Changelog: https://github.com/element-hq/synapse/blob/release-v1.164/…

Highlights

• feat(wordlist): Added Claude files to quickhits.txt (PR #1338)
• feat(wordlist): Added LureScope observed SSH credentials (PR #1342)
• feat(wordlist): Added risk-classified list of SQLi payloads
• feat(wordlist): Added template engine fuzzing wordlist (PR #1340)
• Various automatic wordlist updates, documentation improvements, and a few new payloads.

New Contributors

• @dineshg0pal made their first contribution in #1302
• @dagecko made their first contribution in #1297
• @ferranverdes made their first contribution in #1316
• @binary1985 made their first contribution in #1317
• @NoPurposeInLife made their first contribution in #1321
• @Xib3rR4dAr made their first contribution in #1339
• @praneeth132006 made their first contribution in #1344
• @lurescope made their first contribution in #1342
• @XSS3cut10n3r made their first contribution in #1348

Full Changelog: 2026.1...2026.2

June 5, 2026

New Features & Enhancements

• A new federation data-fetching service improves reliability in rooms whose history is spread across many servers by locating missing events through concurrent queries. It ranks candidate servers by room-membership popularity and recent reachability, and reuses requests already in flight instead of issuing duplicates. Resolved state for outlier events, fetch and backoff decisions, and per-server reachability ("Peer Status") are now cached persistently, and auth-chain, state, prev-event, and backfill fetches all run through it. Servers that used to re-request the same uncacheable lookups should see far less repeated federation traffic.

• OIDC device authorization grant (RFC 8628) lets users sign in on input-constrained devices. The MSC4191 account-management action set is now complete with a deep-linked cross-signing reset, and MSC3861 OAuth 2.0/OIDC is advertised on /versions. The token endpoints and refresh-token lifecycle were reworked, dynamic client registration is opt-in and validates submitted client metadata, and device-scope binding requires PKCE. The OIDC authorization-server chapter of the documentation was expanded to match.

• Several additional MSCs land this cycle: MSC3980 (event_fields trimming on /sync), MSC3860 (media download redirects), MSC4311 (origin_server_ts on the stripped create event), MSC1219 (key backup storage conformance), MSC2659 (appservice ping error codes), MSC3550 (403 M_FORBIDDEN allowed on profile lookup), and a stable m.forget_forced_upon_leave capability (MSC4267). MSC4380 invite blocking now also covers invites delivered through /sync and createRoom.

• Support-contact discovery gains a PGP field and policy links (MSC4439, MSC4266), graciously contributed by @x86pup. The /.well-known/matrix/support endpoint can now advertise a pgp_key per contact (with raw key material rejected) and link support policies, and multiple support contacts can be configured with validation.

• @dasha-uwu added an admin media preview command for debugging URL previews, retired blurhashing, dropped the legacy media-preview redirect, and removed the deprecated server-keys endpoint.

• Sliding sync (v5) now retracts departed and left rooms from the list and adds re-invited rooms back, so clients track membership churn without a full resync.

• A device may now hold multiple access tokens, for easier rotation and concurrent sessions.

• /context can optionally resolve events it has not yet received over federation, and outbound HTTP compression gained per-direction opt-out switches.

• An admin command to purge every room containing a given user was added, raised by @winyadepla in (#472).

• Documentation for ip_source_trusted_subnets now warns about accidentally including a proxy in the trusted set, courtesy of @BVollmerhaus in (#468).

• Diagnostic admin command suites were added for the federation fetcher and Peer Status, and the runtime can dump tokio and getrusage metrics to JSON at exit.

Bug Fixes

• A regression introduced with ip_source in 1.6.1 blocked locally-connected appservices and other loopback clients (#465). Loopback peers and trusted-peer subnets now bypass the configured ip_source, including over the Unix-socket listener, and the axum-client-ip dependency was replaced with inlined helpers. Sincere apologies to everyone whose bridges went quiet.

• Remote room directory and summary lookups are more resilient over federation: the room-summary fallback now tries every via server (5c99983), and a failed remote publicRooms request now returns a 502 (9a87977).

• Thank you @x86pup for reporting in (#466) that a bad unix_socket_path produced an opaque startup failure; listener initialization errors now name the offending path.

• !admin query oauth associate replied with an empty message and did nothing, reported by @Vazgen005 in (#467). It now emits a confirmation and accepts a force flag.

• @dasha-uwu fixed a compression configuration option that could accidentally disable client-side decompression.

• Several federation correctness fixes: the federation lock is now held across the invite residency check to close a join/unban race (add512b); a send_join response that omits state fails over to other servers (9c158d3); each transaction's PDUs are sorted topologically before handling (91218e1); and references outside the auth graph are treated as non-edges during resolution (6643919).

• Knock membership is now persisted and a remote re-knock re-drives to reconcile state; per-PDU backfill errors are isolated so one bad event no longer aborts the batch; and thread redaction walks through the redacted target.

• Media fetches and URL previews now honor CIDR denylists for the addresses they resolve to (af1266a, 554557c). Buffered outbound responses are size-bounded, and federation key lookups are bounded and backed off.

• Configuration handling improved: an unreadable client_secret_file now reports the path and IO error (844f123), matched keys can be excluded from the "unknown to tuwunel" warning (6bbfd0a), and packaged builds no longer drop their malloc_conf tuning (de0eb1d).

June 27, 2026

New Features & Enhancements

• Conduit database migration available again courtesy of @x86pup. Open Tuwunel with an existing Conduit (or foreign-lineage) database directory and it migrates in-place: rooms, original media including S3-backed objects, pending knocks, and suspended or locked users all carry over, media is attributed to its local owners, and conduit-migrated rooms become usable. Raised by @Korvox in (#41).

• Third-party-identifier (3pid) email support (MSC2290) arrives with outbound email, 3pid storage, the email-3pid request and management endpoints, and admin commands to manage and query email 3pids.

• Matrix Authentication Service (MAS) support is implemented: the provisioning API endpoints, synced provisioned email bindings, and SSO redirect-action forwarding (MSC3824, so a register action becomes prompt=create on the upstream OIDC request). Opened by @CEbbinghaus in (#266).

• A remote-server version API, a new client endpoint exposing the versions reported by remote servers, shipped by @dasha-uwu (d038c5b).

• SSLKEYLOGFILE support for the outbound client, for debugging federation TLS, also from @dasha-uwu (5f00e39).

• User reports can post to a configurable room instead of the admin room, so operators can moderate without holding server-admin, graciously contributed by @x86pup. Opened by @iwalkalone69 in (#180).

• The nginx reverse-proxy example collapses its duplicate 443 and 8448 server blocks into one, tip of the hat to @Daniel15 in (#487).

• Push gateway resolution now runs through the validating resolver, so the private-IP CIDR denylist (ip_range_denylist) applies to pusher delivery, including redirect hops (28e08c2). Operator note: this silently stops delivery to any push gateway on a private or loopback address (a localhost Sygnal, a LAN ntfy or UnifiedPush) until ip_range_denylist is adjusted to permit it.

• Spec compliance advanced across many endpoints: stable /v1/mutual_rooms with count and paging (MSC2666, cd5004e); rich-text room topics preferring the m.topic block with legacy fallback and indexed for search (MSC3765, fc29fe4); extended profile fields with enforced size and grammar limits (MSC4133, 03b9909); invite and knock stripped state carried as full federation PDUs so a receiver can bind the create event (MSC4311, d2c473f); a registration terms stage (MSC1692, opened by @erebion in #289); appservice device management (MSC4190, opened by @ngophuocloi-miracle-aavn in #488); the user-report endpoint returning 200 for unknown users to deter enumeration (MSC4277, 6ddd590); per-requester thread bundles with current_user_participated and the full latest_event (MSC3816, 3c3e65a); search results populating surrounding event context and pagination tokens (945e79c); device-list updates flushed to federation on key change (eff8e52); and federation get_missing_events serving stored canonical JSON so unmodeled fields survive (e2eca44).

