NodeBB Files

Release build (minor) of NodeBB @ 2026-05-27T15:34:05.321Z

v4.12.0 (2026-05-27)

Documentation Changes

• open api schema for /intents/:intent (77819720)
• openapi spec for new chat search API (aabe86d8)

New Features

• add privilege gate behind category outbox AP route (8e98325e)
• add a nbbRequire that works with esm/cjs (56606f3b)
• navigate thumbs by keyboard (0b684d5b)
• link to thumbs in preview modal (dbb75efe)
• federate ActivityPub Delete when chat messages are deleted (f8d34d41)
• [#14277], handle remote chat message deletion (d69b6e8e)
• handle incoming like/dislike/follow Activity Intents, publish support in webfinger (8f7cb7d9)
• Create Activity Intent handler landing page controller + view (43e383a0)
• send some content and inReplyTo for the Create intent (2a26a62e)
• invoke intents.trigger() on guest topic creation and reply actions (965e0dd9)
• invoke intents.trigger on guest vote attempt (f93f45d1)
• server-side rate limiting in intents.query (ec232d32)
• Activity Intent trigger modal (2aa97baa)
• open intent registration modal in login and register pages (c4871938)
• basic register() method and modal tpl (75424886)
• expose object activity intent, [#14253] (b76ef6a7)
• restore note assertion on redirectToPost controller, update /ap route to redirect guests to login for 3b86 Object intent support, [#14253] (b89b5d4e)
• use separate bootstrap file to build schema data before api schema tests (8e818fd9)
• closes [#14251] (6f3d6884)
• allow owners to move misplaced topics (#14227) (7fa7a714)
• allow array of privileges for categories.can (7599a125)
• show muted users in /users and acp page (85b980b5)
• add new localisation, Burmese (Myanmar) :tada: (b082d971)
• add blocked file extensions (blacklist) to complement the existing allowlist (#14229) (41675ecf)
• implement additional checks to fetchPublicKey (6b3801fa)
• add rate limiter to fetchPublicKey, one failing request at a time (d393de7a)
• [#13707], moderators collection for categories (c51a0ad6)
• [#14202], naive fulltext search on chats list (3f311050)
• activitypub: implement FEP-baf5 administrator collection and discovery (6a0c4fd7)
• schema.js: add filtered execution by path keyword (d85d4a1c)
• federation: add hostname and type filtering to errors page (03660664)

