Skip to content

Releases: NodeBB/NodeBB

v4.4.4

18 Jun 14:20
Compare
Choose a tag to compare

Release build (patch) of NodeBB @ 2025-06-18T14:20:41.218Z

v4.4.4 (2025-06-18)

New Features
  • link to post in preview timestamp (8c69c6a)
  • Add live reload functionality with Grunt watch and Socket.IO (#13489) (84d99a0)
  • closes #13484, post preview changes (14e30c4)
Bug Fixes
  • sanitize svg when uploading site-logo, default avatar and og:image (da2597f)
  • Revise package hash check in Docker entrypoint.sh (#13483) (6c5b226)
  • more edge cases (32faaba)
  • #13484, clear tooltip if cursor leaves link (0ebb31f)
Other Changes
Refactors

3.x security release

18 Jun 14:22
Compare
Choose a tag to compare
v3.12.7

3.x security release

2.x security release

18 Jun 14:22
Compare
Choose a tag to compare
v2.8.20

2.x security release

v4.4.3

09 Jun 15:27
Compare
Choose a tag to compare

Release build (patch) of NodeBB @ 2025-06-09T15:26:58.877Z

v4.4.3 (2025-06-09)

Bug Fixes

v3.12.6

09 Jun 15:32
Compare
Choose a tag to compare

Security release for 3.x

v2.8.19

09 Jun 15:32
Compare
Choose a tag to compare

Security release for 2.x

v4.4.2

02 Jun 15:06
Compare
Choose a tag to compare

Release build (patch) of NodeBB @ 2025-06-02T15:06:29.241Z

v4.4.2 (2025-06-02)

New Features
  • add action:post-queue.save (ebb88c1)
  • restrict access to ap.probe method to registered users, add rate limiting protection (e70e990)
Bug Fixes
  • return 200 for non-implemented activities instead of 501 (524a1e8)
  • closes #13458, check if plugin is system (b102256)
  • add try..catch around topics.post in note assertion logic (cc92702)
  • don't throw on unknown post on Undo(Like) (83a55f6)
  • add try..catch wrapper around Announce(Like) call to internal method so as to not return a 500 — just drop the Like activity (629eec7)
  • browser title translation (390f642)
  • allow guests to load topic tools if they have privilege to view them (78de8c6)
  • closes #13454, align dropdowns to opposite side on rtl (72417d8)
  • send actor in undo(follow) (49b5268)
  • missed handling zset on ap unfollow (b20a6ed)
  • additional tests for remote privileges, enforcing privileges for remote edits and deletes (a888b86)
Tests
  • fix groups:find webfinger test (0c1a618)

v4.4.1

16 May 16:37
Compare
Choose a tag to compare

Release build (patch) of NodeBB @ 2025-05-16T16:37:49.359Z

v4.4.1 (2025-05-16)

New Features
  • save width and height values into post attachment (3674fa5)
  • use local date string for digest subject (3d96afb)
Bug Fixes
  • openapi schema to handle additional attachments field in postsobject (ce5ef1a)
  • group edit url (0a574d7)
  • add attachments to getpostsummaries call in search, #13324 (8f9f377)
  • bring back auto-categorization if group and object are same-origin, handle Peertube putting channel names in attributedTo (a460a55)
  • #13419, handle remote content with mediaType text/markdown (45a11d4)
Refactors
  • create date once per digest.send (6c3e2a8)
Tests

v4.4.0

14 May 20:36
Compare
Choose a tag to compare

Release build (minor) of NodeBB @ 2025-05-14T20:36:35.970Z

v4.4.0 (2025-05-14)

Breaking Changes
  • removal of deprecated privilege hooks (8ea377a)
  • removal of filter:flags.getFilters (547fb48)
  • removal of filter:user.verify.code (7e25946)
  • removal of filter:post.purge (df5c1a9)
  • removal of filter:post.purge (c84b72f)
  • removal of filter:router.page (9d8061e)
  • removal of filter:email.send (b73a8d3)
Documentation Changes
  • remove since-removed labels property from api (860ac89)
Bug Fixes
  • adjust Peertube-specific handling to shove mp4 into post attachments, #13324 (799b08d)
  • #13081, don't add mention when you are replying to yourself (d586561)
  • add announces to postdataobject schema (0f576a4)
  • #13375, plus additional tests (fe13c75)
  • missing awaits, more comprehensive 1b12 tests (5802c7d)
  • another case (6bfe4e6)
  • handle missing orderedItems property in followers route (e042201)
  • missing await (651ebaa)
  • handle missing orderedItems (53bb0bb)
  • extra orderedItems property in generated paginated OrderedCollection, #13153 (f83b1fb)
  • #13153, follower and following collections to use generateCollection helper (a2de7aa)
  • #13374, updates to posts.edit to handle remote content updates better (b433848)
  • leftover handle var (625ce96)
  • AP inbox update handling for non-note objects (f8d012c)
  • 1b12 creates being dropped (9f80d10)
  • update AP api (un)follow ids to be url encoded id instead of handle (7cf61ab)
Other Changes
Refactors
  • use a single until (1b0b1da)
  • Helpers.generateCollection so that total count and a bound function can be passed in, #13153 (7f59238)
Tests
  • a few additional tests for announce handling (61f6806)
  • fix regression from 5802c7d (5b11890)
  • fix broken test due to adjusted note assertion relation logic (9dc91f1)
  • update filter:router.page tests to response:router.page (a819d39)
  • adjustment for now-removed labels property (52df41b)

v4.3.2

12 May 14:53
Compare
Choose a tag to compare

Release build (patch) of NodeBB @ 2025-05-12T14:53:40.003Z

v4.3.2 (2025-05-12)

Bug Fixes
  • sql injection in sortedSetScan (16504ba)
  • escape flag filters (285d438)
  • #13407, don't restart user jobs (31be083)
  • closes #13405, catch errors in ap.verify (8174578)
  • send proper accept header for outgoing webfinger requests (20ab906)
  • wrap generateCollection calls in try..catch to send 404 if thrown (64fdf91)
  • #13397, null values in category sync list (26e6a22)
  • #13392, regression from c6f2c87, unable to unfollow from pending follows (401ff79)
  • #13397, update getCidByHandle to work with remote categories, fix sync with handles causing issues with null entries (a9a5ab5)
  • correct stage name in dev dockerfile (#13393) (10077d0)
Refactors
  • wrap ap routes in try/catch (00668bd)
  • call verify if request is POST (dfa2132)