Fedify: ActivityPub server framework

:fedify: Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards, so-called fediverse. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

Public Key

npub14m5mtm90njtvnfethdhsy4svharvsyr7kep4dws6y9kvdn8sj96sg0rx6j

NIP-05 Address

fedify@hollo-social.mostr.pub

Profile Code

nprofile1qqs2a6d4ajhee9kf5u4mkmcz2cxt73kgzpltvs6khgdzzmxxencfzagpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qrpqat8

Publishing to

relay.ditto.pub

Author Public Key

npub14m5mtm90njtvnfethdhsy4svharvsyr7kep4dws6y9kvdn8sj96sg0rx6j

Show more details

Last Notes

2026-07-01 15:09:19 UTC

The official account for the Fedify project is moving to @nprofile…fmck. This account will be replaced by the new one. Followers should automatically follow the new account unless any issues occur.

2026-06-29 20:48:07 UTC

OSSCA 2026 has started, and Fedify is joining for the second year. 24 mentees will work on Fedify, Hollo, BotKit, DrFed, and Feder over the next four months, with some of that work likely to continue after the program ends.
OSSCA, the Open Source Software Contribution Academy, is a South Korean mentorship program that connects developers with active open source projects. @nprofile…almw and @nprofile…v85c, both Fedify co-maintainers who first came to the project through OSSCA 2025, are mentoring this year's cohort. Welcome, everyone.

2026-06-26 09:09:10 UTC

Two new maintainers join Fedify: Chanhaeng Lee and Jiwon Kwon
Chanhaeng Lee (@nprofile…almw) and Jiwon Kwon (@nprofile…v85c) are now co-maintainers of Fedify. They have already been doing maintainer-shaped work for much of the past year, so this is mostly making the repository match reality.
Chanhaeng has done a lot of the package-boundary work in Fedify. The most visible piece was splitting the old @fedify/fedify/x/* modules into standalone packages: @fedify/cfworkers, @fedify/denokv, @fedify/hono, and @fedify/sveltekit. They then separated the Activity Vocabulary layer itself into @fedify/vocab, @fedify/vocab-runtime, and @fedify/vocab-tools, making it possible to build custom vocabulary extensions without touching the federation core. They built @fedify/next and @fedify/nuxt from scratch, contributed to @fedify/solidstart, and added Nuxt support to fedify init. @fedify/sqlite gained SqliteMessageQueue: a queue backend that only needs SQLite, handy for single-node deployments and local development. Chanhaeng also implemented the fedify webfinger CLI command, fediverse handle utilities (parseFediverseHandle(), isFediverseHandle(), toAcctUrl()), and the @fedify/webfinger and @fedify/lint packages. They are currently working on a custom background task API built around defineTask().
Jiwon has spent much of the past year making the CLI and relay tooling more useful for real ActivityPub debugging. fedify relay, backed by @fedify/relay, spins up a local ephemeral ActivityPub relay server with Mastodon and LitePub support. They extended fedify lookup with multi-URL traversal and inline image rendering for compatible terminal emulators (Kitty, WezTerm, iTerm, and others), and added configuration file support so options can live in ~/.config/fedify/config.toml or a project-local .fedify.toml rather than being passed on every invocation. They also fixed a race condition in RedisMessageQueue, corrected ActivityPub object handling for relative URLs, extended TypeScript types for RFC 6570 URI Template expressions in dispatcher paths, and implemented the FEP-5711 inverse collection properties, including likesOf, repliesOf, and followersOf.
Chanhaeng and Jiwon both came to Fedify through OSSCA 2025, Korea's Open Source Contribution Academy. I'm grateful that the program led to long-term maintainers, not just a few merged patches, and I'm looking forward to working with them in this new role.

2026-06-24 16:53:11 UTC

Fedify 2.3.0 is out! This release is largely about production observability: OpenTelemetry metrics now cover every major federation path, and a monitoring guide and runnable example stack ship alongside them. Also new: a delivery circuit breaker that holds queued activities for unreachable servers rather than retrying indefinitely; @fedify/backfill, a new package for reconstructing conversations via FEP-f228; and fedify bench, an ActivityPub-aware load testing command. Release notes: https://github.com/fedify-dev/fedify/discussions/821.
Thanks to @nprofile…almw (@fedify/uri-template), @nprofile…v85c (@fedify/backfill), @nprofile…6y8x (FEP-0837 vocabulary), @nprofile…a27x (@fedify/lint/oxlint), and @nprofile…nztu (--skip-install) for their contributions to this release.

2026-06-17 04:20:49 UTC

DrFed is our sister project, built alongside #Fedify to tackle the debugging side of #ActivityPub development. It just received @nprofile…246t funding and now has its own account here: @nprofile…vhgs.
#DrFed #fedidev #fediverse #NLnet
#nevent1q…yqxm

2026-06-08 14:56:47 UTC

Fedify security updates: 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5
If you use Fedify, update to a patched release now. CVE-2026-50131 affects Fedify's public URL validation for remote document and media loading. An attacker could use special-use IP address ranges to bypass Fedify's SSRF protections and cause a Fedify server to initiate requests to non-public or special-use network destinations, depending on the deployment environment and network routing.
Fedify validates remote ActivityPub document and media URLs before fetching them, including direct IP literals and hostnames resolved through DNS. The vulnerable path is validatePublicUrl(): affected versions rejected common private and local addresses, but still treated several special-use IPv4 ranges as public internet destinations. That gap could allow outbound requests to ranges such as carrier-grade NAT, benchmarking, multicast, reserved, and documentation networks.
The fix makes Fedify validate resolved addresses against public-network expectations instead of relying on the incomplete denylist. It rejects additional special-use IPv4 ranges and IPv6 translation or tunneling prefixes, including NAT64, Teredo, and 6to4 addresses, before remote document or media fetching proceeds.
Current patched releases are 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5. The GitHub Security Advisory is GHSA-xw9q-2mv6-9fr8, and the CVE ID is CVE-2026-50131.
Update @fedify/fedify:
npm update @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update @fedify/fedify
bun update @fedify/fedify
deno update @fedify/fedify
If your project depends directly on @fedify/vocab-runtime, update that package too.
After updating, redeploy. If you run other Fedify-based servers, update those too.
Thanks to Chaitanya Vilas Garware for the report and responsible disclosure.
If anything is unclear, ask below.

