Skip to content

Update Fedify packages to 1.10.11 #1856

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sagzy merged 2 commits into from
Jun 4, 2026
Merged

Update Fedify packages to 1.10.11 #1856

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c1d7677
Update fedify monorepo to 1.10.11
sagzy Jun 4, 2026
f74ef15
Update @fedify/fedify to 1.10.11 in reconcile-account-topics job
sagzy Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion jobs/reconcile-account-topics/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "reconcile-account-topics",
"private": true,
"dependencies": {
"@fedify/fedify": "1.10.10",
"@fedify/fedify": "1.10.11",
"mysql2": "3.22.4"
}
}
8 changes: 4 additions & 4 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
"@biomejs/biome": "2.4.16",
"@cucumber/cucumber": "12.9.0",
"@faker-js/faker": "10.4.0",
"@fedify/cli": "1.10.10",
"@fedify/cli": "1.10.11",
"@types/html-to-text": "9.0.4",
"@types/jsonwebtoken": "9.0.10",
"@types/node": "22.19.19",
Expand All @@ -64,9 +64,9 @@
"wiremock-captain": "4.1.3"
},
"dependencies": {
"@fedify/fedify": "1.10.10",
"@fedify/hono": "1.10.10",
"@fedify/redis": "1.10.10",
"@fedify/fedify": "1.10.11",
"@fedify/hono": "1.10.11",
"@fedify/redis": "1.10.11",
Comment on lines +67 to +69

@coderabbitai coderabbitai Bot Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

What changes were introduced in Fedify 1.10.11 and are there any security advisories for Fedify packages versions 1.10.10 or 1.10.11?

💡 Result:

As of June 4, 2026, there is no release for Fedify version 1.10.11. The most recent release in the 1.10.x series is 1.10.10 [1]. Regarding security advisories for Fedify: - Fedify 1.10.10 was released on May 21, 2026, to address a security vulnerability (CVE-2026-42462) in Linked Data Signature verification [1][2]. This vulnerability could allow an attacker to restructure the JSON-LD graph of a signed activity, potentially changing its interpretation without invalidating the signature [2][3]. The fix involves normalizing activities against the local JSON-LD context before interpretation and rejecting constructs that could manipulate the object shape [2]. - Fedify 1.10.9 (released May 10, 2026) addressed a separate vulnerability related to a private network protection bypass in validatePublicUrl(), which could have allowed SSRF attacks via IPv4-mapped IPv6 literals [4][5]. Users are advised to keep their Fedify installations updated to the latest patched versions to mitigate these risks [2][5].

Citations:

🌐 Web query:

Is @fedify/hono version 1.10.11 compatible with hono version 4.12.23?

💡 Result:

No reliable source evidence found that explicitly states whether @fedify/hono version 1.10.11 is compatible with hono version 4.12.23. What I could verify from sources: 1) The current published @fedify/hono package page doesn’t show version 1.10.11; it shows much newer versions (e.g., 2.2.x) on npm/JSR, so I could not confirm the dependency range for 1.10.11 from the package metadata available in the search results. [1] 2) Hono 4.12.23 is a release tag (2026-05-25). [2] 3) Fedify repo lockfile evidence shows that their hono integration typically depends on specific hono versions (example shows hono 4.8.3 in a lockfile snapshot), but that does not prove compatibility for the specific combo you asked about (fedify-hono 1.10.11 + hono 4.12.23). [3] To answer your question conclusively, I would need an authoritative artifact for exactly @fedify/hono@1.10.11 (its package.json peerDependencies/dependencies on “hono”, or release notes / compatibility matrix). The search results I found were insufficient to locate those exact version details. Practical guidance: if you’re using npm/pnpm, check what “hono” version @fedify/hono@1.10.11 declares (peerDependencies or dependencies) and then see whether 4.12.23 satisfies that range; otherwise expect possible type/runtime breakage due to Hono’s v4 migration history. [4]

Citations:

🏁 Script executed:

