Catodon 26.10.4 - Security release
Security release - please update. 26.10.4 is a security release on top of 26.10.3: a fix for hashtag handling ported from Misskey, and two libraries updated for published security advisories. Every instance should update.
Upgrading
• Container image: pull 26.10.4 and restart. There is no migration and nothing to change in your configuration.
• Source install: update the code, reinstall the dependencies (pnpm install --frozen-lockfile), rebuild and restart.
What it fixes
• Hashtag handling no longer does unbounded work on an overly long tag, a fix ported from Misskey 2026.10.1 (their private security fix be48948a). The hashtag endpoints and the hashtag stream now refuse a tag longer than 128 characters. An ordinary hashtag is matched exactly as before.
• fastify, the web framework, moves to 5.12.7, which includes the 5.12.6 security fix.
• sanitize-html, the HTML sanitizer used for posts from other servers among other things, moves to 2.18.1 for its published advisories.
The same changes are on develop through #704.
:catodon:
#catodon