v4.4.4

Release build (patch) of NodeBB @ 2025-06-18T14:20:41.218Z

v4.4.4 (2025-06-18)

New Features

• link to post in preview timestamp (8c69c6a)
• Add live reload functionality with Grunt watch and Socket.IO (#13489) (84d99a0)
• closes #13484, post preview changes (14e30c4)

Bug Fixes

• sanitize svg when uploading site-logo, default avatar and og:image (da2597f)
• Revise package hash check in Docker entrypoint.sh (#13483) (6c5b226)
• more edge cases (32faaba)
• #13484, clear tooltip if cursor leaves link (0ebb31f)

Other Changes

• fix lint (8ab034d)

Refactors

• send single message (dc37789)

3.x security release

v3.12.7

3.x security release

2.x security release

v2.8.20

2.x security release

v4.4.3

Release build (patch) of NodeBB @ 2025-06-09T15:26:58.877Z

v4.4.3 (2025-06-09)

Bug Fixes

• escape, query params (b02eb57)
• closes #13475, don't store escaped username (806e54b)

v3.12.6

Security release for 3.x

v2.8.19

Security release for 2.x

v4.4.2

Release build (patch) of NodeBB @ 2025-06-02T15:06:29.241Z

v4.4.2 (2025-06-02)

New Features

• add action:post-queue.save (ebb88c1)
• restrict access to ap.probe method to registered users, add rate limiting protection (e70e990)

Bug Fixes

• return 200 for non-implemented activities instead of 501 (524a1e8)
• closes #13458, check if plugin is system (b102256)
• add try..catch around topics.post in note assertion logic (cc92702)
• don't throw on unknown post on Undo(Like) (83a55f6)
• add try..catch wrapper around Announce(Like) call to internal method so as to not return a 500 — just drop the Like activity (629eec7)
• browser title translation (390f642)
• allow guests to load topic tools if they have privilege to view them (78de8c6)
• closes #13454, align dropdowns to opposite side on rtl (72417d8)
• send actor in undo(follow) (49b5268)
• missed handling zset on ap unfollow (b20a6ed)
• additional tests for remote privileges, enforcing privileges for remote edits and deletes (a888b86)

Tests

• fix groups:find webfinger test (0c1a618)

v4.4.1

Release build (patch) of NodeBB @ 2025-05-16T16:37:49.359Z

v4.4.1 (2025-05-16)

New Features

• save width and height values into post attachment (3674fa5)
• use local date string for digest subject (3d96afb)

Bug Fixes

• openapi schema to handle additional attachments field in postsobject (ce5ef1a)
• group edit url (0a574d7)
• add attachments to getpostsummaries call in search, #13324 (8f9f377)
• bring back auto-categorization if group and object are same-origin, handle Peertube putting channel names in attributedTo (a460a55)
• #13419, handle remote content with mediaType text/markdown (45a11d4)

Refactors

• create date once per digest.send (6c3e2a8)

Tests

• fix tests to account for a460a55 (948bfe4)

v4.4.0

Release build (minor) of NodeBB @ 2025-05-14T20:36:35.970Z

v4.4.0 (2025-05-14)

Breaking Changes

• removal of deprecated privilege hooks (8ea377a)
• removal of filter:flags.getFilters (547fb48)
• removal of filter:user.verify.code (7e25946)
• removal of filter:post.purge (df5c1a9)
• removal of filter:post.purge (c84b72f)
• removal of filter:router.page (9d8061e)
• removal of filter:email.send (b73a8d3)

Documentation Changes

• remove since-removed labels property from api (860ac89)

Bug Fixes

• adjust Peertube-specific handling to shove mp4 into post attachments, #13324 (799b08d)
• #13081, don't add mention when you are replying to yourself (d586561)
• add announces to postdataobject schema (0f576a4)
• #13375, plus additional tests (fe13c75)
• missing awaits, more comprehensive 1b12 tests (5802c7d)
• another case (6bfe4e6)
• handle missing orderedItems property in followers route (e042201)
• missing await (651ebaa)
• handle missing orderedItems (53bb0bb)
• extra orderedItems property in generated paginated OrderedCollection, #13153 (f83b1fb)
• #13153, follower and following collections to use generateCollection helper (a2de7aa)
• #13374, updates to posts.edit to handle remote content updates better (b433848)
• leftover handle var (625ce96)
• AP inbox update handling for non-note objects (f8d012c)
• 1b12 creates being dropped (9f80d10)
• update AP api (un)follow ids to be url encoded id instead of handle (7cf61ab)

Other Changes

• //github.com//issues/13367 (39953ee)

Refactors

• use a single until (1b0b1da)
• Helpers.generateCollection so that total count and a bound function can be passed in, #13153 (7f59238)

Tests

• a few additional tests for announce handling (61f6806)
• fix regression from 5802c7d (5b11890)
• fix broken test due to adjusted note assertion relation logic (9dc91f1)
• update filter:router.page tests to response:router.page (a819d39)
• adjustment for now-removed labels property (52df41b)

v4.3.2

Release build (patch) of NodeBB @ 2025-05-12T14:53:40.003Z

v4.3.2 (2025-05-12)

Bug Fixes

• sql injection in sortedSetScan (16504ba)
• escape flag filters (285d438)
• #13407, don't restart user jobs (31be083)
• closes #13405, catch errors in ap.verify (8174578)
• send proper accept header for outgoing webfinger requests (20ab906)
• wrap generateCollection calls in try..catch to send 404 if thrown (64fdf91)
• #13397, null values in category sync list (26e6a22)
• #13392, regression from c6f2c87, unable to unfollow from pending follows (401ff79)
• #13397, update getCidByHandle to work with remote categories, fix sync with handles causing issues with null entries (a9a5ab5)
• correct stage name in dev dockerfile (#13393) (10077d0)

Refactors

• wrap ap routes in try/catch (00668bd)
• call verify if request is POST (dfa2132)