We just released Mastodon v4.7.4, v4.6.10, v4.5.20 and v4.4.27.
For those using our nightly containers, the `nightly.2026-10-30-security ` tag is available with the fix.
In addition to several bugfixes and dependency updates, they fix a critical security issue that can be used to impersonate remote accounts and activities. We urge admins to update as soon as possible.
Full release notes and update instructions are available on the GitHub releases page.
@MastodonEngineering is there an easy way to make sure it fixes any permissions issues without having to modify the Dockerfile every time on a build?
That seems to be the only sticking point I have with standard upgrades. (moved from 4.7.3 to 4.7.4)