
• Fix CW being copied to body when editing quote posts with empty text (#39823 and #39837 by @shleeable and @ClearlyClaire)
• Fix handling of QuoteRequest rejections when those can't be found by id (#39820 by @shleeable)
• Fix autofollow option being ignored in invite moderation interface (#39819 by @shleeable)
• Fix pagination overlapping announcement reactions bar (#39814 by @diondiondion)
• Fix very wide images overflowing posts horizontally (#39812 by @diondiondion)
• Fix collections not being removed when an account is deleted (#39809 by @oneiros)
• Fix account followed languages selector (#39801 by @ChaosExAnima)
• Fix error handling in ActivityPub::ProcessFeaturedItemService (#39787 by @ClearlyClaire)
• Fix display of past relative times (#39742 by @ClearlyClaire)
• Fix pinned post button width (#39724 by @ChaosExAnima)

Upgrade notes

To get the code for v4.6.4, use git fetch && git checkout v4.6.4.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.3.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Fix incorrect permission enforcement (GHSA-7jvv-fhmg-wpfw)

Fix SSRF protection bypass via IPv4-compatible IPv6 addresses (GHSA-vwhj-3g83-v276)

Update dependencies

Fixed

Fix being unable to vote in polls without an expiration date (#39949 by @ClearlyClaire)

Fix performance of user-focused queries in admin dashboard (#39929 by @ClearlyClaire)

Fix Web Push subscription deletion endpoint incorrectly expecting anti-CSRF tokens (#39918 by @ClearlyClaire)

Fix ActivityPub::Activity::Create trying to re-create known statuses when author changes (#39916 by @ClearlyClaire)

Fix typo in quotes list error handling (#39904 by @shleeable)

Fix lax relevancy check in inbound activity processing (#39892 by @ClearlyClaire)

Fix Account::Merging concern not supporting Quotes, refactor it (#39884 by @ClearlyClaire)

Fix suspended accounts not being removed from follow request count in /api/v1/accounts/verify_credentials (#39858 by @ClearlyClaire)

Fix followed tags not being properly cleaned up when an account is deleted (#39824 by @shleeable)

Fix CW being copied to body when editing quote posts with empty text (#39823 and #39837 by @shleeable and @ClearlyClaire)

Fix handling of QuoteRequest rejections when those can't be found by id (#39820 by @shleeable)

Fix autofollow option being ignored in invite moderation interface (#39819 by @shleeable)

Upgrade notes

To get the code for v4.5.14, use git fetch && git checkout v4.5.14.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

Ruby: 3.2 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 20.19 or newer

libvips (optional, instead of ImageMagick): 8.13 or newer

ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.13.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.6 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.6 version when they can.

Changelog

Security

• Fix incorrect permission enforcement (GHSA-7jvv-fhmg-wpfw)
• Fix SSRF protection bypass via IPv4-compatible IPv6 addresses (GHSA-vwhj-3g83-v276)
• Update dependencies

Fixed

• Fix performance of user-focused queries in admin dashboard (#39929 by @ClearlyClaire)
• Fix Web Push subscription deletion endpoint incorrectly expecting anti-CSRF tokens (#39918 by @ClearlyClaire)
• Fix ActivityPub::Activity::Create trying to re-create known statuses when author changes (#39916 by @ClearlyClaire)
• Fix lax relevancy check in inbound activity processing (#39892 by @ClearlyClaire)
• Fix Account::Merging concern not supporting Quotes, refactor it (#39884 by @ClearlyClaire)
• Fix suspended accounts not being removed from follow request count in /api/v1/accounts/verify_credentials (#39858 by @ClearlyClaire)
• Fix followed tags not being properly cleaned up when an account is deleted (#39824 by @shleeable)
• Fix autofollow option being ignored in invite moderation interface (#39819 by @shleeable)

Upgrade notes

To get the code for v4.4.21, use git fetch && git checkout v4.4.21.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.20.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

For a user-focused highlight of these changes, see https://blog.joinmastodon.org/2026/06/mastodon-4.6/

For changes of particular interest to application developers, see https://blog.joinmastodon.org/2026/06/mastodon-4-6-for-devs/

For a more detailed run-down on the changes, see the Changelog section below!

Upgrade overview

Tip

A hotfix release is available for this branch, please update directly to it or a later version, while following the instructions below.

This release contains upgrade notes that deviate from the norm:

• ⚠️ The minimum supported version for Ruby has been bumped to 3.3
• ⚠️ The minimum supported version for Node.JS has been bumped to 22
• ⚠️ The minimum supported version for FFMpeg has been bumped to 5.1
• ⚠️ ImageMagick support has been dropped, libvips is required
• ⚠️ Custom themes need to be updated
• ℹ️ Requires assets recompilation
• ℹ️ Requires streaming server restart
• ℹ️ Requires database migrations

