@[email protected] · 7 following · 375 followers
Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards, so-called fediverse. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.
| Website | GitHub | JSR | npm |
|---|---|---|---|
We released #Fedify 0.9.2, 0.10.1, and 0.11.1, which patched the last reported #vulnerability, CVE-2024-39687, but the vulnerability of SSRF attacks via DNS rebinding still exists, so we released Fedify 0.9.3, 0.10.2, and 0.11.2, which fixes it.
If you are using an earlier version, please update as soon as possible.
Thanks to @benaryorg for reporting the vulnerability!
@[email protected] · Reply to Mitex Leo's post
@ml Apparently they (Ghost) have a bug. We'll inform them!
We're releasing @fedify/h3! Now you can integrate #Fedify with h3, an HTTP server framework behind Nitro, Analog, Vinxi, SolidStart, TanStack Start, and other many web frameworks.
@[email protected] · Reply to Mitex Leo's post
@ml What Mastodon client app do you use?
@[email protected] · Reply to silverpill's post
@silverpill Yeah, they apparently missed to wrap it with Image object! See their code:
It should be changed as like below (from @hollo):
Woah, #ghost is now live in the #fediverse with @index.
Absolutely outstanding progress! #fedify definitely deserves a great deal of recognition for making this possible. 😎
Feeling like we now have tooling in place to fediverse all things. 😅
looks like there will be lighter-weight alternatives to mastodon, thanks to @fedify — maybe I’ll hack together a simple one? 🙃
Finally, @ghost has open sourced their #ActivityPub implementation powered by #Fedify! For Fedify users, this means another production-grade example code.
If you'd like to follow updates on #Ghost's ActivityPub implementation, you can do so by following @index!
Two big pieces of news in Ghost's progress on ActivtyPub integration:
1. You can now follow their newsletter from the Fediverse at this address: @index
2. They've open sourced their ActivityPub work!
We're many steps closer to being able to follow Ghost newsletters on the #Fediverse rather than cluttering up your email inbox 🙏🏻
https://activitypub.ghost.org/lets-fix-it-in-production/?ref=build-log-newsletter
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
@fedify users of Fedify still need to keep potential for SSRF in mind when requesting any URLs in Activities/Objects not through these APIs, e.g., when downloading media from a remote server for caching
I was planning to play around with #fedify but got sidetracked into learning #deno #fresh #preact #tailwindcss ...
To #Hollo users: please update your #Hollo to 0.1.0-dev.46, a #security patch which addresses @fedify's #vulnerability CVE-2024-39687, as soon as possible!
https://hollo.social/@fedify/019080c7-c784-755d-a6f2-d1f91f2c5709
To #Fedify users: please update your Fedify as soon as possible!
https://hollo.social/@fedify/019080c7-c784-755d-a6f2-d1f91f2c5709
CVE-2024-39687, a vulnerability that could potentially allow a Server Side Request Forgery (SSRF) attack, was discovered in #Fedify and a security patch has been applied to fix it. The patched versions are 0.9.2, 0.10.1, and 0.11.1, respectively. If you are using an earlier version, please update as soon as possible.
Thanks to @thisismissem for reporting the vulnerability!
Hooray, #Fedify's GitHub repository just hit 300 stars!
@[email protected] · Reply to Tim Chambers's post
I've been using fedify for the last few months and I'm absolutely loving it. It makes it really easy to prototype new ideas.
@[email protected] · Reply to 洪 民憙 (Hong Minhee)'s post
#Fedify now has a queue for incoming activities and they are automatically retried when they fail. The default retry strategy is good enough (exponential backoff + decorrelated jitter), and it's even fully customizable. Updated also the docs:
https://unstable.fedify.dev/manual/inbox#making-inbox-listeners-non-blocking
You can give it a try by installing 0.12.0-dev.265+cb851932, the latest unstable release:
https://jsr.io/@fedify/[email protected]ev.265+cb851932
https://www.npmjs.com/package/@fedify/fedify/v/0.12.0-dev.265
In the next version of #Fedify, the #RetryPolicy type is introduced to let you fully customize the retry policy of the task queue for incoming and outgoing activities. Of course, you can also simply adjust the parameters of the built-in exponential backoff + decorrelated jitter policy.
Basic implementation of the inbox queue is complete and documentation is being worked on.
https://hollo.social/@fedify/0190687b-1a09-728b-8a0d-bcbd4dca54cd
In the next version of #Fedify, the Context.hostname, Context.host, and Context.origin properties will be added for better multitenancy/virtual hosting support.
https://github.com/dahlia/fedify/issues/66#issuecomment-2198967566
#Fedify has always been queuing outgoing activities, but not incoming activities. Thanks to @ghost's sponsorship, we are now implementing queues for incoming activities!
@[email protected] · Reply to 洪 民憙 (Hong Minhee)'s post
It was trivial than I expected; #Fedify now supports #ChatMessage type!
Did you know? #Fedify offers the markdown-it plugins for parsing #Mastodon-style mentions and hashtags syntax.
• @fedify/markdown-it-mention: https://github.com/dahlia/markdown-it-mention
• @fedify/markdown-it-hashtag: https://github.com/dahlia/markdown-it-hashtag
Check it out!
Week in Fediverse 2024-06-28
Servers
- Sharkey v2024.5.1
- Gancio v1.18.0
- Mitra v2.23.0
- neodb v0.10.2.3
- Castopod v1.12.0
- NodeBB v4.0.0-alpha (aka ActivityPub alpha release)
- Hollo: Federated single-user microblogging software powered by Fedify
Clients
- IceCubesApp v1.10.43
- Tuba v0.8.1
- Pachli v2.6.0
- mlmym v0.0.46
- P2Play v0.8.1
- Phanpy changelog
Tools and Plugins
- FediFetcher v7.1.1
- Granary v7.0
- Fedify v0.11.0
- Betulon: A simple utility to add Mastodon bookmarks to Betula
Articles
- Meta is connecting Threads more deeply with the fediverse
-----
#WeekInFediverse #Fediverse #ActivityPub
Previous edition: https://mitra.social/objects/01903bb6-c8eb-3a66-3305-460bf5a946d1
Version 0.11.0 of Fedify, an ActivityPub server framework, has been released! Here are the key changes:
Followed up changes in eddsa-jcs-2022 spec for Object Integrity Proofs.
Frequently used JSON-LD contexts are now bundled with Fedify.
Inbox, linked, featured, and featured tags collection dispatchers are introduced. (Thanks to @ghost!)
Activity Vocabulary API now has better runtime type error messages.
The items property of OrderedCollection and OrderedCollectionPage is now represented as orderedItems (was items) in JSON-LD.
Added Invite, Join, Leave, Listen, Offer classes. (Thanks to Randy Wressell & @moreal!)
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
If you want a message queue backend for #RabbitMQ as well, please upvote this issue!
#Hollo is using this @fedify/redis package for caching and queuing. Battle tested!
https://hollo.social/@fedify/01905e6b-deec-785a-9bda-b72883031f8f
#Fedify has supported optional queuing for outgoing activities, with two built-in message queue backends: InProcessMessageQueue, which is suitable for development, and DenoKvMessageQueue, which is only available in Deno.
Fedify has also had two built-in cache backends, MemoryKvStore, which is suitable for development, and DenoKvStore, which is only available in Deno.
Now, however, by installing the @fedify/redis package, you can use #Redis as both a message queue backend and a cache backend! Unlike DenoKvMessageQueue and DenoKvStore, it's also available for #Node.js and #Bun.
This feature was made possible with the support of @ghost.