#!/bin/bash
# Check npm registry for package existence and basic metadata
echo "=== Checking `@fedify/fedify`@1.10.11 ==="
curl -s https://registry.npmjs.org/@fedify/fedify/1.10.11 | jq -r '.version, .deprecated // "Not deprecated"'

echo -e "\n=== Checking `@fedify/hono`@1.10.11 ==="
curl -s https://registry.npmjs.org/@fedify/hono/1.10.11 | jq -r '.version, .peerDependencies.hono // "No hono peer dependency specified", .deprecated // "Not deprecated"'

echo -e "\n=== Checking `@fedify/redis`@1.10.11 ==="
curl -s https://registry.npmjs.org/@fedify/redis/1.10.11 | jq -r '.version, .deprecated // "Not deprecated"'

echo -e "\n=== Checking `@fedify/cli`@1.10.11 ==="
curl -s https://registry.npmjs.org/@fedify/cli/1.10.11 | jq -r '.version, .deprecated // "Not deprecated"'

# Check for known vulnerabilities
echo -e "\n=== Checking for security advisories ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, ecosystem: NPM, package: "`@fedify/fedify`") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Repository: TryGhost/ActivityPub

Length of output: 2926

Update Fedify packages beyond 1.10.11 to address HIGH security advisory

  • @fedify/fedify@1.10.11, @fedify/hono@1.10.11, and @fedify/redis@1.10.11 exist on npm and are not deprecated.
  • @fedify/hono@1.10.11 declares peerDependencies.hono: ^4.0.0, so hono@4.12.23 satisfies the requirement.
  • Security: GitHub advisory for @fedify/fedify (“LD-Signature Bypass via JSON-LD Named-Graph Restructuring”) affects versions <2.2.3 (patched in 2.2.3), so upgrading only to 1.10.11 keeps this HIGH issue unfixed—upgrade Fedify packages to >=2.2.3.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 67 - 69, The package versions for
"`@fedify/fedify`", "`@fedify/hono`", and "`@fedify/redis`" are pinned to 1.10.11
which leaves the HIGH security advisory for `@fedify/fedify` unpatched; update the
dependency entries in package.json for "`@fedify/fedify`", "`@fedify/hono`", and
"`@fedify/redis`" to versions >=2.2.3 (ensure "`@fedify/hono`" remains compatible
with its peer hono version—hono@4.12.23 satisfies hono:^4.0.0), run npm/yarn
install to update lockfile, and run tests/build to verify compatibility after
bumping those package versions.

@sagzy sagzy Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"LD-Signature Bypass via JSON-LD Named-Graph Restructuring" has been fixed in 1.10.10, the advisory needs an update

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check Fedify 1.10.10 release notes on GitHub
echo "=== Fedify 1.10.10 release ==="
curl -s "https://api.github.com/repos/fedify-dev/fedify/releases/tags/1.10.10" | jq -r '.body' | head -60

echo -e "\n=== GitHub Security Advisory details ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, ecosystem: NPM, package: "`@fedify/fedify`") {
    nodes {
      advisory {
        ghsaId
        summary
        severity
        publishedAt
        updatedAt
        description
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Length of output: 95746

@sagzy, you're correct — thank you for the correction. The Fedify release notes confirm that 1.10.10 was the backport that addressed the LD-Signature Bypass (CVE-2026-42462), so the project was already protected before this PR. The GitHub advisory GHSA-9rfg-v8g9-9367 is incomplete: it only records the 2.x fix (< 2.2.3, patched in 2.2.3) and is missing the >= 1.10.0, < 1.10.10 range with 1.10.10 as the first patched version. My original concern was based on that incomplete advisory data. I'll withdraw it.

✏️ Learnings added 
Learnt from: sagzy
Repo: TryGhost/ActivityPub PR: 1856
File: package.json:67-69
Timestamp: 2026-06-04T06:59:44.055Z
Learning: GHSA-9rfg-v8g9-9367 ("Fedify LD-Signature Bypass via JSON-LD Named-Graph Restructuring") was backported and fixed in `fedify/fedify` 1.10.10 (released 2026-05-21), but the GitHub advisory is incomplete — it only lists the 2.x branch fix (`< 2.2.3`, patched in `2.2.3`) and does not include the 1.x backport range. Projects on `fedify/fedify` >= 1.10.10 are NOT vulnerable to this issue despite the advisory appearing to flag them.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

"@google-cloud/opentelemetry-cloud-trace-exporter": "3.0.0",
"@google-cloud/opentelemetry-cloud-trace-propagator": "0.21.0",
"@google-cloud/pubsub": "5.3.0",
Expand Down
32 changes: 16 additions & 16 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -406,15 +406,15 @@
resolved "https://registry.yarnpkg.com/@faker-js/faker/-/faker-10.4.0.tgz#2dc84d1bc32a2eef3c4658985ca7692a0c5c51b3"
integrity sha512-sDBWI3yLy8EcDzgobvJTWq1MJYzAkQdpjXuPukga9wXonhpMRvd1Izuo2Qgwey2OiEoRIBr35RMU9HJRoOHzpw==