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Added

• Add collections (#37992, #37005, #37049, #37020, #37053, #37110, #37117, #37122, #37154, #37157, #37176, #37192, #37222, #37225, #37254, #37277, #37298, #37322, #37434, #37468, #37514, #37512, #37549, #37556, #37560, #37580, #37591, #37552, #37618, #37643, #37658, #37731, #37678, #37741, #37762, #37790, #37805, #37823, #37837, #37842, #37850, #37848, #37812, #37950, #37898, #37916, #37920, #37927, #37928, #37961, #37967, #37974, #37989, #37986, #38004, #38026, #38027, #38030, #38038, #38065, #38081, #38082, #38096, #38106, #38113, #38124, #38133, #38144, #38153, #38166, #38167, #38169, #38170, #38177, #38193, #38213, #38251, #38255, #38256, #38282, #38298, #38292, #38307, #38306, #38316, #38115, #38329, #38334, #38337, #38351, #38368, #38370, #38356, #38383, #38386, #38385, #38394, #38393, #38399, #38402, #38409, #38414, #38413, #38424, #38425, #38450, #38508, #38528, #38534, #38536, #38540, #38543, #38491, #38586, #38611, #38588, #38612, #38628, #38626, #38630, #38633, #38629, #38638, #38645, #38644, #38636, #38660, #38657, #38688, #38690, #38672, #38698, #38697, #38708, #38712, #38713, #38709, #38719, #38728, #38730, #38732, #38739, #38749, #38751, #38750, #38767, #38769, #38783, #38785, #38959, #38786, #38794, #38776, #38817, #38792, #38822, #38827, #38831, #38830, #38844, #38843, #38852, #38850, #38847, #38865, #38897, #38900, #38919, #38933, #38934, #38935, #38942, #38941, #38954, #38961, #38957, #38962, #38991, #39009, #39062, #39029, #39069, #39020, #39073, #39082, #39096, #39080, #39182, #39143, #39127, #37929, #38029, #39194, #39198, #39210, #39211, #39202, #39214, #39215, #39220, #39234, #39260, #39251, #39361, #39357, #39349, #39287, #39376, #39289, #39342, #38711, #39379, #39282, #39286, #39296, #39047, #39346, #39373, #39372, #39429, and #39457 by @ChaosExAnima, @ClearlyClaire, @Gargron, @arte7, @diondiondion, @mjankowski, @oneiros, and @shleeable)

Create collections with up to 25 accounts each, then share them with others. You can read more about this feature on our blog. This is based on FEP-7aa9 (Featured Collections) to be interoperable with the wider Fediverse. All the new API methods are documented here.

• Add email subscriptions (#38163, #38507, #38502, #38487, #38527, #38582, #38741, #38907, #39162, #39271 by @ClearlyClaire and @Gargron)

Admins can allow specific roles to enable email subscriptions on their profile, allowing anonymous visitors to subscribe to their posts via email.

• Add new overview landing page setting (#39074, #39170, #39163, and #39138 by @Gargron, @diondiondion, and @zunda)

Admins can choose a new frontpage for anonymous visitors, which combines the about page and most recent posts from local profiles.

• Add ability to require 2FA for specific roles (including Everybody) (#37701, #37846, and #38906 by @ClearlyClaire and @mjankowski)

• Add import and export for custom filters (#39085, #39256, #39386 by @arte7)

• Add ability to search email blocks by domain in admin UI (#38923 by @arte7)

• Add new endpoints for profile editing in REST API (#37912, #37934, #37932, #38221, and #38339 by @ClearlyClaire)

Add GET /api/v1/profile and PATCH /api/v1/profile to replace the existing update_credentials endpoint. See the documentation for more information.

• Add missing_attribution boolean to preview cards in REST API (#38043 by @ClearlyClaire)

Documentation: https://docs.joinmastodon.org/entities/PreviewCard/#missing_attribution

• Add exclude_direct flag to /api/v1/accounts/:id/statuses to exclude direct messages (#37763 by @ClearlyClaire)

• Add max_note_length and max_display_name_length attributes to configuration.accounts in Instance entity (#37991 by @ClearlyClaire)

• Add profile field limits to instance entity in REST API (#37535 by @mkljczk)

This adds attributes configuration.accounts.max_profile_fields, configuration.accounts.profile_field_name_limit and configuration.accounts.profile_field_value_limit to the Instance entity.

• Add unresolved flag to /api/v1/admin/reports to query both resolved and unresolved reports (#38323 by @mkljczk)

• Add fallback attributes to notifications for new and infrequent notifications in REST API (#38832 and #38860 by @ClearlyClaire)

This adds a supported_types parameter to GET /api/v1/notifications, GET /api/v1/notifications/:id, GET /api/v2/notifications, and GET /api/v2/notifications/:group_key along with a new fallback attribute for notifications and notification groups.

