Update Fedify packages to v2

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@fedify/cli (source)	1.10.8 → 2.2.1
@fedify/fedify (source)	1.10.8 → 2.2.1
@fedify/hono (source)	1.10.8 → 2.2.1
@fedify/redis (source)	1.10.8 → 2.2.1

---

Release Notes

fedify-dev/fedify (@​fedify/cli)

v2.2.1

Compare Source

Released on May 10, 2026.

@​fedify/vocab-runtime

• Fixed validatePublicUrl() allowing private IPv4 addresses encoded as
  IPv4-mapped IPv6 URL literals, such as http://[::ffff:7f00:1]/, which
  could bypass private network protections in remote document loading.

v2.2.0

Compare Source

Released on April 28, 2026.

@​fedify/fedify

• Shipped an Agent Skills bundle at skills/fedify/ and declared it in
  package.json through the agents.skills field. The skill teaches AI
  coding agents how to use Fedify inside a consumer's project (builder
  pattern, dispatchers, framework integrations, vocabulary, keys, queues
  and storage, observability, CLI, and common pitfalls). Projects that
  run a tool implementing the Agent Skills spec, such as skills-npm,
  will pick up the skill automatically from node_modules, keeping the
  guidance in sync with the installed Fedify version. [#​711, #​712]

• Added setOutboxListeners() and OutboxContext for handling
  client-to-server POST requests to actor outboxes. Outbox listeners use
  application-defined authorization through .authorize(), catch activity
  types with .on(), and require explicit delivery through
  ctx.sendActivity() or ctx.forwardActivity(). Fedify now also logs a
  runtime warning when an outbox listener returns without delivering the
  posted activity.
  [#​430, #​688]

• Allowed actor dispatchers to return Tombstone for deleted accounts.
  Fedify now serves those actor URIs as 410 Gone with the serialized
  tombstone body, and the corresponding WebFinger lookups also return
  410 Gone instead of pretending the account was never handled.
  Added a RequestContext.getActor() overload that can return those
  tombstones to application code when called with
  { tombstone: "passthrough" }.
  [#​644, #​680]

• Added DoubleKnockOptions.maxRedirection to configure the maximum number
  of redirects followed by doubleKnock().
  getAuthenticatedDocumentLoader() now also respects
  GetAuthenticatedDocumentLoaderOptions.maxRedirection.

• Improved interoperability with threadiverse software by serializing the
  public audience as the full https://www.w3.org/ns/activitystreams#Public
  URI in outgoing activities' to, cc, bto, bcc, and audience
  fields, instead of the compacted as:Public or Public CURIEs that
  JSON-LD compaction would otherwise produce. Some ActivityPub
  implementations, Lemmy included, match those fields as plain URLs
  without JSON-LD expansion and would silently drop activities carrying
  the CURIE form; see LemmyNet/lemmy#6465. The rewrite is gated on a
  URDNA2015 canonical-form equivalence check, so an application-defined
  @context that redefines the as: prefix or the bare Public term
  is preserved as is. The rewrite is also applied before
  eddsa-jcs-2022 Object Integrity Proof signing so the signed bytes
  match what is sent on the wire. [#​710, #​721]

• Improved interoperability with Pixelfed by serializing outgoing
  activities' attachment fields as arrays even when there is only one
  attachment. JSON-LD compaction would otherwise emit a scalar value for
  single attachments, but Pixelfed currently expects an array and may reject
  incoming posts; see pixelfed/pixelfed#6588. [#​721]

@​fedify/lint

• Added the outbox-listener-delivery-required rule. It warns when an
  outbox listener registered through setOutboxListeners() returns without an
  explicit delivery call, which would otherwise leave a posted client
  activity unfederated. [#​430, #​688]

@​fedify/testing

• Added createOutboxContext() plus postOutboxActivity() and mock
  setOutboxListeners() support so outbox listeners using either
  sendActivity() or forwardActivity() can be tested without spinning up
  a live federation server. [#​430, #​688]

@​fedify/vocab-runtime

• Added DocumentLoaderFactoryOptions.maxRedirection to configure the
  maximum number of redirects followed by getDocumentLoader().

@​fedify/vocab

• Added Tombstone.formerType plus generated entity type helpers for deleted
  vocabulary objects. Applications can now construct tombstones with Fedify
  entity classes such as Person, and @fedify/vocab now exports
  $EntityType, isEntityType(), and getEntityTypeById() for working with
  those references. Unknown remote formerType values are ignored with a
  warning instead of making the whole tombstone fail to parse.
  [#​645, #​681]

• Added FEP-044f vocabulary support for Mastodon-style quote posts.
  [#​452, #​679]

  • Added QuoteRequest and QuoteAuthorization classes.
  • Added canQuote to InteractionPolicy.
  • Added quote and quoteAuthorization properties to Article,
    ChatMessage, Note, and Question.

• Added vocabulary types for FEP-0837, economic resource coordination
  in federated networks. [#​578 by Samuel Brinkmann]

  • Added Proposal class for publishing offers or requests.
  • Added Intent class for describing economic transactions within
    a proposal, with action, resourceConformsTo, resourceQuantity,
    availableQuantity, and minimumQuantity properties.
  • Added Measure class for representing quantities with units of
    measure, with unit and numericalValue properties.

@​fedify/vocab-tools

• Added the fedify:vocabEntityType pseudo-scalar to the vocabulary
  generator. Vocabulary properties can now accept generated Fedify entity
  constructors instead of arbitrary IRIs when the schema wants a reference to
  a known vocabulary type. Generated code now also emits the supporting
  $EntityType, isEntityType(), and getEntityTypeById() helpers for
  working with those references. [#​645, #​681]

@​fedify/cli

• Made fedify lookup --recurse honor -p/--allow-private-address
  for recursively discovered object URLs, matching the policy already used
  by -t/--traverse. Recursive lookups still reject private or
  localhost targets by default unless users explicitly opt in.
  [#​700, #​718]

• Added FEP-044f quote support to fedify lookup --recurse, so the CLI
  can follow both the new quote-post relation and the older quoteUrl
  compatibility surface. [#​452, #​679]

@​fedify/solidstart

• Added @fedify/solidstart package for integrating Fedify with
  SolidStart. It provides fedifyMiddleware() for request handling
  with SolidStart's middleware system.
  [#​476, #​601 by Hyeonseo Kim and #​652 by ChanHaeng Lee]

@​fedify/nuxt

• Added @fedify/nuxt package for integrating Fedify with Nuxt.
  It provides a Nuxt module that delegates non-federation requests to Nuxt,
  supports shared-route content negotiation, and returns deferred
  406 Not Acceptable when Fedify routes are requested without
  ActivityPub-compatible Accept headers and Nuxt has no matching page.
  [#​149, #​674 by ChanHaeng Lee]

@​fedify/init

• Added a --allow-non-empty option to fedify init for automated
  scaffolding in directories that already contain unrelated files. The
  command still fails before making changes if any file that Fedify would
  generate already exists, avoiding accidental merges or appends.
  [#​716, #​717]

• Fixed fedify init so that a directory containing only a freshly
  initialized Git repository is treated as empty. Directories whose Git
  HEAD already resolves to a commit, whose Git metadata contains loose or
  packed refs, stored objects, an index, or reflogs, or that contain any
  files besides .git, still require the existing non-empty-directory
  confirmation. [#​716, #​717]

• Fixed generated biome.json files to use Biome 2 configuration syntax,
  matching the @biomejs/biome version that fedify init installs.
  Generated projects now enable import organization through Biome's
  assist.actions.source.organizeImports setting instead of the removed
  top-level organizeImports option. [#​716, #​717]

• Fixed errors when using fedify init with certain web framework
  integration packages (Astro, ElysiaJS, Nitro) alongside @fedify/mysql.
  Environment variables are now properly loaded at runtime, resolving the
  TypeError: Cannot read properties of undefined from mysql2.
  [#​649, #​656 by ChanHaeng Lee]

• Supported Nuxt as a web framework option in fedify init, with
  templates for federation setup, logging, and Nitro middleware.
  [#​149, #​675 by ChanHaeng Lee]

Docs

• Added a per-page Markdown action to the docs site so readers can open or
  copy the LLM-friendly Markdown for the current page without guessing the
  generated *.md path or starting from llms.txt. The action is now
  available directly from each documentation page while llms.txt and
  llms-full.txt continue to exclude high-noise pages such as the changelog,
  contribution guide, README.md, and sponsors page. [#​706, #​715]

• Added Building a federated blog tutorial showing how to layer
  ActivityPub federation onto an Astro + Bun blog: actor setup,
  follower management, SQLite persistence, sending Create/Update/
  Delete(Article) activities on server startup, and receiving
  Create/Update/Delete(Note) inbox activities as comments.
  [#​691, #​695]

