Home | Notifications | New Note | Local | Federated | Search | Logout
fedicat@fedicat@pc.cafe
The official account for the Fedicat fediverse iOS client available on TestFlight. I try to include other fediverse stuff to keep it interesting.
the website: https://fedicat.com/
daily builds on tesflight: https://testflight.apple.com/join/b6GatWTY
some code on codeberg: https://codeberg.org/technicat/fedicat
me, myself, and I: https://technicat.com/
Joined: 2026-04-16 05:05:56
353 notes, 1 following, 1 followers
fedicat@fedicat@pc.cafe boosted:
@fedify@hollo.social (2026-06-08 23:56:47)
Fedify security updates: 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5
If you use Fedify, update to a patched release now. CVE-2026-50131 affects Fedify's public URL validation for remote document and media loading. An attacker could use special-use IP address ranges to bypass Fedify's SSRF protections and cause a Fedify server to initiate requests to non-public or special-use network destinations, depending on the deployment environment and network routing.
Fedify validates remote ActivityPub document and media URLs before fetching them, including direct IP literals and hostnames resolved through DNS. The vulnerable path is validatePublicUrl(): affected versions rejected common private and local addresses, but still treated several special-use IPv4 ranges as public internet destinations. That gap could allow outbound requests to ranges such as carrier-grade NAT, benchmarking, multicast, reserved, and documentation networks.
The fix makes Fedify validate resolved addresses against public-network expectations instead of relying on the incomplete denylist. It rejects additional special-use IPv4 ranges and IPv6 translation or tunneling prefixes, including NAT64, Teredo, and 6to4 addresses, before remote document or media fetching proceeds.
Current patched releases are 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5. The GitHub Security Advisory is GHSA-xw9q-2mv6-9fr8, and the CVE ID is CVE-2026-50131.
Update @fedify/fedify:
npm update @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update @fedify/fedify
bun update @fedify/fedify
deno update @fedify/fedify
If your project depends directly on @fedify/vocab-runtime, update that package too.
After updating, redeploy. If you run other Fedify-based servers, update those too.
Thanks to Chaitanya Vilas Garware for the report and responsible disclosure.
If anything is unclear, ask below.
fedicat@fedicat@pc.cafe boosted:
@wild1145@mastodonapp.uk (2026-06-08 06:52:52)
Apologies to those that have had to wait longer than usual for accounts to be approved here on #MastodonAppUK and #Universeodon - We've had a large spike in spam accounts with increasingly legitimate looking reasons for joining and a wider range of domains and IPs than usual. It's taking a lot more work than normal to work out which accounts appear to be legitimate and which ones are bots / bad actors.
fedicat@fedicat@pc.cafe boosted:
@pachli@mastodon.social (2026-06-08 16:08:27)
#pachli development focus for the next couple of weeks is supporting the new #FeaturedCollections feature in the latest Mastodon release.
This is probably going to drop in multiple Pachli Current releases over the next few weeks. https://github.com/pachli/pachli-android/issues/2319 tracks the work.
fedicat@fedicat@pc.cafe boosted:
@Catfish_Man@mastodon.social (2026-06-08 05:19:08)
#Caturday nonsense
#CatsOfMastodon
---Attachments---
image: https://files.mastodon.social/media_attachments/files/116/710/671/373/304/964/original/8f864afcfef0c656.jpeg
image: https://files.mastodon.social/media_attachments/files/116/710/671/998/627/532/original/62f3af6f5d73de74.jpeg
image: https://files.mastodon.social/media_attachments/files/116/710/672/372/291/452/original/96812d1b76f1f852.jpeg
image: https://files.mastodon.social/media_attachments/files/116/710/673/155/463/364/original/4d67bda436967dde.jpeg
fedicat@fedicat@pc.cafe boosted:
@cheeaun@mastodon.social (2026-06-07 01:42:19)
Probably gone a bit overboard? It's fun though 🤔
Still WIP on local dev. #MastoDev #PhanpySocialDev #SneakPeek
---Attachments---
image: https://files.mastodon.social/media_attachments/files/116/704/158/400/851/880/original/fb28a804bf2bffbc.png
video: https://files.mastodon.social/media_attachments/files/116/704/158/443/097/790/original/83f8e745d791845f.mp4
fedicat@fedicat@pc.cafe boosted:
@sabrinkmann@hachyderm.io (2026-06-02 04:15:16)
The Fediverse is so cool because of the diversity of the different software. In the last weeks, I did build a (completely?) new one. The Menuverse consists of two software: 1) create daily changing dishes like in a canteen, and 2) can aggregate different of this actors in a marketplace. The working title for this is Menuverse.
