Mastodon Updated to 4.5.6 (February 9, 2026)
We have updated C.IM to Mastodon v4.5.6.
This release includes a security fix for ActivityPub collection caching, improvements to quote post handling, and several bug fixes for relationship caching, notifications, and connection management.
Security
- Fixed ActivityPub collection caching logic for pinned posts and featured tags not checking blocked accounts (GHSA-ccpr-m53r-mfwr)
Changes
Fixes
- Fixed relationship cache not being cleared when handling account migrations (#37664)
- Fixed quote cancel button not appearing after edit then delete-and-redraft (#37066)
- Fixed followers with profile subscription (bell icon) being notified of post edits (#37646)
- Fixed error when encountering invalid tag in updated object (#37635)
- Fixed cross-server conversation tracking (#37559)
- Fixed recycled connections not being immediately closed (#37335 and #37674)
Full changelog:
https://github.com/mastodon/mastodon/releases/tag/v4.5.6
Summary
This update patches a security issue in how Mastodon handles cached ActivityPub collections, and fixes several bugs around quote posts, notifications, and database connections.
C.IM now runs the latest patch release for the 4.5 series.
Source code for our instance is available at: