Mastodon Updates & Release Notes

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Update dependencies

Added

• Add “Update available” navigation item at top of navbar when new Mastodon versions are available (#39705 by @ClearlyClaire)
• Add rendering of post images in emails (#39636 by @diondiondion)

Fixed

• Fix “view collection” menu item appearing on collection page (#39694 by @mkljczk)
• Fix incorrect filter cache key sometimes causing incorrect filters to be applied (#39698 by @ClearlyClaire)
• Fix missing to_json to publish announcement reaction worker (#39685 by @mjankowski)
• Fix duplicate "clear" button shown in main search input in Chrome (#39679 by @diondiondion)
• Fix visual glitch with the spoiler button (#39677 by @ChaosExAnima)
• Fix invisible username during post highlight animation (#39659 by @diondiondion)
• Fix follow button floating on profiles when overview landing page is enabled (#39650 by @FFederi)
• Fix encryption warning "read more" link (#39635 by @thomas-pike)
• Fix tootctl media lookup failing on some setups (#39615 by @brookmiles)
• Fix visible transparent navigation link borders in Windows forced-contrast mode (#39614 by @diondiondion)
• Fix crash with some browser extensions injecting custom elements in the page (#39507 by @OriginalRoOhi)

Upgrade notes

To get the code for v4.6.3, use git fetch && git checkout v4.6.3.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.2.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

This release is made solely to update FFmpeg in our docker container images to fix CVE-2026-8461 (critical severity). It is critical to update if you use our docker container images.

If you are not using our docker container images, please make sure your system FFmpeg is updated to a fixed version, that is, 8.1.2, 7.1.5, 6.1.6, or 5.1.10.

For the recently released v4.6.1, see 4.6.1 release notes for information.

Changelog

Security

Update FFMpeg version used in the container image to fix CVE-2026-8461 (critical severity)

Upgrade notes

To get the code for v4.6.2, use git fetch && git checkout v4.6.2.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.1.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Restart all Mastodon processes.

Original source

This release is made solely to update FFmpeg in our docker container images to fix CVE-2026-8461 (critical severity). It is critical to update if you use our docker container images.

If you are not using our docker container images, please make sure your system FFmpeg is updated to a fixed version, that is, 8.1.2, 7.1.5, 6.1.6, or 5.1.10.

For the recently released v4.5.12, see 4.5.12 release notes for information.

Changelog

Security

Update FFMpeg version used in the container image to fix CVE-2026-8461 (critical severity)

Upgrade notes

To get the code for v4.5.13, use git fetch && git checkout v4.5.13.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

Ruby: 3.2 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 20.19 or newer

libvips (optional, instead of ImageMagick): 8.13 or newer

ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.12.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Restart all Mastodon processes.

Original source

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.5 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.5 version when they can.

This release is made solely to update FFmpeg in our docker container images to fix CVE-2026-8461 (critical severity). It is critical to update if you use our docker container images.

If you are not using our docker container images, please make sure your system FFmpeg is updated to a fixed version, that is, 8.1.2, 7.1.5, 6.1.6, or 5.1.10.

For the recently released v4.4.19, see 4.4.19 release notes for information.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

• ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Update FFMpeg version used in the container image to fix CVE-2026-8461 (critical severity)

Upgrade notes

To get the code for v4.4.20, use git fetch && git checkout v4.4.20.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look:

docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.19.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Fix TLS certificate verification being disabled on setups with LDAP_TLS_NO_VERIFY=true (GHSA-3rhr-8phh-jm86)

Update dependencies

Fixed

Fix being unable to unmark media as sensitive when "always mark media as sensitive" is enabled in web UI (#39339 by @matrix07012)

Upgrade notes

To get the code for v4.5.12, use git fetch && git checkout v4.5.12.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

Ruby: 3.2 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 20.19 or newer

libvips (optional, instead of ImageMagick): 8.13 or newer

ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.11.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.5 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.5 version when they can.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Fix TLS certificate verification being disabled on setups with LDAP_TLS_NO_VERIFY=true (GHSA-3rhr-8phh-jm86)

Update dependencies

Fixed

Fix being unable to unmark media as sensitive when "always mark media as sensitive" is enabled in web UI (#39339 by @matrix07012)

Upgrade notes

To get the code for v4.4.19, use git fetch && git checkout v4.4.19.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.17.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

This is a patch release for 4.6.

Check out the 4.6.0 release notes for information.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Update dependencies

Added

Add avatar_description and header_description to /api/v1/accounts/update_credentials (#39547 and #39574 by @ClearlyClaire and @mkljczk)

This is available starting from Mastodon API version 11 and intended to provide an easier implementation path for clients implementing a similar feature in forks.

The new /api/v1/profile API remains the recommended API for setting avatar and header description as well as other profile values.

Fixed

Fix combobox menu not closing after a selection (#39595 by @diondiondion)

Fix Emoji IndexedDB upgrades when multiple tabs are open (#39576 by @ChaosExAnima)

Fix combobox listbox not scrolling up when new suggestions have loaded (#39588 by @diondiondion)

Fix media modal navigation in RTL languages (#39587 by @diondiondion)

Fix accounts not visible in collection editor in advanced web interface (#39586 by @diondiondion)

Fix error on login with certain LDAP configurations (#39571 by @oneiros)

Fix simplified layout applying to other pages in web UI (#39570 by @Gargron)

Fix emoji database loading in web worker (#39558 and #39562 by @ChaosExAnima)

Fix display name length limit being incorrectly enforced in web UI (#39499 by @shleeable)

Fix advanced UI columns not using mobile styles (#39528 by @diondiondion)

Fix "private mention" post heading overlapping thread line (#39521 and #39554 by @diondiondion)

Fix misattribution of remote featured collections in some cases (#39523, #39525, and #39550 by @oneiros)

Fix custom profile field overflow (#39513 by @diondiondion)

Fix fetching unknown key when it's not the actor's first, and add error handling for unavailable keys (#39512 by @ClearlyClaire)

Upgrade notes

To get the code for v4.6.1, use git fetch && git checkout v4.6.1.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

Ruby: 3.3 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 22 or newer

libvips: 8.13 or newer

FFMpeg: 5.1 or newer

ImageMagick removal and libvips replacement

ImageMagick has been deprecated since Mastodon 4.4.0 and is now unsupported. If you used MASTODON_USE_LIBVIPS=false, this will be ignored and you will need to install libvips.

