# Mastodon 4.7.4 patches ActivityPub verification flaw, adds inactive-login challenge

> **Key takeaway:** Mastodon 4.7.4 fixes a critical ActivityPub identifier verification vulnerability (GHSA-288h-6j8h-6x5j) and introduces security challenge emails for dormant accounts, alongside dependency updates for Ruby, Node.js, and multiple gems.

**Published:** 2026-10-29T14:00:06+00:00 
**Source:** Mastodon Fediverse Platform 
**Category:** decentralized-p2p 
**Canonical URL:** https://fosswire.org/news/mastodon-474-patches-activitypub-verification-flaw-adds-inac.html 

## Summary
Mastodon has released version 4.7.4, a security-focused update for the open-source federated social network that addresses a vulnerability in ActivityPub identifier verification tracked as GHSA-288h-6j8h-6x5j. The release also adds a new security mechanism that sends challenge emails to users attempting to log in after extended periods of inactivity, and updates dependencies to resolve security advisories affecting Ruby, Node.js, excon, css_parser, pghero, and sanitize. Administrators upgrading from 4.7.3 must recompile assets and may need to update their Ruby version, with the default now set to 3.3 or newer. The update also fixes several timeline query inefficiencies, a bug where followers-only posts were incorrectly excluded from account timelines, and a federation issue where local collection item revocations were not properly propagated to other instances.

This release follows the significant 4.7.0 milestone and requires standard upgrade procedures including database backups. Docker deployments need only restart processes, while non-Docker installations face additional steps including potential workarounds for charlock_holmes gem compilation failures on newer GCC versions. The dependency requirements remain unchanged from v4.6.0, maintaining PostgreSQL 14+, Redis 7.0+, Node 22+, and libvips 8.13+ as minimum versions.

## Security fixes and federation changes in Mastodon 4.7.4
- **ActivityPub verification flaw (GHSA-288h-6j8h-6x5j):** The release patches insufficient identifier verification in ActivityPub handling, a vulnerability in Mastodon's federation protocol implementation that could potentially allow spoofed or unauthorized actor references.
- **Inactive account login challenge:** A new security feature sends challenge emails to users authenticating after long periods of inactivity, adding a layer of account takeover protection for dormant accounts.
- **Dependency security updates:** Multiple dependency chains were updated to address advisories in Ruby runtime, Node.js runtime, and specific gems including excon (HTTP client), css_parser, pghero (PostgreSQL monitoring), and sanitize (HTML sanitization).
- **Timeline query optimizations:** Two fixes address inefficiencies in hashtag timeline database queries and timeline delivery processing, improving performance for instances with high post volumes.
- **Federation revocation fix:** Local collection item revocations now properly federate to remote instances, correcting a bug where removal actions on local content were not propagated across the ActivityPub network.

## Why it matters
For the thousands of self-hosted Mastodon instances comprising the Fediverse, this release represents a mandatory security update due to the ActivityPub verification vulnerability, which affects core federation trust boundaries between servers. The inactive-login challenge aligns Mastodon with broader industry practices for account security, particularly important for an ecosystem where many users maintain multiple accounts across instances with varying administrative competence. The timeline performance improvements and revocation federation fix directly benefit instance administrators managing resource constraints and content moderation workflows at scale.