Fedify: ActivityPub server framework's avatar

Fedify: ActivityPub server framework

@fedify@hollo.social · 9 following · 949 followers

:fedify: Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards, so-called fediverse. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

🎉 Excited to announce that is now on Open Collective! Support the project's development starting at:

  • Backer (from $5/mo)
  • Supporter (from $25/mo)
  • Sponsor (from $100/mo)
  • Corporate Sponsor (from $500/mo)
  • Custom donations welcome

Your support will help us maintain and improve Fedify. Check it out here:

https://opencollective.com/fedify

:fedify:

Fedify's Open Collective page showing the project logo, description as “A TypeScript library for building federated server apps powered by ActivityPub and other standards”, and five contribution tiers starting from $5/month Backer to $500/month Corporate Sponsor, with custom contribution options available.
ALT text detailsFedify's Open Collective page showing the project logo, description as “A TypeScript library for building federated server apps powered by ActivityPub and other standards”, and five contribution tiers starting from $5/month Backer to $500/month Corporate Sponsor, with custom contribution options available.
Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

Fedify is an server framework in & . It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

The key features it provides currently are:

If you're curious, take a look at the website! There's comprehensive docs, a demo, a tutorial, example code, and more:

https://fedify.dev/

Erlend Sogge Heggen's avatar
Erlend Sogge Heggen

@erlend@writing.exchange

hollo.social/@fedify/0199a579-

Hope this leads to an even larger shared-layer between all the js/node implementations like Ghost, NodeBB, *keys et.al.

Particularly wishing for convergence around a shared *identity core* across all these AP apps in accordance with NomadPub by @silverpill

codeberg.org/ap-next/ap-next/s

FEP-ef61: Portable Objects
FEP-ae97: Client-side activity signing

That in addition to a common OAuth foundation would effectively be ActivityPub 2.0 and on-par with atproto.

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

Exciting news for developers! We've just landed a major milestone for Fedify 2.0—the now runs natively on .js and , not just (#456). If you install @fedify/cli@2.0.0-dev.1761 from npm, you'll get actual JavaScript that executes directly in your runtime, no more pre-compiled binaries from deno compile. This is part of our broader transition to Optique, a new cross-runtime CLI framework we've developed specifically for Fedify's needs (#374).

This change means a more natural development experience regardless of your runtime preference. Node.js developers can now run the CLI tools directly through their familiar ecosystem, and the same goes for Bun users. While Fedify 2.0 isn't released yet, we're excited to share this progress with the community—feel free to try out the dev version and let us know how it works for you!

Jon's avatar
Jon

@jdp23@neuromatch.social · Reply to Fedify: ActivityPub server framework's post

@fedify really exciting! Fedify is such an Important project, and it’s really great to see the support you’re getting!

Riley Testut :fatpikachu:'s avatar
Riley Testut :fatpikachu:

@rileytestut@mastodon.social · Reply to Riley Testut :fatpikachu:'s post

While this solves our problems, we are far from the only Fediverse project that could use some funding and we want to support the growth of the entire ecosystem.

So to give back to the open social web, we’re also donating $500,000 total to these incredible Fediverse-related projects 🎉

@Mastodon
@Ivory
Tapestry by @Iconfactory
@mstdn
@bsky.brid.gy
@PeerTube
@bookwyrm
@akkoma
@fedify

The Fediverse as we know it would not exist without them, so please check them out!

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

Announcement: AltStore becomes a financial contributor to Fedify

We're thrilled to announce that AltStore has become a financial contributor to Fedify! This generous support comes as part of AltStore's broader commitment to strengthening the open social web ecosystem, as they prepare to become the world's first federated app store. Their investment in Fedify and other fediverse projects demonstrates a shared vision for building a more open, interoperable digital future.

