NodeBB Files

Release build (minor) of NodeBB @ 2026-09-16T23:18:19.874Z

v4.16.0 (2026-09-16)

New Features

• allow admins to hide topic event types (#14824) (f2c968e9)
• add Messaging.isRoomMember() (#14779) (18925527)
• add action:messaging.markRead hook with previous read timestamp (#14777) (fcaeec1b)
• update chat room url with message index on scroll (#14738) (040b9967)
• mark flag notifications read when the flag detail page is viewed (#14747) (4d155cc9)
• expose category privilege copying via v3 API (#14670) (6203ebc9)
• add full name to ACP user search (#14671) (4700ccb5)
• hint when follow notifications are disabled (#14666) (a7cc7f42)
• activitypub:
• include contentWarning in post summaries and teasers (bfabeba6)
• include contentWarning in feed post data (c1636f4c)
• hide content and thumbs behind CW in templates (0b3433eb)
• support content warnings on incoming remote posts (c968c281)
• add category selector to hashtag follow, fix actor assertion (fea80171)
• add global hashtag follow feature (4e22def3)
• enable instance actor to follow remote actors (deeeb3d4)
• verify incoming rfc 9421 signatures (872c6178)
• sign activities with rfc 9421, fall back to draft (32494377)
• render remote emoji in actor names (d0cbe18d)
• render custom emoji in topic titles (44ca8f46)
• re-download stale emoji on serve (379f4bb7)
• hostname-aware custom emoji cache and proxy (f7376eab)
• allow plugins to handle incoming AP activities via plugin hook (2bf93aa9)
• announce bumped topics to followers (16d3f6d6)
• add staged delivery for topic replies (c3003933)
• log send pool failures via analytics.sendError (94b1ad5d)
• add allowList to ssrf.js for hostname whitelisting (711f2275)
• implement send worker child process for offloaded federation (664c9bb9)
• flags: support remote flag forwarding for chat messages (8462ac86)
• federation: add activities-by-type pie chart to analytics page (b23912c0)
• tags: add case-sensitive tag support with caseSensitiveTags config (#14690) (883c2175)

Bug Fixes

• messaging: skip existing members in addUidsToRoom to preserve join timestamps (f34e2e8c)

• activitypub:

