Hashtag

#Hollo

56 posts tagged with this hashtag.

@navi@hey.pomnavi.net

Media proxy is a big feature, that means I'm not worried about filling up the disk space on my server anymore!

The new UI looks great too https://hollo.social/@hollo/019e451e-f368-70e2-b993-77d01a14a677

hollo.social

Hollo 0.9.0 is out. https://gi…

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496 The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout. Other highlights: - Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step - Full FEP-044f quote authorization: `QuoteRequest`/`Accept`/`Reject` federation, quote policy enforcement, and dereferenceable `QuoteAuthorization` objects - A configurable media proxy (`MEDIA_PROXY=proxy` or `cache`) that re-serves remote avatars, attachments, and preview images from Hollo's own origin - Optional split-domain WebFinger via `HANDLE_HOST` + `WEB_ORIGIN` - Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes) There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs. #Hollo #ActivityPub #Fediverse

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496

The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout.

Other highlights:

  • Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there's no separate TOTP step
  • Full FEP-044f quote authorization: QuoteRequest/Accept/Reject federation, quote policy enforcement, and dereferenceable QuoteAuthorization objects
  • A configurable media proxy (MEDIA_PROXY=proxy or cache) that re-serves remote avatars, attachments, and preview images from Hollo's own origin
  • Optional split-domain WebFinger via HANDLE_HOST + WEB_ORIGIN
  • Public followers/following pages and per-post reaction list pages (likes, boosts, emoji reactions, quotes)

There were also several serious database performance fixes: profile page queries that were taking hundreds of seconds on cold caches, a NodeInfo endpoint doing a full table scan on every request, and a handful of timeline pagination bugs.

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below
ALT text

Public profile for 洪 民憙 (Hong Minhee) with a bookstore header image, circular avatar, follower and following counts, bio, custom fields including website and GitHub links, and a pinned post card below

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button
ALT text

The “Edit @hongminhee” admin page showing the new Hollo design: profile image upload areas for avatar and header, identity fields for display name and bio, custom fields table with label-value pairs, privacy checkboxes, a 20-swatch theme color picker with orange selected, and a “Save changes” button

@hollo@hollo.social

What client apps do you use with ?

  • Elk8 (17%)
  • Phanpy15 (31%)
  • Moshidon11 (23%)
  • Subway Tooter4 (8%)
  • Mona2 (4%)
  • Nightfox DAWN7 (15%)
  • Tusker1 (2%)
  • Woolly0 (0%)
@hollo@hollo.social

🚨 Security Update: Hollo 0.6.5 Released

We've released 0.6.5 with a critical fix for CVE-2025-53941, addressing an HTML injection vulnerability in federated posts.

Please immediately to protect your instance from potential phishing and XSS attacks.

How to update:

  • Railway: Go to deployments → click three dots → Redeploy
  • Docker: docker pull ghcr.io/fedify-dev/hollo:latest and restart
  • Manual: git pull origin stable && pnpm install and restart server

github.com

Posts received with form elements are rendered allow submission

### Summary When an incoming post has form elements included, the elements are rendered and are submittable. Other platforms normally remove such elements before rendering. Please note that I a...

@hollo@hollo.social

We've released updates for (0.4.12, 0.5.7, and 0.6.6) to address a in the underlying framework. These updates incorporate the latest Fedify security patches that fix CVE-2025-54888.

We strongly recommend all Hollo instance administrators update to the latest version for their respective release branch as soon as possible.

Update Instructions:

  • Railway users: Go to your project dashboard, select your Hollo service, click the three dots menu in deployments, and choose “Redeploy”
  • Docker users: Pull the latest image with docker pull ghcr.io/fedify-dev/hollo:latest and restart your containers
  • Manual installations: Run git pull to get the latest code, then pnpm install and restart your service

github.com

Improper Authentication and Incorrect Authorization in @fedify/fedify

### Summary An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are...

@hollo@hollo.social

Security Update: Hollo 0.6.19 Released

We have released Hollo 0.6.19 to address a security vulnerability in Fedify's HTML parsing code.

This vulnerability (CVE-2025-68475) is a ReDoS (Regular Expression Denial of Service) issue that could allow an attacker to cause service unavailability by sending specially crafted HTML responses during federation operations. The malicious payload is small (approximately 170 bytes) but can block the Node.js event loop for extended periods.

We strongly recommend all Hollo operators upgrade to version 0.6.19 immediately.

Field Details
CVE CVE-2025-68475
Severity High (CVSS 7.5)
Action Upgrade to Hollo 0.6.19

github.com

ReDoS Vulnerability in HTML Parsing Regex

Hi Fedify team! 👋 Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Servic...

@hongminhee@hollo.social
@hongminhee@hollo.social

Hi and developers!

I'm currently working on interoperability testing for and , and I need a account to test federation with their implementation.

Since there aren't many open public Bonfire instances available, I was wondering if any Bonfire instance admins out there would be willing to grant me a test account? It would be a huge help for improving interop! Let me know if you can help. Thanks!

@navi@sakurajima.moe

After reading about the many people who self host their own fediverse instance, I wanted to give it a shot as well!

I won't be migrating this account, but you will see a follow request from one of my new accounts, @navi@hey.pomnavi.net

I'm trying out

@navi@sakurajima.moe

After reading about the many people who self host their own fediverse instance, I wanted to give it a shot as well!

I won't be migrating this account, but you will see a follow request from one of my new accounts, @navi@hey.pomnavi.net

I'm trying out

@hongminhee@hollo.social

Hi and developers!

I'm currently working on interoperability testing for and , and I need a account to test federation with their implementation.

Since there aren't many open public Bonfire instances available, I was wondering if any Bonfire instance admins out there would be willing to grant me a test account? It would be a huge help for improving interop! Let me know if you can help. Thanks!

@hongminhee@hollo.social
@hollo@hollo.social · Reply to Hollo :hollo:

セキュリティアップデート: Hollo 0.6.19 リリース

FedifyのHTMLパースコードにおけるセキュリティ脆弱性に対応したHollo 0.6.19をリリースしました。

この脆弱性 (CVE-2025-68475) は ReDoS (正規表現によるサービス拒否) の問題であり、攻撃者がフェデレーション操作中に特別に細工されたHTMLレスポンスを送信することで、サービス停止を引き起こす可能性があります。悪意のあるペイロードは小さい (約170バイト) ですが、Node.jsのイベントループを長時間ブロックする可能性があります。

すべてのHollo運営者の皆様には、直ちにバージョン 0.6.19 へのアップグレードを強くお勧めします。

項目 詳細
CVE CVE-2025-68475
深刻度 高 (CVSS 7.5)
対応 Hollo 0.6.19 にアップグレード

github.com

ReDoS Vulnerability in HTML Parsing Regex

Hi Fedify team! 👋 Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Servic...

@hollo@hollo.social · Reply to Hollo :hollo:

보안 업데이트: Hollo 0.6.19 릴리스

Fedify의 HTML 파싱 코드에서 발견된 보안 취약점을 수정한 Hollo 0.6.19를 릴리스했습니다.

