Skip to content

Hollo 0.8.14

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Oct 07:32
· 573 commits to main since this release
0.8.14
This tag was signed with the committer’s verified signature.
dahlia Hong Minhee (洪 民憙)
GPG key ID: C429ECD57EED6CCA
Verified
Learn about vigilant mode.
0a1cd19
This commit was signed with the committer’s verified signature.
dahlia Hong Minhee (洪 民憙)
GPG key ID: C429ECD57EED6CCA
Verified
Learn about vigilant mode.

Released on October 1, 2026.

  • Upgraded Fedify to 2.1.26, which fixes a security vulnerability where Context.routeActivity() authenticated the dereferenced activity but routed the caller's unauthenticated copy, so an attacker who knew the id of any dereferenceable activity could have the application's inbox listeners process an activity with that id but with an actor, object, and addressing of the attacker's choice, and the genuine activity could then be dropped as a duplicate. The verified fetched document is now the one that gets queued, handed to listeners, and forwarded. [GHSA-39gj-rchc-q5m3]
Assets 2
Loading