Fedify changelog ================ Version 1.5.0 ------------- Released on March 28, 2025. - Improved activity delivery performance with large audiences through a two-stage queuing system. Sending activities to many recipients (e.g., accounts with many followers) is now significantly faster and uses less memory. [[#220]] - Added `FederationQueueOptions.fanout` option. - Changed the type of `FederationStartQueueOptions.queue` option to `"inbox" | "outbox" | "fanout" | undefined` (was `"inbox" | "outbox" | undefined`). - Added `SendActivityOptions.fanout` option. - Added OpenTelemetry instrumented span `activitypub.fanout`. - The `ForwardActivityOptions` interface became a type alias of `Omit & { skipIfUnsigned: boolean }`, which is still compatible with the previous version. - A `Federation` object now can have a canonical origin for web URLs and a canonical host for fediverse handles. This affects the URLs constructed by `Context` objects, and the WebFinger responses. - Added `CreateFederationOptions.origin` option. - Added `FederationOrigin` interface. - Added `Context.canonicalOrigin` property. - Followers collection synchronization ([FEP-8fcf]) is now turned off by default. - Added `SendActivityOptionsForCollection` interface. - The type of `Context.sendActivity({ identifier: string } | { username: string } | { handle: string }, "followers", Activity)` overload's fourth parameter became `SendActivityOptionsForCollection | undefined` (was `SendActivityOptions | undefined`). - Fedify now accepts PEM-PKCS#1 besides PEM-SPKI for RSA public keys. [[#209]] - `CryptographicKey` now can contain a `publicKey` with a PEM-PKCS#1 format (in addition to PEM-SPKI). - Added `importPkcs1()` function. - Added `importPem()` function. - The `fetchKey()` function became to choose the public key of the actor if `keyId` has no fragment and the actor has only one public key. [[#211]] - Added an optional parameter with `GetSignedKeyOptions` type to the `RequestContext.getSignedKey()` method. - Added `GetSignedKeyOptions` interface. - Added an optional parameter with `GetKeyOwnerOptions` type to the `RequestContext.getSignedKeyOwner()` method. - Deprecated the parameters of the `AuthorizePredicate` and `ObjectAuthorizePredicate` types to get the signed key and its owner in favor of the `RequestContext.getSignedKey()` and `RequestContext.getSignedKeyOwner()` methods. - Deprecated the third parameter of the `AuthorizePredicate` type in favor of the `RequestContext.getSignedKey()` method. - Deprecated the fourth parameter of the `AuthorizePredicate` type in favor of the `RequestContext.getSignedKeyOwner()` method. - Deprecated the third parameter of the `ObjectAuthorizePredicate` type in favor of the `RequestContext.getSignedKey()` method. - Deprecated the fourth parameter of the `ObjectAuthorizePredicate` type in favor of the `RequestContext.getSignedKeyOwner()` method. - Added an optional method `enqueueMany()` to `MessageQueue` interface for sending multiple activities at once. - Updated *@js-temporal/polyfill* to 0.5.0 for Node.js and Bun. On Deno, there is no change because the polyfill is not used. - Updated *uri-template-router* to 0.0.17 which fixes bundler errors on Rollup. [[#221]] - Improved error handling and logging for document loader when KV store operations fail. [[#223] by Revath S Kumar] - Fixed a bug of the `fedify inbox` command where it had failed to render the web interface when the `fedify` command was installed using `deno install` command from JSR. - The web interface of the `fedify inbox` command was slightly redesigned: - The Fedify logo with the cute dinosaur is now displayed at the top of the page. - You can easily copy the fediverse handle of the ephemeral actor. - Internalized the [multibase] package, which is obsolete and no longer maintained. [[#127], [#215] by Fróði Karlsson] - Added more log messages using the [LogTape] library. Currently the below logger categories are used: - `["fedify", "federation", "fanout"]` - `["fedify", "federation", "object"]` [#127]: https://github.com/fedify-dev/fedify/issues/127 [#209]: https://github.com/fedify-dev/fedify/issues/209 [#211]: https://github.com/fedify-dev/fedify/issues/211 [#215]: https://github.com/fedify-dev/fedify/pull/215 [#220]: https://github.com/fedify-dev/fedify/issues/220 [#221]: https://github.com/fedify-dev/fedify/issues/221 [#223]: https://github.com/fedify-dev/fedify/pull/223 [FEP-8fcf]: https://w3id.org/fep/8fcf [multibase]: https://github.com/multiformats/js-multibase Version 1.4.9 ------------- Released on March 26, 2025. - Fixed a `TypeError` thrown by the followers collection dispatcher when the `base-url` parameter was provided. - Fixed a `TypeError` thrown by the `signRequest()` function on Node.js. [[#222]] Version 1.4.8 ------------- Released on March 26, 2025. - Fixed a bug where the `totalItems` property of `OrderedCollection` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. - Fixed a bug where the `id` property of `OrderedCollection` and `OrderedCollectionPage` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. Version 1.4.7 ------------- Released on March 20, 2025. - Fixed a bug of WebFinger handler where it had failed to match `acct:` URIs with a host having a port number. [[#218], [#219] by Revath S Kumar] - Fixed a server error thrown when an invalid URL was passed to the `base-url` parameter of the followers collection. [[#217]] Version 1.4.6 ------------- Released on March 9, 2025. - Fedify no more depends on `node:punycode` module, which is deprecated in Node.js. Now it uses the built-in `node:url` module instead. [[#212], [#214] by Fróði Karlsson] Version 1.4.5 ------------- Released on February 28, 2025. - Made `fedify init` to install *@fedify/h3* 0.1.2 which is compatible with Fedify 1.0.0 or later versions when `--web-framework nitro` option is provided. [[#213]] - Fixed a bug where `fedify init` had failed to initialize a project with the `--runtime node --package-manager pnpm --web-framework nitro` option. [[#213]] Version 1.4.4 ------------- Released on February 25, 2025. - Added the following default context to `Application`, `Group`, `Organization`, `Person`, and `Service` classes: ~~~~ json { "Emoji": "http://joinmastodon.org/ns#Emoji" } ~~~~ Version 1.4.3 ------------- Released on February 22, 2025. - Added the following default contexts to `Follow`, `Undo`, and `Update` classes: - - - Version 1.4.2 ------------- Released on February 19, 2025. - Fixed a bug where the `fedify init` command had failed to locate package managers on Windows. [[#210]] - The `fedify` command became aware of `FEDIFY_LOG_FILE` environment variable to log messages to a file. If the variable is set, the command logs messages to the file specified by the variable. Version 1.4.1 ------------- Released on February 10, 2025. - Fixed a bug with nested object hydration in Activity Vocabulary API where deeply nested properties (like `Object.getAttribution()` on `Activity.getObject()`) were't being properly hydrated during `toJsonLd()` calls. Previously, subsequent calls to `toJsonLd()` on nested objects could result in inconsistent JSON-LD output where nested objects remained as URLs instead of being fully expanded. Version 1.4.0 ------------- Released on February 5, 2025. - Document loader and context loader are now configurable with a factory function for more flexibility. - Deprecated `CreateFederationOptions.documentLoader` option. Use `CreateFederationOptions.documentLoaderFactory` option instead. - Deprecated `CreateFederationOptions.contextLoader` option. Use `CreateFederationOptions.contextLoaderFactory` option instead. - Added `DocumentLoaderFactory` type. - Added `DocumentLoaderFactoryOptions` interface. - Added the second parameter with `DocumentLoaderFactoryOptions` type to `AuthenticatedDocumentLoaderFactory` type. - `GetAuthenticatedDocumentLoaderOptions` interface became to extend `DocumentLoaderFactoryOptions` interface. - Added a type parameter `TContextData` to `CreateFederationOptions` interface. - Fedify now assigns a random-generated *http:*/*https:* URI to activities if these do not have explicit `id` properties. This behavior can be disabled by excluding `autoIdAssigner()` from the `CreateFederationOptions.activityTransformers` option. - Introduced `ActivityTransformer`s for adjusting outgoing activities before sending them so that some ActivityPub implementations with quirks are satisfied. - Added `@fedify/fedify/compat` module. - Added `ActivityTransformer` type. - Added `autoIdAssigner()` function. - Added `actorDehydrator()` function. - Added `defaultActivityTransformers` constant. - Added `CreateFederationOptions.activityTransformers` option. - The `suppressError` option of Activity Vocabulary APIs, `traverseCollection()` function, and `Context.traverseCollection()` method now suppresses errors occurred JSON-LD processing. - WebFinger responses are now customizable. [[#3]] - Added `ActorCallbackSetters.mapAlias()` method. - Added `ActorAliasMapper` type. - Added `Context.getNodeInfo()` method. [[#203]] - Added `shares` property to `Object` class in Activity Vocabulary API. - Added `Object.sharesId` property. - Added `Object.getShares()` method. - `new Object()` constructor now accepts `shares` option. - `Object.clone()` method now accepts `shares` option. - Added `likes` property to `Object` class in Activity Vocabulary API. - Added `Object.likesId` property. - Added `Object.getLikes()` method. - `new Object()` constructor now accepts `likes` option. - `Object.clone()` method now accepts `likes` option. - Added `emojiReactions` property to `Object` class in Activity Vocabulary API. - Added `Object.emojiReactionsId` property - Added `Object.getEmojiReactions()` method. - `new Object()` constructor now accepts `emojiReactions` option. - `Object.clone()` method now accepts `emojiReactions` option. - Added `allowPrivateAddress` option to `LookupWebFingerOptions` interface. - Added more log messages using the [LogTape] library. Currently the below logger categories are used: - `["fedify", "compat", "transformers"]` - Added `-t`/`--traverse` option to the `fedify lookup` subcommand. [[#195]] - Added `-S`/`--suppress-errors` option to the `fedify lookup` subcommand. [[#195]] [#3]: https://github.com/fedify-dev/fedify/issues/3 [#195]: https://github.com/fedify-dev/fedify/issues/195 Version 1.3.16 -------------- Released on March 26, 2025. - Fixed a `TypeError` thrown by the followers collection dispatcher when the `base-url` parameter was provided. - Fixed a `TypeError` thrown by the `signRequest()` function on Node.js. [[#222]] Version 1.3.15 -------------- Released on March 26, 2025. - Fixed a bug where the `totalItems` property of `OrderedCollection` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. - Fixed a bug where the `id` property of `OrderedCollection` and `OrderedCollectionPage` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. Version 1.3.14 -------------- Released on March 20, 2025. - Fixed a bug of WebFinger handler where it had failed to match `acct:` URIs with a host having a port number. [[#218], [#219] by Revath S Kumar] - Fixed a server error thrown when an invalid URL was passed to the `base-url` parameter of the followers collection. [[#217]] Version 1.3.13 -------------- Released on March 9, 2025. - Fedify no more depends on `node:punycode` module, which is deprecated in Node.js. Now it uses the built-in `node:url` module instead. [[#212], [#214] by Fróði Karlsson] Version 1.3.12 -------------- Released on February 28, 2025. - Made `fedify init` to install *@fedify/h3* 0.1.2 which is compatible with Fedify 1.0.0 or later versions when `--web-framework nitro` option is provided. [[#213]] - Fixed a bug where `fedify init` had failed to initialize a project with the `--runtime node --package-manager pnpm --web-framework nitro` option. [[#213]] Version 1.3.11 -------------- Released on February 25, 2025. - Added the following default context to `Application`, `Group`, `Organization`, `Person`, and `Service` classes: ~~~~ json { "Emoji": "http://joinmastodon.org/ns#Emoji" } ~~~~ Version 1.3.10 -------------- Released on February 22, 2025. - Added the following default contexts to `Follow`, `Undo`, and `Update` classes: - - - Version 1.3.9 ------------- Released on February 19, 2025. - Fixed a bug where the `fedify init` command had failed to locate package managers on Windows. [[#210]] - The `fedify` command became aware of `FEDIFY_LOG_FILE` environment variable to log messages to a file. If the variable is set, the command logs messages to the file specified by the variable. Version 1.3.8 ------------- Released on February 10, 2025. - Fixed a bug with nested object hydration in Activity Vocabulary API where deeply nested properties (like `Object.getAttribution()` on `Activity.getObject()`) were't being properly hydrated during `toJsonLd()` calls. Previously, subsequent calls to `toJsonLd()` on nested objects could result in inconsistent JSON-LD output where nested objects remained as URLs instead of being fully expanded. Version 1.3.7 ------------- Released on February 1, 2025. - Updated [LogTape] to version 0.8.1, which fixes a bug where `lowestLevel` option had incorrectly behaved. Version 1.3.6 ------------- Released on January 31, 2025. - Fixed a bug where `getUserAgent()` function had returned a `User-Agent` string with a wrong JavaScript runtime name on Node.js. [[#203]] [#203]: https://github.com/fedify-dev/fedify/issues/203 Version 1.3.5 ------------- Released on January 21, 2025. - Fixed a bug where `CreateFederationOptions.allowPrivateAddress` option had been ignored by the `Context.lookupObject()` method when it had taken a fediverse handle. - The `lookupWebFinger()` function became to silently return `null` when it fails to fetch the WebFinger document due to accessing a private network address, instead of throwing a `UrlError`. Version 1.3.4 ------------- Released on January 21, 2025. - Fixed several security vulnerabilities of the `lookupWebFinger()` function. [[CVE-2025-23221]] - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the infinite number of redirects, which could lead to a denial of service attack. Now it follows up to 5 redirects. - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the redirects to other than the HTTP/HTTPS schemes, which could lead to a security breach. Now it follows only the same scheme as the original request. - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the redirects to the private network addresses, which could lead to a SSRF attack. Now it follows only the public network addresses. Version 1.3.3 ------------- Released on December 30, 2024. - The `fetchDocumentLoader()` function now preloads the following JSON-LD context: . Version 1.3.2 ------------- Released on December 18, 2024. - Fixed the default document loader to handle the `Link` header with incorrect syntax. [[#196]] Version 1.3.1 ------------- Released on December 11, 2024. - Fixed idempotence check in inbox listeners to ensure activities for different origins are processed correctly. Version 1.3.0 ------------- Released on November 30, 2024. - `MessageQueue`s now can be differently configured for incoming and outgoing activities. - Changed the type of `CreateFederationOptions.queue` option to `FederationQueueOptions | MessageQueue | undefined` (was `MessageQueue | undefined`). - Added `FederationQueueOptions` interface. - Added `FederationStartQueueOptions.queue` option. - Fedify now makes HTTP requests with the proper `User-Agent` header. [[#162]] - Added `getUserAgent()` function. - Added `GetUserAgentOptions` interface. - Added `getDocumentLoader()` function. - Added `GetDocumentLoaderOptions` interface. - The type of `getAuthenticatedDocumentLoader()` function's second parameter became `GetAuthenticatedDocumentLoaderOptions | undefined` (was `boolean | undefined`). - Added `GetAuthenticatedDocumentLoaderOptions` interface. - Deprecated `fetchDocumentLoader()` function. - Added `LookupObjectOptions.userAgent` option. - Added the type of `getActorHandle()` function's second parameter became `GetActorHandleOptions | undefined` (was `NormalizeActorHandleOptions | undefined`). - Added `GetActorHandleOptions` interface. - Added the optional second parameter to `lookupWebFinger()` function. - Added `LookupWebFingerOptions` interface. - Added `GetNodeInfoOptions.userAgent` option. - Added `-u`/`--user-agent` option to `fedify lookup` subcommand. - Added `-u`/`--user-agent` option to `fedify node` subcommand. - Fedify now caches unavailable keys of remote actors as well to avoid trying fetching the same unavailable key multiple times. - The return type of the `KeyCache.get()` method became `Promise` (was `Promise`). - The type of the `KeyCache.set()` method's second parameter became `CryptographicKey | MultiKey | null` (was `CryptographicKey | MultiKey`). - Added `fetchKey()` function. - Added `FetchKeyOptions` interface. - Added `FetchKeyResult` interface. - The `Router` now provide the matched route's URI template besides the name. - The return type of `Router.route()` method became `RouterRouteResult | null` (was `{ name: string; values: Record } | null`). - Added `RouterRouteResult` interface. - Added `getTypeId()` function. - `Context.sendActivity()` and `InboxContext.forwardActivity()` methods now reject when they fail to enqueue the task. [[#192]] - Fedify now allows you to manually route an `Activity` to the corresponding inbox listener. [[#193]] - Added `Context.routeActivity()` method. - Added `RouteActivityOptions` interface. - `Object.toJsonLd()` without any `format` option now returns its original JSON-LD object even if it not created from `Object.fromJsonLd()` but it is returned from another `Object`'s `get*()` method. - Fedify now supports OpenTelemetry for tracing. [[#170]] - Added `Context.tracerProvider` property. - Added `CreateFederationOptions.tracerProvider` option. - Added `LookupWebFingerOptions.tracerProvider` option. - Added `LookupObjectOptions.tracerProvider` option. - Added `GetActorHandleOptions.tracerProvider` option. - Added `VerifyRequestOptions.tracerProvider` option. - Added `SignRequestOptions` interface. - Added the optional fourth parameter to `signRequest()` function. - Added `VerifyProofOptions.tracerProvider` option. - Added `VerifyObjectOptions.tracerProvider` option. - Added `SignObjectOptions.tracerProvider` option. - Added `VerifySignatureOptions.tracerProvider` option. - Added `VerifyJsonLdOptions.tracerProvider` option. - Added `SignJsonLdOptions.tracerProvider` option. - Added `DoesActorOwnKeyOptions.tracerProvider` option. - Added `GetKeyOwnerOptions.tracerProvider` option. - Added `tracerProvider` option to the following Activity Vocabulary APIs: - The second parameters of constructors. - The second parameters of `fromJsonLd()` static methods. - The second parameters of `get*()` methods. - Added `@fedify/fedify/x/sveltekit` module for integrating with [SvelteKit] hook. [[#171], [#183] by Jiyu Park] - Added `fedifyHook()` function. - The scaffold project generated by `fedify init` command now enables tracing data into log messages. - Let the `fedify lookup` command take multiple arguments. [[#173], [#186] by PGD] [SvelteKit]: https://kit.svelte.dev/ [#162]: https://github.com/fedify-dev/fedify/issues/162 [#170]: https://github.com/fedify-dev/fedify/issues/170 [#171]: https://github.com/fedify-dev/fedify/issues/171 [#173]: https://github.com/fedify-dev/fedify/issues/173 [#183]: https://github.com/fedify-dev/fedify/pull/183 [#186]: https://github.com/fedify-dev/fedify/pull/186 [#192]: https://github.com/fedify-dev/fedify/issues/192 [#193]: https://github.com/fedify-dev/fedify/issues/193 Version 1.2.20 -------------- Released on March 26, 2025. - Fixed a `TypeError` thrown by the followers collection dispatcher when the `base-url` parameter was provided. - Fixed a `TypeError` thrown by the `signRequest()` function on Node.js. [[#222]] Version 1.2.19 -------------- Released on March 26, 2025. - Fixed a bug where the `totalItems` property of `OrderedCollection` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. - Fixed a bug where the `id` property of `OrderedCollection` and `OrderedCollectionPage` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. Version 1.2.18 -------------- Released on March 20, 2025. - Fixed a bug of WebFinger handler where it had failed to match `acct:` URIs with a host having a port number. [[#218], [#219] by Revath S Kumar] - Fixed a server error thrown when an invalid URL was passed to the `base-url` parameter of the followers collection. [[#217]] Version 1.2.17 -------------- Released on March 9, 2025. - Fedify no more depends on `node:punycode` module, which is deprecated in Node.js. Now it uses the built-in `node:url` module instead. [[#212], [#214] by Fróði Karlsson] Version 1.2.16 -------------- Released on February 28, 2025. - Made `fedify init` to install *@fedify/h3* 0.1.2 which is compatible with Fedify 1.0.0 or later versions when `--web-framework nitro` option is provided. [[#213]] - Fixed a bug where `fedify init` had failed to initialize a project with the `--runtime node --package-manager pnpm --web-framework nitro` option. [[#213]] - Made `fedify init` to install *@logtape/logtape* 0.7.2 which is the version used in Fedify 1.2.x. Version 1.2.15 -------------- Released on February 25, 2025. - Added the following default context to `Application`, `Group`, `Organization`, `Person`, and `Service` classes: ~~~~ json { "Emoji": "http://joinmastodon.org/ns#Emoji" } ~~~~ Version 1.2.14 -------------- Released on February 22, 2025. - Added the following default contexts to `Follow`, `Undo`, and `Update` classes: - - - Version 1.2.13 -------------- Released on February 19, 2025. - Fixed a bug where the `fedify init` command had failed to locate package managers on Windows. [[#210]] - The `fedify` command became aware of `FEDIFY_LOG_FILE` environment variable to log messages to a file. If the variable is set, the command logs messages to the file specified by the variable. Version 1.2.12 -------------- Released on February 10, 2025. - Fixed a bug with nested object hydration in Activity Vocabulary API where deeply nested properties (like `Object.getAttribution()` on `Activity.getObject()`) were't being properly hydrated during `toJsonLd()` calls. Previously, subsequent calls to `toJsonLd()` on nested objects could result in inconsistent JSON-LD output where nested objects remained as URLs instead of being fully expanded. Version 1.2.11 -------------- Released on January 21, 2025. - Fixed several security vulnerabilities of the `lookupWebFinger()` function. [[CVE-2025-23221]] - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the infinite number of redirects, which could lead to a denial of service attack. Now it follows up to 5 redirects. - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the redirects to other than the HTTP/HTTPS schemes, which could lead to a security breach. Now it follows only the same scheme as the original request. - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the redirects to the private network addresses, which could lead to a SSRF attack. Now it follows only the public network addresses. Version 1.2.10 -------------- Released on December 18, 2024. - Fixed the default document loader to handle the `Link` header with incorrect syntax. [[#196]] Version 1.2.9 ------------- Released on December 11, 2024. - Fixed idempotence check in inbox listeners to ensure activities for different origins are processed correctly. Version 1.2.8 ------------- Released on November 23, 2024. - Fixed warnings from the `fedify inbox` command. [[#177], [#181] by WinterHana] - Fixed `ShikiError` on the `fedify inbox` command rendering web interface. [[#178], [#185] by Heesun Jung] - Fixed text overflow of the `fedify inbox` command's web log view. [[#180], [#188] by Lim Kyunghee] [#177]: https://github.com/fedify-dev/fedify/issues/177 [#181]: https://github.com/fedify-dev/fedify/pull/181 Version 1.2.7 ------------- Released on November 22, 2024. - Fixed a bug where `lookupWebFinger()` function had thrown a `TypeError` when the *.well-known/webfinger* redirects to a relative URI. [[#166]] Version 1.2.6 ------------- Released on November 19, 2024. - Fix a bug where `Actor`'s `inbox` and `outbox` properties had not been able to be set to an `OrderedCollectionPage` object, even though it is a subtype of `OrderedCollection` according to Activity Vocabulary specification. [[#165]] - The type of `Application()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Application.