AltStore's journey into the fediverse represents a groundbreaking approach to app distribution—connecting their alternative app marketplace with the open social web through ActivityPub. As pioneers who have already pushed Apple to change App Store policies twice in their first year, AltStore understands the transformative power of open protocols and decentralized systems. Their support will help Fedify continue developing robust tools and libraries that make it easier for developers to build federated applications. We're deeply grateful for AltStore's trust in our project and look forward to seeing how their innovative federated app store will reshape mobile app distribution while strengthening the entire fediverse ecosystem.

https://rileytestut.com/blog/2025/10/07/evolving-altstore-pal/

Email notification from Open Collective showing AltStore has become a new financial contributor to Fedify as a corporate sponsor with a $500.00 monthly contribution. The email includes the Open Collective logo, information about AltStore with a link to their Open Collective page, and details about the sponsorship tier and amount.
ALT text detailsEmail notification from Open Collective showing AltStore has become a new financial contributor to Fedify as a corporate sponsor with a $500.00 monthly contribution. The email includes the Open Collective logo, information about AltStore with a link to their Open Collective page, and details about the sponsorship tier and amount.
Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

Transparency update: Web framework integration progress

We're sharing a public project board to track our progress on web framework integrations for , work commissioned by the Sovereign Tech Fund (@sovtechfund). You can follow along at:

https://github.com/orgs/fedify-dev/projects/1

About this work

The Sovereign Tech Fund invested in Fedify to expand its ecosystem through official integrations with popular web frameworks. This investment enables developers to add federation capabilities to their existing applications without changing their technology stack.

Notably, some of these integrations were completed between our initial application submission and the official kickoff of the investment. This demonstrates both our commitment to the project and the community's active development momentum.

Current status

Already completed:

  • Next.js integration supporting both App Router and Pages Router (completed before STF kickoff)
  • Elysia integration optimized for the Bun ecosystem (completed before STF kickoff)

In progress:

  • Fastify integration (PR currently under review)

Upcoming:

  • Koa integration
  • Comprehensive documentation for all integrations

Why this matters

These integrations make Fedify accessible to developers across different JavaScript ecosystems and runtime environments. Each integration follows established patterns from our Express and h3 integrations, ensuring consistency and ease of adoption.

Investment details

Fedify has been awarded a service agreement by the Sovereign Tech Fund for this work, with a budget of €‎32,000 and completion target of November 30, 2025. The Sovereign Tech Agency supports the development, improvement, and maintenance of open digital infrastructure through investments like this.

We believe in transparent development and welcome community input and contributions.

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

We're excited to announce that has been awarded a service agreement by the @sovtechfund! The Sovereign Tech Fund is investing €192,000 in Fedify's development over 2025–2026 to strengthen the fediverse ecosystem.

This investment will enable us to significantly expand Fedify's capabilities and make it easier for developers to build federated applications. The commissioned work focuses on improving developer experience, adding comprehensive debugging tools, and ensuring Fedify remains at the forefront of innovation.

Here are the key milestones we'll be delivering:

  • Web framework integrations: Official adapters for Next.js, Elysia, Fastify, and Koa, making it seamless to add federation to existing applications

  • ActivityPub debug & development tools: Real-time debug dashboard with WebSocket monitoring, federation lifecycle hooks, and implementation checklist CLI to make federation interactions transparent and debuggable

  • Storage & infrastructure enhancements: SQLiteKvStore for robust file-based storage across Node.js, Deno, and Bun, plus performance optimizations for production deployments

  • Comprehensive documentation & examples: Specialized tutorials for building federated blogs, social networks, and content platforms, with complete working examples and migration guides

  • Observability & monitoring: Full OpenTelemetry metrics, performance benchmarking tools, and federation health dashboards for production environments

  • Advanced features & standards: FEP-ef61 (Portable Objects) support and implementation of emerging Fediverse Enhancement Proposals to keep Fedify at the cutting edge

All developments will be open source and available for the entire community to use, contribute to, and build upon.

https://www.sovereign.tech/tech/fedify

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

Transparency update: Web framework integration progress

We're sharing a public project board to track our progress on web framework integrations for , work commissioned by the Sovereign Tech Fund (@sovtechfund). You can follow along at:

https://github.com/orgs/fedify-dev/projects/1

About this work

The Sovereign Tech Fund invested in Fedify to expand its ecosystem through official integrations with popular web frameworks. This investment enables developers to add federation capabilities to their existing applications without changing their technology stack.

Notably, some of these integrations were completed between our initial application submission and the official kickoff of the investment. This demonstrates both our commitment to the project and the community's active development momentum.

Current status

Already completed:

  • Next.js integration supporting both App Router and Pages Router (completed before STF kickoff)
  • Elysia integration optimized for the Bun ecosystem (completed before STF kickoff)

In progress:

  • Fastify integration (PR currently under review)

Upcoming:

  • Koa integration
  • Comprehensive documentation for all integrations

Why this matters

These integrations make Fedify accessible to developers across different JavaScript ecosystems and runtime environments. Each integration follows established patterns from our Express and h3 integrations, ensuring consistency and ease of adoption.