Bug Fixes

• The local server is now always exempt from allowed_remote_server_names and forbidden_remote_server_names. A 1.7.x allow-list that omitted the local name classified a local user's own events as coming from a forbidden remote and dropped them (fixes #489). Reported by @BurningEnlightenment. Sincere apologies to anyone whose own users went quiet.

• /timestamp_to_event (MSC3030) returned M_NOT_FOUND for valid searches because the room-scoped scan stopped on the first foreign-room key; fixed by @lingbohome in (#477).

• make-user-admin now grants the correct power level when the target is already in the admin room, with appreciation to @x86pup. Reported by @mio-19 in (#84).

• LDAP is skipped during UIA reauth for non-LDAP accounts, so resetting device keys on a non-LDAP account no longer triggers a filterless LDAP search, credit to @x86pup. Reported by @kuhnchris in (#255).

• A lost-wakeup in until_shutdown that could stall a service worker is fixed (22676a3).

• /timestamp_to_event falls back to federation for local misses and forward start-edge queries (MSC3030, 914b16c).

• Several federation membership fixes: a re-invite over a stale local ban is honored, an out-of-band invite rescission is applied, join_authorised_via_users_server is ignored for an existing member, custom /join body keys are merged into the member event, and kicking a non-member returns 403 (a37bd24, b5101ac, 836831c, 8e135be, fae1595).

• Lazy-loaded incremental sync no longer drops changed members other than the syncing user (MSC4222, 0e5800c).

• State resolution for pre-v12 rooms now begins iterative auth checks from an empty initial state, matching the handling used for version 12 rooms (954b0c3).

• Per-room push rules now carry across a room upgrade (c852ae2).

• A device's local notification settings are removed on every device-deletion path (MSC3890, e0283e0).

• The single-event endpoint returns 404 rather than 403 for an event hidden from the requester (404b516).

• A client invite to a server lacking the room version returns M_UNSUPPORTED_ROOM_VERSION (MSC1866, 5869123).

• Version 12 room upgrades omit the deprecated predecessor.event_id (MSC4291, 6625065).

• The /context end token is positioned so a backward page still includes the base event (f3fe502).

• The [global.smtp] config section is fixed (6061c5c).

• Notable for operators: the RocksDB storage engine is bumped to 11.1.1 (ab32765), and the first 1.8.0 boot on an existing database performs a one-time timestamp-index rebuild from pduid_pdu, which lengthens first startup on large instances (41f0de0, 873f670).

July 9, 2026

New Features & Enhancements

• Synapse-compatible admin API. The Synapse admin surface is served: user, room, media, device and access-token endpoints, the version and event-fetch endpoints, and room deletion, purge, and background-task tracking, backed by an in-memory task tracker and documented on a coverage status page. Opened by @iwalkalone69 in (#38). The user endpoints include listing a user's joined rooms, opened by @ngophuocloi-miracle-aavn in (#494).

• Threads list (MSC3856). The /threads endpoint now orders threads by latest activity, honors an include=participated filter, serves per-requester views that respect ignored users, guards its inputs upfront, and carries the newest edit on each thread's latest_event.

• Stable threading (MSC3440). Threading is advertised in /versions, the related_by_senders and related_by_rel_types event filters are implemented, and nested thread relations are rejected at the send endpoint.

• Sender erasure (MSC4025). An erasure marker lands with admin surfacing, erased senders' events are served as pruned copies, and federation serving of those events is gated accordingly.

• Native OIDC account registration and login, so Tuwunel can act as its own identity provider. Requested by @temp1403-oss (#479).

• Configurable default power-level override for newly created rooms, courtesy of @basnijholt in (#496).

• User suspension is now enforced at the API boundary, contributed by @dasha-uwu.

• OAuth falls back to Apple id_token claims when the userinfo endpoint fails, shipped by @basnijholt in (#495).

• The admin query raw commands gain a put command and hex key decoding, from @dasha-uwu.

• A SECURITY.md with a detached PGP signature, along with issue and pull-request templates and contact links, graciously added by @x86pup.

• Event bundling advances across three proposals: aggregations bundled on search context events (MSC3666), m.reference children bundled as an event-id chunk (MSC3267), and the latest m.replace edit bundled as a full event (MSC3925).

• Private read receipts now carry a timestamp.

• Rust is bumped to 1.95.0.

Bug Fixes

• Sliding sync silently dropped m.space rooms, so spaces were absent from the room list where Synapse showed them; the list filters a client omits are now cleared before applying (MSC4186, fixes #503). Reported by @sdenike.

• Rooms made space-visible did not appear in the space overview for new users. The room hierarchy cache is now evicted on any state change (fixes #498). Reported by @Lazalatin.

• Registration with OIDC and LDAP configured together was broken: LDAP users are now provisioned even when provider registration is disabled (fixes #499). Reported by @balintbarna.

• Tuwunel builds on FreeBSD again, with rust-rocksdb vendoring RocksDB there (fixes #492). Reported by @syobocat.

• The MatrixRTC/Livekit setup docs were missing the Docker address-advertisement configuration, now explained (fixes #493). Reported by @Wanja-L.

• Conduit database import gains several repairs: the roomuserid_joined repair runs in a single pass, the conduwuit-era membership repairs are skipped for Conduit imports, and systemd's start timeout is extended so long startup migrations are not killed (#41). Thanks to @x86pup.

• The remote-server version endpoint returns our own version for a self-query instead of failing, with appreciation to @x86pup.

• Unauthenticated TURN access was possible with turn_allow_guests enabled; guest access is now gated and appservice users are excluded from the guest TURN credentials check, credit to @dasha-uwu.

• Federation delivery is steadier: a stale resolver route is evicted on a non-JSON response (9bac544), the sender flushes when an unhealthy peer shows inbound activity (2d9c684), a first-failure retry grace precedes the backoff curve (e7f5769), and the sender wakes to retry a failed destination (93a772e).

• EDU delivery is more reliable: selected device-list and receipt EDUs persist until acknowledged (ffdfc1b), EDU selections queue past the transaction budget (7091f84), and fresh EDUs are selected on the post-response path (3569317).

• /messages is forbidden on a room the requester cannot see (a791d7e).

• An unsupported method on a known path returns 405 instead of 404 (cd0513a).

• The request extractor separates an empty body from a malformed one (80727f8).

• is_direct is omitted from member events unless it is true (adb78b9).

• The registration email binds regardless of UIA stage order (9b58cae).

• The error log on undecodable presence data is restored (d81f340).

• FIFO cache column TTLs are bounded to each column's validity window, with intra-L0 compaction enabled for those columns (9b3011a, e9004c9).

• Release builds could fail to compile the room-summary layout after a 1.8.0 change; boxing the membership format at the invite edge cuts the recursion (regression d2c473f).

September 12, 2026

Important

Upgrading from 1.8.3 or earlier? The first boot runs a one-time database migration before the listener opens, so back up first (docs/backups.md). It can take a while on a large database, but progress now appears in the log and in systemctl status every fifteen seconds, and a normal stop is honored at the next safe point and resumes on restart; only a forced kill is unsafe, and the recovery is your backup. A standalone binary in a chroot, distroless, or FROM scratch image also needs a CA bundle or SSL_CERT_FILE since 1.9.0; the container image and both packages include one.

New Features & Enhancements

• Animated thumbnails are generated on demand (MSC2705), shipped by @x86pup. An explicit animated=true request can produce a bounded, cached GIF from animated GIF, WebP, or APNG media, while absent or false requests remain still. Current shipping clients omit the parameter, so the server capability arrives ahead of client adoption. Normal builds include it and media_thumbnail_animated defaults to true; frame, pixel, and concurrency limits bound its resource use.

• Prebuilt Nix store paths are available from project caches, courtesy of @x86pup. The flake covers packages and development shells, although unattended Nix installations must trust the substituters and public keys explicitly. Cache upload is non-fatal, so an individual release may still have incomplete coverage.

• Debian and RPM packages can adopt an existing Conduwuit or Conduit database, with appreciation to @x86pup. Adoption uses a same-filesystem rename into /var/lib/tuwunel, refuses a nonempty destination, and waits for the old service to stop. This relocates the database; normal startup migrations still perform any format conversion.

