MMastodon runs free, open-source social network servers based on the ActivityPub protocol, allowing users to share text, links, images, and videos. Users join a specific server (instance) and can follow others, while servers federation enables interactions across different Mastodon servers and other ActivityPub-compatible platforms. Its key differentiation is the decentralized, federated structure where each community hosts its own server, yet all servers communicate, giving users choice and broad reach. The goal is to provide a free, decentralized alternative to centralized social networks, with user data and community rules under local control.
Work here?Claim your company
Industries
Company Size
1-10
Company Stage
N/A
Total Funding
N/A
Headquarters
Berlin, Germany
Founded
2016
See people who can refer or advise you
Help us improve and share your feedback! Did you find this helpful?
Elestio catalog updates: 174 new releases this week (October 25-31, 2026). 174 stable releases landed across 52 services in the Elestio catalogue between 25 and 31 October. Two of them patched the same bug in two different databases on the same day, and the most interesting security fix of the week was not in the application at all. Start with the security section. Everything else can wait for Monday. Security alerts. Redis shipped a coordinated fix across seven branches on 26 October: 8.10.3, 8.8.4, 8.6.8, 8.4.8, 8.2.11, 7.4.12 and 7.2.17. The flaw is a heap buffer overflow when propagating a PUBLISH or SPUBLISH message larger than 4 GB over the cluster bus. It only bites in cluster mode. Redis marks the upgrade urgency as SECURITY. Valkey patched five branches the same day: 9.1.3, 9.0.7, 8.1.11, 8.0.12 and 7.2.15. The advisory, GHSA-f4q9-j22m-xqq9, describes an integer truncation in cluster publish message construction causing a heap buffer overflow. Rated high. If those two descriptions sound like the same bug, that is because they are the same lineage. Valkey forked from Redis, and a flaw in cluster publish handling predates the split. Running one instead of the other bought you nothing here. Mastodon released 4.7.4, 4.6.10, 4.5.20 and 4.4.27 on 29 October against GHSA-288h-6j8h-6x5j, rated critical: insufficient ActivityPub identifier verification. If you run a fediverse instance, this is the one to do first. PeerTube 8.3.2 (26 October) fixes a critical issue that is not PeerTube's code: a vulnerable sharp image processing dependency allowing remote code execution via a crafted SVG. A federation fix rated high ships alongside it. Grafana patched 13.3.0, 13.2.5, 13.1.9, 13.0.12 and 12.4.14 on 27 October, covering CVE-2026-100105, CVE-2026-13719, CVE-2026-13720 and CVE-2026-15577. Mautic issued security releases across three branches on 26 October: Community 7.2.2, 6.0.10 and 5.2.12, addressing CVE-2026-115188 among others. Jenkins 2.588 (28 October) carries multiple security fixes. Wekan 12.74 (30 October) stops the Caddy and FerretDB servers it bundles from opening MPTCP listeners, following Linux kernel bug CVE-2026-98432. Databases. * Redis 8.10.3 and Valkey 9.1.3 (26 Oct). See above. * InfluxDB v1.13.2 (30 Oct). Maintenance on the 1.x line. * Milvus 3.0.5 (30 Oct). Point release on the lake-native 3.0 branch. * Weaviate v1.40.3 (28 Oct). LSM store work and a recount property fix. AI and GPU. Development. * n8n 1.123.91 (30 Oct). Weekly cadence continues. * Jenkins 2.588 (28 Oct). Security, see above. * Strapi v5.60.0 (28 Oct), Directus v12.6.0 (27 Oct), NocoDB 2026.10.1 (29 Oct). * Hasura v2.51.3 (27 Oct), Appsmith v2.6.0 (28 Oct), ToolJet v3.20.252-lts (30 Oct). * Meilisearch v1.56.0 (28 Oct), Apache Solr 10.1.0 (27 Oct), Huginn v2026.10.26 (26 Oct). * Hoppscotch 2026.10.0 (30 Oct). The desktop app now uses the system trust store, so corporate and custom CAs work without extra configuration. Timely, given how many teams spent October untangling certificate trust. Hosting and infrastructure. * Grafana 13.3.0 (27 Oct). Security, see above. * RabbitMQ 4.4.0 (28 Oct), a minor version bump worth reading the notes on before upgrading. * Loki v3.7.9 (26 Oct), SigNoz v0.148.1 (29 Oct), VictoriaMetrics v1.155.0 (26 Oct). * Nomad v2.1.1 (29 Oct), Healthchecks v5.0.3 (27 Oct), Uptime Kuma 2.5.9 (31 Oct). Applications. * Mastodon 4.7.4, PeerTube 8.3.2, Mautic 7.2.2, Wekan 12.74. All security, see above. * WordPress 7.1.4 (28 Oct). Maintenance on the 7.1 line that shipped at WordCamp US. * Jellyfin 12.4 (26 Oct). The 12.x line continues to move quickly. * Ghost v6.73.0 (27 Oct), Element v1.12.33 (27 Oct), Discourse (30 Oct). * Paperless-ngx v3.4.1 (31 Oct), PhotoPrism (29 Oct), Penpot 2.18.5 (26 Oct). * OpenProject 17.9.6 (30 Oct), ERPNext v15.124.3 (30 Oct), Invoice Ninja v5.13.52 (30 Oct). * Metabase v0.65.2.5 (31 Oct), Jitsi Meet 9585 (31 Oct). Wekan deserves a second mention: it shipped eight releases this week, and 12.76 adds a password policy with an optional breached-password check, compulsory two-factor authentication, and sign-out of idle sessions. What stood out this week. Redis and Valkey patching the same flaw on the same day is the week's real lesson. Teams that migrated to Valkey