Mastodon Release Notes

Warning

This is a pre-release! This has not been as widely tested as regular releases, although it is still tested on mastodon.social and some other servers. If you update to this release, you will not be able to safely downgrade to the existing stable releases. You will, however, be able to upgrade to later nightly releases or pre-releases, as well as the upcoming 5.0.0 stable release.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

• ℹ️ Requires assets recompilation
• ℹ️ Requires streaming server restart
• ℹ️ Requires database migrations

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

New web interface

Mastodon has a new look!

This version contains a redesign of Mastodon's web interface. This includes a refreshed visual design (with a new color theme setting to personalise it further), a new page layout and a new composer.

This is only the start of the journey and this version is laying out the basis for many new things to come.

You can read all about it in our dedicated blog post.

Added

• Add a setting to pick a color theme for the web interface (#41088, #41094, #41153 by @diondiondion and @ClearlyClaire)

• Add a user setting to have the Content Warning field on by default (#40824 by @ClearlyClaire)

• Add a user setting to hide your own posts and boosts (#40813 and #40867 by @arte7)

  Your own boosts are now hidden by default.

• Add ability to follow hashtag from the menu (#40640 by @ChaosExAnima)

• Add new Server Health admin page (#41101 and #41282 by @jhbabon)

• Add bloom filters to limit which servers account deletion notices are sent to (#40283 by @ClearlyClaire)

  This heavily reduces the number of deletion notices sent to other servers by storing the list of servers which fetched an account in a bloom filter. This is strongly recommended on large servers which regularly delete many accounts as it heavily decreases the number of federation Delete activities. This feature introduces a new setting to require signed requests for accounts in order to know where the request comes from.

• Add server setting to postpone confirmation emails after accounts are approved (#40690, #40702, #41099 by @ClearlyClaire)

• Add DISABLE_ANNOUNCEMENT_REACTIONS environment variable to disable emoji reactions in announcements (#40931 by @ClearlyClaire)

• Add RACK_COMPRESS env to enable Rack::Deflater middleware (#39927 by @shleeable)

• Add server directory and default server opt-in options (#40750 by @arte7)

• Add new tab to server settings for external discovery (#40768 by @arte7)

• Add moderation domain block/allow list synchronization feature (#40136, #41349 by @ClearlyClaire and @zunda)

  In this version, this is behind an experimental feature flag to allow us to gather feedback and test it in the real world. We expect this to be stable and enabled for all servers in our next release.

• Add the app used for registration in the moderation view of an account (#40567 by @jhbabon)

• Add canned response (formerly warning presets) categories to restrict them to a specific action (#41092, #41264 by @arte7)

• Add information about who handled an appeal in moderation interface (#41186, #41427 by @arte7 and @ClearlyClaire)

• Add information about trends and follow recommendation blocks in the account moderation page (#40398 by @jhbabon)

• Add support for verifying ML-DSA-44 HTTP Message Signatures (#41119 by @ClearlyClaire)

• Add support for signing-up through the OAuth flow (#40659 by @ClearlyClaire)

  You can read more about the new flow in our documentation. The previous registration flow (POST /api/v1/accounts) is deprecated and will be removed in a future version.

• Add allow_nonfunctional parameter to GET /api/v1/accounts/verify_credentials (#40803 by @ClearlyClaire)

• Add server-side filtering to home feed endpoint (#40468, #41031 by @ClearlyClaire and @cacheflow)

• Add counters to track which features result in users following each other (#40226, #40258, #40340 by @Gargron)

Fixed

• Fix terms of service and privacy policy API failing on percent signs (#41343 by @dualfroz)
• Fix size of date-of-birth input fields (#41021 by @ClearlyClaire)
• Fix invisible links in server announcements (#40949 by @diondiondion)
• Fixes infinite requests loop on hovering over broken emojis (#40884 by @FFederi)
• Fix HTTP 200 response code on paths to remote accounts that don't exist (#40341 by @Gargron)
• Fix performance of media attachment queries in admin instance page (#40515 by @crafkaz)
• Fix deprecated nginx HTTP/2 directive (#36149 by @sirodoht)
• Fix typo in new locales for admin account trending info (#40438 by @jhbabon)
• Fix follows and followers pages to show "Today" instead of hours (#40367 by @FFederi)
• Fix long dropdown menus being cut off on smaller screens (#41026 by @diondiondion)
• Fix the moderation interface to allow seeing media reports of suspended accounts (#40274 by @jhbabon)