2026-05-20 17:35:44 UTC

Fedify security updates: 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3
If you use Fedify, update to a patched release now. CVE-2026-42462 affects Fedify's Linked Data Signature handling. An attacker could use JSON-LD graph-restructuring features to change how a signed activity is interpreted without invalidating its Linked Data Signature.
Fedify verifies incoming ActivityPub activities with several mechanisms, including HTTP Signatures, Object Integrity Proofs, and Linked Data Signatures. The vulnerable path is Linked Data Signatures: the signature is checked over the canonical RDF graph, but JSON-LD can represent the same graph in more than one JSON shape. In affected versions, that gap could let a signed activity be reshaped so that Fedify reads a different ActivityPub object shape than intended.
The fix makes Fedify normalize Linked Data Signature-verified activities against Fedify's local JSON-LD context before interpreting them, and rejects JSON-LD constructs that can preserve the signed RDF graph while changing the ActivityPub object shape consumed by Fedify.
Patched releases are 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3. The GitHub Security Advisory is GHSA-9rfg-v8g9-9367, and the CVE ID is CVE-2026-42462.
Update @fedify/fedify:
npm update @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update @fedify/fedify
bun update @fedify/fedify
deno update @fedify/fedify
After updating, redeploy. If you run other Fedify-based servers, update those too.
Thanks to @nprofile…c80l for the report and responsible disclosure.
If anything is unclear, ask below.

2026-05-10 14:13:33 UTC

Fedify security updates: 1.9.10, 1.10.9, 2.0.16, 2.1.12, and 2.2.1
If you use Fedify, update to a patched release now. A private network protection bypass affects Fedify's remote document loading code. URLs with private IPv4 addresses encoded as IPv4-mapped IPv6 literals, such as http://[::ffff:7f00:1]/, could pass validatePublicUrl() even though they refer to private or loopback addresses.
Fedify uses validatePublicUrl() when fetching remote ActivityPub documents and related resources. An attacker who can make a Fedify server fetch an attacker-controlled URL may be able to bypass the private address checks that are intended to reduce SSRF risk.
All versions up to and including 2.2.0 are affected. Patched releases are 1.9.10, 1.10.9, 2.0.16, 2.1.12, and 2.2.1.
For Fedify 1.x, update @fedify/fedify:
npm update @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update @fedify/fedify
bun update @fedify/fedify
deno update @fedify/fedify
For Fedify 2.x, update both @fedify/fedify and @fedify/vocab-runtime:
npm update @fedify/fedify @fedify/vocab-runtime
yarn upgrade @fedify/fedify @fedify/vocab-runtime
pnpm update @fedify/fedify @fedify/vocab-runtime
bun update @fedify/fedify @fedify/vocab-runtime
deno update @fedify/fedify
deno update @fedify/vocab-runtime
After updating, redeploy. If you run other Fedify-based servers, update those too.
Thanks to Changkyun Kim (@nprofile…jfsp) for the report and responsible disclosure.
If anything is unclear, ask below.

2026-02-22 11:35:44 UTC

- reply

Fedify 2.0.0을 릴리스했습니다!
Fedify 역사상 가장 큰 릴리스입니다. 주요 변경 사항을 소개합니다:
모듈형 아키텍처 — 기존의 단일 @fedify/fedify 패키지를 @fedify/vocab, @fedify/vocab-runtime, @fedify/vocab-tools, @fedify/webfinger 등 독립적인 패키지들로 분리했습니다. 번들 크기가 줄어들고, 임포트가 깔끔해지며, 커스텀 어휘 타입으로 ActivityPub을 확장할 수도 있습니다.
실시간 디버그 대시보드 — 새로운 @fedify/debugger 패키지로 /__debug__/ 경로에 라이브 대시보드를 띄울 수 있습니다. 연합 트래픽의 트레이스, 액티비티 상세, 서명 검증, 로그까지 한눈에 확인할 수 있습니다. 기존 Federation 객체를 감싸기만 하면 됩니다.
ActivityPub 릴레이 지원 — @fedify/relay 패키지와 fedify relay CLI 명령어로 릴레이 서버를 바로 띄울 수 있습니다. Mastodon 방식과 LitePub 방식 모두 지원합니다(FEP-ae0c).
순서 보장 메시지 전달 — 새로운 orderingKey 옵션으로 “좀비 포스트” 문제를 해결합니다. Delete가 Create보다 먼저 도착하는 문제가 더 이상 발생하지 않습니다. 같은 키를 공유하는 액티비티는 FIFO 순서가 보장됩니다.
영구 전달 실패 처리 — setOutboxPermanentFailureHandler()로 원격 인박스가 404나 410을 반환할 때 대응할 수 있습니다. 도달 불가능한 팔로워를 정리하는 등의 처리가 가능합니다.
이 외에도 미들웨어 수준의 콘텐츠 협상, @fedify/lint, @fedify/create, CLI 설정 파일, 네이티브 Node.js/Bun CLI 지원, 다수의 버그 수정 등이 포함되어 있습니다.
이번 릴리스에는 한국 OSSCA (오픈소스 컨트리뷰션 아카데미) 참가자분들의 큰 기여가 담겨 있습니다. 참여해 주신 모든 분께 감사드립니다!
브레이킹 체인지가 포함된 메이저 릴리스입니다. 업그레이드 전에 마이그레이션 가이드를 꼭 확인해 주세요.
전체 릴리스 노트: https://github.com/fedify-dev/fedify/discussions/580
#Fedify #ActivityPub #fediverse #fedidev #TypeScript