Theming system changes

The theming system has changed substantially, changing how light and dark themes work, as well as high-contrast. We also overhauled the whole theme to use design tokens and CSS variables.

Custom themes will most likely require significant changes to work with Mastodon 4.6.0.

If you are a theme author, please see our documentation at https://docs.joinmastodon.org/dev/frontend/theming/ and https://docs.joinmastodon.org/dev/frontend/design-tokens/

Email subscription feature and additional costs

Mastodon 4.6 introduces a new feature that lets users turn their public posts into mailing lists. This can result in an increased amount of sent emails and thus increased costs.

This feature needs to be enabled by a Mastodon user with administrator privileges, then opted-in by individual users.

In situations where the Mastodon administrators and the people hosting the server are not the same people, such as providers that offer Mastodon as a service, the system administrators may want to disable this feature. This can be done by setting the DISABLE_EMAIL_SUBSCRIPTIONS environment variable to true.

Update steps

The following instructions are for updating from 4.6.0.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

After many months of design, development, gathering feedback, and testing, today we’re releasing a big update with Mastodon 4.6. The headliner of this release is Collections, a way to create and share curated collections of profiles. Part of Mastodon’s work ethos is our commitment to trust and safety, so we’ve put a lot of thought and care into the design of this feature to avoid some of the pitfalls and abuse people have experienced with similar features on other platforms, while focusing on its primary goal: Helping new users discover more of the Fediverse.

Collections

The quality that sets our Collections feature apart is that you can control which collections your profile appears in. If you aren’t opted in to our “Feature me in discovery experiences” preference, you cannot be included in collections at all. If you are opted in, you will be notified every time you’re added to a collection, and can always—at any time—remove yourself from a given collection. We’ve also limited the number of profiles that can be included in a single collection to 25, and decided not to offer a “follow all” shortcut. We might tune the exact number in the future, but the idea is that high volume makes collections harder to overview and therefore easier to use for spam (by e.g. sneaking in some profiles used for spam among a sea of legitimate ones).

Once you have created a collection, you can send the link to your friend or share it anywhere on the web, including Mastodon itself. Your collections will also be available on your own Mastodon profile, under the “Featured” tab. If you update the title or description of your collection later, the profiles that are on it will be notified, so no funny business! For now, finding collections is very manual, primarily through word of mouth. In the future, we are planning to introduce some ways to browse and discover popular collections.

Profiles

After doing a survey to understand what information about other users our community values the most, we’ve updated the look of profiles on Mastodon to make them more ergonomic (and a little prettier!). Whether you like browsing a profile’s original posts only, or want to see everything they boost and reply to, it now takes fewer clicks to get to that information, and your preference applies on every profile you view. Featured hashtags are now also way more prominent and easier to access.

Perhaps even more importantly, we’ve reworked the entire editing experience for your profile. Instead of navigating away into the settings area just to update your profile picture, everything is available right from your profile by switching it into editing mode. Now you can crop your profile picture and header right there, instead of having to do it by hand before uploading. We’re also making it possible to add alt text for profile pictures and headers now, making your profile more accessible for blind and visually impaired users.

With the new profile editing experience comes a few brand new options for customising your profile. You can now control whether a “Media” tab shows at all, and if so, whether it should include media attachments from your replies to other people or not. This way, if you want to use it as a portfolio while hiding the GIFs and memes you use to respond to others, you can. You can also control if the “Featured” tab, which displays your collections and featured profiles, should show up or not.

Newsletters

This feature is primarily for our institutional users, though we expect that journalists, bloggers, and other creators who run their own server might find it useful too: You can now opt-in to allow anonymous visitors to subscribe to your posts via e-mail, so even people who don’t have a Mastodon or Fediverse account and don’t wish to get one can keep up to date with you—given that you have an assigned role with the respective permission and the feature has been enabled on the server. We chose not to make this available for everyone by default as sending e-mail newsletters can significantly rack up the costs of operating a Mastodon server. You can discuss with your server administrator if you want to use this feature.

New landing page variant

If you are looking at the Mastodon server of the European Commission or the German government, the “Trending” tab may not be the most suitable place to start. For this reason, we’re introducing a setting for a new type of landing page that highlights the description of the server and the most recent updates from local profiles, as well as a simplified interface that keeps you from wandering off.

#Wrapstodon

You might remember for the past two years we’ve been offering your year in review on mastodon.social around the month of December. This is a feature we’ve been polishing and optimizing and it’s finally officially becoming available to all server administrators. Starting from December 10 each year, Mastodon will offer you an option to generate your year in review report—only if you agree will anything be generated. The offer can just as easily be dismissed. Unlike the original 2024 version of this feature, which required you to manually take a screenshot to share your #Wrapstodon with other people, it can now be shared as a link with anyone on the web. So that’s something to look forward to towards the end of the year!

Accessibility fixes

We’ve already mentioned that you can now add alt text for profile pictures and headers, but that is just one of many countless accessibility improvements in Mastodon 4.6, from keyboard navigation and focus management, improving color contrasts, to various improvements to how screen readers navigate and read out things in the Mastodon interface. We want to thank the Dutch government who sponsored a significant part of this effort.

In conclusion

Mastodon is the result of the work of our (now much larger!) engineering team and community contributors who submit patches, file bug reports, and translate Mastodon into their native languages. From our heart: Thank you to everyone who contributed to this release, either through code, feedback, or by funding our mission.

Delivering handcrafted code that runs on tens of thousands of servers and serves hundreds of thousands of users is not an easy task. We don’t take venture capital, we don’t sell ads, and we don’t sell your data—unlike many other platforms out there. Please support our mission, so that we can continue to make Mastodon better, and work towards an internet that is diverse, fun, and free from corporate control.

Thank you for supporting Mastodon

We develop and maintain the free and open source software that powers the social web. There is no capital behind this — we rely entirely on your support.

