Catodon 26.10.4 - Security release Security release - please update. 26.10.4 is a security release on top of 26.10.3: a fix for hashtag handling ported from Misskey, and two libraries updated for published security advisories. Every instance should update. Upgrading • Container image: pull 26.10.4 and restart. There is no migration and nothing to change in your configuration. • Source install: update the code, reinstall the dependencies (pnpm install --frozen-lockfile), rebuild and restart. What it fixes • Hashtag handling no longer does unbounded work on an overly long tag, a fix ported from Misskey 2026.10.1 (their private security fix be48948a). The hashtag endpoints and the hashtag stream now refuse a tag longer than 128 characters. An ordinary hashtag is matched exactly as before. • fastify, the web framework, moves to 5.12.7, which includes the 5.12.6 security fix. • sanitize-html, the HTML sanitizer used for posts from other servers among other things, moves to 2.18.1 for its published advisories. The same changes are on develop through #704. ​:catodon:​ #catodon