nextcloud/social v0.23.0 on GitHub

✨ Highlights since v0.10.0

Social 0.23.0 is a major evolution of Nextcloud Social. It brings a much more complete, accessible and interoperable social experience to your Nextcloud — from everyday posting and media sharing to federation, moderation and administration.

🌍 Federation & interoperability

🤝 More reliable ActivityPub federation with hardened actor signatures, delivery, inbox handling and remote visibility
🐘 Broader Mastodon compatibility, including follow/unfollow, search, filters, preferences, familiar followers, peers and activity integration
🦣 Pixelfed-compatible routes, account import, stories, collections, reports, direct messages and administrative workflows
📺 PeerTube interoperability: discover channels, stream remote videos and publish videos that PeerTube can consume
🔁 Relays for bringing public posts from other federated servers into a local timeline
🔗 Deep links that open posts and profiles in the right place, plus link previews and rich unfurls in Talk, Text and Deck
🧭 WebFinger, NodeInfo and federation-health checks for administrators

✍️ Publishing & conversations

📝 Edit and delete posts, with a visible edit history
💬 Replies displayed as conversations, with improved thread resolution and reply forwarding
❗ Content warnings for posts and media
⏰ Scheduled posts with a queue visible in account settings
🗣️ Quote posts with author-controlled quote permissions
#️⃣ Hashtag following, trending hashtags and hashtag discovery
🗳️ Create, view and vote in federated polls
😀 Emoji reactions and custom emoji from other instances
🔒 Per-post visibility controls and clearer audience handling

👥 Social graph & discovery

🔐 Locked accounts with approvable follow requests
🚫 Account blocking, muting, timed mutes and domain blocks
📋 Personal lists, keyword filters and automatic lists for Nextcloud groups
🧭 Discover page with suggested accounts, starter packs and people from the same Nextcloud
⭐ Pinned posts, endorsements, notes and familiar-follower context
🔔 A complete notifications area with unread counts and actionable follow requests

🖼️ Photos, video & audio

📎 Attach images, video and audio to posts, with improved upload and attachment management
🖼️ Alt text, focal points, WebP support and automatic removal of camera metadata such as GPS coordinates
🎬 Dedicated Videos timelines, video watch pages, chapters, RSS feeds and PeerTube channel support
📡 Byte-range streaming, poster frames, HLS transcoding ladders and configurable video quotas
🛡️ Moderation controls for sensitive media and posts containing video
📁 Share pictures and videos directly from the Nextcloud Files app

👤 Profiles, accounts & personal data

🪪 Profile tabs for Posts, Photos and Videos, richer biographies and profile metadata fields
✅ Verified profile links with rel="me" guidance
📊 Personal and instance statistics, comparisons over the last 30 days and post-level insights
📤 Import and export for follows, followers, blocks, mutes and lists
🔑 Authorized-app management with visibility into access and last use
🗑️ Delete a Social account while correctly notifying federated servers
👋 First-run introduction for new users

🛡️ Moderation, security & administration

🧑‍⚖️ Reporting workflows and an administration moderation panel
📣 Instance announcements and moderation settings through the admin interface
🧰 Admin API and setup checks for WebFinger, instance identity, delivery and outbound queues
🧱 Stronger OAuth protection with scoped tokens, CSRF protection, brute-force protection and hashed client secrets
🔐 Encrypted actor private keys at rest and safer outbound-request/SSRF handling
🚦 Rate limiting for incoming federation deliveries and bounded signature replay windows
🧹 Retention controls for remote content and clearer federation queue status

📱 Accessibility, usability & performance

📱 Responsive phone layout and a smoother mobile composer
⌨️ Keyboard-friendly navigation, screen-reader improvements and accessible timeline reading
✨ View transitions, hover cards, drag-and-drop, rolling counters and a more polished timeline
🏠 Expanded dashboard widgets for timelines, mentions, direct messages, bookmarks and follow requests
⚡ Faster timelines, lighter pages, improved caching and queue processing, database indexes and fewer round trips
🧪 Broader frontend, backend, integration, browser and interoperability test coverage
🌐 Translated error messages and improved documentation aligned with the implementation

