v4.16.0 (2026-09-16)
-
Release Build - Released on September 16th, 2026 (Commit: 3c94b93)
We have added things such as chat messages reporting, advanced admin tools, and more. Read below for a more in-depth list of the changes that were made in the update.
New Features
- Allow admins to hide topic event types (#14824) (f2c968e)
- Add Messaging.isRoomMember() (#14779) (1892552)
- Add action:messaging.markRead hook with previous read timestamp (#14777) (fcaeec1)
- Update chat room url with message index on scroll (#14738) (040b996)
- Mark flag notifications read when the flag detail page is viewed (#14747) (4d155cc)
- Expose category privilege copying via v3 API (#14670) (6203ebc)
- Add full name to ACP user search (#14671) (4700ccb)
- Hint when follow notifications are disabled (#14666) (a7cc7f4)
- Chat message reporting
ActivityPub Features
- Include contentWarning in post summaries and teasers (bfabeba)
- Include contentWarning in feed post data (c1636f4)
- Hide content and thumbs behind CW in templates (0b3433e)
- Support content warnings on incoming remote posts (c968c28)
- Add category selector to hashtag follow, fix actor assertion (fea8017)
- Add global hashtag follow feature (4e22def)
- Enable instance actor to follow remote actors (deeeb3d)
- Verify incoming rfc 9421 signatures (872c617)
- Sign activities with rfc 9421, fall back to draft (3249437)
- Render remote emoji in actor names (d0cbe18)
- Render custom emoji in topic titles (44ca8f4)
- Re-download stale emoji on serve (379f4bb)
- Hostname-aware custom emoji cache and proxy (f7376ea)
- Allow plugins to handle incoming AP activities via plugin hook (2bf93aa)
- Announce bumped topics to followers (16d3f6d6)
- Add staged delivery for topic replies (c300393)
- Log send pool failures via analytics.sendError (94b1ad5)
- Add allowList to ssrf.js for hostname whitelisting (711f227)
- Implement send worker child process for offloaded federation (664c9bb)
- Flags: support remote flag forwarding for chat messages (8462ac8)
- Federation: add activities-by-type pie chart to analytics page (b23912c)
- Tags: add case-sensitive tag support with caseSensitiveTags config (#14690) (883c217)
Bug Fixes
- Messaging: skip existing members in addUidsToRoom to preserve join timestamps (f34e2e8)
- Require author for federated chat message edit/delete (e717c3e)
- Cross-check signature against verified keyId, not raw header (fc28231)
- Announce dereferenceable objects to relays (7abe252)
- Improve RFC 9421 interoperability (a57eb6e)
- Resolve string URIs and use resolveLocalId in inbox.flag (46ae1ce)
- Skip undo.announce for pseudo-category cid -1 (3805286)
- Return true from assert/assertGroup when all IDs already present (89d3d96)
- Move fallback warning from worker to orchestrator (ef860a3)
- Handle FediBuzz Accept with actor document as object (40ca8ef)
- Add stateClass to Hashtags.list() for API consumers (1ad7056)
- Parse createdAt as number in hashtag records (d758fbe)
- Limit activity dedup window to 10s (8f7471c)
- Use RFC 9421 registered algorithm identifiers in Signature-Input header (c5dc224)
- Correct assertion check in Out.follow (57095a4)
- Correct assertion check in Out.follow (a0fdef7)
- Use request protocol for rfc 9421 target uri (203e9a9)
- Accept Content-Digest (RFC 9530) for Mitra compatibility (6190b45)
- Add required algorithm parameter to RFC 9421 Signature-Input header (bce41a3)
- Reconstruct rfc 9421 target uri from host header (b49186b)
- Emit rfc 9421 signatures as rfc 8941 byte sequences (bb199f4)
- Gate user-facing S2S endpoints on fediverse view:users privilege (f0368a2)
- Normalize webfinger cache keys and search handles (958cd2d)
- Harden split-domain vouching and self-link fallback (934ad5e)
- Harden webfinger query input validation (d6f95f1)
- Prevent cross-domain webfinger cache poisoning (60c6333)
- Re-apply federation policy on redirect destinations (6c4692b)
- Route unhandled resource types through outgoing warning page (634fb15)
- Validate webfinger content-type before parsing (be5f09a)
- Accept same-domain legacy actors via self-link fallback (6cca6a4)
- Use sensible min/max worker counts (1d85751)
- Handle unhandled rejections in handleResult and add .unref() to force-kill timer (18bdab7)
- Repair send pool drain loop and worker sizing (ce0765f)
- Add User-Agent header to fetch requests (Match NodeBB/request.js format: NodeBB/x.x.x (site-url)) (634cb7d)
- Export SendPool on ActivityPub module for test access (bbab962)