Changed

• Change authentication errors to return HTTP 422 instead of HTTP 200 (#41503 by @ClearlyClaire)
• Change account confirmation e-mail to not redirect to app (#41066 and #41181 by @ClearlyClaire and @oneiros)
• Change empty search requests to return a HTTP 400 error (#40196 and #40214 by @Gargron)
• Change warning presets to canned responses and move the navigation item (#41045 by @arte7)
• Change FASP configuration to individual toggles for capabilities (#40764 and #40787 by @oneiros)
• Change the web interface to check media attachment size limit before uploading (#30475 by @rgroothuijsen)

Removed

• Remove discovery area in settings (#41258 by @ChaosExAnima)
• Remove deprecated tootctl accounts fix-duplicate command (#40232 by @ClearlyClaire)
• Remove support for node version 22 (#41152 by @mjankowski)
• Remove support for ruby 3.3 and 3.4, only support a single version (#40603 by @mjankowski)
• Remove support for pre-4.7 zero-downtime migrations (#40235 by @ClearlyClaire)

Upgrade notes

To get the code for v5.0.0-beta.1, use git fetch && git checkout v5.0.0-beta.1.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have changed since v4.7.0, with new Ruby, Node and Redis version requirements.

• Ruby: 4.0
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.2 or newer
• Node: 24 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Zero-downtime migrations

Zero-downtime migrations to Mastodon 5.0 are only possible coming from Mastodon 4.7. Please update to 4.7 before 5.0 if you want to perform zero-downgrade updates.

Update steps

The following instructions are for updating from 4.7.5.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.7.0 release notes.

Non-Docker Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

If you are using rbenv, update the list of available versions and install the proper Ruby version by doing RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install in the Mastodon install directory (e.g. /home/mastodon/live)

• Install dependencies with bundle install and yarn install --immutable
• Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
• Run the pre-deployment database migrations by specifying the SKIP_POST_DEPLOYMENT_MIGRATIONS=true environment variable: SKIP_POST_DEPLOYMENT_MIGRATIONS=true RAILS_ENV=production bundle exec rails db:migrate
• Restart all Mastodon processes.
• Run the post-deployment database migrations: RAILS_ENV=production bundle exec rails db:migrate

When using Docker

• Run the pre-deployment database migrations by specifying the SKIP_POST_DEPLOYMENT_MIGRATIONS=true environment variable: docker-compose run --rm -e SKIP_POST_DEPLOYMENT_MIGRATIONS=true web bundle exec rails db:migrate
• Restart all Mastodon processes.
• Run the post-deployment database migrations: docker-compose run --rm web bundle exec rails db:migrate

Original source

Changelog

Security

• Fix DoS through JSON-LD compaction (#41482 by @ClearlyClaire, GHSA-cf49-73r7-rxj6)
• Fix Forwarded header taking precedence over X-Forwarded-For (#41481 by @ClearlyClaire, GHSA-qp4r-p842-mw5c)

If your reverse-proxy setup uses Forwarded instead of X-Forwarded-For, please make sure it ignores user-provided X-Forwarded-For headers.

If you are using our provided nginx.conf, please consider updating it.

Updated dependencies, in particular to address security advisories in addressable, loofah, rack, and rails-html-sanitizer

Changed

• Change invites use counts to not decrease if an invited user deletes their account (#41458 by @ClearlyClaire)

Upgrade notes

To get the code for v4.6.11, use git fetch && git checkout v4.6.11.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.10.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

• Install dependencies with bundle install and yarn install --immutable
• Restart all Mastodon processes.

When using Docker

• Restart all Mastodon processes.

Original source

Warning

While we do our best to support Mastodon 4.5 until 2027-02-20, there are known security issues in some of the dependencies we use.

We recommend administrators to update to a newer Mastodon version when they can, especially if you use OpenStack Swift for object storage.

