Wandering Adventure Party

@bh4-tech thanks for reporting, fixed in https://github.com/NodeBB/NodeBB/issues/14109

@julian I think it's a good workaround if you don't keep original activities.

We are publishing a notice today to bring to attention an unintentional breaking change that could affect some users of NodeBB. v4.5.0 contained an update to src/request.js that calls a DNS resolver to ensure that the destination address is not a reserved IP address (e.g. 192.168..., 127.0..) This change was introduced in order to close off any potential for Server-Side Request Forgery for any calls made within the NodeBB codebase. In the vast majority of installations, this has no unintended effects. In some installations, custom plugins or themes may call URLs that resolve to an internal address on purpose (e.g. to query an internal database or similar.) In those situations, the call will now fail as of v4.5.0. In those situations, you will need to update the plugin to add the domain to the allow list by calling the filter:request.init hook: plugin.json { ... "hooks": [ ... { "hook": "filter:request.init", "method": "allowInternalHostname" }, ... ] ... } library.js or similar const plugin = module.exports; plugin.allowInternalHostname = async ({ allowed }) => { allowed.add('example.org'); return { allowed }; });

@quaff@thecanadian.social you’re… right about that in my rush I forgot to update this instance

@panos okay, it turns out your account (and like 5 others, me included) had started “tracking” the /world category, which didn’t really make sense. I removed that option awhile back, but the setting probably stayed behind. I’ve cleared that setting and manually flushed your inbox now, so you should see a more sane /world page going forward.

Oh, I am liking the looks of this. Would love to test (play) with this when/if available.

@panos cross posts themselves are not federated out because there is no established standard or FEP that spells out how its done. (Not that that’s ever stopped me before… but I digress.) When a user cross-posts a topic to another category it will federate out an “announce”, which looks like a boost on Mastodon. I’ve put some of those checks in here for me to look at. https://github.com/NodeBB/NodeBB/issues/13931

Hope everybody is having a great autumn — with temperatures slated to drop next week, I suppose it’s almost time for winter 🥶 (and yes, I use em dashes. No LLM was used to write this travesty of a release post.) We’ve just dropped NodeBB v4.7.0 with some nice QoL improvements for sites federating via ActivityPub. Security Fixes Just a note that v4.6.3 contained a dependency upgrade to the validator package that fixes CVE-2025-56200. v4.7.0 contains this fix as well. New setting to control whether uploaded media is displayed as a topic thumbnail ️ Early changes to better handle ActivityPub content meant that uploaded post content was shown in the topic thumbnails set. This is now a configurable option in Settings > Uploads. Removal of the “federated description” We had a small postscript added by default when categories federated outward, and it even came with some default text about mentioning the category to create a topic. It didn’t quite work out like we planned, and just looked plain weird when viewed through other threadiverse software (you don’t mention a community to create a post in it). For now I’ve removed that feature. A link back to remote categories ️ Remote categories now have a button that allows you to navigate directly to the community itself — be it a Lemmy or Piefed community, Peertube channel, etc. Category boost fixes When a topic is moved between categories, the related categories will share (or “Announce” in AP parlance) OP. Likewise, it will be unshared by the other category is no longer belongs to. N.B. For devs — categories will also federate out Move and Remove activities for the appropriate contexts, which is going to be part of an upcoming FEP the ForumWG is working on. Improved handling of remote content in chats When receiving non-public content from remote sources (shown as a chat message), embedded images are now included. When sending chat messages outside of NodeBB, emoji are now included.

We have just released v4.6.0 of NodeBB, containing fixes to our ActivityPub integration, minor fixes with SCSS, and some new functionality with topic templating. ActivityPub Fixes WordPress blogs can be properly pulled into NodeBB (via their URL) now Fixed an error when moving a remote topic to another category This also fixed the issue where moved topics didn’t update topic/post counters Fixed bug where NodeBB could not properly process Link headers when it contained the standalone crossorigin directive Notifications for replies to topics made in remote categories now show the appropriate user Fixed bug where remote users were not able to post to a local category if registered-users privilege was removed (now checks fediverse pseudo-user) Nested remote categories can now be removed from the ACP Remote categories can be renamed for de-duplication purposes Improved title generation for quote-posts Core fixes Persona theme now shows hidden (zero-character) links in post content _variables.scss page in ACP > Appearance can now override Bootstrap variables A template can be provided in a category’s settings. This template is auto-populated in the composer when a new topic is being authored.

Hi everyone! I’m trying to upgrade from v4.4.6 to v4.5.2 and after connecting to Redis, it just stucks and I don’t know where yet. There is no error. The HTTP server doesn’t start. Our forum has a lot of users, uploads, posts. We had several issues in the past. I will try to figure out what’s wrong, but if anyone have an idea what might be the problem in v4.5.x, it would help me. Thanks, Tomas

@Mark_Harbinger @lippyduck Yep, just walk away.

KirillJsx https://github.com/NodeBB/NodeBB/issues/13722

@AltCode ackchyually… it opens in the same tab for me. … because there’s a user setting for it I’ll update it to respect that user setting.

julian No, it does not. Not even the push notifications button stays on.