Darkscribes Community

Thanks, I've found a bug where retries were not sending in the (saved) digest, and updated activitypub.space

Can you let me know if you are still seeing them? Since they only occurred on retries, it was likely not something that happened often.

@[email protected] are they new activities or resends? I want to know whether this is an issue that has been fixed (but stale queue items persist), or whether it's an unfixed issue.

With temperatures reaching well into the 30s (in celsius of course ) in the Toronto area, we're all firmly in summer mode , but that won't stop us from forging on ahead with new features and fixes for NodeBB!

There are improvements across ActivityPub federation, administrative tooling, and security hardening. Our ActivityPub integration receives bug fixes including duplicate handling, configurable rate limiting, and better error reporting, alongside new hooks for remote user lifecycle events. The registration queue and invitations are reorganized into a dedicated UI with a new "Reject All" bulk action and improved notification handling. Security reports have been coming in consistently throughout the month with valid security reports (though almost all AI discovered and generated). This led to stricter privilege checks on post diffs, crossposts, and GDPR exports, plus protection against username enumeration. The NodeBB team strongly encourages upgrading to v4.14.0 for the latest security fixes and federation improvements. The release also includes a new tx() translation helper, Benchpress escaping improvements, and a first-run categories onboarding modal for fresh installations.

Here are the high level changes you can expect to see when you upgrade from v4.13.0 to v4.14.0...

Federation Regression Fixes!

Around v4.12.0 or so, a number of regressions were unintentionally introduced as part of security fixes that severely hampered federation — especially with Lemmy-based instances and relays. We've resolved those regressions and Relay/Lemmy federation should resume within 24 hours after upgrading.

The public key fetch rate limiter logic was simplified and updated (due to it being faulty and not really working in the first place), streamlined some duplicate logic with Like/Dislike activities, improved the AP Errors reporting page in the ACP, added a parent traversal depth guard, fixed an issue where updates to scheduled topics were accidentally being federated out, and about a hundred other smaller bugs

Registration Queue updates

The registration queue was moved out of the ACP, and invitations are also managed in this page now. A "reject all" button was added to allow admins to quickly reject every queued registrant in one fell swoop.

Privilege & Security Fixes

• Post diff access — Check topics:read privilege when loading post diffs
• Crossposts — Added source category privilege check to crossposts
• GDPR export — Prevented global moderators from performing GDPR data exports
• Nids ownership — Don't mark nids as read/unread that you don't own
• Upload privileges — Prevent uploading thumbnails without upload:image privilege; replaced extension-based MIME validation with content
  sniffing
• Username enumeration — Use dummy lockout key for non-existent users to prevent enumeration
• Category disabled flag — Check category disabled flag on getRaw

Benchpress Improvements

We use Benchpress as our templating engine. We updated our integration for security and performance. [@baris put together a thorough write-up for that one here](https://community.nodebb.org/topic/19364/upcoming-breaking-changes-for-4.14.0).

Miscellaneous

• First-run modal — New categories onboarding modal for fresh installations
• Dashboard warnings — Added localhost and URL mismatch warnings to admin dashboard notices
• Push notifications should work on Safari/iOS devices now (via the web-push plugin)

@jasonwch no, I javent looked into the issue yet 🫤

> julian said:
>
> the Activity Intents behaviour is meant to be active even if federation is disabled.

Actually, you're right, it's not meant to work without federation

@jasonwch the Activity Intents behaviour is meant to be active even if federation is disabled.

I'll fix up the behaviour so it is consistent even if federation is disabled.

@panos cross posts themselves are not federated out because there is no established standard or FEP that spells out how its done. (Not that that's ever stopped me before... but I digress.)

When a user cross-posts a topic to another category it will federate out an "announce", which looks like a boost on Mastodon.

I've put some of those checks in here for me to look at.

https://github.com/NodeBB/NodeBB/issues/13931

Coming soon to a NodeBB near you... a new way to browse both microblog and threadiverse content all in one feed.

Hello from Canada!

We're a week behind the planned release, but we're dropping v4.8.0 today, containing some changes to our ActivityPub handling, along with a new API route, and bug fixes.

Crossposting

As briefly introduced in my earlier topic on cross-posting, NodeBB v4.8.0 supports cross-posting of topics between categories. More importantly, it means topics from other remote categories can now be added to local categories, which is another way to bring conversations to your local users.

Unlike before, where administrators were the only ones allowed to move topics from cid -1, cross-posting is available to all local users. If you see a topic on the fediverse you'd like to cross-post to a local category, just hit the cross-post button (it's a button with a little upward-right pointing arrow), and share it with other users on your forum!

When you cross-post, it also shares the topic with all of your followers from outside of your forum.

Federated topic moving and removals

This was actually released with v4.7.0 but was improved slightly in the intervening versions. NodeBB now follows the Draft FEP f15d: Context Relocation and Removal and will publish Remove activities when a topic is moved to "Uncategorized", and Move activities when moved to another category.

Developers of other ActivityPub software looking to implement similar mechanics are advised to read the FEP and provide feedback here: https://activitypub.space/topic/86/fep-f15d-context-relocation-and-removal

Other technical debt and bug fixes

• Post ownership websocket call was migrated to a v3 REST API call
• Notifications had issues when user display names contained commas
• Piefed v1.5 supports emoji from remote instances; incoming custom emoji from Piefed are now handled
• Nodeinfo fixes for if a NodeBB instance is not actually federating (has AP turned off)

Hope everybody is having a great autumn — with temperatures slated to drop next week, I suppose it's almost time for winter 🥶

(and yes, I use em dashes. No LLM was used to write this travesty of a release post.)

We've just dropped NodeBB v4.7.0 with some nice QoL improvements for sites federating via ActivityPub.

