# Mastodon v4.6.10 fixes ActivityPub security flaw and updates Ruby dependency

> **Key takeaway:** Mastodon v4.6.10 addresses a critical ActivityPub identifier verification vulnerability and requires a Ruby version update.

**Published:** 2026-10-29T14:04:08+00:00 
**Source:** Mastodon Fediverse Platform 
**Category:** decentralized-p2p 
**Canonical URL:** https://fosswire.org/news/mastodon-v4610-fixes-activitypub-security-flaw-and-updates-r.html 

## Summary
The Mastodon social networking platform has released version 4.6.10, which includes a significant security fix regarding ActivityPub identifier verification. This update addresses vulnerability GHSA-288h-6j8h-6x5j, which involved insufficient validation of identifiers within the decentralized protocol.

Beyond security, this release introduces breaking changes for administrators, specifically an update to the default Ruby version and a requirement for asset recompilation. The update also includes several performance optimizations for hashtag queries and timeline deliveries, alongside various dependency updates to mitigate known advisories in Ruby, NodeJS, and several supporting libraries.

## Security fixes and technical requirements
- **Security Vulnerability:** Fixes GHSA-288h-6j8h-6x5j, addressing insufficient verification of ActivityPub identifiers to ensure proper protocol integrity.
- **Dependency Management:** Updates multiple core dependencies to resolve security advisories, specifically targeting Ruby, NodeJS, excon, css_parser, pghero, and sanitize.
- **Runtime Requirements:** Updates the default Ruby requirement to version 3.3 or newer and requires Node.js 22 or newer.
- **Performance Optimizations:** Implements fixes for inefficiencies in hashtag timeline queries and timeline deliveries, as well as correcting a bug where followers-only posts were incorrectly excluded for non-followed users.
- **Deployment Changes:** Requires manual asset recompilation via `rails assets:precompile` and notes potential build issues with the `charlock_holmes` gem on systems using recent GCC versions.

## Why it matters
As a cornerstone of the Fediverse, this update is critical for instance administrators to maintain secure and efficient federation. The change in default Ruby versions and the requirement for asset recompilation mean that automated deployment scripts and Docker workflows must be reviewed to ensure compatibility with the new runtime environment.