• Added a new tutorial, Building a threadiverse community platform, that
  walks through building a Lemmy-style community server with Fedify and
  Next.js. Where the existing Creating your own federated microblog
  tutorial is actor- and timeline-centric, this one is community-centric: it
  models communities as Group actors, threads as Page objects wrapped in
  Create, replies as Note objects, and the community-side Announce
  redistribution that threadiverse software (Lemmy, Mbin, NodeBB) uses to fan
  activity out to every subscriber. [#​704, #​710]

• Added Creating an image sharing service tutorial, a Pixelfed-style
  image-sharing companion to the microblog walk-through. Built on Nuxt 4
  and the new @fedify/nuxt integration, the tutorial covers actor
  dispatchers, key pairs, follow/unfollow flows, image-bearing
  Create(Note) fan-out and reception, an outbound Like/Undo(Like)
  heart toggle, and threaded comments through inReplyTo. The
  companion example repository keeps one commit per chapter at the
  bottom of its log, with a few rehearsal-driven follow-ups landed on top,
  and the federation flows are demonstrated against both Mastodon and
  Pixelfed. [#​693]

• Added a custom collections cookbook example for bookmark-like data,
  demonstrating cursor pagination, URI-template filtering, collection
  counters, actor stream links, and requester-aware collections using
  ctx.getSignedKeyOwner(). [#​694, #​722]

v2.1.12

Compare Source

Released on May 10, 2026.

@​fedify/vocab-runtime

• Fixed validatePublicUrl() allowing private IPv4 addresses encoded as
  IPv4-mapped IPv6 URL literals, such as http://[::ffff:7f00:1]/, which
  could bypass private network protections in remote document loading.

v2.1.11

Compare Source

Released on April 27, 2026.

@​fedify/init

• Fixed the Astro, Nitro, and Next.js project templates so their generated
  logging.ts files are loaded during server startup before Fedify handles
  requests. Nitro projects now get a server plugin that imports the LogTape
  configuration, Next.js projects get an instrumentation.ts register()
  hook that imports it in the Node.js runtime, and Astro projects import it
  in src/middleware.ts. [#​725, #​727]

v2.1.10

Compare Source

Released on April 23, 2026.

@​fedify/vocab-runtime

• Added https://join-lemmy.org/context.json to preloaded JSON-LD contexts.
  Lemmy serves this context as application/json without a JSON-LD context
  Link header, which caused the default document loader to reject
  Lemmy-originated activities before application handlers could run. [#​714]

v2.1.9

Compare Source

Released on April 22, 2026.

@​fedify/mysql

• Fixed a TypeScript type mismatch in MysqlKvStore and
  MysqlMessageQueue that could reject valid mysql2 pools when an
  application resolved mysql2 through multiple type sources or different
  package versions. The constructors now accept the structural pool shape
  they actually use, so mixed Deno/npm setups and monorepos no longer need
  casts or @ts-expect-error workarounds.

v2.1.8

Compare Source

Released on April 22, 2026.

@​fedify/init

• Fixed fedify init -w astro -p bun generating package.json scripts
  that invoked Astro through Node.js. Bun + Astro projects now use
  bunx --bun astro dev and bunx --bun astro build, so the generated
  development workflow runs on systems that only have Bun installed.

@​fedify/next

• Widened @fedify/next's supported Next.js peer dependency range to
  >=15.4.6 <17, so installing it into a fresh create-next-app 16.x
  project no longer fails with an ERESOLVE peer dependency conflict.
  This restores the default fedify init -w next flow against the current
  Next.js stable release and updates the integration example to track
  Next.js 16. [#​713]

v2.1.7

Compare Source

Released on April 21, 2026.

@​fedify/init

• Fixed fedify init generating Astro projects for Bun with the Node.js
  adapter and astro preview, which could fail to run correctly on Bun.
  Astro + Bun projects now use @​nurodev/astro-bun and run the built
  Bun server entry point instead. [#​707]

v2.1.6

Compare Source

Released on April 20, 2026.

@​fedify/astro

• Restored the npm entrypoint contract for @fedify/astro by making the
  build emit dist/*.js and dist/*.d.ts files that match the published
  package metadata again. This fixes package resolution failures caused by
  package.json exporting files that did not exist in the npm tarball.
  [#​699, #​701]

@​fedify/cli

• Fixed fedify lookup failing to look up URLs on private or localhost
  addresses unless -p/--allow-private-address was passed, which was a
  regression introduced in Fedify 2.1.0 when the CLI began forwarding
  the allowPrivateAddress option to the underlying document loader.
  URLs explicitly provided on the command line now always allow private
  addresses, while URLs discovered during -t/--traverse honor the
  option to mitigate SSRF attacks against private addresses. Recursive
  fetches via --recurse continue to always disallow private
  addresses regardless of the option. [#​696, #​698 by Chanhaeng Lee]

v2.1.5

Compare Source

Released on April 8, 2026.