Investment details

Fedify has been awarded a service agreement by the Sovereign Tech Fund for this work, with a budget of €‎32,000 and completion target of November 30, 2025. The Sovereign Tech Agency supports the development, improvement, and maintenance of open digital infrastructure through investments like this.

We believe in transparent development and welcome community input and contributions.

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social · Reply to wakest ⁂'s post

@liaizon The contract with STF prohibits subcontracting. Therefore, the milestones listed above will be carried out by @hongminhee, currently the sole maintainer. However, we hope to bring in more maintainers by the next funding round!

Andy Piper's avatar
Andy Piper

@andypiper@macaw.social · Reply to Fedify: ActivityPub server framework's post

@fedify @sovtechfund this is fantastic news, and a huge validation for the work you're doing. Congratulations!

Box464's avatar
Box464

@box464@mastodon.social

This is amazing news! Fedify has received a substantial grant for further development, including portability for fediverse objects and enhanced dev kits for ActivityPub. 🎉🎉🎉

hollo.social/@fedify/0199a579-

Sovereign Tech Agency's avatar
Sovereign Tech Agency

@sovtechfund@mastodon.social · Reply to Fedify: ActivityPub server framework's post

We are very much looking forward to following the progress on your work!

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

We're excited to announce that has been awarded a service agreement by the @sovtechfund! The Sovereign Tech Fund is investing €192,000 in Fedify's development over 2025–2026 to strengthen the fediverse ecosystem.

This investment will enable us to significantly expand Fedify's capabilities and make it easier for developers to build federated applications. The commissioned work focuses on improving developer experience, adding comprehensive debugging tools, and ensuring Fedify remains at the forefront of innovation.

Here are the key milestones we'll be delivering:

  • Web framework integrations: Official adapters for Next.js, Elysia, Fastify, and Koa, making it seamless to add federation to existing applications

  • ActivityPub debug & development tools: Real-time debug dashboard with WebSocket monitoring, federation lifecycle hooks, and implementation checklist CLI to make federation interactions transparent and debuggable

  • Storage & infrastructure enhancements: SQLiteKvStore for robust file-based storage across Node.js, Deno, and Bun, plus performance optimizations for production deployments

  • Comprehensive documentation & examples: Specialized tutorials for building federated blogs, social networks, and content platforms, with complete working examples and migration guides

  • Observability & monitoring: Full OpenTelemetry metrics, performance benchmarking tools, and federation health dashboards for production environments

  • Advanced features & standards: FEP-ef61 (Portable Objects) support and implementation of emerging Fediverse Enhancement Proposals to keep Fedify at the cutting edge

All developments will be open source and available for the entire community to use, contribute to, and build upon.

https://www.sovereign.tech/tech/fedify

chomu

@chomu@oeee.cafe

종이를 물고 있는 퍼렁공뇽

https://github.com/fedify-dev/fedify

종이를 물고 있는 퍼렁공뇽
ALT text details종이를 물고 있는 퍼렁공뇽
Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

We've just published an experimental pre-release version 1.9.0-pr.431.1597 that adds CommonJS support to all npm packages in the Fedify ecosystem! 🧪

What's new

This experimental build addresses one of the most requested features—better compatibility with CommonJS-based Node.js applications, especially NestJS projects. The pre-release eliminates the need for Node.js's --experimental-require-module flag and resolves dual package hazard issues.

Note: While we now support CommonJS for legacy project compatibility, we still recommend using ESM or migrating to Deno for the best experience with Fedify.

Who should test this?

  • NestJS developers using Fedify who need CommonJS compatibility
  • Legacy CommonJS-based Node.js projects that had trouble integrating Fedify
  • Anyone who previously needed experimental Node.js flags to use Fedify

How to test

Install the experimental pre-release version:

npm install @fedify/fedify@1.9.0-pr.431.1597
# or for specific integrations
npm install @fedify/nestjs@1.9.0-pr.431.1597

You should now be able to use standard require() syntax without any experimental flags.