Changelog

Security

• Fix DoS through JSON-LD compaction (#41482 by @ClearlyClaire, GHSA-cf49-73r7-rxj6)
• Fix Forwarded header taking precedence over X-Forwarded-For (#41481 by @ClearlyClaire, GHSA-qp4r-p842-mw5c)

If your reverse-proxy setup uses Forwarded instead of X-Forwarded-For, please make sure it ignores user-provided X-Forwarded-For headers.

If you are using our provided nginx.conf, please consider updating it.

• Updated dependencies, in particular to address security advisories in addressable, loofah, rack, and rails-html-sanitizer

Changed

• Change invites use counts to not decrease if an invited user deletes their account (#41458 by @ClearlyClaire)

Upgrade notes

To get the code for v4.5.21, use git fetch && git checkout v4.5.21.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look:

docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

• Ruby: 3.2 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 20.19 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.20.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

• Install dependencies with bundle install and yarn install --immutable
• Restart all Mastodon processes.

When using Docker

• Restart all Mastodon processes.

Original source

Warning

While we do our best to support Mastodon 4.4 until 2026-12-17, there are known security issues in some of the dependencies we use.

We recommend administrators to update to a newer Mastodon version when they can, especially if you use OpenStack Swift for object storage.

Changelog

Security

• Fix DoS through JSON-LD compaction (#41482 by @ClearlyClaire, GHSA-cf49-73r7-rxj6)
• Fix Forwarded header taking precedence over X-Forwarded-For (#41481 by @ClearlyClaire, GHSA-qp4r-p842-mw5c)

If your reverse-proxy setup uses Forwarded instead of X-Forwarded-For, please make sure it ignores user-provided X-Forwarded-For headers.

If you are using our provided nginx.conf, please consider updating it.

• Updated dependencies, in particular to address security advisories in addressable, loofah, rack, and rails-html-sanitizer

Changed

• Change invites use counts to not decrease if an invited user deletes their account (#41458 by @ClearlyClaire)

Upgrade notes

To get the code for v4.4.28, use git fetch && git checkout v4.4.28.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look:

docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.27.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

• Install dependencies with bundle install and yarn install --immutable
• Restart all Mastodon processes.

When using Docker

• Restart all Mastodon processes.

Original source

Changelog

Security

• Fix password authentication bypass for inactive accounts (GHSA-3xjw-gv43-3w62)
• Fix DoS through JSON-LD compaction (#41482 by @ClearlyClaire, GHSA-cf49-73r7-rxj6)
• Fix Forwarded header taking precedence over X-Forwarded-For (#41481 by @ClearlyClaire, GHSA-qp4r-p842-mw5c)

If your reverse-proxy setup uses Forwarded instead of X-Forwarded-For, please make sure it ignores user-provided X-Forwarded-For headers.

If you are using our provided nginx.conf, please consider updating it.

Updated dependencies, in particular to address security advisories in addressable, loofah, rack, and rails-html-sanitizer

Changed

• Change invites use counts to not decrease if an invited user deletes their account (#41458 by @ClearlyClaire)

Upgrade notes

To get the code for v4.7.5, use git fetch && git checkout v4.7.5.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.7.4.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.7.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

• Install dependencies with bundle install and yarn install --immutable
• Restart all Mastodon processes.

When using Docker

• Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

• ℹ️ Default Ruby version has been updated
• ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Fix insufficient ActivityPub identifier verification (GHSA-288h-6j8h-6x5j)
• Added security challenge e-mail to users that try to log in after long period of inactivity (#40745 by @jhbabon)
• Updated dependencies, in particular to address security advisories in Ruby, NodeJS, excon, css_parser, pghero, and sanitize

Fixed

• Fix inefficiency in some hashtag timeline queries (#41132 by @hugogameiro)
• Fix minor inefficiency in timeline deliveries (#41079 by @isidzukuri)
• Fix account timeline with exclude_direct also excluding followers-only posts for non-followed users (#41019 by @ClearlyClaire)
• Fix error in dev:populate_sample_data task (#40995 and #41051 by @isidzukuri and @mjankowski)
• Fix local collection item revocation not being properly federated (#40930 by @oneiros)

Upgrade notes

To get the code for v4.7.4, use git fetch && git checkout v4.7.4.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.7.3.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.7.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

If you are using rbenv, update the list of available versions and install the proper Ruby version by doing RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install in the Mastodon install directory (e.g. /home/mastodon/live)

• Install dependencies with bundle install and yarn install --immutable
• Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
• Restart all Mastodon processes.