이 취약점(CVE-2025-68475)은 ReDoS(정규 표현식 서비스 거부) 문제로, 공격자가 연합 작업 중 특수하게 조작된 HTML 응답을 보내 서비스 장애를 유발할 수 있습니다. 악성 페이로드는 작지만(약 170바이트), Node.js 이벤트 루프를 장시간 차단할 수 있습니다.

모든 Hollo 운영자분들께 즉시 버전 0.6.19로 업그레이드하실 것을 강력히 권고드립니다.

항목 상세
CVE CVE-2025-68475
심각도 높음 (CVSS 7.5)
조치 Hollo 0.6.19로 업그레이드

github.com

ReDoS Vulnerability in HTML Parsing Regex

Hi Fedify team! 👋 Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Servic...

@hollo@hollo.social

Security Update: Hollo 0.6.19 Released

We have released Hollo 0.6.19 to address a security vulnerability in Fedify's HTML parsing code.

This vulnerability (CVE-2025-68475) is a ReDoS (Regular Expression Denial of Service) issue that could allow an attacker to cause service unavailability by sending specially crafted HTML responses during federation operations. The malicious payload is small (approximately 170 bytes) but can block the Node.js event loop for extended periods.

We strongly recommend all Hollo operators upgrade to version 0.6.19 immediately.

Field Details
CVE CVE-2025-68475
Severity High (CVSS 7.5)
Action Upgrade to Hollo 0.6.19

github.com

ReDoS Vulnerability in HTML Parsing Regex

Hi Fedify team! 👋 Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Servic...

@hollo@hollo.social

0.7 brings a redesigned system with much better performance. We've moved from generating on-demand to storing them as they happen, which makes the notifications endpoint about 60% faster. We've also added response compression (though if you're using a reverse proxy, you probably had this already).

More notably, Hollo 0.7 implements Mastodon's v2 grouped notifications API. Notifications like favorites, follows, and reblogs targeting the same post or account are now grouped together server-side, reducing clutter. Clients that support the new API (introduced in 4.3) will show cleaner, more organized notifications automatically.

Hollo 0.7 is still in development, but we're excited to share it with you when it's ready!

@hollo@hollo.social

Security update: Hollo 0.6.12 is now available

We've released 0.6.12 to fix a critical privacy where direct messages were being exposed in the replies section of public posts. Please update your instances immediately to ensure your private conversations remain private.

@hollo@hollo.social · Reply to Hollo :hollo:

为了解决底层 Fedify 框架的安全漏洞,我们发布了 Hollo 安全更新。(0.4.120.5.70.6.6)这些更新包含了修复 CVE-2025-54888 的最新 Fedify 安全补丁。

我们强烈建议所有 Hollo 实例管理员尽快更新到相应发布分支的最新版本。

更新方法:

  • Railway 用户:进入项目仪表板,选择您的 Hollo 服务,点击部署中的三点菜单,然后选择"Redeploy"
  • Docker 用户:使用 docker pull ghcr.io/fedify-dev/hollo:latest 拉取最新镜像并重启容器
  • 手动安装用户:运行 git pull 获取最新代码,然后执行 pnpm install 并重启服务

github.com

Improper Authentication and Incorrect Authorization in @fedify/fedify

### Summary An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are...

@hollo@hollo.social · Reply to Hollo :hollo:

Fedify 프레임워크의 해결하기 위해 보안 업데이트를 릴리스했습니다 (0.4.12, 0.5.7, 0.6.6). 이번 업데이트는 CVE-2025-54888을 수정하는 최신 Fedify 보안 패치를 포함합니다.

모든 Hollo 인스턴스 관리자분들께서는 가능한 한 빨리 해당 릴리스 브랜치의 최신 버전으로 업데이트하시기를 강력히 권장합니다.

업데이트 방법:

  • Railway 사용자: 프로젝트 대시보드에서 Hollo 서비스를 선택하고, deployments의 점 세 개 메뉴를 클릭한 후 “Redeploy”를 선택하세요
  • Docker 사용자: docker pull ghcr.io/fedify-dev/hollo:latest로 최신 이미지를 받고 컨테이너를 재시작하세요
  • 수동 설치 사용자: git pull로 최신 코드를 받은 후 pnpm install을 실행하고 서비스를 재시작하세요

github.com

Improper Authentication and Incorrect Authorization in @fedify/fedify

### Summary An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are...

@hollo@hollo.social

We've released updates for (0.4.12, 0.5.7, and 0.6.6) to address a in the underlying framework. These updates incorporate the latest Fedify security patches that fix CVE-2025-54888.

We strongly recommend all Hollo instance administrators update to the latest version for their respective release branch as soon as possible.

Update Instructions:

  • Railway users: Go to your project dashboard, select your Hollo service, click the three dots menu in deployments, and choose “Redeploy”
  • Docker users: Pull the latest image with docker pull ghcr.io/fedify-dev/hollo:latest and restart your containers
  • Manual installations: Run git pull to get the latest code, then pnpm install and restart your service

github.com

Improper Authentication and Incorrect Authorization in @fedify/fedify

### Summary An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are...

@hollo@hollo.social · Reply to Hollo :hollo:

🚨 安全更新:Hollo 0.6.5 发布

我们发布了 0.6.5,修复了 CVE-2025-53941 关键安全漏洞,解决了联邦帖子中的 HTML 注入漏洞。

请立即更新以保护您的实例免受潜在的钓鱼和 XSS 攻击。

更新方法:

  • Railway:转到部署 → 点击三个点 → Redeploy
  • Docker:docker pull ghcr.io/fedify-dev/hollo:latest 然后重启
  • 手动:git pull origin stable && pnpm install 然后重启服务器

github.com

Posts received with form elements are rendered allow submission

### Summary When an incoming post has form elements included, the elements are rendered and are submittable. Other platforms normally remove such elements before rendering. Please note that I a...

@hollo@hollo.social · Reply to Hollo :hollo:

🚨 セキュリティアップデート:Hollo 0.6.5 リリース

CVE-2025-53941のセキュリティ脆弱性を修正したHollo 0.6.5をリリースしました。連合投稿のHTMLインジェクション脆弱性が修正されています。

フィッシングやXSS攻撃からインスタンスを保護するため、今すぐアップデートしてください

アップデート方法:

  • Railway:デプロイメント → 縦3点クリック → Redeploy
  • Docker:docker pull ghcr.io/fedify-dev/hollo:latest して再起動
  • 手動:git pull origin stable && pnpm install してサーバー再起動

github.com

Posts received with form elements are rendered allow submission

### Summary When an incoming post has form elements included, the elements are rendered and are submittable. Other platforms normally remove such elements before rendering. Please note that I a...

@hollo@hollo.social · Reply to Hollo :hollo:

🚨 보안 업데이트: Hollo 0.6.5 릴리스

CVE-2025-53941 취약점을 해결하는 0.6.5를 릴리스했습니다. 연합 게시물의 HTML 주입 취약점이 수정되었습니다.

피싱 및 XSS 공격으로부터 인스턴스를 보호하기 위해 즉시 업데이트해 주세요.

업데이트 방법:

  • Railway: 배포 탭 → 점 세 개 클릭 → Redeploy
  • Docker: docker pull ghcr.io/fedify-dev/hollo:latest 후 재시작
  • 수동: git pull origin stable && pnpm install 후 서버 재시작

github.com

Posts received with form elements are rendered allow submission

### Summary When an incoming post has form elements included, the elements are rendered and are submittable. Other platforms normally remove such elements before rendering. Please note that I a...