Social 0.23.0

What's Changed

v0.10.1: Fix federation bugs, migrations, and cleanup by @SchBenedikt in #2004
fix: sanitize remote HTML with an allowlist instead of strip_tags by @karlitschek in #2023
test: add backend and frontend unit test suites by @karlitschek in #2027
docs: bring the documentation in line with the implementation by @karlitschek in #2028
fix: harden federation trust, OAuth and outbound requests by @karlitschek in #2030
fix: repair the basics — debug output, remote deletions, and four dead paths by @karlitschek in #2029
fix: repair broken timeline, profile and search behaviour in the UI by @karlitschek in #2032
fix: repair the cron/queue failure paths and index the timeline hot path by @karlitschek in #2031
fix(deps): resolve the production npm advisories shipped in the bundle by @karlitschek in #2033
fix: brute-force protect the OAuth token endpoint and add alt text to images by @karlitschek in #2034
fix: repair model and service correctness defects found by the unit suite by @karlitschek in #2036
fix: guard Move with alsoKnownAs and encrypt actor private keys at rest by @karlitschek in #2037
fix: repair mention rendering, timeline paging and rollback defects in the UI by @karlitschek in #2038
feat: implement account blocking and muting by @karlitschek in #2035
fix: enforce OAuth token scopes and CSRF, hash client credentials at rest by @karlitschek in #2039
fix: bound signature replay windows and fail loudly on signing errors by @karlitschek in #2040
fix: implement bookmarks, stop leaking internals, repair the controller edges by @karlitschek in #2041
test: wire the integration suite into CI and grow it across the Db layer by @karlitschek in #2042
fix: fresh-instance timelines and version-independent SSRF classification by @karlitschek in #2043
feat: locked accounts with approvable follow requests by @karlitschek in #2045
feat: reporting with a moderation panel in the admin settings by @karlitschek in #2046
feat: complete the media API — v2 upload, alt text, and attachment management by @karlitschek in #2044
chore(deps-dev): bump browserslist from 4.28.2 to 4.28.8 by @dependabot[bot] in #2026
chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.7 by @dependabot[bot] in #2025
chore(deps-dev): bump dockerode from 5.0.0 to 5.0.1 by @dependabot[bot] in #2024
Use Pleroma-compatible version string by @mkljczk in #1616
chore(deps-dev): bump webpack-dev-server from 5.2.4 to 5.2.6 by @dependabot[bot] in #2016
ci: update reuse.yml workflow from template by @nextcloud-command in #1980
chore(deps): bump friendica/json-ld from 1.1.4 to 1.1.5 by @dependabot[bot] in #2006
chore(deps): bump shell-quote from 1.8.4 to 1.10.0 by @dependabot[bot] in #2015
chore(deps-dev): bump brace-expansion from 1.1.15 to 1.1.18 by @dependabot[bot] in #2019
fix: keep the Mastodon-compatible version string out of NodeInfo by @karlitschek in #2049
build: update node and npm engines versions by @nextcloud-command in #1983
fix: webfinger without a resource parameter is a 400 by @karlitschek in #2048
feat: estimate the visibility of incoming remote statuses by @karlitschek in #2050
fix: escape post content before newline conversion, everywhere by @karlitschek in #2051
ci: reuse check back on ubuntu-latest by @karlitschek in #2052
chore(deps-dev): bump nextcloud/coding-standard from 1.3.2 to 1.5.0 by @dependabot[bot] in #2005
chore(deps): bump gumlet/php-image-resize from 2.0.4 to 3.0.0 by @dependabot[bot] in #2013
chore(deps-dev): bump http-proxy-middleware from 2.0.9 to 2.0.10 by @dependabot[bot] in #2047
chore: apply nextcloud/coding-standard 1.5 by @karlitschek in #2053
fix: backfill the visibility of remote statuses stored before estimation by @karlitschek in #2054
feat: rate-limit incoming inbox deliveries per origin by @karlitschek in #2055
feat: follow-request and report UI, composer code-splitting by @karlitschek in #2057
chore: PHP attributes for access control, drop the dead Tools files by @karlitschek in #2059
feat: retention for remote content by @karlitschek in #2056
feat: push new timeline entries to web clients through notify_push by @karlitschek in #2058
feat: WebP images and video/audio attachments by @karlitschek in #2060
feat: render custom emoji from other instances by @karlitschek in #2061
feat: full-text search of visible posts through unified search by @karlitschek in #2063
feat: federated polls — view and vote by @karlitschek in #2062
fix: align the independently developed feature branches after merge by @karlitschek in #2064
ci: fix reuse workflow startup failure by @karlitschek in #2067
feat: create own polls by @karlitschek in #2065
feat: follow/unfollow and /api/v2/search for third-party clients by @karlitschek in #2066
fix: the router base has to carry index.php where mod_rewrite is off by @karlitschek in #2071
feat: profile metadata fields by @karlitschek in #2068
feat: pinned posts by @karlitschek in #2069
feat: link preview cards by @karlitschek in #2070
refactor: send outbound requests through the server's http client by @karlitschek in #2072
feat: manage blocked and muted accounts, and drop the settings entries that never worked by @karlitschek in #2073
feat: motion and polish across the timeline by @karlitschek in #2074
feat: view transitions, keyboard reading, and a face for every instance by @karlitschek in #2075
