Skip to content
TrustMyStack, home

fider

v0.39.0
getfider/fider

Open platform to collect and prioritize feedback

Version of getfider/fider you run

CompareView on GitHub
Maintenance
ActiveBased on the last push: commit history is not collected yet
License
AGPL-3.0Copyleft · OSI-approved
Security
13 advisories1 critical, 5 high, 7 medium · Scorecard 4.3/10
Supported versions
No scheduleendoflife.date does not track this project

4.6k stars · 876 forks · 46 open issues · last release 11 days ago · data checked 2 hours ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • v0.36.0Jun 24, 2026
    • ### ⚠️ Security

    🔧 Upgrade notes

    A standard deploy (run migrations + restart) is all that's required.

    • Database migrations: 2 new migrations are included — run them as usual (make migrate).
    • New optional environment variables (both backward compatible — no action needed unless you want them):
    • EMAIL_SMTP_ENABLE_IMPLICIT_TLS (default false) — enable for SMTPS / port 465.
    • STRIPE_UK_VAT_TAX_RATE_ID — hosted billing only; UK VAT is skipped if unset.
    • No new background services or workers — the board-deletion cleanup runs as an in-process scheduled job.

Release history

All releases on GitHub
Atom feed/feed/getfider/fider
BadgeLatest version of getfider/fider[![version](/badge/getfider/fider)](/p/getfider/fider)

TL;DR

-----

Quite a lot going on here - security fixes worth upgrading for, some bugs new and old sorted, and some new stuff - an option to disable sign-up, and some UI improvements :)

Upgrade notes

-------------

  • LOG_SQL now defaults to false (#1688). Fider no longer writes every log entry to the logs table, which was never pruned and could grow to many GB. Console logging is unchanged. If you read logs from the database, set LOG_SQL=true. To reclaim the space on an existing install, run TRUNCATE logs; once.
  • Node 24 (#1640). The Docker image and CI now build with Node 24 LTS. This only matters if you build Fider from source.
  • A database migration runs automatically on start-up (it adds the sign-up setting below).

Security

--------

  • GHSA-f9m2-vm33-7hvh: a blocked administrator's API key still worked when combined with the X-Fider-UserID impersonation header (#1751)
  • OAuth sign-in rejects redirect targets that start with several slashes (#1737)
  • DOMPurify updated to 3.4.17 (#1743)

Thanks to @wyx200612 for reporting this responsibly.

New

---

  • Disable sign-ups (#1732): a new toggle under Site Settings > Privacy stops visitors creating their own accounts, so a public board can be invite-only. Trusted OAuth providers can still create accounts. Thanks @kevinpapst.
  • Post actions have moved into a 3-dot menu at the top of the post (#1725)
  • The members menu lists every user level (Administrator, Collaborator, Trusted member, Member, Blocked) and you can move a user between any of them. The API roles filter also accepts member, trusted and blocked (#1726)

Fixes

-----

  • Fider stops responding (#1744, fixes #1042): the SQL blob storage opened a second database connection for every image request, so a few concurrent image requests could use up the connection pool and hang every request after that. Thanks @kevinpapst for tracking this one down.
  • Mobile layout fixes for posts, comments, modals and sign-in (#1720)
  • Browsers can autofill email and name fields (#1722)
  • Deleting a post removes its web notifications (#1723)
  • Visitors get mention notifications by default (#1730, thanks @pvarshh)
  • Page descriptions no longer show HTML entities such as & (#1734, thanks @sap1110)
  • Declining a post takes you back to the home page instead of a 404 (#1746, thanks @kevinpapst)
  • Improved Chinese (zh-CN) translations (#1485, thanks @qiujiejun)

Plus dependency, build and CI housekeeping (#1715, #1724, #1727, #1728, #1731, #1745, #1749, #1750, #1752).

Full Changelog: https://github.com/getfider/fider/compare/v0.38.2...v0.39.0

Full release notesCompare with previous