@hollo@hollo.social

🚨 Security Update: Hollo 0.6.5 Released

We've released 0.6.5 with a critical fix for CVE-2025-53941, addressing an HTML injection vulnerability in federated posts.

Please immediately to protect your instance from potential phishing and XSS attacks.

How to update:

  • Railway: Go to deployments → click three dots → Redeploy
  • Docker: docker pull ghcr.io/fedify-dev/hollo:latest and restart
  • Manual: git pull origin stable && pnpm install and restart server

github.com

Posts received with form elements are rendered allow submission

### Summary When an incoming post has form elements included, the elements are rendered and are submittable. Other platforms normally remove such elements before rendering. Please note that I a...

@hollo@hollo.social

What client apps do you use with ?

  • Elk8 (17%)
  • Phanpy15 (31%)
  • Moshidon11 (23%)
  • Subway Tooter4 (8%)
  • Mona2 (4%)
  • Nightfox DAWN7 (15%)
  • Tusker1 (2%)
  • Woolly0 (0%)
@hollo@hollo.social

みなさん、こんにちは! :hollo:

Holloの新しい計画について、みなさんのご意見をお聞かせください。

これまでHolloは、セルフホスティングを基本原則としてきました。これは今後も変わることなく維持され、ソースコードは引き続きAGPLv3ライセンスで公開されます。

最近、プロジェクトの持続可能な発展のため、Open Collective (@opencollective )を通じて一定額以上を定期的にご支援いただいている方々向けに、ホスティングサービスの提供を検討しています。

これは、技術的な部分を気にすることなくHolloを利用したい方のための追加オプションとなります。もちろん、現在のように自身でインストールして運用することも引き続き可能です。

引用させていただいた英語の投稿のアンケートにご参加ください!📊

  1. 良いアイデアです!ホスティングサービスを利用したいです。
  2. いいですね!私はセルフホスティングを続けますが、応援しています。
  3. 他の方法でサポートを増やすのが良いと思います。
  4. 現状通り純粋なセルフホスティングのままが良いです。

💭 追加のご意見やご提案がございましたら、コメントでお寄せください!

https://hollo.social/@hollo/01950344-1c55-7f43-8afc-b0a1ee8b4abf

hollo.social

#Hollo everyone! :hollo: We'd…

#Hollo everyone! :hollo: We'd like to hear your thoughts on something we've been considering. As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license. We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective@opencollective.com. This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now. What are your thoughts on this idea? Please vote below! 📊 💭 Have additional thoughts or suggestions? Feel free to share them in the comments! #poll #fediverse

@hollo@hollo.social

everyone! :hollo:

We'd like to hear your thoughts on something we've been considering.

As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license.

We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective.

This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now.

What are your thoughts on this idea? Please vote below! 📊

💭 Have additional thoughts or suggestions? Feel free to share them in the comments!

  • 1️⃣ Great idea! I'd be interested in supporting and using the hosted service.26 (45%)
  • 2️⃣ Sounds good! I'll stick to self-hosting but support the initiative.29 (50%)
  • 3️⃣ I think we should explore other ways to increase support.2 (3%)
  • 4️⃣ I prefer Hollo to remain purely self-hosted.1 (2%)
@hollo@hollo.social

안녕하세요! :hollo:

Hollo의 새로운 계획에 대해 여러분의 의견을 듣고자 합니다.

지금까지 Hollo는 셀프 호스팅을 기본 원칙으로 삼아왔습니다. 이는 앞으로도 변함없이 유지될 것이며, 소스 코드는 계속해서 AGPLv3 라이선스로 공개됩니다.

최근 저희는 프로젝트의 지속 가능한 발전을 위해, Open Collective(@opencollective)를 통해 일정 금액 이상을 정기적으로 후원해 주시는 분들을 위한 호스팅 서비스 제공을 검토하고 있습니다.

이는 기술적인 부분에 신경 쓰지 않고도 Hollo를 이용하고 싶으신 분들을 위한 추가 옵션이 될 것입니다. 물론 지금처럼 직접 설치하고 운영하시는 것도 계속 가능합니다.

아래 인용된 영어 게시물의 투표에 참여해 주시면 감사하겠습니다! 📊

  1. 좋은 생각입니다! 호스팅 서비스를 이용하고 싶어요.
  2. 괜찮네요! 전 셀프 호스팅을 계속하지만 응원합니다.
  3. 다른 방식으로 후원을 늘리는 게 좋겠어요.
  4. 현재처럼 순수 셀프 호스팅으로 남았으면 좋겠어요.

💭 추가 의견이나 제안이 있으시다면 댓글로 남겨주세요!

https://hollo.social/@hollo/01950344-1c55-7f43-8afc-b0a1ee8b4abf

hollo.social

#Hollo everyone! :hollo: We'd…

#Hollo everyone! :hollo: We'd like to hear your thoughts on something we've been considering. As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license. We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective@opencollective.com. This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now. What are your thoughts on this idea? Please vote below! 📊 💭 Have additional thoughts or suggestions? Feel free to share them in the comments! #poll #fediverse

@hollo@hollo.social

everyone! :hollo:

We'd like to hear your thoughts on something we've been considering.

As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license.

We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective.

This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now.

What are your thoughts on this idea? Please vote below! 📊

💭 Have additional thoughts or suggestions? Feel free to share them in the comments!

  • 1️⃣ Great idea! I'd be interested in supporting and using the hosted service.26 (45%)
  • 2️⃣ Sounds good! I'll stick to self-hosting but support the initiative.29 (50%)
  • 3️⃣ I think we should explore other ways to increase support.2 (3%)
  • 4️⃣ I prefer Hollo to remain purely self-hosted.1 (2%)
@hollo@hollo.social · Reply to Hollo :hollo:

みなさん、こんにちは! :hollo:

Holloの新しい計画について、みなさんのご意見をお聞かせください。

これまでHolloは、セルフホスティングを基本原則としてきました。これは今後も変わることなく維持され、ソースコードは引き続きAGPLv3ライセンスで公開されます。

最近、プロジェクトの持続可能な発展のため、Open Collective (@opencollective )を通じて一定額以上を定期的にご支援いただいている方々向けに、ホスティングサービスの提供を検討しています。

これは、技術的な部分を気にすることなくHolloを利用したい方のための追加オプションとなります。もちろん、現在のように自身でインストールして運用することも引き続き可能です。

引用させていただいた英語の投稿のアンケートにご参加ください!📊

  1. 良いアイデアです!ホスティングサービスを利用したいです。
  2. いいですね!私はセルフホスティングを続けますが、応援しています。
  3. 他の方法でサポートを増やすのが良いと思います。
  4. 現状通り純粋なセルフホスティングのままが良いです。

💭 追加のご意見やご提案がございましたら、コメントでお寄せください!

https://hollo.social/@hollo/01950344-1c55-7f43-8afc-b0a1ee8b4abf

hollo.social

#Hollo everyone! :hollo: We'd…

#Hollo everyone! :hollo: We'd like to hear your thoughts on something we've been considering. As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license. We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective@opencollective.com. This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now. What are your thoughts on this idea? Please vote below! 📊 💭 Have additional thoughts or suggestions? Feel free to share them in the comments! #poll #fediverse

@hollo@hollo.social

everyone! :hollo:

We'd like to hear your thoughts on something we've been considering.

