the moneyMay 20
Good morning! Iceshrimp.js has published version v2026.5.1. This release contains several critical security patches, as well as minor fixes and improvements. Upgrading is strongly recommended for all server operators.

# Highlights
- Fixed signature bypass with certain keywords (reported by Mastodon)
- Fixed signature bypass with improper algorithm ordering
- Fixed XSS in emoji autocompleter

See our release for the full changelog: iceshrimp.dev/iceshrimp/iceshrimp/releases/tag/v2026.5.1
Join our Zulip for updates: chat.iceshrimp.dev/
v2026.5.1 - iceshrimp/iceshrimp

This release contains several critical security patches, as well as minor fixes and improvements. Upgrading is strongly recommended for all server operators. ### Security - Fixed signature bypass with certain keywords (reported by Mastodon) - Fixed signature bypass with improper algorithm or...

Iceshrimp development
Show threadthe money
im so good at following release checklists
May 20 at 12:55pmWeb
Show threadthe moneyMay 20
you all have your complex build pipelines and fancy tools to do releases. i have a list of steps that i follow very quickly. this makes me cooler than you
Release checklist

wahoo, release time

Show threadsodiboo May 20
@mia login link ​​
Show threadthe moneyMay 20
@sodiboo oops
Show threadthe moneyMay 20
@sodiboo link fixed
Show threadsodiboo May 20
@mia yaay thanks :3
Show threadCat 🐈🥗 (D.Burch) ⁠May 20
@sodiboo @mia Log in Link? 😳
Show threadErin 💽✨May 20
@mia I KNEW it was going to be LD-Sigs
Show threadthe moneyMay 20
@erincandescent it's always LD-sigs...
Show threadErin 💽✨May 20
@mia Data was not meant to be canonicalized.
Show threadErin 💽✨May 20
@mia “It affects everyone but Mastodon, the Pleroma family and GoToSocial” -> OK its gotta be LD signatures, neither GTS nor Pleroma do them, and its probably a repeat of one of the LD sig bugs Puck flushed out of Mastodon 7 years ago
Show threadthe moneyMay 20
@erincandescent so about mastodon
Merge commit from fork · mastodon/mastodon@0786c1e

Your self-hosted, globally interconnected microblogging community - Merge commit from fork · mastodon/mastodon@0786c1e

GitHub
Show thread💙🩷💜Brett🐡🍉🐧May 20
CC: @[email protected] @[email protected]

Snac maybe not affected? No recent changes in Snac mentioning patched vulnerabilities...

Show threadthe moneyMay 20
@brettm @erincandescent i doubt snac implements LD-sig, so i would guess not affected
Show threadErin 💽✨May 20
@mia @brettm if someone has implemented LD signatures in C I think I need to award them with a certificate in technological masochism
Show threadkopper May 20
@erincandescent @mia you don't need to be claude mythos to figure that out