We're 7 years after the publication of NIST 800-63 on best practice guidance for modern passwords and I still talk to large companies stuck in the past trying to enforce silly password rules and mandatory 90 day rotations. Pretty sure I'm still going to be having these discussions at the 10 year anniversary.

We are planning to release new Mastodon security updates for versions 4.1, 4.2 and nightly this Thursday, Jul 04, at 15:00 UTC. It solves multiple security issues, including a major one. We encourage server administrators to plan for a timely upgrade to ensure their Mastodon server is protected.