Catodon 26.10.4 - Security release

Linked to https://codefloe.com/catodon/catodon/releases/tag/26.10.4

Security release - please update. 26.10.4 is a security release on top of 26.10.3: a fix for hashtag handling ported from Misskey, and two libraries updated for published security advisories. Every instance should update.

Upgrading

• Container image: pull 26.10.4 and restart. There is no migration and nothing to change in your configuration.
• Source install: update the code, reinstall the dependencies (pnpm install --frozen-lockfile), rebuild and restart.

What it fixes

• Hashtag handling no longer does unbounded work on an overly long tag, a fix ported from Misskey 2026.10.1 (their private security fix be48948a). The hashtag endpoints and the hashtag stream now refuse a tag longer than 128 characters. An ordinary hashtag is matched exactly as before.
• fastify, the web framework, moves to 5.12.7, which includes the 5.12.6 security fix.
• sanitize-html, the HTML sanitizer used for posts from other servers among other things, moves to 2.18.1 for its published advisories.

The same changes are on develop through #704.

​:catodon:​
#catodon

Catodon 26.10.3 released: Update Node.js in Docker

Linked to https://codefloe.com/catodon/catodon/releases/tag/26.10.3

Release 26.10.3: 26.10.2 plus the Node releases of the October 2026 security advisory (advisory), and follow-ups from #663 that came after 26.10.2 was cut.

Update not necessary if you're on a bare metal installation - just make sure you have updated your Node.js to the October 21 security release - and have restarted Catodon afterwards.

​:catodon:​
#catodon

New "Videos" page and timeline in Catodon

This new feature allows you to watch peertube videos as intended, subscribe to peertube channels and follow them there, and also subscribe to youtube channels through our RSS feed feature. Just merged (so expect some changes in the following days), just deployed on catodon.rocks: look for "Videos" under "Show more" in your navigation bar, or add the Videos timeline through "Customize timelines" in Settings.

​:catodon:​ 📹 ⏯
#catodon #peertube #youtube

Catodon 26.10.0 "Bongo Cat" released!

Linked to https://codefloe.com/catodon/catodon/releases/tag/26.10.0

This is a big one! Caught up with Misskey 2026.10.0, added ActivityPub C2S API support (we know there are not many clients, but we want to do our part for standardization in the Fediverse), added post languages and language filters, replaced Redis with Valkey and many more - read the release notes for a full list of everything we did this month!

​:catodon:​
#catodon

Catodon 26.10.0-rc.1 released!

Linked to https://codefloe.com/catodon/catodon/releases/tag/26.10.0-rc.1

Major changes:

  • The bundled in-memory store is now Valkey instead of Redis. The app itself is unchanged: config keys keep their redis names and an existing Redis still works, but Redis is now an untested compatibility path rather than a supported option. Follow docs/upgrading-to-valkey.md in order: check which Redis wrote your data, drain the job queue, back up, then switch — Docker installs by renaming the service to the Valkey image, bare-metal installs via the distro's Valkey package. On Redis 7.4+ the data file cannot be reused, so notification history is lost.
  • Dependencies now track Misskey 2026.9.0 instead of Sharkey's: backend packages are at the versions Misskey 2026.9.0 runs, on new majors of Fastify, BullMQ 6 and the TypeORM 1 database layer, with the Node 24 image and pnpm 12 for source installs.
  • ActivityPub client API (client-to-server) is on by default. Apps identified by a web address can sign in and post, read and upload for authorizing accounts. Turn it off under Control Panel > Federation > Policy if unwanted.
  • Trending links, after Mastodon: server-side ranking, an Explore Links tab, and moderator review, with an opt-in mode to trend without prior review.
  • "Also discussed in": posts sharing a link are listed on the post page, alongside forum cross-posts.
  • Like and repost counts now match the origin for posts from Mastodon and Catodon servers.
  • Posts carry their language: composer picker, per-account default, federated both ways, and exposed on the Mastodon API.

Admins: BullMQ 6 needs no queue drain; Meilisearch re-indexes posts once on first start.

Full details with the stable release.

​:catodon:​
#catodon

Sharkey migration compatibility: no-data-loss window closes at end of 26.x

Attention, admins!

So far, all of Catodon's database changes have been additive - even though we've removed or replaced several Misskey/Sharkey features, nothing has been deleted at the database level. This means Sharkey admins trying out Catodon can currently migrate back with zero data loss if they change their minds.

At some point, though, we want to do a proper cleanup of the database. So we're announcing our plan now:
Catodon → Sharkey migration with no data loss will be supported through the end of the year (all 26.x releases).

Starting with 2027 releases, migrating back to Sharkey will still be possible, but will most likely involve some data loss in secondary features.

If you have any questions, point them to
@panos@catodon.rocks - replies here may take a bit longer to notice.

