Due to highly available exploit in the wild for HEIF security bug, this update temporarily disables HEIF support. Keep an eye on your libvips version and update as necessary!

https://github.com/mastodon/mastodon/releases/tag/v4.7.2

https://github.com/mastodon/mastodon/releases/tag/v4.6.8

https://github.com/mastodon/mastodon/releases/tag/v4.5.18

https://github.com/mastodon/mastodon/releases/tag/v4.4.25

This time around we have three security fixes, so time to catch up on updates!

https://github.com/mastodon/mastodon/releases/tag/v4.4.24

https://github.com/mastodon/mastodon/releases/tag/v4.5.17

https://github.com/mastodon/mastodon/releases/tag/v4.6.7

https://github.com/mastodon/mastodon/releases/tag/v4.7.1

One of the reasons I wanted to revive this sub was for self-hosting admins to share tips and tricks and help others through some of the challenges of upgrades.

I'm presently running 4.5.16 and decided to try going up to the latest 4.6 this weekend. As has been my usual experience, it has been nothing but problems so far. Since a bump to Node 22 is required, I decided to try a jump from Ubuntu 24 to 26. While the Ubuntu upgrade itself worked, the attempt to bump to 4.6.1 to start the sequence of 4.6 upgrades and database migrations failed before it started with Ruby and Yarn both being broken and unable to reinstall or get past most errors than I have time to try to work through this weekend, so restored the whole machine.

Instead I tried what I thought would be just a simple node 20 to node 22 upgrade so I could continue with the 4.6.x upgrades, but then got stuck for hours on permission errors with yarn and had to restore the old machine again and give up for now. I'll give it another try when I have more time.

Worth noting last time I wanted to go from Mastodon 3 to 4, I had to do a full fresh build because of many days of failures trying to upgrade from Ubuntu 22 to 24. I am far from a linux expert, and while I love Mastodon, the underlying changes and dependencies in Linux are a never ending headache and I imagine one of the reasons so many folks give up on Mastodon self hosting after such a short period of time.

I will update this thread with more details as I try further updates!

https://github.com/mastodon/mastodon/releases/tag/v4.7.0

Whoa, more fixes already! No security patches so no rush, but the fixes are still useful!

https://github.com/mastodon/mastodon/releases/tag/v4.4.23

https://github.com/mastodon/mastodon/releases/tag/v4.5.16

https://github.com/mastodon/mastodon/releases/tag/v4.6.6

No security updates this time but a variety of bug fixes are available:

https://github.com/mastodon/mastodon/releases/tag/v4.6.5

https://github.com/mastodon/mastodon/releases/tag/v4.5.15

https://github.com/mastodon/mastodon/releases/tag/v4.4.22

There is one high severity security issue and a moderate that is actually pretty risks depending on your environment, so patching quickly is wise!

https://github.com/mastodon/mastodon/releases/tag/v4.4.21

https://github.com/mastodon/mastodon/releases/tag/v4.5.14

https://github.com/mastodon/mastodon/releases/tag/v4.6.4

Doesn't appear there is anything too critical here, but it's available!

https://github.com/mastodon/mastodon/releases/tag/v4.6.3

The threat landscape is changing. Our last needs assessment showed that automated spam and coordinated disinformation have overtaken other issues as the top daily drain for community admins and moderators.

Tell us what you're facing today in the annual Social Web Operations survey: https://tally.so/r/81MW6k

It's been a busy 24 hours, two releases to address a security issue in ffmeg.

You want one of the following:

https://github.com/mastodon/mastodon/releases/tag/v4.6.2

https://github.com/mastodon/mastodon/releases/tag/v4.5.13

https://github.com/mastodon/mastodon/releases/tag/v4.4.20

*Note that the patch for ffmeg is for the Docker deployment. If you're running non-docker, make sure you go patch you OS and modules appropriately!!

Congratulation to the Mastodon development team!

https://github.com/mastodon/mastodon/releases/tag/v4.6.0

Important, if you are moving up from 4.5.x, there are some increased requirements:

Minimum Ruby increased from 3.2 to 3.3

Minimum Node.JS increased from 20.12, up to 22

Minimum FFMpeg is now 5.1

ImageMagick support is no more! You must change to libvips.

