Fedify 1.4.0

Released on February 5, 2025.

• Document loader and context loader are now configurable with a factory function for more flexibility.

  • Deprecated CreateFederationOptions.documentLoader option. Use CreateFederationOptions.documentLoaderFactory option instead.
  • Deprecated CreateFederationOptions.contextLoader option. Use CreateFederationOptions.contextLoaderFactory option instead.
  • Added DocumentLoaderFactory type.
  • Added DocumentLoaderFactoryOptions interface.
  • Added the second parameter with DocumentLoaderFactoryOptions type to AuthenticatedDocumentLoaderFactory type.
  • GetAuthenticatedDocumentLoaderOptions interface became to extend DocumentLoaderFactoryOptions interface.
  • Added a type parameter TContextData to CreateFederationOptions interface.
  • Fedify now assigns a random-generated http:/https: URI to activities if these do not have explicit id properties. This behavior can be disabled by excluding autoIdAssigner() from the CreateFederationOptions.activityTransformers option.

• Introduced ActivityTransformers for adjusting outgoing activities before sending them so that some ActivityPub implementations with quirks are satisfied.

  • Added @fedify/fedify/compat module.
  • Added ActivityTransformer type.
  • Added autoIdAssigner() function.
  • Added actorDehydrator() function.
  • Added defaultActivityTransformers constant.
  • Added CreateFederationOptions.activityTransformers option.

• The suppressError option of Activity Vocabulary APIs, traverseCollection() function, and Context.traverseCollection() method now suppresses errors occurred JSON-LD processing.

• WebFinger responses are now customizable. [#3]

  • Added ActorCallbackSetters.mapAlias() method.
  • Added ActorAliasMapper type.

• Added Context.getNodeInfo() method. [#203]

• Added shares property to Object class in Activity Vocabulary API.

  • Added Object.sharesId property.
  • Added Object.getShares() method.
  • new Object() constructor now accepts shares option.
  • Object.clone() method now accepts shares option.

• Added likes property to Object class in Activity Vocabulary API.

  • Added Object.likesId property.
  • Added Object.getLikes() method.
  • new Object() constructor now accepts likes option.
  • Object.clone() method now accepts likes option.

• Added emojiReactions property to Object class in Activity Vocabulary API.

  • Added Object.emojiReactionsId property
  • Added Object.getEmojiReactions() method.
  • new Object() constructor now accepts emojiReactions option.
  • Object.clone() method now accepts emojiReactions option.

• Added allowPrivateAddress option to LookupWebFingerOptions interface.

• Added more log messages using the LogTape library. Currently the below logger categories are used:

  • ["fedify", "compat", "transformers"]

• Added -t/--traverse option to the fedify lookup subcommand. [#195]

• Added -S/--suppress-errors option to the fedify lookup subcommand. [#195]

Fedify 1.3.7

Released on February 1, 2025.

• Updated LogTape to version 0.8.1, which fixes a bug where lowestLevel option had incorrectly behaved.

Fedify 1.3.6

Released on January 31, 2025.

• Fixed a bug where getUserAgent() function had returned a User-Agent string with a wrong JavaScript runtime name on Node.js. [#203]

Fedify 1.3.5

Released on January 21, 2025.

• Fixed a bug where CreateFederationOptions.allowPrivateAddress option had been ignored by the Context.lookupObject() method when it had taken a fediverse handle.

• The lookupWebFinger() function became to silently return null when it fails to fetch the WebFinger document due to accessing a private network address, instead of throwing a UrlError.

Fedify 1.3.4

Released on January 21, 2025.

• Fixed several security vulnerabilities of the lookupWebFinger() function. [CVE-2025-23221]

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the infinite number of redirects, which could lead to a denial of service attack. Now it follows up to 5 redirects.

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the redirects to other than the HTTP/HTTPS schemes, which could lead to a security breach. Now it follows only the same scheme as the original request.

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the redirects to the private network addresses, which could lead to a SSRF attack. Now it follows only the public network addresses.

Fedify 1.2.11

Released on January 21, 2025.

• Fixed several security vulnerabilities of the lookupWebFinger() function. [CVE-2025-23221]

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the infinite number of redirects, which could lead to a denial of service attack. Now it follows up to 5 redirects.

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the redirects to other than the HTTP/HTTPS schemes, which could lead to a security breach. Now it follows only the same scheme as the original request.

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the redirects to the private network addresses, which could lead to a SSRF attack. Now it follows only the public network addresses.

Fedify 1.1.11

Released on January 21, 2025.

• Fixed several security vulnerabilities of the lookupWebFinger() function. [CVE-2025-23221]

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the infinite number of redirects, which could lead to a denial of service attack. Now it follows up to 5 redirects.

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the redirects to other than the HTTP/HTTPS schemes, which could lead to a security breach. Now it follows only the same scheme as the original request.

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the redirects to the private network addresses, which could lead to a SSRF attack. Now it follows only the public network addresses.

Fedify 1.0.14

Released on January 21, 2025.

• Fixed several security vulnerabilities of the lookupWebFinger() function. [CVE-2025-23221]

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the infinite number of redirects, which could lead to a denial of service attack. Now it follows up to 5 redirects.

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the redirects to other than the HTTP/HTTPS schemes, which could lead to a security breach. Now it follows only the same scheme as the original request.

  • Fixed a security vulnerability where the lookupWebFinger() function had followed the redirects to the private network addresses, which could lead to a SSRF attack. Now it follows only the public network addresses.

Fedify 1.3.3

Released on December 30, 2024.

• The fetchDocumentLoader() function now preloads the following JSON-LD context: https://gotosocial.org/ns.

Fedify 1.3.2

Released on December 18, 2024.

• Fixed the default document loader to handle the Link header with incorrect syntax. [#196]