• Add support for posts in vertical languages in web UI (#37204, #38205, and #38797 by @shimon1024)

• Add Alt + PageUp and Alt + PageDown hotkeys for list navigation (#39252 and #39427 by @diondiondion)

• Add g+e keyboard shortcut to access the trending page in web UI (#38014 by @antoinecellerier)

• Add Cmd/Ctrl+Enter for form submissions in more text areas in web UI (#37821 by @diondiondion)

• Add support for quoting by dragging a link into the compose form in web UI (#36859 and #36896 by @ClearlyClaire and @tribela)

• Add text-autospace to posts to improve rendering of mixed script posts in web UI (#37694 by @ahxxm)

• Add Taiwanese (Minnan), Lazuri, Mingrelian and Ottoman Turkish to supported locales (#37650, #34923, #37822, #37721, #38648 by @ClearlyClaire and @Yoxem)

• Add ability to filter notifications from bots (#38809 and #39377 by @evanp and @shleeable)

• Add support for hosts resolver in request socket DNS lookup (#38699, #38866, and #39030 by @ClearlyClaire and @mjankowski)

• Add support for FEP-2c59 (Webfinger Backlink) (#38239, #38538, and #38639 by @ClearlyClaire and @shleeable)

• Add support for FEP-3b86 (Activity Intents) (#38120 and #38130 by @ClearlyClaire and @Gargron)

• Add support for alt text for profile pictures and headers (#37634, #37641, #38000, #39352 by @ClearlyClaire and @Doxterpepper)

• Add support for multiple keypairs for remote accounts (#38279, #38407, #38419, #38511, #38516, #38515, #38555 and #39235 by @ClearlyClaire)

• Add duration to ActivityPub representation of media attachments (#38061 by @ClearlyClaire)

• Add Stoplight circuit-breaker on Elasticsearch endpoints to better handle some Elasticsearch failures (#39323 and #39375 by @ClearlyClaire and @shleeable)

• Add support for the “require approval” feature for email domain blocks to tootctl email_domain_blocks (#34579 and #38107 by @ClearlyClaire and @e-nomem)

• Add --keep-interacted flag to tootctl media remove to preserve cached media on cleanup (#36200 by @northerner)

• Add systemd service file for prometheus exporter (#35130 by @ThisIsMissEm)

Changed

• Change design of profiles in web UI (#37472, #37490, #37479, #37513, #37527, #37550, #37538, #37632, #37627, #37593, #37638, #37626, #37645, #37653, #37683, #37707, #37682, #37742, #37747, #37760, #37761, #37831, #37766, #37811, #37813, #37825, #37854, #37851, #37876, #37885, #37892, #37890, #37907, #37922, #37952, #37958, #37996, #37990, #37994, #38005, #38012, #38040, #38052, #38066, #38083, #38147, #38148, #38152, #38168, #38156, #38175, #38191, #38189, #38235, #38283, #38310, #38309, #38315, #38314, #38365, #38366, #38363, #38346, #38382, #38384, #38400, #38404, #38417, #38426, #38440, #38442, #38443, #38445, #38446, #38451, #38456, #38509, #38510, #38512, #38513, #38517, #38529, #38531, #38535, #38532, #38544, #38549, #38575, #38579, #38580, #38581, #38585, #38584, #38604, #38605, #38606, #38607, #38622, #38616, #38625, #38632, #38640, #38663, #38667, #38646, #38691, #38692, #38766, #38791, #38687, #38826, #38828, #38863, #38845, #38870, #38872, #38932, #38945, #38963, #38964, #39055, #39042, #38893, #39079, #39084, #39160, #39070, #39217, #39309, #39354, #39324, #39387, #39452, #39467 by @ChaosExAnima, @ClearlyClaire, @Coro365, @diondiondion, and @shleeable)

The profile screen has been entirely redesigned, has new features, and allows you to update your own profile directly without going into the preferences panel. You can read more about it on our blog.

• Change how #Wrapstodon reports are generated and displayed (#37033, #37045, #37093, #37055, #37096, #37047, #37103, #37104, #37106, #37109, #37121, #37138, #37134, #37177, #37182, #37169, #37186, #37187, #37188, #37189, #37190, #37193, #37198, #37201, #37203, #37205, #37206, #37207, #37209, #37202, #37216, #37219, #37224, #37226, #37229, #37249, #37251, #37256, #37261, #37269, #37270, #37273, and #37289 by @ChaosExAnima, @ClearlyClaire, @channyeintun, and @diondiondion)

This finishes up work started in 2024 by completely revamping how Wrapstodon reports are generated and displayed, reducing the amount of data collected and generating reports when active users ask for them.

Instead of requiring manual generation from a server administrator, this is now offered between the 10th of December and the end of each year if enabled in the server settings.

The design of the Wrapstodon report has also been fully reworked to be more delightful and easier to share!