@​fedify/fedify

• Fixed Context.getActorKeyPairs() assigning the same key ID to both
  the CryptographicKey (used for HTTP Signatures and Linked Data
  Signatures) and the Multikey (used for Object Integrity Proofs) within
  an ActorKeyPair. The Multikey now receives a distinct ID
  (#multikey-1, #multikey-2, …) so that the actor document no longer
  contains two objects sharing the same id, which was invalid JSON-LD.
  Object Integrity Proof signatures now reference the correct Multikey ID
  instead of the CryptographicKey ID. [#​663]

• Object Integrity Proofs signing now takes place before activity fanout,
  so all recipients receive the same pre-signed activity. Previously, OIP
  signing was deferred until after fanout, meaning each fanout worker would
  re-sign independently with potentially different timestamps and the fanout
  message itself contained an unsigned activity.

@​fedify/cfworkers

• Fixed a remaining TypeScript type mismatch for Cloudflare Workers users who
  pass wrangler types or @cloudflare/vite-plugin generated KV bindings to
  WorkersKvStore. The package now accepts a minimal structural KV binding
  interface for WorkersKvStore and WorkersMessageQueue's orderingKv
  option instead of requiring the nominal KVNamespace type imported from
  @cloudflare/workers-types, so generated local declarations compile
  without casts or @ts-expect-error. [#​665]

v2.1.4

Compare Source

Released on April 7, 2026.

@​fedify/fedify

• Fixed sendActivity() not awaiting fanoutQueue.enqueue() in the fanout
  path, which could cause fanout messages to be silently dropped on runtimes
  like Cloudflare Workers that may terminate an isolate as soon as the
  response is sent. [#​661]

@​fedify/cfworkers

• Fixed a TypeScript type mismatch that occurred when passing
  wrangler types-generated binding types (e.g. KVNamespace, Queue)
  to WorkersKvStore and WorkersMessageQueue constructors. The package
  previously imported these types from
  @cloudflare/workers-types/experimental, which includes extra members
  (such as KVNamespace.deleteBulk()) absent from types generated by
  wrangler types, causing TypeScript assignment errors at the call site.
  The import now uses the stable @cloudflare/workers-types entrypoint,
  whose definitions match what wrangler types generates. [#​662]

v2.1.3

Compare Source

Released on March 31, 2026.

@​fedify/init

• Restored the npm entrypoint contract for @fedify/init after the tsdown
  upgrade started publishing dist/*.mjs files while the package metadata
  still exported dist/*.js and dist/*.d.ts. Node consumers such as
  @fedify/cli can start again, including npx -y @​fedify/cli --help.
  [#​655]

@​fedify/create

• Restored the npm CLI entrypoint for @fedify/create so the published
  bin and exports paths once again point to generated dist/mod.js
  output instead of missing dist/mod.js files. This prevents the same
  packaging regression from breaking npm init @​fedify. [#​655]

v2.1.2

Compare Source

Released on March 29, 2026.

@​fedify/fedify

• Fixed CommonJS builds of @fedify/fedify/vocab missing the Object
  export from the entry point. Older tsdown output generated an invalid
  CommonJS re-export, causing require("@​fedify/fedify/vocab").Object to be
  undefined. Updated the bundler toolchain and added a regression test for
  the built CommonJs entry point. [#​651]

v2.1.1

Compare Source

Released on May 10, 2026.

@​fedify/vocab-runtime

• Fixed validatePublicUrl() allowing private IPv4 addresses encoded as
  IPv4-mapped IPv6 URL literals, such as http://[::ffff:7f00:1]/, which
  could bypass private network protections in remote document loading.

v2.1.0

Compare Source

Released on March 24, 2026.

