svemagie.net/indiekit-server
1
0
Fork 0
Code Issues 1 Actions Packages Projects Releases Activity

security: update @fedify/fedify + @fedify/vocab-runtime to 2.2.5

Browse Source 
Patches CVE-2026-50131 (GHSA-xw9q-2mv6-9fr8, CVSS 8.6) — incomplete SSRF
mitigation in isValidPublicIPv4Address() that allowed requests to special-use
IPv4 ranges (CGNAT 100.64.0.0/10, multicast, documentation).

Promote both @fedify/fedify and @fedify/vocab-runtime to direct dependencies
pinned at ^2.2.5 to prevent transitive resolution back to vulnerable versions.

Was 2.2.1 -> now 2.2.5 (fix is in 2.2.4+).

Refs: https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8
This commit is contained in:
Sven
2026-06-08 19:10:58 +02:00
parent 521bc04c4e
commit 6eeadeb2fa
2 changed files with 30 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package-lock.json
Generated
+28 -25
View File
@@ -10,6 +10,8 @@
"hasInstallScript": true,
"license": "ISC",
"dependencies": {
"@fedify/fedify": "^2.2.5",
"@fedify/vocab-runtime": "^2.2.5",
"@indiekit/endpoint-json-feed": "^1.0.0-beta.25",
"@indiekit/indiekit": "^1.0.0-beta.27",
"@indiekit/post-type-repost": "^1.0.0-beta.25",
@@ -313,9 +315,9 @@
}
},
"node_modules/@digitalbazaar/http-client/node_modules/undici": {
"version": "6.25.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.25.0.tgz",
"integrity": "sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==",
"version": "6.26.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.26.0.tgz",
"integrity": "sha512-4yqz8a3n5HmGTlsbADNtr/dJlhkh/55Rq798G6ibiULcXbDtaLpTl1pvdqcbFfeoj3iSi52lePFM7h9H21cw/A==",
"license": "MIT",
"engines": {
"node": ">=18.17"
@@ -781,18 +783,18 @@
}
},
"node_modules/@fedify/fedify": {
"version": "2.2.1",
"resolved": "https://registry.npmjs.org/@fedify/fedify/-/fedify-2.2.1.tgz",
"integrity": "sha512-OIxa7+Kp6KDpz8v6bgo67Zg8fWRNdyNbOx21WrJbPhh6RaSl7SkVm1GAQ2ehIS318ipoFUD00DvM6sKbcR+DYg==",
"version": "2.2.5",
"resolved": "https://registry.npmjs.org/@fedify/fedify/-/fedify-2.2.5.tgz",
"integrity": "sha512-nARV2R/lkPgUb7XBZkg+MjmZUr0vkoEWG2w/+7Rle7uf2jgk8bL3axxl95xUkvf7gWwqHrBXgw9RXWReMFIFaw==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
],
"license": "MIT",
"dependencies": {
"@fedify/vocab": "2.2.1",
"@fedify/vocab-runtime": "2.2.1",
"@fedify/webfinger": "2.2.1",
"@fedify/vocab": "2.2.5",
"@fedify/vocab-runtime": "2.2.5",
"@fedify/webfinger": "2.2.5",
"@js-temporal/polyfill": "^0.5.1",
"@logtape/logtape": "^2.0.5",
"@opentelemetry/api": "^1.9.0",
@@ -833,18 +835,18 @@
}
},
"node_modules/@fedify/vocab": {
"version": "2.2.1",
"resolved": "https://registry.npmjs.org/@fedify/vocab/-/vocab-2.2.1.tgz",
"integrity": "sha512-sYVnwJLUYEiG6AuxR7Q+eYA3c+PzcZSDGxjmkFnMQ4mO1IU6G9Od85b66buGIV29g1+mgTYJLkBvNiLEOqBbaA==",
"version": "2.2.5",
"resolved": "https://registry.npmjs.org/@fedify/vocab/-/vocab-2.2.5.tgz",
