Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.9.1→2.0.0Release Notes
fedify-dev/fedify (@fedify/hono)
v2.0.0Compare Source
Released on February 22, 2026.
@fedify/fedify
Remove
contextLoaderoption (which was deprecated) fromFederationOptionsinterface in favor ofcontextLoaderFactoryoptionfor better flexibility. [#376, #445 by Hasang Cho]
Migrated from @phensley/language-tag package and its
LanguageTagclassto the standardized
Intl.Localeclass for representing language tags.[#280, #392 by Jang Hanarae]
LanguageString.languageproperty is nowLanguageString.localeandis of type
Intl.Localeinstead ofLanguageTag.LanguageStringconstructor now accepts either anIntl.Localeobject or a string for the language parameter.
Link.languageproperty is now of typeIntl.Localeinsteadof
LanguageTag.@phensley/language-tagdependency.Remove
documentLoaderoption (which was deprecated) fromFederationOptionsinterface in favor ofdocumentLoaderFactoryoptionfor better flexibility. [#376, #393 by Hasang Cho]
Remove
CreateFederationOptions<TContextData>interface (which wasdeprecated since 1.6.0). Use
FederationOptions<TContextData>instead.[#376]
Remove
fetchDocumentLoader()function (which was deprecated since 0.14.0).Use
getDocumentLoader()from@fedify/vocab-runtimeinstead. [#376]Remove
{ handle: string }parameter form fromsendActivity(),forwardActivity(),getDocumentLoader(), andParseUriResult.Use
{ identifier: string }or{ username: string }instead. [#376]Changed NodeInfo
software.versionfield type fromSemVertostringto properly handle non-SemVer version strings in accordance with the
NodeInfo specification. [#366, #433 by Hyeonseo Kim]
parseNodeInfo()function now returns version asstringinsteadof
SemVerobject.Software.versionfield is now ofstring(was ofSemVer).parseSemVer()andformatSemVer()functions.Federation dispatchers are now only triggered when the request accepts
ActivityPub-compatible content types. This improves compatibility with
applications that serve both HTML and ActivityPub content from the same
URLs. [#434 by Emelia Smith]
requests with
Accept: text/htmlor other non-ActivityPub contenttypes.
notAcceptablecallback is now triggered at the middleware levelbefore dispatchers are invoked.
Acceptheader, you may need to adjust your routing logic.Changed the default activity idempotency strategy from
"per-origin"to"per-inbox"to align with standard ActivityPub behavior. [#441]activity ID to be processed once per inbox independently.
"per-origin"strategy (deduplicate per receiving server)can still be explicitly configured using
.withIdempotency("per-origin").on the same server, fixing issues where activities were incorrectly
deduplicated globally.
Separated modules from
@fedify/fedify/runtimeto improve modularity andreduce coupling between vocabulary generation and core federation
functionality. [#444, #451 by ChanHaeng Lee]
into the new
@fedify/vocab-runtimepackage.@fedify/fedify/runtimehave beenreorganized into the
@fedify/fedify/utilsdirectory within the mainpackage.
organization.
Deprecated the
@fedify/fedify/runtimemodule in favor of the new@fedify/vocab-runtimepackage. The@fedify/fedify/runtimemodule nowre-exports all exports from
@fedify/vocab-runtimefor backwardcompatibility, but will be removed in a future version. Please migrate
to
@fedify/vocab-runtimedirectly. [#560]The
KvCacheParameters.rulesoption's type became[string | URL | URLPattern, Temporal.Duration | Temporal.DurationLike][](was
[string | URL | URLPattern, Temporal.Duration][]).The
@fedify/fedify/x/*modules are removed. Also, there are no Freshintegration for now. [#391 by Chanhaeng Lee]
@fedify/fedify/x/cfworkersin favor of@fedify/cfworkers.@fedify/fedify/x/denokvin favor of@fedify/denokv.@fedify/fedify/x/honoin favor of@fedify/hono.@fedify/fedify/x/sveltekitin favor of@fedify/sveltekit.@fedify/fedify/x/fresh(Fresh integration). [#466]Deprecated the
@fedify/fedify/vocabmodule in favor of the new@fedify/vocabpackage. The@fedify/fedify/vocabmodule now re-exportsall exports from
@fedify/vocabfor backward compatibility, but will beremoved in a future version. Please migrate to
@fedify/vocabdirectly.[#437, #517 by ChanHaeng Lee]
The
KvStore.list()method is now required instead of optional.This method was added as optional in version 1.10.0 to give existing
implementations time to add support. All official
KvStoreimplementationsalready support this method. [#499, #506]
Added
orderingKeyoption toMessageQueueEnqueueOptionsinterface forordered message delivery. Messages with the same ordering key are
guaranteed to be processed in the order they were enqueued, while messages
with different ordering keys can be processed in parallel. This helps
prevent race conditions when processing related activities (e.g., ensuring
a
Deleteactivity is processed after aCreateactivity for the sameobject). [#536, #538, #540, #544]
MessageQueueEnqueueOptions.orderingKeyproperty.MessageQueueEnqueueOptionsare nowreadonly.InProcessMessageQueuenow supports theorderingKeyoption.SendActivityOptions.orderingKeyoption to ensure ordereddelivery of activities for the same object. When specified, activities
with the same
orderingKeyare guaranteed to be delivered in orderto each recipient server.
