v2026.5.4
This release mitigates the recent eMudhra CA compromise, as well as adding various security hardening fixes:
- Secure mode can no longer be disabled
- API tokens for admin accounts can no longer access admin endpoints unless explicitly allowed
- Moderator accounts can no longer access the queue dashboard
- Image size is now capped on megapixels as well as individual dimensions
- Signin history no longer includes header data
- Private pages and clips no longer render metadata to public crawlers
- Moderators can no longer reset other moderators' passwords
Iceshrimp Updates Bot
@iceshrimp_updates@meow.company