• Users can control invitations by sender (MSC4155) through stable and unstable invite-permission account data. Blocked invitations are refused, while ignored invitations stay out of sync, push, and automatic acceptance until policy changes. Graciously added by @x86pup.

• Operators can enable automatic invite acceptance for local users with the reloadable auto_accept_invites option, which defaults to false. Direct-only and local-sender-only filters are available, and accepted direct chats are recorded in m.direct. Opened by @sanyamseac in (#513) and implemented by @x86pup.

• Tuwunel now validates custom status, call, and timezone profile fields and serves changed values through the client-enabled Sliding Sync profiles extension (MSC4262 and MSC4426). This is the server foundation used by clients such as Element X, but does not add the separate legacy /sync delivery path. Credit to @x86pup.

• Federated events can build state from complete local history, reducing dependence on an origin server's /state_ids response. resolve_state_locally is reloadable and defaults to true; incomplete or unsafe local results retain the existing federation fallback.

• New admin commands provide diagnostics through parallel federation requests: query feds version, event, state, and head. Surveys report per-peer outcomes and require explicit confirmation above 2,048 destinations; the head query can cause a remote server to persist an otherwise unused short event identifier (e2c74fd, 23789f4, 9acf26f, 6bfb797, 85db28f, e77de56, 3e9db3f, 84e8395, 5a2b4d2).

• URL preview cache lifetime is configurable with reloadable url_preview_cache_ttl, courtesy of @x86pup and inspired by @alemidev in (#558). The 24-hour default is unchanged; values above seven days require a restart for the RocksDB retention floor, and size limits can still evict entries earlier.

• URL preview requests can carry an operator-selected Accept-Language header for pages, media, and oEmbed. The reloadable url_preview_accept_language option defaults to unset, and cached previews keep their prior language until expiry. Implemented by @tototomate123 in (#580), after @dlrudie opened (#575).

• A new admin command creates a complete RocksDB checkpoint or exports one named column family. A single-column export is not a restorable server backup, and the default destination shares the live database filesystem (b11b5e1).

• Argon2id memory, time, and parallelism costs are configurable for newly written password hashes. Existing hashes retain their stored parameters, and the production defaults remain 19,456 KiB, two iterations, and one lane (0635833, 3d8267c).

• Alpine source builds have a recipe tested on x86_64 and aarch64, and musl builds now route Tuwunel and RocksDB allocations through the pinned jemalloc. No Alpine artifact or support commitment is added; -C target-feature=-crt-static is required, and host-specific target-cpu=native output may not run on older CPUs. Thanks to @x86pup.

• Long startup migrations now report their phase, elapsed time, and position every fifteen seconds in logs and systemd status. Graceful stops are honored at step boundaries and resume unfinished work on restart; forced kills remain unsafe. The shipped Podman unit gains migration-aware health and stop timing. Credit to @x86pup.

Bug Fixes

• Sliding Sync now delivers subscribed-room required state and changed room configuration without waiting for timeline events or a client reload. The first collection after upgrading may resend the configured timeline window because older connection records lack its configuration hash. Reported by @AngelBePro in (#560) and fixed in (#561).

• Legacy full-state sync includes quiet joined rooms and their latest state, even with an empty timeline or timeline.limit: 0. Graciously contributed by @basnijholt in (#583).

• Element X for iOS location markers move as room state changes arrive. Incremental Sliding Sync now compares selected state at the delivered cursor with current resolved state, including across federation forks. Thank you @utop-top for reporting (#569).

• FluffyChat can clear stale unread markers after a receipt advances because legacy sync now emits an explicit zero when the room or thread read cursor proves a reset, including on initial sync. Credit to @ruka-hamanasu for (#564).

• Private read markers targeting backfilled events become a safe no-op instead of failing the entire read-marker request, so public receipts and unread resets can still complete. Shipped by @ruka-hamanasu in (#566).

• Directional /messages bounds now honor valid global sync tokens even when the room has no event at that exact position, while malformed tokens return M_INVALID_PARAM. With appreciation to @basnijholt for (#574).

• Device-key uploads fail safely when an existing row cannot be read or decoded instead of overwriting identity material. Courtesy of @basnijholt in (#577).

• Large query storage sync operations now report a single copy summary rather than overflowing the admin response with one line per object. Thanks to @tototomate123 for (#579) and @justinbrick for reporting (#571).

• Both Synapse-compatible account-deactivation routes now make the local user leave their rooms. Reactivation does not restore prior memberships. Graciously contributed by @obodnikov in (#584) and (#585).

• Native OIDC browser callbacks now complete in Chrome when the client and homeserver use different origins. This built-in authentication path remains gated by oidc_native_auth, which defaults to false. Reported by @asmj1108 in (#573).

• Room enable and unban commands now explain when an immutable m.federate: false creation setting prevents remote joins or invites, with remote-target invite coverage for MSC4361. Thank you @tcyrus for reporting (#568).

• Sliding Sync direct-message and room-tag filters now use stored m.direct and tag account data, including account-data changes during a long poll. Shipped by @x86pup.

• Deleting a local room alias removes only that alias from the reverse index and updates canonical-alias state when the sender has permission, courtesy of @x86pup (9221685, aa9bf1b, 3f44bda, 295c037).

• Invitation state handling now preserves authoritative and stripped state, including senderless stored invites, with appreciation to @x86pup (31c547f, a107046, 49f9d0e, 36a73db).

• Backup restore is now an explicit one-process action through the restore-backup command-line option. Tuwunel refuses database_restore_backup in TOML, environment configuration, and generic option overrides, and regeneration omits it, preventing a destructive restore request from persisting or repeating (7a0cdb6, 956d6c0).

• OIDC authorization now requires explicit user approval before releasing a code to a dynamically registered client whose redirect target the operator has not vetted. oidc_require_client_approval defaults to true; the prompt informs but does not authenticate the client (143562b).

• Server notices now create and reuse private notice rooms, deduplicate transactional retries, and prevent invite rejection while still allowing joined users to leave (868b846).

• Federation history and fetch recovery are more reliable: empty or duplicate-only backfill responses no longer count as progress, timestamp answers are validated against the room and requested time after ingestion, incompatible single-flight requests no longer share results, and previous-event recovery width is reloadable (65eb68d, e3a5dd1, b138959, 35fc5c1, 14bf02d).

• Declined short-ID migrations now finalize safely, forbidden-name scans stop promptly when shutdown is requested, and injectivity patch additions cannot collide with removals (8f0035e, 032248e, bfe4a27, 67fb14d).

• Key-backup versions and etags are validated while mutations are serialized (1dd1b12, 4106440). Account erasure closes login and thread leaks and removes contact bindings (942bf2a, 090e420).

• Cross-signing uploads now validate ownership, role usage, key shape, and signature relationships while keeping foreign signatures private (e87a9aa, 1cd92aa). To-device events addressed to the server user are delivered (ad1ed82).

• Room-send transaction identifiers are scoped by room and event type, with checked compatibility for legacy rows (99908c1). Redactions and private receipts reject cross-room event targets (6c02023, 323e1ba).

• Thread updates are room-bound and transactional, and a receipt on the root no longer clears unread replies (5d4db96, bffd8e6). Retained events and expiry indexes are stored atomically and replay in order (65d2483, 3a8d1c4).

• Passwordless user creation writes its origin and disabled-password marker atomically (3a835c8). Presence queries return a default status when no row exists (3f7869b).

• Sync and timeline edge cases are corrected: left-room state uses the correct incremental anchor, ignored replies no longer remove the thread root, and exhausted filtered backward pages advance their cursor (83b6253, 0ea5de0, 609c511).

September 25, 2026

New Features & Enhancements

• Remote profiles can be refreshed on demand, graciously contributed by @x86pup (64e1226, b1157d8). !admin users refresh-profile <user> fetches a remote user's profile from their own server and drops every cached field that server no longer serves, such as a status the user has since cleared; local clients see the removal on their next sync. !admin users set-profile-key can now also clear one cached field of a remote user, and the value returns on the next ordinary lookup if their server still serves it. Neither command runs automatically, and both accept only remote users this server already knows. See docs/moderation.md.