2026-02-22 11:34:57 UTC

Fedify 2.0.0 is here!
This is the biggest release in Fedify's history. Here are the highlights:
Modular architecture — The monolithic @fedify/fedify package has been broken up into focused, independent packages: @fedify/vocab, @fedify/vocab-runtime, @fedify/vocab-tools, @fedify/webfinger, and more. Smaller bundles, cleaner imports, and the ability to extend ActivityPub with custom vocabulary types.
Real-time debug dashboard — The new @fedify/debugger package gives you a live dashboard at /__debug__/ showing all your federation traffic: traces, activity details, signature verification, and correlated logs. Just wrap your Federation object and you're done.
ActivityPub relay support — First-class relay support via @fedify/relay and the fedify relay CLI command. Supports both Mastodon-style and LitePub-style relay protocols (FEP-ae0c).
Ordered message delivery — The new orderingKey option solves the “zombie post” problem where a Delete arrives before its Create. Activities sharing the same key are guaranteed to be delivered in FIFO order.
Permanent failure handling — setOutboxPermanentFailureHandler() lets you react when a remote inbox returns 404 or 410, so you can clean up unreachable followers instead of retrying forever.
Other changes include content negotiation at the middleware level, @fedify/lint for shared linting rules, @fedify/create for quick project scaffolding, CLI config files, native Node.js/Bun CLI support, and many bug fixes.
This release includes significant contributions from Korea's OSSCA participants. Huge thanks to everyone involved!
This is a major release with breaking changes—please check the migration guide before upgrading.
Full release notes: https://github.com/fedify-dev/fedify/discussions/580
#Fedify #ActivityPub #fediverse #fedidev #TypeScript

2025-10-14 08:56:39 UTC

Fedify 1.9.0: Security enhancements, improved DX, and expanded framework support
We are excited to announce Fedify 1.9.0, a mega release that brings major security enhancements, improved developer experience, and expanded framework support. Released on October 14, 2025, this version represents months of collaborative effort, particularly from the participants of Korea's OSSCA (Open Source Contribution Academy).
This release would not have been possible without the dedicated contributions from OSSCA participants: Jiwon Kwon (@nprofile…dfj9), Hyeonseo Kim (@nprofile…dkyl), Chanhaeng Lee (@nprofile…g0ru), Hyunchae Kim (@nprofile…an9e), and An Subin (@nprofile…wxuz). Their collective efforts have significantly enhanced Fedify's capabilities and made it more robust for the fediverse community.Origin-based security model
Fedify 1.9.0 implements FEP-fe34, an origin-based security model that protects against content spoofing attacks and ensures secure federation practices. This critical security enhancement enforces same-origin policy for ActivityPub objects and their properties, preventing malicious actors from impersonating content from other servers.
The security model introduces a crossOrigin option in Activity Vocabulary property accessors (get*() methods) with three security levels:
// Default behavior: logs warning and returns null for cross-origin content
const actor = await activity.getActor({ crossOrigin: "ignore" });
// Strict mode: throws error for cross-origin content
const object = await activity.getObject({ crossOrigin: "throw" });
// Trust mode: bypasses security checks (use with caution)
const attachment = await note.getAttachment({ crossOrigin: "trust" });
Embedded objects are automatically validated against their parent object's origin. When an embedded object has a different origin, Fedify performs automatic remote fetches to ensure content integrity. This transparent security layer protects your application without requiring significant code changes.
For more details about the security model and its implications, see the origin-based security model documentation.Enhanced activity idempotency
Activity idempotency handling has been significantly improved with the new withIdempotency() method. This addresses a critical issue where activities with the same ID sent to different inboxes were incorrectly deduplicated globally instead of per-inbox.
federation
.setInboxListeners("/inbox/{identifier}", "/inbox")
.withIdempotency("per-inbox") // New idempotency strategy
.on(Follow, async (ctx, follow) => {
// Each inbox processes activities independently
});
The available strategies are:
"per-origin": Current default for backward compatibility
"per-inbox": Recommended strategy (will become default in Fedify 2.0)
Custom strategy function for advanced use cases
This enhancement ensures that shared inbox implementations work correctly while preventing duplicate processing within individual inboxes. For more information, see the activity idempotency documentation.Relative URL resolution
Fedify now intelligently handles ActivityPub objects containing relative URLs, automatically resolving them by inferring the base URL from the object's @id or document URL. This improvement significantly enhances interoperability with ActivityPub servers that use relative URLs in properties like icon.url and image.url.
// Previously required manual baseUrl specification
const actor = await Actor.fromJsonLd(jsonLd, { baseUrl: new URL("https://example.com") });
// Now automatically infers base URL from object's @id
const actor = await Actor.fromJsonLd(jsonLd);
This change, contributed by Jiwon Kwon (@nprofile…dfj9), eliminates a common source of federation failures when encountering relative URLs from other servers.Full RFC 6570 URI template support
TypeScript support now covers all RFC 6570 URI Template expression types in dispatcher path parameters. While the runtime already supported these expressions, TypeScript types previously only recognized simple string expansion.
// Now fully supported in TypeScript
federation.setActorDispatcher("/{+identifier}", async (ctx, identifier) => {
// Reserved string expansion — recommended for URI identifiers
});
The complete set of supported expression types includes:
{identifier}: Simple string expansion
{+identifier}: Reserved string expansion (recommended for URIs)
{#identifier}: Fragment expansion
{.identifier}: Label expansion
{/identifier}: Path segments
{;identifier}: Path-style parameters
{?identifier}: Query component
{&identifier}: Query continuation
This was contributed by Jiwon Kwon (@nprofile…dfj9). For comprehensive information about URI templates, see the URI template documentation.WebFinger customization
Fedify now supports customizing WebFinger responses through the new setWebFingerLinksDispatcher() method, addressing a long-standing community request:
federation.setWebFingerLinksDispatcher(async (ctx, actor) => {
return [
{
rel: "http://webfinger.net/rel/profile-page",
type: "text/html",
href: actor.url?.href,
},
{
rel: "http://ostatus.org/schema/1.0/subscribe",
template: "https://example.com/follow?uri={uri}",
},
];
});
This feature was contributed by Hyeonseo Kim (@nprofile…dkyl), and enables applications to add custom links to WebFinger responses, improving compatibility with various fediverse implementations. Learn more in the WebFinger customization documentation.New integration packagesFastify support
Fedify now officially supports Fastify through the new @fedify/fastify package:
import Fastify from "fastify";
import { fedifyPlugin } from "@fedify/fastify";
const fastify = Fastify({ logger: true });
await fastify.register(fedifyPlugin, {
federation,
contextDataFactory: () => ({ /* your context data */ }),
});
This integration was contributed by An Subin (@nprofile…wxuz). It supports both ESM and CommonJS, making it accessible to all Node.js projects. See the Fastify integration guide for details.Koa support
Koa applications can now integrate Fedify through the @fedify/koa package:
import Koa from "koa";
import { createMiddleware } from "@fedify/koa";
const app = new Koa();
app.use(createMiddleware(federation, (ctx) => ({
user: ctx.state.user,
// Pass Koa context data to Fedify
})));
The integration supports both Koa v2.x and v3.x. Learn more in the Koa integration documentation.Next.js integration
The new @fedify/next package brings first-class Next.js support to Fedify:
// app/api/ap/[...path]/route.ts
import { federation } from "@/federation";
import { fedifyHandler } from "@fedify/next";
export const { GET, POST } = fedifyHandler(federation);
This integration was contributed by Chanhaeng Lee (@nprofile…g0ru). It works seamlessly with Next.js App Router. Check out the Next.js integration guide for complete setup instructions.CommonJS support
All npm packages now support both ESM and CommonJS module formats, resolving compatibility issues with various Node.js applications and eliminating the need for the experimental --experimental-require-module flag. This particularly benefits NestJS users and other CommonJS-based applications.FEP-5711 collection inverse properties
Fedify now implements FEP-5711, adding inverse properties to collections that provide essential context about collection ownership:
const collection = new Collection({
likesOf: note, // This collection contains likes of this note
followersOf: actor, // This collection contains followers of this actor
// … and more inverse properties
});
This feature was contributed by Jiwon Kwon (@nprofile…dfj9). The complete set of inverse properties includes likesOf, sharesOf, repliesOf, inboxOf, outboxOf, followersOf, followingOf, and likedOf. These properties improve data consistency and enable better interoperability across the fediverse.CLI enhancementsNodeInfo visualization
The new fedify nodeinfo command provides a visual way to explore NodeInfo data from fediverse instances. This replaces the deprecated fedify node command and offers improved parsing of non-semantic version strings. Try it with:
fedify nodeinfo https://comam.es/snac/
This was contributed by Hyeonseo Kim (@nprofile…dkyl). The command now correctly handles various version formats and provides a cleaner visualization of instance capabilities. See the CLI documentation for more options.Enhanced lookup with timeout
The fedify lookup command now supports a timeout option to prevent hanging on slow or unresponsive servers:
fedify lookup --timeout 10 https://example.com/users/alice
This enhancement, contributed by Hyunchae Kim (@nprofile…an9e), ensures reliable operation even when dealing with problematic remote servers.Package modularization
Several modules have been separated into dedicated packages to improve modularity and reduce bundle sizes. While the old import paths remain for backward compatibility, we recommend migrating to the new packages:
@fedify/cfworkers replaces @fedify/fedify/x/cfworkers
@fedify/denokv replaces @fedify/fedify/x/denokv
@fedify/hono replaces @fedify/fedify/x/hono
@fedify/sveltekit replaces @fedify/fedify/x/sveltekit
This modularization was contributed by Chanhaeng Lee (@nprofile…g0ru). The old import paths are deprecated and will be removed in version 2.0.0.Acknowledgments
This release represents an extraordinary collaborative effort, particularly from the OSSCA participants who contributed numerous features and improvements. Their dedication and hard work have made Fedify 1.9.0 the most significant release to date.
Special thanks to all contributors who helped shape this release, including those who provided feedback, reported issues, and tested pre-release versions. The fediverse community's support continues to drive Fedify's evolution.
For the complete list of changes, bug fixes, and improvements, please refer to the CHANGES.md file in the repository.

