The February 2026 Trunk & Tidbits is posted. Our monthly engineering update, including progress on 4.6, our AI contribution policy, upcoming end-of-life for version 4.3, some posts about the Share button, and more.
#MastoDev #MastoAdmin #Mastodon
https://blog.joinmastodon.org/2026/03/trunk-tidbits-february-2026/
We’re happy to announce that Mastodon 4.5 is now ready for prime time! Quote posts, async fetching of replies, server timeline visibility settings, more moderation tools, and lots and lots of other tweaks and improvements.
Announcement on our blog: https://blog.joinmastodon.org/2025/11/mastodon-4.5/
Full release notes and update instructions are available on our GitHub release page: https://github.com/mastodon/mastodon/releases/tag/v4.5.0
We just released Mastodon 4.3.8 and 4.2.21. They contain a few minor bug fixes and a minor security fix.
If you are running nightly versions, an updated container image is available under the `nightly.2025-05-07-security` tag
Full release notes and update instructions are available on our GitHub release page: https://github.com/mastodon/mastodon/releases/
A #SysAdmin / #MastoAdmin Question for folks
Has anyone used mikrotik hardware in anger / in production?
I've had enough now of my Unifi gear causing problems, this is the second gateway I've purchased which exhibits these random lock-ups / crashes and I'm very much over it so am looking at alternatives and mikrotik continues to be one that looks sensible.
Just curious if anyone has much experience using it hands on?
With Mastodon v4.4.0 instance owners can enable HTTP referrers. That means:
If somebody clicks a link in a Mastodon post (e.g. to a news article), the link target owner (such as the news site operator) can see that a user from that instance has visited their website.
They do _only_ get the instance domain (e.g. metalhead.club). No information about the user!
I've enabled this setting, because I am sure that it will increase awareness of Mastodon's existence. 💪
Edit: (in previous versions, Mastodon did not send referrer-Headers)
We just released #Mastodon 4.4.1, a small patch release fixing a few issues with 4.4.0.
We recommend to install this version instead of 4.4.0 when you update your server.
Full release notes and update instructions are available on our GitHub release page: https://github.com/mastodon/mastodon/releases/tag/v4.4.1
I got a boost from @lisamelton and my $6.25/mo instance didn't break a sweat. Phew!
We just released Mastodon 4.7.0!
This version contains very few user-facing changes, but significantly reworks the backend code to improve security and support new protocol features.
You can read more about it on our blog: https://blog.joinmastodon.org/2026/08/mastodon-4.7/
Note for admins: the database migrations might take a long time, this is expected (see the release notes).
Release notes and upgrade instructions are available here: https://github.com/mastodon/mastodon/releases/tag/v4.7.0
ISSO NÃO É UM TESTE
Saiu a versão 4.4 do Mastodon!
https://mastodon.social/@mastodon_releases/114818058810302485
cc @fediadminbr
There is a new major mastodon release (v4.4.0). As usual we will wait some time for bugs to settle and for us to check everything. Please be patient until then. #mastoadmin
Not that this will affect anyone but me and @elliot , but I have imported the GardenFence Mastodon blocklist for spammy servers - https://github.com/gardenfence/blocklist/blob/main/gardenfence-mastodon.csv bar some such as bird.makeup (Twitter accounts), mostr.pub (nostr bridge) and one that is just scanning ActivityPub instances
Currently we observe errors on one of our media servers. #mastoadmin
@mijndert and I have been working hard to create a new platform for the #tootcommunity Mastodon instance. It's completely open-source and built as Infrastructure as Code. The repository includes Kubernetes configurations, custom Helm charts, and OpenTofu code. The best part is that any changes made to this repository are instantly deployed to production.
We hope these resources will support and inspire the community.
Check it out here: https://github.com/toot-community/platform/
Spammers have been programmatically creating accounts on Mastodon instances for years. Sometimes they post once and never again, sometimes they post on a schedule. Sometimes they never post, like a waiting botnet.
As Mastodon's anti-spam solutions are effectively nonexistent, most instances in our network require manual approval of new accounts. Up until recently, it was easy to spot a spammer; their join reasons were generic.
ChatGPT spammers have now arrived.