The relevant API endpoints are documented at https://docs.joinmastodon.org/methods/annual_reports/

• Change limitation to allow posts with both media and a poll to be created (#39203, #39368, #39388 by @ClearlyClaire and @Gargron)

• Change account display name length limit from 30 to 40 characters (#39458 by @mjankowski)

• Change alt text limit for media attachments to 10,000 characters (#39306 by @ClearlyClaire)

• Change pending user notification email to link directly to the pending account (#39206 by @vmstan)

• Changed emoji processing in web UI to make it less resource intensive and more robust (#39077, #39008, #39088, #38892, #38885, #38965, #38854, #38825, #38784, #38541, #37442, #37300, #37306, #37271, #37255, #37284, #37272, #37178, #37084, #37080, #37418, #39167, #39126, #39353, #39378, #39382, #39402, and #39421 by @ChaosExAnima, @ClearlyClaire, @diondiondion, @gomasy, and @Hanage999)

• Change composer textarea to have a limited height to prevent column scrolling (#39268 by @diondiondion)

• Change mentions of “Mastodon gGmbH” to “Mastodon GmbH” (#39261 by @renchap)

• Change the limited profile message to be less misleading (#39231 by @mortie)

• Change images/videos in posts in web UI to not have unlimited height (#36966, #37035, #37136, and #37032 by @diondiondion)

• Change search field and tabs to stick to the top on the search results page in web UI (#38968 by @diondiondion)

• Change “anyone can quote” label to “quotes allowed” in web UI (#37427 by @vmstan)

• Change navigation by j/k hotkeys to anchor navigated item to top of viewport in web UI (#38036 by @diondiondion)

• Change hotkeys to focus columns to not reset scroll, add hotkey 0 to scroll to top in web UI (#37052 by @diondiondion)

• Change media modal swipe animation in web UI (#36916, #37034, #37323, and #37464 by @ChaosExAnima and @heathdutton)

• Change “Hide”/“Show all” eye icon in thread view in web UI (#22301 by @tribela)

• Change order of onboarding steps (follow people, then fill out profile) in web UI (#38121 by @Gargron)

• Change “Why do you want to join” field on the sign-up page to have a label (#38936 by @diondiondion)

• Change date of birth field on the sign-up page to use locale-specific fields order (#36039 and #36895 by @mjankowski)

• Change how invalid-but-not-expired invites are shown in admin UI (#38736 by @ClearlyClaire)

• Change wording and ordering of media display settings (#38731 by @mjankowski)

• Change wording of server account recommendation setting description (#36771 by @mjankowski)

• Change wording and ordering of account migration warnings (#20387 by @jsoref)

• Change wording of “Automatic post deletion” settings (#37286 by @mjankowski)

• Change wording of language filter settings to clarify they do not impact home/lists (#38490 by @mjankowski)

• Change wording of tootctl preview_cards remove command description to clearly state it only removes media (#39348 by @mjankowski)

• Change invitations to only bypass sign-up approval setting when the issuer of the invitation has the invite_bypass_approval permission (#38278 by @ClearlyClaire)

This splits the “Invite Users” permission into a new “Invite Users without review” permission.

Existing roles will be updated to have the new permission if they have the old one, but default permissions will not include the new invite_bypass_approval permission.

• Change followers synchronization mechanism on followers-only posts to be skipped for accounts with 25k followers or more (#37302 by @ClearlyClaire)

• Change "Accept" link on sign-up page to a form to prevent some crawling behavior (#39283 and #39345 by @ClearlyClaire and @mjankowski)

• Change “dark”, “light” and “high contrast” themes to be separate “Color scheme” and “Contrast” settings handled by a single theme (#37095, #37120, #37288, #37459, #37470, #37477, #37519, #37520, #37523, #37524, #37526, #37612, #37824, #37807, #37810, #37819, #37906, and #38261 by @ClearlyClaire, @diondiondion, and @mjankowski)

Existing settings should be migrated automatically from user settings, and using browser defaults otherwise.

This also allows third-party theme authors to make use of the same browser defaults and user settings. Learn more about this in our new Theming docs.

• Change default theme to use CSS theme tokens (#36861, #36936, #37019, #37054, #37056, #37081, #37105, #37268, #37841, #37843, #38387, #38459, and #38621 by @diondiondion)

A guide to using the new tokens can be found in our docs.

• Change location blocks in default nginx.conf (#19644 and #37866 by @BedrockDigger and @Izorkin)

• Change proxy_read_timeout to 120 seconds in default nginx.conf (#30599 by @shleeable)

• Change JSON-LD collection handling (#34595 and #37806 by @ClearlyClaire and @sneakers-the-rat)

Removed

• Remove support for EOL Node version 20 (#38926 by @mjankowski)

• Remove support for Ruby 3.2 (#37476 by @mjankowski)

• Remove support for ENABLE_SIDEKIQ_UNIQUE_JOBS_UI (#38340 by @ClearlyClaire)

• Remove support for ImageMagick (#37488 by @mjankowski)

• Remove outdated hint for "Use system scrollbar" preference (#39297 by @diondiondion)

Fixed

• Fix accessibility issues in web UI (#37250, #38006, #38033, #38188, #38230, #38252, #38257, #38285, #38293, #38362, #38387, #38459, #38796, #38801, #39098, #39111, #39120, #39129, #39133, #39134, #39144, #39145, #39149, #39164, #39165, #39169, #39181, #39335, #39305, #39331, #39356, #39350, #39358, #39360, #39325, #39270, #39439, #39400, and #39408 by @ChaosExAnima and @diondiondion)

• Fix report modal heading being impossible to translate properly in some languages (#39457 by @diondiondion)

• Fix being unable to edit an attachment twice without submitting (#39453 by @ClearlyClaire)