​:catodon:​
#catodon #sharkey #misskey

Reintroducing Catodon (after 6 months of active development)

A little bit of history

Some of you may know that I was in the core team of Firefish, which is now an abandoned project, but made a splash back in 2023. I loved the project and its community, but as months were passing I got confused by its (lack of) direction and leadership, so in late 2023 we decided to fork Firefish with another core team member, Namekuji, as the lead dev. The new project drew attention and raised expectations at first, but lack of time (and loss of interest) led to the lead dev resigning, leaving the project without a dev (my passion is UX, not coding). Since then I tried finding another dev to continue the project, but without any luck. So by late 2025 I had kinda accepted that Catodon is a dead project, and closed our catodon.social server. This is a very short summary of the project's first chapter.

Enter 2026, and to be honest, I couldn't let go of the idea of Catodon - but still couldn't find a dev who wanted to dedicate the time and energy to maintain a project. Then a friend (who works as a full-time dev) told me that I could even do it on my own, with the help of LLMs. Initially I kinda laughed at the idea, but then I thought that maybe it's worth a shot. The results were much better than I expected, so I set up catodon.rocks and got the project rolling again - this time, on my terms, and based on the latest Sharkey instead of -now outdated- Firefish (but porting its best features). And, six months and several stable releases later, we have a growing community, and recently two more people joined the core team - AntoineÐ, who, unlike me, is an actual developer, and Sproid, who helps with testing and QA - I firmly believe that open source projects do not need only devs, and we should find ways to welcome and involve more people in a meaningful way.

In defence of our choice to use LLMs

I know AI is a sensitive subject on fedi, and I understand the arguments against it. But here's what it's actually done for us: First of all, the project wouldn't exist without it. But even now that we have a dev on the team, we're keeping it in our workflow. In six months, it's helped us ship features that projects with several full-time devs would need years to build: forums with full Lemmy compatibility, an RSS timeline, federated blogs, a dedicated Direct Messages page with a chat-like interface, New/Hot/Active sorting for forums and microblogging timelines, a WYSIWYG editor for Pages and Blogs, native Mastodon API support, and multi-protocol login that lets you use Catodon as a client for your Mastodon, Pixelfed, or Misskey account too. It also recently helped us catch a vulnerability in upstream Misskey, which we reported and which has now been patched - meaning every Misskey fork will benefit. We've also used it to spot 13 Misskey security patches that hadn't been merged into Sharkey yet, which we flagged to the Sharkey team as well. And to be clear, AI isn't magic - we spend hours of real work on every feature, and everything is tested and reviewed before it ships. We also keep a close eye on Misskey and Sharkey upstream, so we can pull in security patches as soon as they land.

We're not going to pretend this settles the debate about AI, and we don't expect it to. More and more projects (including the Linux kernel) are utilizing LLMs - and there are actual, valid reasons for this. All we can do is keep being transparent about how we use these tools, and let our work speak for itself.

Why "Catodon"

When Catodon was announced, some people found it odd that we chose a name that resembles Mastodon, since we are essentially a Misskey fork. But I think that our latest additions make our vision clearer: we now have Mastodon-compatible quotes, you can follow hashtags in your Home feed (one of the most demanded features in Misskey forks), we use the same verification system as Mastodon, we have implemented a similar feature for automatic post deletion, and native Mastodon API support which allows Catodon to use Mastodon apps - but also to be used as a Mastodon client itself. We love Misskey, but it's a project that is not always very fedi-oriented, with many features (which we have removed in Catodon) being local only. We are big fans of the Fediverse and want to pay attention to interoperability. You will never hear from us about a "Catodon network" - our network is the Fediverse, and we are providing software for people and collectives to set up their own federated communities. We have improved interoperability with Peertube, Lemmy, ActivityPub Articles, and we intend to keep this direction, hopefully supporting features from other fedi platforms too. We are trying to unite, not fragment. And since Mastodon is still the most popular fedi software, interoperability with Mastodon is crucial for our project.

Home is whatever you want it to be

In 26.9.0, we introduced customizable timelines, which let admins reconfigure the default timelines for their whole server, or let individual users do the same for their personal timelines - including replacing Home entirely. Set Forums as your Home timeline, for example, and Catodon becomes less of a Mastodon alternative and more of a Reddit or Lemmy alternative. Or set the Media timeline (a masonry-style photo grid, like Pinterest) as Home, and it starts to feel like an Instagram or Pixelfed alternative instead - all on the same install.

Screenshot of Catodon's masonry layout, while logged in with a Pixelfed account.

What's next

With the recent expansion of the core team and our repo on Codefloe getting much busier, it feels like we're just warming up. Our next moves include defaulting to plain Markdown, which we feel is a better standard for fedi, while keeping MFM support. This way you'll be able to see posts the way they were intended to be viewed, no matter what platform they were sent from, and compose your posts either with Markdown or MFM. We will also implement language setting and filtering for posts, and we're keeping an eye on the E2EE messaging protocol being built by Emissary and Bonfire, and intend to support it as soon as it's ready.

On the technical side, Catodon was initially based on the latest Sharkey stable, which is now almost 18 months old (based on Misskey 2026.4). We have since cherry-picked commits from Sharkey's develop branch that apply to Catodon, keeping us reasonably current with Sharkey's develop - but we'll soon go further and merge selected fixes and changes from upstream Misskey, all the way to the latest version.