"integrity": "sha512-68CYYd239zgfcVppUZGA7D90y0gEcAXNzSxUOBLy04XUZG6MUO81xk5k/j4l9Twagf1KtfQI/gwPpldfpBJeQQ==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
],
"license": "MIT",
"dependencies": {
"@fedify/vocab-runtime": "2.2.1",
"@fedify/vocab-tools": "2.2.1",
"@fedify/webfinger": "2.2.1",
"@fedify/vocab-runtime": "2.2.5",
"@fedify/vocab-tools": "2.2.5",
"@fedify/webfinger": "2.2.5",
"@js-temporal/polyfill": "^0.5.1",
"@logtape/logtape": "^2.0.5",
"@multiformats/base-x": "^4.0.1",
@@ -861,15 +863,16 @@
}
},
"node_modules/@fedify/vocab-runtime": {
"version": "2.2.1",
"resolved": "https://registry.npmjs.org/@fedify/vocab-runtime/-/vocab-runtime-2.2.1.tgz",
"integrity": "sha512-NRnlhUv2mmVGNMrjhmTUMN1gZaDax8KmBkUHV3U5PMDSA2aSGQ/iWCruoV4TeaCAI1nX1AW0kAH8Q9Uwkb6f8Q==",
"version": "2.2.5",
"resolved": "https://registry.npmjs.org/@fedify/vocab-runtime/-/vocab-runtime-2.2.5.tgz",
"integrity": "sha512-EiPkMwBqYsoSrllMOCFb0RTDwEO6XvppMmPa81lCux+7g9zXygKrJb9hJ9PP8Zi59+cJGqIF/Gdhug239+tZug==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
],
"license": "MIT",
"dependencies": {
"@js-temporal/polyfill": "^0.5.1",
"@logtape/logtape": "^2.0.5",
"@multiformats/base-x": "^4.0.1",
"@opentelemetry/api": "^1.9.0",
@@ -885,9 +888,9 @@
}
},
"node_modules/@fedify/vocab-tools": {
"version": "2.2.1",
"resolved": "https://registry.npmjs.org/@fedify/vocab-tools/-/vocab-tools-2.2.1.tgz",
"integrity": "sha512-b8Gu/clgudHjSSWEVrzm3N85xlAk23keNAxLPL6uQp+oybtG7ZvBXyUMOwFvrQLKtAmcPvRh0XXVETMN2hWv2g==",
"version": "2.2.5",
"resolved": "https://registry.npmjs.org/@fedify/vocab-tools/-/vocab-tools-2.2.5.tgz",
"integrity": "sha512-D5GMXvcoSeNhI68BBPlpLHAlI7dqc0pheqj3NDCp9f5bBagXz7o+oevzzjZFxiHgxYQfRVoZ2N5lFNEy5d27gQ==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
@@ -906,16 +909,16 @@
}
},
"node_modules/@fedify/webfinger": {
"version": "2.2.1",
"resolved": "https://registry.npmjs.org/@fedify/webfinger/-/webfinger-2.2.1.tgz",
"integrity": "sha512-gRGgjCLgfvovLstTAa7U4d170SsQQSb0pIPCyE7hMRvzdgU+uIPwbtgm5Btbe/ZognzCN2Q6ELx+tAsuQGbY5g==",
"version": "2.2.5",
"resolved": "https://registry.npmjs.org/@fedify/webfinger/-/webfinger-2.2.5.tgz",
"integrity": "sha512-NHJ0Q+YXbkE3mmQZhf5/UccSTOVUwtOCm9bQmFKGd8BbY5HCnjMceVZqLlCLT4AC6d7o5j9717KPl7+B2b7XvA==",
"funding": [
"https://opencollective.com/fedify",
"https://github.com/sponsors/dahlia"
],
"license": "MIT",
"dependencies": {
"@fedify/vocab-runtime": "2.2.1",
"@fedify/vocab-runtime": "2.2.5",
"@logtape/logtape": "^2.0.5",
"@opentelemetry/api": "^1.9.0",
"es-toolkit": "1.43.0"
package.json
+2
View File
@@ -23,6 +23,8 @@
"@indiekit/frontend": "npm:@rmdes/indiekit-frontend@^1.0.0-beta.37"
},
"dependencies": {
"@fedify/fedify": "^2.2.5",
"@fedify/vocab-runtime": "^2.2.5",
"@indiekit/endpoint-json-feed": "^1.0.0-beta.25",
"@indiekit/indiekit": "^1.0.0-beta.27",
"@indiekit/post-type-repost": "^1.0.0-beta.25",