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Application.getInbox()` and `Application.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Group()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Group.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Group.getInbox()` and `Group.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Organization()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Organization.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Organization.getInbox()` and `Organization.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Person()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Person.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Person.getInbox()` and `Person.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Service()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Service.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Service.getInbox()` and `Service.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). Version 1.2.5 ------------- Released on November 14, 2024. - Suppressed a `TypeError` with a message unusable due to Node.js's mysterious behavior. [[#159]] - The `verifyRequest()` function no longer throws a `TypeError` when a given `Request` object's body is already consumed or locked. Instead, it logs an error message to the `["fedify", "sig", "http"]` logger category and returns `null`. - The `Federation.fetch()` method no longer throws a `TypeError` when a given `Request` object's body is already consumed or locked. Instead, it logs an error message to the `["fedify", "federation", "inbox"]` logger category and responds with a `500 Internal Server Error`. Version 1.2.4 ------------- Released on November 12, 2024. - Fixed a bug where default document loaders had thrown a `TypeError` with a message Body is unusable: Body has already been read or Body already consumed when the content type of the response was an HTML document and there's no link to a JSON-LD document. - Fixed a bug where `verifySignature()` and `verifyJsonLd()` functions sometimes had thrown a `jsonld.ValidationError` error. Now such errors are caught and logged as warnings, and the signature to verify is considered as invalid. Version 1.2.3 ------------- Released on November 6, 2024. - The `fedify node` subcommand now can recognize multiple values of the `rel` attribute in the `` HTML elements. Version 1.2.2 ------------- Released on November 1, 2024. - Handle connection errors (rather than HTTP errors) in the `Context.sendActivity()` method. - Support the `fedify` command on Windows on ARM64 via x64 emulation. [[#160]] [#160]: https://github.com/fedify-dev/fedify/issues/160 Version 1.2.1 ------------- Released on October 31, 2024. - Now `fedify node` command can render the node's favicon with `image/vnd.microsoft.icon` or `image/x-icon` format. Version 1.2.0 ------------- Released on October 31, 2024. - Added `InboxContext.recipient` property. - Added NodeInfo client functions. - Added `getNodeInfo()` function. - Added `GetNodeInfoOptions` interface. - Added `parseNodeInfo()` function. - Added `ParseNodeInfoOptions` interface. - Re-exported Semantic Versioning-related types and functions: - Added `SemVer` type. - Added `formatSemVer()` function. - Added `parseSemVer()` function. - Added `followedMessage` property to `Actor` type in Activity Vocabulary API. - Added `Application.followedMessage` property. - `new Application()` constructor now accepts `followedMessage` option. - `Application.clone()` method now accepts `followedMessage` option. - Added `Group.followedMessage` property. - `new Group()` constructor now accepts `followedMessage` option. - `Group.clone()` method now accepts `followedMessage` option. - Added `Organization.followedMessage` property. - `new Organization()` constructor now accepts `followedMessage` option. - `Organization.clone()` method now accepts `followedMessage` option. - Added `Person.followedMessage` property. - `new Person()` constructor now accepts `followedMessage` option. - `Person.clone()` method now accepts `followedMessage` option. - Added `Service.followedMessage` property. - `new Service()` constructor now accepts `followedMessage` option. - `Service.clone()` method now accepts `followedMessage` option. - Log messages now can be traced using [LogTape]'s [implicit contexts]. [[#118]] - Added options for an AMQP driver to `fedify init` command. - Added `amqp` value to the `-q`/`--message-queue` option of the `fedify init` command. - Added `fedify node` subcommand. - Added more log messages using the [LogTape] library. Currently the below logger categories are used: - `["fedify", "nodeinfo", "client"]` [implicit contexts]: https://logtape.org/manual/contexts#implicit-contexts [#118]: https://github.com/fedify-dev/fedify/issues/118 Version 1.1.20 -------------- Released on March 26, 2025. - Fixed a `TypeError` thrown by the followers collection dispatcher when the `base-url` parameter was provided. - Fixed a `TypeError` thrown by the `signRequest()` function on Node.js. [[#222]] Version 1.1.19 -------------- Released on March 26, 2025. - Fixed a bug where the `totalItems` property of `OrderedCollection` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. - Fixed a bug where the `id` property of `OrderedCollection` and `OrderedCollectionPage` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. Version 1.1.18 -------------- Released on March 20, 2025. - Fixed a bug of WebFinger handler where it had failed to match `acct:` URIs with a host having a port number. [[#218], [#219] by Revath S Kumar] - Fixed a server error thrown when an invalid URL was passed to the `base-url` parameter of the followers collection. [[#217]] Version 1.1.17 -------------- Released on March 9, 2025. - Fedify no more depends on `node:punycode` module, which is deprecated in Node.js. Now it uses the built-in `node:url` module instead. [[#212], [#214] by Fróði Karlsson] Version 1.1.16 -------------- Released on February 28, 2025. - Made `fedify init` to install *@fedify/h3* 0.1.2 which is compatible with Fedify 1.0.0 or later versions when `--web-framework nitro` option is provided. [[#213]] - Fixed a bug where `fedify init` had failed to initialize a project with the `--runtime node --package-manager pnpm --web-framework nitro` option. [[#213]] - Made `fedify init` to install *@logtape/logtape* 0.6.5 which is the version used in Fedify 1.1.x. Version 1.1.15 -------------- Released on February 25, 2025. - Added the following default context to `Application`, `Group`, `Organization`, `Person`, and `Service` classes: ~~~~ json { "Emoji": "http://joinmastodon.org/ns#Emoji" } ~~~~ Version 1.1.14 -------------- Released on February 22, 2025. - Added the following default contexts to `Follow`, `Undo`, and `Update` classes: - - - Version 1.1.13 -------------- Released on February 19, 2025. - Fixed a bug where the `fedify init` command had failed to locate package managers on Windows. [[#210]] - The `fedify` command became aware of `FEDIFY_LOG_FILE` environment variable to log messages to a file. If the variable is set, the command logs messages to the file specified by the variable. Version 1.1.12 -------------- Released on February 10, 2025. - Fixed a bug with