NodeBB v4.14.0 — Federation regression fixes, security fixes, and more!
-
wrote last edited by [email protected]
With temperatures reaching well into the 30s (in celsius of course
) in the Toronto area, we're all firmly in summer mode 
, but that won't stop us from forging on ahead with new features and fixes for NodeBB!There are improvements across ActivityPub federation, administrative tooling, and security hardening. Our ActivityPub integration receives bug fixes including duplicate handling, configurable rate limiting, and better error reporting, alongside new hooks for remote user lifecycle events. The registration queue and invitations are reorganized into a dedicated UI with a new "Reject All" bulk action and improved notification handling. Security reports have been coming in consistently throughout the month with valid security reports (though almost all AI discovered and generated). This led to stricter privilege checks on post diffs, crossposts, and GDPR exports, plus protection against username enumeration. The NodeBB team strongly encourages upgrading to v4.14.0 for the latest security fixes and federation improvements. The release also includes a new
tx()translation helper, Benchpress escaping improvements, and a first-run categories onboarding modal for fresh installations.Here are the high level changes you can expect to see when you upgrade from v4.13.0 to v4.14.0...
Federation Regression Fixes!Around v4.12.0 or so, a number of regressions were unintentionally introduced as part of security fixes that severely hampered federation — especially with Lemmy-based instances and relays. We've resolved those regressions and Relay/Lemmy federation should resume within 24 hours after upgrading.
The public key fetch rate limiter logic was simplified and updated (due to it being faulty and not really working in the first place), streamlined some duplicate logic with Like/Dislike activities, improved the AP Errors reporting page in the ACP, added a parent traversal depth guard, fixed an issue where updates to scheduled topics were accidentally being federated out, and about a hundred other smaller bugs
Registration Queue updatesThe registration queue was moved out of the ACP, and invitations are also managed in this page now. A "reject all" button was added to allow admins to quickly reject every queued registrant in one fell swoop.
Privilege & Security Fixes- Post diff access — Check topics:read privilege when loading post diffs
- Crossposts — Added source category privilege check to crossposts
- GDPR export — Prevented global moderators from performing GDPR data exports
- Nids ownership — Don't mark nids as read/unread that you don't own
- Upload privileges — Prevent uploading thumbnails without upload:image privilege; replaced extension-based MIME validation with content
sniffing - Username enumeration — Use dummy lockout key for non-existent users to prevent enumeration
- Category disabled flag — Check category disabled flag on getRaw
Benchpress ImprovementsWe use Benchpress as our templating engine. We updated our integration for security and performance. [@baris put together a thorough write-up for that one here](https://community.nodebb.org/topic/19364/upcoming-breaking-changes-for-4.14.0).
Miscellaneous
- First-run modal — New categories onboarding modal for fresh installations
- Dashboard warnings — Added localhost and URL mismatch warnings to admin dashboard notices
- Push notifications should work on Safari/iOS devices now (via the web-push plugin)
-
>Federation Regression Fixes!
Idk if this is related, but activitypub.space, which runs NodeBB 4.13.2, still sends me group-Announce activities without the
Digestheader. -
>Federation Regression Fixes!
Idk if this is related, but activitypub.space, which runs NodeBB 4.13.2, still sends me group-Announce activities without the
Digestheader.@[email protected] are they new activities or resends? I want to know whether this is an issue that has been fixed (but stale queue items persist), or whether it's an unfixed issue.
-
They looked like new activities.
The latest one is
https://activitypub.space/post/https%3A%2F%2Fenby.life%2Fnotes%2Faol4zvw33l#activity/announce/1783847404321
Delivered to my inbox at 2026-07-12T17:47:00Z -
They looked like new activities.
The latest one is
https://activitypub.space/post/https%3A%2F%2Fenby.life%2Fnotes%2Faol4zvw33l#activity/announce/1783847404321
Delivered to my inbox at 2026-07-12T17:47:00ZThanks, I've found a bug where retries were not sending in the (saved) digest, and updated
activitypub.spaceCan you let me know if you are still seeing them? Since they only occurred on retries, it was likely not something that happened often.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login