Merge tag '2.3.6'

Fedify 2.3.6

Author: dahlia

CHANGES.md

@@ -396,6 +396,59 @@ To be released.
 [#935]: https://github.com/fedify-dev/fedify/pull/935
 
 
+Version 2.3.6
+-------------
+
+Released on August 23, 2026.
+
+### @fedify/fedify
+
+ -  Fixed some public relay subscription requests being rejected by
+    implementations that compare `Follow.object` as a plain URL without JSON-LD
+    expansion.  The Public collection in relay `Follow` activities is now
+    serialized as its full ActivityStreams URI instead of a compact IRI.
+    [[#998], [#1008] by Jiwon Kwon\]
+
+[#998]: https://github.com/fedify-dev/fedify/issues/998
+[#1008]: https://github.com/fedify-dev/fedify/pull/1008
+
+### @fedify/cli
+
+ -  Added a permanent removal warning to the `fedify init` command for Linux
+    and other Unix-like system users before deleting existing content in the
+    project directory.
+    [[#989], [#997] by Jungmin Yoon\]
+
+[#989]: https://github.com/fedify-dev/fedify/issues/989
+[#997]: https://github.com/fedify-dev/fedify/pull/997
+
+### @fedify/init
+
+ -  Added permanent removal warning for Linux or other UNIX-like system users
+    before delete the existing content in the project directory.
+    [[#989], [#997] by Jungmin Yoon\]
+
+### @fedify/lint
+
+ -  Fixed `@fedify/lint` actor property requirement rules reporting false
+    positives when an actor dispatcher returns `null` for an actor that was not
+    found.  Non-null actor returns are still checked for the configured
+    properties.  [[#974]]
+
+[#974]: https://github.com/fedify-dev/fedify/issues/974
+
+### @fedify/vocab-runtime
+
+ -  Added the [Controlled Identifiers v1.0] context to the preloaded JSON-LD
+    contexts.  The default document loader now resolves
+    <https://www.w3.org/ns/cid/v1> locally, so transient W3C outages no longer
+    prevent otherwise valid inbound documents from being parsed or verified.
+    [[#932]]
+
+[Controlled Identifiers v1.0]: https://www.w3.org/TR/cid-1.0/
+[#932]: https://github.com/fedify-dev/fedify/issues/932
+
+
 Version 2.3.5
 -------------
 
@@ -1139,6 +1192,48 @@ Released on June 25, 2026.
 [#756]: https://github.com/fedify-dev/fedify/pull/756
 
 
+Version 2.2.11
+--------------
+
+Released on August 23, 2026.
+
+### @fedify/fedify
+
+ -  Fixed some public relay subscription requests being rejected by
+    implementations that compare `Follow.object` as a plain URL without JSON-LD
+    expansion.  The Public collection in relay `Follow` activities is now
+    serialized as its full ActivityStreams URI instead of a compact IRI.
+    [[#998], [#1008] by Jiwon Kwon\]
+
+### @fedify/cli
+
+ -  Added a permanent removal warning to the `fedify init` command for Linux
+    and other Unix-like system users before deleting existing content in the
+    project directory.
+    [[#989], [#997] by Jungmin Yoon\]
+
+### @fedify/init
+
+ -  Added permanent removal warning for Linux or other UNIX-like system users
+    before delete the existing content in the project directory.
+    [[#989], [#997] by Jungmin Yoon\]
+
+### @fedify/lint
+
+ -  Fixed `@fedify/lint` actor property requirement rules reporting false
+    positives when an actor dispatcher returns `null` for an actor that was not
+    found.  Non-null actor returns are still checked for the configured
+    properties.  [[#974]]
+
+### @fedify/vocab-runtime
+
+ -  Added the [Controlled Identifiers v1.0] context to the preloaded JSON-LD
+    contexts.  The default document loader now resolves
+    <https://www.w3.org/ns/cid/v1> locally, so transient W3C outages no longer
+    prevent otherwise valid inbound documents from being parsed or verified.
+    [[#932]]
+
+
 Version 2.2.10
 --------------
 
@@ -1689,6 +1784,40 @@ Released on April 28, 2026.
 [#722]: https://github.com/fedify-dev/fedify/pull/722
 
 
+Version 2.1.22
+--------------
+
+Released on August 23, 2026.
+
+### @fedify/cli
+
+ -  Added a permanent removal warning to the `fedify init` command for Linux
+    and other Unix-like system users before deleting existing content in the
+    project directory.
+    [[#989], [#997] by Jungmin Yoon\]
+
+### @fedify/init
+
+ -  Added permanent removal warning for Linux or other UNIX-like system users
+    before delete the existing content in the project directory.
+    [[#989], [#997] by Jungmin Yoon\]
+
+### @fedify/lint
+
+ -  Fixed `@fedify/lint` actor property requirement rules reporting false
+    positives when an actor dispatcher returns `null` for an actor that was not
+    found.  Non-null actor returns are still checked for the configured
+    properties.  [[#974]]
+
+### @fedify/vocab-runtime
+
+ -  Added the [Controlled Identifiers v1.0] context to the preloaded JSON-LD
+    contexts.  The default document loader now resolves
+    <https://www.w3.org/ns/cid/v1> locally, so transient W3C outages no longer
+    prevent otherwise valid inbound documents from being parsed or verified.
+    [[#932]]
+
+
 Version 2.1.21
 --------------
 