"@fedify/cli@1.10.10":
version "1.10.10"
resolved "https://registry.yarnpkg.com/@fedify/cli/-/cli-1.10.10.tgz#49f4d7416f34a410e56364c768aaeaca37026976"
integrity sha512-DTPZh+qvXZKtfFA4CHyChp2HBMhzy5eEqVLpYg9ztI5uPkd1sGWZHc3I/FNvChvJT6JXiK5A40UzphqFyKORWg==
"@fedify/cli@1.10.11":
version "1.10.11"
resolved "https://registry.yarnpkg.com/@fedify/cli/-/cli-1.10.11.tgz#ce44099d0bfbc081d7f99f56496ddbed5bb81a26"
integrity sha512-gM/aRtt4PYzdqIMWeAShS7Y+O+k4wgZpFDzM80rPMqQBPnbnmzSs8Ct9JDNMKLvbQ+0BgETZI4/wItuffhPSOA==

"@fedify/fedify@1.10.10":
version "1.10.10"
resolved "https://registry.yarnpkg.com/@fedify/fedify/-/fedify-1.10.10.tgz#8d874a8920f61d793e36fbd5d28bab600a106a53"
integrity sha512-iIEokcPsy3p73qIO9n0IEJDXtqxrE8AQx/9m1rrPfzJRGsOG1QWlLxcvoxXXgD2yCY+E+HtBokALWzlWy39XHg==
"@fedify/fedify@1.10.11":
version "1.10.11"
resolved "https://registry.yarnpkg.com/@fedify/fedify/-/fedify-1.10.11.tgz#964b59a531109ebbbd648dc69a82deea0d8cc624"
integrity sha512-wetnw6X33bv/sqXyDCJxxdeBYaHnwYNCx33sFsQ1FyjbzHxSHrSZ0OJCIEzOnke3AoePhLwPffpGkcGeBA8erg==
dependencies:
"@cfworker/json-schema" "^4.1.1"
"@js-temporal/polyfill" "^0.5.1"
Expand All @@ -437,15 +437,15 @@
url-template "^3.1.1"
urlpattern-polyfill "^10.1.0"

"@fedify/hono@1.10.10":
version "1.10.10"
resolved "https://registry.yarnpkg.com/@fedify/hono/-/hono-1.10.10.tgz#faa465ecef1d1100c751a9cff6d6dd13358f4367"
integrity sha512-0zInG7fR25ZetMgLaviIzsMRKG70UZRnjPka8QxfICMmkGNrv9l/+HfWsR9Yplukj71BfMdz1dduRwOzWGIShQ==
"@fedify/hono@1.10.11":
version "1.10.11"
resolved "https://registry.yarnpkg.com/@fedify/hono/-/hono-1.10.11.tgz#3d05942e7e0d52ef3b19d22f2e0b52cf9a1f876b"
integrity sha512-u+y0+iGOUE9kKHhxQ689H3uqX/Tr2SPCszMDoXLPC6TNvQ6JzZv8LfdXaFH81GYdpss6CFY1Xhgby/lsTgU6ng==

"@fedify/redis@1.10.10":
version "1.10.10"
resolved "https://registry.yarnpkg.com/@fedify/redis/-/redis-1.10.10.tgz#ae972ee01384baf4a0b8c5b90bfcb6d315330091"
integrity sha512-0X6pnLbPcNHPdo8GSb8WpD9TTh5cAnekBodGFQLfnBT7nZ5m+YUeQPuigu6ryRPe6pM7ByJFb+6M+zGSQ85QUA==
"@fedify/redis@1.10.11":
version "1.10.11"
resolved "https://registry.yarnpkg.com/@fedify/redis/-/redis-1.10.11.tgz#52320ecd659a72b108a35c509a14447305e58385"
integrity sha512-6JAs1ymP4/ycVnT1TM55vqWIpIgOq1baUlnvqk3sh9AfiX3l1ZVo53DU0WypXGNUvM1w76Ds99MjSJG6MVLzvg==
dependencies:
"@js-temporal/polyfill" "^0.5.1"
"@logtape/logtape" "^1.2.2"
Expand Down
Loading