NodeBB Files

Release build (patch) of NodeBB @ 2026-09-02T21:20:37.096Z

v4.15.2 (2026-09-02)

New Features

• shift-click range selection when selecting posts (#14727) (f7668bd6)
• add filter:privileges.posts.delete, fired ahead of the lock gate (#14722) (8d9d0645)
• expose topic lock state to filter:privileges.posts.edit (#14710) (61126cc9)
• link pinned message timestamp to its place in the conversation (#14699) (8cb1be35)
• link chat reply quote timestamp to the quoted message (#14697) (90fc85da)
• show full category path on hover in category dropdowns (#14686) (0ea5c3dc)
• add missing object cache to psql similar to mongodb/redis (#14684) (4b93ab96)
• allow disabling all notification emails, closes [#5644] (46ac1ee6)
• crossposts: reconcile stale sort scores on topic read (#14681) (aa52e783)

Bug Fixes

• uid can be a groupname in groups.join/leave (857680ce)
• clean up active and orphaned tooltips on ajaxify transitions and chat modal actions (#14745) (3052ab03)
• closes [#14743], handle uid groupnames in isMember methods (9999d1eb)
• keep a readable name on converted pasted images (#14735) (c443898c)
• closes [#14729], handle purged topic/ deleted account (ec5503a4)
• add missing uid to getRaw, compare Strings (0cfa8308)
• closes [#14717], add uid:<uid>:blocker_uids (85da0d17)
• hide deleted main post content on (2db21463)
• scope chat modal delete-room handler to room controls (#14714) (a2899e2d)
• do not expose raw content of deleted chat messages (#14709) (c5351fc7)
• revert skin regression (8b6ecbeb)
• use normalizeReturnToPath for redirect validation (d99545fa)
• restrict x-return-to to internal paths (67555b4b)
• closes [#14702], helpers.redirect expects path to start with / (b4ebd4b0)
• validate theme id on admin.themes.set (24c9d560)
• retarget animated navigator scrolls after layout shifts (#14674) (5a76dfd9)
• anchor the assets/uploads strip in routeTouchIcon (#14694) (72f711e8)
• check upload folder containment in admin uploadFile (#14693) (12230a39)
• throw on invalid db during webinstall (7f5f0903)
• quick reply user status tooltip (63a542ce)
• [#14691], fix selector up themes (8979c218)
• user profile age off by a few days due to fixed-length year math (#14687) (7d573372)
• scroll chats list to the active room (#14683) (50b616d9)
• hide imagedrop overlay when drag ends outside of it (#14682) (616c6aef)
• don't display crosspost button if user doesn't have privilege (0cd65312)
• apply saved search preferences immediately (#14665) (95e4f9fc)
• bring chat modal to front on interaction so overlapping chat modals stack correctly (#14663) (f7f7bf2e)
• only offer categories the user can crosspost to (e9cfa61f)
• sync client category watch states with core so unread badge updates for watching users (#14648) (77518451)
• topic filter dropdown opening in wrong direction on RTL (#14504) (35756dfa)
• update stale template path for search filters partial (#14643) (118c6c6c)
• return error instead of redirect for banned uid on token-authenticated requests, closes [#12739] (#14639) (2c8379b7)
• activitypub:
• trim whitespace from signature parameter names in middleware reparses (038cc5a6)
• filter soft-deleted and scheduled topics from outbox (c03de9e9)
• crossposts:
• pin and unpin the crossposted categories too (#14680) (4f293ab4)
• pinned topics throw, tags unindexed, no bump on reply (#14658) (7403b018)

Performance Improvements

• only hydrate chat rooms that match the search query (#14734) (9f0b3451)
• select uploads on the routes that render posts (#14654) (a2d19d34)
• use .some for better perf, no need to filter entire array (22962f49)

Refactors

• only send to login if user has password (73035d5f)
• go to login when login timer expires (1eb8ace5)
• validate extensions first before processing upload (75e8771f)
• change schduled restore to happen first (f28200d5)
• if there are unread notifications open unread tab (bd21871c)
• follow up, clear cache on privilege change for crossposts (321df046)
• remove ttl on set, cache has it on init (86c9102e)

Tests

• fix getRaw test, voterUid is the owner so need to use another uid (aed03040)
• move federate posts to after unpin (da30471e)
• cover root and subfolder return paths (4a1c33d2)
• await unpin (a9e2f69a)
• on fail log data (1ef1cf17)
• unpin after everything else (c2016090)