after the licence change did so for governance reasons, and governance does not rewrite shared C code. A fork inherits the bugs that existed before it forked. PeerTube's critical fix was in sharp, not PeerTube. That is the second week running where the most serious issue in a self-hosted application arrived through a dependency rather than its own code. Your version number tells you nothing about what is linked underneath it. Mastodon and PeerTube both patched federation handling in the same week. ActivityPub is a protocol where other people's servers send you data by design, and that attack surface is still being mapped. Hoppscotch adopting the system trust store is a small change that solves a real October problem. Applications carrying their own certificate bundles is exactly why a CA distrust breaks things unevenly. Everything above is available as a one-click managed deployment in the Elestio catalogue, with automated updates, backups and monitoring. If you have automatic updates enabled, the security releases in this list are already queued for you. Thanks for reading | See you next Sunday
Trunk & Tidbits, September 2026. The Mastodon Team Building a better social web Welcome to the 30th edition of Trunks & Tidbits! Releases. Mastodon GmbH made two patch releases for all supported versions since its last Trunk & Tidbits post. As of this publication, its latest supported versions are 4.7.3, 4.6.9, 4.5.19 and 4.4.26. Please note that Mastodon 4.4 will stop being maintained in less than 2 months, and Mastodon GmbH advise any server running it to update to a more recent version. Mastodon 5.0 release is coming soon, and Mastodon GmbH shared an update of the upcoming interface changes. You can expect a first beta version very soon. Backend & web. In September 2026 Mastodon GmbH reviewed and merged 287 Pull Requests (202 with translation and dependency updates removed) from 17 contributors. This month, a lot of the activity was again to work on its upcoming Mastodon 5.0 redesign. In addition to this, here are the most significant changes: Android & ios. Mastodon GmbH is hard at work bringing a new navigational structure and features to align with the upcoming 5.0 design. Stay tuned! Thanks. Thanks for reading! If you're excited about what Mastodon GmbH is working on, would you consider supporting Mastodon GmbH with a small, recurring donation? Thank you for supporting Mastodon. Mastodon GmbH develop and maintain the free and open source software that powers the social web. There is no capital behind this - Mastodon GmbH rely entirely on your support.
Scheduling the same ai-generated post across X, Mastodon, and Bluesky. AImitatio Team | October 7, 2026 Posting the same update to X, Mastodon, and Bluesky used to mean three different copy-paste jobs. AImitatio's scheduler now treats all three as one job: you write a prompt once, set a schedule, and the content goes out to whichever networks you've connected - text and, where supported, video. How the scheduling actually works. Each content job has two timing settings: an interval (how often to post) and an optional randomness window added on top of it. That second part matters more than it sounds - a feed that posts at the exact same minute every day reads as a bot immediately. A few minutes of jitter on top of your interval is enough to make scheduled content look like it was actually posted by someone, without you doing anything by hand. One prompt, three different platforms. Under the hood, AImitatio has a separate posting integration for X (Twitter), Mastodon, and Bluesky - each network has its own API, its own character limits, and its own quirks, so the platform adapts the same generated content to fit each one rather than blasting out one identical blob of text everywhere. Bluesky in particular needed its own path: it's built on the AT Protocol, which identifies accounts by a DID rather than just a handle, and video works completely differently from a normal image upload. A video has to be uploaded to Bluesky's own separate video-processing service, authorized with a short-lived token scoped to just that upload, and then the platform waits - polling Bluesky's own job-status endpoint - until Bluesky confirms the video has finished processing before the post is considered published. AImitatio handles that whole handshake for you; from your side it's still just "this job posts to Bluesky too." Where the content comes from. None of this changes how you set up a job in the first place: you still write a prompt that gives the AI the context and tone you want, and AImitatio generates the text (and, if the job uses one, an image) from it. What changed is only the distribution side - the same generated post can now reach X, Mastodon, and Bluesky from a single schedule instead of needing a separate setup per network. Try it. If you're already using AImitatio for one network, connecting a second or third costs you nothing extra in setup time - the prompt and schedule stay the same, you're just adding another destination. New to AImitatio? See how the whole platform works or create a free account to set up your first job.