Added
Federatable.setOutboxPermanentFailureHandler()method to handlepermanent delivery failures (such as
410 Goneor404 Not Found) whensending activities to remote inboxes. This allows applications to clean
up unreachable followers and avoid future delivery attempts to permanently
failed inboxes. [#548, #559]
Added
permanentFailureStatusCodesoption toFederationOptionstoconfigure which HTTP status codes are treated as permanent delivery
failures. By default,
404and410are treated as permanent failures.[#548, #559]
Added
SendActivityErrorclass, a structured error that is thrown whenan activity fails to send to a remote inbox. It includes the HTTP status
code, the inbox URL, and the response body, making it easier to
programmatically handle delivery errors. [#548, #559]
Added
traceIdandspanIdto LogTape context in federation middlewareso that log records emitted during request handling and queue processing
include the OpenTelemetry trace and span IDs in their properties. This
enables the
@fedify/debuggerdashboard to display per-trace logs.[#561, #564]
Fixed unbounded memory consumption when activity delivery fails with large
error responses. The
SendActivityError.responseBodyproperty is nowlimited to 1 KiB to prevent memory pressure when remote servers return
large HTML error pages (e.g., Cloudflare error pages of 50–100 KB each).
This prevents potential OOM crashes in production environments with many
unreachable inboxes. [#569]
@fedify/cli
The Fedify CLI now runs natively on Node.js and Bun without requiring
compiled binaries, providing a more natural JavaScript package experience
for Node.js and Bun users. [#374, #456, #457]
Added
fedify generate-vocabcommand to generate Activity Vocabularyclasses from schema files. This command uses the new @fedify/vocab-tools
package internally and allows users to extend Activity Vocabulary with
custom types. [#444, #458 by ChanHaeng Lee]
Updated
fedify initcommand for better DX.[#397, #435 by Chanhaeng Lee]
before proceeding. If the user agrees, it moves the remaining directory
to trash and continue the initialization from new created directory.
The
fedify lookupcommand now supports multiple URLs with the-t/--traverseoption, allowing users to traverse multiple collectionsin a single command. [#408, #449 by Jiwon Kwon]
The
fedify initcommand now supports Elysia as a web framework option,with runtime-specific templates for Deno, Bun, and Node.js environments.
[#460, #496 by Hyeonseo Kim]
Fixed a bug in the
fedify initcommand where Deno import map generationincorrectly handled dependencies with registry prefixes (e.g.,
npm:),creating invalid specifiers in deno.json.
[#460, #496 by Hyeonseo Kim]
Added
fedify relaycommand to run an ephemeral ActivityPub relay server.[#510, #518 by Jiwon Kwon]
--protocoloption.
--persistentoption withSQLite database.
--accept-followand
--reject-followoptions.access, with
--no-tunneloption to run locally only.Added
--tunnel-serviceoption tofedify lookup,fedify inbox, andfedify relaycommands to select the tunneling service (localhost.run,serveo.net, or pinggy.io). Also added
--tunnel-serviceas an aliasto the existing
-s/--serviceoption infedify tunnelfor consistency.[#525, #529, #531 by Jiwon Kwon]
Added configuration file support for CLI commands. The CLI now loads
settings from configuration files at multiple levels, with a well-defined
precedence chain. [#555, #566 by Jiwon Kwon]
from a system-wide configuration file (/etc/xdg/fedify/config.toml),
a user-level configuration file (~/.config/fedify/config.toml),
and .fedify.toml in the current directory; later files override
earlier ones.
--configoption to specify a custom configuration file path;this file has the highest precedence over all other configuration
sources.
