@fedify/fedify 1.4.10 → 1.4.11

package/CHANGES.md

@@ -3,6 +3,20 @@
 Fedify changelog
 ================
 
+Version 1.4.11
+--------------
+
+Released on May 16, 2025.
+
+ -  Fixed a bug where inbox handler had thrown a `jsonld.SyntaxError` which
+    caused a `500 Internal Server Error` when the received activity had
+    an invalid JSON-LD syntax.  Now it logs the error and responds with
+    a `400 Bad Request` error instead.  [[#232]]
+
+ -  The `exportJwk()` function now populates the `alg` property of a returned
+    `JsonWebKey` object with `"Ed25519"` if the input key is an Ed25519 key.
+
+
 Version 1.4.10
 --------------
 
@@ -227,6 +241,20 @@ Released on February 5, 2025.
 [#195]: https://github.com/fedify-dev/fedify/issues/195
 
 
+Version 1.3.18
+--------------
+
+Released on May 16, 2025.
+
+ -  Fixed a bug where inbox handler had thrown a `jsonld.SyntaxError` which
+    caused a `500 Internal Server Error` when the received activity had
+    an invalid JSON-LD syntax.  Now it logs the error and responds with
+    a `400 Bad Request` error instead.  [[#232]]
+
+ -  The `exportJwk()` function now populates the `alg` property of a returned
+    `JsonWebKey` object with `"Ed25519"` if the input key is an Ed25519 key.
+
+
 Version 1.3.17
 --------------
 
@@ -567,6 +595,20 @@ Released on November 30, 2024.
 [#193]: https://github.com/fedify-dev/fedify/issues/193
 
 
+Version 1.2.22
+--------------
+
+Released on May 16, 2025.
+
+ -  Fixed a bug where inbox handler had thrown a `jsonld.SyntaxError` which
+    caused a `500 Internal Server Error` when the received activity had
+    an invalid JSON-LD syntax.  Now it logs the error and responds with
+    a `400 Bad Request` error instead.  [[#232]]
+
+ -  The `exportJwk()` function now populates the `alg` property of a returned
+    `JsonWebKey` object with `"Ed25519"` if the input key is an Ed25519 key.
+
+
 Version 1.2.21
 --------------
 
@@ -955,6 +997,20 @@ Released on October 31, 2024.
 [#118]: https://github.com/fedify-dev/fedify/issues/118
 
 
+Version 1.1.22
+--------------
+
+Released on May 16, 2025.
+
+ -  Fixed a bug where inbox handler had thrown a `jsonld.SyntaxError` which
+    caused a `500 Internal Server Error` when the received activity had
+    an invalid JSON-LD syntax.  Now it logs the error and responds with
+    a `400 Bad Request` error instead.  [[#232]]
+
+ -  The `exportJwk()` function now populates the `alg` property of a returned
+    `JsonWebKey` object with `"Ed25519"` if the input key is an Ed25519 key.
+
+
 Version 1.1.21
 --------------
 
@@ -1384,6 +1440,22 @@ Released on October 20, 2024.
 [#150]: https://github.com/fedify-dev/fedify/issues/150
 
 
+Version 1.0.25
+--------------
+
+Released on May 16, 2025.
+
+ -  Fixed a bug where inbox handler had thrown a `jsonld.SyntaxError` which
+    caused a `500 Internal Server Error` when the received activity had
+    an invalid JSON-LD syntax.  Now it logs the error and responds with
+    a `400 Bad Request` error instead.  [[#232]]
+
+ -  The `exportJwk()` function now populates the `alg` property of a returned
+    `JsonWebKey` object with `"Ed25519"` if the input key is an Ed25519 key.
+
+[#232]: https://github.com/fedify-dev/fedify/issues/232
+
+
 Version 1.0.24
 --------------
 

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "@fedify/fedify",
-    "version": "1.4.10",
+    "version": "1.4.11",
     "license": "MIT",
     "exports": {
         ".": "./mod.ts",

package/esm/deps/jsr.io/@std/bytes/{1.0.5 → 1.0.6}/equals.js

@@ -48,7 +48,7 @@ function equals32Bit(a, b) {
  * Byte length threshold for when to use 32-bit comparisons, based on
  * benchmarks.
  *
- * @see {@link https://github.com/denoland/deno_std/pull/4635}
+ * @see {@link https://github.com/denoland/std/pull/4635}
  */
 const THRESHOLD_32_BIT = 160;
 /**

package/esm/deps/jsr.io/@std/semver/{1.0.4 → 1.0.5}/_constants.js

@@ -1,14 +1,4 @@
 // Copyright 2018-2025 the Deno authors. MIT license.
-/**
- * The minimum valid SemVer object. Equivalent to `0.0.0`.
- */
-export const MIN = {
-    major: 0,
-    minor: 0,
-    patch: 0,
-    prerelease: [],
-    build: [],
-};
 /**
  * ANY is a sentinel value used by some range calculations. It is not a valid
  * SemVer object and should not be used directly.

package/esm/deps/jsr.io/@std/semver/{1.0.4 → 1.0.5}/satisfies.js

@@ -1,4 +1,5 @@
 // Copyright 2018-2025 the Deno authors. MIT license.
+// This module is browser compatible.
 import { testComparatorSet } from "./_test_comparator_set.js";
 /**
  * Test to see if the SemVer satisfies the range.

