Elektrine lite

← Feed

Hollo :hollo:

hollo@hollo.social

<p>:hollo: A federated single-user microblogging software.</p>

Posts

  • View post

    Hollo security updates: 0.8.17 and 0.9.25 If you run Hollo, update to 0.8.17 or 0.9.25 now. These releases fix GHSA-r48c-xx2h-fv4g, a DNS rebinding vulnerability in Fedify that could bypass Hollo&#39;s server-side request forgery (SSRF) protection and cause requests to reach internal services. Fedify checked that a hostname resolved only to public addresses, then let the HTTP client resolve it again when connecting. An attacker controlling the hostname&#39;s DNS answers could return a public ad...

  • View post

    Hollo security updates: 0.8.12 and 0.9.19 If you run Hollo, update to a patched release now. Fedify has disclosed three vulnerabilities that affect Hollo: CVE-2026-96625, a critical actor impersonation vulnerability; CVE-2026-96623, a high-severity denial-of-service vulnerability in remote document parsing; and CVE-2026-96624, a medium-severity server-side request forgery vulnerability in outbound activity delivery. Treat the actor impersonation issue as an immediate upgrade: anyone on the int...

  • View post

    Hollo security updates: 0.8.9 and 0.9.9 If you run Hollo, update to a patched release now. CVE-2026-62857 affects Fedify&#39;s NodeInfo client, which Hollo uses to identify the software running on remote ActivityPub servers. A NodeInfo lookup starts by fetching a remote server&#39;s /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable getNodeInfo() path fetched both URLs without validating that they resolved to public network desti...

  • View post

    Hollo 0.9.0 is out. https://github.com/fedify-dev/hollo/discussions/496 The biggest change this release is a complete redesign of every server-rendered page. Pico CSS is replaced by a new design system built on UnoCSS, and your chosen theme color now tints your profile and dashboard pages throughout. Other highlights: Passkey (WebAuthn) authentication: sign in with a biometric or PIN gesture, which counts as MFA so there&#39;s no separate TOTP stepFull FEP-044f quote authorization: QuoteRequ...

  • View post

    Hollo security updates: 0.7.17, 0.8.6, and 0.9.1 If you run Hollo, update to a patched release now. CVE-2026-42462 affects Fedify&#39;s Linked Data Signature handling, and Hollo depends on Fedify for ActivityPub federation. Fedify verifies incoming ActivityPub activities with several mechanisms, including HTTP Signatures, Object Integrity Proofs, and Linked Data Signatures. The vulnerable path is Linked Data Signatures: the signature is checked over the canonical RDF graph, but JSON-LD can repr...

  • View post

    Hollo security updates: 0.7.16 and 0.8.5 If you run Hollo, update to a patched release now. Hollo 0.7.16 and 0.8.5 fix several security issues in ActivityPub federation, the web admin UI, OAuth, and the transitive fast-xml-parser dependency. On the federation side, three inbox handlers were missing authorization checks. Any remote actor could send a Delete to remove any cached post by IRI, an Update to overwrite or first-materialize a cached post under another actor&#39;s name, or a cross-ori...

  • View post

    Hollo security updates: 0.7.15 and 0.8.3If you run Hollo, update to a patched release now. A private network protection bypass in Fedify, the ActivityPub framework Hollo depends on, affects remote document loading. URLs with private IPv4 addresses encoded as IPv4-mapped IPv6 literals, such as http://[::ffff:7f00:1]/, could pass URL validation even though they refer to private or loopback addresses. Hollo uses Fedify to fetch remote ActivityPub documents and related resources. An attacker who...

  • View post

    Hollo 0.7.11 is now available and includes an important security update. If you are running an older version, please upgrade to 0.7.11 as soon as possible.

  • View post

    Hollo 0.8.0 is out. The main additions: you can now run web and worker processes separately via NODE_TYPE, which helps on instances with large follower counts where federation load was slowing down API responses. Mastodon clients that support the 4.5 quote post API will now work with Hollo. Remote actor profiles are refreshed automatically in the background when they go stale, and dead follower records are cleaned up on permanent delivery failures. There&#39;s also a new dashboard page for mass-...

  • View post

    Hollo 0.7.0: Advanced search, faster notifications, and improved client compatibilityIt&#39;s been a while since our last release, and we&#39;re excited to finally share Hollo 0.7.0 with you. This release brings a lot of improvements that we&#39;ve been working on over the past months—from powerful new search capabilities to significant performance gains that should make your daily Hollo experience noticeably snappier. Let&#39;s dive into what&#39;s new. HighlightsSearch gets a major upgradeOn...

