We have updated to v4.8.0-alpha.3+mementomods-2026-11-03-v4-security, which means today's Mastodon 4.7.5 security fixes cherry-picked on top of our 29.10.2026 security build.
🔒 Security
- Fixed a password authentication bypass for inactive accounts (https://github.com/mastodon/mastodon/security/advisories/GHSA-3xjw-gv43-3w62).
- Fixed a way to overload the server with specially crafted ActivityPub data (https://github.com/mastodon/mastodon/security/advisories/GHSA-cf49-73r7-rxj6).
- Fixed the Forwarded header taking precedence over X-Forwarded-For. Our proxy now also strips the Forwarded header (https://github.com/mastodon/mastodon/security/advisories/GHSA-qp4r-p842-mw5c).
- Updated dependencies with security advisories: addressable, loofah, rack and rails-html-sanitizer.
🔧 Fixes
- Invite use counts no longer go down when an invited user deletes their account.
🧠Mastodon 5 status
Mastodon 5 with its new design is still in alpha, and Mastodon Bird UI is not ready for it yet. Until we get things ready, we stay on our v4 build and pick only the security updates on top of it.
Source code: https://github.com/mementomori-social/mastodon
As always, if you notice anything unusual or buggy, please reach out to me or any of the admins. Enjoy your time here, and feel free to message me with any questions or thoughts. 
If anything feels off, please let us know!
