User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
Automated
(UNOFFICIAL)
This bot automatically checks for Iceshrimp-js and Iceshrimp.NET releases and posts them.

Sources:
iceshrimp.dev/iceshrimp/iceshrimp/releases
iceshrimp.dev/iceshrimp/Iceshrimp.NET/releases

Iceshrimp dev chat: chat.iceshrimp.dev
Iceshrimp documentation: iceshrimp.net/help
Iceshrimp issues board: issues.iceshrimp.dev
Author @pancakes
Source Code https://codeberg.org/pancakes/fedifeeds
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
2w
Iceshrimp.NET v2026.1.3-beta
This is a beta security hotfix release. It's identical to v2026.1.2-beta, except for the security mitigations listed below. Upgrading is strongly recommended for all server operators.

- The thread mute endpoint now returns the expected results
- The docker images now use runtime version 10.0.14, addressing a vulnerability in the brotli compression library
- Various dependencies have been updated, mitigating security vulnerabilities

Check out the full changelog for more information on this release.
0
2
0
0
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
3w
v2026.5.5
This release fixes a typo that caused the backend to not properly initialize.
👍1
1
0
2
1
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
3w
v2026.5.4
This release mitigates the recent eMudhra CA compromise, as well as adding various security hardening fixes:

- Secure mode can no longer be disabled
- API tokens for admin accounts can no longer access admin endpoints unless explicitly allowed
- Moderator accounts can no longer access the queue dashboard
- Image size is now capped on megapixels as well as individual dimensions
- Signin history no longer includes header data
- Private pages and clips no longer render metadata to public crawlers
- Moderators can no longer reset other moderators' passwords
0
1
1
0
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
3w
v2026.5.2
A patch release for a more civilized age.

- Fixed speakAsCat federation
- Fixed security key enrollment failures
- Pasted images get converted to WebP before upload
- Removed instance cloud

This release was made possible by project contributors: Ashhhleyyy, Cirnos & mia
1
0
2
0
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
3mo
Iceshrimp.NET v2026.1.2-beta
This is a beta security hotfix release. It's identical to v2026.1.1-beta, except for the security mitigations listed below. Upgrading is strongly recommended for all server operators.

- When LibVips is used for image processing, unfuzzed / untrusted load/save operations are now disabled by default. The formats JPEG-XL, JPEG-2000 and SVG can be reenabled with configuration options respectively.

Check out the full changelog for more information on this release.
0
6
1
0
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
5mo
Iceshrimp.NET v2026.1.1-beta
This is a beta security hotfix release. It's identical to v2026.1-beta, except for the security mitigations listed below. Upgrading is strongly recommended for all server operators.

- The JSON-LD keywords @reverse, @graph and @included are now disallowed
- JSON-LD payloads that result in more than one object after expansion are now disallowed
- Regex timeouts during note filtering are now handled gracefully

Check out the full changelog for more information on this release.
0
17
9
0
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
5mo
v2026.5.1
This release contains several critical security patches, as well as minor fixes and improvements. Upgrading is strongly recommended for all server operators.

### Security

- Fixed signature bypass with certain keywords (reported by Mastodon)
- Fixed signature bypass with improper algorithm ordering
- Fixed XSS in emoji autocompleter
- Disabled hashtag channel

### Miscellaneous

- Fixed service worker not properly loading

### Attribution

This release was made possible by project contributors: mia

Furthermore, I want to give special thanks to Mastodon for the vulnerability disclosure.
:heart_cyber@fedia.social:1❤️1
0
7
2
2
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
6mo
v2026.4.2
A patch release for a calm Wednesday morning.

- Fixed quote authorization stripping post metadata
- Fixed broken navigation when "automatically reload when losing connection to the server" is enabled
- Hid voting options for logged out users
- Build system has been rewritten
- Dependencies have been updated
:heart_cyber@fedia.social:1❤️1
1
2
1
2
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
6mo
Iceshrimp.NET v2026.1-beta
This is a beta release, containing lots of new features & bug fixes. Upgrading is recommended for all server operators.

Note: We've simplified our versioning scheme to reduce both confusion and the slightly absurd length of our releases - we're now following v<yyyy>.<major>[.<patch>][-beta].

Highlights:

- Local and remote user/note reports are now fully supported
- Emoji management is massively improved with better handling of remote emojis and bulk emoji editing
- Users can now mute, block, unmute and unblock other users in any client
- Users can now import or export their following, muted, and blocked users list
- The note composer is much more powerful with support for polls, pasting attachments/quotes, user mention searching
- Instances can now customize their favicon, banner, and theme color
- MFM nodes for emojis, fg, bg, border, font, and ruby have been improved
- Users can now manage account migrations from the frontend
- The Iceshrimp.NET API now has lots of human readable documentation which can be access through the Scalar or Swagger UI
- Atom, JSONFeed, and RSS are now supported. Profile pages now have links to the feeds and feed readers should be able to automatically find the feeds from a user's profile URL. Feeds only display notes that have a public visibility and are unavailable for private/locked users
- Moderators can now create instance announcements
- Mastodon users can now quote notes from Iceshrimp.NET users
- Users can now view, pin and unpin notes from any client
- Static pages are now visually consistent with the frontend
- Light theme is now supported for static pages and the frontend
- Updated from .NET 9 to .NET 10
- Added support for instance admins to use OpenTelemetry to better monitor instance performance and other metrics
- Private memos (notes you can create about other users) are supported in all clients
- Federated bite controls are now supported and bites are now opt-in

Check out the full changelog for more information on this release.
:heart_cyber@fedia.social:1
1
5
3
1
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
7mo
Iceshrimp v2026.4.1
This release contains multiple new features and bug fixes. Due to this release including database migrations, you will not be able to migrate from this version to Iceshrimp.NET until their migration script is updated.

