Update Fedify packages to v2.4.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@fedify/cli (source)	2.4.0 → 2.4.2
@fedify/fedify (source)	2.4.0 → 2.4.2
@fedify/hono (source)	2.4.0 → 2.4.2
@fedify/redis (source)	2.4.0 → 2.4.2
@fedify/vocab (source)	2.4.0 → 2.4.2
@fedify/vocab-runtime (source)	2.4.0 → 2.4.2
@fedify/webfinger (source)	2.4.0 → 2.4.2

---

Release Notes

fedify-dev/fedify (@​fedify/cli)

v2.4.2

Compare Source

Released on October 9, 2026.

@​fedify/fedify

• Fixed signature verification throwing an exception when a remote actor
  supplied a malformed JSON-LD context or its context could not be fetched.
  These requesters are now treated as unverifiable.
  [#​1267, #​1270]

@​fedify/backfill

• Fixed conversation backfill skipping posts in paginated context and replies
  collections. Backfill now follows the first and subsequent pages while
  respecting traversal limits, and retains posts already found if a page
  cannot be loaded.
  [#​1248, #​1256 by Jiwon Kwon]
• Fixed conversation backfill stopping when the context collection loader
  failed. Failed context loads are now skipped so later configured strategies
  can still find accessible posts. Cancellation and interval configuration
  errors continue to propagate.
  [#​1249, #​1258 by Jiwon Kwon]

@​fedify/cfworkers

• Fixed npm refusing to install @fedify/cfworkers alongside
  @cloudflare/workers-types 5.x, which recent versions of Wrangler
  require, unless --legacy-peer-deps or an override was used. The peer
  dependency on @cloudflare/workers-types now accepts both 4.x and 5.x,
  so you can drop such workarounds.
  [#​1255, #​1260]

@​fedify/express

• Fixed asynchronous contextDataFactory and federation.fetch() failures
  being left as unhandled rejections in the Express integration. Errors
  that occur before Fedify passes the request to the next middleware now
  reach Express error-handling middleware, so applications can send their
  usual error response.
  [#​1244, #​1261]

@​fedify/init

• Migrated the initialization template script to SvelteKit version 3, by
  replacing the $lib syntax to #lib. [#​1222, #​1224 by Jungmin Yoon]

@​fedify/postgres

• Fixed PostgresMessageQueue remaining unusable after a transient
  initialization failure. Later calls now retry initialization, so the same
  queue instance can recover when the database becomes available again.
  [#​1268, #​1271]

@​fedify/sveltekit

• Fixed the hook types returned by fedifyHook() to support both SvelteKit 2
  and 3, so SvelteKit 3 applications can type-check the integration.
  [#​1222, #​1224]

v2.4.1

Compare Source

Released on October 5, 2026.

@​fedify/fedify

• Fixed cached signing-key fetch failures losing their error types, URLs,
  failure reasons, and cause details, so applications can classify failures
  consistently before and after caching.
  [#​1168, #​1237 by Junghoon Ban]

@​fedify/vocab

• Fixed language-tagged strings and Link.hreflang values with extended
  language subtags being dropped or rejected. Tags such as zh-YUE, which
  Mastodon uses for Cantonese posts, are now accepted and parsed into their
  canonical form (yue). Unmodified objects still re-emit the original
  tag through the cached JSON-LD document, but objects serialized afresh
  use the canonical tag.
  [[#​1229], [#​1231]]
• Fixed shared property arrays in vocabulary objects so dereferencing a
  clone no longer changes its source's properties or serialization.
  Constructors and clone() also copy supplied plural-value arrays,
  allowing frozen arrays and preventing changes to the caller's arrays.
  Nested objects and URLs retain their identity.
  [#​1207, #​1208]

@​fedify/vocab-runtime

• Added the [FEP-6757] context to the preloaded JSON-LD contexts. The default
  document loader now resolves https://w3id.org/fep/6757 locally, so
  transient Codeberg Pages outages no longer prevent otherwise valid inbound
  documents from being parsed or verified.
  [#​1211, #​1216]
• Fixed the LanguageString constructor throwing a RangeError for
  language tags with extended language subtags, such as zh-YUE. It now
  stores their canonical form (yue) as its locale.
  [[#​1229], [#​1231]]
• Fixed the preloaded Mastodon context treating attributionDomains values
  as IRIs instead of plain domain name strings. Values now expand as string
  literals and remain arrays when compacted, matching Mastodon's context.
  [#​1233, #​1235]

@​fedify/vocab-tools

• Fixed generated constructors and clone() methods to copy property
  arrays, preventing a clone's remote lookups from changing its source and
  preserving arrays supplied by callers.
  [#​1207, #​1208]
• Fixed generated vocabulary code rejecting language tags with extended
  language subtags, such as zh-YUE, in language-tagged strings and
  fedify:langTag values. Code generated by this version requires
  a release of @​fedify/vocab-runtime that includes this fix.
  [[#​1229], [#​1231]]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Between 07:00 AM and 04:59 PM, only on Monday, Tuesday, Wednesday, and Thursday (* 7-16 * * 1,2,3,4)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c6b323bb-263e-479e-a640-5d1ecd5b431d

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (2.4.2). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.