v4.16.4

Release build (patch) of NodeBB @ 2026-10-23T17:15:32.954Z

v4.16.4 (2026-10-23)

New Features

• add inflight request handling to lru/ttl cache (3b778b9)
• return registration pending message (31f883f)

Bug Fixes

• another security fix for body-parser (de3e773)
• update multer to address CVE (d7502b9)
• crosspost remove bypass via cid type manipulation (1a90f8a)
• closes #15029, apply default user settings set in acp to guests as well (73334d7)
• closes #15023 (b609bd3)
• closes #15022, encode targetId, fixed AP urls (387099d)
• missing return in intents.create (2f74bfa)
• closes #15011, update messageCount on message purge (4e4051f)
• remove extraneous chore lines from changelog (8d2af9e)
• search: support federated (UUID) tids in in-topic search (#15043) (1169aff)
• activitypub: keep emoji tags when tag is a single object (740511c)

Refactors

• tags are stored in topic hash (acca7f3)
• use promise.all, use req.uid, always set isSelf (dbf9cc6)
• single return (80d6a16)

Tests

• remove node 22 (d497a86)
• mongodb7.0 (ea09832)
• add healthcheck to mongodb (c8c2b24)
• fix crosspost test (abe2c26)
• fix tests again (084dfd2)
• fix tests (8d725cb)