diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2808bece2b..783b4dd082 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,53 @@
+#### v4.0.3 (2025-02-09)
+
+##### Chores
+
+*  up harmony (2ee0cda2)
+*  update persona (b6b76639)
+*  bump persona to fix theme description issue (cd88cce0)
+*  up harmony (a01bf73e)
+*  forgot to remove bad code (865c09a5)
+*  up harmony (c3f8222f)
+*  up harmony (f07f3801)
+*  up harmony (67a789ad)
+*  up themes (c1c5cc6e)
+*  up themes (b2b0ed35)
+*  up peace (55eedcbe)
+*  up themes (38a21e29)
+*  up harmony (58e551fe)
+*  incrementing version number - v4.0.2 (73fe5fcf)
+*  update changelog for v4.0.2 (75588ffe)
+*  incrementing version number - v4.0.1 (a461b758)
+*  incrementing version number - v4.0.0 (c1eaee45)
+
+##### Bug Fixes
+
+*  delete from payload instead of setting null (1b4e0c87)
+*  regression :tmi: (f5328aa8)
+*  #13139, payload.version can be null (bfe6d9d8)
+*  tidChanged (1f8e2f9a)
+*  #13135, tids are not numeric for ap topics (d687f081)
+*  handle cases where url passed to mime does not pass because url contained a query string (5baa46d0)
+*  isDraft logic, closes #13119 (21156673)
+*  path on windows, #13119 (36063d1f)
+*  #13115, prevent messages from getting duplicated (1ff8e1e4)
+*  #13115, limit bodyLength length (8e9fdb5f)
+
+##### Other Changes
+
+*  remove log (a8e7bf35)
+
+##### Refactors
+
+*  events are returned inside post objects (3ab22c2c)
+*  move dropdown search inputs into dropdown (b993be6f)
+*  server.destroy (72091ec4)
+*  remove deprecated methods (265e44f0)
+
+##### Tests
+
+*  search endpoint with start & end (c1b630d4)
+
 #### v4.0.2 (2025-02-02)
 
 ##### Chores
diff --git a/install/package.json b/install/package.json
index 7b91682df7..5bcd2e732c 100644
--- a/install/package.json
+++ b/install/package.json
@@ -2,7 +2,7 @@
     "name": "nodebb",
     "license": "GPL-3.0",
     "description": "NodeBB Forum",
-    "version": "4.0.2",
+    "version": "4.0.3",
     "homepage": "https://www.nodebb.org",
     "repository": {
         "type": "git",
@@ -108,7 +108,7 @@
         "nodebb-plugin-spam-be-gone": "2.3.0",
         "nodebb-plugin-web-push": "0.7.2",
         "nodebb-rewards-essentials": "1.0.0",
-        "nodebb-theme-harmony": "2.0.18",
+        "nodebb-theme-harmony": "2.0.19",
         "nodebb-theme-lavender": "7.1.17",
         "nodebb-theme-peace": "2.2.38",
         "nodebb-theme-persona": "14.0.14",
@@ -200,4 +200,4 @@
             "url": "https://github.com/barisusakli"
         }
     ]
-}
+}
\ No newline at end of file
diff --git a/src/activitypub/mocks.js b/src/activitypub/mocks.js
index 7f1cc466be..e5206ecd4b 100644
--- a/src/activitypub/mocks.js
+++ b/src/activitypub/mocks.js
@@ -155,7 +155,10 @@ Mocks.post = async (objects) => {
 	await activitypub.actors.assert(Array.from(actorIds));
 
 	const posts = await Promise.all(objects.map(async (object) => {
-		if (!activitypub._constants.acceptedPostTypes.includes(object.type)) {
+		if (
+			!activitypub._constants.acceptedPostTypes.includes(object.type) ||
+			!activitypub.helpers.isUri(object.id) // sanity-check the id
+		) {
 			return null;
 		}
 
diff --git a/src/api/activitypub.js b/src/api/activitypub.js
index c66cf9bde9..0632219e66 100644
--- a/src/api/activitypub.js
+++ b/src/api/activitypub.js
@@ -155,6 +155,7 @@ activitypubApi.create.privateNote = enabledCheck(async (caller, { messageObj })
 	const payload = {
 		id: `${object.id}#activity/create/${Date.now()}`,
 		type: 'Create',
+		actor: object.attributedTo,
 		to: object.to,
 		object,
 	};
@@ -173,6 +174,7 @@ activitypubApi.update.profile = enabledCheck(async (caller, { uid }) => {
 	await activitypub.send('uid', caller.uid, targets, {
 		id: `${object.id}#activity/update/${Date.now()}`,
 		type: 'Update',
+		actor: object.id,
 		to: [activitypub._constants.publicAddress],
 		cc: [],
 		object,
@@ -188,6 +190,7 @@ activitypubApi.update.category = enabledCheck(async (caller, { cid }) => {
 	await activitypub.send('cid', cid, targets, {
 		id: `${object.id}#activity/update/${Date.now()}`,
 		type: 'Update',
+		actor: object.id,
 		to: [activitypub._constants.publicAddress],
 		cc: [],
 		object,
@@ -214,6 +217,7 @@ activitypubApi.update.note = enabledCheck(async (caller, { post }) => {
 	const payload = {
 		id: `${object.id}#activity/update/${post.edited || Date.now()}`,
 		type: 'Update',
+		actor: object.attributedTo,
 		to,
 		cc,
 		object,
@@ -241,6 +245,7 @@ activitypubApi.update.privateNote = enabledCheck(async (caller, { messageObj })
 	const payload = {
 		id: `${object.id}#activity/create/${Date.now()}`,
 		type: 'Update',
+		actor: object.attributedTo,
 		to,
 		object,
 	};
@@ -270,6 +275,7 @@ activitypubApi.delete.note = enabledCheck(async (caller, { pid }) => {
 	const payload = {
 		id: `${id}#activity/delete/${Date.now()}`,
 		type: 'Delete',
+		actor: object.attributedTo,
 		to,
 		cc,
 		object: id,
@@ -333,6 +339,7 @@ activitypubApi.announce.note = enabledCheck(async (caller, { tid }) => {
 	await activitypub.send('uid', caller.uid, Array.from(targets), {
 		id: `${nconf.get('url')}/post/${encodeURIComponent(pid)}#activity/announce/${Date.now()}`,
 		type: 'Announce',
+		actor: `${nconf.get('url')}/uid/${caller.uid}`,
 		to,
 		cc,
 		object: pid,
@@ -385,6 +392,7 @@ activitypubApi.flag = enabledCheck(async (caller, flag) => {
 	await activitypub.send('uid', caller.uid, reportedIds, {
 		id: `${nconf.get('url')}/${flag.type}/${encodeURIComponent(flag.targetId)}#activity/flag/${caller.uid}`,
 		type: 'Flag',
+		actor: `${nconf.get('url')}/uid/${caller.uid}`,
 		object: reportedIds,
 		content: reason,
 	});
@@ -431,6 +439,7 @@ activitypubApi.undo.flag = enabledCheck(async (caller, flag) => {
 	await activitypub.send('uid', caller.uid, reportedIds, {
 		id: `${nconf.get('url')}/${flag.type}/${encodeURIComponent(flag.targetId)}#activity/undo:flag/${caller.uid}/${Date.now()}`,
 		type: 'Undo',
+		actor: `${nconf.get('url')}/uid/${caller.uid}`,
 		object: {
 			id: `${nconf.get('url')}/${flag.type}/${encodeURIComponent(flag.targetId)}#activity/flag/${caller.uid}`,
 			actor: `${nconf.get('url')}/uid/${caller.uid}`,