Bug Fixes

• Sliding Sync works again for users with old-format join records. In 1.9.2, a user holding a join record written by Conduit, conduwuit, another Conduit-lineage fork, or Tuwunel before 1.4.3.1, and not rewritten since, got a 500 on every Sliding Sync request, logged as u64 buffer underflow, and Element X sat in a restart loop. Legacy /sync failed the same way for clients that request profile_fields in their filter. Such a record now reads as the earliest join position. The condition is per record, not per database: a join event processed by Tuwunel 1.4.3.1 or later rewrites the record, and a display name or avatar change sends one into every joined room, so a user who had changed their profile on such a release was spared while a neighbor with a stable profile on the same database was not. Upgrading is the whole fix; nothing migrates and nobody needs to rejoin. @drrossum reported the restart loop in (#598), @Reaster0 confirmed it on a database migrated from a Conduit-lineage fork, and @scvalex hit it while testing the nixpkgs backport of 1.9.2; the fix is courtesy of @x86pup. Sincere apologies to everyone whose Element X could not get past a sync.

• OIDC sessions carried over from a Conduit-lineage fork survive the upgrade again. The 1.9.2 migration that preserved imported token expiries stamped each such session with its long-past origin expiry, so its first request drew a soft logout (M_UNKNOWN_TOKEN) and deleted its token. With no OIDC provider here, the default, the client could neither refresh nor sign out cleanly; the reporter's Element X sat in a 401 loop for forty minutes before a password sign-in. Adoption now waits until this server runs its own OIDC provider (well_known.client plus an identity_provider or oidc_native_auth); until then those sessions keep their origin lifetime, and enabling a provider signs them out once, cleanly. On a server without a provider, a database that already ran 1.9.2 is repaired on its first 1.9.3 start for every migrated session not used since, and each restored device is logged. A session used under 1.9.2 was deleted at that request; neither this release nor a rollback to 1.9.1 brings it back. Do not roll back to 1.9.2 after that first 1.9.3 start: 1.9.2 would stamp the restored sessions again and delete each at its next request, and the repair does not run a second time, so those sessions are lost. 1.9.1 and earlier are safe to return to. Thanks to @Reaster0, who reported (#602) with a proxy-log timeline and a code-level diagnosis and proposed the repair for databases 1.9.2 had already stamped; shipped by @x86pup. Sincere apologies to everyone 1.9.2 signed out.

• The Synapse-compatible admin join, POST /_synapse/admin/v1/join/{room_id_or_alias}, no longer answers 403 "cannot join a room that is not public" for a private room. When this server is in the room and its join rule would refuse the user uninvited, the requesting admin now invites them first, matching Synapse; a restricted room gets the invite only when the user is outside its allowed rooms. The admin must be joined there with power to invite, and the !admin users force-join console commands are unchanged. Thank you @arnolicious for reporting (#603); credit to @x86pup for the fix.

• Debian and RPM upgrades skip the recursive ownership walk over a database directory already owned by tuwunel:tuwunel, unless a legacy database was just adopted. The server keeps running until the package restarts it, so a file RocksDB removed mid-walk could fail the chown; on Debian that aborted package configuration, while the RPM script ignored the failure. Tip of the hat to @x86pup (afc1116).

October 10, 2026

New Features & Enhancements

• Google Cloud Storage is now a supported media provider, graciously contributed by @asafarian in (#644). On GCE or GKE, metadata-server credentials replace the exported key the S3 interoperability route needed. Set bucket (prefix in base_path, not a gs:// URL) under [global.storage_provider.<ID>.gcs] and list that ID in media_storage_providers unless it is media. The startup check needs storage.objects.list, aborts startup on failure and proves no write or delete rights; signing without a private key also needs the IAM API and iam.serviceAccounts.signBlob.

• Native OIDC adds provider choice, thanks to @tototomate123 (#615) and @utop-top's request (#570). Authorization, account and device-login pages offer local passwords or configured SSO with responsive, light/dark cards; @utop-top reported in (#639) that Element X's Manage Account skipped straight to SSO. Device approval stays bound to the signing-in provider. Requires oidc_native_auth = true (default false) and well_known.client. Account management excludes registration; registration policy still applies (da50af4, 2607b7c).

• Servers gain profile-read, display-name and room-alias controls courtesy of @arnolicious (#608), (#609), (#610). Reloadable limit_profile_requests_to_users_who_share_rooms (default false) requires require_auth_for_profile_requests = true; unrelated users get 403. Reloadable enable_set_displayname and allow_room_alias_creation default true; documented admin/appservice exemptions remain. @arnolicious's (#607) is partial: avatar controls and federation profile reads remain unchanged.

• Password limits arrive thanks to @obodnikov (#597). Reloadable global.rate_limiting.login.account counts verified sign-ins (default burst five, refill 0.003 tokens per second); global.rate_limiting.login.failed counts wrong passwords (default burst three, refill 0.17 tokens per second). Zero rate/burst disables each. Password login and native sign-in share both; UIAA uses the failed-password limit only. Exhaustion returns 429 M_LIMIT_EXCEEDED. LDAP/SSO/JWT/token login remain excluded.

• Thanks to @x86pup for refreshing dependencies and advancing OpenTelemetry to 0.33 and tracing-opentelemetry to 0.34 (e9eca62, 659bf3e); yoke-derive also advances to 0.8.4 (bdcba0b).

• !admin users redact-recent <user> <room> <count> redacts a local user's newest messages in a room as that user; the count covers unredacted plaintext and encrypted messages, not rows scanned. Partial failure reports progress without rollback (653ac3e).

• Inspect predecessor fetching with !admin debug prev-walk-metrics, backoff-metrics, prev-walk-rooms and !admin federation incoming-federation: fetch/upgrade timing, in-flight work, room history and locked rooms without walks. Stock builds warn on capped, failed or cancelled endings; admin diagnostics retain successful walks (f64de3d, 82aa52a, 91358e2).

• Presence scans seek the requested counter window instead of the entire column. Federation encoding skips avatar/display-name loading; presence payloads gain a dedicated cache (a196906, 07761c5).

• Database helpers gain indexed column handles and four-byte integer decoding. RocksDB column options follow table-factory installation; capacity-derived caches round up to MiB. Identical state hashes skip snapshot loading (6ed002c, d81fe55, 54fccbb, 8f12fad, bdbb049).

• Unset servername_status_cache_capacity now defaults to 200,000 plus 15,000 per available CPU (was 100,000 plus 10,000), counting entries, not bytes; no memory or speed effect is measured (a1e5cd2).

Bug Fixes

• Thread redactions update counts and latest replies, thanks to @basnijholt (#617), (#618), (#619). MindRoom Chat repeatedly fetched 13 pages for roughly 1,000 events. Root redactions preserve bundles; root receipts leave replies unread. One-time startup reconciliation has unknown duration, depending on stored roots/relations. Backfilled counts remain where replies are absent. Failed roots log errors yet completion is recorded. Latest-reply replacement scans at most thread_latest_reply_search_limit relations (default 1024, reloadable); a miss or failed read drops the stale preview and omits that summary from served bundles. The startup pass ignores the limit (20feec8, 281becc).

• Startup repairs short-id residue behind (#586)'s refusal. Thank you @dogarrowtype and @mav96 for the refusal reports. Repair reconciles identities, reconstructs orphan states, cleans proven purge residue, preserves uncertain data and verifies more. Fresh databases skip scans; settled ones check identities once. Attempts lacking recognized durable outcomes can retry (0341e0f, a47f170, 3d2abb9).

• Federated key queries and claims keep only the answering server's users, shipped by @basnijholt in (#624); another server can no longer overwrite device, cross-signing or one-time keys of local or third-server users. Stored keys are not revisited (113a83d).

• Thanks to @basnijholt, knocking stops opening rooms early: Sliding Sync withholds invited and knocked rooms' timelines (#625), knock-response member events stay out of room state (#632), and a pending knock no longer grants federation read access (#634). Knock bump stamps come from the membership event (607b104).

