mastodon releases

Upgrade now

v4.4.18 Security relevant · 13h

Auth RCE / SSRF

Security fixes + media description handling

Open

Upgrade now

v4.5.11 Security relevant · 13h

Auth RCE / SSRF

Security fixes + media description bug

Open

Upgrade now

v4.5.10 Breaking risk · 14d

RCE / SSRF Breaking upgrade

SSRF fix + strategy removal

Open

v4.3.22 Security relevant · 1mo

Security fixes

• Insufficient verification of email addresses (GHSA-5r37-qpwq-2jhh)

Notable features

• Add trademark warning to mastodon:setup task

View release on GitHub

v4.4.16 Security relevant · 1mo

Security fixes

• Insufficient verification of email addresses (GHSA-5r37-qpwq-2jhh)

Notable features

• Add trademark warning to mastodon:setup task
• Fix quote definition in JSON-LD context

View release on GitHub

v4.5.9 Security relevant · 1mo

Security fixes

• Insufficient verification of email addresses (GHSA-5r37-qpwq-2jhh)

Notable features

• Add trademark warning to mastodon:setup task
• Fix quote definition in JSON-LD context
• Fix quote interactions with blocked users

View release on GitHub

v4.3.21 Security relevant · 2mo

Security fixes

• GHSA-q4g8-82c5-9h33: Insufficient checks on quote authorizations
• GHSA-xqw8-4j56-5hj6: Open redirect in legacy path handler

Notable features

• Media description limit increased to 10000 characters for remote attachments
• Added search for already-known private GtS posts

View release on GitHub

v4.4.15 Security relevant · 2mo

Security fixes

• GHSA-q4g8-82c5-9h33: Fixed insufficient checks on quote authorizations
• GHSA-xqw8-4j56-5hj6: Fixed open redirect in legacy path handler

Notable features

• Media description limit increased to 10000 characters for remote attachments
• Added support for searching private GtS posts

View release on GitHub

v4.5.8 Security relevant · 2mo

Security fixes

• GHSA-q4g8-82c5-9h33 (quote authorization checks)
• GHSA-xqw8-4j56-5hj6 (open redirect in legacy path handler)

Notable features

• Search capability for private GtS posts
• Extended media description limit to 10,000 characters
• HTTP signature header improvements

View release on GitHub

v4.3.20 Bug fix · 3mo

Notable features

• Added --suspended-only option to emoji purge command

View release on GitHub

v4.4.14 Security relevant · 3mo

Security fixes

• GHSA-qgmm-vr4c-ggjg: Reject unconfirmed FASPs
• GHSA-46w6-g98f-wxqm: Re-use custom socket class for FASP requests

Notable features

• Added --suspended-only option to emoji purge command
• Fixed custom emoji purging on domain suspension

View release on GitHub

v4.5.7 Security relevant · 3mo

Security fixes

• GHSA-qgmm-vr4c-ggjg: Reject unconfirmed FASPs
• GHSA-46w6-g98f-wxqm: Re-use custom socket class for FASP requests

Notable features

• Added --suspended-only option to emoji purge command
• Fixed custom emoji purging on domain suspension

View release on GitHub

v4.3.19 Security relevant · 4mo

Security fixes

• GHSA-ccpr-m53r-mfwr - ActivityPub collection caching not checking blocked accounts

View release on GitHub

v4.4.13 Security relevant · 4mo

Security fixes

• GHSA-ccpr-m53r-mfwr (ActivityPub collection caching for blocked accounts)

View release on GitHub

v4.5.6 Security relevant · 4mo

Security fixes

• ActivityPub collection caching not checking blocked accounts (GHSA-ccpr-m53r-mfwr)

View release on GitHub

v4.3.18 Security relevant · 4mo

Security fixes

• GHSA-gg8q-rcg7-p79g - Missing limits on various federated properties
• GHSA-5h2f-wg8j-xqwp - Remote user suspension bypass
• GHSA-6x3w-9g92-gvf3 - Missing length limits on user-provided fields

View release on GitHub

v4.4.12 Security relevant · 4mo

Security fixes

• GHSA-gg8q-rcg7-p79g - Missing limits on various federated properties
• GHSA-5h2f-wg8j-xqwp - Remote user suspension bypass
• GHSA-6x3w-9g92-gvf3 - Missing length limits on user-provided fields

View release on GitHub

v4.5.5 Security relevant · 4mo

Security fixes

• GHSA-gg8q-rcg7-p79g - Missing limits on various federated properties
• GHSA-5h2f-wg8j-xqwp - Remote user suspension bypass
• GHSA-6x3w-9g92-gvf3 - Missing length limits on user-provided fields

View release on GitHub

v4.2.29 Security relevant · 4mo

Security fixes

• GHSA-xfrj-c749-jxxq - SSRF protection bypass

View release on GitHub

v4.3.17 Security relevant · 4mo

Security fixes

• SSRF protection bypass (GHSA-xfrj-c749-jxxq)
• Missing ownership check in severed relationships controller (GHSA-ww85-x9cp-5v24)

View release on GitHub

v4.4.11 Security relevant · 4mo

Security fixes

• SSRF protection bypass (GHSA-xfrj-c749-jxxq)
• Missing ownership check in severed relationships controller (GHSA-ww85-x9cp-5v24)

View release on GitHub

v4.5.4 Security relevant · 4mo

Security fixes

• SSRF protection bypass (GHSA-xfrj-c749-jxxq)
• Missing ownership check in severed relationships controller (GHSA-ww85-x9cp-5v24)

View release on GitHub