Fedify: ActivityPub server framework

So happy to join the team as a maintainer :)

RE: https://hollo.social/@fedify/019f0330-a26c-7ee2-80a1-c2ebeb4bab09

Two new maintainers join Fedify: Chanhaeng Lee and Jiwon Kwon

Chanhaeng Lee (@2chanhaeng) and Jiwon Kwon (@z9mb1) are now co-maintainers of Fedify. They have already been doing maintainer-shaped work for much of the past year, so this is mostly making the repository match reality.

Chanhaeng has done a lot of the package-boundary work in Fedify. The most visible piece was splitting the old @fedify/fedify/x/* modules into standalone packages: @fedify/cfworkers, @fedify/denokv, @fedify/hono, and @fedify/sveltekit. They then separated the Activity Vocabulary layer itself into @fedify/vocab, @fedify/vocab-runtime, and @fedify/vocab-tools, making it possible to build custom vocabulary extensions without touching the federation core. They built @fedify/next and @fedify/nuxt from scratch, contributed to @fedify/solidstart, and added Nuxt support to fedify init. @fedify/sqlite gained SqliteMessageQueue: a queue backend that only needs SQLite, handy for single-node deployments and local development. Chanhaeng also implemented the fedify webfinger CLI command, fediverse handle utilities (parseFediverseHandle(), isFediverseHandle(), toAcctUrl()), and the @fedify/webfinger and @fedify/lint packages. They are currently working on a custom background task API built around defineTask().

Jiwon has spent much of the past year making the CLI and relay tooling more useful for real ActivityPub debugging. fedify relay, backed by @fedify/relay, spins up a local ephemeral ActivityPub relay server with Mastodon and LitePub support. They extended fedify lookup with multi-URL traversal and inline image rendering for compatible terminal emulators (Kitty, WezTerm, iTerm, and others), and added configuration file support so options can live in ~/.config/fedify/config.toml or a project-local .fedify.toml rather than being passed on every invocation. They also fixed a race condition in RedisMessageQueue, corrected ActivityPub object handling for relative URLs, extended TypeScript types for RFC 6570 URI Template expressions in dispatcher paths, and implemented the FEP-5711 inverse collection properties, including likesOf, repliesOf, and followersOf.

Chanhaeng and Jiwon both came to Fedify through OSSCA 2025, Korea's Open Source Contribution Academy. I'm grateful that the program led to long-term maintainers, not just a few merged patches, and I'm looking forward to working with them in this new role.

Fedify 2.3.0 is out! This release is largely about production observability: OpenTelemetry metrics now cover every major federation path, and a monitoring guide and runnable example stack ship alongside them. Also new: a delivery circuit breaker that holds queued activities for unreachable servers rather than retrying indefinitely; @fedify/backfill, a new package for reconstructing conversations via FEP-f228; and fedify bench, an ActivityPub-aware load testing command. Release notes: https://github.com/fedify-dev/fedify/discussions/821.

Thanks to @2chanhaeng (@fedify/uri-template), @z9mb1 (@fedify/backfill), @sabrinkmann (FEP-0837 vocabulary), @nyanrus (@fedify/lint/oxlint), and @fruitsssdev (--skip-install) for their contributions to this release.

DrFed is our sister project, built alongside #Fedify to tackle the debugging side of #ActivityPub development. It just received @nlnet funding and now has its own account here: @drfed.

#DrFed #fedidev #fediverse #NLnet

Some of you have already heard of us as #Fedify Studio. We now have a proper name: DrFed, short for “Doctor Fed.” We've also just received funding from @nlnet, through the NGI0 Commons Fund.

#DrFed is a web app for debugging #ActivityPub interoperability failures. When two implementations don't federate, the slow part is usually figuring out where the exchange broke: signing, JSON-LD processing, WebFinger, or something less obvious. DrFed's first job is to show where it failed.

We're the team behind @fedify: @2chanhaeng, @gaebalgom, @hongminhee, and @z9mb1. We'll post updates when there's something to try.

