NodeBB v4.14.0 — Federation regression fixes, security fixes, and more!

Submitted ⁨⁨3⁩ ⁨weeks⁩ ago⁩ by ⁨julian@community.nodebb.org⁩ to ⁨nodebb-development@community.nodebb.org⁩

With temperatures reaching well into the 30s (in celsius of course :sunglasses:) in the Toronto area, we're all firmly in summer mode :swimmer: :beach_with_umbrella: , but that won't stop us from forging on ahead with new features and fixes for NodeBB!

There are improvements across ActivityPub federation, administrative tooling, and security hardening. Our ActivityPub integration receives bug fixes including duplicate handling, configurable rate limiting, and better error reporting, alongside new hooks for remote user lifecycle events. The registration queue and invitations are reorganized into a dedicated UI with a new "Reject All" bulk action and improved notification handling. Security reports have been coming in consistently throughout the month with valid security reports (though almost all AI discovered and generated). This led to stricter privilege checks on post diffs, crossposts, and GDPR exports, plus protection against username enumeration. The NodeBB team strongly encourages upgrading to v4.14.0 for the latest security fixes and federation improvements. The release also includes a new tx() translation helper, Benchpress escaping improvements, and a first-run categories onboarding modal for fresh installations.

Here are the high level changes you can expect to see when you upgrade from v4.14.0 to v4.14.0... [...]

:globe_with_meridians: Federation Regression Fixes!

Around v4.12.0 or so, a number of regressions were unintentionally introduced as part of security fixes that severely hampered federation — especially with Lemmy-based instances and relays. We've resolved those regressions and Relay/Lemmy federation should resume within 24 hours after upgrading.

The public key fetch rate limiter logic was simplified and updated (due to it being faulty and not really working in the first place), streamlined some duplicate logic with Like/Dislike activities, improved the AP Errors reporting page in the ACP, added a parent traversal depth guard, fixed an issue where updates to scheduled topics were accidentally being federated out, and about a hundred other smaller bugs :slightly_smiling_face:

:ballot_box_with_check: Registration Queue updates

The registration queue was moved out of the ACP, and invitations are also managed in this page now. A "reject all" button was added to allow admins to quickly reject every queued registrant in one fell swoop.

🔒 Privilege & Security Fixes

Post diff access — Check topics:read privilege when loading post diffs
Crossposts — Added source category privilege check to crossposts
GDPR export — Prevented global moderators from performing GDPR data exports
Nids ownership — Don't mark nids as read/unread that you don't own
Upload privileges — Prevent uploading thumbnails without upload:image privilege; replaced extension-based MIME validation with content
sniffing
Username enumeration — Use dummy lockout key for non-existent users to prevent enumeration
Category disabled flag — Check category disabled flag on getRaw

:interrobang: Benchpress Improvements

We use Benchpress as our templating engine. We updated our integration for security and performance. @baris put together a thorough write-up for that one here.

Miscellaneous

First-run modal — New categories onboarding modal for fresh installations
Dashboard warnings — Added localhost and URL mismatch warnings to admin dashboard notices
Push notifications should work on Safari/iOS devices now (via the web-push plugin)

original

Comments

Sort:hotnew top

cagatay@community.nodebb.org ⁨1⁩ ⁨week⁩ ago
@julian I don't think I've ever seen a forum platform that is updated so frequently and continues to improve itself year after year. For that alone, all I can say is: great job, and thank you for the effort you've both put into it.

That said, I sometimes feel that when we focus heavily on certain initiatives, we risk moving away from the core realities and shortcomings of the forum itself.

For example, I enabled ActivityPub on my forum, but none of my users could actually use it. To be honest, even I struggled to understand it. Following people, interacting across different platforms, language differences, and not really knowing what was happening made it difficult to grasp.

Of course, everything isn't about money. I think it's an impressive piece of work from a technical perspective. But it's been around a year since development started maybe even longer and I think it's worth asking how many NodeBB forums are actively using it today. That kind of adoption is also an important measure of success.