Security Fixes

Just a note that v4.6.3 contained a dependency upgrade to the validator package that fixes CVE-2025-56200. v4.7.0 contains this fix as well.

New setting to control whether uploaded media is displayed as a topic thumbnail ️

Early changes to better handle ActivityPub content meant that uploaded post content was shown in the topic thumbnails set. This is now a configurable option in Settings > Uploads.

Removal of the "federated description"

We had a small postscript added by default when categories federated outward, and it even came with some default text about mentioning the category to create a topic. It didn't quite work out like we planned, and just looked plain weird when viewed through other threadiverse software (you don't mention a community to create a post in it).

For now I've removed that feature.

A link back to remote categories ️

Remote categories now have a button that allows you to navigate directly to the community itself — be it a Lemmy or Piefed community, Peertube channel, etc.

Category boost fixes

When a topic is moved between categories, the related categories will share (or "Announce" in AP parlance) OP. Likewise, it will be unshared by the other category is no longer belongs to.

N.B. For devs — categories will also federate out Move and Remove activities for the appropriate contexts, which is going to be part of an upcoming FEP the ForumWG is working on.

Improved handling of remote content in chats

When receiving non-public content from remote sources (shown as a chat message), embedded images are now included.

When sending chat messages outside of NodeBB, emoji are now included.

jlgourley everything is handled on Transifex, so I'd just go ahead and start translating!

[email protected] the root post was originally published with a far future timestamp but that has since been updated to reflect the actual posting date.

Was a bug with the original federation code but I'm surprised your still seeing this post as from the future?

Well, the whole idea behind them being resolvable is so that when they are acted upon (by the context owner), they can be queried.

For example if I receive a Delete(Context), I'll resolve it to find the root level post, and from there find my local representation, and delete it, assuming the actor was allowed to delete it.

They're only server generated views per current usage... but why do they have to be constrained to that usage?

I think Announce(Delete(Object)) skirts around that, though. Maybe not if you're being technical about it, but the shape of the activity is different enough to mean something else in 1b12-land:

• A community/group-actor announced a Delete
• The object may or may not belong to the same domain as the community/group-actor or Delete actor
• Verify that the community/group-actor and Delete actor are same-origin (might not need this if cross-instance moderation is a thing)
• Verify that the Delete actor is a moderator of the community/group-actor as per 1b12

[email protected] got it, thanks. How do you reconcile the Delete coming from outside your domain? I would figure Mastodon would drop those Deletes.

Edit: that was confusing wording... I mean — how do you sign a Delete for an object that doesn't belong to your instance?

[email protected] Do you send the Undo(Announce(Create)) as well for microblog compatibility?

We have just released v4.6.0 of NodeBB, containing fixes to our ActivityPub integration, minor fixes with SCSS, and some new functionality with topic templating.

ActivityPub Fixes

• WordPress blogs can be properly pulled into NodeBB (via their URL) now
• Fixed an error when moving a remote topic to another category
  • This also fixed the issue where moved topics didn't update topic/post counters
• Fixed bug where NodeBB could not properly process Link headers when it contained the standalone crossorigin directive
• Notifications for replies to topics made in remote categories now show the appropriate user
• Fixed bug where remote users were not able to post to a local category if registered-users privilege was removed (now checks fediverse pseudo-user)
• Nested remote categories can now be removed from the ACP
• Remote categories can be renamed for de-duplication purposes
• Improved title generation for quote-posts

Core fixes

• Persona theme now shows hidden (zero-character) links in post content
• _variables.scss page in ACP > Appearance can now override Bootstrap variables
• A template can be provided in a category's settings. This template is auto-populated in the composer when a new topic is being authored.

[email protected] Yes you're right, some messiness is bound to happen.

I'm not trying to force all implementations into a specific inheritance pattern, that's why it's a "should", not a "must".

Even then one of my concerns is that while in an ideal scenario, everybody inheriting their parent context leads to an entire collection all referencing the same context... in reality a lot of messiness will occur, objects will reference other contexts all over the place, etc.

At the end of the day it's best effort, and if we are able to handle all that and still get to a point where backfill is achievable, then that's a win in my books.

> it depends on how much you embrace the idea of each publisher being allowed to make their own claims (and how much you allow "clean up" after the fact)

Part of me would like this to not happen, but it is unavoidable.

Good question — in my opinion, 7888 serves as a gentle introduction into the entire concept of conversational contexts. It's meant to be descriptive in order to capture the variety of existing implementations of context that are found in the wild (e.g. Pleroma context which doesn't resolve, contexts that are not URLs, etc.)

Each subsequent FEP "down the tree" (or up, depending on how you look at it) narrows the scope and upgrades verbiage in order to enable additional functionality.

Specifically pertaining to 11dd:

• Ownership is explicitly defined and is now a requirement, 7888 mentioned attributedTo and context ownership as examples only.
  • This upgrade was done to set the stage for subsequent FEPs for forking, merging, moving, etc.
• Activities should be sent to the context owner. This is identical to 7888, but re-stated as a reminder.
• A specific recommendation for inheritance is included (adopt the immediate parent's context, more if able), while 7888 allows for one to drop context altogether, inherit, or create your own.

This is not to say that 7888 is deficient in any manner. On the contrary, it's working entirely as intended!

In practice, Lemmy has adopted 7888, but at this time will not adopt 11dd. [email protected] creates a context local to the instance, for each post because each instance is expected to be the canonical representation of the context, even if they are cached representations of remote federated content.

It means it would preclude Lemmy from adopting further upgrades like forking/merging/moving/locking, but it doesn't mean they are wrong in doing so.

[email protected]

@Ben-Stokes you'll want to use NodeBB-plugin-sso-oauth2-multiple or nodebb-plugin-session-sharing