#fedidev #fediverse

Fedify security updates: 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5

If you use Fedify, update to a patched release now. CVE-2026-50131 affects Fedify's public URL validation for remote document and media loading. An attacker could use special-use IP address ranges to bypass Fedify's SSRF protections and cause a Fedify server to initiate requests to non-public or special-use network destinations, depending on the deployment environment and network routing.

Fedify validates remote ActivityPub document and media URLs before fetching them, including direct IP literals and hostnames resolved through DNS. The vulnerable path is validatePublicUrl(): affected versions rejected common private and local addresses, but still treated several special-use IPv4 ranges as public internet destinations. That gap could allow outbound requests to ranges such as carrier-grade NAT, benchmarking, multicast, reserved, and documentation networks.

The fix makes Fedify validate resolved addresses against public-network expectations instead of relying on the incomplete denylist. It rejects additional special-use IPv4 ranges and IPv6 translation or tunneling prefixes, including NAT64, Teredo, and 6to4 addresses, before remote document or media fetching proceeds.

Current patched releases are 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5. The GitHub Security Advisory is GHSA-xw9q-2mv6-9fr8, and the CVE ID is CVE-2026-50131.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

If your project depends directly on @fedify/vocab-runtime, update that package too.

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to Chaitanya Vilas Garware for the report and responsible disclosure.

If anything is unclear, ask below.

There's a Matrix room for #Fedify contributors, open to anyone curious about how development happens. Feel free to drop in or lurk; small questions are fine too.

#fedify-contributors:matrix.org

The software is built with @fedify and uses Nuxt for the server and server-side rendering. This is my first bigger Fedify project, so I'm looking for improvements and best practices.
The Fediverse data structure is built on top of: https://codeberg.org/fediverse/fep/src/branch/main/fep/0837/fep-0837.md.
From the data point of view, this includes the proposal and resourceConformsTo field, which links to an URI. Like: https://mensa.mahlzeitheute.de/users/fl-ca1/menu-items/currywurst-currysosse-und-pommes.
Behind this is a JSON LD with a description of the food. As someone who is gluten intolerant, the allergen information is quite relevant and interesting. I'm not sure if this is the best way, and I'm interested what others would do. [2/4]

Fedify触ってみたいなあ!!

FedifyでActivityPubサーバーを実装して公開してみた（FediLUG・東海道らぐのLT大会OSC名古屋2026出張版 2026.05.23）
https://www.docswell.com/s/monaco_koukoku/ZE18LQ-fedilug-tokaidolug-oscnagoya20260523

guess it’s time to learn some fedi dev with fedify

@hongminhee

Fedify security updates: 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3

If you use Fedify, update to a patched release now. CVE-2026-42462 affects Fedify's Linked Data Signature handling. An attacker could use JSON-LD graph-restructuring features to change how a signed activity is interpreted without invalidating its Linked Data Signature.

Fedify verifies incoming ActivityPub activities with several mechanisms, including HTTP Signatures, Object Integrity Proofs, and Linked Data Signatures. The vulnerable path is Linked Data Signatures: the signature is checked over the canonical RDF graph, but JSON-LD can represent the same graph in more than one JSON shape. In affected versions, that gap could let a signed activity be reshaped so that Fedify reads a different ActivityPub object shape than intended.

The fix makes Fedify normalize Linked Data Signature-verified activities against Fedify's local JSON-LD context before interpreting them, and rejects JSON-LD constructs that can preserve the signed RDF graph while changing the ActivityPub object shape consumed by Fedify.

Patched releases are 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3. The GitHub Security Advisory is GHSA-9rfg-v8g9-9367, and the CVE ID is CVE-2026-42462.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to @Claire for the report and responsible disclosure.

If anything is unclear, ask below.

It took some night tinkering around, but I built a proof of concept with @fedify, with 1) a shop software that creates and sends offers/products, 2) to the following marketplaces. The marketplace aggregates these offers and all via activitipub, so in the fediverse.
You can find the proof of concept here: https://marketplace.playground.54gradsoftware.de/.
If you go to a shop software, you also can add products, and you should see in the marketplace the new product: https://shop-postcards.playground.54gradsoftware.de/
Every hour there is a reset in the db.

