v4.6.0

Release build (minor) of NodeBB @ 2025-10-01T18:12:05.727Z

v4.6.0 (2025-10-01)

Documentation Changes

• update openapi schema to refer to try.nodebb.org instead of example.org (56a9336)

New Features

• ability to nickname remote categories, closes #13677 (bd80b77)
• allow activities to be addressed to as:Public or Public to be treated as public content (5f4790a)
• allow user auto-categorization rule (1d6a9fe)
• add minor pre-processing step to better handle header elements in incoming html (15f9fba)

Bug Fixes

• login handler to handle if non-confirmed email is entered (5ed19ef)
• allow quote-inline class in mocks sanitizer so quote-post fallback elements can be detected and removed during title generation, fixes #13688 (675178a)
• force outgoing page on direct access to /ap handler (9cee799)
• update outgoing page to match 404 design (954e7bc)
• don't begin processing local login if the passed-in username isn't even valid (c3df68f)
• #13667, record to instances:lastSeen instead of domains:lastSeen (7184507)
• #13676, bug where nested remote categories could not be removed (175dc20)
• regression 218f5ea from via, stricter check on whether the calling user is a remote uid (8c553b1)
• #13668, privilege checking on topic create for remote users; was not properly checking against fediverse pseudo-user (218f5ea)
• update logic as to whether a post is served as an article or not (d122bf4)
• update activitypubFilterList logic so that it is also checked on resolveInbox and ActivityPub.get methods, updated instances.isAllowed to no longer return a promise (be9212b)
• add missing unlock in nested try/catch (9184a7a)
• wrap majority of note assertion logic in try..catch to handle exceptions so that the lock is always released (95fb084)
• use newline_boundaries param for tokenizer during title and summary generation, attempt to serve HTML in summary generation (2ea624f)
• deprecated call to api.topics.move (0f9015f)
• deps:
  • update dependency webpack to v5.102.0 (#13683) (17dba0b)
  • update dependency mongodb to v6.20.0 (#13665) (9b00ff1)
  • update dependency lru-cache to v11.2.2 (#13669) (00d8061)
  • update dependency sass to v1.93.2 (#13674) (1b5804e)
  • update fontsource monorepo (#13663) (6e84e35)
  • update dependency esbuild to v0.25.10 (#13664) (9b48bbd)
  • update dependency sharp to v0.34.4 (#13662) (c8680f3)
  • update dependency satori to v0.18.3 (#13660) (b2d91dc)
  • update dependency nodebb-theme-harmony to v2.1.20 (#13659) (b845aa4)
  • update dependency fs-extra to v11.3.2 (#13658) (8324be2)
  • update dependency @fontsource/inter to v5.2.7 (#13655) (db89250)
  • update dependency commander to v14.0.1 (#13652) (19f3919)
  • update dependency bootswatch to v5.3.8 (#13651) (1e82af6)
  • update dependency sass to v1.92.1 (#13645) (10344c9)
  • update dependency workerpool to v9.3.4 (#13650) (6a1e9e8)
  • update dependency lru-cache to v11.2.1 (#13644) (6adfbb2)

Other Changes

• disallow checkHeader from returning a URL from a different origin than the passed-in URL (4776d01)
• 'nickname' and 'descriptionParsed' use in categories controller (051043b)

Performance Improvements

• update old upgrade scripts to use bulkSet/Add (2b987d0)

Refactors

• notes.assert to add finally block, update assertPayload to update instances:lastSeen via method instead of direct db call (559155d)

Reverts

• post queue changes to fix tests (10350ea)

Tests

• fix message (d6e7e16)
• show tids on test fail (8614d82)
• more fixes for note vs. article (3bba902)
• short OPs create Notes again (1587808)
• ap timeouts (8d6a0f0)
• disable post queue when testing posting logic (9bfce68)