• Deactivating the last active local admin refuses before removing devices or clearing the password, courtesy of @obodnikov in (#604). Users must appoint another admin; passwordless or deactivated admin-room members cannot qualify.

• JWT login and interactive authentication reject deactivated accounts, thanks to @obodnikov for (#611). Locked-account refusals cover refresh and affected OIDC sign-in/approval/token paths. Deactivation returns 403 M_USER_DEACTIVATED; locks return 401 M_USER_LOCKED with soft logout. Appservice passwordless-puppet exceptions remain (eb655bc, e85f4dc, 45800bd).

• @basnijholt made email password resets refuse deactivated accounts at the final step in (#628), rather than setting a fresh password. Password writes, creation and deactivation share a per-user lock (7f8b85e).

• Removing/emptying emergency_password clears server-user sessions and password next startup, as documented. Credit to @obodnikov for (#612). Cleanup includes LDAP, clearing the password last for interruption recovery. Admin user APIs refuse server-user access changes but allow profile edits (fa3eefe).

• JWT B64HMAC works, graciously fixed by @obodnikov in (#613); legacy HMACB64 remains accepted case-insensitively. Enabled configurations reject unknown formats at startup/reload, before login. Accepted: HMAC, B64HMAC, HMACB64, ECDSA, EDDSA. Validation checks format names, not keys (95f9733).

• Admin-banned rooms refuse non-admin member-state joins, knocks and invites, contributed by @basnijholt in (#627). Joins recheck the ban under the join locks, and leaving a banned local room appends a real leave event (f40de15).

• Tip of the hat to @basnijholt for (#636): ip_range_denylist now matches IPv4-mapped IPv6, so [::ffff:10.1.2.3] fails 10.0.0.0/8, and the default adds 0.0.0.0/8 and ::/128; explicit lists are not augmented. Literal federation destinations get the same check (b8234c9).

• With thanks to @basnijholt, federation rejects create events contradicting their room, including room version 12's derived ID (73e24ae), and stored predecessor events from another room, walking predecessors at the room's first timestamp too (3245200, fd13f97). Loaded predecessor state must match the incoming room, and send_join auth-chain events pass the same room check before storage, skipping invalid ones (94198c3, d3db90b).

• @az4521 taught URL previews to fetch media from the page's final redirected URL, rechecked against host policy, in (#623), fixing kkinstagram.com and kkclip.com embeds whose crawler redirect reaches an Instagram CDN .mp4 while other agents get a landing page.

• Thank you @az4521 for reporting missing-room_id in (#616). Admin force-set-room-state-from-server handles room-version-12 create events omitting it; state, auth-chain and incoming knocks normalize before storage (0428ba7, 0a707a3, 1c6dd68).

• Mistyped !admin users reset-password reports absent local accounts instead of creating state. Thanks to @morteng for (#599). Other user-writing commands/admin grants reject absent accounts. !admin users revoke-admin clears accountless staged grants but refuses room-command self-revocation and server-user revocation (10fc18f, 0a6eef5, 3492880).

• Credit to @basnijholt for (#635): failed appservice requests no longer log the request URL carrying the hs_token; the appservice and its registered URL are still named.

• Pending interactive-authentication sessions retain at most 1,024 request bodies of up to 4,096 bytes each, shipped by @basnijholt (fcc07b1), with keys counted (0b43956); evicted or oversized ones must be resent in full. A session-only cross-signing retry without retained keys gets M_MISSING_PARAM asking for the full body (cdde2f4).

• With appreciation to @basnijholt for formatting and closure-borrow changes for October 3 nightly Clippy compatibility in (#621) and a steadier auto-accept-invites test in (#630), and to @SatvikMishra08 for fixing federate_created_rooms documentation in (#643), reported by @edenworky in (#642).

• After four consecutive federation failures, a content-related error triggers transaction splitting by room. A failing room can be parked after another succeeds, with backoff from one hour to 24 hours, doubling each time. Connection failures and rate limits do not trigger splitting. Admin queries expose parked rooms (cffd295, bc0f9a0, a60622d, b492082, 9af7242, c449ad2).

• Signed federation requests stop following HTTP redirects, so peers must serve them at the selected destination, and legacy media downloads and thumbnails ask remote origins for bytes. URL preview fetches and local object-store redirects are unaffected (021841f, 344d2c5).

• SSO sign-in asks before sending its login token to an unlisted destination: anything outside the configured client origin and oidc_registration_allowed_redirect_hosts (which accepts private-use schemes) gets a Continue sign-in page naming user and destination. Provider chains carry the account internally instead of as a redirect login token, checking the browser cookie at every step even where check_cookie is off (7d83687).

• Federation preserves sibling changes sharing preceding snapshots through state-event fork identities. Resolution loads complete fork state, prepares resolved state before installation and batches forward-extremity replacements under the room state lock (9fcefae, 241ece9, bb8f3c1, 0b403d7, 5f048d8).

• Shutdown-interrupted federation work avoids ordinary event-failure recording. Incoming transactions warn on missing PDUs; auth-chain failures remain distinct from fallback-eligible fork-state failures (14239a1, 92e5363, cb3915a, 8d3f6a9).

• Federation SRV routing preserves request names while resolving target hosts/ports and stripping DNS trailing dots. Malformed remote names get quieter diagnostics; local resolver timeouts and connection exhaustion still warn/error (a8e41c3, 5045ab9).

• /events respects requester visibility; previews expose history world-readable at the event. Own join/invite events use their resulting membership. Missing from starts at the current stream position; malformed cursors return M_INVALID_PARAM. The 50-event cap does not bound hidden-event scans (1803907, 23ef4fd, 73d60b1, 80e45ce). Read receipts must target a visible same-room event; m.fully_read is not covered (0d7794f).

• Remote profile refreshes must fit max_remote_profile_fields (default 100) and 64 KiB whole, or the cache stays unchanged; filter and sync field selections are capped by max_profile_fields_per_request (default 64). Both are reloadable; larger inputs accepted before are now refused. Refreshes keep stored null fields, which count toward the limits and can be replaced, and incremental Sliding Sync profile logs read only joined rooms (0933f37, 5490f37, 2059b2e).

• Multi-room search limits merged pages to 10 results by default, capped at 100. Pagination uses the last returned event's count instead of skip offsets. Results are bounded; total index work is not (2431c63).

• Concurrent claims cannot reuse one-time keys or OAuth authorization codes within one running server. Codes are consumed before validation, including invalid exchanges (25dbbb5, 210297c).

• Registration reserves names of accountless former admin-room members, returning M_USER_IN_USE before side effects. Existing accounts and the server user remain exempt (cc6dfd4, 9993cb5).

• Admin-room commands require m.text, excluding notices/emotes/captions. Outside-room escaped commands now default off (was on); reloadable admin_escape_commands = true retains them. Ordinary admin-room !admin commands remain unchanged. A shutdown interrupt before worker startup leaves the queue closed (a7ac11f, aa34a66, 08c68ee).

• Required email verification plus configured SMTP satisfies open-registration guards without tokens. Config display conceals smtp.connection_uri credentials and hides unparsable/hostless URIs entirely (e8f6903, 2398708).

• LDAP-origin interactive authentication skips local-password lookup; the LDAP build feature and ldap.enable remain required (6527b26).

• Space hierarchy cache entries record local or remote provenance, so remote answers no longer serve as local authority, and participation lookup errors no longer read as absence (5b2d534).

• A federation destination already sending returns busy before peer-status work, sender workers return to tokio's cooperative budgeting, and presence scans hand their upper counter bound to RocksDB (48487fa, 436be8a).

• Database seek commands destroy iterator state before releasing map and engine owners, including queued cancellation before execution (0b14469).

• Debian packages link the system glibc on a Debian trixie baseline, declaring that dependency through cargo-deb; C++ and other libraries stay static. RocksDB moves to ThinLTO; packaging waits for passing tests (002f585, abd9837, 3e991df).