• Fix error with audio player in Safari Lockdown Mode (#39397 by @Federicorao)

• Fix tiny checkboxes and radio buttons in Safari (#39332 by @diondiondion)

• Fix handling of offset in timezone list in settings (#39334 by @mjankowski)

• Fix being unable to unmark media as sensitive when "always mark media as sensitive" is enabled in web UI (#39339 by @matrix07012)

• Fix display of sensitive media cards in web UI according to settings (#39366 by @nshki)

• Fix some inputs incorrectly having resize handles in Firefox (#39274 by @diondiondion)

• Fix processing some link previews where text is language-tagged (#39190 by @zunda)

• Fix error when “New trends” email is sent at the same time trends are recomputed (#39122 by @arte7)

• Fix hovercard not showing in compose column (#39430 by @diondiondion)

• Fix hover card opening even when not preceded by mouse movement in web UI (#39166, #39381 by @diondiondion)

• Fix ominous "Moments remaining" timestamp in web UI (#38488 and #38689 by @ChaosExAnima and @MitarashiDango)

• Fix filters not being applied to search results in web UI (#36346 by @ClearlyClaire)

• Fix error when visiting non-public hashtag timelines (#36961 by @diondiondion)

• Fix duplicate favourite/boost counters in some languages (#36844 by @ChaosExAnima)

• Fix unblocking domain from blocked domains column not updating the list in web UI (#38882 by @tribela)

• Fix "change thumbnail" button being visible when it shouldn't in web UI (#38467 by @dpbento)

• Fix profile dropdown menu sometimes ending with a separator in web UI (#38481 by @mkljczk)

• Fix short numbers rounding up instead of truncating in web UI (#38114 by @serranodfm)

• Fix directory showing load more button when no more profiles exist in web UI (#37465 by @heathdutton)

• Fix focus restoration after closing some modals in web UI (#37424 by @MegaManSec)

• Fix video modals being pushed down on mobile in web UI (#37421 by @ChaosExAnima)

• Fix outer page margins when viewport width equals content width in web UI (#36733 by @diondiondion)

• Fix announcement margin when in advanced web UI (#36714 by @ChaosExAnima)

• Fix navigation overflow issue in advanced web UI (#39178 by @diondiondion)

• Fix stale merging stale account from cached instance API response in web UI (#37666 by @ChaosExAnima)

• Fix HTML lang attribute being stripped out of remote posts (#39114 by @artemist)

• Fix remote posts with large media descriptions being rejected (#39135 by @ClearlyClaire)

• Fix some occurrence of PostgreSQL log pollution when processing new hashtags (#35792 by @oelison)

• Fix blocked domains not being removed from the Instance search index (#39109 by @shleeable)

• Fix Elasticsearch connections not being cleaned up properly in Sidekiq middleware (#39359 by @ClearlyClaire)

• Fix replica database not being used when REPLICA_DB_HOST is used but neither REPLICA_DB_NAME nor REPLICA_DATABASE_URL (#37240 by @smiba)

• Fix remote media attachment thumbnails not being stored in the cache/ directory (#36911 by @shugo)

• Fix race condition when processing posts twice with the same idempotency key (#37879 by @ClearlyClaire)

• Fix expire_at instead of expires_at in muted words CSV exports (#39304 by @arte7)

• Fix various missing translation strings (#37671, #37838, #37078, #37371, #37827, #39328 by @ClearlyClaire, @mjankowski, and @valtlai)

• Fix last post time for remote accounts not being accurately tracked (#37619 by @ClearlyClaire)

• Fix filtering of mentions from filtered-on-their-origin-server accounts (#37583 by @ClearlyClaire)

• Fix irrelevant remote accounts being passed through to local fan-out worker (#37589 by @ClearlyClaire)

• Fix required field markers being displayed on fields that cannot be empty anyway in settings (#37291 by @diondiondion)

• Fix thumbnails for links from The Guardian (and possibly other CDNs that check URL hashes) not showing up (#36139 by @phocks)

• Fix mastodon-async-refresh response header not being exposed through CORS (#38914 by @mkljczk)

• Fix FASP availability being incorrectly updated (#38818 by @oneiros)

• Fix use of deprecated vsync FFmpeg option, using fps_mode instead (FFmpeg >= 5.1 now required) (#38198 by @mjankowski)

• Fix unnecessary downcasing of some words in admin UI (#37364 by @ClearlyClaire)

• Fix delivery worker counting unsalvageable HTTP errors as successes (#37235 by @shleeable)

• Fix streaming heartbeat comment not being its own event (#37389 by @ClearlyClaire)

• Fix posts with edited out media attachments being returned in GET /api/v1/accounts/:id/statuses?only_media=true (#37363 by @ClearlyClaire)

• Fix wrong media attachment URLs being returned from DELETE /api/v1/statuses/:id (#35880 by @dbarabashh)

• Fix hashtag matching by replacing negative look-behind with positive look-behind (#37684 and #38212 by @ClearlyClaire)

• Fix discovery of ActivityPub representation from HTML tags in presence of a non-ActivityPub alternate Link header (#37439 by @shleeable)

