Mastodon v4.7.1 is a complete social network server
Mastodon v4.7.1 combines an ActivityPub server with a web client, account system, media support, live chronological timelines, moderation tools, and OAuth2 APIs. Users on one installation can follow accounts on other compatible servers, including software that is not Mastodon. That federation is the reason to run it: an organization can set local rules and ownership without turning its community into an isolated website.
The README lists 5 baseline runtime requirements: Ruby 3.3 or newer, PostgreSQL 14 or newer, Redis 7.0 or newer, Node.js 22 or newer, and FFmpeg 5.1 or newer. Rails handles web pages and REST APIs, Sidekiq uses Redis for background jobs, and Node powers streaming. React and Redux provide the interactive client. This is application infrastructure, not a binary you copy onto a small server and forget.
Version 4.7.1 needs a domain you can keep
Mastodon's v4.7.1 configuration treats LOCAL_DOMAIN as a permanent network identity. The official documentation says changing it later can make remote servers view existing accounts as new ones, and reinstalling does not repair that confusion. A separate WEB_DOMAIN can put the interface on a subdomain while keeping shorter user handles, but it requires WebFinger redirects and the same careful planning before launch.
The source-install guide expects root access, a domain, and an SMTP service before setup begins. Its production sequence creates a dedicated user, PostgreSQL role, .env.production, database schema, TLS certificate, and Nginx site. It then enables 3 systemd units: web, Sidekiq, and streaming. The setup wizard helps generate configuration and secrets, but the operator still owns DNS, mail reputation, certificate renewal, backups, and service supervision.
What happened when we ran it
Our sandbox installed 1,317 Yarn packages in 33 seconds, and those dependencies occupied 748 MB on disk. We cloned commit 8b6f5b2 into an unprivileged Node 22 container with 3 CPUs and 8 GB of RAM. The repository itself contained 10,015 files, roughly 303,803 lines of source, and used 87.8 MB before installation.
The lab found no build script or target, so it skipped that step. The Vitest command completed in 114 seconds with 4,053 passed and 0 failed out of 4,053. Those are the only test results from our run. They cover the measured JavaScript suite and do not imply that Rails tests, federation between servers, database migrations, media processing, email delivery, or a production boot were exercised.
Our checkout had 22 CI workflow files, a Dockerfile, a compose file, a tests directory, and monorepo workspaces. The 748 MB installed size covers the Yarn side, not Ruby gems, container layers, PostgreSQL data, Redis state, uploaded media, or cached remote media. This measurement setup is useful for front-end development cost. It is not a sizing result for an instance with real accounts and federation traffic.
Version 4.7.1 shipped 3 security fixes and migration repairs
Release v4.7.1 arrived on September 1, 2026. It fixed a password-authentication bypass affecting 2FA with LDAP, PAM, or SSO accounts, a denial of service involving pathological JSON-LD activities, and disabled staff accounts retaining admin API access. The release also repaired some 4.7 migrations that did not rerun cleanly after interruption. These are good reasons to track point releases rather than remaining on an initial feature release.
The v4.7.1 notes instruct administrators to back up the database before upgrading and to read every skipped release's notes because migrations may require extra steps. One open report, issue 40407, describes more than 3,000 Sidekiq threads after a day and roughly 20% memory growth over 3 to 4 days on a 32 GB server. That is one operator's report, but it warrants post-upgrade memory and queue monitoring.
4,523 issues and pull requests reflect a wide operating surface
GitHub reported 4,523 combined issues and pull requests. That number includes feature proposals, dependency updates, bug reports, and code review, so it is not a defect count. The breadth makes sense for software responsible for federation, accessibility, moderation, media, authentication, migrations, multiple clients, and admin policy. A prospective operator should search the queue for the exact database, identity provider, object store, and deployment mode they intend to use.
Moderation is part of the workload even though the product supplies capable controls. The README names private posts, locked accounts, phrase filtering, muting, blocking, reports, and moderation interfaces. Version 4.7.1 also fixed an approval bypass and an email-domain filter lost during pagination. Software can provide queues and enforcement actions; it cannot decide community policy, cover reports, or handle appeals without people responsible for those decisions.
50,297 stars pair with a September 10 push
Mastodon had 50,297 stars and a last push on September 10, 2026, only 9 days after v4.7.1. Issues and pull requests were updating the same day, including dependency work, media retention discussions, and moderation-list synchronization. That combination shows active maintenance and heavy public scrutiny. The 4,523-item combined queue remains a cost when waiting on a niche fix, but release cadence and daily repository work are plainly current.
Misskey is the closest alternative here for a general ActivityPub community with a different interaction style. Pixelfed makes more sense when photos are the product rather than one attachment type among many. Mastodon is the conservative choice for a full-featured federated community, provided someone owns its 3 application services, data stores, email, media, moderation, and upgrades. The passing 4,053-test Vitest run supports that choice; the 748 MB JavaScript install explains why it is still an operations commitment.