v1.1.0 — Security & reliability release

Security & reliability release. Hardens the federation, XML-RPC, guest-comment, and setup paths; adds a configurable app port; and smooths self-hosted installs. Backward-compatible — upgrade with npm run update, no action required.

Security

• Federation-delivery SSRF guard + tainted-format-string fix + least-privilege CI workflow permissions (#52)
• XML-RPC (MetaWeblog) ReDoS rewrite + getRecentPosts pagination clamp (#53, #9)
• Robust plain-text snippets + HTML-entity decode fix (#56)
• Guest-comment request-body cap (#8)
• One-time SETUP_TOKEN first-claim gate for the setup wizard (#22)

Fixed

• Configurable app listen port — PORT / FEDIHOME_PORT (#27)
• SITE_URL persisted at setup, preserving protocol + port (#33)
• npm run update restarts pm2 under any process name + fails loudly (#32)
• Docker image builds + runs under Prisma 7 (#40)

Full details in CHANGELOG.md.

💖 If FediHome is useful to you, you can sponsor the project.