- Fix handleWorkerExit bug and fix sendWorker tests (343b96b)
- Refactor send pool into send.js and fix critical bugs (612e821)
- Registration approval queue link in ACP user settings (#14825) (4688978)
- Filter fork topic events by category find privilege (#14823) (0af568a5)
- Fall back to en-GB for untranslated strings (#14829) (3f3f85c)
- Translate plugin-supplied labels on the registration queue (#14830) (059bccc)
- Upgrade progress for system-message upgrade script (8f5ecab)
- Fire pluginHooks for /compose (2d15e00, 4b666b8)
- Scroll chat/notification dropdowns to top when a new item arrives (#14776) (1c63633)
- Don't show new posts alert on topic lists for the user's own posts (#14818) (2a2cf37)
- Do not federate crossposts to private targets (3a6b81f)
- Bump themes for #14794 (d0dd90b)
- Broken tpl in feed/item.tpl (92e4f80)
- Prevent caching of responses carrying a CSRF token (#14787) (47e3858)
- Add hashtag schemas to OpenAPI manifests (fb38d0f)
- Closes #14765 (8f5f105)
- Load zxcvbn lazily so password forms keep working when the chunk fails to load (#14791) (1478c95)
- Prune expired topic view timestamps from the session (#14789) (a21aaf1)
- Ask for the current password when an admin changes their own password from ACP (#14790) (6b47ea8)
- Hide "none found" notice on trending plugins tab when plugins exist (#14785) (edc15e5)
- Use parent category as up link, closes #14784 (e661c60)
- Don't splice the viewer's own chat room into another user's room list (#14781) (86827de)
- Keep the server timestamp on live chat messages (#14778) (2f3df9c)
- Bump emoji plugin (c092185)
- Browser title rendered LTR for RTL users when the page title starts with Latin text (#14780) (561de8a)
- Register template helpers before ajaxify can render a page (#14775) (c2da26f)
- Only allow sort by flags for privileged users (9af2e8b)
- Don't allow sorting by email in user search (dba251b)
- Show which login field is missing instead of a generic error (#14772) (b155970)
- On notifications page don't show counts if post notifications are not visible (0290c45)
- Category/tag filter dropdown taller than the viewport (#14769) (3391a3d)
- Filter out notifications that are from pids that are (3bfdf62)
- During post creation don't use posts.uploads.sync (1e49042)
- Unread/flags nav counts not rendered when relative_path is set (#14755) (7457d23)
- Enforce response size during streaming and require Digest for inbox requests (cee29dc)
- Add one more escape for title (b873693)
- Add missing escape (92a7fd5)
- Use new helper in topic and posts (0796f50)
- Include fullnameEmoji in key places in core (873d027)
- Escape attributes in renderShortcodeEmoji helper (7523dd7)
- Bump themes for #14748 (e371cbe)
- Closes #14743, handle uid groupnames in isMember methods (c1081a0)
- Issue where wrong cid was passed in when remote uid was posting to remote cid (eadc8e2)
- Remove extraneous comments (aaff6c0)
- Lang keys (42f5f46)
- Add missing dep (d2fee2b)
- Lint (8ef4b72)
- Regressed tests due to webfinger strictness checks (8b008cd)
- Fallbacks, manually executed (c20d2e8)
- Use thread instead of process for AP workerpool config (301f7c7)
- Update maxWorkers strategy to use os.availableParallelism() * 2 (a0fa245)
- Debug logs (e8b9475)
- Match the same icon in topic.tpl for merge (419ef35)
Security Fixes
- Harden login timing, user status, and groupTitle (d271e20, 12860ab)
- Flags: support remote actor URIs in Flags.rescindReport (d111ae8)
- Auth: #14793, clear forceLogin before session regeneration (40fc44f)
Test & Federation Fixes
- Assert relative localPath in getEmoji test (59139cc)
- Adjust ActivityPub privilege tests for remote uid/cid checks (aeb0a3e)
- Federation: resolve analytics lint errors (#14703) (ce136e0)
- Activitypub/jobs: only run drainLoop on primary process (5c5dc76)
- Admin/federation: add pie chart, no-data state, and legend spacing to analytics (0eda2d6)
Performance Improvements
- Don't map twice for keys (4d6379d)
- Don't stringify unused value (5987213)
- Use a single filterUids (3b76bf7)
- Use index and get watching and everything above (e065409)
Refactors
- Remove deprecated chat socket.io methods (a2aa265)
- Change worker count (883953d)
- Don't log timestamp parse error (7ca81b4)
- New topic notification (708ccdd)
- Remove postcss-clean (d1ee69...)
-
period but now none of the buttons show up on nintendo, they just look like squares TvT (the upvote, messaging, notification bell, recents icon, ect.)