feat: trending hashtags and bookmarks by @karlitschek in #2076
perf: measure the timelines, and stop paying for what nobody asked by @karlitschek in #2077
feat: content warnings by @karlitschek in #2078
fix: translate the error messages the app shows by @karlitschek in #2079
feat: forward replies to local posts (ActivityPub §7.1.2) by @karlitschek in #2080
fix: notice when the instance address moves, and correct stored handles by @karlitschek in #2081
feat: show what the federation queue is doing by @karlitschek in #2082
fix: stop the shortcut handler from swallowing Enter by @karlitschek in #2083
fix: delete the Fediverse account with the Nextcloud one by @karlitschek in #2084
chore(deps): bump @vitest/mocker, @vitest/coverage-v8 and vitest by @dependabot[bot] in #2088
fix: stop posting activities to ourselves over HTTP by @karlitschek in #2085
chore(deps-dev): bump joi from 18.2.1 to 18.2.8 by @dependabot[bot] in #2087
feat: an unread notification badge that counts by @karlitschek in #2089
feat: make the timeline usable without a mouse or without sight by @karlitschek in #2090
feat: let people describe the pictures they post by @karlitschek in #2091
feat: say what changed, and make the instance colours readable by @karlitschek in #2092
perf: read a timeline in two queries instead of one wide DISTINCT by @karlitschek in #2094
perf: stop shipping the emoji picker with the post menu by @karlitschek in #2095
feat: let a moderator actually moderate by @karlitschek in #2096
chore(deps-dev): bump js-yaml from 4.2.0 to 4.3.2 by @dependabot[bot] in #2093
feat(dashboard): seven more widgets, and fix three defects in the existing two by @karlitschek in #2097
fix(navigation): stop gating routes on a view transition, and highlight Home by @karlitschek in #2098
fix(media): serve a document by either of its copies, and rebuild moved links by @karlitschek in #2099
Fix the defects found reviewing the last wave, and the wave itself by @karlitschek in #2100
Name the profile entry after the reader, and stop sorting the whole liked list to show fifteen by @karlitschek in #2101
Open the composer when it is written in, not before by @karlitschek in #2102
Make the app more playful: hover cards, drag-and-drop, rolling counters, and a first-post moment by @karlitschek in #2103
Sit the timeline cards on the page instead of outlining them by @karlitschek in #2104
Federation parity: edits that apply, threads that resolve, media that loads, and signatures that name an actor by @karlitschek in #2105
Quote posts, hashtag following, a bio, account export — and a photo-first timeline by @karlitschek in #2106
Lists, keyword filters, and seven things that were quietly wrong by @karlitschek in #2107
Domain blocks, notes, endorsements, timed mutes, discovery and edit history by @karlitschek in #2108
Notifications people actually receive, announcements, and the admin API by @karlitschek in #2109
Eight things the wire got wrong by @karlitschek in #2110
A card that opens for its actions, and a picture that stays in its frame by @karlitschek in #2111
Move the reviews into docs/, and keep them there by @karlitschek in #2112
Bring the Mastodon compatibility report into docs/ by @karlitschek in #2123
Open a card's actions over the gap, not into it by @karlitschek in #2124
fix(psalm): clear the eight errors static analysis reports on master by @karlitschek in #2125
Work through the technical-debt survey by @karlitschek in #2127
Three things a small instance gets wrong: local follows, duplicate boosts, empty widgets by @karlitschek in #2128
chore(deps-dev): Bump jsdom from 26.1.0 to 30.0.1 by @dependabot[bot] in #2113
build(lint): move to ESLint 10 and @nextcloud/eslint-config 9 by @karlitschek in #2129
The Mastodon compatibility report, items 3 to 7 by @karlitschek in #2126
Take the dependency bumps that can be taken by @karlitschek in #2130
Re-verify the performance survey against master by @karlitschek in #2131
Fix everything the performance survey still listed as open by @karlitschek in #2132
The full inventory of what a Mastodon replacement still needs by @karlitschek in #2133
The small client gaps: v1 filters, peers, activity, preferences, familiar followers by @karlitschek in #2134
What a peer would notice: pins that federate, a real media type, the right profile link by @karlitschek in #2135
Moderation, custom emoji and authorized fetch: nine roadmap items by @karlitschek in #2136
Clear the technical-debt survey: private core classes, the floors, and the federation transport by @karlitschek in #2137
Per-user OAuth tokens, and the eight gaps the route walk turned up by @karlitschek in #2138
Pixelfed parity: strip the metadata phones write into photos, and the nine features that were missing by @karlitschek in #2140
A switcher between My Feed, Local and Global — on the feeds and on Photos by @karlitschek in #2139
A Discover page for who to follow, with starter packs by @karlitschek in #2141
feat(video): a Videos timeline, PeerTube interoperability both ways, and hosting that works by @karlitschek in #2143
fix(cache): the cache cron passes over a streamed file by @karlitschek in #2142
Posts/Photos/Videos on a profile, the account at the bottom of the sidebar, and a Migration page by @karlitschek in #2144