As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license.

We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective.

This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now.

What are your thoughts on this idea? Please vote below! 📊

💭 Have additional thoughts or suggestions? Feel free to share them in the comments!

  • 1️⃣ Great idea! I'd be interested in supporting and using the hosted service.26 (45%)
  • 2️⃣ Sounds good! I'll stick to self-hosting but support the initiative.29 (50%)
  • 3️⃣ I think we should explore other ways to increase support.2 (3%)
  • 4️⃣ I prefer Hollo to remain purely self-hosted.1 (2%)
@hollo@hollo.social · Reply to Hollo :hollo:

안녕하세요! :hollo:

Hollo의 새로운 계획에 대해 여러분의 의견을 듣고자 합니다.

지금까지 Hollo는 셀프 호스팅을 기본 원칙으로 삼아왔습니다. 이는 앞으로도 변함없이 유지될 것이며, 소스 코드는 계속해서 AGPLv3 라이선스로 공개됩니다.

최근 저희는 프로젝트의 지속 가능한 발전을 위해, Open Collective(@opencollective)를 통해 일정 금액 이상을 정기적으로 후원해 주시는 분들을 위한 호스팅 서비스 제공을 검토하고 있습니다.

이는 기술적인 부분에 신경 쓰지 않고도 Hollo를 이용하고 싶으신 분들을 위한 추가 옵션이 될 것입니다. 물론 지금처럼 직접 설치하고 운영하시는 것도 계속 가능합니다.

아래 인용된 영어 게시물의 투표에 참여해 주시면 감사하겠습니다! 📊

  1. 좋은 생각입니다! 호스팅 서비스를 이용하고 싶어요.
  2. 괜찮네요! 전 셀프 호스팅을 계속하지만 응원합니다.
  3. 다른 방식으로 후원을 늘리는 게 좋겠어요.
  4. 현재처럼 순수 셀프 호스팅으로 남았으면 좋겠어요.

💭 추가 의견이나 제안이 있으시다면 댓글로 남겨주세요!

https://hollo.social/@hollo/01950344-1c55-7f43-8afc-b0a1ee8b4abf

hollo.social

#Hollo everyone! :hollo: We'd…

#Hollo everyone! :hollo: We'd like to hear your thoughts on something we've been considering. As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license. We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective@opencollective.com. This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now. What are your thoughts on this idea? Please vote below! 📊 💭 Have additional thoughts or suggestions? Feel free to share them in the comments! #poll #fediverse

@hollo@hollo.social

everyone! :hollo:

We'd like to hear your thoughts on something we've been considering.

As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license.

We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective.

This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now.

What are your thoughts on this idea? Please vote below! 📊

💭 Have additional thoughts or suggestions? Feel free to share them in the comments!

  • 1️⃣ Great idea! I'd be interested in supporting and using the hosted service.26 (45%)
  • 2️⃣ Sounds good! I'll stick to self-hosting but support the initiative.29 (50%)
  • 3️⃣ I think we should explore other ways to increase support.2 (3%)
  • 4️⃣ I prefer Hollo to remain purely self-hosted.1 (2%)
@hollo@hollo.social

everyone! :hollo:

We'd like to hear your thoughts on something we've been considering.

As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license.

We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective.

This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now.

What are your thoughts on this idea? Please vote below! 📊

💭 Have additional thoughts or suggestions? Feel free to share them in the comments!

  • 1️⃣ Great idea! I'd be interested in supporting and using the hosted service.26 (45%)
  • 2️⃣ Sounds good! I'll stick to self-hosting but support the initiative.29 (50%)
  • 3️⃣ I think we should explore other ways to increase support.2 (3%)
  • 4️⃣ I prefer Hollo to remain purely self-hosted.1 (2%)
@hollo@hollo.social · Reply to Hollo :hollo:

저장소가 @dahlia/hollo에서 @fedify-dev/hollo로 이전되었습니다. 이에 따라 이미지 레지스트리도 ghcr.io/dahlia/hollo에서 ghcr.io/fedify-dev/hollo로 이전되었습니다.

기존 이미지 레지스트리는 계속 접근 가능하지만, 새로운 태그는 더 이상 추가되지 않을 예정입니다. Hollo를 사용 중이신 모든 분들은 새로운 레지스트리 주소로 업데이트해 주시기 바랍니다.

Docker 설정을 다음과 같이 변경해 주세요:

  • 기존 이미지 주소: ghcr.io/dahlia/hollo:latest
  • 새 이미지 주소: ghcr.io/fedify-dev/hollo:latest

이번 이전은 프로젝트의 더 나은 운영과 지속적인 개발을 위해 진행되었습니다. 원활한 전환에 협조해 주셔서 감사합니다. :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

hollo.social

We've just moved the #Fedify p…

We've just moved the #Fedify project and related repositories to our new GitHub organization account, [@fedify-dev]! 🎉 Here's what moved: - [@dahlia/fedify](https://github.com/dahlia/fedify) → [@fedify-dev/fedify](https://github.com/fedify-dev/fedify) - [@dahlia/botkit](https://github.com/dahlia/botkit) → [@fedify-dev/botkit](https://github.com/fedify-dev/botkit) - [@dahlia/hollo](https://github.com/dahlia/hollo) → [@fedify-dev/hollo](https://github.com/fedify-dev/hollo) - [@dahlia/fedify-amqp](https://github.com/dahlia/fedify-amqp) → [@fedify-dev/amqp](https://github.com/fedify-dev/amqp) - [@dahlia/fedify-h3](https://github.com/dahlia/fedify-h3) → [@fedify-dev/h3](https://github.com/fedify-dev/h3) - [@dahlia/fedify-express](https://github.com/dahlia/fedify-express) → [@fedify-dev/express](https://github.com/fedify-dev/express) - [@dahlia/fedify-postgres](https://github.com/dahlia/fedify-postgres) → [@fedify-dev/postgres](https://github.com/fedify-dev/postgres) - [@dahlia/fedify-redis](https://github.com/dahlia/fedify-redis) → [@fedify-dev/redis](https://github.com/fedify-dev/redis) - [@dahlia/markdown-it-hashtag](https://github.com/dahlia/markdown-it-hashtag) → [@fedify-dev/markdown-it-hashtag](https://github.com/fedify-dev/markdown-it-hashtag) - [@dahlia/markdown-it-mention](https://github.com/dahlia/markdown-it-mention) → [@fedify-dev/markdown-it-mention](https://github.com/fedify-dev/markdown-it-mention) - [@dahlia/fedichatbot](https://github.com/dahlia/fedichatbot) → [@fedify-dev/fedichatbot](https://github.com/fedify-dev/fedichatbot) - [@dahlia/microblog](https://github.com/dahlia/microblog) → [@fedify-dev/microblog](https://github.com/fedify-dev/microblog) All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged. Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home! :fedify: New GitHub organization: <https://github.com/fedify-dev>. [@fedify-dev]: https://github.com/fedify-dev

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

github.com

Fedify

A collection of development tools for fediverse. Fedify has 24 repositories available. Follow their code on GitHub.

