mastodon/mastodon
Your self-hosted, globally interconnected microblogging community
How mastodon is put together
Mastodon is a federated social network server implementing ActivityPub, licensed AGPLv3. The core is a Ruby on Rails 8.1 application (REST API, web UI backend, OAuth2 provider via Doorkeeper, admin and moderation tooling) with PostgreSQL as the primary datastore. Background processing uses Sidekiq backed by Redis; full-text search is layered through Chewy/Elasticsearch indexes in app/chewy. A separate Node.js streaming server (streaming/) provides real-time WebSocket timeline updates using Express 5, ioredis, pg, and ws. The frontend is a React 19 + Redux Toolkit single-page app built with Vite, TypeScript-checked, with Storybook for component development.
Languages
Frameworks
Datastores
Infrastructure
Major components
Rails web/API application
Serves the REST API, OAuth2 provider endpoints, HTML pages, and moderation/admin interfaces under app/controllers with Pundit authorization.
Streaming server (streaming/)
Standalone Node.js WebSocket service that pushes real-time timeline updates to authenticated clients by reading from Redis and PostgreSQL.
Background jobs (Sidekiq)
Queued workers for federation delivery, media processing, mailers, and scheduled tasks configured in config/sidekiq.yml with sidekiq-scheduler and sidekiq-unique-jobs.
Federation / ActivityPub layer
Handles inter-server communication, JSON-LD signature verification (linzer), HTTP signatures, and remote account/status interactions over HTTP (http gem).
Media pipeline
File attachment handling via kt-paperclip with custom transcoders in lib/paperclip (blurhash, ruby-vips, FFmpeg), storage backends for S3, OpenStack, and Azure.
Search indexing (app/chewy)
Chewy-managed Elasticsearch indexes for accounts, statuses, public statuses, instances, and tags.
Frontend SPA (app/javascript)
React 19/Redux client with react-intl i18n extraction, Vite build with SRI manifest plugin, service worker (public/sw.js), and Storybook stories.
Authentication & identity
Devise-based sessions plus two-factor auth (devise-two-factor), WebAuthn, LDAP/PAM strategies in lib/devise/strategies, and OmniAuth CAS/SAML/OIDC providers.
The navigation redesign continued to take shape, with new sections for custom feeds and followed hashtags plus several polish fixes.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
The navigation redesign continued to take shape, with new sections for custom feeds and followed hashtags plus several polish fixes.
Week of 2026-08-17
A busy week of 52 commits advanced the redesign (new menus, cards, modals, and the Cal Sans UI font) while bumping the version toward v4.7.0.
Week of 2026-08-10
The composer redesign kicked off in earnest alongside the first steps of the main navigation overhaul, with an alpha build cut for testing.
Week of 2026-08-03
A stability-focused week delivered fixes for deleted-account handling, database indexes, and Elasticsearch timeouts, plus a patch release.
Week of 2026-07-27
Foundation work for account deletion tracking and dropdown/composer redesigns landed, along with fixes for remote follows and backups.
Over the past five weeks, Mastodon's development has been dominated by a sweeping redesign of the web interface — a brand-new post composer, rebuilt navigation menus, and refreshed visual components — alongside steady progress toward the v4.7.0 release. Interspersed with the redesign work are numerous bug fixes around search, federation with other servers, and account management, plus routine dependency updates and automated translation refreshes. The team also shipped reliability improvements for server operators, such as better handling of deleted accounts and database performance tweaks.
Week by week
2026-08-24The navigation redesign continued to take shape, with new sections for custom feeds and followed hashtags plus several polish fixes.latest6 changes
Feature
Custom feeds and hashtags in the main menu
The redesigned sidebar now includes dedicated sections so users can quickly reach their custom feeds and followed hashtags.
Fix
Search no longer randomly auto-focuses
Fixed an annoying bug where the search box would grab keyboard focus at random times instead of only when intended.
Feature
App icon in the navigation header
The Mastodon app icon now appears at the top of the new navigation bar as part of the visual refresh.
