<![CDATA[v4.16.0 (2026-09-16)]]>Release Build - Released on September 16th, 2026 (Commit: 3c94b93)

We have added things such as chat messages reporting, advanced admin tools, and more. Read below for a more in-depth list of the changes that were made in the update.

New Features

  • Allow admins to hide topic event types (#14824) (f2c968e)
  • Add Messaging.isRoomMember() (#14779) (1892552)
  • Add action:messaging.markRead hook with previous read timestamp (#14777) (fcaeec1)
  • Update chat room url with message index on scroll (#14738) (040b996)
  • Mark flag notifications read when the flag detail page is viewed (#14747) (4d155cc)
  • Expose category privilege copying via v3 API (#14670) (6203ebc)
  • Add full name to ACP user search (#14671) (4700ccb)
  • Hint when follow notifications are disabled (#14666) (a7cc7f4)
  • Chat message reporting

ActivityPub Features

  • Include contentWarning in post summaries and teasers (bfabeba)
  • Include contentWarning in feed post data (c1636f4)
  • Hide content and thumbs behind CW in templates (0b3433e)
  • Support content warnings on incoming remote posts (c968c28)
  • Add category selector to hashtag follow, fix actor assertion (fea8017)
  • Add global hashtag follow feature (4e22def)
  • Enable instance actor to follow remote actors (deeeb3d)
  • Verify incoming rfc 9421 signatures (872c617)
  • Sign activities with rfc 9421, fall back to draft (3249437)
  • Render remote emoji in actor names (d0cbe18)
  • Render custom emoji in topic titles (44ca8f4)
  • Re-download stale emoji on serve (379f4bb)
  • Hostname-aware custom emoji cache and proxy (f7376ea)
  • Allow plugins to handle incoming AP activities via plugin hook (2bf93aa)
  • Announce bumped topics to followers (16d3f6d6)
  • Add staged delivery for topic replies (c300393)
  • Log send pool failures via analytics.sendError (94b1ad5)
  • Add allowList to ssrf.js for hostname whitelisting (711f227)
  • Implement send worker child process for offloaded federation (664c9bb)
  • Flags: support remote flag forwarding for chat messages (8462ac8)
  • Federation: add activities-by-type pie chart to analytics page (b23912c)
  • Tags: add case-sensitive tag support with caseSensitiveTags config (#14690) (883c217)

