:skull360: We've upgraded our Mastodon server to v4.7.0-alpha.2+mementomods-2026-07-27. A small one this time, mostly a security update, with 6 new commits from upstream since yesterday's build (mementomods-2026-07-26).
Upstream released 4.6.4 with three advisories, and those fixes are now in the nightly line we run:
Security:
- Two permission enforcement fixes, where some admin statistics and retention endpoints could be reached without the right role
https://github.com/mastodon/mastodon/security/advisories/GHSA-7jvv-fhmg-wpfw and
https://github.com/mastodon/mastodon/security/advisories/GHSA-hx34-2pfw-2qfj- An SSRF protection bypass through IPv4 compatible IPv6 addresses, which could be used to make the server fetch addresses it should refuse
https://github.com/mastodon/mastodon/security/advisories/GHSA-vwhj-3g83-v276Fixes & improvements:
- Polls without an expiration date can be voted in again
https://github.com/mastodon/mastodon/pull/39949- Tighter enforcement of the collection item limit
https://github.com/mastodon/mastodon/pull/39969As always, if you notice anything unusual or buggy, please reach out to me or any of the admins. Enjoy your time here, and feel free to message me with any questions or thoughts. :bunhdheart:
If anything feels off, please let us know!
#MementoMoriSocial #Mastodon #MastoAdmin