Original source

Warning

This is a pre-release! This has not been as widely tested as regular releases, although it is still tested on mastodon.social and some other servers. If you update to this release, you will not be able to safely downgrade to the existing stable releases. You will, however, be able to upgrade to later nightly releases or pre-releases, as well as the upcoming 4.6.0 stable release.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

• ⚠️ The minimum supported version for Ruby has been bumped to 3.3
• ⚠️ The minimum supported version for Node.JS has been bumped to 22
• ⚠️ The minimum supported version for FFMpeg has been bumped to 5.1
• ⚠️ ImageMagick support has been dropped, libvips is required
• ⚠️ Custom themes need to be updated
• ℹ️ Requires assets recompilation
• ℹ️ Requires streaming server restart
• ℹ️ Requires database migrations

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog (v4.6.0-rc.2)

Added

Add alt text for default server thumbnail (#39439 by @diondiondion)

Changed

Change Page Up/Page Down hotkeys to require Alt modifier key (#39427 by @diondiondion)

Fixed

Fix service worker failing to load due to 404 on chunk dependencies (#39433 by @oliinykdm)
Fix bio text overflow on account profile page (#39418 by @Coro365)
Fix hovercard not showing in compose column (#39430 by @diondiondion)
Fix categorised custom emojis missing from the emoji picker (#39421 by @Hanage999)
Fix notifications about collections not being destroyed with the underlying collection (#39429 by @oneiros)
Fix crash on load and navigation in some cases (#39408 by @diondiondion)
Fix some errors when loading emoji data (#39402 by @ChaosExAnima)
Fix error with audio player in Safari Lockdown Mode (#39397 by @Federicorao)
Fix crash of standalone wrapstodon and embedded status pages (#39400 by @diondiondion)

Changelog (v4.6.0-rc.1)

Added

Add import for custom filters (#39256 by @arte7)
Add redirection when collection AP ID is requested as HTML (#39361 by @oneiros)
Add meta tags to Collection HTML (#39357 by @oneiros)
Add Deprecation headers to collections alpha API (#39349 by @oneiros)
Add ability to filter notifications from bots (#38809 and #39377 by @evanp and @shleeable)
Add duration to ActivityPub representation of media attachments (#38061 by @ClearlyClaire)
Add Stoplight circuit-breaker on Elasticsearch endpoints to better handle some Elasticsearch failures (#39323 and #39375 by @ClearlyClaire and @shleeable)
Add support for collection URLs in authorized_interactions endpoint (#39287 and #39376 by @ClearlyClaire and @shleeable)
Add support for collections in search results when searched by URL in web UI (#39289 by @diondiondion)
Add link to profile editing from “Privacy and reach” (#39309 by @ClearlyClaire)
Add ability to view individual newsletters in admin UI (#39271 by @Gargron)
Add Lazuri, Mingrelian and Ottoman Turkish to languages helper (#38648 by @batumi14)
Add avatar and profile header descriptions to ActivityPub serialization (#39352 by @ClearlyClaire)

Changed

Change limitation to allow posts with both media and a poll to be created (#39203 and #39368 by @ClearlyClaire and @Gargron)
Change links to unknown objects to be resolved when posting (#38711 and #39379 by @ClearlyClaire and @shleeable)
Change web UI navigation to automatically focus the navigated-to modal, post, column header, or compose form (#39350, #39358, and #39360 by @diondiondion)
Change web UI emoji autocompletion to perform substring search (#39353 and #39382 by @ChaosExAnima)
Change wording of tootctl preview_cards remove command description to clearly state it only removes media (#39348 by @mjankowski)
Change rule acceptance link to a form to prevent some crawling behavior (#39283 and #39345 by @ClearlyClaire and @mjankowski)
Change collection API to enforce a maximum for the pagination limit param (#39342 by @oneiros)
Change alerts ("toasts") to be announced by assistive tech in web UI (#39335 by @diondiondion)
Change media attachment limit to 10000 characters (#39306 by @ClearlyClaire)
Change column headers to move extra buttons out of h1 in web UI (#39305, #39331, and #39356 by @diondiondion)

Removed

Remove outdated hint for "Use system scrollbar" preference (#39297 by @diondiondion)

Fixed

Fix account hovercard sometimes not triggering (#39381 by @diondiondion)
Fix loading/errored emoji in detailed status display name causing line break in web UI (#39378 by @diondiondion)
Fix empty modal when adding an account to collections from profile when no collection has been created (#39372 by @diondiondion)
Fix "unlisted collections" profile section incorrectly listing empty collections as unlisted in web UI (#39373 by @diondiondion)
Fix display of sensitive media cards in web UI according to settings (#39366 by @nshki)
Fix Elasticsearch connections not being cleaned up properly in Sidekiq middleware (#39359 by @ClearlyClaire)
Fix font size of Callout component actions in Safari in web UI (#39354 by @diondiondion)
Fix being unable to unmark media as sensitive when "always mark media as sensitive" is enabled (#39339 by @matrix07012)
Fix featured collection updates not always being delivered to all featured collection members (#39346 by @oneiros)
Fix handling of offset in timezone list in settings (#39334 by @mjankowski)
Fix Delete activities on quote approval stamps and featured collection stamps not being signed (#39047 by @shleeable)
Fix various accessibility issues caused by "simple" ruby gems (#39325 by @diondiondion)
Fix tiny checkboxes and radio buttons in Safari (#39332 by @diondiondion)
Fix inconsistent keyboard_shortcuts.translate string (#39328 by @noelleleigh)
Fix alignment of icon and text in Callout component (#39324 by @diondiondion)
Fix naming of custom filter export attribute (#39304 by @arte7)
Fix "change thumbnail" button being visible when it shouldn't (#38467 by @dpbento)
Fix collections editor allowing to add the same account multiple times (#39296 by @diondiondion)
Fix robustness of post/feed navigation by hotkey (#39270 by @diondiondion)
Fix blocked domains not being removed from the Instance search index (#39109 by @shleeable)
Fix account data fetching when loading many collections at once (#39286 by @diondiondion)
Fix logged out users being able to access confusing collection and list creation routes (#39282 by @diondiondion)
Fix some inputs incorrectly having resize handles in Firefox (#39274 by @diondiondion)

Changelog (v4.6.0-beta.1)