nested object hydration in Activity Vocabulary API where deeply nested properties (like `Object.getAttribution()` on `Activity.getObject()`) were't being properly hydrated during `toJsonLd()` calls. Previously, subsequent calls to `toJsonLd()` on nested objects could result in inconsistent JSON-LD output where nested objects remained as URLs instead of being fully expanded. Version 1.1.11 -------------- Released on January 21, 2025. - Fixed several security vulnerabilities of the `lookupWebFinger()` function. [[CVE-2025-23221]] - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the infinite number of redirects, which could lead to a denial of service attack. Now it follows up to 5 redirects. - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the redirects to other than the HTTP/HTTPS schemes, which could lead to a security breach. Now it follows only the same scheme as the original request. - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the redirects to the private network addresses, which could lead to a SSRF attack. Now it follows only the public network addresses. Version 1.1.10 -------------- Released on December 18, 2024. - Fixed the default document loader to handle the `Link` header with incorrect syntax. [[#196]] Version 1.1.9 ------------- Released on December 11, 2024. - Fixed idempotence check in inbox listeners to ensure activities for different origins are processed correctly. Version 1.1.8 ------------- Released on November 23, 2024. - Fixed `ShikiError` on the `fedify inbox` command rendering web interface. [[#178], [#185] by Heesun Jung] - Fixed text overflow of the `fedify inbox` command's web log view. [[#180], [#188] by Lim Kyunghee] [#178]: https://github.com/fedify-dev/fedify/issues/178 [#180]: https://github.com/fedify-dev/fedify/issues/180 [#185]: https://github.com/fedify-dev/fedify/pull/185 [#188]: https://github.com/fedify-dev/fedify/pull/188 Version 1.1.7 ------------- Released on November 22, 2024. - Fixed a bug where `lookupWebFinger()` function had thrown a `TypeError` when the *.well-known/webfinger* redirects to a relative URI. [[#166]] Version 1.1.6 ------------- Released on November 19, 2024. - Fix a bug where `Actor`'s `inbox` and `outbox` properties had not been able to be set to an `OrderedCollectionPage` object, even though it is a subtype of `OrderedCollection` according to Activity Vocabulary specification. [[#165]] - The type of `Application()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Application.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Application.getInbox()` and `Application.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Group()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Group.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Group.getInbox()` and `Group.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Organization()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Organization.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Organization.getInbox()` and `Organization.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Person()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Person.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Person.getInbox()` and `Person.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Service()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Service.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Service.getInbox()` and `Service.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). Version 1.1.5 ------------- Released on November 14, 2024. - Suppressed a `TypeError` with a message unusable due to Node.js's mysterious behavior. [[#159]] - The `verifyRequest()` function no longer throws a `TypeError` when a given `Request` object's body is already consumed or locked. Instead, it logs an error message to the `["fedify", "sig", "http"]` logger category and returns `null`. - The `Federation.fetch()` method no longer throws a `TypeError` when a given `Request` object's body is already consumed or locked. Instead, it logs an error message to the `["fedify", "federation", "inbox"]` logger category and responds with a `500 Internal Server Error`. Version 1.1.4 ------------- Released on November 12, 2024. - Fixed a bug where default document loaders had thrown a `TypeError` with a message Body is unusable: Body has already been read or Body already consumed when the content type of the response was an HTML document and there's no link to a JSON-LD document. - Fixed a bug where `verifySignature()` and `verifyJsonLd()` functions sometimes had thrown a `jsonld.ValidationError` error. Now such errors are caught and logged as warnings, and the signature to verify is considered as invalid. Version 1.1.3 ------------- Released on October 31, 2024. - Fixed a bug where `fetchDocumentLoader()` function had disallowed redirecting to a private network address when the second parameter, a `boolean` value to allow private network addresses, was `true`. Version 1.1.2 ------------- Released on October 27, 2024. - Fixed default document loaders' incorrect handling of relative URIs in `Link` headers with `rel=alternate`. [[#155] by Emelia Smith] - The `fetchDocumentLoader()` function now preloads the following JSON-LD context: . Version 1.1.1 ------------- Released on October 23, 2024. - The `fetchDocumentLoader()` function now preloads the following JSON-LD context: . Version 1.1.0 ------------- Released on October 20, 2024. - Added utility functions for traversing remote collections. [[#150]] - Added `Context.traverseCollection()` method. - Added `traverseCollection()` function. - Added `TraverseCollectionOptions` interface. - Added `EmojiReact` class to Activity Vocabulary API. [[FEP-c0e0]] - Added `successor` property to the `Actor` types in the Activity Vocabulary API. - Added `Application.getSuccessor()` method. - `new Application()` constructor now accepts `successor` option. - `Application.clone()` method now accepts `successor` option. - Added `Group.getSuccessor()` method. - `new Group()` constructor now accepts `successor` option. - `Group.clone()` method now accepts `successor` option. - Added `Organization.getSuccessor()` method. - `new Organization()` constructor now accepts `successor` option. - `Organization.clone()` method now accepts `successor` option. - Added `Person.getSuccessor()` method. - `new Person()` constructor now accepts `successor` option. - `Person.clone()` method now accepts `successor` option. - Added `Service.getSuccessor()` method. - `new Service()` constructor now accepts `successor` option. - `Service.clone()` method now accepts `successor` option. - Added `DidService` class to Activity Vocabulary API. [[FEP-9091], [#146]] - Added `Export` class to Activity Vocabulary API. [[FEP-9091], [#146]] - Added `service` property to the `Actor` types in the Activity Vocabulary API. [[FEP-9091], [#146]] - Added `Application.getService()` method. - Added `Application.getServices()` method. - `new Application()` constructor now accepts `service` option. - `new Application()` constructor now accepts `services` option. - `Application.clone()` method now accepts `service` option. - `Application.clone()` method now accepts `services` option. - Added `Group.getService()` method. - Added `Group.getServices()` method. - `new Group()` constructor now accepts `service` option. - `new Group()` constructor now accepts `services` option. - `Group.clone()` method now accepts `service` option. - `Group.clone()` method now accepts `services` option. - Added `Organization.getService()` method. - Added `Organization.getServices()` method. - `new Organization()` constructor now accepts `service` option. - `new Organization()` constructor now accepts `services` option. - `Organization.clone()` method now accepts `service` option. - `Organization.clone()` method now accepts `services` option. - Added `Person.getService()` method. - Added `Person.getServices()` method. - `new Person()` constructor now