That said, I've never doubted that you and Baris always do your best. I'm well aware that both of you have invested a huge amount of your time and energy into this project.

Thank you very much for taking the time to reply.

original
cagatay@community.nodebb.org ⁨1⁩ ⁨week⁩ ago
Hi @julian and @baris
As someone who has been following NodeBB for years, contributing feedback, and running my own forum on NodeBB for a long time, I wanted to ask something as a genuine self-reflection rather than criticism.
Do you really think ActivityPub has proven to be useful and widely adopted by NodeBB users?
The reason I'm asking is that you've invested an enormous amount of time and effort into it, and honestly, I feel a bit disappointed because I personally can't make practical use of it on my own forum. There are still areas that need improvement, such as language support, and to be honest, I'm not even sure what I would use it for. I also wonder whether the average NodeBB administrator actually knows how to use it or finds it valuable.

I can absolutely see why it makes sense for this forum (the NodeBB community forum), where federation and reaching users across the Fediverse can be beneficial. But does the same really apply to most other forums? Are you seeing real-world adoption and engagement from the broader NodeBB community, or is it still a niche feature?
I'm genuinely curious about your perspective because I'd like to understand whether the investment has paid off in practice.

original
- julian@community.nodebb.org ⁨1⁩ ⁨week⁩ ago
  Hey @cagatay, that's a good question, and one well worth asking.
  
  Right off the bat I'll say that if the majority of this work were not sponsored (by the NLNet foundation; @nlnet@social.nlnet.nl), then it wouldn't have happened, or happened as quickly. They were instrumental in accelerating the development of the AP integration.
  
  To me the question isn't directly one of value for money, results over spend, etc. Its a more existential question of whether forums are able to persist in this world of fast-paced social media, hot takes, sound bites, and memes. Forums have always been closer to the kind of "slower" web, a more deliberate web, and the "network" part of forums only extended as far as the site itself.
  
  A lot of forum admins think that's perfectly fine, and we support that world view. I wanted to explore what it meant if a forum could interconnect, not only with users on its own platform, not only with other NodeBBs, but to a worldwide fediverse of social networks. That's the potential that has been realized, but I'm still trying to figure out forums' place in this network.
  
  It seems very much so that forums don't tend to be generalist "anything goes" networks — usually there's an overarching topic. That makes it a less than ideal fit for the fediverse, there's a lot of noise, and finding the signal is key.
  
  So that's where I've been spending my time these past few months.
  
  I personally think the AP integration was well worth it, but I am very strict in my stance that AP is a choice, and full federation isn't always the right fit for every community.
  
  original
  - julian@community.nodebb.org ⁨1⁩ ⁨week⁩ ago
    @cagatay lastly if there are spots that you find NodeBB lacking, please do continue to discuss them here or open issues. We're receptive to improvements to NodeBB, and if they're not too niche of an improvement we'll usually be happy to put it into core.
    
    Otherwise plugins are where things should go 🙂
    
    original
silverpill@mitra.social@mitra.social ⁨3⁩ ⁨weeks⁩ ago
>Federation Regression Fixes!
Idk if this is related, but activitypub.space, which runs NodeBB 4.13.2, still sends me group-Announce activities without the Digest header.
original
- julian@community.nodebb.org ⁨3⁩ ⁨weeks⁩ ago
  @silverpill@mitra.social are they new activities or resends? I want to know whether this is an issue that has been fixed (but stale queue items persist), or whether it's an unfixed issue.
  
  original
  - silverpill@mitra.social@mitra.social ⁨3⁩ ⁨weeks⁩ ago
    They looked like new activities.
    The latest one is https://activitypub.space/post/https%3A%2F%2Fenby.life%2Fnotes%2Faol4zvw33l#activity/announce/1783847404321
    Delivered to my inbox at 2026-07-12T17:47:00Z
    original
    -> View More Comments