Added

Add collections (#37992, #37005, #37049, #37020, #37053, #37110, #37117, #37122, #37154, #37157, #37176, #37192, #37222, #37225, #37254, #37277, #37298, #37322, #37434, #37468, #37514, #37512, #37549, #37556, #37560, #37580, #37591, #37552, #37618, #37643, #37658, #37731, #37678, #37741, #37762, #37790, #37805, #37823, #37837, #37842, #37850, #37848, #37812, #37950, #37898, #37916, #37920, #37927, #37928, #37961, #37967, #37974, #37989, #37986, #38004, #38026, #38027, #38030, #38038, #38065, #38081, #38082, #38096, #38106, #38113, #38124, #38133, #38144, #38153, #38166, #38167, #38169, #38170, #38177, #38193, #38213, #38251, #38255, #38256, #38282, #38298, #38292, #38307, #38306, #38316, #38115, #38329, #38334, #38337, #38351, #38368, #38370, #38356, #38383, #38386, #38385, #38394, #38393, #38399, #38402, #38409, #38414, #38413, #38424, #38425, #38450, #38508, #38528, #38534, #38536, #38540, #38543, #38491, #38586, #38611, #38588, #38612, #38628, #38626, #38630, #38633, #38629, #38638, #38645, #38644, #38636, #38660, #38657, #38688, #38690, #38672, #38698, #38697, #38708, #38712, #38713, #38709, #38719, #38728, #38730, #38732, #38739, #38749, #38751, #38750, #38767, #38769, #38783, #38785, #38959, #38786, #38794, #38776, #38817, #38792, #38822, #38827, #38831, #38830, #38844, #38843, #38852, #38850, #38847, #38865, #38897, #38900, #38919, #38933, #38934, #38935, #38942, #38941, #38954, #38961, #38957, #38962, #38991, #39009, #39062, #39029, #39069, #39020, #39073, #39082, #39096, #39080, #39182, #39143, #39127, #37929, #38029, #39194, #39198, #39210, #39211, #39202, #39214, #39215, #39220, #39234, #39260, and #39251 by @ChaosExAnima, @ClearlyClaire, @Gargron, @arte7, @diondiondion, @mjankowski, @oneiros, and @shleeable)

Create collections with up to 25 accounts each, then share them with others. You can read more about this feature on our blog. This is based on FEP-7aa9 (Featured Collections) to be interoperable with the wider Fediverse. All the new API methods are documented here.

Add email subscriptions (#38163, #38507, #38502, #38487, #38527, #38582, #38741, #38907, and #39162 by @ClearlyClaire and @Gargron)

Admins can allow specific roles to enable email subscriptions on their profile, allowing anonymous visitors to subscribe to their posts via email.

Add new overview landing page setting (#39074, #39170, #39163, and #39138 by @Gargron, @diondiondion, and @zunda)

Admins can choose a new frontpage for anonymous visitors, which combines the about page and most recent posts from local profiles.

Add ability to require 2FA for specific roles (including Everybody) (#37701, #37846, and #38906 by @ClearlyClaire and @mjankowski)

Add export for custom filters (#39085 by @arte7)
Add ability to search email blocks by domain in admin UI (#38923 by @arte7)
Add new endpoints for profile editing in REST API (#37912, #37934, #37932, #38221, and #38339 by @ClearlyClaire)

Add GET /api/v1/profile and PATCH /api/v1/profile to replace the existing update_credentials endpoint. See the documentation for more information.

Add missing_attribution boolean to preview cards in REST API (#38043 by @ClearlyClaire)

Documentation: https://docs.joinmastodon.org/entities/PreviewCard/#missing_attribution

Add exclude_direct flag to /api/v1/accounts/:id/statuses to exclude direct messages (#37763 by @ClearlyClaire)
Add max_note_length and max_display_name_length attributes to configuration.accounts in Instance entity (#37991 by @ClearlyClaire)
Add profile field limits to instance entity in REST API (#37535 by @mkljczk)

This adds attributes configuration.accounts.max_profile_fields, configuration.accounts.profile_field_name_limit and configuration.accounts.profile_field_value_limit to the Instance entity.

Add unresolved flag to /api/v1/admin/reports to query both resolved and unresolved reports (#38323 by @mkljczk)
Add fallback attributes to notifications for new and infrequent notifications in REST API (#38832 and #38860 by @ClearlyClaire)

This adds a supported_types parameter to GET /api/v1/notifications, GET /api/v1/notifications/:id, GET /api/v2/notifications, and GET /api/v2/notifications/:group_key along with a new fallback attribute for notifications and notification groups.

Add support for posts in vertical languages in web UI (#37204, #38205, and #38797 by @shimon1024)
Add PageUp and PageDown hotkeys for list navigation (#39252 by @diondiondion)
Add g+e keyboard shortcut to access the trending page in web UI (#38014 by @antoinecellerier)
Add Cmd/Ctrl+Enter for form submissions in more text areas in web UI (#37821 by @diondiondion)
Add support for quoting by dragging a link into the compose form in web UI (#36859 and #36896 by @ClearlyClaire and @tribela)
Add text-autospace to posts to improve rendering of mixed script posts in web UI (#37694 by @ahxxm)
Add nan-TW to supported locales (#37650, #34923, #37822, and #37721 by @ClearlyClaire and @Yoxem)
Add support for hosts resolver in request socket DNS lookup (#38699, #38866, and #39030 by @ClearlyClaire and @mjankowski)
Add support for FEP-2c59 (Webfinger Backlink) (#38239, #38538, and #38639 by @ClearlyClaire and @shleeable)
Add support for FEP-3b86 (Activity Intents) (#38120 and #38130 by @ClearlyClaire and @Gargron)
Add support for alt text for profile pictures and headers (#37634, #37641, and #38000 by @ClearlyClaire and @Doxterpepper)
Add support for multiple keypairs for remote accounts (#38279, #38407, #38419, #38511, #38516, #38515, #38555 and #39235 by @ClearlyClaire)
Add support for the “require approval” feature for email domain blocks to tootctl email_domain_blocks (#34579 and #38107 by @ClearlyClaire and @e-nomem)
Add --keep-interacted flag to tootctl media remove to preserve cached media on cleanup (#36200 by @northerner)
Add systemd service file for prometheus exporter (#35130 by @ThisIsMissEm)