When using Docker

• Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

• ℹ️ Default Ruby version has been updated
• ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Fix insufficient ActivityPub identifier verification (GHSA-288h-6j8h-6x5j)
• Updated dependencies, in particular to address security advisories in Ruby, NodeJS, excon, css_parser, pghero, and sanitize

Fixed

• Fix inefficiency in some hashtag timeline queries (#41132 by @hugogameiro)
• Fix minor inefficiency in timeline deliveries (#41079 by @isidzukuri)
• Fix account timeline with exclude_direct also excluding followers-only posts for non-followed users (#41019 by @ClearlyClaire)
• Fix error in dev:populate_sample_data task (#40995 and #41051 by @isidzukuri and @mjankowski)
• Fix local collection item revocation not being properly federated (#40930 by @oneiros)

Upgrade notes

To get the code for v4.6.10, use git fetch && git checkout v4.6.10.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look:

docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.9.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try:

BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install

If you are using rbenv, update the list of available versions and install the proper Ruby version by doing:

RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install

in the Mastodon install directory (e.g. /home/mastodon/live)

• Install dependencies with bundle install and yarn install --immutable
• Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
• Restart all Mastodon processes.

When using Docker

• Restart all Mastodon processes.

Original source

Warning

While we do our best to support Mastodon 4.5 until 2027-02-20, there are known security issues in some of the dependencies we use.

We recommend administrators to update to a newer Mastodon version when they can, especially if you use OpenStack Swift for object storage.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Default Ruby version has been updated

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Fix insufficient ActivityPub identifier verification (GHSA-288h-6j8h-6x5j)
• Updated dependencies, in particular to address security advisories in Ruby, NodeJS, and sanitize

Fixed

• Fix inefficiency in some hashtag timeline queries (#41132 by @hugogameiro)
• Fix error in dev:populate_sample_data task (#40995 and #41051 by @isidzukuri and @mjankowski)

Upgrade notes

To get the code for v4.5.20, use git fetch && git checkout v4.5.20.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

• Ruby: 3.2 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 20.19 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.19.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

If you are using rbenv, update the list of available versions and install the proper Ruby version by doing RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install in the Mastodon install directory (e.g. /home/mastodon/live)

• Install dependencies with bundle install and yarn install --immutable
• Restart all Mastodon processes.

When using Docker

• Restart all Mastodon processes.

Original source

Warning

While we do our best to support Mastodon 4.4 until 2026-12-17, there are known security issues in some of the dependencies we use.

We recommend administrators to update to a newer Mastodon version when they can, especially if you use OpenStack Swift for object storage.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Default Ruby version has been updated

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Fix insufficient ActivityPub identifier verification (GHSA-288h-6j8h-6x5j)
• Updated dependencies, in particular to address security advisories in Ruby, NodeJS, and sanitize

Upgrade notes

To get the code for v4.4.27, use git fetch && git checkout v4.4.27.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.26.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

If you are using rbenv, update the list of available versions and install the proper Ruby version by doing RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install in the Mastodon install directory (e.g. /home/mastodon/live)

• Install dependencies with bundle install and yarn install --immutable
• Restart all Mastodon processes.

When using Docker

• Restart all Mastodon processes.

Original source

October is here, and it’s almost time for Mastodon’s 5.0 release! We announced our plans for big changes in an early preview back in August. In this companion article, we’re hoping to shed light on some of the decisions behind this major UI overhaul.

Between the feedback we’ve gathered during Discovery Week, an event in which we spent a week doing surveys and workshop sessions with volunteers from the community, and Mastodon’s 10th anniversary coming up, we were determined to deliver something notable.