• Element Web checks reject empty first passes and out-of-test errors, clear stale reports and preserve exit status. Browser/pnpm dependencies align; legacy-crypto known-failure coverage expands without fixing client behavior. Docker unit/integration binaries stop after ten minutes plus 30-second grace; benchmarks/Valgrind are uncapped. Debian checks debhelper markers; startup tests cover disabled federation (29bd18d, a3eb734, 0d3cf15, 4ac1a2c, 97a6378).

• @basnijholt landed several more fixes: appservices reach other users' account data only within their own namespace and the delete routes (MSC3391) refuse m.fully_read and m.push_rules (#626, 7e9466e); per-user room scans stop at the user ID boundary, so @alice:example.org no longer matches @alice:example.org.other (#633); a leave without membership records no departure (#631); and Sliding Sync caps each room's timeline_limit at 100 (#637).

Dendrite Matrix Homeserver

This is the first release after forking matrix-org/dendrite, this repository is now licensed under AGPLv3.0.

Upgrading to this version is highly recommended, as it fixes several long-standing bugs which could lead to state resets.
It also improves performance and memory usage.

Features

• The required Go version to build Dendrite is now 1.22
• Support for listening and connecting to I2P and Onion services was added (contributed by eyedeekay)
• Add via parameter on join room requests as per MSC4156 (contributed by Johennes)
• Support for fallback keys has been added (contributed by neilalexander)
• Dendrite now supports MSC4225
• Updated dependencies
  • Internal NATS Server has been updated from v2.10.20 to v2.10.23 (contributed by neilalexander)
  • gomatrixserverlib has been updated, which includes several performance improvements

Fixes

• Correctly respond to OPTIONS requests on authed media endpoints (contributed by arenekosreal)
• A long-standing bug which could lead to state resets has been fixed (contributed by neilalexander)
  • Note: While state resets should happen less frequently, they are still part of the Matrix protocol, so they are not entirely fixed.
  • Also, rooms which have been utterly broken may take some time to reconcile, it may be worth to leave, purge and rejoin such rooms.

What's Changed

• Add via parameter on join room requests as per MSC4156 by @Johennes in #3441
• Update dependencies by @neilalexander in #3449
• Add temporary repository flag by @S7evinK in #3453
• Various fixes in fetchAuthEvents by @S7evinK in #3447
• Add dependabot config by @S7evinK in #3450
• Support for fallback keys by @neilalexander in #3451
• Fetch oldest OTKs first (MSC4225) by @S7evinK in #3452
• Add GHA dependabot config, bump codecov action by @S7evinK in #3459
• Bump github.com/dgraph-io/ristretto from 0.1.1 to 0.2.0 by @dependabot in #3457
• Bump github.com/docker/docker from 25.0.6+incompatible to 26.1.0+incompatible by @dependabot in #3458
• Bump github.com/docker/docker from 26.1.0+incompatible to 26.1.5+incompatible by @dependabot in #3466
• Bump github.com/docker/go-connections from 0.4.0 to 0.5.0 by @dependabot in #3465
• Bump github.com/gorilla/websocket from 1.5.0 to 1.5.3 by @dependabot in #3455
• Bump nhooyr.io/websocket from 1.8.7 to 1.8.17 by @dependabot in #3456
• Bump actions/setup-go from 4 to 5 by @dependabot in #3462
• Bump actions/upload-pages-artifact from 1 to 3 by @dependabot in #3461
• Bump actions/setup-python from 4 to 5 by @dependabot in #3460
• Bump helm/chart-testing-action from 2.3.1 to 2.6.1 by @dependabot in #3463
• Bump yokawasa/action-setup-kube-tools from 0.8.2 to 0.11.2 by @dependabot in #3464
• Speedup building docker images in CI by @S7evinK in #3467
• Version 0.14.0 by @S7evinK in #3468

New Contributors

• @Johennes made their first contribution in #3441
• @neilalexander made their first contribution in #3449
• @S7evinK made their first contribution in #3453
• @dependabot made their first contribution in #3457

Full Changelog: https://github.com/element-hq/dendrite/commits/v0.14.0

Dendrite Matrix Homeserver

⚠ Important

This is a security release, adding support for room version 12.

Features

• Add support for MSC4163.
• Add support for MSC3967.
• Add support for room version 12.

Bug fixes

• Refactored NATS JetStream code to gracefully handle more potential errors. (contributed by neilalexander)
• Refactored NATS startup and readiness checking. (contributed by neilalexander)
• Updated NATS to 2.11.7. (contributed by neilalexander)
• Fixed an issue which could cause Dendrite to become unresponsive for minutes at a time. (contributed by viviicat)
• Order events when backfilling to reduce the amount of unecessary /state_ids requests.
• Gracefully handle incorrect sync filter JSON.
• Fixed an issue which prevented device deletion working correctly. (contributed by robinsdan)

Bug fixes

• Fixed an issue which could cause Dendrite to become unresponsive for minutes at a time. (contributed by viviicat)
• Fixed an issue which prevented joining v12 rooms in some circumstances.
• Fixed an issue which prevented sending invites to v12 rooms.
• Fixed an issue which prevented some clients from syncing v12 rooms.
• Fixed an issue where a single badly formed PDU would block entire transactions of PDUs being processed. See element-hq/synapse#7543 for the related issue on Synapse.

Bug fixes

• Fixed an issue which could cause Dendrite to crash on startup if the room state lacked a create event.

Changelog: https://github.com/element-hq/synapse/blob/release-v1.161/CHANGES.md

Changelog: https://github.com/element-hq/synapse/blob/release-v1.162/CHANGES.md

Changelog: https://github.com/element-hq/synapse/blob/release-v1.162/CHANGES.md

Changelog: https://github.com/element-hq/synapse/blob/release-v1.163/CHANGES.md

Changelog: https://github.com/element-hq/synapse/blob/release-v1.163/CHANGES.md

Changelog: https://github.com/element-hq/synapse/blob/release-v1.164/CHANGES.md

Changelog: https://github.com/element-hq/synapse/blob/release-v1.163/CHANGES.md

Changelog: https://github.com/element-hq/synapse/blob/release-v1.164/CHANGES.md

Changelog: https://github.com/element-hq/synapse/blob/release-v1.163/CHANGES.md

Changelog: https://github.com/element-hq/synapse/blob/release-v1.164/CHANGES.md

Changelog

Security

• Fix password authentication bypass in 2FA auth for LDAP/PAM/SSO accounts (GHSA-vx32-x96w-qq65)
• Fix Denial of Service when processing pathological JSON-LD activities (GHSA-vgm8-frgh-rh2v)
• Fix disabled staff accounts still having access to admin API (GHSA-62j4-hvj7-px3f)

Fixes

• Fix invited-without-approval-bypass not being asked for a textual reason (#40332 by @ClearlyClaire)
• Fix email blocks domain filter not being kept through pagination (#40254 by @ClearlyClaire)
• Fix config/ directory missing from Bootsnap precompilation options in Dockerfile (#40255 by @ClearlyClaire)
• Fix some of 4.7 migrations not re-running cleanly when interrupted (#40264 by @ClearlyClaire)
• Fix account creation failing on ActiveRecord::Encryption configuration in mastodon:setup rake task (#40275 by @ClearlyClaire)

Upgrade notes

To get the code for v4.7.1, use git fetch && git checkout v4.7.1.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.7.0.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.7.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.
If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

1. Install dependencies with bundle install
2. Restart all Mastodon processes.

When using Docker

1. Restart all Mastodon processes.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Update dependencies
• Fix password authentication bypass in 2FA auth for LDAP/PAM/SSO accounts (GHSA-vx32-x96w-qq65)
• Fix Denial of Service when processing pathological JSON-LD activities (GHSA-vgm8-frgh-rh2v)
• Fix disabled staff accounts still having access to admin API (GHSA-62j4-hvj7-px3f)

Fixes

• Fix config/ directory missing from Bootsnap precompilation options in Dockerfile (#40255 by @ClearlyClaire)
• Fix autosuggestions overstaying their welcome in languages that don't use spaces (#40217 by @Gargron)
• Fix error when processing remote actors with null public keys (#40194 by @ClearlyClaire)
• Fix various off-by-one errors in statistics time ranges (#40193 by @ClearlyClaire)

Upgrade notes

To get the code for v4.6.7, use git fetch && git checkout v4.6.7.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.6.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.
If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

1. Install dependencies with bundle install
2. Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
3. Restart all Mastodon processes.

