:warning: The 4.0.x branch will not receive any update—including security fixes—after this one.

:warning: This release is an important security release fixing a critical security issue (CVE-2024-23832).

Corresponding security releases are available for the 4.2.x branch, the 4.1.x branch and the 3.5.x branch.

If you are using nightly builds, do not use this release but update to nightly.2024-02-02-security or newer instead. If you are on the main branch, update to the latest commit.

End of life notice

The 4.0.x branch will not receive any further update after.

This means that no further security fix will be made available for this branch, and you will need to update to a more recent version (such as the 4.2.x branch) to receive security fixes.

Changelog

Security

• Fix insufficient origin validation (CVE-2024-23832, GHSA-3fjr-858r-92rw)

Upgrade notes

To get the code for v4.0.13, use git fetch && git checkout v4.0.13.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed compared to v4.0.9, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 2.7 to 3.0
• PostgreSQL: 9.5 or newer
• Elasticsearch (optional, for full-text search): 7.x
• Redis: 4 or newer
• Node: >= 14, < 18
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 4.0.12.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

1. Install dependencies: bundle install and yarn install --frozen-lockfile

Both Docker and non-Docker:

1. Restart all Mastodon processes

:warning: The 3.5.x branch will not receive any update—including security fixes—after this one.

:warning: This release is an important security release fixing a critical security issue (CVE-2024-23832).

Corresponding security releases are available for the 4.2.x branch, the 4.1.x branch and the 4.0.x branch.

If you are using nightly builds, do not use this release but update to nightly.2024-02-02-security or newer instead. If you are on the main branch, update to the latest commit.

End of life notice

The 3.5.x branch will not receive any further update after.

This means that no further security fix will be made available for this branch, and you will need to update to a more recent version (such as the 4.2.x branch) to receive security fixes.

Changelog

Security

• Fix insufficient origin validation (CVE-2024-23832, GHSA-3fjr-858r-92rw)

Upgrade notes

To get the code for v3.5.17, use git fetch && git checkout v3.5.17.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed compared to v3.5.16, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 2.7 to 3.0
• PostgreSQL: 9.5 or newer
• Elasticsearch (optional, for full-text search): 7.x
• Redis: 4 or newer
• Node: >= 12.22, < 18
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 3.5.16.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

1. Install dependencies: bundle install and yarn install --frozen-lockfile

Both Docker and non-Docker:

1. Restart all Mastodon processes

:warning: This release is an important security release fixing a critical security issue (CVE-2024-23832).

Corresponding security releases are available for the 4.2.x branch, the 4.0.x branch and the 3.5.x branch.

If you are using nightly builds, do not use this release but update to nightly.2024-02-02-security or newer instead. If you are on the main branch, update to the latest commit.

Changelog

Security

• Fix insufficient origin validation (CVE-2024-23832, GHSA-3fjr-858r-92rw)

Upgrade notes

To get the code for v4.1.13, use git fetch && git checkout v4.1.13.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed compared to v4.1.7, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 2.7 to 3.0
• PostgreSQL: 9.5 or newer
• Elasticsearch (optional, for full-text search): 7.x
• Redis: 4 or newer
• Node: >= 14, < 18
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 4.1.12.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

1. Install dependencies: bundle install and yarn install --frozen-lockfile

Both Docker and non-Docker:

1. Restart all Mastodon processes

:warning: This release is an important security release fixing a critical security issue (CVE-2024-23832).

Corresponding security releases are available for the 4.1.x branch, the 4.0.x branch and the 3.5.x branch.

If you are using nightly builds, do not use this release but update to nightly.2024-02-02-security or newer instead. If you are on the main branch, update to the latest commit.