What we were facing

Invisible binds

Working on Mastodon’s engineering team can sometimes feel like harvesting wheat one stalk at a time. We make a lot happen with limited resources–far more limited than most people realise–but there’s always more to do. There’s more tech and UX debt than is obvious to the naked eye, so something that seems simple on the outside may be often limited by backend constraints or architecture shifts that can’t easily be changed. So we had to make concessions about what we could realistically fit into our 5.0 plans, and leave some work for later.

Competing needs

What’s better for one person can be worse for another, and we’ve had to keep that in mind throughout the redesign. We’re acutely aware that such a divide is most pronounced between longstanding users and newcomers. Mastodon’s current UI is beloved by many longtime users, since it can be very powerful once you’ve learned its secrets and quirks. However, newcomers should be able to dive in without being overwhelmed. To keep the community fresh, alive and diverse, we need to break down the barriers to joining, so when you bring your friends, they can find their way around without a manual.

What we believe in

The redesign was grounded in these principles:

• Clarity trumps convenience. The most powerful interface can be useless if it’s too difficult to figure out. Making things more clear and obvious can result in more friction, and that can be necessary.
• Leave room for what’s to come. Navigation may feel emptier for now, and that is on purpose. We have lots of improvements planned that we need to leave space for, to avoid moving more elements around in the future.
• Small improvements matter. We might not be able to fix everything overnight, but we’ll continue to look for small but meaningful improvements to accessibility and usability.

What’s changing in 5.0

Our previous blog post covers most of the big stuff: We’re moving away from the embedded composer and adopting a pop-out composer with new controls for visibility and other post settings. Navigation is simplified and organised in a more intuitive way and create space for future new features.

In your feeds, the posts themselves have been rebuilt from the ground up, giving a fresh look to the places we all spend the most time. We’re also excited to roll out a few new colour themes, which took a truly monumental effort from our engineering team since the start of the year to tokenise our design system.

The new design includes many small affordances, such as hiding a user’s boosts directly from the post menu, following and unfollowing hashtags right from the post, and hiding your own posts and boosts in your home feed.

Notable iterations (since the August blog post)

Since our original announcement, we’ve iterated a lot on the feedback we’ve been receiving, so you’ll notice that the UI looks a bit different than what we’ve shown in that blog post. Here’s what’s changed:

• From bottom right to bottom centre: The position of the composer in the bottom right was controversial. The biggest complaint was that the composer was so far away from the main navigation. However, keeping the composer embedded within the navigation is too limiting, bottom left docking would hide key navigational elements, and resorting to a modal would mean users could lose context of something they’re referencing or replying to. Until we can offer user settings for docking preferences, we’re adjusting to a bottom-centre placement–and the composer can be fully minimised without losing a draft in progress.
• The ‘New post’ action has changed: It’s a more prominent button in the navigation, but moved further down to reduce the distance the mouse has to travel to reach the popout composer. The floating button on mobile launches the composer immediately instead of opening a sub-menu, because we received feedback that users expect to initiate the ‘New message’ action elsewhere.
• Composer visibility settings are still contextual, but considerably simplified: We attempted to show some of the recipients in limited visibility posts, but it confused some users more than it clarified things. Instead of dynamically updating the visibility dropdown with mentioned names, we show a few preset labels that still accurately describe the audience.
• ‘Sensitive’ content has been broken into two settings: Users have historically been able to blur media by adding a blank content warning to their post. This was a powerful yet misunderstood feature, and we’ve received feedback about it for quite some time. To keep the existing functionality but present it in a clearer way, sensitive media and content warnings are now separate, dedicated options inside the composer’s gear menu.
• Quote settings have moved: You cannot change the visibility of a post after publishing it, but you can change its quote settings. We’re now grouping these settings differently to keep the ones that can be changed separate from the ones that cannot.

FAQ

How did you make sure these changes reflect the needs of actual Mastodon users?

We ran a week of surveys and workshop sessions with volunteers from the community to figure out what works for people and what doesn’t. We also monitored feedback from the initial blog post, then tested our prototype, first internally, then with users, gathering more feedback on our new Discourse space while iterating on the designs.

What about existing users having to re-learn the interface?