• require author for federated chat message edit/delete (e717c3e9)
• cross-check signature against verified keyId, not raw header (fc282318)
• announce dereferenceable objects to relays (7abe2528)
• improve RFC 9421 interoperability (a57eb6e5)
• resolve string URIs and use resolveLocalId in inbox.flag (46ae1cea)
• skip undo.announce for pseudo-category cid -1 (38052864)
• return true from assert/assertGroup when all IDs already present (89d3d964)
• move fallback warning from worker to orchestrator (ef860a33)
• handle FediBuzz Accept with actor document as object (40ca8efc)
• add stateClass to Hashtags.list() for API consumers (1ad70560)
• parse createdAt as number in hashtag records (d758fbe3)
• limit activity dedup window to 10s (8f7471c3)
• use RFC 9421 registered algorithm identifiers in Signature-Input header (c5dc224e)
• correct assertion check in Out.follow (57095a45)
• correct assertion check in Out.follow (a0fdef70)
• use request protocol for rfc 9421 target uri (203e9a91)
• accept Content-Digest (RFC 9530) for Mitra compatibility (6190b45c)
• add required algorithm parameter to RFC 9421 Signature-Input header (bce41a39)
• reconstruct rfc 9421 target uri from host header (b49186b5)
• emit rfc 9421 signatures as rfc 8941 byte sequences (bb199f45)
• gate user-facing S2S endpoints on fediverse view:users privilege (f0368a2f)
• normalize webfinger cache keys and search handles (958cd2d6)
• harden split-domain vouching and self-link fallback (934ad5ee)
• harden webfinger query input validation (d6f95f14)
• prevent cross-domain webfinger cache poisoning (60c6333f)
• re-apply federation policy on redirect destinations (6c4692b7)
• route unhandled resource types through outgoing warning page (634fb152)
• validate webfinger content-type before parsing (be5f09a3)
• accept same-domain legacy actors via self-link fallback (6cca6a41)
• use sensible min/max worker counts (1d857512)
• handle unhandled rejections in handleResult and add .unref() to force-kill timer (18bdab7c)
• repair send pool drain loop and worker sizing (ce0765fe)
• add User-Agent header to fetch requests\n\n- Match NodeBB/request.js format: NodeBB/x.x.x (site-url)\n- Prevents remote servers from rejecting requests as bots\n\nAssisted-by: unsloth/Qwen3.6-35B-A3B-GGUF (634cb7d4)
• export SendPool on ActivityPub module for test access\n\nAssisted-by: unsloth/Qwen3.6-35B-A3B-GGUF (bbab962f)
• fix handleWorkerExit bug and fix sendWorker tests\n\n- Fix handleWorkerExit accessing task.queueId when task is undefined\n- Export SendPool on ActivityPub module for test access\n- Rewrite sendPool.js tests: reset state between tests, avoid shared worker state\n- Rewrite sendWorker.js tests: fix exit code expectations, remove unreliable tests\n\nAssisted-by: unsloth/Qwen3.6-35B-A3B-GGUF (343b96b5)
• refactor send pool into send.js and fix critical bugs (612e8213)
• registration approval queue link in ACP user settings (#14825) (4688978a)
• filter fork topic events by category find privilege (#14823) (0af568a5)
• fall back to en-GB for untranslated strings (#14829) (3f3f85cc)
• translate plugin-supplied labels on the registration queue (#14830) (059bccc7)
• upgrade progress for system-message upgrade script (8f5ecab6)
• fire pluginHooks for /compose (2d15e006)
• fire pluginHooks for /compose (4b666b87)
• scroll chat/notification dropdowns to top when a new item arrives (#14776) (1c636334)
• don't show new posts alert on topic lists for the user's own posts (#14818) (2a2cf375)
• do not federate crossposts to private targets (3a6b81fb)
• bump themes for [#14794] (d0dd90b4)
• broken tpl in feed/item.tpl (92e4f805)
• prevent caching of responses carrying a CSRF token (#14787) (47e38583)
• add hashtag schemas to OpenAPI manifests (fb38d0fa)
• closes [#14765] (8f5f105f)
• load zxcvbn lazily so password forms keep working when the chunk fails to load (#14791) (1478c95f)
• prune expired topic view timestamps from the session (#14789) (a21aaf17)
• ask for the current password when an admin changes their own password from ACP (#14790) (6b47ea82)
• hide "none found" notice on trending plugins tab when plugins exist (#14785) (edc15e5e)
• use parent category as up link, closes [#14784] (e661c60f)
• don't splice the viewer's own chat room into another user's room list (#14781) (86827de3)
• keep the server timestamp on live chat messages (#14778) (2f3df9ca)
• bump emoji plugin (c0921855)
• browser title rendered LTR for RTL users when the page title starts with Latin text (#14780) (561de8a4)
• register template helpers before ajaxify can render a page (#14775) (c2da26f1)
• only allow sort by flags for privileged users (9af2e8b8)
• dont allow sorting by email in user search (dba251ba)
• show which login field is missing instead of a generic error (#14772) (b1559700)
• on notifications page don't show counts if post notifications are not visible (0290c45b)
• category/tag filter dropdown taller than the viewport (#14769) (3391a3d9)
• filter out notifications that are from pids that are (3bfdf622)
• during post creation don't use posts.uploads.sync (1e490426)
• unread/flags nav counts not rendered when relative_path is set (#14755) (7457d23e)
• enforce response size during streaming and require Digest for inbox requests (cee29dc5)
• add one more escape for title (b8736936)
• add missing escape (92a7fd59)
• use new helper in topic and posts (0796f50c)
• include fullnameEmoji in key places in core (873d0277)
• escape attributes in renderShortcodeEmoji helper (7523dd7b)
• bump themes for [#14748] (e371cbee)
• closes [#14743], handle uid groupnames in isMember methods (c1081a0c)
• issue where wrong cid was passed in when remote uid was posting to remote cid, fixes regression caused by [6f5607] (eadc8e29)
• remove extraneous comments (aaff6c07)
• lang keys (42f5f46a)
• add missing dep (d2fee2b8)
• lint (8ef4b72a)
• regressed tests due to webfinger strictness checks (8b008cdf)
• fallbacks, manually executed (c20d2e85)
• use thread instead of process for AP workerpool config (301f7c7b)
• update maxWorkers strategy to set up more workers per CPU as AP is mostly network-bound. Previous was 1-per CPU (min 1); now using os.availableParallelism() * 2 (a0fa2456)
• debug logs (e8b94750)
• match the same icon in topic.tpl for merge (419ef355)
• security:
• harden login timing, user status, and groupTitle (d271e20c)
• harden login timing, user status, and groupTitle (12860ab5)
• flags: support remote actor URIs in Flags.rescindReport (d111ae86)
• auth: [#14793], clear forceLogin before session regeneration to prevent double re-login challenge (40fc44fa)
• test:
• assert relative localPath in getEmoji test (59139cc9)
• adjust ActivityPub privilege tests for remote uid/cid checks (aeb0a3e6)
• federation: resolve analytics lint errors (#14703) (ce136e06)
• activitypub/jobs: only run drainLoop on primary process (5c5dc763)
• admin/federation: add pie chart, no-data state, and legend spacing to analytics (0eda2d6b)