When using Docker

1. Restart all Mastodon processes.

Changelog

Security

• Temporarily disable HEIF support

Fixes

• Fix relative privacy policy links in subscription emails (#40486 by @crafkaz)
• Fix canonical email blocks interfering with freezing or approving users (#40463 by @ClearlyClaire)
• Fix 500 error when trying to upload a non-custom-filter JSON import (#40449 and #40451 by @ClearlyClaire)
• Fix 500 error when submitting a status twice (#40439 by @ClearlyClaire)
• Fix self-deleted accounts not being un-deleted when using tootctl accounts create --reattach (#40430 by @mjankowski)
• Fix account deletion not deleting generated annual reports (#40394 by @ClearlyClaire)
• Fix notifications not being cleaned up when notification requests are deleted in bulk (#40393 by @ClearlyClaire)

Upgrade notes

To get the code for v4.7.2, use git fetch && git checkout v4.7.2.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.7.0.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.7.0 release notes.

1. Restart all Mastodon processes

Changelog

Security

• Temporarily disable HEIF support

Fixes

• Fix relative privacy policy links in subscription emails (#40486 by @crafkaz)
• Fix canonical email blocks interfering with freezing or approving users (#40463 by @ClearlyClaire)
• Fix 500 error when submitting a status twice (#40439 by @ClearlyClaire)
• Fix account deletion not deleting generated annual reports (#40394 by @ClearlyClaire)
• Fix notifications not being cleaned up when notification requests are deleted in bulk (#40393 by @ClearlyClaire)

Upgrade notes

To get the code for v4.6.8, use git fetch && git checkout v4.6.8.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.7.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

1. Restart all Mastodon processes.

Changelog

Security

• Temporarily disable HEIF support

Fixes

• Fix canonical email blocks interfering with freezing or approving users (#40463 by @ClearlyClaire)
• Fix account deletion not deleting generated annual reports (#40394 by @ClearlyClaire)
• Fix notifications not being cleaned up when notification requests are deleted in bulk (#40393 by @ClearlyClaire)

Upgrade notes

To get the code for v4.5.18, use git fetch && git checkout v4.5.18.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

• Ruby: 3.2 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 20.19 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.16.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

1. Restart all Mastodon processes.

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.6 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.6 version when they can.

Changelog

Security

• Temporarily disable HEIF support

Fixes

• Fix canonical email blocks interfering with freezing or approving users (#40463 by @ClearlyClaire)
• Fix account deletion not deleting generated annual reports (#40394 by @ClearlyClaire)
• Fix notifications not being cleaned up when notification requests are deleted in bulk (#40393 by @ClearlyClaire)

Upgrade notes

To get the code for v4.4.25, use git fetch && git checkout v4.4.25.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.24.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

1. Restart all Mastodon processes.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Update dependencies

Added

• Add logging of account data removal (#40572 by @ClearlyClaire)
• Add link to homepage to 404 error page (#40369 by @diondiondion)

Changed

• Change account self-deletion page to always ask to confirm username (#40576 and #40733 by @ClearlyClaire)

Fixed

• Fix error handling for malformed webfinger subjects (#40731 by @ClearlyClaire)
• Fix threads leak by updating dependency aws-sdk-s3
• Fix occasional installation-time error by updating dependency yarn to v4.18.1 (#40722 by @renovate[bot])
• Fix inconsistent horizontal page padding between profile and profile editor (#40700 by @diondiondion)
• Fix server error on registration for wrong DOB (#40607 by @sudeeptarlekar)
• Fix quotes disclaimer disappearing on posts with no quote (#40587 by @crafkaz)
• Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681 by @ClearlyClaire)
• Fix reported statuses not being deleted after account deletion (#40650 by @ClearlyClaire)
• Fix mobile navigation covering up "Next step" button during onboarding (#40634 by @diondiondion)
• Fix rate limits not normalizing submitted e-mail addresses (#40658 by @Gargron)
• Fix moderators being able to issue a warning on moderators of higher position (#40646 by @ClearlyClaire)
• Fix deleted-because-of-suspension accounts being marked as manually deleted (#40645 by @ClearlyClaire)
• Fix description text overflowing on Overview landing page (#40272 by @diondiondion)
• Fix account avatar and header descriptions not being deleted when an account is deleted (#40621 by @ClearlyClaire)
• Fix deleted accounts not being removed from featured collections (#40623 by @ClearlyClaire)
• Fix PreviewCardsStatus records not being deleted on account deletion (#40624 by @ClearlyClaire)
• Fix z-index of PIP video player to be above the side panel (#40484 by @tribela)
• Fix replies order (#40481 by @OmmyZhang)
• Fix missing confirmation when leaving with an unsent post (#40478 by @crafkaz)
• Fix email footer spacing around custom footer text (#40440 by @mjankowski)

Upgrade notes

To get the code for v4.7.3, use git fetch && git checkout v4.7.3.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.7.2.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.7.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.
If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

1. Install dependencies with bundle install and yarn install --immutable
2. Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
3. Restart all Mastodon processes.

When using Docker

1. Restart all Mastodon processes.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Update dependencies

Added

• Add logging of account data removal (#40572 by @ClearlyClaire)

Changed

• Change account self-deletion page to always ask to confirm username (#40576 and #40733 by @ClearlyClaire)

Fixed

• Fix threads leak by updating dependency aws-sdk-s3
• Fix inconsistent horizontal page padding between profile and profile editor (#40700 by @diondiondion)
• Fix server error on registration for wrong DOB (#40607 by @sudeeptarlekar)
• Fix quotes disclaimer disappearing on posts with no quote (#40587 by @crafkaz)
• Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681 by @ClearlyClaire)
• Fix reported statuses not being deleted after account deletion (#40650 by @ClearlyClaire)
• Fix mobile navigation covering up "Next step" button during onboarding (#40634 by @diondiondion)
• Fix rate limits not normalizing submitted e-mail addresses (#40658 by @Gargron)
• Fix moderators being able to issue a warning on moderators of higher position (#40646 by @ClearlyClaire)
• Fix description text overflowing on Overview landing page (#40272 by @diondiondion)
• Fix account avatar and header descriptions not being deleted when an account is deleted (#40621 by @ClearlyClaire)
• Fix deleted accounts not being removed from featured collections (#40623 by @ClearlyClaire)
• Fix PreviewCardsStatus records not being deleted on account deletion (#40624 by @ClearlyClaire)
• Fix replies order (#40481 by @OmmyZhang)
• Fix missing confirmation when leaving with an unsent post (#40478 by @crafkaz)

Upgrade notes

To get the code for v4.6.9, use git fetch && git checkout v4.6.9.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.6.0.

• Ruby: 3.3 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 22 or newer
• libvips: 8.13 or newer
• FFMpeg: 5.1 or newer

Update steps

The following instructions are for updating from 4.6.8.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.6.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.
If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

1. Install dependencies with bundle install and yarn install --immutable
2. Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
3. Restart all Mastodon processes.

When using Docker

1. Restart all Mastodon processes.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Update dependencies

Added

• Add logging of account data removal (#40572 by @ClearlyClaire)

Changed

• Change account self-deletion page to always ask to confirm username (#40576 and #40733 by @ClearlyClaire)

Fixed

• Fix stuck sidekiq jobs by updating dependency sidekiq
• Fix server error on registration for wrong DOB (#40607 by @sudeeptarlekar)
• Fix quotes disclaimer disappearing on posts with no quote (#40587 by @crafkaz)
• Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681 by @ClearlyClaire)
• Fix reported statuses not being deleted after account deletion (#40650 by @ClearlyClaire)
• Fix rate limits not normalizing submitted e-mail addresses (#40658 by @Gargron)
• Fix moderators being able to issue a warning on moderators of higher position (#40646 by @ClearlyClaire)
• Fix PreviewCardsStatus records not being deleted on account deletion (#40624 by @ClearlyClaire)
• Fix replies order (#40481 by @OmmyZhang)

Upgrade notes

To get the code for v4.5.19, use git fetch && git checkout v4.5.19.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.5.0.