2025-10-08 03:28:57 UTC

Announcement: AltStore becomes a financial contributor to Fedify
We're thrilled to announce that AltStore has become a financial contributor to Fedify! This generous support comes as part of AltStore's broader commitment to strengthening the open social web ecosystem, as they prepare to become the world's first federated app store. Their investment in Fedify and other fediverse projects demonstrates a shared vision for building a more open, interoperable digital future.
AltStore's journey into the fediverse represents a groundbreaking approach to app distribution—connecting their alternative app marketplace with the open social web through ActivityPub. As pioneers who have already pushed Apple to change App Store policies twice in their first year, AltStore understands the transformative power of open protocols and decentralized systems. Their support will help Fedify continue developing robust tools and libraries that make it easier for developers to build federated applications. We're deeply grateful for AltStore's trust in our project and look forward to seeing how their innovative federated app store will reshape mobile app distribution while strengthening the entire fediverse ecosystem.
https://rileytestut.com/blog/2025/10/07/evolving-altstore-pal/
#nevent1q…edsr

2025-10-02 15:10:47 UTC

We're excited to announce that #Fedify has been awarded a service agreement by the @nprofile…du6g! The Sovereign Tech Fund is investing €192,000 in Fedify's development over 2025–2026 to strengthen the fediverse ecosystem.
This investment will enable us to significantly expand Fedify's capabilities and make it easier for developers to build federated applications. The commissioned work focuses on improving developer experience, adding comprehensive debugging tools, and ensuring Fedify remains at the forefront of #ActivityPub innovation.
Here are the key milestones we'll be delivering:
Web framework integrations: Official adapters for Next.js, Elysia, Fastify, and Koa, making it seamless to add federation to existing applications
ActivityPub debug & development tools: Real-time debug dashboard with WebSocket monitoring, federation lifecycle hooks, and implementation checklist CLI to make federation interactions transparent and debuggable
Storage & infrastructure enhancements: SQLiteKvStore for robust file-based storage across Node.js, Deno, and Bun, plus performance optimizations for production deployments
Comprehensive documentation & examples: Specialized tutorials for building federated blogs, social networks, and content platforms, with complete working examples and migration guides
Observability & monitoring: Full OpenTelemetry metrics, performance benchmarking tools, and federation health dashboards for production environments
Advanced features & standards: FEP-ef61 (Portable Objects) support and implementation of emerging Fediverse Enhancement Proposals to keep Fedify at the cutting edge
All developments will be open source and available for the entire #fediverse community to use, contribute to, and build upon.
https://www.sovereign.tech/tech/fedify
#opensource #SovereignTechFund #STF