What we're looking for

  • Does CommonJS import work correctly in your legacy project?
  • Are you able to remove the --experimental-require-module flag?
  • Any issues or regressions compared to the current stable version?

Your feedback on this experimental build is invaluable for ensuring this major compatibility improvement works smoothly before the official 1.9.0 release!

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

We're excited to share an update on 's development! While we're actively working on Fedify 1.9 in the main branch, we've also begun preparations for Fedify 2.0 in the next branch.

Before you get too excited about revolutionary new features, we want to set clear expectations: Fedify 2.0 will primarily focus on cleaning up technical debt that we couldn't address due to backward compatibility constraints. This means removing deprecated APIs and making breaking changes that will ultimately result in a cleaner, more maintainable codebase. Think of it as a major housekeeping release—necessary work that will make Fedify better in the long run.

Some of the planned improvements include adding readonly modifiers throughout our types and interfaces to better enforce our immutability-by-default principle, implementing our own RFC 6570 URI Template library for symmetric expansion and pattern matching, and various CLI tool migrations to our new Optique framework for better cross-runtime support. While the majority of changes will be about refinement rather than revolution, these updates will strengthen Fedify's foundation and improve interoperability across the . You can track all planned changes in detail by checking out the Fedify 2.0 milestone on our GitHub repository.

Tertle950's avatar
Tertle950

@tertle950@app.wafrn.net

wait, dead serious?
(from https://fedify.dev/tutorial/microblog)


#fediverse #holy-hell-fedify-lookin'-cool
We assume that you have experience in creating web applications using HTML and HTTP, and that you understand command-line interfaces, SQL, JSON, and basic JavaScript. However, you don't need to know TypeScript, JSX, ActivityPub, or Fedify—we'll teach you what you need to know about these as we go along.
(That last sentence is highlighted for importance.)
ALT text detailsWe assume that you have experience in creating web applications using HTML and HTTP, and that you understand command-line interfaces, SQL, JSON, and basic JavaScript. However, you don't need to know TypeScript, JSX, ActivityPub, or Fedify—we'll teach you what you need to know about these as we go along. (That last sentence is highlighted for importance.)
Box464's avatar
Box464

@box464@mastodon.social

Finished the basic tutorial for - I can now Follow and Unfollow the "me" account. Lots of useful debugging and dev tools built in, too.

I think what's most interesting about this framework is that there are quite a few AP vocabulary activitites available to you above and beyond the Mastodon mainstream.

Would love to tinker around with Offer, Reject, Listen, Question, Read

fedify.dev/tutorial/basics

A screenshot of some basic code from a tutorial that was following to create a basic AP server.
ALT text detailsA screenshot of some basic code from a tutorial that was following to create a basic AP server.
Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

In case you weren't aware, has both and communities where you can get help, discuss features, or just chat about and federated social networks.

Feel free to join either community based on your preference. Both channels have active discussions about Fedify and federation topics.

이찬행's avatar
이찬행

@2chanhaeng@hackers.pub

거의 반은 내가 기여했네 ㅎㅎ

  • @fedify/fedify: Custom Collection 디스패처 setter
  • @fedify/cli: webfinger 커맨드
  • @fedify/next: 패키지 제작 및 예제 생성
  • @fedify/sveltekit: 패키지 분리, 타입 수정 및 예제 생성
  • @fedify/cfworkers, @fedify/denokv, @fedify/hono: 패키지 분리



RE: https://hollo.social/@fedify/0198fe69-a7be-7c09-bc42-81e27fc1dd3c

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

The monorepo has grown to 16 packages!

We've been working hard to make Fedify more modular and easier to integrate with your favorite tools and platforms. From the core framework to database drivers, from CLI tools to web framework integrations—we've got you covered.

Our packages now include:

  • Core framework and CLI tools
  • Web framework integrations: Express, Hono, H3, Elysia, NestJS, Next.js, SvelteKit
  • Database drivers: PostgreSQL, Redis, SQLite, AMQP/RabbitMQ
  • Platform integrations: Cloudflare Workers, Deno KV
  • Testing utilities

Each package is available on JSR and/or npm, making it easy to pick exactly what you need for your ActivityPub implementation.

What integration would you like to see next? Let us know!

