Fedify 2.0.3

Released on March 3, 2026.

@fedify/postgres

• Fixed PostgresMessageQueue.listen() crashing the process when a malformed NOTIFY payload is received. Temporal.Duration.from() was called without error handling, so an invalid duration string caused an unhandled RangeError that propagated through the postgres driver. The NOTIFY callback is now wrapped in a try–catch that logs the error and falls back to an immediate poll. [#594]

• Fixed PostgresMessageQueue.listen() permanently stalling all message processing when a message handler hangs indefinitely (e.g., due to an unresponsive remote server). The serializedPoll mechanism chains every poll() invocation onto a single promise, so a single hung handler blocked the entire queue permanently. Handler invocations are now wrapped with a configurable timeout (default: 60 seconds) via the new handlerTimeout option in PostgresMessageQueueOptions. When a handler exceeds the timeout, it is treated as an error and the poll loop moves on, preventing permanent stalls. [#595]

Fedify 2.0.2

Released on February 27, 2026.

@fedify/fedify

• Removed the deprecated third and fourth parameters (signedKey and signedKeyOwner) from AuthorizePredicate and ObjectAuthorizePredicate. These parameters were deprecated since Fedify 1.5.0 in favor of RequestContext.getSignedKey() and RequestContext.getSignedKeyOwner() methods, but were mistakenly left in the Fedify 2.0.0 release. The internal handler code that eagerly called getSignedKey() and getSignedKeyOwner() before invoking the predicate has also been removed; predicates should now call those methods themselves when needed. [#473, #590]

Fedify 2.0.1

Released on February 24, 2026.

@fedify/cli

• Fixed fedify command hanging indefinitely when invoked as an executable (e.g., via npx @fedify/cli or npm exec -- fedify) on Linux. The shebang line #!/usr/bin/env node --disable-warning=ExperimentalWarning was passing node --disable-warning=ExperimentalWarning as a single argument to env, which caused an infinite exec loop on Linux because the kernel passes all shebang arguments as one string. Fixed by using env -S to properly split arguments: #!/usr/bin/env -S node --disable-warning=ExperimentalWarning.

@fedify/postgres

• Fixed PostgresMessageQueue.listen() permanently stopping message processing when poll() throws (e.g., transient PostgreSQL errors or handler failures). listen() now catches polling errors for subscribe, notify, and interval-triggered polls, logs them, and retries on subsequent triggers instead of terminating the listener. [#581]

• PostgresMessageQueue.initialize() now creates an index on the created column (idx_{table}_created) to improve dequeue query performance under backlog growth. [#581]

Fedify 2.0.0

Released on February 22, 2026.

@fedify/fedify

• Remove contextLoader option (which was deprecated) from FederationOptions interface in favor of contextLoaderFactory option for better flexibility. [#376, #445 by Hasang Cho]

• Migrated from @phensley/language-tag package and its LanguageTag class to the standardized Intl.Locale class for representing language tags. [#280, #392 by Jang Hanarae]

  • The LanguageString.language property is now LanguageString.locale and is of type Intl.Locale instead of LanguageTag.
  • The LanguageString constructor now accepts either an Intl.Locale object or a string for the language parameter.
  • The Link.language property is now of type Intl.Locale instead of LanguageTag.
  • Removed the @phensley/language-tag dependency.

• Remove documentLoader option (which was deprecated) from FederationOptions interface in favor of documentLoaderFactory option for better flexibility. [#376, #393 by Hasang Cho]

• Remove CreateFederationOptions<TContextData> interface (which was deprecated since 1.6.0). Use FederationOptions<TContextData> instead. [#376]

• Remove fetchDocumentLoader() function (which was deprecated since 0.14.0). Use getDocumentLoader() from @fedify/vocab-runtime instead. [#376]

• Remove { handle: string } parameter form from sendActivity(), forwardActivity(), getDocumentLoader(), and ParseUriResult. Use { identifier: string } or { username: string } instead. [#376]

• Changed NodeInfo software.version field type from SemVer to string to properly handle non-SemVer version strings in accordance with the NodeInfo specification. [#366, #433 by Hyeonseo Kim]

  • The parseNodeInfo() function now returns version as string instead of SemVer object.
  • The Software.version field is now of string (was of SemVer).
  • Removed parseSemVer() and formatSemVer() functions.
  • Updated related CLI tools and documentation.

• Federation dispatchers are now only triggered when the request accepts ActivityPub-compatible content types. This improves compatibility with applications that serve both HTML and ActivityPub content from the same URLs. [#434 by Emelia Smith]

  • Actor, object, and collection dispatchers will no longer be called for requests with Accept: text/html or other non-ActivityPub content types.
  • The notAcceptable callback is now triggered at the middleware level before dispatchers are invoked.
  • If your application relies on dispatchers being called regardless of Accept header, you may need to adjust your routing logic.

• Changed the default activity idempotency strategy from "per-origin" to "per-inbox" to align with standard ActivityPub behavior. [#441]

  • Activities are now deduplicated per inbox by default, allowing the same activity ID to be processed once per inbox independently.
  • The previous "per-origin" strategy (deduplicate per receiving server) can still be explicitly configured using .withIdempotency("per-origin").
  • This change ensures proper delivery of activities to multiple inboxes on the same server, fixing issues where activities were incorrectly deduplicated globally.

• Separated modules from @fedify/fedify/runtime to improve modularity and reduce coupling between vocabulary generation and core federation functionality. [#444, #451 by ChanHaeng Lee]

  • Modules related to ActivityPub vocabulary generation have been extracted into the new @fedify/vocab-runtime package.
  • Other utility modules from @fedify/fedify/runtime have been reorganized into the @fedify/fedify/utils directory within the main package.
  • Updated import paths throughout the codebase to reflect the new module organization.