2025-06-07 05:12:55 UTC

We're excited to announce the release of #Fedify 1.6.1, which marks the beginning of the 1.6 series following the retraction of version 1.6.0. This release introduces significant new capabilities that expand Fedify's deployment options and enhance security compatibility across the #fediverse.🌐 Cloudflare Workers support
Fedify 1.6 introduces first-class support for Cloudflare Workers, enabling #serverless deployment of #ActivityPub applications at the edge.New components
WorkersKvStore: A key–value store implementation using Cloudflare's KV API for persistent storage in Workers environments
WorkersMessageQueue: A message queue implementation leveraging Cloudflare Queues for reliable message processing
Key features
Seamless integration with #Cloudflare's serverless runtime
Automatic handling of queue message processing through Workers' queue() method
Support for Node.js compatibility flag required for Fedify's cryptographic operations
Manual queue processing via Federation.processQueuedTask() method
For a complete working example, see the Cloudflare Workers example in the Fedify repository.🏗️ Federation builder pattern
Fedify 1.6 introduces the FederationBuilder class and createFederationBuilder() function to support deferred federation instantiation. This pattern provides several benefits:
Deferred instantiation: Set up dispatchers and listeners before creating the federation object
Better code organization: Avoid circular dependencies and improve project structure
Cloudflare #Workers compatibility: Accommodates binding-based architectures where resources are passed as arguments rather than globals
Modular setup: Build complex federations piece by piece before instantiation
The builder pattern is particularly useful for large applications and environments like Cloudflare Workers where configuration data is only available at runtime.🔐 HTTP Message Signatures (RFC 9421)
Fedify 1.6 implements the official HTTP Message Signatures standard (RFC 9421) specification, the final revision of the HTTP Signatures specification.Double-knocking mechanism
To ensure maximum compatibility across the fediverse, Fedify 1.6 introduces an intelligent double-knocking mechanism:
Primary attempt: RFC 9421 (HTTP Message Signatures) for modern implementations
Fallback: Draft cavage version for legacy compatibility
Adaptive caching: The system remembers which version each server supports to optimize future requests
This approach ensures seamless communication with both modern and legacy ActivityPub implementations while positioning Fedify at the forefront of security standards.Interoperability testing
The RFC 9421 implementation has been thoroughly tested for interoperability with existing ActivityPub implementations that support RFC 9421 signature verification:
Mitra 4.4.0: Successfully verified Fedify-generated RFC 9421 signatures
Mastodon 4.4.0 development version: Tested RFC 9421 signature verification against Fedify's implementation (refer to Mastodon PR #34814, though Mastodon 4.4.0 has not yet been released)
These tests confirm that other ActivityPub implementations can successfully verify RFC 9421 signatures generated by Fedify, ensuring proper federation as the ecosystem gradually adopts the official specification. While these implementations currently support verification of RFC 9421 signatures, they do not yet generate RFC 9421 signatures themselves—making Fedify one of the first ActivityPub implementations to support both generation and verification of the modern standard.🔍 WebFinger enhancementsDedicated WebFinger lookup
The new Context.lookupWebFinger() method provides direct access to WebFinger data, offering developers more granular control over account discovery and resource resolution beyond the higher-level Context.lookupObject() method.🛠 Context API improvementsContext data replacement
The new Context.clone() method enables dynamic context data replacement, providing greater flexibility in request processing and data flow management. This is particularly useful for middleware implementations and complex request routing scenarios.🚀 Migration considerationsBackward compatibility
Fedify 1.6 maintains full backward compatibility with existing applications. The new HTTP Message Signatures and double-knocking mechanisms work transparently without requiring any code changes.Node.js version requirement
Important: Fedify 1.6 requires Node.js 22.0.0 or later for Node.js environments. This change does not affect applications using Deno or Bun runtimes. If you're currently using Node.js, please ensure your environment meets this requirement before upgrading.New deployment options
For new deployments, consider leveraging Cloudflare Workers support for:
Global edge deployment with low latency
Serverless scaling and automatic resource management
Integration with Cloudflare's ecosystem of services
🎯 Looking forward
Fedify 1.6 represents a significant expansion of deployment possibilities while maintaining the framework's commitment to broad compatibility across the fediverse. The addition of Cloudflare Workers support opens new architectural patterns for federated applications, while the RFC 9421 implementation ensures Fedify stays current with emerging ActivityPub security standards.
For detailed migration guides, API documentation, and examples, please visit the Fedify documentation. Join our community on Matrix or Discord for support and discussions.
#fedidev #RFC9421 #HTTPSignatures #HTTPMessageSignatures #CloudflareWorkers

2025-06-06 15:05:20 UTC

Did you know? #Fedify provides #documentation optimized for LLMs through the llms.txt standard.
Available endpoints:
https://fedify.dev/llms.txt — Core documentation overview
https://fedify.dev/llms-full.txt — Complete documentation dump
Useful for training #AI assistants on #ActivityPub/#fediverse development, building documentation chatbots, or #LLM-powered dev tools.
#fedidev

2025-06-01 08:15:09 UTC

- reply

🎉 #Cloudflare #Workers support is now complete! After implementing the test infrastructure, core module, examples, and comprehensive documentation, #Fedify can now run on Cloudflare Workers.
What's included:
@fedify/fedify/x/cfworkers module with WorkersKvStore and WorkersMessageQueue
Complete documentation covering Workers-specific patterns and constraints
Working example deployed to production
Integration with Cloudflare KV and Queues
Try it now: Available in the development release v1.6.1-dev.876+7b07d213:
JSR: https://jsr.io/@fedify/fedify@1.6.1-dev.876+7b07d213
npm: https://www.npmjs.com/package/@fedify/fedify/v/1.6.1-dev.876
This will be included in the upcoming Fedify 1.6 stable release. Thank you to everyone who requested this feature and provided feedback throughout the implementation!
#fedidev #ActivityPub #CloudflareWorkers

2025-05-16 11:07:19 UTC

Good news! We've officially added #Cloudflare #Workers support to the #Fedify roadmap. We've created a detailed issue to track our implementation plan: https://github.com/fedify-dev/fedify/issues/233.
The effort will be tackled in phases, including compatibility assessment, core adaptations for Workers' environment, KV store and message queue implementations, and finally integration with Cloudflare's ecosystem. This will be a substantial project that we'll break down into several sub-issues.
If you're interested in contributing to any specific aspect of Workers support, please comment on the main issue to coordinate efforts.
#CloudflareWorkers

