the moneyMay 20
Good morning! Iceshrimp.js has published version v2026.5.1. This release contains several critical security patches, as well as minor fixes and improvements. Upgrading is strongly recommended for all server operators.

# Highlights
- Fixed signature bypass with certain keywords (reported by Mastodon)
- Fixed signature bypass with improper algorithm ordering
- Fixed XSS in emoji autocompleter

See our release for the full changelog: iceshrimp.dev/iceshrimp/iceshrimp/releases/tag/v2026.5.1
Join our Zulip for updates: chat.iceshrimp.dev/
v2026.5.1 - iceshrimp/iceshrimp

This release contains several critical security patches, as well as minor fixes and improvements. Upgrading is strongly recommended for all server operators. ### Security - Fixed signature bypass with certain keywords (reported by Mastodon) - Fixed signature bypass with improper algorithm or...

Iceshrimp development
Show threadthe moneyMay 20
im so good at following release checklists
Show threadErin 💽✨May 20
@mia I KNEW it was going to be LD-Sigs
Show threadErin 💽✨May 20
@mia “It affects everyone but Mastodon, the Pleroma family and GoToSocial” -> OK its gotta be LD signatures, neither GTS nor Pleroma do them, and its probably a repeat of one of the LD sig bugs Puck flushed out of Mastodon 7 years ago
Show thread💙🩷💜Brett🐡🍉🐧
CC: @[email protected] @[email protected]

Snac maybe not affected? No recent changes in Snac mentioning patched vulnerabilities...

May 20 at 1:37pmWeb
Show threadthe moneyMay 20
@brettm @erincandescent i doubt snac implements LD-sig, so i would guess not affected
Show threadErin 💽✨May 20
@mia @brettm if someone has implemented LD signatures in C I think I need to award them with a certificate in technological masochism