Changed

Change design of profiles in web UI (#37472, #37490, #37479, #37513, #37527, #37550, #37538, #37632, #37627, #37593, #37638, #37626, #37645, #37653, #37683, #37707, #37682, #37742, #37747, #37760, #37761, #37831, #37766, #37811, #37813, #37825, #37854, #37851, #37876, #37885, #37892, #37890, #37907, #37922, #37952, #37958, #37996, #37990, #37994, #38005, #38012, #38040, #38052, #38066, #38083, #38147, #38148, #38152, #38168, #38156, #38175, #38191, #38189, #38235, #38283, #38310, #38309, #38315, #38314, #38365, #38366, #38363, #38346, #38382, #38384, #38400, #38404, #38417, #38426, #38440, #38442, #38443, #38445, #38446, #38451, #38456, #38509, #38510, #38512, #38513, #38517, #38529, #38531, #38535, #38532, #38544, #38549, #38575, #38579, #38580, #38581, #38585, #38584, #38604, #38605, #38606, #38607, #38622, #38616, #38625, #38632, #38640, #38663, #38667, #38646, #38691, #38692, #38766, #38791, #38687, #38826, #38828, #38863, #38845, #38870, #38872, #38932, #38945, #38963, #38964, #39055, #39042, #38893, #39079, #39084, #39160, #39070, and #39217 by @ChaosExAnima, @ClearlyClaire, @Coro365, @diondiondion, and @shleeable)

The profile screen has been entirely redesigned, has new features, and allows you to update your own profile directly without going into the preferences panel. You can read more about it on our blog.

Change how #Wrapstodon reports are generated and displayed (#37033, #37045, #37093, #37055, #37096, #37047, #37103, #37104, #37106, #37109, #37121, #37138, #37134, #37177, #37182, #37169, #37186, #37187, #37188, #37189, #37190, #37193, #37198, #37201, #37203, #37205, #37206, #37207, #37209, #37202, #37216, #37219, #37224, #37226, #37229, #37249, #37251, #37256, #37261, #37269, #37270, #37273, and #37289 by @ChaosExAnima, @ClearlyClaire, @channyeintun, and @diondiondion)

This finishes up work started in 2024 by completely revamping how Wrapstodon reports are generated and displayed, reducing the amount of data collected and generating reports when active users ask for them.

Instead of requiring manual generation from a server administrator, this is now offered between the 10th of December and the end of each year if enabled in the server settings.

The design of the Wrapstodon report has also been fully reworked to be more delightful and easier to share!

The relevant API endpoints are documented at https://docs.joinmastodon.org/methods/annual_reports/

Change pending user notification email to link directly to the pending account (#39206 by @vmstan)
Changed emoji processing in web UI to make it less resource intensive and more robust (#39077, #39008, #39088, #38892, #38885, #38965, #38854, #38825, #38784, #38541, #37442, #37300, #37306, #37271, #37255, #37284, #37272, #37178, #37084, #37080, #37418, #39167, and #39126 by @ChaosExAnima, @ClearlyClaire, @diondiondion, and @gomasy)
Change composer textarea to have a limited height to prevent column scrolling (#39268 by @diondiondion)
Change mentions of “Mastodon gGmbH” to “Mastodon GmbH” (#39261 by @renchap)
Change the limited profile message to be less misleading (#39231 by @mortie)
Change images/videos in posts in web UI to not have unlimited height (#36966, #37035, #37136, and #37032 by @diondiondion)
Change search field and tabs to stick to the top on the search results page in web UI (#38968 by @diondiondion)
Change “anyone can quote” label to “quotes allowed” in web UI (#37427 by @vmstan)
Change navigation by j/k hotkeys to anchor navigated item to top of viewport in web UI (#38036 by @diondiondion)
Change hotkeys to focus columns to not reset scroll, add hotkey 0 to scroll to top in web UI (#37052 by @diondiondion)
Change media modal swipe animation in web UI (#36916, #37034, #37323, and #37464 by @ChaosExAnima and @heathdutton)
Change “Hide”/“Show all” eye icon in thread view in web UI (#22301 by @tribela)
Change order of onboarding steps (follow people, then fill out profile) in web UI (#38121 by @Gargron)
Change “Why do you want to join” field on the sign-up page to have a label (#38936 by @diondiondion)
Change date of birth field on the sign-up page to use locale-specific fields order (#36039 and #36895 by @mjankowski)
Change how invalid-but-not-expired invites are shown in admin UI (#38736 by @ClearlyClaire)
Change wording and ordering of media display settings (#38731 by @mjankowski)
Change wording of server account recommendation setting description (#36771 by @mjankowski)
Change wording and ordering of account migration warnings (#20387 by @jsoref)
Change wording of “Automatic post deletion” settings (#37286 by @mjankowski)
Change wording of language filter settings to clarify they do not impact home/lists (#38490 by @mjankowski)
Change invitations to only bypass sign-up approval setting when the issuer of the invitation has the invite_bypass_approval permission (#38278 by @ClearlyClaire)

This splits the “Invite Users” permission into a new “Invite Users without review” permission.

Existing roles will be updated to have the new permission if they have the old one, but default permissions will not include the new invite_bypass_approval permission.

Change followers synchronization mechanism on followers-only posts to be skipped for accounts with 25k followers or more (#37302 by @ClearlyClaire)
Change “dark”, “light” and “high contrast” themes to be separate “Color scheme” and “Contrast” settings handled by a single theme (#37095, #37120, #37288, #37459, #37470, #37477, #37519, #37520, #37523, #37524, #37526, #37612, #37824, #37807, #37810, #37819, #37906, and #38261 by @ClearlyClaire, @diondiondion, and @mjankowski)

Existing settings should be migrated automatically from user settings, and using browser defaults otherwise.

This also allows third-party theme authors to make use of the same browser defaults and user settings. Learn more about this in our new Theming docs.

Change default theme to use CSS theme tokens (#36861, #36936, #37019, #37054, #37056, #37081, #37105, #37268, #37841, #37843, #38387, #38459, and #38621 by @diondiondion)

A guide to using the new tokens can be found in our docs.