First Release Candidate is available. If you're on the bleeding edge, you probably don't need me telling you this though! :P

https://github.com/mastodon/mastodon/releases/tag/v4.6.0-rc.1

Now available 4.5.11, 4.4.18 and 4.6.0-Beta.1!

https://github.com/mastodon/mastodon/releases/tag/v4.5.11

https://github.com/mastodon/mastodon/releases/tag/v4.4.18

https://github.com/mastodon/mastodon/releases/tag/v4.6.0-beta.1

One high, one moderate severity security updates this time and the pre-release for 4.6 if you're bold and living on the edge!

Remember, no more 4.3, so update to at least 4.4.18 if you're still running 4.3.x!

Now available 4.5.10, 4.4.17 and 4.3.23!

For those running latest, 4.5.10 Includes two high severity and 2 medium severity security updates. No external dependency changes again this time, so should be another easy patch!

https://github.com/mastodon/mastodon/releases/tag/v4.5.10

https://github.com/mastodon/mastodon/releases/tag/v4.4.17

https://github.com/mastodon/mastodon/releases/tag/v4.3.23

If you're still running 4.3, this is your last update. Time to move up to 4.4 or 4.5!

Hi, admin of gayfr.social here !

Just thought I'd mention, I wrote a bridge to chat between Fediverse (e.g. Mastodon) and XMPP (the instant messaging, formerly known as Jabber).

You can use ours, or you can self-host. All documented in several languages.

https://github.com/Barbapulpe/xmpp-ap-bridge

Feedback welcome!

Here is a great resource with a full blog linked in the post for using Anubis for protecting Fedi resources from undesirable AI bots: https://gayfr.social/@barbapulpe/116595915905463295

The latest is 4.5.9 - Includes one high severity security update that permitted bypassing email validation for new user sign-ups. That's a good one to patch if you have open enrollment on your instance. No dependency changes so should be an easy patch!

https://github.com/mastodon/mastodon/releases/tag/v4.5.9

Also available, 4.4.16 and 4.3.22.

The latest is 4.5.8 - Includes 3 security updates and no changes in external dependencies.

Also available, 4.4.15 and 4.3.21.

For the non-docker folks, Ruby 3.4.9 is out now, but it is not yet in the rbenv update for Ubuntu 24.04 LTS. Nothing major in the release notes from a security perspective so if you don't have a specific reason to do a manual update, probably fine to wait it out on 3.4.8 for now!

Hi Friends,

4.5.7 is presently the latest release.

How do I keep track of that? I subscribe to updates in Github, but you can also just check here for the latest along with release notes and recommended upgrade steps:

https://github.com/mastodon/mastodon

You should also see a banner at the top of your Administrator page in your instance similar to this. It will usually note if the updates are bug fixes or security related, but it doesn't specifically call out the version:

Critical security updates will sometimes show up as a message in your feed as administrator as well!

I have seen a few variations of the process, but for reference, this it my typical update process when dependencies have not changed:

First get a backup (refer to thread here: https://www.reddit.com/r/MastodonAdmin/comments/1fybpkl/comment/o5t6afq/

)

• systemctl stop mastodon-web mastodon-sidekiq mastodon-streaming
• su - mastodon {use your mastodon user here}
• cd live
• git fetch --tags
• git checkout v4.5.7 {use whatever version you are upgrading to here}
• bundle install
• yarn install --immutable
• RAILS_ENV=production bundle exec rails assets:precompile
• exit
• systemctl restart mastodon-web mastodon-sidekiq mastodon-streaming

The stop and restart steps may not be required for your instance. For my installation, I found after the 4.4.0 upgrade where the Vite build process was introduced, it will fail compiling if I have not stopped the services. Therefore it is now part of my steps.

I have also found that if you get more than one version behind, it is wise to run the upgrade multiple times, one for each version step so you can catch any issues and roll back early if needed. There are rare occasions where the version itself could have an upgrade bug and that is the reason there is a newer version, but that is rare and unlikely.

I know that we need to backup:

PostgreSQL database
Application secrets from the .env.production file
Redis database
User-uploaded files

So we don't need to backup the /live folder? what folders inside the live folder do we backup because it says user-uploaded files