This is just a super simple example with no CSS and no auth, but just an example to test the new fedify vocabulary.
You can find more information in the repo: https://codeberg.org/54GradSoftware/economiverse
#fep0837

This is the CUTEST kawaii Ai-chan (藍(あい)"Ai" is a normal female Japanese name meaning "Indigo" both the color and the plant; "Ai"-chan, the mascot of Misskey, has nothing to do with Large Language Models) I have ever seen from a technical literature titled like "Practical Fedify: An Introduction to ActivityPub Microblog Development"! I even see other mascots in the Fediverse too, like Don the Mastodon and that Blue Dinosaur mascot of Fedify (I don't know its name).
Huge thanks to @hongminhee@hollo.social https://hollo.social/@hongminhee for their work on authoring this amazing book and developing Fedify itself! And if you can read Japanese and are interested in Fedify and ActivityPub Development, then definitely check this one out! You can pre-order the book on Amazon Japan → https://amzn.asia/d/0hQSKBmI #Fedify (The book will be printed on May 22)

日本で世界初のFedifyの書籍「実践Fedify——ActivityPubマイクロブログ開発入門」が出版されました。この本は私にとって初めての著書でもありますが、最初の本が母語の韓国語ではなく日本語だというのは、なんだかとても不思議な気分ですね。本書は、英語で書かれたFedifyの公式チュートリアル「Creating your own federated microblog」をベースに、様々な加筆を行ったものです。Fedifyのマスコットの恐竜と、Misskeyのマスコットである三須木（みすき） 藍（あい）、Mastodonのマスコットが一緒に描かれた可愛い表紙のイラストは、ゆめつきママさんが描いてくださいました。電子書籍と紙の書籍の両方で、来る22日にインプレス NextPublishingから出版される予定です。

The world's first Fedify book, Practical Fedify: Introduction to ActivityPub Microblog Development (実践Fedify——ActivityPubマイクロブログ開発入門), has been published in Japan. This is also the first book I have ever published, and it feels quite surreal that my first book is in Japanese rather than my native language, Korean. This book is an expanded version based on the official English Fedify tutorial, Creating your own federated microblog, with various additions. Yumetsuki Mama (ゆめつきママ) worked on the cute book cover illustration, which features the Fedify dinosaur mascot, Misskey's mascot Ai-chan, and the Mastodon mascot together. It is scheduled to be published in both e-book and print formats on the 22nd by Impress NextPublishing. See also the Amazon Japan.

Fedify security updates: 1.9.10, 1.10.9, 2.0.16, 2.1.12, and 2.2.1

If you use Fedify, update to a patched release now. A private network protection bypass affects Fedify's remote document loading code. URLs with private IPv4 addresses encoded as IPv4-mapped IPv6 literals, such as http://[::ffff:7f00:1]/, could pass validatePublicUrl() even though they refer to private or loopback addresses.

Fedify uses validatePublicUrl() when fetching remote ActivityPub documents and related resources. An attacker who can make a Fedify server fetch an attacker-controlled URL may be able to bypass the private address checks that are intended to reduce SSRF risk.

All versions up to and including 2.2.0 are affected. Patched releases are 1.9.10, 1.10.9, 2.0.16, 2.1.12, and 2.2.1.

For Fedify 1.x, update @fedify/fedify:

npm update @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update @fedify/fedify
bun update @fedify/fedify
deno update @fedify/fedify

For Fedify 2.x, update both @fedify/fedify and @fedify/vocab-runtime:

npm update @fedify/fedify @fedify/vocab-runtime
yarn upgrade @fedify/fedify @fedify/vocab-runtime
pnpm update @fedify/fedify @fedify/vocab-runtime
bun update @fedify/fedify @fedify/vocab-runtime
deno update @fedify/fedify @fedify/vocab-runtime

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to Changkyun Kim (@me) for the report and responsible disclosure.

If anything is unclear, ask below.