--ignore-configoption to skip configuration file loading.inbox,lookup,webfinger,nodeinfo,tunnel,relay) can now be configured via any of the configurationfiles.
@fedify/debugger
Created the @fedify/debugger package, an embedded real-time ActivityPub
debug dashboard for Fedify. It wraps an existing
Federationobject asa proxy, intercepting requests to a configurable path prefix (default
/__debug__) and serving an SSR-based web UI. [#561, #564]createFederationDebugger()function that returns aFederationproxy with a built-in debug dashboard. When calledwithout an
exporteroption, it automatically sets up OpenTelemetrytracing (creating
MemoryKvStore,FedifySpanExporter,BasicTracerProvider) and registers it as the global tracerprovider—no manual OTel configuration needed.
and timestamps, with auto-polling for real-time updates.
verification details, inbox URL, and expandable activity JSON.
/__debug__/api/tracesfor programmatic access.object now includes a
sinkproperty (a LogTapeSinkfunction)that captures log records grouped by trace ID. In the simplified
overload (without
exporter), LogTape is auto-configured.logger category, and message for each log record in the trace.
/__debug__/api/logs/:traceIdfor retrievinglog records for a specific trace.
authconfiguration for protecting the debug dashboardwith authentication. Supports three modes: password-only,
username + password, and request-based (e.g., IP filtering).
Each mode supports both static credentials and callback functions.
Uses cookie-based sessions with HMAC-signed tokens.
@fedify/relay
Created ActivityPub relay integration as the @fedify/relay package.
[#359, #459, #471, #490, #510, #518 by Jiwon Kwon]
Relayinterface defining the common contract for relayimplementations.
MastodonRelayclass implementing Mastodon-compatible relayprotocol.
LitePubRelayclass implementing LitePub-compatible relayprotocol.
SubscriptionRequestHandlertype for custom subscription approvallogic.
RelayOptionsinterface for relay configuration.RelayTypetype alias to document the type-safe parametercreateRelay()factory function as a key public API@fedify/vocab-tools
Created Activity Vocabulary code generator as the @fedify/vocab-tools
package. Separated vocabulary code generation tools from the main
@fedify/fedify package to improve modularity and enable custom vocabulary
extensions across different JavaScript runtimes.
[#444, #458 by ChanHaeng Lee]
and Bun environments.
schema files.
fedify generate-vocabCLI command.@fedify/vocab-runtime
Created ActivityPub vocabulary runtime as the @fedify/vocab-runtime
package. Separated core vocabulary generation and processing modules
from the main @fedify/fedify package to improve modularity and reduce
coupling between vocabulary processing and federation functionality.
[#444, #451 by ChanHaeng Lee]
DocumentLoader,RemoteDocument, and related types fromthe main package.
importSpki,exportSpki,importMultibaseKey,exportMultibaseKey.LanguageStringclass).provides the runtime infrastructure for ActivityPub object processing.
@fedify/elysia
in the package. [#460, #496]
@fedify/lint
This package provides shared Deno Lint and ESLint configurations for
consistent code style across Fedify packages and user projects.
[#297, #494 by ChanHaeng Lee]
@fedify/fresh
between Fedify and Fresh 2.0, replacing the deprecated
@fedify/fedify/x/freshmodule that was designed for Fresh 1.x.[#466, #478 by Hyeonseo Kim]
@fedify/webfinger
This package provides tools for working with WebFinger resources,
including parsing and generating WebFinger documents.
[#517 by ChanHaeng Lee]
@fedify/vocab
Created ActivityPub Vocabulary API package as the @fedify/vocab package.
This package contains the generated Activity Vocabulary classes and
related types, separated from the main @fedify/fedify package to
improve modularity and enable custom vocabulary extensions.
The previous
@fedify/fedify/vocabmodule is now deprecated andre-exports all exports from this package for backward compatibility.
[#437, #517 by ChanHaeng Lee]
@fedify/vocabnow re-exportsLanguageString,DocumentLoader,GetUserAgentOptions, andRemoteDocumentfrom@fedify/vocab-runtimeso that downstream consumers do not need to depend on
@fedify/vocab-runtimedirectly. [#560]Fixed
@fedify/vocab-runtimebeing bundled inline into@fedify/vocab'sESM/CJS output instead of being kept as an external dependency. This
caused
instanceof LanguageStringchecks to fail because two distinctLanguageStringclasses existed at runtime. [#560]@fedify/sqlite
Added
SqliteMessageQueueclass implementingMessageQueueinterfaceusing SQLite as the backing store. This implementation uses polling to
check for new messages and is suitable for single-node deployments and
development environments. [#477, #526 by ChanHaeng Lee]
SqliteMessageQueueclass.SqliteMessageQueueOptionsinterface.SqliteMessageQueuenow supports theorderingKeyoption to ensuremessages with the same ordering key are processed sequentially.
