NodeBB Files

Release build (minor) of NodeBB @ 2026-02-27T19:20:49.364Z

v4.9.0 (2026-02-27)

Documentation Changes

• added new ACP routes (82b7f429)
• add missing privileges prop to world schema (4ef9d5fa)
• add bookmarks to postobject in /world (07f9eda9)
• add bookmarks to postobject (9a15b571)
• chat teasers are different (91323dce)
• add teaser to postobject schema (0178e4fb)
• OpenAPI schema for rules re-ordering route (072dd1ae)

New Features

• support the magic break string '[...]' in content, such that if found, outbound federation will use all content up to (and including) that string in its summary (cd357aaf)
• add a '[...]' to the end of the generated summary when federating out articles (fep-b2b8) (bf0f5228)
• prune topics remote cids, closes [#13461] (20eb02f1)
• change notif controls to toggles (523e3b49)
• add invitedBy to user info page, closes [#13972], closes [#13997] (1dae3d22)
• quick create on world page (5df2b8b7)
• allow configuring unreadCutoff per user, closes [#6811] (8c6ce198)
• introduce new topics:crosspost privilege (5c35dc86)
• add guest-cta.tpl and lang strings (9da67474)
• track all caches created in acp (9ac507e5)
• closes [#5867], dont email if user already read notification (a55651d1)
• allow re-ordering of auto-categorization rules (fd43368a)
• add group tx key (45ff9f0d)
• eslint10 (#13967) (62d88555)
• closes [#13968], add sitemap cache duration (fe35ad4f)
• add data-field values from tpl into search dict (abcfc1a5)
• closes https://github.com/NodeBB/NodeBB/pull/11970 (007efc21)
• closes [#13961], rename ban-reasons to custom reasons (0eaf2bee)
• ban/mute reasons (#13960) (d086ed2c)
• show bodyLong in notifications, closes [#4767] (30541a96)
• allow converting pasted images, closes [#10352] (472a8fc1)
• add language key for untitled topic draft (0125ab55)
• add missing lang key for light/dark (870c6310)
• closes [#13009], add dedicated test smtp button (c8488012)
• closes [#13203], make users room owners on private chats (61662f19)
• topic crossposts generate topic events, [#13908] (0c79eaa5)
• remote account banning, [#13904] (560ad81f)
• opportunistic backfill, [#13895] (33c2de9c)