package/esm/federation/handler.js

@@ -1,6 +1,6 @@
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { accepts } from "../deps/jsr.io/@std/http/1.0.13/negotiation.js";
+import { accepts } from "../deps/jsr.io/@std/http/1.0.16/negotiation.js";
 import metadata from "../deno.js";
 import { verifyRequest } from "../sig/http.js";
 import { detachSignature, verifyJsonLd } from "../sig/ld.js";
@@ -322,12 +322,25 @@ async function handleInboxInternal(request, { recipient, context: ctx, inboxCont
         });
     }
     const keyCache = new KvKeyCache(kv, kvPrefixes.publicKey, ctx);
-    const ldSigVerified = await verifyJsonLd(json, {
-        contextLoader: ctx.contextLoader,
-        documentLoader: ctx.documentLoader,
-        keyCache,
-        tracerProvider,
-    });
+    let ldSigVerified;
+    try {
+        ldSigVerified = await verifyJsonLd(json, {
+            contextLoader: ctx.contextLoader,
+            documentLoader: ctx.documentLoader,
+            keyCache,
+            tracerProvider,
+        });
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === "jsonld.SyntaxError") {
+            logger.error("Failed to parse JSON-LD:\n{error}", { recipient, error });
+            return new Response("Invalid JSON-LD.", {
+                status: 400,
+                headers: { "Content-Type": "text/plain; charset=utf-8" },
+            });
+        }
+        ldSigVerified = false;
+    }
     const jsonWithoutSig = detachSignature(json);
     let activity = null;
     if (ldSigVerified) {

package/esm/nodeinfo/client.js

@@ -1,5 +1,5 @@
 import { getLogger } from "@logtape/logtape";
-import { parse } from "../deps/jsr.io/@std/semver/1.0.4/mod.js";
+import { parse } from "../deps/jsr.io/@std/semver/1.0.5/mod.js";
 import { getUserAgent, } from "../runtime/docloader.js";
 const logger = getLogger(["fedify", "nodeinfo", "client"]);
 export async function getNodeInfo(url, options = {}) {

package/esm/nodeinfo/mod.js

@@ -5,6 +5,6 @@
  * @module
  * @since 0.2.0
  */
-export { format as formatSemVer, parse as parseSemVer, } from "../deps/jsr.io/@std/semver/1.0.4/mod.js";
+export { format as formatSemVer, parse as parseSemVer, } from "../deps/jsr.io/@std/semver/1.0.5/mod.js";
 export { getNodeInfo, parseNodeInfo, } from "./client.js";
 export * from "./types.js";

package/esm/nodeinfo/types.js

@@ -1,4 +1,4 @@
-import { format } from "../deps/jsr.io/@std/semver/1.0.4/mod.js";
+import { format } from "../deps/jsr.io/@std/semver/1.0.5/mod.js";
 /**
  * Converts a {@link NodeInfo} object to a JSON value.
  * @param nodeInfo The {@link NodeInfo} object to convert.

package/esm/runtime/key.js

@@ -1,6 +1,6 @@
 import * as dntShim from "../_dnt.shims.js";
 import { createPublicKey } from "node:crypto";
-import { concat } from "../deps/jsr.io/@std/bytes/1.0.5/concat.js";
+import { concat } from "../deps/jsr.io/@std/bytes/1.0.6/concat.js";
 import { decodeBase64, encodeBase64 } from "../deps/jsr.io/@std/encoding/1.0.7/base64.js";
 import { decodeBase64Url } from "../deps/jsr.io/@std/encoding/1.0.7/base64url.js";
 import { decodeHex } from "../deps/jsr.io/@std/encoding/1.0.7/hex.js";

package/esm/sig/http.js

@@ -2,7 +2,7 @@ import * as dntShim from "../_dnt.shims.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace, } from "@opentelemetry/api";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL, } from "@opentelemetry/semantic-conventions";
-import { equals } from "../deps/jsr.io/@std/bytes/1.0.5/mod.js";
+import { equals } from "../deps/jsr.io/@std/bytes/1.0.6/mod.js";
 import { decodeBase64, encodeBase64 } from "../deps/jsr.io/@std/encoding/1.0.7/base64.js";
 import { encodeHex } from "../deps/jsr.io/@std/encoding/1.0.7/hex.js";
 import metadata from "../deno.js";

package/esm/sig/key.js

@@ -70,7 +70,10 @@ export function generateCryptoKeyPair(algorithm) {
  */
 export async function exportJwk(key) {
     validateCryptoKey(key);
-    return await dntShim.crypto.subtle.exportKey("jwk", key);
+    const jwk = await dntShim.crypto.subtle.exportKey("jwk", key);
+    if (jwk.crv === "Ed25519")
+        jwk.alg = "Ed25519";
+    return jwk;
 }
 /**
  * Imports a key from JWK format.

package/esm/vocab/lookup.js

@@ -1,7 +1,7 @@
 import * as dntShim from "../_dnt.shims.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { delay } from "../deps/jsr.io/@std/async/1.0.12/delay.js";
+import { delay } from "../deps/jsr.io/@std/async/1.0.13/delay.js";
 import metadata from "../deno.js";
 import { getDocumentLoader, } from "../runtime/docloader.js";
 import { lookupWebFinger } from "../webfinger/lookup.js";