Version Chart

Mastodon End of Life Dates

End of Life versions of Mastodon do not receive any features, bug fixes, and generally no security updates except at the discretion of the core development team.

Reference: Mastodon Security Policy

Additional Resources

• Installing from Source (docs.joinmastodon.org)
• Mastodon Releases (github.com/mastodon/mastodon)

Product Lifecycles

For the purposes of this document, when applied to dependencies the term "End of Life" is standardized to mean when there are no further updates of any kind, and/or no support available for a released version of Mastodon or it's dependencies.

• Ruby
• Node.js
• Postgres
• Redis
• Elasticsearch
• OpenSearch
• FFmpeg

Version Notes

Ruby Versions

Mastodon will have a file called .ruby-version in the source code that is the expected target version for that release. For example, this file has 3.3.5 for the Mastodon 4.3 branch.

It is best practice to run the specific target version in this file.

It is not best practice to use the version of Ruby that is available in your OS platform repositories. You should use a tool like rbenv or rvm to install and manage the target Ruby version. The Mastodon instructions for installing from source use rbenv.

ruby -v will show your currently running Ruby version.

The official Mastodon container image should always be using the target version of Ruby for that release.

Node.js Versions

Mastodon will have a file called .nvmrc in the source code that is the expected target version for that release. For example, this file has 20.17 for the Mastodon 4.3 branch.

It is not best practice to use the version of Node.js that is available in your OS platform default repositories. You should use a tool like nvm to install and manage the target Node version.

node -v will show your currently running Node.js version.

The official Mastodon container image should always be using the target version of Ruby for that release.

ImageMagick Versions

All Mastodon installs should be using at least ImageMagick 6.9.7-7 to mitigate CVE-2023-36460, see this guide for more details.

It is generally recommended to use the latest version of ImageMagick that is available in your operation system, or otherwise installable, and is supported in your version of Mastodon. This allows you to support the latest image formats and helps limit exposure to any relevant CVEs that may be associated with those products.

If you are having issues uploading, viewing or processing any of the supported image types in your Mastodon instance:

• Make sure you're running the latest available updates to ImageMagick
• Make sure that your default path is using the correct version
• Make sure that your version is compiled with support for the proper media codecs

convert -version will show your currently running ImageMagick version.

Libvips

Starting in Mastodon 4.3, there are two image processors that are available. Administrators can opt-in to using libvips instead of ImageMagick. Please refer to the Mastodon documentation for more information.

Libvips is generally available in most OS package repositories, but instructions on how to install it will be made available starting with the release of 4.3. Installing vips-tools on Debian or Ubuntu package respositories will also usually install ImageMagick as a fallback processor for formats that may not be supported by libvips, but those formats are not generally used in Mastodon. It is likely that compiling libvips from source will be the preferrable installation method.

The official Mastodon 4.3 container image uses libvips.

FFmpeg Versions

It is generally recommended to use the latest version of FFmpeg that is available in your operation system, or otherwise installable, and is supported in your version of Mastodon. This allows you to support the latest media codecs and helps limit exposure to any relevant CVEs that may be associated with those products.

If you are having issues uploading, viewing or processing any of the support video types or animated GIF files in your Mastodon instance:

• Make sure you're running the latest available updates to FFmpeg
• Make sure that your default path is using the correct version
• Make sure that your version is compiled with support for the proper media codecs

ffmpeg -version will show your currently running ffmpeg version.

FFmpeg has a rather complicated support cycle. If you do not see a major/minor version of it listed in the matrix, it is considered end of life and not supported, it may still however work without issue. Refer to endoflife.date for more information on determining if your version of FFmpeg is considered supported.

Nginx or Other Ingress

Mastodon requires an load balancer or reverse proxy to properly terminate TLS/SSL connections between users and ingress traffic to the system. Nginx is commonly used for this purpose, and an example configuration is provided in the Mastodon respository.

Other types of software can be used in place of Nginx, such as Caddy for example. There is no Mastodon specific requirement that Nginx be used.

Reguardless of the ingress software that is used, you should keep it up to date to prevent expliotation of known CVEs.

• Nginx
• Caddy

Full Text Search

Elasticsearch 7.x is the only officially supported version at this time due to use of the Chewy gem for Ruby. Mastodon does not use any of the newer features of Elasticsearch 8.x, nor are it's Ruby gem components able to leverage them. If you're able to stay on 7.x at this time, you should.

Administrators can elect to use OpenSearch as targets for full text search indexing, with the understanding that OpenSearch is gradually diverging in API compatibility.

• Installing Elasticsearch
• Installing OpenSearch
• Configuring Full Text Search

Redis Forks

At this time there has been no project level testing of Redis alternatives such as Valkey or Redict. While they may work fine at this time due to the limited changes since Redis changed their license in March 2024, long term support will be largely driven by the support of major Mastodon components such as Sidekiq.