Post #4146683

:skull360: We've upgraded our Mastodon server to v4.7.0-alpha.2+mementomods-2026-07-27. A small one this time, mostly a security update, with 6 new commits from upstream since yesterday's build (mementomods-2026-07-26). Upstream released 4.6.4 with three advisories, and those fixes are now in the nightly line we run: Security: - Two permission enforcement fixes, where some admin statistics and retention endpoints could be reached without the right role https://github.com/mastodon/mastodon/security/advisories/GHSA-7jvv-fhmg-wpfw and https://github.com/mastodon/mastodon/security/advisories/GHSA-hx34-2pfw-2qfj - An SSRF protection bypass through IPv4 compatible IPv6 addresses, which could be used to make the server fetch addresses it should refuse https://github.com/mastodon/mastodon/security/advisories/GHSA-vwhj-3g83-v276 Fixes & improvements: - Polls without an expiration date can be voted in again https://github.com/mastodon/mastodon/pull/39949 - Tighter enforcement of the collection item limit https://github.com/mastodon/mastodon/pull/39969 As always, if you notice anything unusual or buggy, please reach out to me or any of the admins. Enjoy your time here, and feel free to message me with any questions or thoughts. :bunhdheart: If anything feels off, please let us know! #MementoMoriSocial #Mastodon #MastoAdmin