[#538, #540]
ordering_keycolumn to the message queue table schema.SqliteMessageQueue.initialize()is called on a fresh database.
@fedify/testing
Added
testMessageQueue()utility function for standardized testing ofMessageQueueimplementations. This function provides a reusable testharness that covers common message queue operations including
enqueue(),enqueue()with delay,enqueueMany(), and multiple listener scenarios.[#477, #526 by ChanHaeng Lee]
testMessageQueue()function.waitFor()helper function.getRandomKey()helper function.Added
TestMessageQueueOptionsinterface and optionaloptionsparameterto
testMessageQueue()function. [#538, #540]TestMessageQueueOptionsinterface.testOrderingKeyoption to enable ordering key tests.@fedify/redis
Fixed a race condition in
RedisMessageQueue.listen()where pub/subnotifications could be missed if
enqueue()was called immediately afterlisten()started. The issue occurred because the message handler wasattached inside an async callback, allowing a timing window where messages
could be published before the handler was ready.
[#515, #532 by Jiwon Kwon]
RedisMessageQueuenow supports theorderingKeyoption to ensuremessages with the same ordering key are processed sequentially.
[#538, #540]
@fedify/postgres
PostgresMessageQueuenow supports theorderingKeyoption to ensuremessages with the same ordering key are processed sequentially.
[#538, #540]
ordering_keycolumn to the message queue table schema.PostgresMessageQueue.initialize()is called on a fresh database.
Fixed a race condition in
PostgresMessageQueue.initialize()whereconcurrent calls from
listen()andenqueue()would run DDLstatements in parallel, causing redundant table creation and
ALTER TABLEoperations. The initialization promise is now cachedso that concurrent callers share the same work.
Fixed
PostgresMessageQueue.listen()spawning many concurrentpoll()calls when a burst ofNOTIFYsignals arrived (e.g., frombulk enqueue of 100 messages), causing excessive database contention.
Poll executions are now serialized so that at most one runs at a time,
with subsequent requests queued after the current one finishes.
@fedify/amqp
AmqpMessageQueuenow supports theorderingKeyoption to ensuremessages with the same ordering key are processed sequentially.
[#538, #540]
rabbitmq_consistent_hash_exchangeplugin to routemessages with the same ordering key to the same queue.
support to work.
@fedify/cfworkers
WorkersMessageQueuenow supports theorderingKeyoption to ensuremessages with the same ordering key are processed sequentially.
[#538, #540]
WorkersMessageQueueOptionsinterface withorderingKv,orderingKeyPrefix, andorderingLockTtloptions.processMessage()method to handle lock acquisition and release.@fedify/init
Created project initializer as the @fedify/init package. Separated
the
fedify initfunctionality from @fedify/cli into a standalonepackage to improve modularity and enable reuse by other tools such as
@fedify/create. [#482 by Chanhaeng Lee]runInit()function as the main initialization action handler.initCommandandinitOptionsfor CLI integration.testInitCommandfor comprehensive testing of all initcombinations.
@fedify/create
Created standalone project scaffolding CLI as the @fedify/create
package. This enables creating new Fedify projects without installing
the full
@fedify/clitoolchain. [#351 by Chanhaeng Lee]npm init @​fedify,pnpm create @​fedify,yarn create @​fedify, andbunx @​fedify/create.@fedify/initinternally for all initialization logic.fedify init.v1.10.3Compare Source
Released on February 1, 2026.
@fedify/fedify
traverseCollection()yielding no items when aCollectionhasan inline
CollectionPagein itsfirstproperty without an explicitid. This is common in Mastodon'srepliescollections. The functionpreviously used
collection.firstIdto determine pagination, whichreturned
nullfor inline pages without anid, causing it toincorrectly fall into the non-paginated branch. [#550 by Lee Dogeon]
v1.10.2Compare Source
Released on January 23, 2026.
@fedify/testing
TestContext.getActorKeyPairs()returning empty array instead ofcalling registered key pairs dispatcher. The method now properly invokes
the key pairs dispatcher when it is registered via
setKeyPairsDispatcher(). [#530]v1.10.1Compare Source
Released on January 22, 2026.