Change location blocks in default nginx.conf (#19644 and #37866 by @BedrockDigger and @Izorkin)
Change proxy_read_timeout to 120 seconds in default nginx.conf (#30599 by @shleeable)
Change JSON-LD collection handling (#34595 and #37806 by @ClearlyClaire and @sneakers-the-rat)

Removed

Remove support for EOL Node version 20 (#38926 by @mjankowski)
Remove support for Ruby 3.2 (#37476 by @mjankowski)
Remove support for ENABLE_SIDEKIQ_UNIQUE_JOBS_UI (#38340 by @ClearlyClaire)
Remove support for ImageMagick (#37488 by @mjankowski)

Fixed

Fix accessibility issues in web UI (#37250, #38006, #38033, #38188, #38230, #38252, #38257, #38285, #38293, #38362, #38387, #38459, #38796, #38801, #39098, #39111, #39120, #39129, #39133, #39134, #39144, #39145, #39149, #39164, #39165, #39169, and #39181 by @ChaosExAnima and @diondiondion)
Fix processing some link previews where text is language-tagged (#39190 by @zunda)
Fix error when “New trends” email is sent at the same time trends are recomputed (#39122 by @arte7)
Fix hover card opening even when not preceded by mouse movement in web UI (#39166 by @diondiondion)
Fix ominous "Moments remaining" timestamp in web UI (#38488 and #38689 by @ChaosExAnima and @MitarashiDango)
Fix filters not being applied to search results in web UI (#36346 by @ClearlyClaire)
Fix error when visiting non-public hashtag timelines (#36961 by @diondiondion)
Fix duplicate favourite/boost counters in some languages (#36844 by @ChaosExAnima)
Fix unblocking domain from blocked domains column not updating the list in web UI (#38882 by @tribela)
Fix profile dropdown menu sometimes ending with a separator in web UI (#38481 by @mkljczk)
Fix short numbers rounding up instead of truncating in web UI (#38114 by @serranodfm)
Fix directory showing load more button when no more profiles exist in web UI (#37465 by @heathdutton)
Fix focus restoration after closing some modals in web UI (#37424 by @MegaManSec)
Fix video modals being pushed down on mobile in web UI (#37421 by @ChaosExAnima)
Fix outer page margins when viewport width equals content width in web UI (#36733 by @diondiondion)
Fix announcement margin when in advanced web UI (#36714 by @ChaosExAnima)
Fix navigation overflow issue in advanced web UI (#39178 by @diondiondion)
Fix stale merging stale account from cached instance API response in web UI (#37666 by @ChaosExAnima)
Fix HTML lang attribute being stripped out of remote posts (#39114 by @artemist)
Fix remote posts with large media descriptions being rejected (#39135 by @ClearlyClaire)
Fix some occurrence of PostgreSQL log pollution when processing new hashtags (#35792 by @oelison)
Fix replica database not being used when REPLICA_DB_HOST is used but neither REPLICA_DB_NAME nor REPLICA_DATABASE_URL (#37240 by @smiba)
Fix remote media attachment thumbnails not being stored in the cache/ directory (#36911 by @shugo)
Fix race condition when processing posts twice with the same idempotency key (#37879 by @ClearlyClaire)
Fix various missing translation strings (#37671, #37838, #37078, #37371, and #37827 by @ClearlyClaire, @mjankowski, and @valtlai)
Fix last post time for remote accounts not being accurately tracked (#37619 by @ClearlyClaire)
Fix filtering of mentions from filtered-on-their-origin-server accounts (#37583 by @ClearlyClaire)
Fix irrelevant remote accounts being passed through to local fan-out worker (#37589 by @ClearlyClaire)
Fix required field markers being displayed on fields that cannot be empty anyway in settings (#37291 by @diondiondion)
Fix thumbnails for links from The Guardian (and possibly other CDNs that check URL hashes) not showing up (#36139 by @phocks)
Fix mastodon-async-refresh response header not being exposed through CORS (#38914 by @mkljczk)
Fix FASP availability being incorrectly updated (#38818 by @oneiros)
Fix use of deprecated vsync FFmpeg option, using fps_mode instead (FFmpeg >= 5.1 now required) (#38198 by @mjankowski)
Fix unnecessary downcasing of some words in admin UI (#37364 by @ClearlyClaire)
Fix delivery worker counting unsalvageable HTTP errors as successes (#37235 by @shleeable)
Fix streaming heartbeat comment not being its own event (#37389 by @ClearlyClaire)
Fix posts with edited out media attachments being returned in GET /api/v1/accounts/:id/statuses?only_media=true (#37363 by @ClearlyClaire)
Fix wrong media attachment URLs being returned from DELETE /api/v1/statuses/:id (#35880 by @dbarabashh)
Fix hashtag matching by replacing negative look-behind with positive look-behind (#37684 and #38212 by @ClearlyClaire)
Fix discovery of ActivityPub representation from HTML tags in presence of a non-ActivityPub alternate Link header (#37439 by @shleeable)
Fix Webfinger endpoint not handling new ActivityPub ID scheme (#38391 by @ClearlyClaire)
Fix error when admin-selected theme does not exist by falling back to default theme (#38703 by @shleeable)
Fix wrong endonyms for Divehi and Latvian in languages list (#36254 and #36876 by @cuu508 and @shimon1024)
Fix Accept headers when fetching ActivityPub resources not including JSON-LD profile (#30354 by @TheOneric)
Fix wrong hover indicators on unclickable items in admin UI (#38782 by @diondiondion)
Fix streaming server using deprecated url.parse instead of WHATWG URL API (#36973 by @Exagone313)

Upgrade notes

To get the code for v4.6.0-rc.2, use git fetch && git checkout v4.6.0-rc.2.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have changed since v4.5.0, with new Ruby, Node and FFMpeg version requirements.

Ruby: 3.3 or newer
PostgreSQL: 14 or newer
Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
LibreTranslate (optional, for translations): 1.3.3 or newer
Redis: 7.0 or newer
Node: 22 or newer
libvips: 8.13 or newer
FFMpeg: 5.1 or newer

ImageMagick removal and libvips replacement

ImageMagick has been deprecated since Mastodon 4.4.0 and is now unsupported. If you used MASTODON_USE_LIBVIPS=false, this will be ignored and you will need to install libvips.

Theming system changes

The theming system has changed substantially, changing how light and dark themes work, as well as high-contrast. We also overhauled the whole theme to use design tokens and CSS variables.

