We just published version 2.4.0 of the Mastodon on AWS by FOSSonCloud pattern to AWS Marketplace. The highlight is a Mastodon upgrade from 4.5.1 to 4.5.9 — spanning eight patch releases that focused heavily on security hardening.
What’s in this release
Mastodon 4.5.9 (up from 4.5.1)
Upstream shipped eight patch releases between our 2.3.0 and 2.4.0. The headline is security. Over those eight releases, Mastodon fixed:
- SSRF protection bypass (
GHSA-xfrj-c749-jxxq) — could let a malicious federated server probe the hosting instance’s internal network - Email verification gap (
GHSA-5r37-qpwq-2jhh) — insufficient verification of email addresses - Missing ownership checks on severed relationships and push notification settings (
GHSA-ww85-x9cp-5v24,GHSA-f3q8-7vw3-69v4) - Information disclosure through inconsistent error handling on private posts (
GHSA-gwhw-gcjx-72v8) - ActivityPub caching logic not honoring blocks for pinned posts / featured tags (
GHSA-ccpr-m53r-mfwr) - Remote user suspension bypass (
GHSA-5h2f-wg8j-xqwp) - Missing length limits on user-provided fields (
GHSA-6x3w-9g92-gvf3) - Open redirect in legacy path handler (
GHSA-xqw8-4j56-5hj6) - FASP reliability issues fixed across 4.5.7 (
GHSA-qgmm-vr4c-ggjg,GHSA-46w6-g98f-wxqm) - Quote post authorization checks tightened (
GHSA-q4g8-82c5-9h33)
Stability and quality-of-life fixes
On top of security, upstream fixed a long list of smaller issues — duplicate conversations, quote handling edge cases, emoji rendering in profile fields, keyboard shortcut regressions, YouTube embed reliability, federation tracking across servers, and more. None earth-shattering, but collectively meaningful for operators seeing odd behavior in their logs.
Admin tooling
tootctl emoji purge now supports a --suspended-only option for cleaning up emoji from suspended remote domains — useful on instances that have grown a large block/suspend list.
Pattern-level modernization (not from upstream)
We also refreshed the deployment tooling underneath the pattern:
- CDK
2.120.0→2.225.0 - OE CDK common library →
4.5.0(adds versioned AMI parameter support, CloudWatch Logs early-start, Aurora PostgreSQL 15.13, ElastiCache Redis 7.0 — see caveat below) - Packer upgraded
- TaskCat upgraded
- Marketplace submission now uses the AWS Marketplace Catalog API end-to-end, replacing the older PLF spreadsheet workflow — faster iteration for us, no change for you
Fresh deployments
Just subscribe on AWS Marketplace and launch. You’ll need a Route 53 hosted zone and an ACM certificate in advance — everything else the template provisions.
What’s next
We’re building out a marketing-content automation pipeline so future releases get their blog post, LinkedIn update, and release video drafted automatically from the CHANGELOG and upstream release notes. This is the first post written with that pipeline in the loop — expect faster turnaround on future upgrades.
As always, thanks to everyone running the pattern and filing issues. If you hit anything in 2.4.0, ping us on GitHub.
— FOSSonCloud