@hollo@hollo.social · Reply to Hollo :hollo:

Holloのリポジトリが@dahlia/holloから@fedify-dev/holloに移行いたしました。これに伴い、Dockerイメージレジストリもghcr.io/dahlia/holloからghcr.io/fedify-dev/holloに移行しております。

旧イメージレジストリは引き続きアクセス可能ですが、新しいタグの追加は行われません。Holloをご利用の皆様には、新しいレジストリアドレスへの更新をお願いいたします。

Dockerの設定を以下のように更新してください:

  • 旧アドレス:ghcr.io/dahlia/hollo:latest
  • 新アドレス:ghcr.io/fedify-dev/hollo:latest

この移行はプロジェクトのより良い運営と継続的な開発のために行われました。円滑な移行にご協力いただき、誠にありがとうございます。 :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

hollo.social

We've just moved the #Fedify p…

We've just moved the #Fedify project and related repositories to our new GitHub organization account, [@fedify-dev]! 🎉 Here's what moved: - [@dahlia/fedify](https://github.com/dahlia/fedify) → [@fedify-dev/fedify](https://github.com/fedify-dev/fedify) - [@dahlia/botkit](https://github.com/dahlia/botkit) → [@fedify-dev/botkit](https://github.com/fedify-dev/botkit) - [@dahlia/hollo](https://github.com/dahlia/hollo) → [@fedify-dev/hollo](https://github.com/fedify-dev/hollo) - [@dahlia/fedify-amqp](https://github.com/dahlia/fedify-amqp) → [@fedify-dev/amqp](https://github.com/fedify-dev/amqp) - [@dahlia/fedify-h3](https://github.com/dahlia/fedify-h3) → [@fedify-dev/h3](https://github.com/fedify-dev/h3) - [@dahlia/fedify-express](https://github.com/dahlia/fedify-express) → [@fedify-dev/express](https://github.com/fedify-dev/express) - [@dahlia/fedify-postgres](https://github.com/dahlia/fedify-postgres) → [@fedify-dev/postgres](https://github.com/fedify-dev/postgres) - [@dahlia/fedify-redis](https://github.com/dahlia/fedify-redis) → [@fedify-dev/redis](https://github.com/fedify-dev/redis) - [@dahlia/markdown-it-hashtag](https://github.com/dahlia/markdown-it-hashtag) → [@fedify-dev/markdown-it-hashtag](https://github.com/fedify-dev/markdown-it-hashtag) - [@dahlia/markdown-it-mention](https://github.com/dahlia/markdown-it-mention) → [@fedify-dev/markdown-it-mention](https://github.com/fedify-dev/markdown-it-mention) - [@dahlia/fedichatbot](https://github.com/dahlia/fedichatbot) → [@fedify-dev/fedichatbot](https://github.com/fedify-dev/fedichatbot) - [@dahlia/microblog](https://github.com/dahlia/microblog) → [@fedify-dev/microblog](https://github.com/fedify-dev/microblog) All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged. Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home! :fedify: New GitHub organization: <https://github.com/fedify-dev>. [@fedify-dev]: https://github.com/fedify-dev

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

github.com

Fedify

A collection of development tools for fediverse. Fedify has 24 repositories available. Follow their code on GitHub.

@hollo@hollo.social

The repository has moved from @dahlia/hollo to @fedify-dev/hollo! Along with this move, our image registry has also been relocated from ghcr.io/dahlia/hollo to ghcr.io/fedify-dev/hollo.

While the old image registry will remain accessible, it won't receive any new tags. We recommend all Hollo users to update their Docker image references to the new registry address.

To update your Docker configurations, please change:

  • From: ghcr.io/dahlia/hollo:latest
  • To: ghcr.io/fedify-dev/hollo:latest

The migration ensures better project organization and continued development. Thank you for your understanding and cooperation in making this transition smooth! :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

hollo.social

We've just moved the #Fedify p…

We've just moved the #Fedify project and related repositories to our new GitHub organization account, [@fedify-dev]! 🎉 Here's what moved: - [@dahlia/fedify](https://github.com/dahlia/fedify) → [@fedify-dev/fedify](https://github.com/fedify-dev/fedify) - [@dahlia/botkit](https://github.com/dahlia/botkit) → [@fedify-dev/botkit](https://github.com/fedify-dev/botkit) - [@dahlia/hollo](https://github.com/dahlia/hollo) → [@fedify-dev/hollo](https://github.com/fedify-dev/hollo) - [@dahlia/fedify-amqp](https://github.com/dahlia/fedify-amqp) → [@fedify-dev/amqp](https://github.com/fedify-dev/amqp) - [@dahlia/fedify-h3](https://github.com/dahlia/fedify-h3) → [@fedify-dev/h3](https://github.com/fedify-dev/h3) - [@dahlia/fedify-express](https://github.com/dahlia/fedify-express) → [@fedify-dev/express](https://github.com/fedify-dev/express) - [@dahlia/fedify-postgres](https://github.com/dahlia/fedify-postgres) → [@fedify-dev/postgres](https://github.com/fedify-dev/postgres) - [@dahlia/fedify-redis](https://github.com/dahlia/fedify-redis) → [@fedify-dev/redis](https://github.com/fedify-dev/redis) - [@dahlia/markdown-it-hashtag](https://github.com/dahlia/markdown-it-hashtag) → [@fedify-dev/markdown-it-hashtag](https://github.com/fedify-dev/markdown-it-hashtag) - [@dahlia/markdown-it-mention](https://github.com/dahlia/markdown-it-mention) → [@fedify-dev/markdown-it-mention](https://github.com/fedify-dev/markdown-it-mention) - [@dahlia/fedichatbot](https://github.com/dahlia/fedichatbot) → [@fedify-dev/fedichatbot](https://github.com/fedify-dev/fedichatbot) - [@dahlia/microblog](https://github.com/dahlia/microblog) → [@fedify-dev/microblog](https://github.com/fedify-dev/microblog) All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged. Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home! :fedify: New GitHub organization: <https://github.com/fedify-dev>. [@fedify-dev]: https://github.com/fedify-dev

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

github.com

Fedify

A collection of development tools for fediverse. Fedify has 24 repositories available. Follow their code on GitHub.

@hollo@hollo.social

Once we have a @fedify org account, we'll be moving 's repository there as well.

https://hollo.social/@fedify/01949657-262f-78f4-a9a0-97643682ea70

hollo.social

We're planning to move our [Gi…

We're planning to move our [GitHub repository] to an organization account for better project management. We've requested GitHub support to help us acquire the inactive [@fedify] username for this purpose. (The attached screenshot is our formal request to GitHub support.) If we successfully acquire [@fedify], that will be our new organization name. If not, we'll choose an alternative name. We'll keep you updated on the progress! In any case, we'll ensure a smooth transition with proper redirects from the current repository. Stay tuned for updates! [GitHub repository]: https://github.com/dahlia/fedify [@fedify]: https://github.com/fedify

We're planning to move our GitHub repository to an organization account for better project management. We've requested GitHub support to help us acquire the inactive @fedify username for this purpose. (The attached screenshot is our formal request to GitHub support.)