Bug Fixes

• add missing return (a6c4b86e)
• module (08bf19b6)
• more tx fixes (f08422a3)
• don't escape [ & ] breaks nested translations (730e4dac)
• relax tx escape/unescape (02ce0581)
• delete tid/pid when post is coming from post queue (73f908b3)
• tests, when removing the announce wrapper, resolve the sub-object (b1e516b9)
• don't overwrite pid in POST /api/v3/topics (7f08fb95)
• custom routes bypassing /admin checks (19c7473b)
• correct Announce(Delete) tests to use remote category and post (ba9db006)
• on the manage uploads page files can be uploaded to the uploads folder (8d060047)
• additional checks for Announce(Delete) (2c5fe7e1)
• [#14293], close crosspost modal when navigating away from topic (29e09dd3)
• [#14292], rtl css fix for cropper.js (6922b23d)
• relative_path test (6129c77e)
• escape cover:url/picture (6b281edd)
• closes [#14289], index conflicts in createIndices (e73e0d1a)
• rtl resizable issue, closes [#13340] (0594bff8)
• check xmldom dependency since it's required in file.js (44217a07)
• quote filenames (4fb7f5b3)
• download xml files (7142c008)
• language keys for new intents feature (3e8f7798)
• guard husky postinstall script behind NODE_ENV check (0ddec59e)
• postinstall script (b640ba4a)
• sanitize xml files in uploads (2bde875f)
• [#14274] - add postinstall script for husky auto-install (b291c4aa)
• [#14273] - clear ap:retry:queue entries without digest (b5809172)
• update intent display map to include the square brackets (d7338d5d)
• unworking code from an errant AI refactor (8fa6987a)
• mapIntentNames calling wrong translation method (15ed75d0)
• revert added code that did not do what it was meant to do (567fae09)
• update redirectUidToUserslug to handle remote ids (a74f426a)
• navigate to post directly (ce231176)
• pass toPid to front-end too (1d90e53c)
• invoke intents trigger on world page items (e7b1d73b)
• handle registration not showing up in UI if there were no existing handlers registered (a96ffb8a)
• interpolate parameters into template string, add schema for new route (15725b38)
• use storage module instead of localStorage directly (ebd903f0)
• save template in localStorage as well (b8ed48c3)
• show supported intents in modal (5288f773)
• update modal to stay open on handle registration (423e9d9d)
• front-end logic (getters, setters, refresh code to call backend), backend code to query webfinger to get valid intents (8422ec26)
• [#14269], don't treat test.test.test as url in input-text (ea92fb97)
• decode request path before checking for privateUploads (b3d6b2c6)
• on user delete remove from users:muted (bec23aea)
• add escaping to id/type/activityType in AP/errors ACP page to guard against improper user data (a0ffa2ec)
• [#14208], off-by-some error on getUsersFields (b8af9375)
• add missing l10n file (4552c908)
• [#14219], show crossposted topics in unread (6cffd1c2)
• 'on' not 'true' (6d988c76)
• simpler logic for parsing peertube objects, [#14220] (2523d95b)
• broken test, overly strict (and wrong) conditional, remove content-type check (3604452f)
• add fixed-window rate limiter to fetchPublicKey (8d730de7)
• add 50ms delay before checking activitypub._sent (03b56eac)
• syntax error (5e2bcc31)
• syntax error (6e1ecfbc)
• wrap calls to activitypub.out methods in setImmediate so local methods have a chance to finish before requests start going out (814076e0)
• test manual dispatcher (607defbb)
• [#14202] (4f71a0e7)
• [#14203], checkCache.get returns null when fetch is used directly (9c30f1d4)
• activitypub:
• escape rule.value in Rules.list (68bd6137)
• regenerate topic title when post with generatedTitle is edited (359077a2)
• [#14275], delete topic when Announce(Delete) targets last post (412dd61b)
• use /uid/{uid} for local user mention hrefs in Mocks.notes.public (26e595e1)
• save digest in retry queue for failed message delivery (4f58b3e4)
• skip actor resolution when federation is disabled (f0bf44fd)
• handle before cursor for upward infinite scroll navigation (699c3593)
• ap: use correct key 'ap.errors' (dot) in pruning cron job (1e0ce6e5)

Refactors

• don't log both messages (564185df)
• use hooks to update thumb counts (16c43a4d)
• remove Announce(Like) handler in favour of removing the wrapper and delegating to inbox.like directly (it has more checks). Preserve the actor assertion check as that is not done on sub-objects (0c37a496)
• switch to globalThis.nodebb (04abb3e9)
• use require (7c61cf15)
• add more tags, normalize value (7d6522a1)
• tests back into individual it() blocks (66d8029e)
• fix typo in error message (ae2592ba)
• add muted field to user (2f3b3ecf)
• add guards against Error [ERR_IPC_CHANNEL_CLOSED] (18dd8125)
• break apart helpers.generateCollection into two smaller methods for situations where you have the items already (76246949)
• activitypub: simplify signature verification in middleware (f6b5cd82)

Tests

• fix flag test (a0a9f2b2)
• fix relative_path test (c4efdeb9)
• fix more picture tests (446539fb)
• fix user test (b5a77598)
• add more tests for xml uploads (2c1dcfb4)
• fix merge test (fbd8dbc4)
• fix helpers.mocks.create to accept custom actor (681b5f94)
• add inbox-cids test suite for uid:<uid>:cids sorted set (902cdfb2)
• set thumbs during topics.post (a66d98a5)
• add missing await (0900ab24)
• fix muted tests (8707f891)
• fix nav tests (1fe4ab5d)