Issues

• proxyImage accepts any image/* except SVG, so federated bytes reach the HEIF decoder

  fixed-pending-mergeP2security
  TemujinCalidius/FediHome#596 · Filter by author TemujinCalidius opened on Sep 5, 2026

• Remote actor documents are read untyped: an array icon silently drops the avatar, and inbox is typed string without ever being checked

  automatedbugdownstream-syncfixed-pending-mergeP2
  TemujinCalidius/FediHome#591 · Filter by author TemujinCalidius opened on Sep 4, 2026

• Route Bluesky writes through an injected fetch, so a new outbound surface can't be ungated

  automateddownstream-syncP3security
  TemujinCalidius/FediHome#588 · Filter by author TemujinCalidius opened on Aug 26, 2026

• /api/health reports a storage status but never says which uploads root it measured — and since #479 that is one root while the panel and the trim sweep cover two

  fixed-pending-merge
  TemujinCalidius/FediHome#586 · Filter by author TemujinCalidius opened on Aug 26, 2026

• @fedify/fedify is initialised and never used — the whole ActivityPub library is inert

  cleanupdependenciesP3
  TemujinCalidius/FediHome#584 · Filter by author TemujinCalidius opened on Aug 25, 2026
  1

• guardedFetch should return undici's Response, so remote JSON stops being typed as any

  enhancement
  TemujinCalidius/FediHome#513 · Filter by author TemujinCalidius opened on Aug 3, 2026

• Bluesky auth uses legacy app passwords; OAuth is the supported path

  enhancementP3
  TemujinCalidius/FediHome#450 · Filter by author TemujinCalidius opened on Aug 1, 2026

• Use your own domain as your Bluesky handle

  enhancementP2
  TemujinCalidius/FediHome#448 · Filter by author TemujinCalidius opened on Aug 1, 2026
  1

• Teach CodeQL that guardedFetch sanitizes, so js/request-forgery stops crying wolf

  P3securitytesting
  TemujinCalidius/FediHome#436 · Filter by author TemujinCalidius opened on Jul 30, 2026
  3

• /api/feed hides Bluesky posts from apps by default — remove the shim once clients handle a null apId

  enhancement
  TemujinCalidius/FediHome#408 · Filter by author TemujinCalidius opened on Jul 29, 2026

• TypeScript 7.0.2 upgrade blocked upstream (Next next build + typescript-eslint peer cap)

  automateddependenciesP3
  TemujinCalidius/FediHome#234 · Filter by author TemujinCalidius opened on Jul 11, 2026
  18

• Native iOS app for a personal FediHome instance

  enhancement
  TemujinCalidius/FediHome#157 · Filter by author TemujinCalidius opened on Jul 1, 2026
  1