If we successfully acquire @fedify, that will be our new organization name. If not, we'll choose an alternative name. We'll keep you updated on the progress!

In any case, we'll ensure a smooth transition with proper redirects from the current repository. Stay tuned for updates!

Dear GitHub Support,

I am writing to request the takeover of the inactive GitHub username “@fedify”. This username is currently held by an account that shows no activity since its creation—no repositories, contributions, or any other engagement.

I am the maintainer of the Fedify project (https://github.com/dahlia/fedify), which is an open source ActivityPub server framework. We would like to use this username as an organization account to host our project and related repositories.

The reasons for this request are:

1. The current “@fedify” account has been completely inactive with no public contributions or repositories
2. The name directly relates to our project's name and purpose
3. We need an organization account to better manage our growing open source project
4. The username would help us maintain consistent branding across different platforms (@fedify on npm, JSR, etc.)

If possible, we would greatly appreciate if you could help us acquire this username. We believe this would benefit the GitHub community by putting the inactive username to active use for an open source project.

Please let me know if you need any additional information to process this request.

Thank you for your time and consideration.

Best regards,
Hong Minhee (@dahlia)
ALT text

Dear GitHub Support, I am writing to request the takeover of the inactive GitHub username “@fedify”. This username is currently held by an account that shows no activity since its creation—no repositories, contributions, or any other engagement. I am the maintainer of the Fedify project (https://github.com/dahlia/fedify), which is an open source ActivityPub server framework. We would like to use this username as an organization account to host our project and related repositories. The reasons for this request are: 1. The current “@fedify” account has been completely inactive with no public contributions or repositories 2. The name directly relates to our project's name and purpose 3. We need an organization account to better manage our growing open source project 4. The username would help us maintain consistent branding across different platforms (@fedify on npm, JSR, etc.) If possible, we would greatly appreciate if you could help us acquire this username. We believe this would benefit the GitHub community by putting the inactive username to active use for an open source project. Please let me know if you need any additional information to process this request. Thank you for your time and consideration. Best regards, Hong Minhee (@dahlia)

@hollo@hollo.social · Reply to Hollo :hollo:

この件に関連して、Holloもセキュリティアップデートをリリースしました。0.3.6または0.4.4バージョンに今すぐアップデートしてください!

https://hollo.social/@fedify/0194848e-7cac-7af3-941b-c93999a51274

hollo.social

FedifyのWebFinger実装における脆弱性[CVE-…

FedifyのWebFinger実装における脆弱性[CVE-2025-23221]に対するセキュリティアップデート([1.0.14]、[1.1.11]、[1.2.11]、[1.3.4])をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。 [1.0.14]: https://github.com/dahlia/fedify/releases/tag/1.0.14 [1.1.11]: https://github.com/dahlia/fedify/releases/tag/1.1.11 [1.2.11]: https://github.com/dahlia/fedify/releases/tag/1.2.11 [1.3.4]: https://github.com/dahlia/fedify/releases/tag/1.3.4 [CVE-2025-23221]: https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx ## 脆弱性の詳細 セキュリティ研究者により、Fedifyの`lookupWebFinger()`関数において以下のセキュリティ上の問題が発見されました: - 無限リダイレクトループによるサービス拒否攻撃(DoS)の可能性 - プライベートネットワークアドレスへのリダイレクトを利用したSSRF(サーバーサイドリクエストフォージェリ)攻撃の可能性 - リダイレクト操作による意図しないURLスキームへのアクセスの可能性 ## 修正されたバージョン - 1.3.xシリーズ:[1.3.4]へアップデート - 1.2.xシリーズ:[1.2.11]へアップデート - 1.1.xシリーズ:[1.1.11]へアップデート - 1.0.xシリーズ:[1.0.14]へアップデート ## 変更内容 本セキュリティアップデートでは、以下の修正が実施されました: 1. 無限リダイレクトループを防ぐため、最大リダイレクト回数(5回)の制限を導入 2. 元のリクエストと同じスキーム(HTTP/HTTPS)のみにリダイレクトを制限 3. SSRFを防止するため、プライベートネットワークアドレスへのリダイレクトをブロック ## アップデート方法 以下のコマンドで最新のセキュアバージョンにアップデートできます: ```sh # npmユーザーの場合 npm update @fedify/fedify # Denoユーザーの場合 deno add jsr:@fedify/fedify ``` この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。 本脆弱性の詳細については、[セキュリティ勧告][CVE-2025-23221]をご参照ください。 --- ご質問やご懸念がございましたら、[GitHub Discussions](https://github.com/dahlia/fedify/discussions)、[Matrixチャットスペース](https://matrix.to/#/#fedify:matrix.org)、または[Discordサーバー](https://discord.gg/bhtwpzURwd)までお気軽にご連絡ください。 #Fedify #WebFinger #セキュリティ #脆弱性 #DoS #SSRF

FedifyのWebFinger実装における脆弱性CVE-2025-23221に対するセキュリティアップデート(1.0.141.1.111.2.111.3.4)をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。

脆弱性の詳細

セキュリティ研究者により、FedifyのlookupWebFinger()関数において以下のセキュリティ上の問題が発見されました:

  • 無限リダイレクトループによるサービス拒否攻撃(DoS)の可能性
  • プライベートネットワークアドレスへのリダイレクトを利用したSSRF(サーバーサイドリクエストフォージェリ)攻撃の可能性
  • リダイレクト操作による意図しないURLスキームへのアクセスの可能性

修正されたバージョン

  • 1.3.xシリーズ:1.3.4へアップデート
  • 1.2.xシリーズ:1.2.11へアップデート
  • 1.1.xシリーズ:1.1.11へアップデート
  • 1.0.xシリーズ:1.0.14へアップデート

変更内容

本セキュリティアップデートでは、以下の修正が実施されました:

  1. 無限リダイレクトループを防ぐため、最大リダイレクト回数(5回)の制限を導入
  2. 元のリクエストと同じスキーム(HTTP/HTTPS)のみにリダイレクトを制限
  3. SSRFを防止するため、プライベートネットワークアドレスへのリダイレクトをブロック

アップデート方法

以下のコマンドで最新のセキュアバージョンにアップデートできます:

# npmユーザーの場合
npm update @fedify/fedify

# Denoユーザーの場合
deno add jsr:@fedify/fedify

この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。

本脆弱性の詳細については、セキュリティ勧告をご参照ください。


ご質問やご懸念がございましたら、GitHub DiscussionsMatrixチャットスペース、またはDiscordサーバーまでお気軽にご連絡ください。

discord.com

Fedify & Hollo Discord 서버에 가입하세요!

