Skip to content

Fedify 2.3.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Aug 10:34
· 521 commits to main since this release
2.3.5
This tag was signed with the committer’s verified signature.
dahlia Hong Minhee (洪 民憙)
GPG key ID: C429ECD57EED6CCA
Verified
Learn about vigilant mode.
c067fc4
This commit was signed with the committer’s verified signature.
dahlia Hong Minhee (洪 民憙)
GPG key ID: C429ECD57EED6CCA
Verified
Learn about vigilant mode.

Released on August 22, 2026.

@fedify/fedify

  • Fixed a remotely triggerable denial-of-service vulnerability where the outbound delivery circuit breaker, when configured with a custom failure policy without an explicit stateTtl, stored per-host state in the configured key–value store without any expiry. A remote attacker could accumulate unbounded permanent records—one per distinct inbox host:port—by advertising inbox URLs that fail delivery, gradually exhausting storage. Custom failure policies now derive a default stateTtl of recoveryDelay plus heldActivityTtl (7 days 30 minutes with the default values), and the automatic upgrade sweep on CAS-backed stores now stamps a TTL on circuit state that earlier 2.3 releases wrote without one, including state written by custom policies on 2.3.2–2.3.4. Set stateTtl explicitly if your custom policy needs its failure history retained for a different length of time. [CVE-2026-69132]
  • Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
  • Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@fedify/elysia

  • Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@fedify/vocab-runtime

  • Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
  • Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]
Assets 39
Loading