@​fedify/fedify

• Added InboxListenerSetters.onUnverifiedActivity() so applications can
  inspect inbound activities whose signatures could not be verified and
  optionally return a custom response instead of the default
  401 Unauthorized. This is useful for cases like Delete deliveries
  from actors whose signing keys now return 404 Not Found or 410 Gone.
  Added the supporting public types UnverifiedActivityHandler and
  UnverifiedActivityReason. [#​472, #​611]

• Added verifyRequestDetailed() plus the public types
  VerifyRequestDetailedResult, VerifyRequestFailureReason, and
  FetchKeyErrorResult so applications can distinguish unsigned requests,
  invalid signatures, and key-fetch failures during HTTP signature
  verification. [#​611]

• OpenTelemetry spans/events and FedifySpanExporter signature details now
  expose HTTP signature failure reasons and key-fetch failure details for
  inbound activities. [#​611]

• Fixed RequestContext.getSignedKeyOwner() to return null instead of
  throwing an error when the remote server requires authorized fetch and
  returns 401 Unauthorized for the key owner lookup. Previously, this
  caused a 500 Internal Server Error when interoperating with servers like
  GoToSocial that have authorized fetch enabled. [#​473, #​589]

• Added RFC 9421 §5 Accept-Signature negotiation for both outbound and
  inbound paths. On the outbound side, doubleKnock() now parses
  Accept-Signature challenges from 401 responses and retries with a
  compatible RFC 9421 signature before falling back to legacy spec-swap.
  On the inbound side, a new InboxChallengePolicy option in
  FederationOptions enables emitting Accept-Signature headers on
  inbox 401 responses, with optional one-time nonce support for replay
  protection. [#​583, #​584, #​626 by ChanHaeng Lee]

@​fedify/vocab-runtime

• Added Decimal, a branded string type for exact xsd:decimal values,
  along with isDecimal(), canParseDecimal(), and parseDecimal() for
  checking and validating XML Schema decimal lexical forms without
  introducing a decimal arithmetic dependency. isDecimal() performs a
  strict lexical-form check, while canParseDecimal() and parseDecimal()
  apply XML Schema whitespace normalization first. This lays the runtime
  groundwork for precision-safe marketplace and measurement values such as
  those needed by [FEP-0837]. [#​617, #​640]

• Updated the preloaded https://gotosocial.org/ns JSON-LD context to
  match the current GoToSocial v0.21+ namespace, adding new type terms
  (LikeRequest, LikeAuthorization, etc.) and property terms
  (automaticApproval, manualApproval, interactingObject, etc.) while
  retaining deprecated terms (always, approvalRequired) for backward
  compatibility. [#​453, #​622]

• Added optional FetchError.response so callers can inspect the original
  failed HTTP response when remote document or key fetches return an HTTP
  error (such as 404 Not Found or 410 Gone). This enables higher-level
  APIs to distinguish transport failures from specific HTTP fetch failures.
  [#​611]

@​fedify/cli

• Added --reverse option to fedify lookup to reverse presentation order
  of emitted results. It now works across default multi-input lookup,
  --traverse collection traversal output, and --recurse object chains,
  while preserving existing fetch/error semantics. [#​607, #​609]

• Fixed fedify lookup printing separators with extra quotes between
  adjacent objects/items in some output paths (e.g., recurse/traverse
  flows). Separators are now printed as plain text consistently.
  [#​608]

• Added --recurse and --recurse-depth options to fedify lookup for
  recursively following object relationships (e.g., reply chains via
  replyTarget / inReplyTo, and quote chains via quoteUrl and quote
  IRIs). --traverse and --recurse are now mutually exclusive,
  --recurse-depth depends on --recurse, and --suppress-errors now
  works in recurse mode as best-effort lookup.
  [#​606, #​608]

• Hardened fedify lookup by disallowing private/localhost document loads
  by default. For local-development workflows, -p/--allow-private-address
  (or lookup.allowPrivateAddress = true in config) can re-enable private
  address access for explicit lookup/traverse requests. This option does
  not apply to recursive fetches, which always disallow private addresses.
  [#​608]

@​fedify/vocab

• Added GoToSocial interaction controls vocabulary for expressing who
  can like, reply to, or announce posts and for approving interactions.
  [#​453, #​622]

  • Added InteractionPolicy and InteractionRule typeless value
    classes.
  • Added LikeRequest, ReplyRequest, and AnnounceRequest activity
    types for requesting interaction approval.
  • Added LikeAuthorization, ReplyAuthorization, and
    AnnounceAuthorization types for proving approved interactions.
  • Added Object.interactionPolicy, Object.approvedBy,
    Object.getLikeAuthorization()/Object.likeAuthorizationId,
    Object.getReplyAuthorization()/Object.replyAuthorizationId, and
    Object.getAnnounceAuthorization()/Object.announceAuthorizationId.