Fix
Email block filter survives paging
Admins filtering blocked email domains no longer lose their filter when moving between pages of results.
Chore
Faster Docker startup via Bootsnap
The Docker setup now pre-compiles configuration code caches, helping servers start up more quickly.
Refactor
Internal code loading cleanup
Miscellaneous app files were switched to a faster, more modern way of loading code behind the scenes.
2026-08-17A busy week of 52 commits advanced the redesign (new menus, cards, modals, and the Cal Sans UI font) while bumping the version toward v4.7.0.6 changes
Feature
Account navigation menu added
A new menu gives users quick access to admin, moderation, and profile-related links from their account area.
Feature
New heading font: Cal Sans UI
Headings across the interface now use a fresh typeface as part of the ongoing visual redesign.
Feature
Composer redesign: attachments, replies, hints, messages
The new post-writing experience gained support for images and videos, reply contexts, helpful hints, and message tiles.
Chore
Version bumped to v4.7.0
The codebase was officially versioned as 4.7.0, marking progress toward the next release.
Fix
Autosuggestions fixed for space-less languages
Text suggestions no longer linger on screen when typing in languages like Japanese or Chinese that don't use spaces.
Fix
Remote actor public key errors fixed
Fixed crashes that occurred when processing accounts from other servers that had missing public key data.
2026-08-10The composer redesign kicked off in earnest alongside the first steps of the main navigation overhaul, with an alpha build cut for testing.6 changes
Feature
Redesigned post composer begins
Work started on a completely reworked post-writing screen, adding compose buttons, an emoji picker, visibility options, poll durations, and improved text editing.
Chore
v4.8.0-alpha.1 released
An early alpha version was tagged so testers can try upcoming changes before the stable release.
Feature
Main navigation redesign starts
The foundational work began on rebuilding the site-wide navigation, including a new footer section.
Fix
Web UI inaccessible with .zip URLs fixed
Fixed a bug where visiting certain web addresses ending in '.zip' made the web interface unreachable.
Fix
Mobile nav scroll-to-top fixed
Opening the mobile navigation menu no longer causes the page to annoyingly jump back to the top.
Fix
Alt text editor preview brightened
Image previews in the alt-text dialog are no longer shown too dark, making it easier to write accurate descriptions.
2026-08-03A stability-focused week delivered fixes for deleted-account handling, database indexes, and Elasticsearch timeouts, plus a patch release.6 changes
Fix
Deleted accounts handled more gracefully
Several safeguards were added so backups, favourites cleanup, and websocket streams all behave correctly when an account is being deleted.
Refactor
Elasticsearch query timeout added
Search queries now time out after 10 seconds by default, preventing slow searches from hanging the server.
Chore
Version bumped to v4.6.5
A maintenance patch release was published with accumulated bug fixes.
Refactor
Database index added for follow requests
A new database index makes lookups of pending follow requests faster on busy servers.
Fix
Spam-filtered scheduled posts fixed
Scheduled posts caught by spam filters now fail silently instead of throwing confusing errors.
Feature
Invalid handles shown in the web UI
The interface can now display basic information about user handles that are invalid or in conflict.
2026-07-27Foundation work for account deletion tracking and dropdown/composer redesigns landed, along with fixes for remote follows and backups.6 changes
Feature
Deletion-requested attribute for accounts
Accounts can now be marked as 'pending deletion' without being fully suspended, enabling cleaner account removal flows.
Fix
Remote users re-followed after address change
If someone on another server changes their web address, local followers are now correctly reconnected automatically.
Fix
Backups fixed for unusual attachments
Account data exports no longer fail when they contain attachment types beyond standard documents.
Feature
Dropdown redesign
Dropdown menus got a visual refresh with better sizing constraints as part of the broader interface overhaul.
Fix
Oversized profile image crops fixed
Uploading very large cropped profile pictures no longer causes errors.
Docs
New signature schemes documented
Developer documentation was updated to explain newly supported ways servers verify each other's identity.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required