-
auntie menhera's neices, nephews and niblings Chud before-update supporter He ate them #fuckmybakalife Eric Cartman canida 🥀 😭🙏 wilford bremly fangurl cult Swagg_c3rt1fi3d<3 Belt to ass Тотя well, fuc- pale as F∪CK short person chronically online former staff But 20$ is 20$ high af Chaotic Asexuals The Lords of Pillows Mr. Duran's classI'm on a Chromebook and the lag is so bad the site is barely useable, I'll click an icon like the chat icon or try to reply to a topic, but nothing will happen. and i'll wait, click it again, nothing happens and eventually I spam click it and still nothing and it'll just randomly work occasionally and if I can get into DMs, messages will just not send at all and the site will also get stuck refreshing for a while when I try to fix it by refreshing.
other, more resorce-intensive sites like discord run ok for me, it's quite literally just browse DNS that's not working.
@_izzy_ I was trying to reply to your post in this exact thread and I just couldn't, for me, some icons won't show up but they do eventually (on my end I think it's a lag issue)
I feel bad for switch users, bc if my non-school chromebook is able to run discord fine but browse DNS is just running poorly I can't imagine how bad the lag is for those using a switch.
-
While this is all great and something I am thankful for, every icon now appears as just a square, and some as some symbol from a foreign language. Group tag colours aren't showing up, and it's all very laggy. (On Switch, anyways.) I'm aware that there's probably not much that can be done, however I am quite bothered.
-
The lag issue is being looked into as well as the squares you've mentioned.
-
I only understand a little bit about what you said but thank you goat
-
there's a new bug, a VERY long peice of the sites code having an error- I'll report it now
-
Please do not report bugs here, but create your own bug report thread so that we can keep it organized.
-
I'm on a Chromebook and the lag is so bad the site is barely useable, I'll click an icon like the chat icon or try to reply to a topic, but nothing will happen. and i'll wait, click it again, nothing happens and eventually I spam click it and still nothing and it'll just randomly work occasionally and if I can get into DMs, messages will just not send at all and the site will also get stuck refreshing for a while when I try to fix it by refreshing.
other, more resorce-intensive sites like discord run ok for me, it's quite literally just browse DNS that's not working.
@_izzy_ I was trying to reply to your post in this exact thread and I just couldn't, for me, some icons won't show up but they do eventually (on my end I think it's a lag issue)
I feel bad for switch users, bc if my non-school chromebook is able to run discord fine but browse DNS is just running poorly I can't imagine how bad the lag is for those using a switch.
Carl Weezer Gynesexual ♡♥ Art group! I AM NOT GAY!! /J Pan Kandi kids >w< stomach book ISSBROKIE fans bacteria❤ Gets hated on | WeedAreTheWorld is #1 Yuri lovers !! 😈Hellverse Banned He ate them roblox The Red Army #1 tenna fan Flareon Lovers! rip wall #1 analog horror fan ×Certified Ch*rL*stor Hater× Dr pepper warriors Aggretsuko Fans Dw fan X] ''she's 17 scott'' The Living Tombstoner nugs not drugs Orange_cats indie game fan i love cats Eeveelution Fan! Stay Gold NonBinary 💛🤍💜🖤 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA tadc fan Despite everything, it's still you. Its you! bookworms Green gleeby glorp Science Nerdz short person We’re the best /jjj Hide BDNS Ads Woolys World fomo I ❤️ frogs xbox nostalgia Edd ♪Robbie's Bugs♪ i never sleep at night Trans Survived a near death experience (yay) vocaloid Random Losers!! =(^.".^)= miku ♡ auntie menhera's neices, nephews and niblings ALNST ANTI FURRY HATTERS TSHD i ♥ weezer Free Afghani Women Zubin weirdcore Melt Ice Young And Dumb pacer test h8ers LGBTQ+ Of BDNS ‼️ silly transmascs Natalies fav Food Lovers MITACS Kuromi luvers<3 #1 kinger fan neurodivergent Anti-Spawn KITTYYYYYUHHH!! SW Fans Femboy :3 ppl Tarmac fw<3 chalk eaters 𝙏𝙑 𝙂𝙄𝙍𝙇 💙×🩷 Rising moon...🌙 I <3 writing News HAIL MOUTHCLOUD pale as F∪CK WILL WOODERS switch players Deltarune Fans Murder Drones Fans Pickle Chips Bats's Cave Breakcore Fans! danganronpa supremacy Pierced people integrity yaoi♡ WARNING! STUPID! The OG FNaF fans ☆ Undertale Fans! ♥♡♥♡♥ Anti-Clanker ★1NT3RN3T K1DZ★ Fry Guys!! anti-clanker deltarune D e p r e s s i o n . . . Thoughtful Raven Empire multi switch gang R.O.G (roleplayer :p) Wings of Fire #KeepBDNSSafe Belt to ass @Everyone VOICE ACTORS OF BDNS No BIRTH IN SB ∀ Chainsaw Man ∀ Goth/emo/scene/other :3 Tally Hall Fans ★☆Theater Kids☆★ `Gravity Falls` Youtube Music OC-Maker@Yanderemenhera switch lag is NOT fun rn, but thankfully I also have an iPad (school issued
) so I only use my switch when I have to
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login