2025-04-29 23:53:32 UTC

We're pleased to announce that #Fedify has been included in the Nivenly Fediverse Security Fund program!
The @nprofile…6qvx Foundation has launched a security bounty fund to support contributors who identify and help fix #security vulnerabilities in popular #fediverse software. Both Fedify and @nprofile…d3ay are among the selected projects that meet their responsible security disclosure requirements.
This program will run from April–September 2025, with bounties of $250–$500 USD for high and critical security vulnerabilities.
We're honored to be recognized alongside other established fediverse projects like Mastodon, Misskey, and Lemmy. This further encourages our commitment to maintaining strong security practices.
If you're interested in contributing to Fedify's security, please follow our responsible disclosure process outlined in our SECURITY.md file.
Learn more about the program:
https://nivenly.org/blog/2025/04/01/nivenly-fediverse-security-fund/

2025-04-20 02:03:29 UTC

In case you weren't aware, #Fedify has both #Discord and #Matrix communities where you can get help, discuss features, or just chat about #ActivityPub and federated social networks.
Matrix space: #fedify:matrix.org
Discord server: https://discord.gg/bhtwpzURwd
Feel free to join either community based on your preference. Both channels have active discussions about Fedify and federation topics.
#fedidev

2025-04-09 09:25:03 UTC

📣 Exciting news! Fedify CLI is now available via Homebrew!
If you're using #Homebrew on macOS or #Linuxbrew on Linux, you can now install our CLI toolchain with a simple command:
brew install fedify
This makes it even easier to get started with building your federated server app. Try it out and let us know what you think!
#Fedify #ActivityPub #fedidev #fediverse

2025-03-31 06:55:20 UTC

We're incredibly honored to announce that #Ghost (@nprofile…wj47) has become a formal sponsor of Fedify through Open Collective!
This is a significant milestone for our project, and we're deeply grateful to @nprofile…m54a and the entire Ghost team for their support and recognition of our work in the #ActivityPub ecosystem.
Ghost's social web integration built on #Fedify is a perfect example of how open standards can connect different publishing platforms in the fediverse. Their backing over the past months has been invaluable, and this formal sponsorship will help ensure Fedify remains sustainable as we continue to develop and improve the framework.
If you're building with ActivityPub or interested in federated applications, please consider joining Ghost in supporting open source development through our Open Collective:
https://opencollective.com/fedify
Every contribution, no matter the size, helps us maintain and enhance the tools that make the fediverse more accessible to developers. Thank you for being part of this journey with us! :fedify: ❤️ :ghost:
#nevent1q…ytax

2025-03-11 10:03:20 UTC

Just released @fedify/markdown-it-mention v0.3.0! This update adds support for bare handles (e.g., @username without domain) with the new localDomain option, allowing you to specify the domain for these shortened mentions.
Install via npm, Bun, or Deno:npm add @fedify/markdown-it-mention@0.3.0
bun add @fedify/markdown-it-mention@0.3.0
deno add jsr:@fedify/markdown-it-mention@0.3.0

2025-03-05 05:02:31 UTC

- reply

Fedify는 새로운 후원 파트너를 찾고 있습니다!:fedify: Fedify란?
Fedify는 #ActivityPub 기반 연합형 서버 프레임워크로, 개발자들이 분산형 소셜 네트워크인 #연합우주(#fediverse)에 애플리케이션을 쉽게 통합할 수 있도록 돕습니다. 복잡한 ActivityPub 프로토콜 구현을 단순화하여 개발 시간을 크게 단축시킵니다. MIT 라이선스 하에 제공되는 오픈 소스 프로젝트입니다.💼 Fedify를 활용하는 프로젝트들
다양한 프로젝트들이 이미 Fedify를 활용하고 있습니다:
Ghost: 수백만 사용자를 보유한 전문적인 오픈 소스(MIT 라이선스) 퍼블리싱 플랫폼으로, Fedify의 주요 후원사이자 파트너입니다.
Hollo: 개인 사용자를 위한 경량 마이크로블로그 (오픈 소스, AGPL-3.0)
Hackers' Pub: 소프트웨어 엔지니어를 위한 연합우주 블로그 플랫폼 (오픈 소스, AGPL-3.0)
Encyclia: ORCID 학술 기록을 ActivityPub을 통해 제공하는 브리지 서비스
🚀 Fedify가 제공하는 가치
개발 시간 80% 단축: ActivityPub의 복잡한 구현 대신 검증된 프레임워크 활용
즉각적인 연합우주 호환성: Mastodon, Misskey, Pleroma, Pixelfed, PeerTube 등 다양한 연합우주 서비스와 즉시 호환
전문 기술 지원: ActivityPub 및 연합 프로토콜 전문가의 직접 지원
맞춤형 개발: 귀사의 특정 요구사항에 맞는 맞춤형 기능 개발
🤝 가능한 협력 모델
맞춤형 컨설팅 및 통합 지원: 귀사 플랫폼에 #Fedify 통합을 위한 전문적 지원
맞춤형 기능 개발 의뢰: 귀사에 필요한 특정 기능의 개발 및 구현
장기적인 기술 파트너십: 지속적인 개발 및 유지보수를 위한 장기 협력 관계
🌟 Fedify와 협력했을 때의 이점
기술적 이점: 자체 구현 대비 시간과 리소스 절약
브랜드 이미지: 오픈 소스 생태계 지원을 통한 기업 이미지 강화
분산형 소셜 네트워크 진입: 연합우주 생태계에 쉽게 참여
경쟁 우위: 소셜 기능을 통한 제품 경쟁력 강화
📩 관심이 있으신가요?
ActivityPub 구현을 고려 중이시거나, Fedify 프로젝트와 협력하고 싶으시다면 연락 주세요:
이메일: sponsor@fedify.dev
연합우주: @nprofile…j979
GitHub: https://github.com/fedify-dev/fedify
귀사의 요구사항과 목표에 맞는 맞춤형 협력 방안을 함께 모색하겠습니다.