• Ruby: 3.2 or newer
• PostgreSQL: 14 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 7.0 or newer
• Node: 20.19 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.5.18.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.5.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.
If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

1. Install dependencies with bundle install and yarn install --immutable
2. Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
3. Restart all Mastodon processes.

When using Docker

1. Restart all Mastodon processes.

Note

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.7 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.7 version when they can.

Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

For more information, view the complete release notes and scroll down to the upgrade instructions section.

Changelog

Security

• Update dependencies

Added

• Add logging of account data removal (#40572 by @ClearlyClaire)

Changed

• Change account self-deletion page to always ask to confirm username (#40576 and #40733 by @ClearlyClaire)

Fixed

• Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681 by @ClearlyClaire)
• Fix reported statuses not being deleted after account deletion (#40650 by @ClearlyClaire)
• Fix rate limits not normalizing submitted e-mail addresses (#40658 by @Gargron)
• Fix moderators being able to issue a warning on moderators of higher position (#40646 by @ClearlyClaire)
• Fix PreviewCardsStatus records not being deleted on account deletion (#40624 by @ClearlyClaire)

Upgrade notes

To get the code for v4.4.26, use git fetch && git checkout v4.4.26.

Note

As always, make sure you have backups of the database before performing any upgrades. If you are using docker-compose, this is how a backup command might look: docker exec mastodon_db_1 pg_dump -Fc -U postgres postgres > name_of_the_backup.dump

Dependencies

External dependencies have not changed since v4.4.1:

• Ruby: 3.2 or newer
• PostgreSQL: 13 or newer
• Elasticsearch (recommended, for full-text search): 7.x (OpenSearch should also work)
• LibreTranslate (optional, for translations): 1.3.3 or newer
• Redis: 6.2 or newer
• Node: 20 or newer
• libvips (optional, instead of ImageMagick): 8.13 or newer
• ImageMagick (optional if using libvips): 6.9.7-7 or newer

Update steps

The following instructions are for updating from 4.4.25.

If you are upgrading directly from an earlier release, please carefully read the upgrade notes for the skipped releases as well, as they often require extra steps such as database migrations. In particular, it is very important to read the 4.4.0 release notes.

Non-Docker

Tip

The charlock_holmes gem may fail to build on some systems with recent versions of gcc.
If you run into this issue, try BUNDLE_BUILD__CHARLOCK_HOLMES="--with-cxxflags=-std=c++17" bundle install.

1. Install dependencies with bundle install and yarn install --immutable
2. Precompile the assets: RAILS_ENV=production bundle exec rails assets:precompile
3. Restart all Mastodon processes.

When using Docker

1. Restart all Mastodon processes.

What's Changed

• Close temp file handle in libFuzzer engine by @Xeicker in #5551

Full Changelog: v2.46.1...v2.46.2

Changes

• AGENTS.md: clearer guidance on tests (#4713) @blotus
• pimp readme (#4701) @buixor

New Features

• waf: add RateLimit() helper (#4721) @blotus
• [bot-detection] Add custom JS fingerprinting capabilities (#4657) @buixor

Improvements

• Add cs_features metric (#4770) @blotus
• bot detection: add an option to set SameSite=None + Partitioned flag on cookie (#4764) @blotus
• exprhelpers: add GetDecisionsSinceCountByScenario (#4756) @tommy-ng0
• lapi: optionally limit concurrent decision stream requests (#4747) @tommy-ng0
• exprhelpers: LookupHost goes through the DNS cache (#4741) @twiesing
• metrics: add CAPI last pull timestamp and error counter (#4749) @NazarkinRoman
• add cscli bot subcommand (#4666) @blotus
• prometheus: add kind label to cs_alerts (#4742) @blotus
• lapi: make decisions stream page size configurable (#4733) @tommy-ng0
• Fix ValidateChallengeResponse (#4737) @buixor
• grok: only keep capture groups that can be accessed in evt.Parsed (#4736) @blotus
• grokky : preshot static strings (#4731) @buixor, @Copilot
• grokky : ParseInto (#4729) @buixor
• bot-detection: add new FlagSubmission() helper (#4727) @blotus
• appsec: add an optional category to the request score (#4715) @buixor
• apiserver: reload the TLS server certificate when its files change (#4709) @ohartwig
• fix image link (#4702) @buixor
• waf: add SkipProcessing() helper (#4667) @blotus
• [bot-detection] drop the URI from the cookie (#4656) @buixor

Bug Fixes

• fix RateLimit() tests (#4771) @blotus
• acquisition/file: don't send half-written lines, or skip the lines after them (#4678) @n1koo, @blotus, @claude
• fix(cscli): display human-readable timestamps in local time (#4759) @sep2
• waf: use dedicated workers for OOB processing (#4722) @blotus
• remove runtime Fatalf calls (#4760) @blotus
• waf: fix log spam when usin unix socket on freebsd (#4745) @blotus
• docker: read from now if container restarts (#4605) @blotus
• splunk-notification: add an option to configure InsecureSkipVerify (#4720) @blotus
• victorialogs: move the datasource to RestartableStreamer interface (#4738) @blotus
• metrics: remove series of deleted machines and bouncers (#4712) @somaz94
• postoverflow: run them in a goroutine to not block writers, enforce max in-flight alerts, and warn if queue is becoming too full (#4672) @blotus
• buckets: make a copy of all event maps before pouring the event to a bucket (#4481) @blotus
• fix(database): keep simulated decisions from suppressing real bans (#4679) @4erdenko, @blotus
• fix a nasty bug in transfrom where the effective uuid for a datasource (#4697) @sabban
• hubtest: add a tiebreaker based on the alert date to have a consistent order (#4699) @blotus
• challenge: optimize memory usage (#4674) @blotus
• syslog: copy buffer before handing it to the datasource (#4690) @blotus
• Expand env vars in online_api_credentials.yaml (#4677) @kushiemoon-dev

Chore / Deps

• build(deps): bump the gomod group with 5 updates (#4778) @dependabot[bot]
• build(deps): bump the github-actions group with 2 updates (#4777) @dependabot[bot]
• build(deps): bump certifi from 2026.1.4 to 2026.10.19 in /build/docker/test (#4780) @dependabot[bot]
• build(deps): bump the github-actions group across 1 directory with 8 updates (#4766) @dependabot[bot]
• build(deps): bump the gomod group with 16 updates (#4767) @dependabot[bot]
• build(deps): bump the gomod group with 8 updates (#4753) @dependabot[bot]
• fpscanner: use fork (#4761) @blotus
• waf: update to coraza 3.8.0 (#4724) @blotus, @buixor
• build(deps): bump the gomod group across 1 directory with 19 updates (#4730) @dependabot[bot]
• CI: skip more docker tests on windows (#4728) @blotus
• grok: embed grok library instead of having it as a dep (#4725) @blotus
• docker datasource: skip tests on windows (#4719) @blotus
• agents.md: keep comments to a reasonable level (#4716) @blotus
• build(deps): bump the github-actions group with 7 updates (#4693) @dependabot[bot]
• build(deps): bump the gomod group with 11 updates (#4694) @dependabot[bot]
• build(deps): bump github.com/go-openapi/validate from 0.26.5 to 1.0.0 (#4682) @dependabot[bot]
• build(deps): bump the gomod group with 19 updates (#4681) @dependabot[bot]
• build(deps): bump cryptography from 48.0.1 to 50.0.0 in /build/docker/test (#4591) @dependabot[bot]
• bump to go 1.27 (#4675) @blotus
• build(deps): bump the github-actions group across 1 directory with 3 updates (#4658) @dependabot[bot]
• build(deps): bump the gomod group across 1 directory with 21 updates (#4659) @dependabot[bot]

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.