A table showing 16 Fedify packages with three columns: Package name, registry availability (JSR and npm links), and Description. The packages include the core @fedify/fedify framework, CLI toolchain, database drivers (PostgreSQL, Redis, SQLite, AMQP/RabbitMQ), web framework integrations (Express, Hono, H3, Elysia, NestJS, Next.js, SvelteKit, Cloudflare Workers), Deno KV integration, and testing utilities. Most packages are available on both JSR and npm registries, with some exceptions like @fedify/denokv (JSR only) and @fedify/elysia, @fedify/nestjs, @fedify/next (npm only).
ALT text detailsA table showing 16 Fedify packages with three columns: Package name, registry availability (JSR and npm links), and Description. The packages include the core @fedify/fedify framework, CLI toolchain, database drivers (PostgreSQL, Redis, SQLite, AMQP/RabbitMQ), web framework integrations (Express, Hono, H3, Elysia, NestJS, Next.js, SvelteKit, Cloudflare Workers), Deno KV integration, and testing utilities. Most packages are available on both JSR and npm registries, with some exceptions like @fedify/denokv (JSR only) and @fedify/elysia, @fedify/nestjs, @fedify/next (npm only).
Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

The monorepo has grown to 16 packages!

We've been working hard to make Fedify more modular and easier to integrate with your favorite tools and platforms. From the core framework to database drivers, from CLI tools to web framework integrations—we've got you covered.

Our packages now include:

  • Core framework and CLI tools
  • Web framework integrations: Express, Hono, H3, Elysia, NestJS, Next.js, SvelteKit
  • Database drivers: PostgreSQL, Redis, SQLite, AMQP/RabbitMQ
  • Platform integrations: Cloudflare Workers, Deno KV
  • Testing utilities

Each package is available on JSR and/or npm, making it easy to pick exactly what you need for your ActivityPub implementation.

What integration would you like to see next? Let us know!

A table showing 16 Fedify packages with three columns: Package name, registry availability (JSR and npm links), and Description. The packages include the core @fedify/fedify framework, CLI toolchain, database drivers (PostgreSQL, Redis, SQLite, AMQP/RabbitMQ), web framework integrations (Express, Hono, H3, Elysia, NestJS, Next.js, SvelteKit, Cloudflare Workers), Deno KV integration, and testing utilities. Most packages are available on both JSR and npm registries, with some exceptions like @fedify/denokv (JSR only) and @fedify/elysia, @fedify/nestjs, @fedify/next (npm only).
ALT text detailsA table showing 16 Fedify packages with three columns: Package name, registry availability (JSR and npm links), and Description. The packages include the core @fedify/fedify framework, CLI toolchain, database drivers (PostgreSQL, Redis, SQLite, AMQP/RabbitMQ), web framework integrations (Express, Hono, H3, Elysia, NestJS, Next.js, SvelteKit, Cloudflare Workers), Deno KV integration, and testing utilities. Most packages are available on both JSR and npm registries, with some exceptions like @fedify/denokv (JSR only) and @fedify/elysia, @fedify/nestjs, @fedify/next (npm only).
Andy Piper's avatar
Andy Piper

@andypiper@macaw.social

Shout-out for @fedify as a great tool for developers in the 🫶🏻 from @dave

David Roetzel, a white man wearing a black t-shirt in front of a slide describing Fedify (a TypeScript ActivityPub server framework and CLI tool). A Mastodon plushie sits on the table in front.
ALT text detailsDavid Roetzel, a white man wearing a black t-shirt in front of a slide describing Fedify (a TypeScript ActivityPub server framework and CLI tool). A Mastodon plushie sits on the table in front.
Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

We'd like to recognize the valuable contributions from two developers who participated in Korea's (Open Source Contribution Academy) program. Both contributors identified important gaps in 's functionality and documentation, providing thoughtful solutions that benefit the broader ecosystem.

@gaebalgom contributed PR #365, addressing issue #353 regarding NodeInfo parser compatibility, originally reported by @andypiper. The issue arose when Fedify incorrectly rejected documents from snac instances due to overly strict version string parsing that required semantic versioning compliance. Their solution improves the fallback behavior in the parseSoftware() function to handle non-SemVer version strings by parsing dot-separated numbers and defaulting to zero for missing components. The implementation includes thorough test coverage for various edge cases, including single numbers (3), two-part versions (2.81), and malformed version strings. This fix provides immediate compatibility improvements across the fediverse while maintaining backward compatibility, and will be included in Fedify 1.9. The contribution serves as an interim solution, with a more comprehensive fix planned for Fedify 2.0 (issue #366), where the NodeInfo software.version field will be changed from the SemVer type to a plain string to fully comply with the NodeInfo specification.