We understand that an interface you’ve been using for years changing under you can be frustrating. Whenever possible, we’ve based the redesign in existing UI patterns used frequently across the web, so that learning the new way would be easy. We are also communicating clearly about those changes through our blog and announcements to ensure that this transition is not a surprise and the reasons behind it are clearly laid out.

Additionally, our decision to fill less space in the 5.0 interface is precisely so we can minimize jarring changes across future releases.

Why is everything so round?

We’re headed towards more roundness to invite a friendlier brand tone, and to make Mastodon feel more native within modern browsers (most of which have adopted a rounded aesthetic).

Can I offer feedback on the redesign?

We hope you do! Head to our new Discourse forum. While we can’t immediately respond to every topic, we will be reading through each piece of feedback. Please remember to be civil even if you don’t like something: We are people too.

If you are on mastodon.online or another server running nightly updates, you already have early access to the redesign. We are planning to enable this new design on mastodon.social tomorrow, on the 20th October, and then release the first Mastodon 5.0 beta version so server administrators can try it out as well.

What you share in our forum could help us make a few more improvements before 5.0 is officially released to the wider Mastodon universe in a few weeks.

What’s next?

There are essential pages that still desperately need an overhaul: Search, Settings, Messages, and Notifications, to name a few. It’s unlikely we’ll be able to redesign all of those in 5.1. We can say with certainty that the search & discovery experience will be a priority, though.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Update dependencies

• Added
  • Add logging of account data removal (#40572 by @ClearlyClaire)
  • Add link to homepage to 404 error page (#40369 by @diondiondion)
• Changed
  • Change account self-deletion page to always ask to confirm username (#40576 and #40733 by @ClearlyClaire)
• Fixed
  • Fix error handling for malformed webfinger subjects (#40731 by @ClearlyClaire)
  • Fix threads leak by updating dependency aws-sdk-s3
  • Fix occasional installation-time error by updating dependency yarn to v4.18.1 (#40722 by @renovate[bot])
  • Fix inconsistent horizontal page padding between profile and profile editor (#40700 by @diondiondion)
  • Fix server error on registration for wrong DOB (#40607 by @sudeeptarlekar)
  • Fix quotes disclaimer disappearing on posts with no quote (#40587 by @crafkaz)
  • Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681 by @ClearlyClaire)
  • Fix reported statuses not being deleted after account deletion (#40650 by @ClearlyClaire)
  • Fix mobile navigation covering up "Next step" button during onboarding (#40634 by @diondiondion)
  • Fix rate limits not normalizing submitted e-mail addresses (#40658 by @Gargron)
  • Fix moderators being able to issue a warning on moderators of higher position (#40646 by @ClearlyClaire)
  • Fix deleted-because-of-suspension accounts being marked as manually deleted (#40645 by @ClearlyClaire)
  • Fix description text overflowing on Overview landing page (#40272 by @diondiondion)
  • Fix account avatar and header descriptions not being deleted when an account is deleted (#40621 by @ClearlyClaire)
  • Fix deleted accounts not being removed from featured collections (#40623 by @ClearlyClaire)
  • Fix PreviewCardsStatus records not being deleted on account deletion (#40624 by @ClearlyClaire)
  • Fix z-index of PIP video player to be above the side panel (#40484 by @tribela)
  • Fix replies order (#40481 by @OmmyZhang)
  • Fix missing confirmation when leaving with an unsent post (#40478 by @crafkaz)
  • Fix email footer spacing around custom footer text (#40440 by @mjankowski)

Upgrade notes

To get the code for v4.7.3, use git fetch && git checkout v4.7.3.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.7.2.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.7.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Update dependencies

Added

• Add logging of account data removal (#40572 by @ClearlyClaire)

Changed

• Change account self-deletion page to always ask to confirm username (#40576 and #40733 by @ClearlyClaire)