• Fix Webfinger endpoint not handling new ActivityPub ID scheme (#38391 by @ClearlyClaire)

• Fix error when admin-selected theme does not exist by falling back to default theme (#38703 by @shleeable)

• Fix wrong endonyms for Divehi and Latvian in languages list (#36254 and #36876 by @cuu508 and @shimon1024)

• Fix Accept headers when fetching ActivityPub resources not including JSON-LD profile (#30354 by @TheOneric)

• Fix wrong hover indicators on unclickable items in admin UI (#38782 by @diondiondion)

• Fix streaming server using deprecated url.parse instead of WHATWG URL API (#36973 by @Exagone313)

Upgrade notes

To get the code for v4.6.0, use git fetch && git checkout v4.6.0.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have changed since v4.5.0, with new Ruby, Node and FFMpeg version requirements.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

ImageMagick removal and libvips replacement

ImageMagick has been deprecated since Mastodon 4.4.0 and is now unsupported. If you used MASTODON_USE_LIBVIPS=false, this will be ignored and you will need to install libvips.

Theming system changes

The theming system has changed substantially, changing how light and dark themes work, as well as high-contrast. We also overhauled the whole theme to use design tokens and CSS variables.

Custom themes will most likely require significant changes to work with Mastodon 4.6.0.

If you are a theme author, please see our documentation at https://docs.joinmastodon.org/dev/frontend/theming/ and https://docs.joinmastodon.org/dev/frontend/design-tokens/

Email subscription feature and additional costs

Mastodon 4.6 introduces a new feature that lets users turn their public posts into mailing lists. This can result in an increased amount of sent emails and thus increased costs.

This feature needs to be enabled by a Mastodon user with administrator privileges, then opted-in by individual users.

In situations where the Mastodon administrators and the people hosting the server are not the same people, such as providers that offer Mastodon as a service, the system administrators may want to disable this feature. This can be done by setting the DISABLE_EMAIL_SUBSCRIPTIONS environment variable to true.

Update steps

The following instructions are for updating from 4.5.11. They also apply for migration from v4.6.0-beta.1, v4.6.0-rc.1, and v4.6.0-rc.2.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

If you are using rbenv, update the list of available versions and install the proper Ruby version by doing RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install in the Mastodon install directory (e.g. /home/mastodon/live)

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Run the pre-deployment database migrations by specifying the SKIP_POST_DEPLOYMENT_MIGRATIONS=true environment variable: SKIP_POST_DEPLOYMENT_MIGRATIONS=true RAILS_ENV=production bundle exec rails db:migrate

Restart all Mastodon processes.

Run the post-deployment database migrations: RAILS_ENV=production bundle exec rails db:migrate

When using Docker

Run the pre-deployment database migrations by specifying the SKIP_POST_DEPLOYMENT_MIGRATIONS=true environment variable: docker-compose run --rm -e SKIP_POST_DEPLOYMENT_MIGRATIONS=true web bundle exec rails db:migrate

Restart all Mastodon processes.

Run the post-deployment database migrations: docker-compose run --rm web bundle exec rails db:migrate

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Update dependencies

Added

• Add “Update available” navigation item at top of navbar when new Mastodon versions are available (#39705 by @ClearlyClaire)
• Add rendering of post images in emails (#39636 by @diondiondion)

Fixed

• Fix “view collection” menu item appearing on collection page (#39694 by @mkljczk)
• Fix incorrect filter cache key sometimes causing incorrect filters to be applied (#39698 by @ClearlyClaire)
• Fix missing to_json to publish announcement reaction worker (#39685 by @mjankowski)
• Fix duplicate "clear" button shown in main search input in Chrome (#39679 by @diondiondion)
• Fix visual glitch with the spoiler button (#39677 by @ChaosExAnima)
• Fix invisible username during post highlight animation (#39659 by @diondiondion)
• Fix follow button floating on profiles when overview landing page is enabled (#39650 by @FFederi)
• Fix encryption warning "read more" link (#39635 by @thomas-pike)
• Fix tootctl media lookup failing on some setups (#39615 by @brookmiles)
• Fix visible transparent navigation link borders in Windows forced-contrast mode (#39614 by @diondiondion)
• Fix crash with some browser extensions injecting custom elements in the page (#39507 by @OriginalRoOhi)

Upgrade notes

To get the code for v4.6.3, use git fetch && git checkout v4.6.3.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.2.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

This release is made solely to update FFmpeg in our docker container images to fix CVE-2026-8461 (critical severity). It is critical to update if you use our docker container images.

If you are not using our docker container images, please make sure your system FFmpeg is updated to a fixed version, that is, 8.1.2, 7.1.5, 6.1.6, or 5.1.10.

For the recently released v4.6.1, see 4.6.1 release notes for information.

Changelog

Security

Update FFMpeg version used in the container image to fix CVE-2026-8461 (critical severity)

Upgrade notes

To get the code for v4.6.2, use git fetch && git checkout v4.6.2.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.1.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Restart all Mastodon processes.

Original source

This release is made solely to update FFmpeg in our docker container images to fix CVE-2026-8461 (critical severity). It is critical to update if you use our docker container images.