Every canteen is Fediverse actor and not only can these marketplaces subscribe to this, but also other softwares like Mastodon, Misskey and so on.
I created a demo setup with live data from different university canteens here:
https://mahlzeitheute.de/ This is the marketplace software)
(The data and frontend is currently only in German).
You can also visit or follow the nearest canteen to me here: @fl-ca1.
You can find the full software here: https://codeberg.org/54GradSoftware/menuverse
But please note that this still quite experimental and I would not advise running in production (unsupervised).
I would love to get (technical) feedback, and I'm looking for real canteens who would like to test the software.
More information in the next posts (this is a thread). [1/4]
#fep0837 #FediverseDevs #fediverse
fedicat@fedicat@pc.cafe boosted:
@lauti@bonfire.cafe (2026-06-05 23:05:18)
The next step in our #activitypub implementation is ready! This brings a simple instance actor object along with #webfinger support for it and a #nodeinfo endpoint.
We highly appreciate reviews from any #fedidev 🙏
codeberg.org/Klasse-Methode/...
We are really greatfull for @nlnet@social.nlnet.nl to fund this work and for @linos@graz.social for being such a great mentor!
fedicat@fedicat@pc.cafe boosted:
@betula@fosstodon.org (2026-06-06 23:25:12)
Introducing Betula v1.8.0
#Betula is a self-hosted federated bookmark manager. Tags, notes, search, #Fediverse, archives.
This release introduces import and export of bookmarks in Netscape Bookmark File, Pinboard JSON and Raindrop CSV.
Release notes: https://joinbetula.org/v1.8.0.html
This release was sponsored by @nlnet
May you be happy!
---Attachments---
image: https://cdn.fosstodon.org/media_attachments/files/116/703/612/372/254/233/original/0d6d82f3200cdc30.png
fedicat@fedicat@pc.cafe boosted:
@koen@pixelfed.com (2026-06-07 17:37:08)
Look #plushtodon at #tdose 20 year anniversary edition.
---Attachments---
image: https://pixelfed.web.procolix.eu/public/m/_v2/821091058097852417/b5862bd14-4506fa/IGFyiM4c96u6/VIXA6I5mwmUZCaGu0TO1Lvulpv5WxOhyf6gyiKC4.jpg
fedicat@fedicat@pc.cafe boosted:
@box464@mastodon.social (2026-06-07 00:47:09)
Updated my test instance to Mastodon v4.5.11 - perhaps one of the fastest updates so far! Looks like the beta version of 4.6 is out, too.
https://github.com/mastodon/mastodon/releases/tag/v4.6.0-beta.1
#MastoAdmin
fedicat@fedicat@pc.cafe boosted:
@fedify@hollo.social (2026-06-06 22:50:16)
There's a Matrix room for #Fedify contributors, open to anyone curious about how development happens. Feel free to drop in or lurk; small questions are fine too.
#fedify-contributors:matrix.org
fedicat@fedicat@pc.cafe boosted:
@dansup@mastodon.social (2026-06-06 20:06:20)
Introducing Loops for Developers ✨
https://joinloops.org/developers
#Loops #Developers #LoopsAPI
fedicat@fedicat@pc.cafe boosted:
@pinkleap@mastodon.social (2026-04-28 19:30:40)
Pinkleap is a photo client for Mastodon and Pixelfed.
Start using it at https://pinkleap.app
---Attachments---
image: https://files.mastodon.social/media_attachments/files/116/481/855/643/706/072/original/1858ce705c9fc8dd.png
fedicat@fedicat@pc.cafe boosted:
@dansup@mastodon.social (2026-06-06 22:31:36)
You, the people, and NLnet, have funded a fully open TikTok alternative with web and mobile clients, ActivityPub federation and an opt-out For You feed algorithm that is privacy friendly.
Anyone can start their own Loops community, and we're working on an official hosting service to help fund development.
