ktistec
Communication & EmailAn ActivityPub server designed for small trusted groups with minimal dependencies (SQLite) and rich posting features
Features
- ActivityPub server optimized for tiny, admin‑only communities
- Uses SQLite instead of heavy services like PostgreSQL+Redis
- Rich text and Markdown editors with image support and focal‑point handling
- Draft posts that autosave until published
- Threaded replies with analysis (key participants, timeline histogram, notable branches)
- Built‑in poll creation and voting
Recent releases
View all 14 releases →
v3.3.7
New feature
Security fixes
- Prevent pinning of private objects and auto-unpin them
- Remove `href` attributes with unsafe schemes from sanitized HTML
- Escape interpolated values in view helpers and actor icon refresh
Notable features
- Sliding token expiration for OAuth2 access tokens
- Mastodon-compatible API endpoint `/api/v1/accounts/update_credentials`
Full changelog
Added
- Sliding token expiration for OAuth2 access tokens.
- Mastodon-compatible API:
/api/v1/accounts/update_credentialsendpoint.
Fixed
- Prevent pinning of (and auto-unpin) private objects.
- Don't save a quote if the quoted actor cannot be dereferenced.
- Fix rendering of federated actor profile attachment values.
- Remove
hrefattributes with unsafe schemes from sanitized HTML. - Escape interpolated values in view helpers and the actor icon streaming refresh.
- Restrict upload extensions and serve uploads with
X-Content-Type-Options: nosniff. - Escape
publicKeyand scrubTag.href. - Sanitizer no longer permits single-quote attribute injection.
- Ensure bearer-token sessions cannot reach the web UI.
- Require client authentication on the OAuth token endpoint.
v3.3.6
Security
Security fixes
- Prevented SSRF when dereferencing externally supplied IRIs
Notable features
- Deferred downloading of script files
- Deferred loading of image, video, and audio attachments
Full changelog
Fixed
- Prevent SSRF when dereferencing externally supplied IRIs.
- Timeline entry no longer becomes stale when an announce is undone.
- Correctly represent boosted posts on the home timeline in API clients.
Changed
- Defer downloading of script files.
- Defer loading of image, video, and audio attachments.
- Move poll vote notification for voters into the outbox processor.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