Ω🪬Ω
new release of #Fedialgo, the customizable timeline algorithm / filtering system for your Mastodon feed, counts the number of times each hashtag appears in your timeline even if people don't use a "#" character to give you a better sense of what people are talking about in the Fediverse.
there's a little bit of art vs. science here because some strings are disqualified from this kind of counting (e.g. a word like "the" should not be counted even if some maniac decided to make it a hashtag) so let me know if you see any weirdly high counts.
* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522
#activitypub #algorithm #algorithmicFeed #algorithmicTimeline #Fedi #FediTips #FediTools #Fediverse #Feed #FOSS #Masto #MastoAdmin #Mastodon #mastohelp #MastoJS #nodejs #node #opensource #SocialWeb #timeline #TL #webdev #hashtag #typescript #hashtags
Cuidado com a nova onda de golpes rondando o fediverso
Contas falsas se fazem passar por equipes de moderação do Mastodon, como se todas as instâncias fossem parte de uma empresa só.
Elas solicitam uma falsa verificação de identidade, coisa que o fediverso não faz, pois são dados sensíveis e muita dor de cabeça para um serviço voluntário lidar.
Não acredite nas mensagens nem cliquem nos links. Em vez disso, denunciem a conta falsa se ver ela ou se for contactado por ela.
ℹ️ Aqui na Ursal as únicas contas oficiais da gestão são: @Ursalzona @Bruiserzinha @liaamancio @red. Esta (@cadusilva) e @ReeSilva cuidam de manter tudo no ar.
Because of AI/LLM signups at our instance, I've decided to disable requests via Mastodon to sign up. If you want an account, please send a mail to info [at] collectifission [dot] nl so we can have a talk before I'm sure you're not a bot.
Sorry, this is the world we live in now.
#FediBlock recommendation, there's a rogue server cloning lots of real accounts so it can impersonate them. There is no legitimate reason for such behaviour, admins should suspend it ASAP:
mastodon.arell.ai
Admins might want to suspend the main domain:
arell.ai
This would be good in case the owner tries the same stunt on a different subdomain. Blocking the main domain also blocks all of its subdomains.
(via @thomas, thread at https://metalhead.club/@thomas/114878505580336321 )
We just released Mastodon 4.4.3, 4.3.11, and 4.2.24.
These versions contain bugfixes, a fix for a moderate severity rate limit issue, and security issue if you use SAML. In 4.4.3 there are also changes to how quote posts are handled, as we continue to work towards full support for quote posts in the next main release.
Full release notes and update instructions are available on the GitHub releases page. #mastoadmin
1. Is anyone else getting routed to chinese language when they visit this URL? because i am: https://docs.joinmastodon.org/methods/apps/ (i end up at the URL https://docs.joinmastodon.org/zh-cn/methods/apps/ - note the "zh-cn" in the path.
i doublechecked my browser locale, VPN, etc. etc. and there's nothing configured for mainland chinese locale, but this happened even after clearing cache data for joinmastodon.org
2. who maintains the #JoinMastodon site?
cc: @mastodonmigration @FediTips @fediversereport @LaurensHof
We will start the update to mastodon v4.4.1 in a few minutes. Please expect some downtime. #mastoadmin
🚨 Alert 🚨
There is a new scam wave spreading across Mastodon.
If you see a post like the one below, do not interact with it. SImply report to your server admin.
Server admins, if you are able, now may be the time to temporarily turn off open sign ups.
As moderators, we will do our best to respond to these reports swiftly. We will also add malicious links to our Newsmast Foundation filters list, meaning the posts should not show on our services.
Fedi Instance Admins: S3 buckets and CDNs. Public buckets with a CDN are simple enough.
Private buckets with signed urls...I understand how they work. Call the S3 API to grab a signed URL for a specific private asset, the URL lives short term. Anyone with that signed url can access it (?).
But doesn't it negate the function of a CDN? Seems like using signed URLs would be much more costly since you can't cache them for very long.
We just released Mastodon 4.4.2, 4.3.10, and 4.2.23.
These versions all contain some internal Ruby dependency updates for security. Version 4.4.2 also includes some fixes, primarily for user interface issues.
Full release notes and update instructions are available on the GitHub releases page. #mastoadmin
v4.2.22