@@ -2404,6 +2533,39 @@ Released on March 24, 2026.
 [#599]: https://github.com/fedify-dev/fedify/pull/599
 
 
+Version 2.0.26
+--------------
+
+Released on August 23, 2026.
+
+### @fedify/cli
+
+ -  Added a permanent removal warning to the `fedify init` command for Linux
+    and other Unix-like system users before deleting existing content in the
+    project directory. [[#989], [#997] by Jungmin Yoon\]
+
+### @fedify/init
+
+ -  Added permanent removal warning for Linux or other UNIX-like system users
+    before delete the existing content in the project directory.
+    [[#989], [#997] by Jungmin Yoon\]
+
+### @fedify/lint
+
+ -  Fixed `@fedify/lint` actor property requirement rules reporting false
+    positives when an actor dispatcher returns `null` for an actor that was not
+    found.  Non-null actor returns are still checked for the configured
+    properties.  [[#974]]
+
+### @fedify/vocab-runtime
+
+ -  Added the [Controlled Identifiers v1.0] context to the preloaded JSON-LD
+    contexts.  The default document loader now resolves
+    <https://www.w3.org/ns/cid/v1> locally, so transient W3C outages no longer
+    prevent otherwise valid inbound documents from being parsed or verified.
+    [[#932]]
+
+
 Version 2.0.25
 --------------
 

packages/fedify/src/compat/public-audience.test.ts

@@ -1,5 +1,5 @@
 import { test } from "@fedify/fixture";
-import { Create, Note, PUBLIC_COLLECTION } from "@fedify/vocab";
+import { Create, Follow, Note, PUBLIC_COLLECTION } from "@fedify/vocab";
 import { getDocumentLoader, preloadedContexts } from "@fedify/vocab-runtime";
 import { assertEquals } from "@std/assert/assert-equals";
 import { assertNotEquals } from "@std/assert/assert-not-equals";
@@ -59,6 +59,25 @@ test("normalizePublicAudience() normalises activities serialized by @fedify/voca
   assertEquals(nestedObject.to, PUBLIC_URI);
 });
 
+test("normalizePublicAudience() normalises a public relay Follow object", async () => {
+  const activity = new Follow({
+    id: new URL("https://example.com/activities/follow-relay"),
+    actor: new URL("https://example.com/alice"),
+    object: PUBLIC_COLLECTION,
+  });
+  const compact = await activity.toJsonLd({ format: "compact" }) as Record<
+    string,
+    unknown
+  >;
+  assertEquals(compact.object, "as:Public");
+
+  const normalized = await normalizePublicAudience(
+    compact,
+    getDocumentLoader(),
+  ) as Record<string, unknown>;
+  assertEquals(normalized.object, PUBLIC_URI);
+});
+
 test("normalizePublicAudience() is a no-op without the CURIE", async () => {
   const input = {
     "@context": AS_CONTEXT,

packages/fedify/src/compat/public-audience.ts

@@ -55,6 +55,16 @@ function hasPublicCurieInAddressing(
   if (typeof value !== "object" || value == null) return false;
   const record = value as Record<string, unknown>;
   for (const key of Object.keys(record)) {
+    // Some relay implementations compare a subscription's Follow.object as a
+    // plain URL without expanding its Public CURIE.  Keep this type-specific
+    // instead of treating every `object` property as a public-addressing field.
+    if (
+      record.type === "Follow" &&
+      key === "object" &&
+      (record[key] === "as:Public" || record[key] === "Public")
+    ) {
+      return true;
+    }
     // `@context` holds term definitions, not addressing values; skip it so
     // we do not traverse potentially large inline context objects.
     if (key === "@context") continue;
@@ -101,9 +111,14 @@ function rewritePublicAudience(
   const normalized: Record<string, unknown> = Object.create(null);
   for (const key of Object.keys(record)) {
     // `@context` is never an addressing field, so skip the recursion and
-    // keep the reference intact.
+    // keep the reference intact.  Follow.object is handled separately because
+    // `object` is not a public-addressing field for other activity types.
     const rewritten = key === "@context"
       ? record[key]
+      : record.type === "Follow" &&
+          key === "object" &&
+          (record[key] === "as:Public" || record[key] === "Public")
+      ? PUBLIC_COLLECTION.href
       : rewritePublicAudience(record[key], key, depth + 1);
     if (rewritten !== record[key]) changed = true;
     normalized[key] = rewritten;