Fedify 2.2.0 is out! This release finally adds client-to-server (C2S) outbox listener support, proper HTTP 410 Gone responses for deleted actors via Tombstone, new integrations for SolidStart and Nuxt, and interoperability fixes for Lemmy and Pixelfed. Three new end-to-end tutorials also landed alongside a custom collections cookbook.

https://github.com/fedify-dev/fedify/discussions/733

Building a threadiverse community platform by @hongminhee https://lobste.rs/s/gbgfec #distributed #web
https://fedify.dev/tutorial/threadiverse

Fedify 2.2.0 is out! This release finally adds client-to-server (C2S) outbox listener support, proper HTTP 410 Gone responses for deleted actors via Tombstone, new integrations for SolidStart and Nuxt, and interoperability fixes for Lemmy and Pixelfed. Three new end-to-end tutorials also landed alongside a custom collections cookbook.

https://github.com/fedify-dev/fedify/discussions/733

Unless something comes up, #Fedify 2.2.0 will be released today.

If you'd like to preview the #tutorial I'm writing on building a small federated image sharing service, similar to @pixelfed, with @fedify and @nuxt, here it is:

https://pr-731-0.fedify.pages.dev/tutorial/content-sharing

If you'd like to give feedback after reading it, please leave a comment on the following PR:

https://github.com/fedify-dev/fedify/pull/731

#Fedify #fedidev #ActivityPub #Nuxt #Pixelfed

If you'd like to preview the #tutorial I'm writing on building a small #threadiverse software with #Fedify, here it is:

https://pr-710.fedify.pages.dev/tutorial/threadiverse

If you'd like to give feedback after reading it, please leave a comment on the following PR:

https://github.com/fedify-dev/fedify/pull/710

The official Awesome Fedify site is now live:

http://awesome.fedify.dev/

It brings together real-world Fedify projects, packages, examples, tutorials, and talks in one place.

If you know a good resource we should list, contributions are welcome:

https://github.com/fedify-dev/awesome-fedify

We're working on a new #tutorial for #Fedify: Building a Federated Blog with Astro!

It walks you through creating a hybrid blog—static Markdown posts powered by #Astro content collections, with #ActivityPub federation layered on top. By the end, your blog will be followable from Mastodon, send Create/Update/Delete activities when you publish or edit posts, and display #fediverse replies as comments.

Preview the draft here: https://d180af62.fedify.pages.dev/tutorial/astro-blog.

We'd love your feedback—especially if you spot anything incorrect, unclear, or missing. Please leave comments on the GitHub PR #695 or issue #691.

#fedidev

Naru, the Korean version of #Neocities, reportedly added an #ActivityPub implementation in just an hour using #Fedify. If you also want to implement ActivityPub quickly, give Fedify a try!

https://hackers.pub/@jihyeok/019da3d9-45b8-7629-96a8-b26bd62867c2

Naru (Korean Neocities) gains ActivityPub support thanks to Fedify!

Now, you can follow Naru personal homepages on the Fediverse, and receive updates at most once a day per website. For example, if you want to receive updates for https://yang.naru.pub, you can simply folllow @yang@naru.pub.

I believe this is a significant improvement over polling websites and an effective way to stay connected with the indie web community.

Fedify ActivityPub server framework

A #TypeScript library for building federated server apps powered by #ActivityPub and other standards, so-called #fediverse

https://fedify.dev

Significant performance improvements are expected in today's latest Fedify patch releases (v1.9.9, v1.10.8, v2.0.12, and v2.1.5).

Fedify security updates: 1.9.7, 1.10.6, 2.0.10, and 2.1.3

If you use Fedify, update to a patched release now. A high-severity denial-of-service vulnerability (CVE-2026-34148) affects Fedify's remote document loader and authenticated document loader. Both follow HTTP redirects without a redirect limit or loop detection. An attacker-controlled server can return a redirect loop for a keyId or actor URL fetch, causing a single inbound ActivityPub request to keep issuing outbound requests until the fetch times out.

All versions up to and including 2.1.0 are affected. Patched releases are 1.9.7, 1.10.6, 2.0.10, and 2.1.3. Update with your package manager:

npm update @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update @fedify/fedify
bun update @fedify/fedify
deno update @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to Abhinav Jaswal for the report and responsible disclosure. Disclosure was coordinated with Ghost so they had time to ship their update.

If anything is unclear, ask below.