If you are not using our docker container images, please make sure your system FFmpeg is updated to a fixed version, that is, 8.1.2, 7.1.5, 6.1.6, or 5.1.10.

For the recently released v4.5.12, see 4.5.12 release notes for information.

Changelog

Security

Update FFMpeg version used in the container image to fix CVE-2026-8461 (critical severity)

Upgrade notes

To get the code for v4.5.13, use git fetch && git checkout v4.5.13.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

Ruby: 3.2 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 20.19 or newer

libvips (optional, instead of ImageMagick): 8.13 or newer

ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.12.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Restart all Mastodon processes.

Original source

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.5 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.5 version when they can.

This release is made solely to update FFmpeg in our docker container images to fix CVE-2026-8461 (critical severity). It is critical to update if you use our docker container images.

If you are not using our docker container images, please make sure your system FFmpeg is updated to a fixed version, that is, 8.1.2, 7.1.5, 6.1.6, or 5.1.10.

For the recently released v4.4.19, see 4.4.19 release notes for information.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

• ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Update FFMpeg version used in the container image to fix CVE-2026-8461 (critical severity)

Upgrade notes

To get the code for v4.4.20, use git fetch && git checkout v4.4.20.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look:

docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.19.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Fix TLS certificate verification being disabled on setups with LDAP_TLS_NO_VERIFY=true (GHSA-3rhr-8phh-jm86)

Update dependencies

Fixed

Fix being unable to unmark media as sensitive when "always mark media as sensitive" is enabled in web UI (#39339 by @matrix07012)

Upgrade notes

To get the code for v4.5.12, use git fetch && git checkout v4.5.12.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

Ruby: 3.2 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 20.19 or newer

libvips (optional, instead of ImageMagick): 8.13 or newer

ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.11.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.5 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.5 version when they can.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Fix TLS certificate verification being disabled on setups with LDAP_TLS_NO_VERIFY=true (GHSA-3rhr-8phh-jm86)

Update dependencies

Fixed

Fix being unable to unmark media as sensitive when "always mark media as sensitive" is enabled in web UI (#39339 by @matrix07012)

Upgrade notes

To get the code for v4.4.19, use git fetch && git checkout v4.4.19.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.17.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

This is a patch release for 4.6.

Check out the 4.6.0 release notes for information.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Update dependencies

Added

Add avatar_description and header_description to /api/v1/accounts/update_credentials (#39547 and #39574 by @ClearlyClaire and @mkljczk)

This is available starting from Mastodon API version 11 and intended to provide an easier implementation path for clients implementing a similar feature in forks.

The new /api/v1/profile API remains the recommended API for setting avatar and header description as well as other profile values.

Fixed

Fix combobox menu not closing after a selection (#39595 by @diondiondion)

Fix Emoji IndexedDB upgrades when multiple tabs are open (#39576 by @ChaosExAnima)

Fix combobox listbox not scrolling up when new suggestions have loaded (#39588 by @diondiondion)

Fix media modal navigation in RTL languages (#39587 by @diondiondion)

Fix accounts not visible in collection editor in advanced web interface (#39586 by @diondiondion)

Fix error on login with certain LDAP configurations (#39571 by @oneiros)

Fix simplified layout applying to other pages in web UI (#39570 by @Gargron)

Fix emoji database loading in web worker (#39558 and #39562 by @ChaosExAnima)

Fix display name length limit being incorrectly enforced in web UI (#39499 by @shleeable)

Fix advanced UI columns not using mobile styles (#39528 by @diondiondion)

Fix "private mention" post heading overlapping thread line (#39521 and #39554 by @diondiondion)

Fix misattribution of remote featured collections in some cases (#39523, #39525, and #39550 by @oneiros)

Fix custom profile field overflow (#39513 by @diondiondion)

Fix fetching unknown key when it's not the actor's first, and add error handling for unavailable keys (#39512 by @ClearlyClaire)

Upgrade notes

To get the code for v4.6.1, use git fetch && git checkout v4.6.1.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

ImageMagick removal and libvips replacement

ImageMagick has been deprecated since Mastodon 4.4.0 and is now unsupported. If you used MASTODON_USE_LIBVIPS=false, this will be ignored and you will need to install libvips.

Theming system changes

The theming system has changed substantially, changing how light and dark themes work, as well as high-contrast. We also overhauled the whole theme to use design tokens and CSS variables.

Custom themes will most likely require significant changes to work with Mastodon 4.6.0.

If you are a theme author, please see our documentation at https://docs.joinmastodon.org/dev/frontend/theming/ and https://docs.joinmastodon.org/dev/frontend/design-tokens/

Email subscription feature and additional costs

Mastodon 4.6 introduces a new feature that lets users turn their public posts into mailing lists. This can result in an increased amount of sent emails and thus increased costs.

This feature needs to be enabled by a Mastodon user with administrator privileges, then opted-in by individual users.

In situations where the Mastodon administrators and the people hosting the server are not the same people, such as providers that offer Mastodon as a service, the system administrators may want to disable this feature. This can be done by setting the DISABLE_EMAIL_SUBSCRIPTIONS environment variable to true.