Join 🚀: https://joinloops.org/join-the-beta
Roadmap ✨: https://joinloops.org/roadmap
Donate 🙏: https://joinloops.org/donate
Source 🤖: http://github.com/joinloops
#Loops #TikTok #ActivityPub
fedicat@fedicat@pc.cafe boosted:
@apps@toot.fedilab.app (2026-06-06 03:46:24)
RE: https://toot.fedilab.app/@apps/116698420184041446
If you're on mastodon.social or any instance that runs the 4.6 beta, the latest Collections feature should work. If you run into a problem, please open an issue on #Codeberg. Thank you.
https://codeberg.org/tom79/Fedilab/issues
fedicat@fedicat@pc.cafe boosted:
@cheeaun@mastodon.social (2026-06-06 12:33:18)
oh, search returns collections 😮
#MastoDev
---Attachments---
image: https://files.mastodon.social/media_attachments/files/116/701/055/949/493/440/original/331757b9a566499b.png
image: https://files.mastodon.social/media_attachments/files/116/701/055/936/861/976/original/4f3899888b91b1ae.png
fedicat@fedicat@pc.cafe boosted:
@weekinfediverse@mitra.social (2026-06-06 04:50:29)
Week in Fediverse 2026-05-29
Servers
- Mastodon v4.5.11
- Hollo v0.9.3
- Wafrn v2026.06.01
- Ktistec v3.4.1
- tootik v0.23.1
- NeoDB v0.15.2
- wanderer v0.19.2
- Lemmy Development Update May 2026
- FitPub: A self-hosted fitness tracking platform for the Fediverse
- Harmony: Discord-style servers and chat with ActivityPub
- Menuverse: A federated menu system for canteens and institutions
- LAUTI: A calendar software where one can publish events, groups and places
Clients
- Pachli v3.7.0
- Elk v1.0.0
- Fedilab v3.41.0
- tooi v0.26.0
- Pixelix v4.4.0
- Aria v1.5.3
- Tesseract v1.5.0
- Interstellar v0.11.4
- Holos v1.8.0
- P2Play v0.10.1
For developers
- APx v0.25.0
Protocol
- FEP-bebd: Follow Invites
Articles
- Prikbord: Federated calendar for events in Rotterdam
- small details in my mastodon client that i wanted more people to notice
- From simple afterthought to over-engineered software
- FR#165 – Fediverse News May 2026
-----
#WeekInFediverse #Fediverse #ActivityPub
Previous edition: https://mitra.social/objects/019e7560-82be-7521-bbb4-2ca61a0d5ad8
fedicat@fedicat@pc.cafe boosted:
@csolisr@hub.azkware.net (2026-06-06 05:46:52)
Somebody went and built a chatroom powered directly by #ActivityPub, called "Harmony". Roughly the opposite of Movim, Harmony aims to replace Discord and even includes end-to-end encryption (although I wonder if it'll be compatible with the implementation by Bonfire and Emissary). mony.lol/
---Attachments---
unknown:
fedicat@fedicat@pc.cafe boosted:
@FediFollows@social.growyourown.services (2026-06-06 06:45:48)
Theatre accounts to follow (continued):
PERFORMERS
@aleciabatson - American actor, classical/opera singer
@RussSharek - Professional clown & podcaster based in the US
@riewarden - Producer/writer/actor in East Midlands of England
MISCELLANEOUS
@shakespearean_Insults - Random insulting quotations from Shakespeare
📣 NONE OF THESE ACCOUNTS ARE BLANK! If an account looks blank to you, no one from your server has followed it yet. Follow and its posts will start showing up on your server too.
3/3
fedicat@fedicat@pc.cafe boosted:
@Coreyartus@mindly.social (2025-10-15 03:43:49)
Happy #PortfolioDay ! My name is Corey Johnston, and I’m an artist living in Eureka, CA. I do digital pieces I make by hand in Procreate on my iPad, which I put on greeting cards, stationery, and prints.
I thought I might share some of my recent work. Lately, I’ve been focusing on the local flora and fauna here in Humboldt County in northern California.
I upload all my livestream recordings and speedpaints to MakerTube: https://makertube.net/a/coreyartus/video-channels
Artist links: https://coreyartusimageryinfo.carrd.co/
#art #artist #IndieArtist #MastoArt #Birds #Birdart #ArtNouveau #PortfolioDay2025
---Attachments---
image: https://a.mindlycdn.com/media_attachments/files/115/373/957/152/098/746/original/931b02fa8604707b.jpg
image: https://a.mindlycdn.com/media_attachments/files/115/373/962/587/582/864/original/b60fb46b67a40c32.jpg
image: https://a.mindlycdn.com/media_attachments/files/115/373/965/282/391/790/original/f10a1afbff662345.jpeg
image: https://a.mindlycdn.com/media_attachments/files/115/373/966/690/337/353/original/2652bfddb5d5132d.jpg
fedicat@fedicat@pc.cafe boosted:
@cheeaun@mastodon.social (2026-06-06 01:01:15)
Hmm, accidentally removed myself from @liaizon 's collection.
According to the official copy, "This action is permanent, and the curator won't be able to re-add you to the collection later on.".