• Fixed Endpoints.toJsonLd() to no longer emit invalid
  "type": "as:Endpoints" in the serialized JSON-LD. The as:Endpoints
  type does not exist in the ActivityStreams vocabulary, and its presence
  caused validation failures on implementations like browser.pub.
  [#​576]

• Fixed Source.toJsonLd() to no longer emit invalid
  "type": "as:Source" in the serialized JSON-LD. The as:Source type
  does not exist in the ActivityStreams vocabulary either.

@​fedify/vocab-tools

• Added xsd:decimal support to the vocabulary code generator. Properties
  with that range are now generated as Decimal in TypeScript, serialized
  as xsd:decimal JSON-LD literals, validated through
  canParseDecimal() when checking input data, and normalized through
  parseDecimal() when decoded. Code generation now also rejects property
  ranges that mix xsd:string and xsd:decimal, since both map to runtime
  strings and would make serialization ambiguous. [#​617, #​640]

• Added typeless field to the type YAML schema. When set to true,
  the generated toJsonLd() method does not emit @type (or type in
  compact form) in the serialized JSON-LD. This is useful for types
  that are not real vocabulary types but rather anonymous object structures.

@​fedify/init

• Changed fedify init to add "temporal" to deno.json's "unstable"
  field only when the installed Deno version is earlier than 2.7.0.
  On Deno 2.7.0 or later, it is no longer added.

• fedify init now omits the "unstable" field entirely when no unstable
  feature is required for the generated Deno project.

• Supported [Astro] as a web framework option in fedify init, with
  runtime-specific templates for Deno, Bun, and Node.js environments.
  [#​50 by ChanHaeng Lee]

@​fedify/astro

• Added @fedify/astro package for integrating Fedify with [Astro].
  It provides fedifyIntegration() for Vite SSR configuration and
  fedifyMiddleware() for request handling. [#​50 by Chanhaeng Lee]

@​fedify/mysql

• Added MysqlMessageQueue class to the @fedify/mysql package, a
  MySQL/MariaDB-backed MessageQueue implementation. It uses periodic
  polling (SELECT … FOR UPDATE SKIP LOCKED) to deliver messages and
  MySQL advisory locks (GET_LOCK/RELEASE_LOCK) for ordering-key
  serialization. Supports delayed delivery, ordering keys,
  enqueueMany(), and concurrent workers. Requires MySQL 8.0+ or
  MariaDB 10.6+. [#​586, #​599]

• Added @fedify/mysql package, a MySQL/MariaDB-backed KvStore
  implementation. It provides MysqlKvStore, which stores key–value
  pairs in a MySQL table using the mysql2 driver. Supports TTL,
  prefix listing, and compare-and-swap (cas()) operations.
  [#​585, #​597]

v2.0.16

Compare Source

Released on May 10, 2026.

@​fedify/vocab-runtime

• Fixed validatePublicUrl() allowing private IPv4 addresses encoded as
  IPv4-mapped IPv6 URL literals, such as http://[::ffff:7f00:1]/, which
  could bypass private network protections in remote document loading.

v2.0.15

Compare Source

Released on April 27, 2026.

@​fedify/init

• Fixed the Nitro and Next.js project templates so their generated
  logging.ts files are loaded during server startup. Nitro projects now
  get a server plugin that imports the LogTape configuration, and Next.js
  projects get an instrumentation.ts register() hook that imports it in
  the Node.js runtime before Fedify handles requests. [[#​725], [#​727]]

v2.0.14

Compare Source

Released on April 23, 2026.

@​fedify/vocab-runtime

• Added https://join-lemmy.org/context.json to preloaded JSON-LD contexts.
  Lemmy serves this context as application/json without a JSON-LD context
  Link header, which caused the default document loader to reject
  Lemmy-originated activities before application handlers could run. [[#​714]]

v2.0.13

Compare Source

Released on April 22, 2026.

@​fedify/next

• Widened @fedify/next's supported Next.js peer dependency range to
  >=15.4.6 <17, so installing it into a fresh create-next-app 16.x
  project no longer fails with an ERESOLVE peer dependency conflict.
  This restores the default fedify init -w next flow against the current
  Next.js stable release and updates the integration example to track
  Next.js 16. [[#​713]]

v2.0.12

Compare Source

Released on April 8, 2026.