Some release highlights:

- Biting has been added
+ You can bite users, notes, and bites
+ You can control who is allowed to bite you
- Pronouns now have a dedicated field (only compatible with Iceshrimp.NET)
- Quotes now are compatible with Mastodon (FEP-044f)
+ Users on Mastodon can quote your post and it will show up properly on their side
+ You can quote users on Mastodon and it will show up properly on their side
- Unicode emojis up to version 16 are now supported

You can read the full changelog here: https://iceshrimp.dev/iceshrimp/iceshrimp/src/branch/dev/CHANGELOG.md#v2026-4-1
:neocat_nom_cat@wetdry.world:1
1
2
1
1
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
10mo
Iceshrimp.NET v2025.1-beta5.patch3.security4
This is a beta security hotfix release. It's identical to v2025.1-beta5.patch3.security3, except for the security mitigations listed below. Upgrading is strongly recommended for all server operators.

- Note visibility is now checked when requesting the hashtag timeline

Check out the full changelog for more information on this release.
0
7
3
0
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
1y
Iceshrimp.NET v2025.1-beta5.patch3.security3
This is a beta security hotfix release. It's identical to v2025.1-beta5.patch3.security2, except for the security mitigations listed below. Upgrading is strongly recommended for all server operators.

- Note visibility is now checked when listing likes or bookmarks

Check out the full changelog for more information on this release.
:baa@miau.jeder.pl:1✨1❤️1
0
12
5
3
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
1y
Iceshrimp.NET v2025.1-beta5.patch3.security2
This is a beta hotfix release. It's identical to v2025.1-beta5.patch2.security2, except for a bunch of bug fixes. Upgrading is strongly recommended for all server operators.

This release resolves a regression where users with multiple authenticated sessions running .NET 9.0.7 / SDK 9.0.302 or above were unable to use the default frontend.

Check out the full changelog for more information on this release.
0
4
0
0
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
1y
Iceshrimp.NET v2025.1-beta5.patch2.security2
This is a beta security hotfix release. It's identical to v2025.1-beta5.patch2.security1, except for the security mitigations listed below. Upgrading is strongly recommended for all server operators.

- Profile fields are now rendered as HTML for federation

Check out the full changelog for more information on this release.
:neocat_heart@peculiar.florist:1❤️3
0
23
13
4
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
1y
Iceshrimp v2023.12.14
This is a stable release containing a critical security fix, as well as several lower severity security fixes.

Upgrading is strongly recommended for all server operators.

Highlights:

- A XSS vulnerability related to parsing of relative URLs has been fixed
- Media URLs are now always proxied, no matter the protocol in use
- AiScript endpoints are now validated more strictly
- Negative values for MFM scale nodes are now clamped
- Profile fields are now rendered as HTML for federation
- Summaly has been updated, resolving a SSRF vulnerability

Check out the full changelog for more information on this release.
❤️3
0
20
9
3
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
1y
From Iceshrimp's Zulip chat:
There'll be security patches released for Iceshrimp-JS (severity: critical) and Iceshrimp.NET (severity: low) between 19:00, 27 Apr 2025 UTC and 21:00, 27 Apr 2025 UTC (this should show in your local time zone on Iceshrimp, but in case it doesn't, that's 2025-04-27T19:00Z - 2025-04-27T21:00Z. Be ready and patch quickly, especially if you're on -js.
Please boost
:neocat_heart@lea.pet:1❤️2⭐1
3
54
19
4
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
1y
Iceshrimp.NET v2025.1-beta5.patch2.security1
This is a beta security hotfix release. It's identical to v2025.1-beta5.patch2, except for the security mitigations listed below. Upgrading is strongly recommended for all server operators.

- Updated SixLabors.ImageSharp to 3.1.7 (addressing GHSA-2cmq-823j-5qj8)

Check out the full changelog for more information on this release.
0
8
8
0
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
1y
Iceshrimp v2023.12.13
This is a stable release containing a critical security fix. It's identical to v2023.12.13, except that it correctly identifies its version as v2023.12.13, instead of v2023.12.11.

Upgrading is strongly recommended for all server operators.

Highlights:

- An unauthenticated SQL injection vulnerability inherited from calckey/firefish has been patched

Check out the full changelog for more information on this release.
0
0
0
0
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
1y
Iceshrimp v2023.12.12
This is a stable release containing a critical security fix.

Upgrading is strongly recommended for all server operators.

Highlights:

- An unauthenticated SQL injection vulnerability inherited from calckey/firefish has been patched

Check out the full changelog for more information on this release.
❤️1
1
23
10
1
User avatar
Iceshrimp Updates Bot @iceshrimp_updates@meow.company
1y
Iceshrimp.NET v2025.1-beta5.patch2
This is a beta hotfix release. It's identical to v2025.1-beta5.patch1, except for a bunch of bugfixes. Upgrading is strongly recommended for all server operators running v2025.1-beta5 or v2025.1-beta5.patch1.

Check out the full changelog for more information on this release.
0
4
1
0