• Deprecated the @fedify/fedify/runtime module in favor of the new @fedify/vocab-runtime package. The @fedify/fedify/runtime module now re-exports all exports from @fedify/vocab-runtime for backward compatibility, but will be removed in a future version. Please migrate to @fedify/vocab-runtime directly. [#560]

• The KvCacheParameters.rules option's type became [string | URL | URLPattern, Temporal.Duration | Temporal.DurationLike][] (was [string | URL | URLPattern, Temporal.Duration][]).

• The @fedify/fedify/x/* modules are removed. Also, there are no Fresh integration for now. [#391 by Chanhaeng Lee]

  • Removed @fedify/fedify/x/cfworkers in favor of @fedify/cfworkers.
  • Removed @fedify/fedify/x/denokv in favor of @fedify/denokv.
  • Removed @fedify/fedify/x/hono in favor of @fedify/hono.
  • Removed @fedify/fedify/x/sveltekit in favor of @fedify/sveltekit.
  • Removed @fedify/fedify/x/fresh (Fresh integration). [#466]

• Deprecated the @fedify/fedify/vocab module in favor of the new @fedify/vocab package. The @fedify/fedify/vocab module now re-exports all exports from @fedify/vocab for backward compatibility, but will be removed in a future version. Please migrate to @fedify/vocab directly. [#437, #517 by ChanHaeng Lee]

• The KvStore.list() method is now required instead of optional. This method was added as optional in version 1.10.0 to give existing implementations time to add support. All official KvStore implementations already support this method. [#499, #506]

• Added orderingKey option to MessageQueueEnqueueOptions interface for ordered message delivery. Messages with the same ordering key are guaranteed to be processed in the order they were enqueued, while messages with different ordering keys can be processed in parallel. This helps prevent race conditions when processing related activities (e.g., ensuring a Delete activity is processed after a Create activity for the same object). [#536, #538, #540, #544]

  • Added MessageQueueEnqueueOptions.orderingKey property.
  • All properties in MessageQueueEnqueueOptions are now readonly.
  • InProcessMessageQueue now supports the orderingKey option.
  • Added SendActivityOptions.orderingKey option to ensure ordered delivery of activities for the same object. When specified, activities with the same orderingKey are guaranteed to be delivered in order to each recipient server.

• Added Federatable.setOutboxPermanentFailureHandler() method to handle permanent delivery failures (such as 410 Gone or 404 Not Found) when sending activities to remote inboxes. This allows applications to clean up unreachable followers and avoid future delivery attempts to permanently failed inboxes. [#548, #559]

• Added permanentFailureStatusCodes option to FederationOptions to configure which HTTP status codes are treated as permanent delivery failures. By default, 404 and 410 are treated as permanent failures. [#548, #559]

• Added SendActivityError class, a structured error that is thrown when an activity fails to send to a remote inbox. It includes the HTTP status code, the inbox URL, and the response body, making it easier to programmatically handle delivery errors. [#548, #559]

• Added traceId and spanId to LogTape context in federation middleware so that log records emitted during request handling and queue processing include the OpenTelemetry trace and span IDs in their properties. This enables the @fedify/debugger dashboard to display per-trace logs. [#561, #564]

• Fixed unbounded memory consumption when activity delivery fails with large error responses. The SendActivityError.responseBody property is now limited to 1 KiB to prevent memory pressure when remote servers return large HTML error pages (e.g., Cloudflare error pages of 50–100 KB each). This prevents potential OOM crashes in production environments with many unreachable inboxes. [#569]

@fedify/cli

• The Fedify CLI now runs natively on Node.js and Bun without requiring compiled binaries, providing a more natural JavaScript package experience for Node.js and Bun users. [#374, ...

Fedify 1.10.3

Released on February 1, 2026.

@fedify/fedify

• Fixed traverseCollection() yielding no items when a Collection has an inline CollectionPage in its first property without an explicit id. This is common in Mastodon's replies collections. The function previously used collection.firstId to determine pagination, which returned null for inline pages without an id, causing it to incorrectly fall into the non-paginated branch. [#550 by Lee Dogeon]

Fedify 1.9.5

Released on February 1, 2026.

@fedify/fedify

• Fixed traverseCollection() yielding no items when a Collection has an inline CollectionPage in its first property without an explicit id. This is common in Mastodon's replies collections. The function previously used collection.firstId to determine pagination, which returned null for inline pages without an id, causing it to incorrectly fall into the non-paginated branch. [#550 by Lee Dogeon]

Fedify 1.10.2

Released on January 23, 2026.

@fedify/testing

• Fixed TestContext.getActorKeyPairs() returning empty array instead of calling registered key pairs dispatcher. The method now properly invokes the key pairs dispatcher when it is registered via setKeyPairsDispatcher(). [#530]

Fedify 1.9.4

Released on January 23, 2026.

@fedify/testing

• Fixed TestContext.getActorKeyPairs() returning empty array instead of calling registered key pairs dispatcher. The method now properly invokes the key pairs dispatcher when it is registered via setKeyPairsDispatcher(). [#530]

Fedify 1.10.1

Released on January 22, 2026.

@fedify/testing

• Fixed TestContext.getActor() and TestContext.getObject() returning null instead of calling registered dispatchers. The methods now properly invoke actor and object dispatchers when they are registered via setActorDispatcher() and setObjectDispatcher(). [#530]

Fedify 1.9.3

Released on January 22, 2026.

@fedify/testing

• Fixed TestContext.getActor() and TestContext.getObject() returning null instead of calling registered dispatchers. The methods now properly invoke actor and object dispatchers when they are registered via setActorDispatcher() and setObjectDispatcher(). [#530]