Performance Improvements

• dont map twice for keys (4d6379d1)
• dont stringify unused value (59872135)
• use a single filterUids (3b76bf79)
• use index and get watching and everything above (e065409f)

Refactors

• remove deprecated chat socket.io methods (a2aa265b)
• change worker count (883953d3)
• dont log timestamp parse error (7ca81b45)
• new topic notification (708ccddc)
• remove postcss-clean (d1ee699f)
• add invalidationVersions to cache dumps (3bd3685b)
• dont promisify pluginHooks already async (6d4b0ec6)
• update lru/ttl cache to use a version map (#14786) (4828d899)
• update swagger parser to 13.0.0 (#14771) (e683f0fb)
• load read & unread notifs parallel (009912ca)
• use uid from postData for isPostOwner check (9aa0e6c6)
• load tid once (98cb2582)
• activitypub:
• simplify hashtag follow to use Out.follow (28a85299)
• use Signatures.sign in sendWorker instead of custom signing (4181b3d5)
• replace bespoke worker pool with workerpool (5eeeb9dc)
• use ssrf.js for DNS rebinding protection in sendWorker (f15db030)
• request: extract SSRF and DNS rebinding protection into standalone ssrf.js module (2b3e3fb6)

Tests

• activitypub:
• regression tests for inbox.delete topic ownership (7bf2e010)
• stub webfinger requests to avoid 10s DNS timeouts (c5673a21)
• eliminate outbound network calls from activitypub tests (748fec0e)
• add unit tests for sendWorker and SendPool (phase 5)\n\n- Add sendWorker.js tests: IPC protocol, SSRF protection, timeout, crash\n- Add sendPool.js tests: lifecycle, dispatch, result, requeue, shutdown\n- Update APSEND.md with phase 5 findings\n\nAssisted-by: unsloth/Qwen3.6-35B-A3B-GGUF (03609b1a)
• one more psql test fix, save session after setting forceLogin=1 (661a467a)
• explicitly save session before redirecting (0f8a0603)
• increase timeout for tests (580ade9e)
• add logs to flaky register/abort test (cb461e98)
• move cache.del to after succesfull transaction complete (46c12b30)
• move cache.del to after query like other dbs (539a1f78)
• add some more debug to flaky test, submit agree-terms (624112f2)
• log failing response (284506de)
• increase timeout for tests (1f1bdede)
• wait for notifyCategoryFollowers to complete (ec0b066f)
• update build test (3c0051ed)
• fix spec (c7f80195)
• fix spec (f9553a5d)
• fix load topic title that's already passed to notification functions (43a1d59e)
• no idea how this passes on CI, add missng awaits (3339e421)
• fix emoji AP test on windows (c4f949d0)
• add more info to flaky test (499df7dd)
• delete topic during post (d85c9cdd)
• remove log (f5a09832)
• log failing value (2ad7a538)
• add debug info to failing test (ee7b2874)
• fix messaging test, delete end point changed (dd3d8913)
• maybe fix category test (60657e16)