Bug Fixes

  • Messaging: skip existing members in addUidsToRoom to preserve join timestamps (f34e2e8)
  • Require author for federated chat message edit/delete (e717c3e)
  • Cross-check signature against verified keyId, not raw header (fc28231)
  • Announce dereferenceable objects to relays (7abe252)
  • Improve RFC 9421 interoperability (a57eb6e)
  • Resolve string URIs and use resolveLocalId in inbox.flag (46ae1ce)
  • Skip undo.announce for pseudo-category cid -1 (3805286)
  • Return true from assert/assertGroup when all IDs already present (89d3d96)
  • Move fallback warning from worker to orchestrator (ef860a3)
  • Handle FediBuzz Accept with actor document as object (40ca8ef)
  • Add stateClass to Hashtags.list() for API consumers (1ad7056)
  • Parse createdAt as number in hashtag records (d758fbe)
  • Limit activity dedup window to 10s (8f7471c)
  • Use RFC 9421 registered algorithm identifiers in Signature-Input header (c5dc224)
  • Correct assertion check in Out.follow (57095a4)
  • Correct assertion check in Out.follow (a0fdef7)
  • Use request protocol for rfc 9421 target uri (203e9a9)
  • Accept Content-Digest (RFC 9530) for Mitra compatibility (6190b45)
  • Add required algorithm parameter to RFC 9421 Signature-Input header (bce41a3)
  • Reconstruct rfc 9421 target uri from host header (b49186b)
  • Emit rfc 9421 signatures as rfc 8941 byte sequences (bb199f4)
  • Gate user-facing S2S endpoints on fediverse view:users privilege (f0368a2)
  • Normalize webfinger cache keys and search handles (958cd2d)
  • Harden split-domain vouching and self-link fallback (934ad5e)
  • Harden webfinger query input validation (d6f95f1)
  • Prevent cross-domain webfinger cache poisoning (60c6333)
  • Re-apply federation policy on redirect destinations (6c4692b)
  • Route unhandled resource types through outgoing warning page (634fb15)
  • Validate webfinger content-type before parsing (be5f09a)
  • Accept same-domain legacy actors via self-link fallback (6cca6a4)
  • Use sensible min/max worker counts (1d85751)
  • Handle unhandled rejections in handleResult and add .unref() to force-kill timer (18bdab7)
  • Repair send pool drain loop and worker sizing (ce0765f)
  • Add User-Agent header to fetch requests (Match NodeBB/request.js format: NodeBB/x.x.x (site-url)) (634cb7d)
  • Export SendPool on ActivityPub module for test access (bbab962)
  • Fix handleWorkerExit bug and fix sendWorker tests (343b96b)
  • Refactor send pool into send.js and fix critical bugs (612e821)
  • Registration approval queue link in ACP user settings (#14825) (4688978)
  • Filter fork topic events by category find privilege (#14823) (0af568a5)
  • Fall back to en-GB for untranslated strings (#14829) (3f3f85c)
  • Translate plugin-supplied labels on the registration queue (#14830) (059bccc)
  • Upgrade progress for system-message upgrade script (8f5ecab)
  • Fire pluginHooks for /compose (2d15e00, 4b666b8)
  • Scroll chat/notification dropdowns to top when a new item arrives (#14776) (1c63633)
  • Don't show new posts alert on topic lists for the user's own posts (#14818) (2a2cf37)
  • Do not federate crossposts to private targets (3a6b81f)
  • Bump themes for #14794 (d0dd90b)
  • Broken tpl in feed/item.tpl (92e4f80)
  • Prevent caching of responses carrying a CSRF token (#14787) (47e3858)
  • Add hashtag schemas to OpenAPI manifests (fb38d0f)
  • Closes #14765 (8f5f105)
  • Load zxcvbn lazily so password forms keep working when the chunk fails to load (#14791) (1478c95)
  • Prune expired topic view timestamps from the session (#14789) (a21aaf1)
  • Ask for the current password when an admin changes their own password from ACP (#14790) (6b47ea8)
  • Hide "none found" notice on trending plugins tab when plugins exist (#14785) (edc15e5)
  • Use parent category as up link, closes #14784 (e661c60)
  • Don't splice the viewer's own chat room into another user's room list (#14781) (86827de)
  • Keep the server timestamp on live chat messages (#14778) (2f3df9c)
  • Bump emoji plugin (c092185)
  • Browser title rendered LTR for RTL users when the page title starts with Latin text (#14780) (561de8a)
  • Register template helpers before ajaxify can render a page (#14775) (c2da26f)
  • Only allow sort by flags for privileged users (9af2e8b)
  • Don't allow sorting by email in user search (dba251b)
  • Show which login field is missing instead of a generic error (#14772) (b155970)
  • On notifications page don't show counts if post notifications are not visible (0290c45)
  • Category/tag filter dropdown taller than the viewport (#14769) (3391a3d)
  • Filter out notifications that are from pids that are (3bfdf62)
  • During post creation don't use posts.uploads.sync (1e49042)
  • Unread/flags nav counts not rendered when relative_path is set (#14755) (7457d23)
  • Enforce response size during streaming and require Digest for inbox requests (cee29dc)
  • Add one more escape for title (b873693)
  • Add missing escape (92a7fd5)
  • Use new helper in topic and posts (0796f50)
  • Include fullnameEmoji in key places in core (873d027)
  • Escape attributes in renderShortcodeEmoji helper (7523dd7)
  • Bump themes for #14748 (e371cbe)
  • Closes #14743, handle uid groupnames in isMember methods (c1081a0)
  • Issue where wrong cid was passed in when remote uid was posting to remote cid (eadc8e2)
  • Remove extraneous comments (aaff6c0)
  • Lang keys (42f5f46)
  • Add missing dep (d2fee2b)
  • Lint (8ef4b72)
  • Regressed tests due to webfinger strictness checks (8b008cd)
  • Fallbacks, manually executed (c20d2e8)
  • Use thread instead of process for AP workerpool config (301f7c7)
  • Update maxWorkers strategy to use os.availableParallelism() * 2 (a0fa245)
  • Debug logs (e8b9475)
  • Match the same icon in topic.tpl for merge (419ef35)