Bug Fixes

• [#14003], set ACAO header on webfinger responses (415602d8)
• restore coveralls script, update gh action to ignore failures (3fab2074)
• change && to ; (95ea376a)
• add --no-fail flag to coveralls invocation (c6ddef67)
• dont show /register page after req.session.forceLogin is set (0ef27187)
• escape fullname in chatWithMessage (64a072c9)
• send guests to login page if they access uncategorized topics without local posts (b4f8e20b)
• remove allowed check from notes.assert as it is already done downstream in topics.(post|reply), update privilege check to inherit world privs if passed-in cid is remote cid (64724629)
• NaN on ap post delete (53b208b7)
• guard against crash when malformed URL present in deliverees (6a0663cd)
• remove unused ACP route (f7d87ecb)
• remove unused ACP controller, add instance count to federation > safety (a35b7d73)
• allow break string and summary limits to be defined and applied (29111ba7)
• make tables responsive on relays/rules pages (0071216c)
• don't show magic break string in regularly parsed posts, tests for ap mocks lib (b460506e)
• remove preview in mocked note for now, due to lack of support (fep-b2b8) (31773694)
• topic purge (e484899d)
• upgrade script, dont remove while processing zset (7a23e291)
• dont store ap tids in topics:tid (e8ef2e5c)
• closes [#14010] (003e6d07)
• hook name (d6cf5fba)
• add missing timestamp (68eba728)
• gate /world behind ensureLoggedIn middleware (bcfdbf7c)
• [#14007], deny access for guests to topics in cid -1, unless a post from a local user exists (de4f016f)
• closes [#7221] restrict cropperjs box to profileImageDimension form ACP (f2bbf369)
• category search shoudn't return results that match in the cid part (75477202)
• favicon url (1a35131a)
• allow passing a selected category markup (309d3003)
• overflowing images on /world (438b4f62)
• missing cb in world IS handler (ab62a8e4)
• closes [#14002], add max-height (9c5ffe36)
• fallbacks and latest translations for nodebb.user (053ce073)
• keep chat input in view after adding new messages (2f88f776)
• [#14001], regression from adjusted acceptable types list (80f61022)
• don't publish name on generated titles (9fbdc792)
• closes [#13999], delay cache creation (42362ccf)
• when registering through an invite, prepopulate the email field on /register/complete with the email (2015777f)
• bump persona (a68311de)
• bump harmony for world page changes (e76f8a60)
• only call syncUserInboxes on post create if local uid creates post in cid -1 (45d2e628)
• schema... not sure why I need this all of a sudden (3e2070b2)
• minor cleanup of quick-reply args; opts.body (a9c2457f)
• render new post in feed when posting via quick create (eb0aa6d8)
• call syncUserInboxes asyncronously (5da35bda)
• update quickreply.init so that it can be passed an options parameter, generate proper draft id for world page (94df9738)
• lint, unused class (4bf0f61e)
• increase categories sent to 1k closes [#12841] (3c08b730)
• [#13993], encodeURICompoent pid since it can be AP url (b607a80a)
• wrong wrapping of route (bb9033af)
• dont call getInbox for /recent (1ca9841c)
• [#13990], don't blindly set user field on notification objects (8c8782fd)
• unbans not triggering if user data is loaded wit 'banned' property only (0b7df274)
• [#13894], buildCategoryLabel helper checks fa-nbb-none (4b9b3648)
• missing gap (e16c5677)
• gate crossposting behind new topics:crosspost privilege (fe8fd9d6)
• [#13983], show only local categories in ACP privilege selector (c4411423)
• add example value for failing schema test (292e70f7)
• lint (1598004e)
• bad relative path (7eb49136)
• regression from refactor of uploadedpicture refactor (b95cd882)
• organize rules and relays logic to separate methods (78d7130c)
• [#13969], bump mentions (4a38d67c)
• lint (9ebd8f4f)
• [#13962], infinite scroll and pagination not working on world (9f1369a2)
• bump themes, l10n world sort label (76fe4bdd)
• rename translations as well (433d318f)
• cant store URL in nconf (6cb6cf7d)
• update tx config (1e109c2e)
• derpy api page (aef0bd97)
• guard against incomplete objects when building context/chain (13422bc8)
• closes [#13953], show uid pic in post queue notification (a8a1089e)
• remote post notifs missing bodyLong (18c04d34)
• double-ajaxify on socket connect (381334f4)
• dont update teaser for public chats (149d649a)
• acp graph labels, dont use indices (17bfd73e)
• closes [#8642], stricter username check (94885109)
• if there is no hr create one (f249699d)
• closes [#13240], move the updatedTeaser to the top of the recent chat list (0a9c5d30)
• regression with updateHistory (b7ea2767)
• [#13939], dont append / if url is empty (2dc49c82)
• acp category selector when category has image (ef75f1ba)
• pagination always getting set to default (eab4025b)
• folder name (f05f8b63)
• proper attachment generation on replies, fixed replies getting thumb attachment when it wasn't part of it (69c5f941)
• closes [#13734], set process.env.NODE_ENV early using argv (252d1d09)
• update buildRecipents to add option to skip target creation step, update ap actors for note to not bother building targets (ad27347f)
• notes announce cache, use cache when retrieving tid posters (eb27b964)
• optimizations (e697d600)
• cache detection logic in context parseItem executing earlier than needed causing false positives (f9affbad)
• closes [#12458], on socket.io reconnect (13bf64c9)
• restrict topic backfill to logged-in users when browsing to a category (0262bb83)
• replace attachment generation logic in notes.public (428b6e73)
• [#13900], assertion re-index (6383bb58)
• simplicity tweak (39582cbd)
• export sendMessage as _sendMessage for use in ap jobs lib (4bab9fb4)
• [#13892], logical flaw (8b7d350e)