2025-03-05 05:02:04 UTC

Fedify is looking for new partnership opportunities!:fedify: What is Fedify?
#Fedify is an #ActivityPub-based federated server framework that helps developers easily integrate their applications with the #fediverse, a decentralized social network. It simplifies the complex implementation of the ActivityPub protocol, significantly reducing development time. Fedify is an open-source project available under the MIT license.💼 Projects using Fedify
Various projects are already leveraging Fedify:
Ghost: A professional publishing platform with millions of users, open source under MIT license, and a major sponsor and partner of Fedify.
Hollo: A lightweight microblogging platform for individual users (open source, AGPL-3.0)
Hackers' Pub: A fediverse blogging platform for software engineers (open source, AGPL-3.0)
Encyclia: A bridge service that makes ORCID academic records available via ActivityPub
🚀 Value provided by Fedify
80% development time reduction: Utilize a proven framework instead of complex ActivityPub implementation
Immediate fediverse compatibility: Instant compatibility with various fediverse services including Mastodon, Misskey, Pleroma, Pixelfed, PeerTube, etc.
Expert technical support: Direct support from ActivityPub and Federation protocol experts
Custom development: Tailored feature development to meet your specific requirements
🤝 Potential collaboration models
Custom consulting and integration support: Professional assistance for integrating Fedify into your platform
Custom feature development: Development and implementation of specific features needed for your platform
Long-term technical partnership: Long-term collaboration for continuous development and maintenance
🌟 Benefits of collaborating with Fedify
Technical advantage: Save time and resources compared to in-house implementation
Brand image: Enhance corporate image through support of the open-source ecosystem
Entry to decentralized social networks: Easily participate in the fediverse ecosystem
Competitive edge: Strengthen product competitiveness through social features
📩 Interested?
If you're considering implementing ActivityPub or wish to collaborate with the Fedify project, please get in touch:
Email: sponsor@fedify.dev
Fediverse: @nprofile…j979
GitHub: https://github.com/fedify-dev/fedify
We're excited to explore customized collaboration opportunities that align with your requirements and goals.

2025-01-29 07:59:43 UTC

🎉 Excited to announce that #Fedify is now on Open Collective! Support the project's development starting at:
Backer (from $5/mo)
Supporter (from $25/mo)
Sponsor (from $100/mo)
Corporate Sponsor (from $500/mo)
Custom donations welcome
Your support will help us maintain and improve Fedify. Check it out here:
https://opencollective.com/fedify
:fedify:
#OpenCollective #support #backing #sponsor #donation

2025-01-20 01:53:36 UTC

Want to build your own #ActivityPub implementation, but don't know where to start? Read and follow #Fedify's official tutorial, Creating your own federated microblog, and get started!

2025-01-10 03:07:57 UTC

:botkit: Introducing #BotKit: A #TypeScript framework for creating truly standalone #ActivityPub bots!
Unlike traditional Mastodon bots, BotKit lets you build fully independent #fediverse bots that aren't constrained by platform limits. Create your entire bot in a single TypeScript file using our simple, expressive API.
Currently #Deno-only, with Node.js & Bun support planned. Built on the robust #Fedify foundation.
https://botkit.fedify.dev/

2024-12-31 17:03:16 UTC

Are you getting the following error when trying to look up any Activity Streams objects from #Akkoma that contain custom emojis?
jsonld.SyntaxError: Invalid JSON-LD syntax; "@id" value must a string.
This is because they represent an Emoji object as an invalid JSON-LD object. Fortunately, this patch fixes that issue, so keep an eye out for it.

2024-12-27 01:08:55 UTC

- reply

@nprofile…0tle It looks great! Could it be applied to likes and emoji reactions?

2024-12-05 07:57:48 UTC

- reply

@nprofile…qymn Yes, it corresponds to the misskey:isCat property! According to the docs:
Used on actors to indicate that they in some way identify as a cat, expressed as a boolean value. If this property is set to true, displaying the actor or their notes will have some special effects attached in some clients.

2024-12-01 06:24:53 UTC

The #Fedify repository has reached 600 stars! Thank you everyone!
https://github.com/dahlia/fedify

2024-11-30 03:51:48 UTC

- reply

Here's the detailed release note of Fedify 1.3.0!
https://dev.to/hongminhee/fedify-130-opentelemetry-support-enhanced-message-queue-42gk

2024-11-29 15:35:31 UTC

The version 1.3.0 of #Fedify, an #ActivityPub server framework, released! The key changes include:
Instrumented spans for OpenTelemetry are added. In most cases, it's automatically enabled if your application configured OpenTelemetry SDK.
Since Fedify 1.3.0, you can configure different MessageQueues for incoming and outgoing activities.
Fedify now allows you to manually route an Activity to the corresponding inbox listener. It is useful for invoking an inbox listener for an Activity enclosed by another Activity.
Context.sendActivity() and InboxContext.forwardActivity() methods now reject when they fail to enqueue the task.
Thanks to @nprofile…5rsf, @fedify/fedify/x/sveltekit module is added for integrating with SvelteKit hook.
Fedify now makes HTTP requests with the proper User-Agent header, e.g., User-Agent: Fedify/1.3.0 (Deno/2.1.2).
For details, see the full changelog as well!
Fedify 1.3.0 is available at JSR and npm.

2024-11-25 16:45:36 UTC

- reply

#Fedify's @nprofile…lgxc instrumentation works like a charm with @nprofile…7sx0! :opentelemetry: :sentry:
#OpenTelemetry #Sentry
https://media.social.fedify.dev/media/01936436-b9bd-7a20-a99d-6bc26cf28148/original
https://media.social.fedify.dev/media/01936436-b9dd-755e-b94d-754929db2dc5/original

2024-11-25 16:17:31 UTC

- reply

Many more spans were added today! :opentelemetry:
https://unstable.fedify.dev/manual/opentelemetry#instrumented-spans

2024-11-25 07:14:24 UTC

- reply

:opentelemetry: @nprofile…lgxc instruments are being added one by one to #Fedify…!

2024-11-24 08:26:32 UTC

Though we have OpenTelemetry Semantic Conventions 1.28.0, it does not yet define attributes related to the fediverse. So #Fedify is taking the initiative to define semantic attributes related to the ActivityPub protocol and its related protocols. If you have any ideas, please leave a comment!
https://gist.github.com/dahlia/7ad0f197a3a87072707996b2ee14a749

2024-11-23 17:30:00 UTC

Thanks to @nprofile…5rsf, #SvelteKit integration support has been added to #Fedify! This feature will be included in Fedify 1.3.0.
https://unstable.fedify.dev/manual/integration#sveltekit

2024-11-22 12:13:30 UTC

- reply

내일 행사를 위해 급하게 처음으로 기여하는 분들을 위한 이슈를 만들고 있습니다!

