action: auto
reason: Patch security/bug fix release. No database migrations, no dependency changes. Standard asset recompile and restart.
---
## Upgrade overview

This release contains upgrade notes that deviate from the norm:

ℹ️ Requires assets recompilation

## Changelog

### Security

- Reject unconfirmed FASPs (#37926, GHSA-qgmm-vr4c-ggjg)
- Re-use custom socket class for FASP requests (#37925, GHSA-46w6-g98f-wxqm)

### Added

- Add `--suspended-only` option to `tootctl emoji purge` (#37828)

### Fixed

- Fix emoji data not being properly cached (#37858)
- Fix delete & redraft of pending posts (#37839)
- Fix processing separate key documents without the ActivityStreams context (#37826)
- Fix custom emojis not being purged on domain suspension (#37808)
- Fix users without special permissions being able to stream disabled timelines (#37791)
- Fix processing of object updates with duplicate hashtags (#37756)

## Upgrade notes

### Dependencies

External dependencies have not changed since v4.5.0.

### Update steps

The following instructions are for updating from 4.5.6.

### Non-Docker

1. Precompile the assets: `RAILS_ENV=production bundle exec rails assets:precompile`
2. Restart all Mastodon processes.