v1.1.0 — Security & reliability release

[TemujinCalidius]

Security & reliability release. Hardens the federation, XML-RPC, guest-comment, and setup paths; adds a configurable app port; and smooths self-hosted installs. Backward-compatible — upgrade with npm run update, no action required.

Security

• Federation-delivery SSRF guard + tainted-format-string fix + least-privilege CI workflow permissions (Harden federation delivery path + CI workflow permissions #52)
• XML-RPC (MetaWeblog) ReDoS rewrite + getRecentPosts pagination clamp (Harden XML-RPC parser against ReDoS (+ first tests for it) #53, [P2] No pagination bounds in XMLRPC route #9)
• Robust plain-text snippets + HTML-entity decode fix (Robust plain-text snippets + HTML-entity decode fix #56)
• Guest-comment request-body cap ([P2] No content-length cap on comment request body #8)
• One-time SETUP_TOKEN first-claim gate for the setup wizard ([P2] Setup wizard is open to anonymous visitors until ADMIN_SECRET is set #22)

Fixed

• Configurable app listen port — PORT / FEDIHOME_PORT ([P1] App port hardcoded to 3000 with no env override — blocks installs on hosts already using port 3000 #27)
• SITE_URL persisted at setup, preserving protocol + port ([P2] On non-3000 deployments, SITE_URL is never written and the setup wizard drops the port — breaks federation/CSRF #33)
• npm run update restarts pm2 under any process name + fails loudly ([P2] npm run update only restarts a pm2 process named exactly 'fedihome' — other setups silently serve stale code #32)
• Docker image builds + runs under Prisma 7 ([P1] Docker runner stage missing @prisma/engines + @prisma/config — runtime db push crashes under Prisma 7 #40)

Full details in CHANGELOG.md.

💖 If FediHome is useful to you, you can sponsor the project.

---

This discussion was created from the release v1.1.0 — Security & reliability release.