@z9mb1 contributed PR #364, resolving issue #337 by adding practical examples for Fedify's custom collection dispatchers feature. Custom collections were introduced in Fedify 1.8 but lacked clear documentation for developers seeking to implement them. Their contribution provides a comprehensive example demonstrating how to set up custom collections for tagged posts, including proper routing patterns, pagination handling, and counter functionality. The example includes mock data structures, shows how to configure collection dispatchers with URL patterns like /users/{userId}/tags/{tag}, and demonstrates the complete request/response cycle using federation.fetch(). This work provides developers with a clear, runnable reference that reduces the complexity of implementing custom collections in ActivityPub applications.

We appreciate these meaningful contributions that help make Fedify more accessible and robust for the entire ActivityPub community.

sid

@sid@margins.work

Hello world! This is my first post. I created a single user microblog using @fedify

I am trying to create 'margins' — a free and open source single-user microblogging site for academics who want to stash ideas and readings within particular projects that can have multiple authors. It will use ActivityPub and federation.

Long road ahead, but I am excited!

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social · Reply to Jer's post

@nyquildotorg Yeah, they seemed to already update their version of Fedify!

https://github.com/TryGhost/ActivityPub/commit/6fafc7d224b1c9a8b21833769a0dc9d884781fe8

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: ActivityPub server framework's post

🚨 緊急セキュリティアップデート通知

Fedifyで非常に深刻なセキュリティ脆弱性(CVE-2025-54888)が発見され、ホットフィックスを緊急リリースいたしました。

全ユーザーは直ちに最新のパッチバージョンにアップデートしてください。

詳細とアップデート方法については、以下のリンクをご参照ください:

https://github.com/fedify-dev/fedify/discussions/361

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: ActivityPub server framework's post

🚨 긴급 보안 업데이트 공지

Fedify에서 매우 심각한 보안 취약점(CVE-2025-54888)이 발견되어 핫픽스를 긴급 배포했습니다.

모든 사용자는 즉시 최신 패치 버전으로 업데이트해야 합니다.

자세한 내용과 업데이트 방법은 아래 링크를 참고해 주세요:

https://github.com/fedify-dev/fedify/discussions/361

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

All users must immediately update to the latest patched versions. A authentication bypass (CVE-2025-54888) has been discovered in Fedify that allows attackers to impersonate any actor by sending forged activities signed with their own keys.

This vulnerability affects all Fedify instances and enables complete actor impersonation across the federation network. Attackers can send fake posts and messages as any user, create or remove follows as any user, boost and share content as any user, and completely compromise the federation trust model. The vulnerability affects all Fedify instances but does not propagate to other ActivityPub implementations like Mastodon, which properly validate authentication before processing activities.

The following versions contain the fix: 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, and 1.8.5. Users should update immediately using their package manager with commands such as npm update @fedify/fedify, yarn upgrade @fedify/fedify, pnpm update @fedify/fedify, bun update @fedify/fedify, or deno update @fedify/fedify.

After updating, redeploy your application immediately and monitor recent activities for any suspicious content. Please also inform other Fedify operators about this critical update to ensure the security of the entire federation network.

The safety and security of our community depends on immediate action. Please update now and feel free to leave comments below if you have any questions.

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

We're thrilled to announce Fedify 1.8.1, a mega release made possible through the incredible efforts of contributors from South Korea's (Open Source Contribution Academy). This release marks a significant milestone in 's development, bringing major architectural changes, new packages, and numerous enhancements across the board.

Note: Version 1.8.0 was skipped due to a versioning error.

🎉 Major Milestone: Monorepo Architecture

Fedify has been restructured as a , consolidating all packages into a single repository with unified versioning. This change streamlines development and ensures all packages are released together with consistent version numbers.