Security Fixes

  • Harden login timing, user status, and groupTitle (d271e20, 12860ab)
  • Flags: support remote actor URIs in Flags.rescindReport (d111ae8)
  • Auth: #14793, clear forceLogin before session regeneration (40fc44f)

Test & Federation Fixes

  • Assert relative localPath in getEmoji test (59139cc)
  • Adjust ActivityPub privilege tests for remote uid/cid checks (aeb0a3e)
  • Federation: resolve analytics lint errors (#14703) (ce136e0)
  • Activitypub/jobs: only run drainLoop on primary process (5c5dc76)
  • Admin/federation: add pie chart, no-data state, and legend spacing to analytics (0eda2d6)

Performance Improvements

  • Don't map twice for keys (4d6379d)
  • Don't stringify unused value (5987213)
  • Use a single filterUids (3b76bf7)
  • Use index and get watching and everything above (e065409)

Refactors

  • Remove deprecated chat socket.io methods (a2aa265)
  • Change worker count (883953d)
  • Don't log timestamp parse error (7ca81b4)
  • New topic notification (708ccdd)
  • Remove postcss-clean (d1ee69...)
]]>https://browsedns.net/topic/23278/v4.16.0-2026-09-16RSS for NodeTue, 22 Sep 2026 00:00:54 GMTMon, 21 Sep 2026 22:19:33 GMT60<![CDATA[Reply to v4.16.0 (2026-09-16) on Mon, 21 Sep 2026 23:13:54 GMT]]>While this is all great and something I am thankful for, every icon now appears as just a square, and some as some symbol from a foreign language. Group tag colours aren't showing up, and it's all very laggy. (On Switch, anyways.) I'm aware that there's probably not much that can be done, however I am quite bothered.

]]>https://browsedns.net/post/257706https://browsedns.net/post/257706Mon, 21 Sep 2026 23:13:54 GMT<![CDATA[Reply to v4.16.0 (2026-09-16) on Mon, 21 Sep 2026 22:59:46 GMT]]>I'm on a Chromebook and the lag is so bad the site is barely useable, I'll click an icon like the chat icon or try to reply to a topic, but nothing will happen. and i'll wait, click it again, nothing happens and eventually I spam click it and still nothing and it'll just randomly work occasionally and if I can get into DMs, messages will just not send at all and the site will also get stuck refreshing for a while when I try to fix it by refreshing.

other, more resorce-intensive sites like discord run ok for me, it's quite literally just browse DNS that's not working.

@_izzy_ I was trying to reply to your post in this exact thread and I just couldn't, for me, some icons won't show up but they do eventually (on my end I think it's a lag issue)

I feel bad for switch users, bc if my non-school chromebook is able to run discord fine but browse DNS is just running poorly I can't imagine how bad the lag is for those using a switch.

]]>https://browsedns.net/post/257702https://browsedns.net/post/257702Mon, 21 Sep 2026 22:59:46 GMT<![CDATA[Reply to v4.16.0 (2026-09-16) on Mon, 21 Sep 2026 22:47:05 GMT]]>I would need help with the message display screen because I would not know what to type and plus I can't use the text box since the old messages are in the way

]]>https://browsedns.net/post/257694https://browsedns.net/post/257694Mon, 21 Sep 2026 22:47:05 GMT<![CDATA[Reply to v4.16.0 (2026-09-16) on Mon, 21 Sep 2026 22:45:33 GMT]]>period but now none of the buttons show up on nintendo, they just look like squares TvT (the upvote, messaging, notification bell, recents icon, ect.)

]]>https://browsedns.net/post/257692https://browsedns.net/post/257692Mon, 21 Sep 2026 22:45:33 GMT<![CDATA[Reply to v4.16.0 (2026-09-16) on Mon, 21 Sep 2026 22:32:12 GMT]]>Interesting

]]>https://browsedns.net/post/257684https://browsedns.net/post/257684Mon, 21 Sep 2026 22:32:12 GMT