Fixed

• Fix threads leak by updating dependency aws-sdk-s3
• Fix inconsistent horizontal page padding between profile and profile editor (#40700 by @diondiondion)
• Fix server error on registration for wrong DOB (#40607 by @sudeeptarlekar)
• Fix quotes disclaimer disappearing on posts with no quote (#40587 by @crafkaz)
• Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681 by @ClearlyClaire)
• Fix reported statuses not being deleted after account deletion (#40650 by @ClearlyClaire)
• Fix mobile navigation covering up "Next step" button during onboarding (#40634 by @diondiondion)
• Fix rate limits not normalizing submitted e-mail addresses (#40658 by @Gargron)
• Fix moderators being able to issue a warning on moderators of higher position (#40646 by @ClearlyClaire)
• Fix description text overflowing on Overview landing page (#40272 by @diondiondion)
• Fix account avatar and header descriptions not being deleted when an account is deleted (#40621 by @ClearlyClaire)
• Fix deleted accounts not being removed from featured collections (#40623 by @ClearlyClaire)
• Fix PreviewCardsStatus records not being deleted on account deletion (#40624 by @ClearlyClaire)
• Fix replies order (#40481 by @OmmyZhang)
• Fix missing confirmation when leaving with an unsent post (#40478 by @crafkaz)

Upgrade notes

To get the code for v4.6.9, use git fetch && git checkout v4.6.9.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer
PostgreSQL: 14 or newer
Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
LibreTranslate (optional, for translations): 1.3.3 or newer
Redis: 7.0 or newer
Node: 22 or newer
libvips: 8.13 or newer
FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.8.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Update dependencies

Added

• Add logging of account data removal (#40572 by @ClearlyClaire)

Changed

• Change account self-deletion page to always ask to confirm username (#40576 and #40733 by @ClearlyClaire)

Fixed

• Fix stuck sidekiq jobs by updating dependency sidekiq
• Fix server error on registration for wrong DOB (#40607 by @sudeeptarlekar)
• Fix quotes disclaimer disappearing on posts with no quote (#40587 by @crafkaz)
• Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681 by @ClearlyClaire)
• Fix reported statuses not being deleted after account deletion (#40650 by @ClearlyClaire)
• Fix rate limits not normalizing submitted e-mail addresses (#40658 by @Gargron)
• Fix moderators being able to issue a warning on moderators of higher position (#40646 by @ClearlyClaire)
• Fix PreviewCardsStatus records not being deleted on account deletion (#40624 by @ClearlyClaire)
• Fix replies order (#40481 by @OmmyZhang)

Upgrade notes

To get the code for v4.5.19, use git fetch && git checkout v4.5.19.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look:

docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

• Ruby: 3.2 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 20.19 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.18.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.7 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.7 version when they can.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Update dependencies

Added

Add logging of account data removal (#40572 by @ClearlyClaire)

Changed

Change account self-deletion page to always ask to confirm username (#40576 and #40733 by @ClearlyClaire)

Fixed

Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681 by @ClearlyClaire)

Fix reported statuses not being deleted after account deletion (#40650 by @ClearlyClaire)

Fix rate limits not normalizing submitted e-mail addresses (#40658 by @Gargron)

Fix moderators being able to issue a warning on moderators of higher position (#40646 by @ClearlyClaire)

Fix PreviewCardsStatus records not being deleted on account deletion (#40624 by @ClearlyClaire)

Upgrade notes

To get the code for v4.4.26, use git fetch && git checkout v4.4.26.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

Ruby: 3.2 or newer

PostgreSQL: 13 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 6.2 or newer

Node: 20 or newer

libvips (optional, instead of ImageMagick): 8.13 or newer

ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.25.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Changelog

Security

Temporarily disable HEIF support

Fixes

Fix relative privacy policy links in subscription emails (#40486 by @crafkaz)

Fix canonical email blocks interfering with freezing or approving users (#40463 by @ClearlyClaire)

Fix 500 error when trying to upload a non-custom-filter JSON import (#40449 and #40451 by @ClearlyClaire)

Fix 500 error when submitting a status twice (#40439 by @ClearlyClaire)

Fix self-deleted accounts not being un-deleted when using tootctl accounts create --reattach (#40430 by @mjankowski)

Fix account deletion not deleting generated annual reports (#40394 by @ClearlyClaire)

Fix notifications not being cleaned up when notification requests are deleted in bulk (#40393 by @ClearlyClaire)

Upgrade notes

To get the code for v4.7.2, use git fetch && git checkout v4.7.2.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.7.0.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.7.0 release notes.

Restart all Mastodon processes

Original source