Version Chart

Mastodon End of Life Dates

End of Life versions of Mastodon do not receive any features, bug fixes, and generally no security updates except at the discretion of the core development team.

Reference: Mastodon Security Policy

Additional Resources

• Installing from Source (docs.joinmastodon.org)
• Mastodon Releases (github.com/mastodon/mastodon)

Product Lifecycles

For the purposes of this document, when applied to dependencies the term "End of Life" is standardized to mean when there are no further updates of any kind, and/or no support available for a released version of Mastodon or it's dependencies.

• Ruby
• Node.js
• Postgres
• Redis
• Elasticsearch
• OpenSearch
• FFmpeg

Version Notes

Ruby Versions

Mastodon will have a file called .ruby-version in the source code that is the expected target version for that release. For example, this file has 3.3.5 for the Mastodon 4.3 branch.

It is best practice to run the specific target version in this file.

It is not best practice to use the version of Ruby that is available in your OS platform repositories. You should use a tool like rbenv or rvm to install and manage the target Ruby version. The Mastodon instructions for installing from source use rbenv.

ruby -v will show your currently running Ruby version.

The official Mastodon container image should always be using the target version of Ruby for that release.

Node.js Versions

Mastodon will have a file called .nvmrc in the source code that is the expected target version for that release. For example, this file has 20.17 for the Mastodon 4.3 branch.

It is not best practice to use the version of Node.js that is available in your OS platform default repositories. You should use a tool like nvm to install and manage the target Node version.

node -v will show your currently running Node.js version.

The official Mastodon container image should always be using the target version of Ruby for that release.

Image Processing

Depending on the version of Mastodon, administrators may choose either Libvips or ImageMagick.

• Libvips is preferred for servers running 4.3 or higher.
• ImageMagick is available for use with 4.3, but support may be removed during development of 4.4.
• ImageMagick is the only option for 4.2 or prior.

If you are having issues uploading, viewing or processing any of the supported image types in your Mastodon instance:

• Make sure you're running the latest available updates to libvips/ImageMagick
• Make sure that your default path is using the correct version of libvips/ImageMagick
• Make sure that your version is compiled with support for the proper media codecs

Libvips Versions

Starting in Mastodon 4.3, there are two image processors that are available. Administrators can opt-in to using libvips instead of ImageMagick. Please refer to the Mastodon documentation for more information.

Libvips is generally available in most OS package repositories, but installing from source is preferrable to obtain newer versions and have more control over dependencies. Installing vips-tools on Debian or Ubuntu package respositories will also usually install ImageMagick as a fallback processor for formats that may not be supported by libvips (but not used by Mastodon).

The official Mastodon 4.3 container image uses libvips.

ImageMagick Versions

All Mastodon installs using ImageMagick should run at least 6.9.7-7 to mitigate CVE-2023-36460, see this guide for more details.

It is generally recommended to use the latest version of ImageMagick that is available in your operation system, or otherwise installable, and is supported in your version of Mastodon. This allows you to support the latest image formats and helps limit exposure to any relevant CVEs that may be associated with those products.

convert -version will show your currently running ImageMagick version.

FFmpeg Versions

It is generally recommended to use the latest version of FFmpeg that is available in your operation system, or otherwise installable, and is supported in your version of Mastodon. This allows you to support the latest media codecs and helps limit exposure to any relevant CVEs that may be associated with those products.

If you are having issues uploading, viewing or processing any of the support video types or animated GIF files in your Mastodon instance:

• Make sure you're running the latest available updates to FFmpeg
• Make sure that your default path is using the correct version
• Make sure that your version is compiled with support for the proper media codecs

ffmpeg -version will show your currently running ffmpeg version.

FFmpeg has a rather complicated support cycle. If you do not see a major/minor version of it listed in the matrix, it is considered end of life and not supported, it may still however work without issue. Refer to endoflife.date for more information on determining if your version of FFmpeg is considered supported.

Full Text Search

Administrators can elect to use either Elasticsearch or the OpenSearch fork as targets for full text search indexing,

• Installing Elasticsearch
• Installing OpenSearch
• Configuring Full Text Search

Elasticsearch Versions

Elasticsearch 7.x is the only officially supported version at this time due to use of the Chewy gem for Ruby. Mastodon does not use any of the newer features of Elasticsearch 8.x, nor are it's Ruby gem components able to leverage them.

Many administrators opt to use Elasticsearch 8.x and do so without major issues, but if you're able to keep current with patching on 7.x at this time, you should.

OpenSearch Versions

OpenSearch 2.x (as a fork of Elasticsearch 7.x) is compatable with Mastodon, but over time my gradually diverge in API compatibility. Many administrators opt to use OpenSearch for this reason, without major issues.

Redis Versions

At this time there has been no project level testing of Redis alternatives such as Valkey or Redict. While they may work fine at this time due to the limited changes since Redis changed their license in March 2024, long term support will be largely driven by the support of major Mastodon components like Sidekiq.

Nginx or Other Ingress

Mastodon requires a load balancer or reverse proxy to properly terminate TLS/SSL connections between users and ingress traffic to the system. Nginx is commonly used for this purpose, and an example configuration is provided in the Mastodon respository.

Other types of software can be used in place of Nginx, such as Caddy for example. There is no Mastodon specific requirement that Nginx be used.

Reguardless of the ingress software that is used, you should keep it up to date to prevent expliotation of known CVEs.

• Nginx
• Caddy