Consolidated Packages

All existing Fedify packages now live under one roof:

  • @fedify/fedify — Main library
  • @fedify/cli — CLI toolchain
  • @fedify/amqp — AMQP/RabbitMQ driver
  • @fedify/express — Express integration
  • @fedify/h3 — h3 framework integration
  • @fedify/postgres — PostgreSQL drivers
  • @fedify/redis — Redis drivers

🆕 New Packages

This release introduces four new packages to the Fedify ecosystem:

  • @fedify/elysiaElysia integration for Bun-powered applications
  • @fedify/nestjsNestJS integration for enterprise Node.js apps
  • @fedify/sqlite — SQLite driver compatible with Bun, Deno, and Node.js
  • @fedify/testing — Testing utilities with mock Federation and Context classes

@fedify/fedify

Custom Collection Dispatchers

A powerful new feature that allows you to create custom collections beyond the standard ActivityPub collections. This enables implementation of domain-specific collections while maintaining federation compatibility.

Contributors: ChanHaeng Lee [#310, #332]

  • Added comprehensive types and interfaces for custom collection handling
  • New methods on Federatable interface: setCollectionDispatcher() and setOrderedCollectionDispatcher()
  • Added getCollectionUri() method to the Context interface
  • Full support for paginated custom collections

Compare-and-Swap (CAS) Support for KV Stores

Key–value stores now optionally support CAS operations for atomic updates, enabling optimistic locking and preventing lost updates in concurrent environments.

  • Added optional KvStore.cas() method
  • Implemented in MemoryKvStore and DenoKvStore
  • Useful for implementing distributed locks and counters

Fediverse Handle Utilities

New utility functions make working with handles more convenient.

Contributors: ChanHaeng Lee [#278]

  • parseFediverseHandle() — Parse handles into components
  • isFediverseHandle() — Validate handle format
  • toAcctUrl() — Convert handles to URLs
  • FediverseHandle interface for type safety

Enhanced HTTP Request APIs

Contributors: Lee ByeongJun [#248, #281], Hyunchae Kim [#51, #315]

  • Added LookupWebFingerOptions.maxRedirection option for controlling redirect behavior
  • APIs now support AbortSignal for request cancellation
  • New DocumentLoaderOptions interface
  • Added signal options to LookupObjectOptions, LookupWebFingerOptions, and DoubleKnockOptions

@fedify/cli

New Commands and Enhancements

The CLI has received significant improvements thanks to our OSSCA contributors:

fedify webfinger Command

Contributors: ChanHaeng Lee [#260, #278], KeunHyeong Park [#311, #328]

Look up WebFinger information for any fediverse resource:

  • Supports handles (@user@server) and URLs
  • --user-agent option for custom User-Agent headers
  • --allow-private-address for local testing
  • --max-redirection to control redirect following

fedify nodeinfo Command

Contributors: Hyeonseo Kim [#267, #331, #168, #282, #304]

Replaces the deprecated fedify node command with improved terminal rendering.

Enhanced fedify lookup Command

Contributors: Jiwon Kwon [#169, #348, #261, #321]

  • Terminal-specific image display for Kitty, WezTerm, Konsole, Warp, Wayst, st, and iTerm
  • -o/--output option to save results to files

Improved fedify inbox Command

Contributors: Hasang Cho [#262, #285], Jang Hanarae [#191, #342]

  • --actor-name and --actor-summary options for customizing temporary actors
  • Now displays object types contained in activities

fedify init --dry-run

Contributors: Lee ByeongJun [#263, #298]

Preview project initialization without creating files.

Better Terminal Support

Contributors: Cho Hasang [#257, #341]

Correctly handles color output based on TTY detection and NO_COLOR environment variable.

@fedify/elysia

Contributors: Hyeonseo Kim [#286, #339]

New Elysia integration brings Fedify to Bun-powered applications with a simple plugin interface:

import { Elysia } from "elysia";
import { fedify } from "@fedify/elysia";

const app = new Elysia()
  .use(fedify(federation, { /* options */ }))
  .listen(3000);

@fedify/nestjs

Contributors: Jaeyeol Lee [#269, #309]

Enterprise-ready NestJS integration with dependency injection support:

import { FedifyModule } from "@fedify/nestjs";

@Module({
  imports: [
    FedifyModule.forRoot({
      kv: new MemoryKvStore(),
      queue: new InProcessMessageQueue(),
      origin: "https://example.com",
    }),
  ],
})
export class AppModule {}

@fedify/sqlite

Contributors: An Subin [#274, #318]

SqliteKvStore implementation compatible across all major JavaScript runtimes:

import { SqliteKvStore } from "@fedify/sqlite";

const kv = new SqliteKvStore("./fedify.db");