Custom themes will most likely require significant changes to work with Mastodon 4.6.0.

If you are a theme author, please see our documentation at https://docs.joinmastodon.org/dev/frontend/theming/ and https://docs.joinmastodon.org/dev/frontend/design-tokens/

Email subscription feature and additional costs

Mastodon 4.6 introduces a new feature that lets users turn their public posts into mailing lists. This can result in an increased amount of sent emails and thus increased costs.

This feature needs to be enabled by a Mastodon user with administrator privileges, then opted-in by individual users.

In situations where the Mastodon administrators and the people hosting the server are not the same people, such as providers that offer Mastodon as a service, the system administrators may want to disable this feature. This can be done by setting the DISABLE_EMAIL_SUBSCRIPTIONS environment variable to true.

Update steps

The following instructions are for updating from 4.5.11. They also apply for migration from v4.6.0-beta.1 and v4.6.0-rc.1.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

If you are using rbenv, update the list of available versions and install the proper Ruby version by doing RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install in the Mastodon install directory (e.g. /home/mastodon/live)

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Run the pre-deployment database migrations by specifying the SKIP_POST_DEPLOYMENT_MIGRATIONS=true environment variable: SKIP_POST_DEPLOYMENT_MIGRATIONS=true RAILS_ENV=production bundle exec rails db:migrate

Restart all Mastodon processes.

Run the post-deployment database migrations: RAILS_ENV=production bundle exec rails db:migrate

When using Docker

Run the pre-deployment database migrations by specifying the SKIP_POST_DEPLOYMENT_MIGRATIONS=true environment variable: docker-compose run --rm -e SKIP_POST_DEPLOYMENT_MIGRATIONS=true web bundle exec rails db:migrate

Restart all Mastodon processes.

Run the post-deployment database migrations: docker-compose run --rm web bundle exec rails db:migrate

Original source

Changelog

Security

• Fix allowed attribution domains spoofing (GHSA-rwcw-vq68-g34p)
• Fix uncaught exception in message sanitization causing Denial of Service (GHSA-qrgq-9fx2-vf2r)
• Update dependencies

Fixed

• Fix remote statuses with large media descriptions being rejected (#39135 by @ClearlyClaire)

Upgrade notes

To get the code for v4.5.11, use git fetch && git checkout v4.5.11.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

• Ruby: 3.2 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 20.19 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.10.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.5 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.5 version when they can.

Changelog

Security

• Fix allowed attribution domains spoofing (GHSA-rwcw-vq68-g34p)
• Fix uncaught exception in message sanitization causing Denial of Service (GHSA-qrgq-9fx2-vf2r)
• Update dependencies

Fixed

• Fix remote statuses with large media descriptions being rejected (#39135 by @ClearlyClaire)

Upgrade notes

To get the code for v4.4.18, use git fetch && git checkout v4.4.18.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.17.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

Install dependencies with bundle install

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Fix SSRF protection bypass (GHSA-crr4-7rm4-8gpw, GHSA-xx55-4rrg-8xg6)
• Fix Linked-Data Signature bypass through JSON-LD graph restructuring features (GHSA-53m7-2wrh-q839, GHSA-chgx-jx3p-rf73)

Updated dependencies

Fixed

• Fix type of interactingObject, interactionTarget and add missing QuoteAuthorization (#38940 by @ClearlyClaire)

Removed

• Remove unused devise strategies (#38795 by @ClearlyClaire)

Upgrade notes

To get the code for v4.5.10, use git fetch && git checkout v4.5.10.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

Ruby: 3.2 or newer

PostgreSQL: 14 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 7.0 or newer

Node: 20.19 or newer

libvips (optional, instead of ImageMagick): 8.13 or newer

ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.9.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.5 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.5 version when they can.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

Fix SSRF protection bypass (GHSA-crr4-7rm4-8gpw, GHSA-xx55-4rrg-8xg6)

Fix Linked-Data Signature bypass through JSON-LD graph restructuring features (GHSA-53m7-2wrh-q839, GHSA-chgx-jx3p-rf73)

Updated dependencies

Removed

Remove unused devise strategies (#38795 by @ClearlyClaire)

Upgrade notes

To get the code for v4.4.17, use git fetch && git checkout v4.4.17.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

Ruby: 3.2 or newer

PostgreSQL: 13 or newer

Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)

LibreTranslate (optional, for translations): 1.3.3 or newer

Redis: 6.2 or newer

Node: 20 or newer

libvips (optional, instead of ImageMagick): 8.13 or newer

ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.16.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

Install dependencies with bundle install and yarn install --immutable

Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile

Restart all Mastodon processes.

When using Docker

Restart all Mastodon processes.

Original source

Caution

Mastodon 4.3 is unsupported and contains known security issues. Please update to a newer Mastodon version as soon as possible.

This version is only provided as a stop-gap, as patches were ready before the end-of-support date, but no further update will be made on this branch.

Changelog

Security

Fix SSRF protection bypass (GHSA-crr4-7rm4-8gpw, GHSA-xx55-4rrg-8xg6)

Fix Linked-Data Signature bypass through JSON-LD graph restructuring features (GHSA-53m7-2wrh-q839, GHSA-chgx-jx3p-rf73)

Updated dependencies

Upgrade notes

To get the code for v4.3.23, use git fetch && git checkout v4.3.23.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.3.0, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 3.1 or newer
• PostgreSQL: 12 or newer. PostgreSQL versions 14.0 to 14.3 are not supported as they contain a critical data-corruption bug (see v4.3.0 release notes)
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 4 or newer
• Node: 18 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer

Update steps

The following instructions are for updating from 4.3.22.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, please read the v4.3.0 release notes, as there have been multiple important changes.

Non-docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.

If you run into such an issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

Install dependencies with bundle install and yarn install --immutable

Restart all Mastodon processes.

When using docker

Restart all Mastodon processes.

Original source

People come to the Fediverse to connect with others around communities and topics of interest. We’ve seen people enjoy their time on Mastodon the most, when they can follow and engage with individuals and organisations that have interesting things to share. We want to help those who are new to the Fediverse discover these communities more easily.

