Skip to content

Fedify 2.2.10

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Aug 08:47
· 1216 commits to main since this release
2.2.10
This tag was signed with the committer’s verified signature.
dahlia Hong Minhee (洪 民憙)
GPG key ID: C429ECD57EED6CCA
Verified
Learn about vigilant mode.
1f1590e
This commit was signed with the committer’s verified signature.
dahlia Hong Minhee (洪 民憙)
GPG key ID: C429ECD57EED6CCA
Verified
Learn about vigilant mode.

Released on August 22, 2026.

@fedify/fedify

  • Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
  • Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@fedify/elysia

  • Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@fedify/vocab-runtime

  • Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
  • Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]
Assets 37
Loading