Other Changes

• fix lint errors (fc474238)
• remove unused (68acc059)
• remove useless assignment (652629df)
• [#13982], dont use btn-group on dropdowns (803473ca)
• //github.com/NodeBB/NodeBB/issues/13982 (26af029a)
• remove unused regex (1747cf81)
• filter at the end of user.search (dcbbc187)
• invalid-username doesnt have params (fb460725)

Performance Improvements

• don't call getUids on every topic load (8a60d9c2)

Refactors

• add topic-await-review notif text (bac9f1f7)
• ActivityPub ACP page to its own top-level section with sub-pages (f0d2be35)
• allow passing an array to topics.purge and topics.purgePost… (#14018) (e4c945f6)
• dont store ap pids in posts:pid (de1f04d9)
• closes [#7155], (bb7be8c5)
• shorter check (a70a62cc)
• isHookValid (63c9a6e0)
• add icons to selected/all (970a4204)
• users table (e3d7abe0)
• pass options to thumbs.load (0424728f)
• slugify isn't heavy anymore (fb95f8a3)
• don't create giant array, process in batches of 500 (ed8cbd6e)
• use opendir instead of loading all files (ce9bd0bb)
• teaser object schema to its own file (1869b807)
• privileges.global.can works with array of privileges (fd6984d2)
• shorter hook (a8a85bcb)
• updateTags to modern js (3756a8fe)
• shorter check (b0f2fead)
• cache page to table (7336c58c)
• emoji replacement code into helper function, remove use of regex on untrusted user input (9608cce6)
• add createFieldChecker (#13973) (c65af199)
• run searches in parallel (9a198c38)
• shorter (3f67a000)
• remove unused url (7f4d537d)
• get rid of url.parse in core (157959df)
• use translator.compile which escapes % and , (a2f4c185)
• shorter (b3dc7f43)
• remove log (ff1376b3)
• get rid of cache for tid posters, was never cleared (065abbf2)
• dont use module, explodes on latest webpack (a4e3fe10)
• use lru directly (c8cd34bf)
• format (070d77fd)
• shorter tpl (e2fc349d)
• get rid of global.env, use process.env.NODE_ENV (07d1f224)
• make custom user field icons fixed width in the acp (2ded6813)
• use local cache for plugin isActive check (7ac5446a)
• Actors.getLocalFollowers to Actors.getFollowers, can pass in both local and remote ids (fac31859)
• move username check to createOrQueue (37675689)
• checkUsername function https://github.com/NodeBB/NodeBB/issues/10864 (7e27da61)
• shorter params (05e76edd)
• move ap jobs to its own file (c595edb4)

Tests

• remove assert (872d7c74)
• remove old test (59f35e6f)
• update tests to allow title-less topics (b1c097f8)
• show topic data on test fail (6e6900ba)
• fix redis, from was string in map, but int in notif object (a8c68ddc)
• fix spec (0e2a42d5)
• fix missing priv in tests (5c73d338)
• add test to check picture!=uploadedpicture (0c2ab232)
• fix hasOwn (d52b1359)
• group members test (ffc4c0dd)
• add more info to failiing response (87fdca2a)
• fix spec, remove log (05dd46c3)
• favicon test (ca237e67)
• dont return cover:url if its not requested (e4d852b4)
• fix username test (db07456b)
• fix test that explodes on new URL (694b545c)
• another test fix (94873c33)
• fix file name (05d4d857)
• fix spec (d601847a)
• fix tests (0d19294a)
• fix tests, update mentions composer (d6c69465)
• fix typo in spec (43be594a)
• fix spec (d1a39554)
• add missing spec for admin page (30014f41)
• remove unused (018e1c5f)
• fix spec (bc1593b2)