Timeline reads: stop asking the database for what the page does not need by @karlitschek in #2145
[master] Fix npm audit by @nextcloud-command in #2146
perf: take four round trips and a write amplification out of the request path by @karlitschek in #2148
docs(mastodon): one list instead of two, re-checked against the code by @karlitschek in #2150
feat: lighter pages, and previews where there were none by @karlitschek in #2153
fix(avatars): one account preview, and it is this app's by @karlitschek in #2154
fix(profile): the tab decides the view, a face is a link, and a post opens before its media by @karlitschek in #2156
feat(post): a post's own page, and a ranking for the hashtags on Discover by @karlitschek in #2157
Five reported defects, and the compose button by @karlitschek in #2158
Discover: a Videos grid, and room in the switcher by @karlitschek in #2159
The byline is a name, not a name and a handle by @karlitschek in #2160
A Settings page, and Bookmarks beside Liked posts by @karlitschek in #2161
No frame around the composer inside the New post dialog by @karlitschek in #2162
The account menu opens as a drawer by @karlitschek in #2163
Migration becomes a section of Settings by @karlitschek in #2164
The notifications page is called Activities by @karlitschek in #2165
Discover suggests the people you share this Nextcloud with by @karlitschek in #2166
"Share to Social" in the Files app by @karlitschek in #2168
Nextcloud groups as Social lists by @karlitschek in #2169
Delivery status on your own posts by @karlitschek in #2167
A first-run introduction in place of the beta banner by @karlitschek in #2170
Docs: remove the conflict markers #2170 landed with by @karlitschek in #2171
Serve a stored post's attachments as Documents, with their mime by @karlitschek in #2172
Direct, account and hashtag timelines as two queries by @karlitschek in #2174
Retire the superseded Custom Local API, and send queued bytes verbatim by @karlitschek in #2175
The bell: every notification type, linked into the app, follow requests answerable by @karlitschek in #2173
Verified profile links, and a remote account's existing pins by @karlitschek in #2177
A layout for phones by @karlitschek in #2182
Replies read as a conversation by @karlitschek in #2178
Files as attachments by @karlitschek in #2179
A browser-test layer: Playwright against a real Nextcloud by @karlitschek in #2176
One rule for who may read and write by @karlitschek in #2184
A link to a post lands in the app, and Back lands where you were reading by @karlitschek in #2185
An administrator hears about what is broken without opening Social by @karlitschek in #2187
The caches and the queue survive a year of federating by @karlitschek in #2186
Links to posts unfurl in Talk, Text and Deck; the bell's news reaches the Activity app by @karlitschek in #2181
What the deep-link change promised, checked on a real instance by @karlitschek in #2192
The WebFinger check survives having nobody logged in by @karlitschek in #2193
A post says what language it is in, when to go out and where to look by @karlitschek in #2188
The notifications page is a page, not a list of everything by @karlitschek in #2189
Your account is something you can change, and so are your lists by @karlitschek in #2190
An account only when you ask for one, with a handle you choose by @karlitschek in #2180
Your pictures and videos travel with your posts by @karlitschek in #2191
The documentation says what the code does by @karlitschek in #2183
The New post dialog gets back the gap the composer lost by @karlitschek in #2194
Clicking the page behind the New post dialog closes it by @karlitschek in #2195
A wave of small things that make the app nicer to use, and an Explore entry in the sidebar by @karlitschek in #2196
The composer's own face comes back, and the Post button keeps its words by @karlitschek in #2197
The administration page looks like the rest of the administration settings by @karlitschek in #2198
The action row is a pill that grows out of the corner by @karlitschek in #2199
The README shows the app instead of listing it by @karlitschek in #2200
Master is green again: the bundle matches, and the app test takes down what it mounts by @karlitschek in #2201
Four things the server could do that the web client could not reach by @karlitschek in #2202
Everything a Mastodon client asks for that this server did not answer by @karlitschek in #2203
Give the switcher back its spacing by measuring the pill by @karlitschek in #2204
feat(pixelfed): what a Pixelfed user and admin meet — the app's routes, bringing an account over, a review queue, and stories that Pixelfed actually reads by @karlitschek in #2206
feat(statistics): compare the last thirty days with the thirty before them by @karlitschek in #2205
Pixelfed parity: fifteen items from the fresh look by @karlitschek in #2207
Mastodon parity: relays, quote controls, annual reports, account deletion, authorized apps, and an interop suite by @karlitschek in #2208
feat(peertube): a channel, a Video PeerTube will take, and the other eighteen by @karlitschek in #2209
perf: what breaks first at a million users, measured and fixed by @karlitschek in #2210

New Contributors

@mkljczk made their first contribution in #1616

Full Changelog: v0.10.0...v0.23.0

nextcloud/social v0.23.0 Social 0.23.0 on GitHub