The Mastodon on AWS by FOSSonCloud pattern now ships Mastodon 4.6.6, up from 4.5.9. That crosses the 4.6.0 major release plus six patch releases, ending on a routine bug-fix release — and this one is not a drop-in patch, because 4.6.0 raised the platform’s infrastructure minimums.
What changed
4.6.0 — a substantial release
- Quote posts landed as part of an ongoing rollout — a feature the Mastodon team has been building toward for years based on community demand.
- Curated profile collections — users can create and share curated collections of profiles, useful for things like “accounts to follow in X community.”
- A reworked profile and profile-editing experience, plus institutional and organizational account features.
- A number of accessibility fixes.
- Minimum requirements moved up: Ruby 3.3+, Node.js 22+, FFmpeg 5.1+ — and ImageMagick support was fully dropped in favor of libvips.
4.6.1–4.6.3 — routine patches
One of them, 4.6.2, shipped solely to update the bundled FFmpeg in Docker images after a critical CVE.
4.6.4 — security
- Incorrect permission enforcement (GHSA-7jvv-fhmg-wpfw, GHSA-hx34-2pfw-2qfj)
- An SSRF protection bypass via IPv4-compatible IPv6 addresses (GHSA-vwhj-3g83-v276)
4.6.5 — hardening the new features
Stability fixes concentrated almost entirely around the two headline 4.6 features — a sign the team was actively hardening quote posts and collections after their initial rollout: collection items being incorrectly rejected, a typo in embedded-quote handling, account-merge logic incorrectly merging appeal and warning records, an off-by-one bug letting updated remote posts carry one too many attachments, collection item limits not being consistently enforced, oversized profile-image crop uploads, and emoji autocomplete occasionally suggesting emoji for the wrong keystroke.
4.6.6 — UI/UX polish
Pure bug fixes, no security content: preview cards failing to generate due to connection errors while processing certain linked content; the web UI becoming completely inaccessible when a URL happened to end in “.zip”; the picture-in-picture video player’s background rendering semi-transparent; a stray tooltip appearing over fullscreen video; alt-text editor image previews rendering too dark to judge properly; domain-block “impact” queries (used by admins to preview how many accounts a block would affect) being incorrectly rejected; mobile navigation scrolling to the top unexpectedly when opened; and the selected account being lost partway through creating a profile collection.
Why it matters
Quote posts are the change your users will talk about. They’ve been one of the most-requested and most-debated features in Mastodon’s history, and their arrival changes conversational norms on an instance — which means it’s a moderation policy question, not only a software update.
The infrastructure minimums are the change that affects you. Ruby 3.3+, Node.js 22+, and FFmpeg 5.1+ are hard requirements, and the removal of ImageMagick in favor of libvips is a real dependency swap in the media processing path. This is why 4.5.x → 4.6.x needs a maintenance window rather than a rolling restart.
The 4.6.4 SSRF bypass is worth understanding even though the pattern already covers it: SSRF protections that filter by IP address can be defeated by IPv4-compatible IPv6 notation, which lets a malicious federated server steer your instance at internal network addresses. That’s the same class of issue as the SSRF fix in the 4.5.x line — it’s a recurring hazard for any federated service that fetches remote URLs.
Finally, 4.6.5 and 4.6.6 are exactly the releases you want after a big feature launch: real users hit real edge cases in quote posts and collections, and the team fixed them quickly. If your instance adopted 4.6.0 early and users complained about lost account selections or rejected collection items, those are fixed.
What you should do
- Budget a maintenance window for the 4.5.x → 4.6.x jump. The Ruby, Node, and FFmpeg minimums plus the ImageMagick-to-libvips swap mean this is an infrastructure change, not just an application upgrade. Fresh deployments from the pattern already have all of it.
- Snapshot before upgrading. Standard advice, but especially warranted when media processing dependencies change.
- Verify media processing after the upgrade. Upload an image and a video, and confirm thumbnails and transcodes generate correctly — libvips is where any surprise will show up.
- Decide your quote post policy before your users decide it for you. Quote-posting changes how conversations escalate. Brief your moderators, and update your instance rules if needed.
- Confirm you’re at 4.6.4 or later if you have an instance that upgraded to 4.6.x early — the permission and SSRF fixes should not be sitting unapplied. At 4.6.6, you’re covered.
- Re-test any admin tooling that queries domain-block impact, which was broken before 4.6.6.
Version details in this post come from Mastodon’s own release notes and GitHub security advisories. If you hit anything upgrading the pattern, open an issue on GitHub.
— FOSSonCloud