Update steps

The following instructions are for updating from 4.6.0.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

After many months of design, development, gathering feedback, and testing, today we’re releasing a big update with Mastodon 4.6. The headliner of this release is Collections, a way to create and share curated collections of profiles. Part of Mastodon’s work ethos is our commitment to trust and safety, so we’ve put a lot of thought and care into the design of this feature to avoid some of the pitfalls and abuse people have experienced with similar features on other platforms, while focusing on its primary goal: Helping new users discover more of the Fediverse.

Collections

The quality that sets our Collections feature apart is that you can control which collections your profile appears in. If you aren’t opted in to our “Feature me in discovery experiences” preference, you cannot be included in collections at all. If you are opted in, you will be notified every time you’re added to a collection, and can always—at any time—remove yourself from a given collection. We’ve also limited the number of profiles that can be included in a single collection to 25, and decided not to offer a “follow all” shortcut. We might tune the exact number in the future, but the idea is that high volume makes collections harder to overview and therefore easier to use for spam (by e.g. sneaking in some profiles used for spam among a sea of legitimate ones).

Once you have created a collection, you can send the link to your friend or share it anywhere on the web, including Mastodon itself. Your collections will also be available on your own Mastodon profile, under the “Featured” tab. If you update the title or description of your collection later, the profiles that are on it will be notified, so no funny business! For now, finding collections is very manual, primarily through word of mouth. In the future, we are planning to introduce some ways to browse and discover popular collections.

Profiles

After doing a survey to understand what information about other users our community values the most, we’ve updated the look of profiles on Mastodon to make them more ergonomic (and a little prettier!). Whether you like browsing a profile’s original posts only, or want to see everything they boost and reply to, it now takes fewer clicks to get to that information, and your preference applies on every profile you view. Featured hashtags are now also way more prominent and easier to access.

Perhaps even more importantly, we’ve reworked the entire editing experience for your profile. Instead of navigating away into the settings area just to update your profile picture, everything is available right from your profile by switching it into editing mode. Now you can crop your profile picture and header right there, instead of having to do it by hand before uploading. We’re also making it possible to add alt text for profile pictures and headers now, making your profile more accessible for blind and visually impaired users.

With the new profile editing experience comes a few brand new options for customising your profile. You can now control whether a “Media” tab shows at all, and if so, whether it should include media attachments from your replies to other people or not. This way, if you want to use it as a portfolio while hiding the GIFs and memes you use to respond to others, you can. You can also control if the “Featured” tab, which displays your collections and featured profiles, should show up or not.

Newsletters

This feature is primarily for our institutional users, though we expect that journalists, bloggers, and other creators who run their own server might find it useful too: You can now opt-in to allow anonymous visitors to subscribe to your posts via e-mail, so even people who don’t have a Mastodon or Fediverse account and don’t wish to get one can keep up to date with you—given that you have an assigned role with the respective permission and the feature has been enabled on the server. We chose not to make this available for everyone by default as sending e-mail newsletters can significantly rack up the costs of operating a Mastodon server. You can discuss with your server administrator if you want to use this feature.

New landing page variant

If you are looking at the Mastodon server of the European Commission or the German government, the “Trending” tab may not be the most suitable place to start. For this reason, we’re introducing a setting for a new type of landing page that highlights the description of the server and the most recent updates from local profiles, as well as a simplified interface that keeps you from wandering off.

#Wrapstodon

You might remember for the past two years we’ve been offering your year in review on mastodon.social around the month of December. This is a feature we’ve been polishing and optimizing and it’s finally officially becoming available to all server administrators. Starting from December 10 each year, Mastodon will offer you an option to generate your year in review report—only if you agree will anything be generated. The offer can just as easily be dismissed. Unlike the original 2024 version of this feature, which required you to manually take a screenshot to share your #Wrapstodon with other people, it can now be shared as a link with anyone on the web. So that’s something to look forward to towards the end of the year!

Accessibility fixes

We’ve already mentioned that you can now add alt text for profile pictures and headers, but that is just one of many countless accessibility improvements in Mastodon 4.6, from keyboard navigation and focus management, improving color contrasts, to various improvements to how screen readers navigate and read out things in the Mastodon interface. We want to thank the Dutch government who sponsored a significant part of this effort.

In conclusion

Mastodon is the result of the work of our (now much larger!) engineering team and community contributors who submit patches, file bug reports, and translate Mastodon into their native languages. From our heart: Thank you to everyone who contributed to this release, either through code, feedback, or by funding our mission.

Delivering handcrafted code that runs on tens of thousands of servers and serves hundreds of thousands of users is not an easy task. We don’t take venture capital, we don’t sell ads, and we don’t sell your data—unlike many other platforms out there. Please support our mission, so that we can continue to make Mastodon better, and work towards an internet that is diverse, fun, and free from corporate control.

Thank you for supporting Mastodon

We develop and maintain the free and open source software that powers the social web. There is no capital behind this — we rely entirely on your support.

Original source