Changelog

Security

• Fix insufficient origin validation (CVE-2024-23832, GHSA-3fjr-858r-92rw)

Upgrade notes

To get the code for v4.2.5, use git fetch && git checkout v4.2.5.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

With the exception of Ruby's recommended version, external dependencies have not changed since v4.2.0, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 3.0 to 3.2
• PostgreSQL: 10 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 4 or newer
• Node: 16 or newer
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 4.2.4.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

1. Install dependencies: bundle install and yarn install --frozen-lockfile
2. Restart all Mastodon processes

Using Docker:

1. Restart all Mastodon processes

This is a bugfix release for the 4.2.0 version, if you're installing from an earlier version, please check the 4.2.0 release notes as they contain important information on how to update.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ The recommended Ruby version has changed from 3.2.2 to 3.2.3

For more information, scroll down to the upgrade instructions section.

Changelog

Fixed

• Fix error when processing remote files with unusually long names (ClearlyClaire)
• Fix processing of compacted single-item JSON-LD collections (ClearlyClaire)
• Retry 401 errors on replies fetching (ShadowJonathan)
• Fix RecordNotUnique errors in LinkCrawlWorker (tribela)
• Fix Mastodon not correctly processing HTTP Signatures with query strings (ClearlyClaire, ClearlyClaire)
• Fix potential redirection loop of streaming endpoint (ClearlyClaire)
• Fix streaming API redirection ignoring the port of streaming_api_base_url (ClearlyClaire)
• Fix error when processing link preview with an array as inLanguage (ClearlyClaire)
• Fix unsupported time zone or locale preventing sign-up (Gargron)
• Fix "Hide these posts from home" list setting not refreshing when switching lists (brianholley)
• Fix missing background behind dismissable banner in web UI (Gargron)
• Fix line wrapping of language selection button with long locale codes (gunchleoc, ClearlyClaire)
• Fix Undo Announce activity not being sent to non-follower authors (MitarashiDango)
• Fix N+1s because of association preloaders not actually getting called (ClearlyClaire)
• Fix empty column explainer getting cropped under certain conditions (ClearlyClaire)
• Fix LinkCrawlWorker error when encountering empty OEmbed response (ClearlyClaire)
• Fix call to inefficient delete_matched cache method in domain blocks (ClearlyClaire)

Security

• Add rate-limit of TOTP authentication attempts at controller level (ClearlyClaire)

Upgrade notes

To get the code for v4.2.4, use git fetch && git checkout v4.2.4.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

With the exception of Ruby's recommended version, external dependencies have not changed since v4.2.0, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 3.0 to 3.2
• PostgreSQL: 10 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 4 or newer
• Node: 16 or newer
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 4.2.3.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

0. If you are using rbenv, update the list of available versions and install Ruby 3.2.3 by doing RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install in the Mastodon install directory (e.g. /home/mastodon/live)
1. Install dependencies: bundle install and yarn install --frozen-lockfile
2. Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
3. Restart all Mastodon processes

Using Docker:

1. Restart all Mastodon processes

This is a bugfix release for the 4.1.x branch. Please consider updating to the 4.2.x branch if you haven't done so yet.

Changelog

Fixed

• Fix error when processing remote files with unusually long names (ClearlyClaire)
• Fix processing of compacted single-item JSON-LD collections (ClearlyClaire)
• Retry 401 errors on replies fetching (ShadowJonathan)
• Fix RecordNotUnique errors in LinkCrawlWorker (tribela)
• Fix Mastodon not correctly processing HTTP Signatures with query strings (ClearlyClaire, ClearlyClaire)
• Fix potential redirection loop of streaming endpoint (ClearlyClaire)
• Fix streaming API redirection ignoring the port of streaming_api_base_url (ClearlyClaire)
• Fix Undo Announce activity not being sent to non-follower authors (MitarashiDango)
• Fix LinkCrawlWorker error when encountering empty OEmbed response (ClearlyClaire)

Security

• Add rate-limit of TOTP authentication attempts at controller level (ClearlyClaire)

Upgrade notes

To get the code for v4.1.12, use git fetch && git checkout v4.1.12.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed compared to v4.1.7, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 2.7 to 3.0
• PostgreSQL: 9.5 or newer
• Elasticsearch (optional, for full-text search): 7.x
• Redis: 4 or newer
• Node: >= 14, < 18
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 4.1.11.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

1. Install dependencies: bundle install and yarn install --frozen-lockfile

Both Docker and non-Docker:

1. Restart all Mastodon processes

This is a rerelease of the 4.2.2 bugfix release, as a dependency used by Mastodon 4.2.0 through 4.2.2 has been removed. If you are installing from a version earlier than 4.2.0, please check the 4.2.0 release notes as they contain important information on how to update.