  • View post

    Hollo has always been headless—no built-in frontend, just a Mastodon-compatible API. You pick your own client. That&#39;s kind of the point. But we&#39;ve been wondering: what if Hollo shipped its own web frontend? The Mastodon-compatible API would stay, so your current client setup wouldn&#39;t change. It&#39;d just be one more option. Would you use it?

  • View post

    🚨 Known Issue: Elk (@elk) login may fail on Hollo instances upgraded from 0.5.x to 0.6.x with 401 Unauthorized errors. Fresh 0.6.x installs work fine. Other clients (Phanpy, Moshidon) are unaffected. We&#39;re investigating: https://github.com/fedify-dev/hollo/issues/167 Workaround: Use alternative clients like Phanpy (@phanpy) for now.

  • View post

    What client apps do you use with #Hollo?

  • View post

    Just dropped Hollo 0.6.4 with a minor bug fix.

  • View post

    🚨 Security Update: Hollo 0.6.5 Released We&#39;ve released #Hollo 0.6.5 with a critical #security fix for CVE-2025-53941, addressing an HTML injection vulnerability in federated posts. Please #update immediately to protect your instance from potential phishing and XSS attacks. How to update: Railway: Go to deployments → click three dots → RedeployDocker: docker pull ghcr.io/fedify-dev/hollo:latest and restartManual: git pull origin stable &amp;amp;&amp;amp; pnpm install and restart server

  • View post

    We&#39;ve released #security updates for #Hollo (0.4.12, 0.5.7, and 0.6.6) to address a #vulnerability in the underlying #Fedify framework. These updates incorporate the latest Fedify security patches that fix CVE-2025-54888. We strongly recommend all Hollo instance administrators update to the latest version for their respective release branch as soon as possible. Update Instructions: Railway users: Go to your project dashboard, select your Hollo service, click the three dots menu in deploy...

  • View post

    Hollo 0.6.11 significantly improves Bluesky interoperability via BridgyFed! Fixed AT Protocol URI parsing issues that were affecting various cross-platform interactions—not just likes, but overall federation with Bluesky users. 🌉

  • View post

    Security update: Hollo 0.6.12 is now availableWe&#39;ve released #Hollo 0.6.12 to fix a critical privacy #vulnerability where direct messages were being exposed in the replies section of public posts. Please update your instances immediately to ensure your private conversations remain private. #security

  • View post

    @nshki Thanks for your interest in Hollo! While we don&#39;t have officially documented minimum requirements yet, Hollo is designed for single-user instances and is significantly lighter than multi-user software like Mastodon or Misskey. Rough guidelines: RAM: 2GB recommended (including Node.js and PostgreSQL)CPU: 1 vCPU/core should be sufficientStorage: 10GB+ (depending on media storage needs)Database: PostgreSQL 17+ Real-world deployment: Works well on basic VPS plans ($5–10/month tier)R...

  • View post

    #Hollo 0.7 brings a redesigned #notification system with much better performance. We&#39;ve moved from generating #notifications on-demand to storing them as they happen, which makes the notifications endpoint about 60% faster. We&#39;ve also added response compression (though if you&#39;re using a reverse proxy, you probably had this already). More notably, Hollo 0.7 implements Mastodon&#39;s v2 grouped notifications API. Notifications like favorites, follows, and reblogs targeting the same po...

  • View post

    Security Update: Hollo 0.6.19 ReleasedWe have released Hollo 0.6.19 to address a security vulnerability in Fedify&#39;s HTML parsing code. This vulnerability (CVE-2025-68475) is a ReDoS (Regular Expression Denial of Service) issue that could allow an attacker to cause service unavailability by sending specially crafted HTML responses during federation operations. The malicious payload is small (approximately 170 bytes) but can block the Node.js event loop for extended periods. We strongly reco...

  • View post

    Hollo 0.7.0 will introduce advanced search operators! You&#39;ll be able to filter posts using operators like has:media, is:sensitive, language:en, from:username, date ranges with before: and after:, and combine them with OR and negation (-). For example: cat has:media -is:sensitive Full documentation: https://canary.docs.hollo.social/search/.

  • View post

    The recent Hollo 0.7.3 and 0.7.4 updates have improved interoperability with #Bonfire. The issue where sending/receiving DMs or mutual following with Bonfire wasn&#39;t working properly has been resolved.