2024-11-22 04:30:29 UTC

내일 서울 서초구 오픈업 플레이그라운드에서 이뤄지는 Open Contribution Jam 2024에 #Fedify 메인테이너(@nprofile…0vgm)가 참여합니다. Fedify에 기여해보고 싶은 분들은 와주시면 메인테이너가 성심껏 도와드리겠습니다! 자세한 행사 정보는 아래 링크를 참고하시면 됩니다.
https://festa.io/events/6342

2024-11-20 10:12:51 UTC

We are going to add instrumentation support for #OpenTelemetry to #Fedify. What kind of spans or events would you like to be instrumented?

2024-11-19 11:51:54 UTC

Starting with #Fedify 1.3.0, you'll be able to use different message queues for incoming and outgoing activities!
https://unstable.fedify.dev/manual/mq#using-different-message-queues-for-different-tasks

2024-10-31 08:46:50 UTC

Visualize your server in the fediverse with the fedify node command and share it with us using the #FedifyNode hashtag!
(See also how to install the fedify command.)
#ActivityPub #fedidev
https://media.social.fedify.dev/media/0192e1c1-6df9-7724-bbdd-a58f89c2d6e9/original
https://media.social.fedify.dev/media/0192e1c1-6da8-7f67-8aeb-8a44bc5834cf/original
https://media.social.fedify.dev/media/0192e1c1-6dfd-757e-b9a7-8e574f041a5d/original
https://media.social.fedify.dev/media/0192e1c1-6e43-793f-af88-0894c503c649/original

2024-10-31 06:50:41 UTC

The version 1.2.0 of #Fedify, an #ActivityPub server framework, released! The key changes include:
Added InboxContext.recipient property. It's useful for determining whether it is a shared inbox or a personal inbox, and whose personal inbox is invoked.
Added getNodeInfo() function, a NodeInfo client.
Added followedMessage property, which corresponds to _misskey_followedMessage, to Actor type in Activity Vocabulary API.
Log messages now can be traced using LogTape's implicit contexts, which means you can filter log messages by requestId (an HTTP request identifier) or messageId (a background task identifier).
Now you can choose an AMQP driver (which supports RabbitMQ) for the message queue in the fedify init command.
Added the fedify node subcommand, which fetches the given instance's NodeInfo document and visualizes it in neofetch-style.
For details, see the full changelog as well!
Fedify 1.2.0 is available at JSR and npm.
#fedidev

2024-10-29 06:54:42 UTC

The next release of Fedify will introduce the fedify node command, which fetches the NodeInfo of the asked instance and visualizes it in neofetch-style.
https://media.social.fedify.dev/media/0192d70d-46c8-7fe2-a1ba-d8b2e28a8e88/original
https://media.social.fedify.dev/media/0192d70d-4703-7752-bce5-f260bac999c7/original
https://media.social.fedify.dev/media/0192d70e-0659-727f-8419-63ca4e1b6af6/original
https://media.social.fedify.dev/media/0192d70d-4704-7862-9556-d01a0e465a33/original

2024-10-04 04:27:56 UTC

If you're considering creating your own implementation of #ActivityPub, consider #Fedify.
Implementing ActivityPub from scratch requires more than you might think. WebFinger, HTTP Signatures, Linked Data Signatures, Object Integrity Proofs, NodeInfo, queues for sending and receiving activities, followers collection synchronization, remote object lookups, interoperability with Mastodon, Akkoma, Misskey, Threads, and more…
Just use Fedify and feel free to create your own ActivityPub implementation!
#fedidev
https://fedify.dev/

2024-09-18 12:54:59 UTC

In the next release of #Fedify, v1.0.0, you'll be able to forward received activities inside an inbox listener without any modifications.
You can preview this feature in v1.0.0-dev.398+5c6e1394 (JSR & npm).
https://unstable.fedify.dev/manual/inbox#forwarding-activities-to-another-server

2024-09-09 11:12:58 UTC

In the next version of #Fedify, the Article, ChatMessage, Note, and Question classes will have a quoteUrl property. This property corresponds to the following three JSON-LD properties all at once:
as:quoteUrl
misskey:_misskey_quote
fedibird:quoteUri
Available for preview in version 0.15.0-dev.384+6c39741b (JSR & npm).

2024-09-05 17:29:55 UTC

We just finished drafting a new tutorial for #Fedify! This tutorial will walk you through the steps of creating your own federated #microblog. It's pretty long, though.
Please read it, give us feedback, and have fun!
https://unstable.fedify.dev/tutorial/microblog
#fedidev #ActivityPub

2024-09-03 10:47:18 UTC

Are there any features you'd like to see in #Fedify?
#fedidev #ActivityPub

2024-08-26 07:47:01 UTC

Do you know that? Some of the properties in Activity Vocabulary have been renamed in #Fedify's JavaScript APIs. Below are some examples:
alsoKnownAs → aliases
publicKeyPem → publicKey
hreflang → language
publicKeyMultibase → publicKey
orderedItems → items
oneOf → exclusiveOptions
anyOf → inclusiveOptions
votersCount → voters
attributedTo → attributions
inReplyTo → replyTargets
#ActivityPub #fedidev

2024-08-17 04:45:48 UTC

In the next version (v0.14.0) of #Fedify, the performance of the Object.toJsonLd() method will be dramatically (~3k ×) faster. This is expected to improve the overall performance of Fedify apps!
#fedidev #JSONLD #ActivityPub

2024-07-19 02:33:05 UTC

The fedify command is now available on #npm! You can install it using the following command:
npm install -g @fedify/cli
Or if you use #Bun:
bun install -g @fedify/cli
https://www.npmjs.com/package/@fedify/cli
#Fedify

2024-07-01 02:21:08 UTC

In the next version of #Fedify, the Context.hostname, Context.host, and Context.origin properties will be added for better multitenancy/virtual hosting support.
https://github.com/dahlia/fedify/issues/66#issuecomment-2198967566
#fedidev #ActivityPub

2024-06-28 05:56:10 UTC

Hello, #fediverse! It's the official fedi account of the Fedify, an #ActivityPub server framework!
#Fedify #fedidev