So… I can't allow myself to be re-added? 😅
fedicat@fedicat@pc.cafe boosted:
@ayo@m.webtoo.ls (2026-06-05 19:51:14)
I'm super excited to be building more features for @elk :) I think it's a great time to be using it as a daily fediverse client if you are not doing that yet. Open to hear more feedback on how we can improve it.
fedicat@fedicat@pc.cafe boosted:
@toddsundsted@epiktistes.com (2026-06-05 04:03:39)
This release fixes a small number of bugs found in recent releases.
The full changelog:
Fixed
Prevent runaway recursion when handling filtered posts.
Ensure profile header and header_static images are always present.
Render the inline replies collection for local objects.
Exclude blocked actors from object statistics and notifications.
Changed
Return 410 Gone instead of 404 Not Found for missing actors.
Removed
Tag counts on public pages.
This release fixes a hard-to-exploit but potentially server-crashing bug. If you're running v3.3.9 or v3.4.0, you should upgrade.
#ktistec #crystallang #activitypub #fediverse
fedicat@fedicat@pc.cafe boosted:
@hongminhee@hollo.social (2026-06-05 13:02:36)
Small fedi badge update: the service has moved to a new domain. Please update your badges to use fedi-badge.minhee.org instead of fedi-badge.deno.dev. The old domain will stop working in July.
I also shipped a couple of related changes. Badges can now show the logo of the software an instance is running, like Mastodon, Misskey, Pleroma, and a few others, detected via NodeInfo. If the software isn't recognized, it falls back to the generic fediverse logo.
The service also moved from Deno Deploy Classic, which is sunsetting, to Cloudflare Workers.
fedicat@fedicat@pc.cafe boosted:
@apps@toot.fedilab.app (2026-06-05 13:24:56)
RE: https://toot.fedilab.app/@apps/116691506099830684
Collections are a new feature introduced in Mastodon 4.6 (currently in beta), the equivalent of starter packs. Anyone can create a group of accounts they recommend following, usually around a theme, and share that collection with a link. Collections are also displayed on the profile page. Only unlocked accounts that have opted into discovery features can be added to a collection, up to 25 accounts each. If someone adds you, you are notified and can remove yourself at any time.
fedicat@fedicat@pc.cafe boosted:
@mkljczk@pl.fediverse.pl (2026-06-05 09:12:28)
to anyone running the develop branch of nicolium, there are probably still some styling issues coming from the migration i’m kinda speedrunning rn, please report them if you encounter some. the style migration will make nicolium ui a lot more hackable than this tailwind shit so i think it’s worth some patience
fedicat@fedicat@pc.cafe boosted:
@peertube@framapiaf.org (2026-06-04 23:01:19)
Did you know you that on #PeerTube you can transfer the ownership of your videos to someone else?
It's really easy!
Please note that the user receiving the video must accept the transfer.
👉 https://docs.joinpeertube.org/use/library#change-ownership-of-a-video
---Attachments---
image: https://stockage.framapiaf.org/framapiaf/media_attachments/files/116/692/200/618/898/325/original/052fddca1d2e11b1.jpg
image: https://stockage.framapiaf.org/framapiaf/media_attachments/files/116/692/200/807/707/900/original/c35a817bc084a268.jpg
image: https://stockage.framapiaf.org/framapiaf/media_attachments/files/116/692/200/903/958/003/original/b5496eb87aec528d.jpg
fedicat@fedicat@pc.cafe boosted:
@box464@mastodon.social (2026-06-04 11:37:48)
I guess a little known fact is that Mastodon has a feature that allows you to schedule your posts. The default app doesn’t have this built in, but there are plenty of third party apps that do.
Mona
Trunks (long press on the post button)
Phanpy
Nicolium
Radiant
Fedicat
Elk
Coho
Tusky
Fedilab
Moshidon
SoraSNS
#MastoApps #FediDev
fedicat@fedicat@pc.cafe boosted:
@mastoblaster@mastoblaster.app (2026-06-04 15:20:03)
MastoBlaster build 100 is out!
It brings some requested fixes:
server marker sync can no longer replace the local restore target with an older status ID, even if the server marker has a newer timestamp. It should improve the last read position when closing and reopening the appMedia player fixesVoting shouldn’t require double tap#MastoBlaster #MastoBlasterUpdate
fedicat@fedicat@pc.cafe boosted:
@cheeaun@mastodon.social (2026-06-04 15:29:28)
Updated https://codeberg.org/cheeaun/mastodon-api-versions
Older Notes