@​fedify/fedify

• Fixed Context.getActorKeyPairs() assigning the same key ID to both
  the CryptographicKey (used for HTTP Signatures and Linked Data
  Signatures) and the Multikey (used for Object Integrity Proofs) within
  an ActorKeyPair. The Multikey now receives a distinct ID
  (#multikey-1, #multikey-2, …) so that the actor document no longer
  contains two objects sharing the same id, which was invalid JSON-LD.
  Object Integrity Proof signatures now reference the correct Multikey ID
  instead of the CryptographicKey ID. [[#​663]]

• Object Integrity Proofs signing now takes place before activity fanout,
  so all recipients receive the same pre-signed activity. Previously, OIP
  signing was deferred until after fanout, meaning each fanout worker would
  re-sign independently with potentially different timestamps and the fanout
  message itself contained an unsigned activity.

@​fedify/cfworkers

• Fixed a remaining TypeScript type mismatch for Cloudflare Workers users who
  pass wrangler types or @cloudflare/vite-plugin generated KV bindings to
  WorkersKvStore. The package now accepts a minimal structural KV binding
  interface for WorkersKvStore and WorkersMessageQueue's orderingKv
  option instead of requiring the nominal KVNamespace type imported from
  @cloudflare/workers-types, so generated local declarations compile
  without casts or @ts-expect-error. [[#​665]]

v2.0.11

Compare Source

Released on April 7, 2026.

@​fedify/fedify

• Fixed sendActivity() not awaiting fanoutQueue.enqueue() in the fanout
  path, which could cause fanout messages to be silently dropped on runtimes
  like Cloudflare Workers that may terminate an isolate as soon as the
  response is sent. [[#​661]]

@​fedify/cfworkers

• Fixed a TypeScript type mismatch that occurred when passing
  wrangler types-generated binding types (e.g. KVNamespace, Queue)
  to WorkersKvStore and WorkersMessageQueue constructors. The package
  previously imported these types from
  @cloudflare/workers-types/experimental, which includes extra members
  (such as KVNamespace.deleteBulk()) absent from types generated by
  wrangler types, causing TypeScript assignment errors at the call site.
  The import now uses the stable @cloudflare/workers-types entrypoint,
  whose definitions match what wrangler types generates. [[#​662]]

v2.0.10

Compare Source

Released on March 31, 2026.

@​fedify/lint

• Fixed the published ESM output paths for @fedify/lint so the package
  exports and type declarations point to the actual files generated by
  tsdown. This restores imports such as
  import fedifyLint from "@​fedify/lint" in documentation examples and other
  TypeScript consumers.

@​fedify/init

• Restored the npm entrypoint contract for @fedify/init after the tsdown
  upgrade started publishing dist/*.mjs files while the package metadata
  still exported dist/*.js and dist/*.d.ts. Node consumers such as
  @fedify/cli can start again, including npx -y @​fedify/cli --help.
  [[#​655]]

@​fedify/create

• Restored the npm CLI entrypoint for @fedify/create so the published
  bin and exports paths once again point to generated dist/mod.js
  output instead of missing dist/mod.js files. This prevents the same
  packaging regression from breaking npm init @​fedify. [[#​655]]

v2.0.9

Compare Source

Released on March 29, 2026.

@​fedify/fedify

• Fixed CommonJS builds of @fedify/fedify/vocab missing the Object
  export from the entry point. Older tsdown output generated an invalid
  CommonJS re-export, causing require("@​fedify/fedify/vocab").Object to be
  undefined. Updated the bundler toolchain and added a regression test for
  the built CommonJs entry point. [[#​651]]

v2.0.8

Compare Source

Released on March 27, 2026.

@​fedify/fedify

• Limited the number of HTTP redirects followed by the remote document
  loaders and signed HTTP fetches to mitigate resource exhaustion during
  remote key and document resolution. [[CVE-2026-34148] by Abhinav Jaswal]

• Stopped the remote document loaders and signed HTTP fetches from
  revisiting the same URL within a redirect chain, preventing
  self-referential redirect loops. [[CVE-2026-34148] by Abhinav Jaswal]

• Persisted negative public key cache entries for failed remote key
  fetches, reducing repeated retries against the same unavailable key
  across requests. [[CVE-2026-34148] by Abhinav Jaswal]

v2.0.7

Compare Source

Released on March 22, 2026.