The official community for Fedify & Hollo! Join users and contributors to discuss, collaborate, and build the fediverse together. Get help with Fedify's ActivityPub framework or Hollo instances, share ideas, and connect with developers passionate about decentralized social networking. | 멤버 133명

@hollo@hollo.social · Reply to Hollo :hollo:

이와 관련하여, 역시 업데이트가 이뤄졌습니다. 0.3.6 또는 0.4.4 버전으로 바로 업데이트하시기 바랍니다!

https://hollo.social/@fedify/0194848b-3b9e-7da1-b631-c011db2f4c43

hollo.social

#Fedify 프레임워크의 #WebFinger 구현에서…

#Fedify 프레임워크의 #WebFinger 구현에서 발견된 보안 취약점 [CVE-2025-23221]을 해결하기 위한 보안 업데이트([1.0.14], [1.1.11], [1.2.11], [1.3.4])를 배포했습니다. 모든 사용자께서는 각자 사용 중인 버전에 해당하는 최신 버전으로 즉시 업데이트하시기를 권장합니다. [1.0.14]: https://github.com/dahlia/fedify/releases/tag/1.0.14 [1.1.11]: https://github.com/dahlia/fedify/releases/tag/1.1.11 [1.2.11]: https://github.com/dahlia/fedify/releases/tag/1.2.11 [1.3.4]: https://github.com/dahlia/fedify/releases/tag/1.3.4 [CVE-2025-23221]: https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx ## 취약점 내용 보안 연구자가 Fedify의 `lookupWebFinger()` 함수에서 다음과 같은 보안 문제점들을 발견했습니다: - 무한 리다이렉트 루프를 통한 서비스 거부 공격 가능 - 내부 네트워크 주소로의 리다이렉트를 통한 SSRF (서버측 요청 위조) 공격 가능 - 리다이렉트 조작을 통한 의도하지 않은 URL 스킴 접근 가능 ## 수정된 버전 - 1.3.x 시리즈: [1.3.4]로 업데이트 - 1.2.x 시리즈: [1.2.11]로 업데이트 - 1.1.x 시리즈: [1.1.11]로 업데이트 - 1.0.x 시리즈: [1.0.14]로 업데이트 ## 변경 사항 이번 보안 업데이트에는 다음과 같은 수정 사항이 포함되어 있습니다: 1. 무한 리다이렉트 루프를 방지하기 위해 최대 리다이렉트 횟수 제한(5회) 도입 2. 원래 요청과 동일한 스킴(HTTP/HTTPS)으로만 리다이렉트 허용하도록 제한 3. SSRF 공격 방지를 위해 내부 네트워크 주소로의 리다이렉트 차단 ## 업데이트 방법 다음 명령어로 최신 보안 버전으로 업데이트하실 수 있습니다: ```sh # npm 사용자의 경우 npm update @fedify/fedify # Deno 사용자의 경우 deno add jsr:@fedify/fedify ``` 이 취약점을 책임감 있게 보고해 주신 보안 연구자께 감사드립니다. 덕분에 신속하게 문제를 해결할 수 있었습니다. 이 취약점에 대한 자세한 내용은 [보안 권고문][CVE-2025-23221]을 참고해 주시기 바랍니다. --- 문의 사항이나 우려 사항이 있으시다면 [GitHub Discussions](https://github.com/dahlia/fedify/discussions)나 [Matrix 채팅방](https://matrix.to/#/#fedify:matrix.org), 또는 [Discord 서버](https://discord.gg/bhtwpzURwd)를 통해 언제든 연락해 주시기 바랍니다. #보안 #보안패치 #취약점 #SSRF

프레임워크의 구현에서 발견된 보안 취약점 CVE-2025-23221을 해결하기 위한 보안 업데이트(1.0.14, 1.1.11, 1.2.11, 1.3.4)를 배포했습니다. 모든 사용자께서는 각자 사용 중인 버전에 해당하는 최신 버전으로 즉시 업데이트하시기를 권장합니다.

취약점 내용

보안 연구자가 Fedify의 lookupWebFinger() 함수에서 다음과 같은 보안 문제점들을 발견했습니다:

  • 무한 리다이렉트 루프를 통한 서비스 거부 공격 가능
  • 내부 네트워크 주소로의 리다이렉트를 통한 SSRF (서버측 요청 위조) 공격 가능
  • 리다이렉트 조작을 통한 의도하지 않은 URL 스킴 접근 가능

수정된 버전

  • 1.3.x 시리즈: 1.3.4로 업데이트
  • 1.2.x 시리즈: 1.2.11로 업데이트
  • 1.1.x 시리즈: 1.1.11로 업데이트
  • 1.0.x 시리즈: 1.0.14로 업데이트

변경 사항

이번 보안 업데이트에는 다음과 같은 수정 사항이 포함되어 있습니다:

  1. 무한 리다이렉트 루프를 방지하기 위해 최대 리다이렉트 횟수 제한(5회) 도입
  2. 원래 요청과 동일한 스킴(HTTP/HTTPS)으로만 리다이렉트 허용하도록 제한
  3. SSRF 공격 방지를 위해 내부 네트워크 주소로의 리다이렉트 차단

업데이트 방법

다음 명령어로 최신 보안 버전으로 업데이트하실 수 있습니다:

# npm 사용자의 경우
npm update @fedify/fedify

# Deno 사용자의 경우
deno add jsr:@fedify/fedify

이 취약점을 책임감 있게 보고해 주신 보안 연구자께 감사드립니다. 덕분에 신속하게 문제를 해결할 수 있었습니다.

이 취약점에 대한 자세한 내용은 보안 권고문을 참고해 주시기 바랍니다.


문의 사항이나 우려 사항이 있으시다면 GitHub DiscussionsMatrix 채팅방, 또는 Discord 서버를 통해 언제든 연락해 주시기 바랍니다.

discord.com

Fedify & Hollo Discord 서버에 가입하세요!

The official community for Fedify & Hollo! Join users and contributors to discuss, collaborate, and build the fediverse together. Get help with Fedify's ActivityPub framework or Hollo instances, share ideas, and connect with developers passionate about decentralized social networking. | 멤버 133명

@hollo@hollo.social

In related news, has also released updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

hollo.social

We have released #security upd…

We have released #security updates ([1.0.14], [1.1.11], [1.2.11], [1.3.4]) to address [CVE-2025-23221], a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately. [1.0.14]: https://github.com/dahlia/fedify/releases/tag/1.0.14 [1.1.11]: https://github.com/dahlia/fedify/releases/tag/1.1.11 [1.2.11]: https://github.com/dahlia/fedify/releases/tag/1.2.11 [1.3.4]: https://github.com/dahlia/fedify/releases/tag/1.3.4 [CVE-2025-23221]: https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx ## The Vulnerability A security researcher identified multiple security issues in Fedify's `lookupWebFinger()` function that could be exploited to: - Perform denial of service attacks through infinite redirect loops - Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses - Access unintended URL schemes through redirect manipulation ## Fixed Versions - 1.3.x series: Update to [1.3.4] - 1.2.x series: Update to [1.2.11] - 1.1.x series: Update to [1.1.11] - 1.0.x series: Update to [1.0.14] ## Changes The security updates implement the following fixes: 1. Added a maximum redirect limit (5) to prevent infinite redirect loops 2. Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS) 3. Blocked redirects to private network addresses to prevent SSRF attacks ## How to Update To update to the latest secure version: ```sh # For npm users npm update @fedify/fedify # For Deno users deno add jsr:@fedify/fedify ``` We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly. For more details about this vulnerability, please refer to our [security advisory][CVE-2025-23221]. --- If you have any questions or concerns, please don't hesitate to reach out through our [GitHub Discussions](https://github.com/dahlia/fedify/discussions), join our [Matrix chat space](https://matrix.to/#/#fedify:matrix.org), or our [Discord server](https://discord.gg/bhtwpzURwd).

