v4.16.0 (2026-09-16)

Raven

Release Build - Released on September 16th, 2026 (Commit: 3c94b93)

We have added things such as chat messages reporting, advanced admin tools, and more. Read below for a more in-depth list of the changes that were made in the update.

New Features

Allow admins to hide topic event types (#14824) (f2c968e)
Add Messaging.isRoomMember() (#14779) (1892552)
Add action:messaging.markRead hook with previous read timestamp (#14777) (fcaeec1)
Update chat room url with message index on scroll (#14738) (040b996)
Mark flag notifications read when the flag detail page is viewed (#14747) (4d155cc)
Expose category privilege copying via v3 API (#14670) (6203ebc)
Add full name to ACP user search (#14671) (4700ccb)
Hint when follow notifications are disabled (#14666) (a7cc7f4)
Chat message reporting

ActivityPub Features

Include contentWarning in post summaries and teasers (bfabeba)
Include contentWarning in feed post data (c1636f4)
Hide content and thumbs behind CW in templates (0b3433e)
Support content warnings on incoming remote posts (c968c28)
Add category selector to hashtag follow, fix actor assertion (fea8017)
Add global hashtag follow feature (4e22def)
Enable instance actor to follow remote actors (deeeb3d)
Verify incoming rfc 9421 signatures (872c617)
Sign activities with rfc 9421, fall back to draft (3249437)
Render remote emoji in actor names (d0cbe18)
Render custom emoji in topic titles (44ca8f4)
Re-download stale emoji on serve (379f4bb)
Hostname-aware custom emoji cache and proxy (f7376ea)
Allow plugins to handle incoming AP activities via plugin hook (2bf93aa)
Announce bumped topics to followers (16d3f6d6)
Add staged delivery for topic replies (c300393)
Log send pool failures via analytics.sendError (94b1ad5)
Add allowList to ssrf.js for hostname whitelisting (711f227)
Implement send worker child process for offloaded federation (664c9bb)
Flags: support remote flag forwarding for chat messages (8462ac8)
Federation: add activities-by-type pie chart to analytics page (b23912c)
Tags: add case-sensitive tag support with caseSensitiveTags config (#14690) (883c217)

Bug Fixes

Messaging: skip existing members in addUidsToRoom to preserve join timestamps (f34e2e8)
Require author for federated chat message edit/delete (e717c3e)
Cross-check signature against verified keyId, not raw header (fc28231)
Announce dereferenceable objects to relays (7abe252)
Improve RFC 9421 interoperability (a57eb6e)
Resolve string URIs and use resolveLocalId in inbox.flag (46ae1ce)
Skip undo.announce for pseudo-category cid -1 (3805286)
Return true from assert/assertGroup when all IDs already present (89d3d96)
Move fallback warning from worker to orchestrator (ef860a3)
Handle FediBuzz Accept with actor document as object (40ca8ef)
Add stateClass to Hashtags.list() for API consumers (1ad7056)
Parse createdAt as number in hashtag records (d758fbe)
Limit activity dedup window to 10s (8f7471c)
Use RFC 9421 registered algorithm identifiers in Signature-Input header (c5dc224)
Correct assertion check in Out.follow (57095a4)
Correct assertion check in Out.follow (a0fdef7)
Use request protocol for rfc 9421 target uri (203e9a9)
Accept Content-Digest (RFC 9530) for Mitra compatibility (6190b45)
Add required algorithm parameter to RFC 9421 Signature-Input header (bce41a3)
Reconstruct rfc 9421 target uri from host header (b49186b)
Emit rfc 9421 signatures as rfc 8941 byte sequences (bb199f4)
Gate user-facing S2S endpoints on fediverse view:users privilege (f0368a2)
Normalize webfinger cache keys and search handles (958cd2d)
Harden split-domain vouching and self-link fallback (934ad5e)
Harden webfinger query input validation (d6f95f1)
Prevent cross-domain webfinger cache poisoning (60c6333)
Re-apply federation policy on redirect destinations (6c4692b)
Route unhandled resource types through outgoing warning page (634fb15)
Validate webfinger content-type before parsing (be5f09a)
Accept same-domain legacy actors via self-link fallback (6cca6a4)
Use sensible min/max worker counts (1d85751)
Handle unhandled rejections in handleResult and add .unref() to force-kill timer (18bdab7)
Repair send pool drain loop and worker sizing (ce0765f)
Add User-Agent header to fetch requests (Match NodeBB/request.js format: NodeBB/x.x.x (site-url)) (634cb7d)
Export SendPool on ActivityPub module for test access (bbab962)
Fix handleWorkerExit bug and fix sendWorker tests (343b96b)
Refactor send pool into send.js and fix critical bugs (612e821)
Registration approval queue link in ACP user settings (#14825) (4688978)
Filter fork topic events by category find privilege (#14823) (0af568a5)
Fall back to en-GB for untranslated strings (#14829) (3f3f85c)
Translate plugin-supplied labels on the registration queue (#14830) (059bccc)
Upgrade progress for system-message upgrade script (8f5ecab)
Fire pluginHooks for /compose (2d15e00, 4b666b8)
Scroll chat/notification dropdowns to top when a new item arrives (#14776) (1c63633)
Don't show new posts alert on topic lists for the user's own posts (#14818) (2a2cf37)
Do not federate crossposts to private targets (3a6b81f)
Bump themes for #14794 (d0dd90b)
Broken tpl in feed/item.tpl (92e4f80)
Prevent caching of responses carrying a CSRF token (#14787) (47e3858)
Add hashtag schemas to OpenAPI manifests (fb38d0f)
Closes #14765 (8f5f105)
Load zxcvbn lazily so password forms keep working when the chunk fails to load (#14791) (1478c95)
Prune expired topic view timestamps from the session (#14789) (a21aaf1)
Ask for the current password when an admin changes their own password from ACP (#14790) (6b47ea8)
Hide "none found" notice on trending plugins tab when plugins exist (#14785) (edc15e5)
Use parent category as up link, closes #14784 (e661c60)
Don't splice the viewer's own chat room into another user's room list (#14781) (86827de)
Keep the server timestamp on live chat messages (#14778) (2f3df9c)
Bump emoji plugin (c092185)
Browser title rendered LTR for RTL users when the page title starts with Latin text (#14780) (561de8a)
Register template helpers before ajaxify can render a page (#14775) (c2da26f)
Only allow sort by flags for privileged users (9af2e8b)
Don't allow sorting by email in user search (dba251b)
Show which login field is missing instead of a generic error (#14772) (b155970)
On notifications page don't show counts if post notifications are not visible (0290c45)
Category/tag filter dropdown taller than the viewport (#14769) (3391a3d)
Filter out notifications that are from pids that are (3bfdf62)
During post creation don't use posts.uploads.sync (1e49042)
Unread/flags nav counts not rendered when relative_path is set (#14755) (7457d23)
Enforce response size during streaming and require Digest for inbox requests (cee29dc)
Add one more escape for title (b873693)
Add missing escape (92a7fd5)
Use new helper in topic and posts (0796f50)
Include fullnameEmoji in key places in core (873d027)
Escape attributes in renderShortcodeEmoji helper (7523dd7)
Bump themes for #14748 (e371cbe)
Closes #14743, handle uid groupnames in isMember methods (c1081a0)
Issue where wrong cid was passed in when remote uid was posting to remote cid (eadc8e2)
Remove extraneous comments (aaff6c0)
Lang keys (42f5f46)
Add missing dep (d2fee2b)
Lint (8ef4b72)
Regressed tests due to webfinger strictness checks (8b008cd)
Fallbacks, manually executed (c20d2e8)
Use thread instead of process for AP workerpool config (301f7c7)
Update maxWorkers strategy to use os.availableParallelism() * 2 (a0fa245)
Debug logs (e8b9475)
Match the same icon in topic.tpl for merge (419ef35)