accepts `service` option. - `new Person()` constructor now accepts `services` option. - `Person.clone()` method now accepts `service` option. - `Person.clone()` method now accepts `services` option. - Added `Service.getService()` method. - Added `Service.getServices()` method. - `new Service()` constructor now accepts `service` option. - `new Service()` constructor now accepts `services` option. - `Service.clone()` method now accepts `service` option. - `Service.clone()` method now accepts `services` option. - The default time window for verifying HTTP Signatures of incoming requests is now an hour (was a minute). This new default window is according to the [ActivityPub and HTTP Signatures] document. - The default value of `VerifyRequestOptions.timeWindow` option became `{ hours: 1 }` (was `{ minutes: 1 }`). - The default value of `CreateFederationOptions.signatureTimeWindow` option became `{ hours: 1 }` (was `{ minutes: 1 }`). - The type of `VerifyRequestOptions.timeWindow` property became `Temporal.Duration | Temporal.DurationLike | false` (was `Temporal.DurationLike | false`). - The type of `CreateFederationOptions.signatureTimeWindow` property became `Temporal.Duration | Temporal.DurationLike | false` (was `Temporal.DurationLike | false`). - In the `fedify inbox` command's web interface, the *Raw Activity* tab is added to show the raw JSON object of the received activity. [FEP-c0e0]: https://w3id.org/fep/c0e0 [FEP-9091]: https://w3id.org/fep/9091 [ActivityPub and HTTP Signatures]: https://swicg.github.io/activitypub-http-signature/ [#146]: https://github.com/fedify-dev/fedify/issues/146 [#150]: https://github.com/fedify-dev/fedify/issues/150 Version 1.0.23 -------------- Released on March 26, 2025. - Fixed a `TypeError` thrown by the followers collection dispatcher when the `base-url` parameter was provided. - Fixed a `TypeError` thrown by the `signRequest()` function on Node.js. [[#222]] [#222]: https://github.com/fedify-dev/fedify/issues/222 Version 1.0.22 -------------- Released on March 26, 2025. - Fixed a bug where the `totalItems` property of `OrderedCollection` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. - Fixed a bug where the `id` property of `OrderedCollection` and `OrderedCollectionPage` objects returned by followers collection dispatcher had been an incorrect value if a `base-url` parameter was provided. Version 1.0.21 -------------- Released on March 20, 2025. - Fixed a bug of WebFinger handler where it had failed to match `acct:` URIs with a host having a port number. [[#218], [#219] by Revath S Kumar] - Fixed a server error thrown when an invalid URL was passed to the `base-url` parameter of the followers collection. [[#217]] [#217]: https://github.com/fedify-dev/fedify/issues/217 [#218]: https://github.com/fedify-dev/fedify/issues/218 [#219]: https://github.com/fedify-dev/fedify/pull/219 Version 1.0.20 -------------- Released on March 9, 2025. - Fedify no more depends on `node:punycode` module, which is deprecated in Node.js. Now it uses the built-in `node:url` module instead. [[#212], [#214] by Fróði Karlsson] [#212]: https://github.com/fedify-dev/fedify/issues/212 [#214]: https://github.com/fedify-dev/fedify/pull/214 Version 1.0.19 -------------- Released on February 28, 2025. - Made `fedify init` to install *@fedify/h3* 0.1.2 which is compatible with Fedify 1.0.0 or later versions when `--web-framework nitro` option is provided. [[#213]] - Fixed a bug where `fedify init` had failed to initialize a project with the `--runtime node --package-manager pnpm --web-framework nitro` option. [[#213]] - Made `fedify init` to install *@logtape/logtape* 0.6.5 which is the version used in Fedify 1.0.x. [#213]: https://github.com/fedify-dev/fedify/issues/213 Version 1.0.18 -------------- Released on February 25, 2025. - Added the following default context to `Application`, `Group`, `Organization`, `Person`, and `Service` classes: ~~~~ json { "Emoji": "http://joinmastodon.org/ns#Emoji" } ~~~~ Version 1.0.17 -------------- Released on February 22, 2025. - Added the following default contexts to `Follow`, `Undo`, and `Update` classes: - - - Version 1.0.16 -------------- Released on February 19, 2025. - Fixed a bug where the `fedify init` command had failed to locate package managers on Windows. [[#210]] - The `fedify` command became aware of `FEDIFY_LOG_FILE` environment variable to log messages to a file. If the variable is set, the command logs messages to the file specified by the variable. [#210]: https://github.com/fedify-dev/fedify/issues/210 Version 1.0.15 -------------- Released on February 10, 2025. - Fixed a bug with nested object hydration in Activity Vocabulary API where deeply nested properties (like `Object.getAttribution()` on `Activity.getObject()`) were't being properly hydrated during `toJsonLd()` calls. Previously, subsequent calls to `toJsonLd()` on nested objects could result in inconsistent JSON-LD output where nested objects remained as URLs instead of being fully expanded. Version 1.0.14 -------------- Released on January 21, 2025. - Fixed several security vulnerabilities of the `lookupWebFinger()` function. [[CVE-2025-23221]] - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the infinite number of redirects, which could lead to a denial of service attack. Now it follows up to 5 redirects. - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the redirects to other than the HTTP/HTTPS schemes, which could lead to a security breach. Now it follows only the same scheme as the original request. - Fixed a security vulnerability where the `lookupWebFinger()` function had followed the redirects to the private network addresses, which could lead to a SSRF attack. Now it follows only the public network addresses. [CVE-2025-23221]: https://github.com/fedify-dev/fedify/security/advisories/GHSA-c59p-wq67-24wx Version 1.0.13 -------------- Released on December 18, 2024. - Fixed the default document loader to handle the `Link` header with incorrect syntax. [[#196]] [#196]: https://github.com/fedify-dev/fedify/issues/196 Version 1.0.12 -------------- Released on December 11, 2024. - Fixed idempotence check in inbox listeners to ensure activities for different origins are processed correctly. Version 1.0.11 -------------- Released on November 22, 2024. - Fixed a bug where `lookupWebFinger()` function had thrown a `TypeError` when the *.well-known/webfinger* redirects to a relative URI. [[#166]] Version 1.0.10 -------------- Released on November 19, 2024. - Fix a bug where `Actor`'s `inbox` and `outbox` properties had not been able to be set to an `OrderedCollectionPage` object, even though it is a subtype of `OrderedCollection` according to Activity Vocabulary specification. [[#165]] - The type of `Application()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Application.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Application.getInbox()` and `Application.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Group()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Group.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Group.getInbox()` and `Group.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Organization()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Organization.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Organization.getInbox()` and `Organization.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Person()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Person.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Person.getInbox()` and `Person.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Service()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Service.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Service.getInbox()` and `Service.