We have released updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a in 's implementation. We recommend all users update to the latest version of their respective release series immediately.

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

  • Perform denial of service attacks through infinite redirect loops
  • Execute server-side request forgery () attacks via redirects to private network addresses
  • Access unintended URL schemes through redirect manipulation

Fixed Versions

  • 1.3.x series: Update to 1.3.4
  • 1.2.x series: Update to 1.2.11
  • 1.1.x series: Update to 1.1.11
  • 1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

  1. Added a maximum redirect limit (5) to prevent infinite redirect loops
  2. Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
  3. Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.


If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

discord.com

Fedify & Hollo Discord 서버에 가입하세요!

The official community for Fedify & Hollo! Join users and contributors to discuss, collaborate, and build the fediverse together. Get help with Fedify's ActivityPub framework or Hollo instances, share ideas, and connect with developers passionate about decentralized social networking. | 멤버 133명

@hollo@hollo.social

Have you been having trouble fetching accounts or posts from that have custom emojis in ?

This is because they represent an Emoji object as an invalid JSON-LD object. Fortunately, this patch fixes that issue, so keep an eye out for it.

https://hollo.social/@fedify/01941dab-e4c3-7ce0-9307-b5b8c095d521

hollo.social

Are you getting the following …

Are you getting the following error when trying to look up any Activity Streams objects from #Akkoma that contain custom emojis? ``` jsonld.SyntaxError: Invalid JSON-LD syntax; "@id" value must a string. ``` This is because [they represent an `Emoji` object as an invalid JSON-LD object][1]. Fortunately, [this patch][2] fixes that issue, so keep an eye out for it. [1]: https://akkoma.dev/AkkomaGang/akkoma/issues/848 [2]: https://akkoma.dev/AkkomaGang/akkoma/pulls/850

@hollo@hollo.social

Hollo 0.4.0 released! is a single-user federated microblogging software which is -enabled and powered by .

The key changes of this release include:

  • Hollo is now powered by Node.js 23+ instead of Bun for more efficient memory usage.

  • Added an experimental feature flag TIMELINE_INBOXES to store all posts visible to your timeline in the database, rather than filtering them in real-time as they are displayed. This is useful for relatively larger instances with many incoming posts, but as of now it may have several bugs. It is expected to be the default behavior in the future after it is stabilized.

  • Now you can import and export your data from the administration dashboard in CSV format: follows, lists, accounts you muted, accounts you blocked, and bookmarks.

  • You can now make your profile discoverable.

  • The profile page now shows an account's cover image if it has one.

  • Many bug fixes.

For the details, see also the full changelog.

You can upgrade to Hollo 0.4.0 using the following ways:

github.com

GitHub - fedify-dev/hollo at stable

Federated single-user microblogging software. Contribute to fedify-dev/hollo development by creating an account on GitHub.

@hollo@hollo.social

is currently testing .js instead of . (In fact, the hollo.social server is already running on Node.js!) If this test is successful, starting with the next release, Hollo will be powered by Node.js instead of Bun.

The main reason for switching to Node.js is to optimize memory usage. As you can see in the graph image below, Node.js uses significantly less memory than Bun. With this switch, Hollo is expected to be even more lightweight than before!

Are you interested in trying out the Node.js version of Hollo early? Try to pull ghcr.io/dahlia/hollo:0.4.0-dev.290!

Hollo's memory usage graph. When I was running on Bun, it used about 4GB of memory, but after switching to Node.js, it uses about 0.5GB of memory.
ALT text

Hollo's memory usage graph. When I was running on Bun, it used about 4GB of memory, but after switching to Node.js, it uses about 0.5GB of memory.

@hollo@hollo.social

is currently testing .js instead of . (In fact, the hollo.social server is already running on Node.js!) If this test is successful, starting with the next release, Hollo will be powered by Node.js instead of Bun.

The main reason for switching to Node.js is to optimize memory usage. As you can see in the graph image below, Node.js uses significantly less memory than Bun. With this switch, Hollo is expected to be even more lightweight than before!

Are you interested in trying out the Node.js version of Hollo early? Try to pull ghcr.io/dahlia/hollo:0.4.0-dev.290!

Hollo's memory usage graph. When I was running on Bun, it used about 4GB of memory, but after switching to Node.js, it uses about 0.5GB of memory.
ALT text

Hollo's memory usage graph. When I was running on Bun, it used about 4GB of memory, but after switching to Node.js, it uses about 0.5GB of memory.

@hollo@hollo.social

now implements FEP-e232 as well for incoming and outgoing activities!

https://hollo.social/@hollo/0191d68a-3ba7-7f2f-9836-fe8664fb51b0

hollo.social

#Hollo finally has #Misskey/#T…

#Hollo finally has #Misskey/#Threads-style quotes! It's easy to use. Just paste the link to the post you want to quote into your post! It will automatically recognize a link to an ActivityPub post (supports `Article`, `Note`, and `Question`) and turn it into a quote. FYI, if you're using #Phanpy, you can use the *Quote* button that appears when you press the boost icon! https://hollo.social/@fedify/0191d67c-a300-786e-8395-2020ac47ebc7

@hollo@hollo.social

finally has /-style quotes! It's easy to use. Just paste the link to the post you want to quote into your post! It will automatically recognize a link to an ActivityPub post (supports Article, Note, and Question) and turn it into a quote.

FYI, if you're using , you can use the Quote button that appears when you press the boost icon!

https://hollo.social/@fedify/0191d67c-a300-786e-8395-2020ac47ebc7

The menu that appears when you press the boost icon in Phanpy. The menu items are Boost and Quote.
ALT text

The menu that appears when you press the boost icon in Phanpy. The menu items are Boost and Quote.

@hollo@hollo.social

finally has /-style quotes! It's easy to use. Just paste the link to the post you want to quote into your post! It will automatically recognize a link to an ActivityPub post (supports Article, Note, and Question) and turn it into a quote.

FYI, if you're using , you can use the Quote button that appears when you press the boost icon!

https://hollo.social/@fedify/0191d67c-a300-786e-8395-2020ac47ebc7

The menu that appears when you press the boost icon in Phanpy. The menu items are Boost and Quote.
ALT text

The menu that appears when you press the boost icon in Phanpy. The menu items are Boost and Quote.

@hollo@hollo.social

Introducing . Hollo is an -enabled single-user microblogging software. Although it's for a single user, it also supports creating and running multiple accounts for different topics.

It's headless, meaning you can use existing client apps instead, with its Mastodon-compatible APIs. It has most feature parity with Mastodon. Two big differences with Mastodon is that you can use in the content of your posts and you can quote another post.

Oh, and Hollo is built using and .

https://github.com/dahlia/hollo

github.com

GitHub - fedify-dev/hollo: Federated single-user microblogging software

Federated single-user microblogging software. Contribute to fedify-dev/hollo development by creating an account on GitHub.