Changelog (v4.2.3)

Fixed

• Fix dependency on json-canonicalization version that has been made unavailable since last release

Changelog (v4.2.2)

Changed

• Change dismissed banners to be stored server-side (ClearlyClaire)
• Change GIF max matrix size error to explicitly mention GIF files (ClearlyClaire)
• Change Follow activities delivery to bypass availability check (ShadowJonathan)
• Change single-column navigation notice to be displayed outside of the logo container (renchap, renchap)
• Change Content-Security-Policy to be tighter on media paths (ClearlyClaire)
• Change post language code to include country code when relevant (gunchleoc, ClearlyClaire)

Fixed

• Fix upper border radius of onboarding columns (ClearlyClaire)
• Fix incoming status creation date not being restricted to standard ISO8601 (ClearlyClaire, ClearlyClaire)
• Fix some posts from threads received out-of-order sometimes not being inserted into timelines (ClearlyClaire)
• Fix posts from force-sensitized accounts being able to trend (ClearlyClaire)
• Fix error when trying to delete already-deleted file with OpenStack Swift (ClearlyClaire)
• Fix batch attachment deletion when using OpenStack Swift (ClearlyClaire)
• Fix processing LDSigned activities from actors with unknown public keys (ClearlyClaire)
• Fix error and incorrect URLs in /api/v1/accounts/:id/featured_tags for remote accounts (ClearlyClaire)
• Fix report processing notice not mentioning the report number when performing a custom action (ClearlyClaire)
• Fix handling of inLanguage attribute in preview card processing (ClearlyClaire)
• Fix own posts being removed from home timeline when unfollowing a used hashtag (kmycode)
• Fix some link anchors being recognized as hashtags (ClearlyClaire, ClearlyClaire)
• Fix format-dependent redirects being cached regardless of requested format (ClearlyClaire)

Upgrade notes

To get the code for v4.2.3, use git fetch && git checkout v4.2.3.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.2.0, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 3.0 to 3.2
• PostgreSQL: 10 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 4 or newer
• Node: 16 or newer
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 4.2.1.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

1. Install dependencies: bundle install and yarn install --frozen-lockfile
2. Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
3. Restart all Mastodon processes

Using Docker:

1. Restart all Mastodon processes

This is a bugfix release for the 4.2.0 version, if you're installing from an earlier version, please check the 4.2.0 release notes as they contain important information on how to update.

Changelog

Changed

• Change dismissed banners to be stored server-side (ClearlyClaire)
• Change GIF max matrix size error to explicitly mention GIF files (ClearlyClaire)
• Change Follow activities delivery to bypass availability check (ShadowJonathan)
• Change single-column navigation notice to be displayed outside of the logo container (renchap, renchap)
• Change Content-Security-Policy to be tighter on media paths (ClearlyClaire)
• Change post language code to include country code when relevant (gunchleoc, ClearlyClaire)

Fixed

• Fix upper border radius of onboarding columns (ClearlyClaire)
• Fix incoming status creation date not being restricted to standard ISO8601 (ClearlyClaire, ClearlyClaire)
• Fix some posts from threads received out-of-order sometimes not being inserted into timelines (ClearlyClaire)
• Fix posts from force-sensitized accounts being able to trend (ClearlyClaire)
• Fix error when trying to delete already-deleted file with OpenStack Swift (ClearlyClaire)
• Fix batch attachment deletion when using OpenStack Swift (ClearlyClaire)
• Fix processing LDSigned activities from actors with unknown public keys (ClearlyClaire)
• Fix error and incorrect URLs in /api/v1/accounts/:id/featured_tags for remote accounts (ClearlyClaire)
• Fix report processing notice not mentioning the report number when performing a custom action (ClearlyClaire)
• Fix handling of inLanguage attribute in preview card processing (ClearlyClaire)
• Fix own posts being removed from home timeline when unfollowing a used hashtag (kmycode)
• Fix some link anchors being recognized as hashtags (ClearlyClaire, ClearlyClaire)
• Fix format-dependent redirects being cached regardless of requested format (ClearlyClaire)

