We've upgraded our Mastodon server to v4.8.0-alpha.2+mementomods-2026-09-06. That is 83 new commits from upstream since our build exactly two weeks ago.This one matters more than the usual weekly round, because Mastodon 4.7.1 was a security release and it is now folded into our build.
🔒 Security
- Fixed a password authentication bypass in two factor auth for LDAP, PAM and SSO accounts (https://github.com/mastodon/mastodon/security/advisories/GHSA-vx32-x96w-qq65).
- Fixed a denial of service when processing malformed JSON-LD activities from other servers (https://github.com/mastodon/mastodon/security/advisories/GHSA-vgm8-frgh-rh2v).
- Fixed disabled staff accounts still having access to the admin API (https://github.com/mastodon/mastodon/security/advisories/GHSA-62j4-hvj7-px3f).
🔧 Fixes & improvements
- The follows and followers lists now say "Today" instead of showing an hour count (https://github.com/mastodon/mastodon/pull/40367).
- Searching with just "from:me" works without also typing a keyword (https://github.com/mastodon/mastodon/pull/40327).
- The search field no longer steals focus at random (https://github.com/mastodon/mastodon/pull/40271).
- The 404 page now has a link back to the front page (https://github.com/mastodon/mastodon/pull/40369).
- Long descriptions no longer overflow on the Overview landing page (https://github.com/mastodon/mastodon/pull/40272).
🛡️ Moderation
- Moderators and admins can see media reports for suspended accounts again (https://github.com/mastodon/mastodon/pull/40274).
- The invite form asks for a written reason when approval bypass is off (https://github.com/mastodon/mastodon/pull/40332).
- The email block domain filter survives pagination (https://github.com/mastodon/mastodon/pull/40254).
🚀 Under the hood
- The 5.0 redesign continued at a fast pace, 35 of the 83 commits: new column headers across almost every page, the mobile navigation bar and menu, the composer covering the viewport, quote posts in the composer, and a batch of design tokens. All of it stays behind a flag, so nothing changes for you yet.
- Mastodon now keeps local counters of which features lead to a follow, so the developers can see which parts of the interface actually help people find accounts. These are plain daily counts in our own server memory, they expire after six months, they hold no account names or identifiers, and nothing is sent anywhere.
- Some of the 4.7 database migrations were made safe to re-run if an upgrade gets interrupted (https://github.com/mastodon/mastodon/pull/40264).
- Account creation no longer fails on an encryption configuration error during setup (https://github.com/mastodon/mastodon/pull/40275).
📦 Dependency updates
- Routine bumps and translation updates.
Source code: https://github.com/mementomori-social/mastodon
As always, if you notice anything unusual or buggy, please reach out to me or any of the admins. Enjoy your time here, and feel free to message me with any questions or thoughts.
#MementoMoriSocial #Mastodon #MastoAdmin