← Feed

Posts

• View post

  BotKit security updates: 0.4.11 and 0.5.8 If you use BotKit, update to a patched release now. GHSA-r48c-xx2h-fv4g is a DNS rebinding vulnerability in Fedify, which BotKit uses for federation. An attacker could bypass its server-side request forgery (SSRF) protection and cause your bot's server to reach internal services. Deno deployments need additional network restrictions; upgrading BotKit alone does not close the vulnerability on Deno. Fedify checked that a hostname resolved only to pu...

• View post

  BotKit security updates: 0.4.10 and 0.5.7 中文（中国） (Chinese (China)): BotKit 安全更新：0.4.10 与 0.5.7 · 自动翻译 If you use BotKit, update to a patched release now. This update addresses two vulnerabilities: GHSA-4qhx-hhwf-8685, an inbox origin validation flaw that could let an attacker supply forged objects or suppress genuine activities, and GHSA-8863-8468-7hq7, a key ownership validation flaw that could authenticate activities as the wrong actor under specific actor-document configurations. Both fla...

• View post

  If you use BotKit, update to a patched release now. Two vulnerabilities affect Fedify versions included by BotKit as a dependency: CVE-2026-77632, a high-severity server-side request forgery vulnerability in the authenticated document loader, and CVE-2026-69132, a medium-severity denial-of-service vulnerability in the outbound delivery circuit breaker. CVE-2026-77632 affects the authenticated document loader Fedify uses to fetch remote documents such as actors and public keys with signed HTTP...

• View post

  If you use BotKit, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client, and BotKit includes the affected Fedify versions as a dependency. Fedify can look up a remote server's NodeInfo document to learn what software it runs. The lookup first fetches the server's /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable paths are getNodeInfo() and the Context.lookupNodeInfo() method that wraps it...

• View post

  A tutorial on building a fediverse RSS bot is now up on the BotKit website. It supports both Deno and Node.js, and even covers how to dynamically add RSS feeds. It's designed to be easy to follow even if you have zero experience with ActivityPub development, so be sure to check it out!

• View post

  한국어 (Korean): BotKit 0.5.0: 새로운 디자인 언어, 멀티봇 인스턴스, 그리고 동의 기반 인용 We're pleased to announce BotKit 0.5.0. This release changes how both the docs site and every bot's own pages look, and it stops limiting a server to one bot: a single process can now host a whole fleet of them. Quoting, and being quoted, goes through a consent step under FEP-044f, and a Redis-backed repository joins the SQLite and PostgreSQL ones for shared production storage. A few of these changes are breaking; see belo...

• View post

  BotKit 0.5.0 is out: a redesigned botkit.fedify.dev and bot pages, multi-bot instances on a single process, consent-respecting quotes via FEP-044f, and a new Redis repository. RE: https://hackers.pub/@botkit/2026/botkit-0-5-0

• View post

  Welcome to BotKit's new official account! The previous account, @botkit@hollo.social, is no longer in use and has been replaced by this one.