Upgrade notes

To get the code for v4.2.2, use git fetch && git checkout v4.2.2.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.2.0, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 3.0 to 3.2
• PostgreSQL: 10 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 4 or newer
• Node: 16 or newer
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 4.2.1.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

1. Install dependencies: bundle install and yarn install --frozen-lockfile
2. Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
3. Restart all Mastodon processes

Using Docker:

1. Restart all Mastodon processes

This is a bugfix release for the 4.1.x branch. Please consider updating to the 4.2.x branch if you haven't done so yet.

Changelog

Changed

• Change GIF max matrix size error to explicitly mention GIF files (ClearlyClaire)
• Change Follow activities delivery to bypass availability check (ShadowJonathan)
• Change Content-Security-Policy to be tighter on media paths (ClearlyClaire)

Fixed

• Fix incoming status creation date not being restricted to standard ISO8601 (ClearlyClaire, ClearlyClaire)
• Fix posts from force-sensitized accounts being able to trend (ClearlyClaire)
• Fix processing LDSigned activities from actors with unknown public keys (ClearlyClaire)
• Fix error and incorrect URLs in /api/v1/accounts/:id/featured_tags for remote accounts (ClearlyClaire)
• Fix report processing notice not mentioning the report number when performing a custom action (ClearlyClaire)
• Fix some link anchors being recognized as hashtags (ClearlyClaire, ClearlyClaire)

Upgrade notes

To get the code for v4.1.11, use git fetch && git checkout v4.1.11.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed compared to v4.1.7, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 2.7 to 3.0
• PostgreSQL: 9.5 or newer
• Elasticsearch (optional, for full-text search): 7.x
• Redis: 4 or newer
• Node: >= 14, < 18
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 4.1.10.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

1. Install dependencies: bundle install and yarn install --frozen-lockfile

Both Docker and non-Docker:

1. Restart all Mastodon processes

:warning: The 3.5.x branch will not receive any update—including security fixes—after 2023-12-31.

This is a bugfix release for the 3.5.x branch. Please consider updating to the 4.2.x branch if you haven't done so yet.

End of life notice

The 3.5.x branch will not receive any update after 2023-12-31. This means that no security fix will be made available for this branch after this date, and you will need to update to a more recent version (such as the 4.2.x branch) to receive security fixes.

Changelog

Changed

• Change GIF max matrix size error to explicitly mention GIF files (ClearlyClaire)
• Change Follow activities delivery to bypass availability check (ShadowJonathan)
• Change Content-Security-Policy to be tighter on media paths (ClearlyClaire)

Fixed

• Fix incoming status creation date not being restricted to standard ISO8601 (ClearlyClaire, ClearlyClaire)
• Fix posts from force-sensitized accounts being able to trend (ClearlyClaire)
• Fix processing LDSigned activities from actors with unknown public keys (ClearlyClaire)

Upgrade notes

To get the code for v3.5.16, use git fetch && git checkout v3.5.16.

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed compared to v3.5.13, the compatible Ruby, PostgreSQL, Node, Elasticsearch and Redis versions are the same, that is:

• Ruby: 2.7 to 3.0
• PostgreSQL: 9.5 or newer
• Elasticsearch (optional, for full-text search): 7.x
• Redis: 4 or newer
• Node: >= 12.22, < 18
• ImageMagick: 6.9.7-7 or newer

If your uploaded images are broken after the upgrade, it means your installed ImageMagick version is older than the new minimum version (6.9.7-7), for example if you are running Ubuntu 18.04. If this happens, you can find more information and ways to fix it on this page.

Update steps

The following instructions are for updating from 3.5.15.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations.

Non-Docker only:

1. Install dependencies: bundle install and yarn install --frozen-lockfile

Both Docker and non-Docker:

1. Restart all Mastodon processes