Mastodon Updated to 4.7.1

We have updated C.IM to Mastodon v4.7.1.

Our last update announcement covered v4.6.6, so this post also covers what’s new in Mastodon 4.7.0. Much of the work in 4.7 improves how Mastodon communicates with other servers, with a few changes you’ll notice while reading and posting. The 4.7.1 patch adds three security fixes.

What’s new in 4.7.0

Mastodon now handles remote accounts changing their handles more cleanly. It identifies them by their ActivityPub actor ID and updates the existing account record when a handle changes. Previously, it created a duplicate account and then merged the two. This improves compatibility with services that support renaming accounts; Mastodon itself still does not let users change their handles.

Link previews gain support for the FEP-8967 format. When another server includes a Link attachment in a post, Mastodon can use it as the preview card. Mastodon also includes these attachments in outgoing posts that have a preview, giving other compatible services an explicit link to work with.

For everyday browsing, boost deduplication now looks back over the last 80 posts instead of 40, reducing repeated boosts in a feed. Several bugs have also been fixed:

Embedded videos no longer restart when you interact with posts in the same feed.
Timelines can load more posts when the last item is an inline follow suggestion.
Newly published posts no longer fail to appear immediately in timelines.
Autosuggestions dismiss correctly in languages that do not use spaces.

Private keys and federation signatures

Mastodon 4.7.0 moves local users’ cryptographic keypairs into a dedicated database table and encrypts the private keys at rest. These are the keys used for federation; this change does not add end-to-end encryption to messages.

The release also expands support for federation signatures, including outgoing RFC 9421 HTTP Message Signatures as a fallback and verification of FEP-8b32 Object Integrity Proofs. These changes help Mastodon exchange and verify activities with services using newer signing formats.

Security fixes in 4.7.1

The 4.7.1 release patches three vulnerabilities that also affect 4.7.0:

GHSA-vx32-x96w-qq65, rated high severity, fixes a password-check bypass for accounts using LDAP, PAM, or server-configured SSO with no database-stored password. Exploitation required the account to have two-factor authentication enabled and the attacker to possess a valid second factor, such as a TOTP token or backup code.
GHSA-vgm8-frgh-rh2v, rated medium severity, mitigates crafted JSON-LD activities that could take several minutes each to process, causing a denial of service.
GHSA-62j4-hvj7-px3f, rated high severity, closes an admin API access gap for frozen staff accounts. Affected staff could still use the API and even restore their own login access. The bug specifically concerned freezing accounts; removing staff roles or suspending accounts already revoked access correctly.

The patch also restores the application-reason prompt for invited users who still require approval and keeps the email-domain block filter in place when administrators move between pages.

Full changelogs:

C.IM source code: https://github.com/odotee/mastodon