← Feed

Posts

• View post

  NodeBB v4.15.0 — QoL and security updates, plus a few new features I realized we didn't put together any release notes for v4.15.0, so here they are :smile: For reference, v4.15.0 was released 12 August 2026. [...] :lock: Security Fixes We receive many reports for vulnerabilities via our bug bounty program, and we encourage people to poke around and find vulnerabilities to report. Note that as of today (1 September 2026), any reports compiled with the help of large language models a...

• View post

  With temperatures reaching well into the 30s (in celsius of course :sunglasses:) in the Toronto area, we're all firmly in summer mode :swimmer: :beach_with_umbrella: , but that won't stop us from forging on ahead with new features and fixes for NodeBB! There are improvements across ActivityPub federation, administrative tooling, and security hardening. Our ActivityPub integration receives bug fixes including duplicate handling, configurable rate limiting, and better error reporting, al...

• View post

  A new feature silently dropped in v4.12.0. NodeBB now supports Activity Intents! Huh? What's an Activity Intent? It is a proposal by @benpate@mastodon.social that aims to "extend the capabilities of an ActivityPub server beyond a user's outbox, and enable direct interactions with content on the wider social web." In other words, it allows you to more seamlessly use your fediverse account on other sites without having to register a new account just to contribute. In even s...

• View post

  Hi everybody — late last week we released v4.11.0, which contains the following changes: ActivityPub Specific Fixes :rotating_light: AP analytics and error pages New pages have been added to the control panel to display analytics (send/receive counts) and error counts. There is also a new error page that will show error received within the last 24 hours, and their respective payloads. This will aid in debugging federation issues. :writing_hand: Article vs. Note distinction updated Prior to t...

• View post

  Since 2017, we've maintained a bug bounty program that awarded responsible disclosure of security vulnerabilities on a sliding scale of $64 to $512 based on severity. Throughout the years we've made some unpublished changes to this bounty program, mostly related to the format (no videos, text only, allowed testing endpoints) and in some cases expanding the scope of covered plugins (e.g. 2factor, web-push). With the rise of LLMs and the corresponding drop in ability needed to analyze...

• View post

  Stoked to see BSD Cafe has a new site... Running NodeBB :sunglasses: https://billboard.bsd.cafe/ Considering they don't run just anything, we're in good company! Their other instances run Mastodon (of course) and snac2, arguably one of the most lightweight ActivityPub services.[...] Designed as a hybrid space, it functions as a classic discussion forum with persistent threads while also supporting ActivityPub federation, enabling cross-platform interactions without algorithmic cur...

• View post

  Hi everybody, With spring around the corner (it is currently a balmy 5°C here right now), it's time to get crackin' on a new release of NodeBB! We focused on a lot of user experience updates this time around, along with tweaking the new /world page that was introduced in v4.9.0. In the backend, lots of optimizations were implemented, which make federation processing (and day-to-day maintenance) faster. Here's what you can expect from v4.10.0...[...] :globe_with_meridians: Upd...

• View post

  We are publishing a notice today to bring to attention an unintentional breaking change that could affect some users of NodeBB. v4.5.0 contained an update to src/request.js that calls a DNS resolver to ensure that the destination address is not a reserved IP address (e.g. 192.168..., 127.0..) This change was introduced in order to close off any potential for Server-Side Request Forgery for any calls made within the NodeBB codebase. [...] In the vast majority of installations, this has no u...

• View post

  Up until today, when you queried a NodeBB user or category's outbox, you would receive an empty OrderedCollection. This was done because the property's inclusion in the actor object was required, but it was not immediately apparent in 2024 how many people utilised this property. Thus it was easier to just send the empty outbox and pursue more urgent functionality. While sending that empty outbox has not broken any implementations, but it has come to my attention that a few (read: more...

• View post

  It is possible for NodeBBs to talk with each other. In fact, not only can two NodeBB forums see and share conversations, you can also connect with other websites that can federate. This article is part of the NodeBB Answers category, where you can learn more about setting up, maintaining, and using your NodeBB forum. [...] How does it work? Under the hood, NodeBB uses a protocol called ActivityPub to exchange messages and activities between different websites and apps. Each user, category,...