Skip to content

friendica

v2026.05-1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 13d Communication & Email
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

federation fediverse mariadb php self-hosted social-media
+1 more
social-network

ReleasePort's take

Light signal
editorial:auto 13d

Friendica 2026.05-1 is the final release supporting PHP below 8.2; future releases require PHP 8.2+. This release patches security vulnerabilities reported by Doyensec/Mastodon.

Why it matters: Plan PHP 8.2+ migration immediately. Instances running older PHP versions must upgrade before the next release to continue receiving security patches.

Summary

AI summary

Updates How to Update, https://github.com/friendica/friendica/pull/14640, and https://github.com/friendica/friendica/blob/stable/CHANGELOG across a mixed release.

Changes in this release

Security Medium

Fixed security vulnerabilities reported by Doyensec/Mastodon.

Fixed security vulnerabilities reported by Doyensec/Mastodon.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Breaking Medium

Last release supporting PHP versions lower than 8.2.

Last release supporting PHP versions lower than 8.2.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: low

Feature Medium

Added new addon to ease handling of images.

Added new addon to ease handling of images.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Feature Medium

Enhanced support for Bridgy Fed and ATproto account integration.

Enhanced support for Bridgy Fed and ATproto account integration.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Performance Medium

Improved several performance issues.

Improved several performance issues.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Refactor Medium

Reworked hook system and introduced AddonHelper class.

Reworked hook system and introduced AddonHelper class.

Source: granite4.1:8b-q6_K@2026-05-21

Confidence: high

Full changelog

We are very happy to announce the availability of the new stable release of Friendica “Blutwurz" 2026.05. In addition to several improvements and new features, this release contains fixes for security problems that Doyensec/Mastodon has notified us about. Thanks for your report!

Some highlight of Friendica 2026.05 are

  • UI improvements in mainly in the frio theme,
  • improved several performance issues,
  • improved support of Bridgy Fed and the ATproto account integration,
  • we added a new addon to ease the handling of images.

For details, please the CHANGELOG file in the repository. 2026.05-1 fixed a small internal problem with the CI but did not change the functionality of Friendica.

This is the last release of Friendica that works with PHP version lower then 8.2. please upgrade your server environment if you are still using older versions of Friendica.

If you have developed your own addons for Friendica note that we reworked our hook system and introduced a new AddonHelper class.

What is Friendica

Friendica is a decentralised communications platform, you can use to host your own social media server that integrates with independent social networking platforms (like the Fediverse or Diaspora*) but also some commercial ones like Tumblr and BlueSky.

How to Update

Updating from old Friendica versions

If you are updating from an older version than the 2026.01 release, please first update your Friendica instance to that version .

Pre-Update Procedures

Ensure that the last backup of your Friendica installation was done recently.

Using Git

Updating from the git repositories should only involve a pull from the Friendica core repository and addons repository, regardless of the branch (stable or develop) you are using. Remember to update the dependencies with composer as well. So, assuming that you are on the stable branch, the commands to update your installation to the 2026.05 release would be

cd friendica
git pull
bin/composer.phar run install:prod
cd addon
git pull

If you want to use a different branch than the stable one, you need to fetch and checkout the branch before your perform the git pull.

Pulling in the dependencies with composer will show some deprecation warning, we will be working on that in the upcoming release.

Using the Archive Files

If you had downloaded the source files in an archive file (tar.gz) please download the current version of the archive from friendica-full-2026.05.tar.gz (sha256) and friendica-addons 2026.05.tar.gz (sha256)) and unpack it on your local computer.

As many files got deleted or moved around, please upload the unpacked files to a new directory on your server (say friendica_new) and copy over your existing configuration (config/local.config.php and config/addon.config.php) and .htaccess files. Afterwards rename your current Friendica directory (e.g. friendica) to friendica_old and friendica_new to friendica.

The files of the dependencies are included in the archive (make sure you are using the friendica-full-2026.05 archive), so you don’t have to worry about them.

Post Update Tasks

The database update should be applied automatically, but sometimes it gets stuck. If you encounter this, please initiate the DB update manually from the command line by running the script

bin/console dbstructure update

from the base of your Friendica installation. If the output contains any error message, please let us know using the channels mentioned below.

Please note, that some of the changes to the database structure will take some time to be applied, depending on the size of your Friendica database this update might run for days.

If you are using the daemon for your background worker, note that we have moved the functionality into the console. Adopt your setup to use the new bin/console daemon command.

Known Issues

At the time of writing this, none with 2026.05

How to Contribute

If you want to contribute to the project, you don’t need to have coding experience. There are a number of tasks listed in the issue tracker with the label “Junior Jobs” we think are good for new contributors. But you are by no means limited to these – if you find a solution to a problem (even a new one) please make a pull request at github or let us know in the development forum.

Contribution to Friendica is also not limited to coding. Any contribution to the documentation, the translation or advertisement materials is welcome or reporting a problem. You don’t need to deal with Git(Hub) or Transifex if you don’t like to. Just get in touch with us and we will get the materials to the appropriate places.

Thanks everyone who helped making this release possible, and especially to all the new contributors to Friendica, and have fun!

Breaking Changes

  • Minimum supported PHP version raised to 8.2; older versions no longer work.

Security Fixes

  • Patched security problems reported by Doyensec/Mastodon (details not specified in changelog)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track friendica

Get notified when new releases ship.

Sign up free

About friendica

Friendica Communications Platform

All releases →

Related context

Beta — feedback welcome: [email protected]