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). Version 1.0.9 ------------- Released on November 14, 2024. - Suppressed a `TypeError` with a message unusable due to Node.js's mysterious behavior. [[#159]] - The `verifyRequest()` function no longer throws a `TypeError` when a given `Request` object's body is already consumed or locked. Instead, it logs an error message to the `["fedify", "sig", "http"]` logger category and returns `null`. - The `Federation.fetch()` method no longer throws a `TypeError` when a given `Request` object's body is already consumed or locked. Instead, it logs an error message to the `["fedify", "federation", "inbox"]` logger category and responds with a `500 Internal Server Error`. Version 1.0.8 ------------- Released on November 12, 2024. - Fixed a bug where default document loaders had thrown a `TypeError` with a message Body is unusable: Body has already been read or Body already consumed when the content type of the response was an HTML document and there's no link to a JSON-LD document. - Fixed a bug where `verifySignature()` and `verifyJsonLd()` functions sometimes had thrown a `jsonld.ValidationError` error. Now such errors are caught and logged as warnings, and the signature to verify is considered as invalid. Version 1.0.7 ------------- Released on October 31, 2024. - Fixed a bug where `fetchDocumentLoader()` function had disallowed redirecting to a private network address when the second parameter, a `boolean` value to allow private network addresses, was `true`. Version 1.0.6 ------------- Released on October 27, 2024. - Fixed default document loaders' incorrect handling of relative URIs in `Link` headers with `rel=alternate`. [[#155] by Emelia Smith] - The `fetchDocumentLoader()` function now preloads the following JSON-LD context: . Version 1.0.5 ------------- Released on October 23, 2024. - The `fetchDocumentLoader()` function now preloads the following JSON-LD context: . Version 1.0.4 ------------- Released on October 17, 2024. - Fixed a bug where `Actor.aliasId` and `Actor.aliasIds` properties had been represented as `as:alsoKnownAs` property instead of `alsoKnownAs` property in compacted JSON-LD objects. - Improved compatibility with Bridgy Fed for Bluesky where it puts an invalid URI with the format `at://...` in the `alsoKnownAs` property. Version 1.0.3 ------------- Released on October 17, 2024. - Improved compatibility with some implementations (e.g., Nexkey) where some `CryptographicKey` objects are incorrectly typed in JSON-LD objects. Version 1.0.2 ------------- Released on September 27, 2024. - Fixed a bug of `Object.toJsonLd()` method where it had incorrectly compacted the `name` property when it was not a language map. - The `Delete(Application)` activities sent by the `fedify inbox` command now embed the entire actor object instead of just the actor's URI so that the peers can verify the actor's signature without fetching the actor object. Version 1.0.1 ------------- Released on September 26, 2024. - Fixed deprecation messages related to the `{handle}` variable in URL templates; they had had wrong placeholders in the message templates. - Fixed a bug of `Object.toJsonLd()` method where it had not fall back to the proper compact form when the heuristic compact form was not available. Version 1.0.0 -------------- Released on September 26, 2024. - The term `handle` for dispatching actors is deprecated in favor of `identifier`. - The URI template for the following methods now accepts variable `{identifier}` instead of `{handle}`: - `Federation.setActorDispatcher()` - `Federation.setInboxDispatcher()` - `Federation.setOutboxDispatcher()` - `Federation.setFollowingDispatcher()` - `Federation.setFollowersDispatcher()` - `Federation.setLikedDispatcher()` - `Federation.setFeaturedDispatcher()` - `Federation.setFeaturedTagsDispatcher()` - `Federation.setInboxListeners()` The `{handle}` variable is deprecated, and it will be removed in the future. - The type of `Federation.setActorDispatcher()` method's first parameter became ```${string}{identifier}${string}` | `${string}{handle}${string}``` (was ```${string}{handle}${string}```). - The type of `Federation.setInboxDispatcher()` method's first parameter became ```${string}{identifier}${string}` | `${string}{handle}${string}``` (was ```${string}{handle}${string}```). - The type of `Federation.setOutboxDispatcher()` method's first parameter became ```${string}{identifier}${string}` | `${string}{handle}${string}``` (was ```${string}{handle}${string}```). - The type of `Federation.setFollowingDispatcher()` method's first parameter became ```${string}{identifier}${string}` | `${string}{handle}${string}``` (was ```${string}{handle}${string}```). - The type of `Federation.setFollowersDispatcher()` method's first parameter became ```${string}{identifier}${string}` | `${string}{handle}${string}``` (was ```${string}{handle}${string}```). - The type of `Federation.setLikedDispatcher()` method's first parameter became ```${string}{identifier}${string}` | `${string}{handle}${string}``` (was ```${string}{handle}${string}```). - The type of `Federation.setFeaturedDispatcher()` method's first parameter became ```${string}{identifier}${string}` | `${string}{handle}${string}``` (was ```${string}{handle}${string}```). - The type of `Federation.setFeaturedTagsDispatcher()` method's first parameter became ```${string}{identifier}${string}` | `${string}{handle}${string}``` (was ```${string}{handle}${string}```). - The type of `Federation.setInboxListeners()` method's first parameter became ```${string}{identifier}${string}` | `${string}{handle}${string}``` (was ```${string}{handle}${string}```). - The type of `Context.getDocumentLoader()` method's first parameter became `{ identifier: string } | { username: string } | { handle: string } | { keyId: URL; privateKey: CryptoKey }` (was `{ handle: string } | { keyId: URL; privateKey: CryptoKey }`). - Passing `{ handle: string }` to `Context.getDocumentLoader()` method is deprecated in favor of `{ username: string }`. - The type of `Context.sendActivity()` method's first parameter became `SenderKeyPair | SenderKeyPair[] | { identifier: string } | { username: string } | { handle: string }` (was `SenderKeyPair | SenderKeyPair[] | { handle: string }`). - All properties of `ParseUriResult` type became readonly. - Added `identifier` properties next to `handle` properties in `ParseUriResult` type. - The `handle` properties of `ParseUriResult` type are deprecated in favor of `identifier` properties. - The return type of `SharedInboxKeyDispatcher` callback type became `SenderKeyPair | { identifier: string } | { username: string } | { handle: string } | null | Promise` (was `SenderKeyPair | { handle: string } | null | Promise`). - Fedify now supports [Linked Data Signatures], which is outdated but still widely used in the fediverse. - A `Federation` object became to verify an activity's Linked Data Signatures if it has one. If Linked Data Signatures are verified, Object Integrity Proofs and HTTP Signatures are not verified. - `Context.sendActivity()` method became to sign an activity with Linked Data Signatures if there is at least one RSA-PKCS#1-v1.5 key pair. - Added `Signature` interface. - Added `signJsonLd()` function. - Added `SignJsonLdOptions` interface. - Added `createSignature()` function. - Added `CreateSignatureOptions` interface. - Added `verifyJsonLd()` function. - Added `VerifyJsonLdOptions` interface. - Added `verifySignature()` function. - Added `VerifySignatureOptions` interface. - Added `attachSignature()` function. - Added `detachSignature()` function. - In inbox listeners, a received activity now can be forwarded to another server. [[#137]] - Added `InboxContext` interface. - Added `ForwardActivityOptions` interface. - The first parameter of the `InboxListener` callback type became `InboxContext` (was `Context`). - Added `cat` property to `Actor` type in Activity Vocabulary API. - Added `Application.cat` property. - `new Application()` constructor now accepts `cat` option. - `Application.clone()` method now accepts `cat` option. - Added `Group.cat` property. - `new Group()` constructor now accepts `cat` option. - `Group.clone()` method now accepts `cat` option. - Added `Organization.cat` property. - `new Organization()` constructor now accepts `cat` option. - `Organization.clone()` method now accepts `cat` option. - Added `Person.cat` property. - `new Person()` constructor now accepts `cat` option. - `Person.clone()` method now accepts `cat` option. - Added `Service.cat` property. - `new Service()` constructor now accepts `cat` option. - `Service.clone()` method now accepts `cat` option. - The `Context.parseUri()` method's parameter type became `URL | null` (was `URL`). - `Context.sendActivity()` method now adds Object Integrity Proofs to the activity to be sent only once. It had added Object Integrity Proofs to the activity for every recipient before. - The message queue is now able to be stopped manually by providing an `AbortSignal` object to the `Federation.startQueue()` method. - Added the optional second parameter to `Federation.startQueue()` method, which is a `FederationStartQueueOptions` object. - Added `FederationStartQueueOptions` interface. - Added the optional second parameter to `MessageQueue.listen()` method, which is a `MessageQueueListenOptions` object. - Added `MessageQueueListenOptions` interface. - The return type of `MessageQueue.listen()` method became `Promise` (was `void`). - Added `ParallelMessageQueue` class. [[#106]] - WebFinger responses now include links if the `Actor` object returned by the actor dispatcher has `icon`/`icons` property. - `DenoKvMessageQueue` now implements `Disposable` interface. - The `fedify inbox` command now sends `Delete(Application)` activities when it's terminated so that the peers can clean up data related to the temporary actor. [[#135]] - Added options for PostgreSQL drivers to `fedify init` command. - Added `postgres` value to the `-k`/`--kv-store` option of the `fedify init` command. - Added `postgres` value to the `-q`/`--message-queue` option of the `fedify init` command. - The generated project by the `fedify init` command now enables dotenv by default. - The `fedify init` command now generates *.env* file with default values. - Added more log messages using the [LogTape] library. Currently the below logger categories are used: - `["fedify", "sig", "ld"]` [Linked Data Signatures]: https://web.archive.org/web/20170923124140/https://w3c-dvcg.github.io/ld-signatures/ [#106]: https://github.com/fedify-dev/fedify/issues/106 [#135]: https://github.com/fedify-dev/fedify/issues/135 [#137]: https://github.com/fedify-dev/fedify/issues/137 Version 0.15.9 -------------- Released on November 22, 2024. - Fixed a bug where `lookupWebFinger()` function had thrown a `TypeError` when the *.well-known/webfinger* redirects to a relative URI. [[#166]] [#166]: https://github.com/fedify-dev/fedify/issues/166 Version 0.15.8 -------------- Released on November 19, 2024. - Fix a bug where `Actor`'s `inbox` and `outbox` properties had not been able to be set to an `OrderedCollectionPage` object, even though it is a subtype of `OrderedCollection` according to Activity Vocabulary specification. [[#165]] - The type of `Application()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Application.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Application.getInbox()` and `Application.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Group()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Group.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Group.getInbox()` and `Group.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Organization()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Organization.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Organization.getInbox()` and `Organization.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Person()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Person.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Person.getInbox()` and `Person.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). - The type of `Service()` constructor's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The type of `Service.clone()` method's `inbox` and `outbox` options is now `OrderedCollection | OrderedCollectionPage | null | undefined` (was `OrderedCollection | null | undefined`). - The return type of `Service.getInbox()` and `Service.getOutbox()` methods is now `OrderedCollection | OrderedCollectionPage | null` (was `OrderedCollection | null`). [#165]: https://github.com/fedify-dev/fedify/issues/165 Version 0.15.7 -------------- Released on November 14, 2024. - Suppressed a `TypeError` with a message unusable due to Node.js's mysterious behavior. [[#159]] - The `verifyRequest()` function no longer throws a `TypeError` when a given `Request` object's body is already consumed or locked. Instead, it logs an error message to the `["fedify", "sig", "http"]` logger category and returns `null`. - The `Federation.fetch()` method no longer throws a `TypeError` when a given `Request` object's body is already consumed or locked. Instead, it logs an error message to the `["fedify", "federation", "inbox"]` logger category and responds with a `500 Internal Server Error`. [#159]: https://github.com/fedify-dev/fedify/issues/159 Version 0.15.6 -------------- Released on November 12, 2024. - Fixed a bug where default document loaders had thrown a `TypeError` with a message Body is unusable: Body has already been read or Body already consumed when the content type of the response was an HTML document and there's no link to a JSON-LD document. Version 0.15.5 -------------- Released on October 30, 2024. - Fixed a bug where `fetchDocumentLoader()` function had disallowed redirecting to a private network address when the second parameter, a `boolean` value to allow private network addresses, was `true`. Version 0.15.4 -------------- Released on October 27, 2024. - Fixed default document loaders' incorrect handling of relative URIs in `Link` headers with `rel=alternate`. [[#155] by Emelia Smith] - The `fetchDocumentLoader()` function now preloads the following JSON-LD context: . [#155]: https://github.com/fedify-dev/fedify/pull/155 Version 0.15.3 -------------- Released on October 23, 2024. - The `fetchDocumentLoader()` function now preloads the following JSON-LD context: . Version 0.15.2 -------------- Released on September 26, 2024. - Fixed a bug of `Object.toJsonLd()` method where it had not fall back to the proper compact form when the heuristic compact form was not available. Version 0.15.1 -------------- Released on September 15, 2024. - Fixed a bug where even if the `ActorCallbackSetters.mapHandle()` method was called, a WebFinger username was used as an actor's handle. [[#136]] [#136]: https://github.com/fedify-dev/fedify/pull/136 Version 0.15.0 -------------- Released on September 11, 2024. - Actors, collections, and objects now can have their URIs that do not consist of a WebFinger username, which means actors can change their fediverse handles. - Added `ActorCallbackSetters.mapHandle()` method. - Added `ActorHandleMapper` type. - Added `quoteUrl` property to `Article`, `ChatMessage`, `Note`, and `Question` classes in Activity Vocabulary API. - Added `Article.quoteUrl` property. - `new Article()` constructor now accepts `quoteUrl` option. - `Article.clone()` method now accepts `quoteUrl` option. - Added `ChatMessage.quoteUrl` property. - `new ChatMessage()` constructor now accepts `quoteUrl` option. - `ChatMessage.clone()` method now accepts `quoteUrl` option. - Added `Note.quoteUrl` property. - `new Note()` constructor now accepts `quoteUrl` option. - `Note.clone()` method now accepts `quoteUrl` option. - Added `Question.quoteUrl` property. - `new Question()` constructor now accepts `quoteUrl` option. - `Question.clone()` method now accepts `quoteUrl` option. - The element type of the liked collection is now `Object` or `URL` instead of `Like`. - Changed the type of `Federation.setLikedDispatcher()` method's second parameter to `CollectionDispatcher