@fedify/testing
TestContext.getActor()andTestContext.getObject()returningnullinstead of calling registered dispatchers. The methods now properlyinvoke actor and object dispatchers when they are registered via
setActorDispatcher()andsetObjectDispatcher(). [[#530]]v1.10.0Compare Source
Released on December 24, 2025.
@fedify/fedify
Enhanced OpenTelemetry instrumentation with span events for capturing
detailed activity data. Span events now record complete activity JSON
payloads and verification status, enabling richer observability and
debugging capabilities without relying solely on span attributes
(which only support primitive values). [#323]
activitypub.activity.receivedspan event to theactivitypub.inboxspan, recording the full activity JSON,verification status (activity verified, HTTP signatures verified,
Linked Data signatures verified), and actor information.
activitypub.activity.sentspan event to theactivitypub.send_activityspan, recording the full activity JSONand target inbox URL.
activitypub.object.fetchedspan event to theactivitypub.lookup_objectspan, recording the fetched object'stype and complete JSON-LD representation.
Added OpenTelemetry spans for previously uninstrumented operations:
[#323]
activitypub.fetch_documentspan for document loader operations,tracking URL fetching, HTTP redirects, and final document URLs.
activitypub.verify_key_ownershipspan for cryptographickey ownership verification, recording actor ID, key ID, verification
result, and the verification method used.
Added optional
list()method to theKvStoreinterface for enumeratingentries by key prefix. This method takes an optional
prefixparameter;when omitted or empty, it returns all entries. This enables efficient
prefix scanning which is useful for implementing features like distributed
trace storage, cache invalidation by prefix, and listing related entries.
[#498, #500]
KvStoreListEntryinterface.MemoryKvStore.Added
FedifySpanExporterclass that persists ActivityPub activity tracesto a
KvStorefor distributed tracing support. This enables aggregatingtrace data across multiple nodes in a distributed deployment, making it
possible to build debug dashboards that show complete request flows across
web servers and background workers. [#497, #502]
@fedify/fedify/otelmodule.FedifySpanExporterclass implementing OpenTelemetry'sSpanExporterinterface.TraceActivityRecordinterface for stored activity data,including
actorIdandsignatureDetailsfields for debug dashboardsupport.
SignatureVerificationDetailsinterface for detailed signatureverification information.
TraceSummaryinterface for trace listing.FedifySpanExporterOptionsinterface.GetRecentTracesOptionsinterface.ActivityDirectiontype.@fedify/nestjs
expresspeer dependency range to support NestJS 11.[#492, #493 by Cho Hasang]
@fedify/sqlite
list()method inSqliteKvStore. [#498, #500]@fedify/postgres
list()method inPostgresKvStore. [#498, #500]@fedify/redis
list()method inRedisKvStore. [#498, #500]@fedify/denokv
list()method inDenoKvStore. [#498, #500]@fedify/cfworkers
list()method inWorkersKvStore. [#498, #500]v1.9.5Compare Source
Released on February 1, 2026.
@fedify/fedify
traverseCollection()yielding no items when aCollectionhasan inline
CollectionPagein itsfirstproperty without an explicitid. This is common in Mastodon'srepliescollections. The functionpreviously used
collection.firstIdto determine pagination, whichreturned
nullfor inline pages without anid, causing it toincorrectly fall into the non-paginated branch. [[#550] by Lee Dogeon]
v1.9.4Compare Source
Released on January 23, 2026.
@fedify/testing
TestContext.getActorKeyPairs()returning empty array instead ofcalling registered key pairs dispatcher. The method now properly invokes
the key pairs dispatcher when it is registered via
setKeyPairsDispatcher(). [[#530]]v1.9.3Compare Source
Released on January 22, 2026.
@fedify/testing
TestContext.getActor()andTestContext.getObject()returningnullinstead of calling registered dispatchers. The methods now properlyinvoke actor and object dispatchers when they are registered via
setActorDispatcher()andsetObjectDispatcher(). [[#530]]v1.9.2Compare Source
Released on December 20, 2025.
@fedify/fedify
the document loader's HTML parsing. An attacker-controlled server could
respond with a malicious HTML payload that blocked the event loop.
[CVE-2025-68475]
@fedify/sqlite
SyntaxError: Identifier 'Temporal' has already been declarederrorthat occurred when using
SqliteKvStoreon Node.js or Bun. The errorwas caused by duplicate
Temporalimports during the build process.[#487]
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - Between 07:00 AM and 04:59 PM, only on Monday, Tuesday, Wednesday, and Thursday ( * 7-16 * * 1,2,3,4 ) (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.