Released on August 22, 2026.

@fedify/fedify

• Fixed a remotely triggerable denial-of-service vulnerability where the outbound delivery circuit breaker, when configured with a custom failure policy without an explicit stateTtl, stored per-host state in the configured key–value store without any expiry. A remote attacker could accumulate unbounded permanent records—one per distinct inbox host:port—by advertising inbox URLs that fail delivery, gradually exhausting storage. Custom failure policies now derive a default stateTtl of recoveryDelay plus heldActivityTtl (7 days 30 minutes with the default values), and the automatic upgrade sweep on CAS-backed stores now stamps a TTL on circuit state that earlier 2.3 releases wrote without one, including state written by custom policies on 2.3.2–2.3.4. Set stateTtl explicitly if your custom policy needs its failure history retained for a different length of time. [CVE-2026-69132]
• Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
• Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@fedify/elysia

• Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@fedify/vocab-runtime

• Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
• Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]

Released on August 22, 2026.

@fedify/fedify

• Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
• Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@fedify/elysia

• Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@fedify/vocab-runtime

• Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
• Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]

Released on August 22, 2026.

@fedify/fedify

• Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
• Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@fedify/elysia

• Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@fedify/vocab-runtime

• Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
• Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]

Released on August 22, 2026.

@fedify/fedify

• Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
• Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@fedify/elysia

• Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@fedify/vocab-runtime

• Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
• Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]

Released on July 29, 2026.

@fedify/vocab-runtime

• Added https://purl.archive.org/miscellany (the SWICG ActivityPub Miscellaneous Terms context, referenced by every Bridgy Fed activity) to preloaded JSON-LD contexts. The context is served through purl.archive.org, which suffers recurring outages; during one, JSON-LD expansion of any activity referencing this URL fails before application handlers can run. [#965 by Michael Barrett]

Released on July 29, 2026.

@fedify/vocab-runtime

• Added https://purl.archive.org/miscellany (the SWICG ActivityPub Miscellaneous Terms context, referenced by every Bridgy Fed activity) to preloaded JSON-LD contexts. The context is served through purl.archive.org, which suffers recurring outages; during one, JSON-LD expansion of any activity referencing this URL fails before application handlers can run. [#965 by Michael Barrett]

Released on July 29, 2026.

@fedify/vocab-runtime

• Added https://purl.archive.org/miscellany (the SWICG ActivityPub Miscellaneous Terms context, referenced by every Bridgy Fed activity) to preloaded JSON-LD contexts. The context is served through purl.archive.org, which suffers recurring outages; during one, JSON-LD expansion of any activity referencing this URL fails before application handlers can run. [#965 by Michael Barrett]

Released on July 29, 2026.

@fedify/vocab-runtime

• Added https://purl.archive.org/miscellany (the SWICG ActivityPub Miscellaneous Terms context, referenced by every Bridgy Fed activity) to preloaded JSON-LD contexts. The context is served through purl.archive.org, which suffers recurring outages; during one, JSON-LD expansion of any activity referencing this URL fails before application handlers can run. [#965 by Michael Barrett]

Released on July 19, 2026.

@fedify/vocab-runtime

• Fixed document loaders rejecting public URLs backed by CNAMEs on Cloudflare Workers. validatePublicUrl() now ignores non-IP aliases returned alongside DNS lookup results while continuing to validate every resolved IP address, and rejects lookups that return no IP addresses. [#956, #957 by SJang1]

@fedify/cfworkers

• Fixed WorkersMessageQueue.enqueueMany() failing when the given messages exceeded Cloudflare Queues' batch limits of 100 messages or 256 KB per batch, which could happen when delivering activities to a large audience. The method now estimates the serialized size of each message and splits the messages into multiple sendBatch() calls that stay within the limits. [#958, #960 by SJang1]

Released on July 19, 2026.

@fedify/vocab-runtime

• Fixed document loaders rejecting public URLs backed by CNAMEs on Cloudflare Workers. validatePublicUrl() now ignores non-IP aliases returned alongside DNS lookup results while continuing to validate every resolved IP address, and rejects lookups that return no IP addresses. [#956, #957 by SJang1]

@fedify/cfworkers

• Fixed WorkersMessageQueue.enqueueMany() failing when the given messages exceeded Cloudflare Queues' batch limits of 100 messages or 256 KB per batch, which could happen when delivering activities to a large audience. The method now estimates the serialized size of each message and splits the messages into multiple sendBatch() calls that stay within the limits. [#958, #960 by SJang1]