Back in October 2025, we shared our initial ideas about a new feature that’s coming in Mastodon 4.6, that we’re calling Collections. Collections are a way for people on Mastodon to curate and share bundles of accounts that they’d recommend to others - helping to grow these connections more quickly, instead of newcomers hunting around for the accounts they might be interested in.

The team has been working hard on the feature since then, and in this post we’re providing an update on what you’ll see when Collections start to appear in the next few weeks. Importantly, this is just the beginning for Collections! Think of this as the “version 1” release for feedback - we’re taking a slow and intentional approach to building them out.

We want to give a shout-out to some of the other great resources that help people to navigate and discover new content across the Fediverse - for example, fedi.tips and their @FediFollows account, the starter packs from fedidevs.com, and more. There’s room for all of these to offer alternative discovery options, and we appreciate the community initiatives; we hope Collections will be a useful addition.

Our approach

We had three primary inputs that shaped our thinking as we designed Collections.

Learning from Bluesky

We reviewed public feedback around Bluesky’s Starter Packs to inform our approach before building this feature. The biggest influence this had on us, was that we knew that we needed to have a way to for people to review Collections they are added to, and to remove themselves without having to resort to blocking or reporting.

We made the decision early on that people are not automatically included in their own collections. Curators can add themselves, but it’s not a requirement. This also influenced our choice for smaller Collection sizes, at least at the start - we may revisit this later.

Learning from the Mastodon community

We wanted to understand what information would be most helpful for people in deciding whether to follow accounts within a collection. Accounts currently display in list form, and we can’t show the entire profile - trade-offs must be made.

To understand what information to prioritise, we distributed a survey to people on Mastodon in late 2025. We found, unsurprisingly, that an account’s posts and bio text both have a huge influence on trust and interest. Additionally, being aware of mutuals (e.g. “people I follow who are following this account”) scored high on both points. Interestingly, recency of the account’s last post scored higher than the presence of a verified link, follower count, post count, and several other factors in influencing following behaviour (these findings also informed the redesign of Profiles). This study was conducted with limited resources - while not statistically significant, it offered us a starting point in understanding how Collections would be best represented.

Technical constraints

Technical challenges limit our ability to show posts within a Collection for v1, but we’d like to explore this as the feature matures.

Collections are similar to our existing Lists feature, in that they’re account-based. Many people asked for public, shareable lists, but we don’t currently have the infrastructure to build something of that scale. However, we plan to reduce confusion through naming and navigational updates in a future release of Mastodon.

Collections: What’s included in 4.6

We’re moving intentionally with this feature, using the 4.6 launch as an opportunity to learn more from the community. As such, we’ve taken a lightweight approach.

Creation

People with accounts on participating servers will be able to create Collections. Collections may include a short description and topic – a single hashtag to aid in discovery. Additionally, Collections may be marked as sensitive (this setting hides the description and accounts behind a content warning).

Sharing and discovery

Collections can be set to either Public or Unlisted, and shared via a link.

There’s a caveat here - the initial launch focuses on creation, with search and discovery coming soon. There are three reasons we’re doing this:

1. The number of community-created Collections needs to hit a critical mass before certain discovery experiences become impactful. For example, we’d like server owners to be able to recommend Collections to follow during onboarding (this would be a replacement for the current Recommended Accounts feature).

2. We’d like to observe how the community creates and shares Collections first; this will help us to understand how and where to showcase public Collections.

3. Implementing Collections in search and discovery is technically expensive.

This means that Public and Unlisted Collections will function very similarly at first, except that public Collections are also included in the curator’s Featured tab on their profile.

Privacy and moderation

You can opt out of having your account be eligible for inclusion in Collections by disabling the existing “Feature profile and posts in discovery algorithms” account setting.

If you are opted into discovery, you will be notified when another account adds you to a Collection. From there, you can view the contents of the Collection, and remove your account if desired.

In cases of potential harassment, you are encouraged to report or block the other account. Reporting a Collection allows a decision to be made by server moderators; blocking removes you from any collections curated by the blocked account, and prevents the blocked account from adding your account to future Collections.

What’s not in the initial release

Super large Collections

In this release, Collections can include up to 25 accounts.

Collections on Mastodon will continue to focus on quality over quantity. We suspect that smaller Collections will cut down on the type of spammy behaviour that was sometimes seen on Bluesky (where there is a limit of 150 accounts on Starter Packs). However, we don’t know exactly what the magic number is; we’ve talked to several industry leaders, and suspect the number is between 25 and 80. This is still a wide range, and we’re starting on the lower end because it’s far easier from a technical perspective to increase this limit later, than it is to reduce it.

Find yourself maxing out a Collection and then creating a “Volume 2”? Send us your Collection, if you want; or, tell us about it, so we can understand your use case.

A ‘Follow All’ button

We’re not including a bulk follow action on day one.

This is something we’re considering, but we want to approach it with care. We read feedback that people on Bluesky often found themselves mass following accounts from stale Starter Packs, only to have a subpar feed afterwards.

We also recognise that there are scenarios that require more thought. For example, imagine you follow all accounts in a Collection, but then, some of the accounts are removed from the Collection. Do you expect to be able to bulk unfollow all of the accounts you previously followed from that Collection, even if they no longer exist there? Many people look to Mastodon to be the straightforward and authentic platform, so including a bulk follow action without an “escape hatch” is a dark pattern that we wish to avoid.

In short, we’re open to this in the future, but we’d like to understand the demand first. We hope to hear from the community about the experience of using “Collections v1”, and we may add a ‘Follow All’ button, potentially with proper undo controls, if there’s strong demand for reducing friction in the experience.

Availability

We’ll be enabling Collections on mastodon.social in the coming week. As usual, we take a moment to test out these features on our own servers ahead of a release. This initial release of Collections will become generally available for all Mastodon servers as part of Mastodon 4.6, coming in a few weeks.

note: we plan to add more screenshots to this post soon

Open to feedback

We’re focused on user privacy, and this means that we have very limited analytics to inform decisions. We also believe in community-driven design, and we want to be transparent about our thinking as we build new features. Our small team is counting on the insights from your experiences as you create, use, and test Collections! If you have things you’d like to let us know related to these updates, contact us at [email protected]. We might not be able to respond individually, but rest assured that we’ll be reading every piece of feedback.

Thanks

We are grateful to GCC for a grant that supported the development of this feature.

Original source