We will also implement the ActivityPub C2S API, alongside the Mastodon and Misskey APIs. Most platforms implement only the S2S (Server-to-Server) part of the ActivityPub spec, and use their own API for Client-to-Server communication - which has resulted in Mastodon's API becoming the de facto standard. We don't think this is ideal: the Mastodon API is owned by Mastodon and designed for its own use case. Since there is already an API spec in the official protocol, we think we should support it, even though it is not currently widely supported, and we'd like to encourage other projects to do the same. As we said above, we want to unite, not fragment.

Besides those plans, we are always open to new suggestions, so why not join our Matrix rooms (#catodon:matrix.org and #catodon-support:matrix.org) and our Codefloe repo (where we recently added a roadmap kanban) and help co-shape the direction of Catodon? We want this to be a project that brings people together - and makes us feel excited for fedi again!

See you on the free, self-organized webs =)

Panos, for Catodon

#catodon

Catodon 26.9.0 stable released!

Linked to https://codefloe.com/catodon/catodon/releases/tag/26.9.0

Catodon 26.9.0 - what's new

- Multi-server accounts - you can now sign in or sign up on any other Misskey- or Mastodon-API server, not just this one. Works with Pixelfed GoToSocial, Akkoma, and the Misskey family too.
- Customizable timelines - pick what fills your Home slot and arrange up to 9 tabs from Following, your other accounts, forums, RSS, antennas, lists, and more. Syncs across devices.
- New media timeline with a masonry layout.
- Quote posts that are compatible with Mastodon's implementation, federated via FEP-044f.
- Hashtag following - follow tags natively, federated, with a hover preview and Custom feed support.
- PeerTube video streaming - remote PeerTube videos now stream over HLS instead of just linking out.
- Blogs got content warnings and per-blog privacy settings, plus a raw HTML mode in the editor.
- Right-to-left language support - the whole UI now mirrors properly for RTL languages.
- ALTCHA added as the default self-hosted, privacy-friendly captcha option.
- A big security pass: closed several SSRF holes (URL previews, RSS fetching, JSON-LD verification), fixed a password-reset bug that let a moderator reset another admin's password, tightened 2FA/TOTP replay protection, patched a few data-visibility leaks, and pulled in ~90 hardening fixes adapted from upstream Sharkey. Nothing here was known to be actively exploited, but if you're running your own instance, update promptly.
- Plus a long tail of smaller fixes: broken federation edge cases (forums, blog permalinks, PeerTube lookups), a mention-notification race, sharper remote media, and assorted UI polish.

docker pull codefloe.com/catodon/catodon:26.9.0
or
docker pull codefloe.com/catodon/catodon:latest
For an existing installation:

docker compose pull
docker compose run --rm web pnpm run migrate
docker compose up -d
Full instructions:
https://codefloe.com/catodon/catodon/src/tag/26.9.0-rc.1/docs/install.md#docker
Migrating from Sharkey:
https://codefloe.com/catodon/catodon/src/tag/26.9.0-rc.1/docs/install.md#migrating-from-sharkey

Please take a db and files backup before migrating! Enjoy =)

​:catodon:​
#catodon

Catodon 26.9.0-rc.1 released!

Linked to https://codefloe.com/catodon/catodon/releases/tag/26.9.0-rc.1

Practically the second RC for 26.9.0 after 26.8.0-rc.1, since August passed and that release version is now outdated.

Several bug fixes/performance improvements since the last RC, and a big code/lint cleanup by AntoineÐ, plus updated documentation.

This is also the first Catodon release that comes with a pre-built Docker image
🥳
docker pull codefloe.com/catodon/catodon:26.9.0-rc.1
For an existing installation:

docker compose pull
docker compose run --rm web pnpm run migrate
docker compose up -d
Full instructions:
https://codefloe.com/catodon/catodon/src/tag/26.9.0-rc.1/docs/install.md#docker
Migrating from Sharkey:
https://codefloe.com/catodon/catodon/src/tag/26.9.0-rc.1/docs/install.md#migrating-from-sharkey

Please take a db and files backup before migrating!

​:catodon:​
#catodon

Catodon 26.8.0-rc.1 released!

Linked to https://codefloe.com/catodon/catodon/releases/tag/26.8.0-rc.1

Release candidate for Catodon 26.8.0

Some major changes:

Customizable timelines - configurable Home slot + up to 9 reorderable tabs (server-synced), admin default timelines/theme/language/forums, plus a new Media timeline.
Multi-server accounts - login with remote Catodon accounts, but also Mastodon, Misskey, Sharkey, Pixelfed, Friendica etc (any platform that supports the Misskey or Mastodon API).
Featured hashtags & profiles (Mastodon-style) with federation.
Mastodon-compatible rel="me" verification badges.
Remote PeerTube/HLS video streaming and video-post player UX.
ALTCHA bot protection by default.

A more detailed list will be published with the stable release.

​:catodon:​
#catodon