Notices by Mastodon Engineering (mastodonengineering@mastodon.social)

We are aware of an ongoing wave of subscription spam throughout the fediverse.

We are investigating avenues to mitigate this, but they will likely involve deep changes in the sign-up flow that may break sign-up from existing applications.

In the meantime, you can find helpful resources at https://about.iftas.org/2026/09/11/boom-protocol-spam/

#MastoAdmin

We just released Mastodon v4.7.2, v4.6.8, v4.5.18 and v4.4.25.

In addition to several bugfixes, they disable HEIF processing to avoid a known critical security issues. We encourage server administrators to update as soon as possible.

Full release notes and update instructions are available on the GitHub releases page.

https://github.com/mastodon/mastodon/releases

#MastoAdmin

We just released Mastodon v4.7.1, v4.6.7, v4.5.17 and v4.4.24.

These include important security fixes.

We encourage server administrators to update as soon as possible, especially if you are using LDAP, PAM or an external SSO for user authentication.

Full release notes and update instructions are available on the GitHub releases page.

https://github.com/mastodon/mastodon/releases

#MastoAdmin

We just released Mastodon 4.7.0!

This version contains very few user-facing changes, but significantly reworks the backend code to improve security and support new protocol features.

You can read more about it on our blog: https://blog.joinmastodon.org/2026/08/mastodon-4.7/

Note for admins: the database migrations might take a long time, this is expected (see the release notes).

Release notes and upgrade instructions are available here: https://github.com/mastodon/mastodon/releases/tag/v4.7.0

#mastoadmin

We released the Release Candidate for Mastodon 4.7 today.

It contains very few user-facing changes, but significantly reworks the backend code to improve security and support new protocol features.

We plan to release the final 4.7 version next week, so if you like being on the edge please test this RC and send us your feedback!

The database migrations might take a long time, this is expected.

Release notes and upgrade instructions are available here: https://github.com/mastodon/mastodon/releases/tag/v4.7.0-rc.1

#mastoadmin

@yawnbox We will be releasing 4.7-rc1 tomorrow with those fixes. None of this is security related, only bug fixes.

We just released Mastodon 4.6.6, 4.5.16 and 4.4.23.

They contain minor bug fixes and we advise server administrators to update when they can.

Full release notes and update instructions are available on the GitHub releases page. https://github.com/mastodon/mastodon/releases

#mastoadmin

@paul Woops, fixed! Thanks

📬 Trunk & Tidbits for July 2026 is now out!

Our monthly blog post series is there to showcase what we worked on last month.

In this edition, we welcome @jhbabon and highlight the many backend changes that were merged and will be part of our upcoming 4.7 release. Those include support for FEP-8b32, FEP 8967 and new algorithms, including ML-DSA-44 for post-quantum signatures.

#mastodev #mastoadmin #TrunkAndTidbits

We released the first beta for Mastodon 4.7 today. It contains very few user-facing changes, but contains significant reworks of the backend code to improve security and support new protocol features.

This update includes substantial database migrations that might take up to a couple of hours on very large servers, but will not cause downtime if the upgrade instructions are followed.

Release notes and upgrade instructions are available here: https://github.com/mastodon/mastodon/releases/tag/v4.7.0-beta.1

#mastoadmin

We just released Mastodon 4.6.5. It contains one important bug fix and we recommend every instance running 4.6 to update.

We are also releasing Mastodon v4.5.15 and v4.4.22 with minor bugfixes

Full release notes and update instructions are available on the GitHub releases page.

https://github.com/mastodon/mastodon/releases

#mastoadmin

@7sleepersmusic It should be better now, please tell us if you encounter this again.

@7sleepersmusic Can you provide more details about what you are doing with the search API?

@liaizon The advisories have now been published.

@kaibojens There are: https://github.com/mastodon/mastodon/releases/tag/v4.5.14 & https://github.com/mastodon/mastodon/releases#release-v4.4.21

We just released Mastodon 4.6.4, 4.5.14 and 4.4.21.

Those updates include multiple security fixes, including fixes for two major issues.

We encourage server administrators to update as soon as possible, as one of the issues can expose PII of local users. We are investigating potential uses of this exploit and will soon share more information.

Full release notes and update instructions are available on the GitHub release page.

https://github.com/mastodon/mastodon/releases/v4.6.3

#MastoAdmin

@maklem Yes, container images will be published on release, for all supported versions.

We are planning to release new Mastodon security updates for versions 4.4, 4.5, 4.6 and nightly this Monday, Jul 27, at around 14:00 UTC.

It solves two major security issues.

We encourage server administrators to plan for an update in the hours following the release to ensure their instance is protected. These versions will not require database migrations.

#mastoadmin

📬 Trunk & Tidbits for June 2026 is now live!

Our monthly blog post series is there to showcase what we worked on last month.

In this edition, we are also discussing our official Helm Chart for Mastodon, for those of you who deploy Mastodon on Kubernetes. We released a brand new version of the chart in a new place, deprecating the existing one.

https://blog.joinmastodon.org/2026/07/trunk-tidbits-june-2026/

#mastodev #mastoadmin #TrunkAndTidbits

We just released Mastodon 4.6.3, containing several bug fixes.

Full release notes and update instructions are available on the GitHub release page.

https://github.com/mastodon/mastodon/releases/v4.6.3

#MastoAdmin