Security Fixes

Harden login timing, user status, and groupTitle (d271e20, 12860ab)
Flags: support remote actor URIs in Flags.rescindReport (d111ae8)
Auth: #14793, clear forceLogin before session regeneration (40fc44f)

Test & Federation Fixes

Assert relative localPath in getEmoji test (59139cc)
Adjust ActivityPub privilege tests for remote uid/cid checks (aeb0a3e)
Federation: resolve analytics lint errors (#14703) (ce136e0)
Activitypub/jobs: only run drainLoop on primary process (5c5dc76)
Admin/federation: add pie chart, no-data state, and legend spacing to analytics (0eda2d6)

Performance Improvements

Don't map twice for keys (4d6379d)
Don't stringify unused value (5987213)
Use a single filterUids (3b76bf7)
Use index and get watching and everything above (e065409)

Refactors

Remove deprecated chat socket.io methods (a2aa265)
Change worker count (883953d)
Don't log timestamp parse error (7ca81b4)
New topic notification (708ccdd)
Remove postcss-clean (d1ee69...)

Noctis

Interesting

_Izzy_

period but now none of the buttons show up on nintendo, they just look like squares TvT (the upvote, messaging, notification bell, recents icon, ect.)

Noctis

I would need help with the message display screen because I would not know what to type and plus I can't use the text box since the old messages are in the way

Yanderemenhera

I'm on a Chromebook and the lag is so bad the site is barely useable, I'll click an icon like the chat icon or try to reply to a topic, but nothing will happen. and i'll wait, click it again, nothing happens and eventually I spam click it and still nothing and it'll just randomly work occasionally and if I can get into DMs, messages will just not send at all and the site will also get stuck refreshing for a while when I try to fix it by refreshing.

other, more resorce-intensive sites like discord run ok for me, it's quite literally just browse DNS that's not working.

@_izzy_ I was trying to reply to your post in this exact thread and I just couldn't, for me, some icons won't show up but they do eventually (on my end I think it's a lag issue)

I feel bad for switch users, bc if my non-school chromebook is able to run discord fine but browse DNS is just running poorly I can't imagine how bad the lag is for those using a switch.

tyler_x

While this is all great and something I am thankful for, every icon now appears as just a square, and some as some symbol from a foreign language. Group tag colours aren't showing up, and it's all very laggy. (On Switch, anyways.) I'm aware that there's probably not much that can be done, however I am quite bothered.