Mastodon integration, best time to post and more. You can now schedule your content for Mastodon. PostFlow also helps you find the best time to post, keep your calendar tidy with compact mode, and pause publishing in a crisis. Mastodon scheduler. PostFlow now integrates with Mastodon. Connect your account from any server, then schedule and publish posts directly to Mastodon. Best time to post insights. Analytics just got better. The new Best times section shows heatmaps of when your posts get the most engagement. Go as deep as you need. See insights for the whole organization, a group, or a single account, and narrow them down by post type. You can also compare them with general trends across PostFlow, based on posts from all accounts in PostFlow. Optimal publish time. Not sure when to schedule your post? Just pick one of the suggested times, based on the engagement of your published posts. Suggestions also adapt to your post. They change depending on whether you selected one network or several, and they take the post type into account, so a Reel gets different times than an image post. Optimal publish times are also available in the API and MCP. Calendar compact mode. Planning a lot of posts? Compact mode shrinks post previews and keeps your calendar tidy. It can be enabled only for published posts or for all posts. Pause publishing (crisis mode). Built for crisis management. Instantly stop all outgoing posts with a single click, across all social accounts in your organization or in individual groups. Other improvements. * Copy media anywhere and paste it into the post composer with Ctrl+V * What's new tab: read the latest changelog directly in the app * Option to keep unpublished posts as drafts when disconnecting a social account
Building shared infrastructure for the Fediverse. Published 03 Sep 2026 Bonfire is happy to share that Bonfire is working with Mastodon and a couple of other free software projects on two pieces of shared fediverse infrastructure: remote media storage and automated content detection. This work is part of a Mastodon grant from the Sovereign Tech Agency. Both projects will build on the open Fediverse Auxiliary Service Provider (FASP) API specifications. FASPs give fediverse servers a standardised way to connect to independent external services, so every platform does not have to build and operate the same capabilities on its own. This approach could support a wide range of services that improve the scalability, safety, accessibility, sustainability, and user experience of the fediverse. Its collaboration will initially focus on two areas: Remote media storage #. Shared services for processing, storing, and hosting media from remote posts can reduce the need for every server to keep its own copies or requiring users' browsers to fetch media directly from external servers (which can otherwise reveal the reader's IP address to those servers). Automated content detection #. Open interfaces for content detection will make it easier for server operators and moderators to connect services that flag potential spam, illegal material, and other abuse for review. Operators will be able to choose services that fit their communities' needs and policies instead of depending on a closed, platform-specific system. Whatever shape these services take, communities should always know what is being scanned and by whom; automated detection should flag things for human review rather than acting on its own; and any such service must be easy to audit and to swap out. Building infrastructure together #. Its role is to help shape the specifications and implement them in Bonfire so that any Bonfire server can plug in to compatible services. Implementing the same open specifications across different platforms will help ensure that FASPs become genuinely shared infrastructure rather than something controlled by a single project or provider. For Bonfire this follows directly from how Bonfire is built: composable building blocks from the bottom up, with modularity and extensibility at every level. FASPs extend the same principle to the whole ecosystem, turning common capabilities into shared infrastructure that any platform can benefit from and any community can enable or swap out. On a closed platform, capabilities like these are usually built in-house and imposed on everyone, or negotiated behind closed doors with a chosen vendor, and either way would answer to data harvesting and profiteering instead of the people who rely on them. Thanks to the Mastodon team for taking the open path and inviting Bonfire to build this together. Bonfire is excited to collaborate with all the teams involved, and Bonfire'll share updates as the project progresses. Going forward #. The FASP approach already reaches beyond these two areas: the Fediscovery project has been designing pluggable search and discovery providers, which Bonfire'd like to bring to Bonfire as well, so communities can choose which services index and surface their public content and how they can search and discover content beyond their server's bubble. More widely, this can lead to an ecosystem of mutualised services a community can easily plug into. Today, anyone setting up an instance often implies separately choosing and setting up external services for domain name and DNS, hosting, email delivery, file storage and CDN, spam protection and more, usually from big commercial providers. Imagine instead enabling each of those with a one-click toggle in your Bonfire settings, provided by co-ops in a cooperative hosting network, governed democratically and transparently, and shaped through co-design the way everything in Bonfire Mosaic is: what one community needs and builds becomes a service every community can benefit from. Bonfire'd also love to hear from you: what would you want from media storage or content detection services, and who would you like to see providing them (e.g. IFTAS)? What other services could this approach make possible? How should this infrastructure be run and governed? And how might it be funded sustainably? Get in touch and share your ideas. The Telling Continue the conversation. Questions, reflections, and additions are welcome. This thread is federated, so the conversation can travel beyond this page.
Find jobs on Simplify and start your career today
We update Mastodon's jobs every few hours, so check again soon!Browse all jobs
Industries
Company Size
1-10
Company Stage
N/A
Total Funding
N/A
Headquarters
Berlin, Germany
Founded
2016
Find jobs on Simplify and start your career today
We update Mastodon's jobs every few hours, so check again soon!Browse all jobs