@fedify/testing

Contributors: Lee ByeongJun [#197, #283]

Comprehensive testing utilities with mocking support for Fedify applications:

import { MockFederation, MockContext } from "@fedify/testing";

const mockFederation = new MockFederation();
const mockContext = new MockContext();

// Track sent activities with full metadata
// Support custom path registration
// Multiple activity type listeners

🙏 Acknowledgments

This release represents an extraordinary community effort, particularly from the participants of South Korea's OSSCA (Open Source Contribution Academy) (Note: page in Korean). We extend our heartfelt thanks to all contributors:

Core Contributors

  • ChanHaeng Lee (@2chanhaeng) — Custom collections, fediverse handles, WebFinger command
  • Lee ByeongJun (@joonnot) — WebFinger redirections, dry-run, testing utilities
  • Hyunchae Kim (@r4bb1t) — AbortSignal support
  • Hyeonseo Kim (@gaebalgom) — Elysia integration, nodeinfo command
  • Jaeyeol Lee (@kodingwarrior) — NestJS integration
  • An Subin (@nyeong) — SQLite driver
  • Jiwon Kwon (@z9mb1) — Terminal image display, output options
  • Hasang Cho (@crohasang) — Color output handling, actor customization
  • Jang Hanarae (@menele) — Activity object type display
  • KeunHyeong Park (@w8385) — WebFinger redirect options

Test Infrastructure Contributors

Your contributions have made Fedify stronger and more versatile than ever. The OSSCA program's support has been instrumental in achieving this milestone release.

Migration Guide

Updating from Previous Versions

If you're using separate Fedify packages, update all packages to version 1.8.1:

{
  "dependencies": {
    "@fedify/fedify": "^1.8.1",
    "@fedify/cli": "^1.8.1",
    "@fedify/express": "^1.8.1"
  }
}

All packages now share the same version number, simplifying dependency management.

Breaking Changes

There are no breaking changes in this release. All existing code should continue to work without modifications.

What's Next

With the monorepo structure in place and new integrations available, we're excited to continue improving Fedify's developer experience and expanding its capabilities. Stay tuned for more updates, and thank you for being part of the Fedify community!

For detailed technical information about all changes, please refer to the full changelog.


Fedify is an open-source project that helps developers build federated server applications powered by ActivityPub. Join us on GitHub or Discord to contribute or get help!

Fedify: ActivityPub server framework's avatar
Fedify: ActivityPub server framework

@fedify@hollo.social

We'd like to recognize some excellent contributions from our (Open Source Contribution Academy) participants who have been working on .

@gaebalgom contributed PR #339, which introduces the @fedify/elysia package to provide Elysia integration for Fedify. This work addresses issue #286 by creating a plugin that enables developers using and to integrate Fedify's capabilities into their applications. The contribution includes the core integration module, documentation, examples, and proper monorepo configuration, making Fedify accessible to the Elysia community.

@r4bb1t submitted PR #315, implementing comprehensive AbortSignal support across multiple APIs to resolve issue #51. This contribution adds request cancellation capabilities not only to lookupWebFinger() but also to lookupObject(), DocumentLoader, and the HTTP signature authentication flow (doubleKnock()), allowing developers to properly handle timeouts and abort ongoing requests throughout the entire request chain. The implementation includes extensive test coverage for cancellation scenarios across all affected components and lays the groundwork for adding --timeout options to various CLI commands like fedify lookup, fedify webfinger, and fedify nodeinfo, making federated applications more robust and responsive.

@ooheunda addressed a testing infrastructure issue with PR #350, fixing a race condition in PostgreSQL message queue tests that was causing intermittent failures (issue #346). By adding explicit initialization before concurrent message queue listeners, this fix prevents table creation conflicts that were affecting test reliability, ensuring more consistent PR testing for all contributors.

@songbirds provided two test stability improvements with PR #344 and PR #347. The first PR adds skip guards to RedisKvStore tests as a workaround for a known Bun runtime issue, keeping the test suite functional while awaiting an upstream fix. The second PR resolves a race condition in the code generation process by randomizing output filenames, preventing conflicts during parallel test execution. These contributions help maintain a stable testing environment for the project.

Thank you all for your contributions to Fedify. Your work helps make federated social networking more accessible to developers.

Older →