@​fedify/fedify

• Switched Fedify's source-based JSON-LD loading to the new
  @fedify/vocab-runtime/jsonld subpath so generated vocabulary code and
  Linked Data signature support no longer have to evaluate jsonld through
  a CommonJS-sensitive package root in Fresh 2, Deno, and other ESM-first
  runtimes. Fresh 2 development mode has been verified on Deno 2.7.7
  after an upstream Deno 2.7.6 dev server regression was fixed.
  [#​621, #​639]

@​fedify/vocab-runtime

• Fixed multibase public key handling to stop relying on the deprecated
  CommonJS-only multicodec package. This removes the Vite SSR crash that
  prevented Fresh 2 applications from importing @fedify/fedify with
  TypeError: varint.encode is not a function. Fresh 2 no longer needs a
  Vite externalization workaround for Fedify. [#​621, #​639]

• Added the new @fedify/vocab-runtime/jsonld subpath export so generated
  vocabulary code and other Fedify runtime code can share a JSR-safe wrapper
  around jsonld's ESM entrypoint instead of depending on fragile relative
  shims or the package-root import path. [#​621, #​639]

@​fedify/init

• Revived removed fedify init options. [#​632, #​638 by ChanHaeng Lee]
  • bare-bones option for web framework.
  • in-memory option for key-value store.
  • in-process option for message queue.

v2.0.6

Compare Source

Released on March 19, 2026.

@​fedify/init

• Fixed fedify init crashing when @fedify/cli or @fedify/init is
  executed through the JSR/Deno distribution. import.meta.dirname is
  undefined for remote JSR modules, so the template loading and
  repository-relative path logic has been made safe for published JSR
  execution. [#​624, #​633]

@​fedify/vocab-runtime

• Added http://joinmastodon.org/ns to preloaded JSON-LD contexts.
  This URL has never served a real JSON-LD context document (Mastodon
  has always inlined the term definitions), but some ActivityPub
  implementations put it as a bare URL in their @context, causing
  JSON-LD processors to fail with a 404. [#​630, #​631]

v2.0.5

Compare Source

Released on March 11, 2026.

@​fedify/fedify

• Added https://w3id.org/security/data-integrity/v2 to preloaded JSON-LD
  contexts.

v2.0.4

Compare Source

Released on March 11, 2026.

@​fedify/fastify

• Fixed the default onNotAcceptable handler in @fedify/fastify to
  create a fresh Response for each request instead of reusing a shared
  singleton instance. [#​612 by Lee Dogeon]

v2.0.3

Compare Source

Released on March 3, 2026.

@​fedify/postgres

• Fixed PostgresMessageQueue.listen() crashing the process when a
  malformed NOTIFY payload is received. Temporal.Duration.from()
  was called without error handling, so an invalid duration string
  caused an unhandled RangeError that propagated through the postgres
  driver. The NOTIFY callback is now wrapped in a try–catch that
  logs the error and falls back to an immediate poll. [#​594]

• Fixed PostgresMessageQueue.listen() permanently stalling all message
  processing when a message handler hangs indefinitely (e.g., due to an
  unresponsive remote server). The serializedPoll mechanism chains
  every poll() invocation onto a single promise, so a single hung
  handler blocked the entire queue permanently. Handler invocations
  are now wrapped with a configurable timeout (default: 60 seconds)
  via the new handlerTimeout option in PostgresMessageQueueOptions.
  When a handler exceeds the timeout, it is treated as an error and the
  poll loop moves on, preventing permanent stalls. [#​595]

v2.0.2

Compare Source

Released on February 27, 2026.

@​fedify/fedify

• Removed the deprecated third and fourth parameters (signedKey and
  signedKeyOwner) from AuthorizePredicate and
  ObjectAuthorizePredicate. These parameters were deprecated since
  Fedify 1.5.0 in favor of RequestContext.getSignedKey() and
  RequestContext.getSignedKeyOwner() methods, but were mistakenly
  left in the Fedify 2.0.0 release. The internal handler code that
  eagerly called getSignedKey() and getSignedKeyOwner() before
  invoking the predicate has also been removed; predicates should now
  call those methods themselves when needed. [[#​473], #​590]

v2.0.1

Compare Source

Released on May 10, 2026.

@​fedify/vocab-runtime

• Fixed validatePublicUrl() allowing private IPv4 addresses encoded as
  IPv4-mapped IPv6 URL literals, such as http://[::ffff:7f00:1]/, which
  could bypass private network protections in remote document loading.

v2.0.0

Compare Source

Released on February 22, 2026.

@​fedify/fedify

• Remove contextLoader option (which was deprecated) from
  FederationOptions interface in favor of contextLoaderFactory option
  for better flexibility. [[#​376], [#​445] by Hasang Cho]

• Migrated from @​phensley/language-tag package and its LanguageTag cla

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Between 07:00 AM and 04:59 PM, only on Monday, Tuesday, Wednesday, and Thursday (* 7-16 * * 1,2,3,4)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.