Hollo 0.9.10

Released on July 20, 2026.

• Fixed media attachments appearing in arbitrary order in the web UI, Mastodon API responses, and federated activities. Hollo now preserves the order supplied by local clients and remote ActivityPub objects, and honors media_ids when editing a status. [#556]

Hollo 0.9.9

Released on July 19, 2026.

• Upgraded Fedify to 2.2.7 to fix a security vulnerability in NodeInfo lookups that could allow remote instances to make Hollo fetch non-public network destinations. [CVE-2026-62857]

Hollo 0.8.9

Released on July 19, 2026.

• Upgraded Fedify to 2.1.18 to fix a security vulnerability in NodeInfo lookups that could allow remote instances to make Hollo fetch non-public network destinations. [CVE-2026-62857]

Hollo 0.9.8

Released on July 11, 2026.

• Fixed a Mastodon API compatibility bug where accounts with Make following list public disabled could not view their own following list in clients. Authenticated account owners can now access their own following list while it remains hidden from everyone else. [#548]

Hollo 0.9.7

Released on July 9, 2026.

• Fixed a bug where locally-created quotes of remote posts that advertised an FEP-044f quote policy were marked as accepted immediately without first obtaining a QuoteAuthorization, causing third-party servers to see the quote as unapproved. Hollo now keeps those quotes pending, sends a QuoteRequest, and publishes the quoteAuthorization property after the remote server accepts the request. Remote posts without an FEP-044f quote policy are still treated as legacy quote targets and continue to publish the quote property without a quoteAuthorization.

Hollo 0.9.6

Released on July 3, 2026.

• Fixed a Mastodon API compatibility bug where editing a post through PUT /api/v1/statuses/:id ignored updated media attachment descriptions, causing alt text changes from clients like Phanpy and Moshidon to appear successful without being saved. [#538]

Hollo 0.8.8

Released on July 3, 2026.

• Fixed a Mastodon API compatibility bug where editing a post through PUT /api/v1/statuses/:id ignored updated media attachment descriptions, causing alt text changes from clients like Phanpy and Moshidon to appear successful without being saved. [#538]

Hollo 0.9.5

Released on June 13, 2026.

• Fixed a bug where expired poll notifications appeared in /api/v1/notifications but not in the grouped /api/v2/notifications feed, which could leave Mastodon-compatible clients such as Phanpy showing a permanent unread notification badge. Poll notifications are now materialized into the notifications and notification_groups tables like other notification types, and existing expired polls are backfilled during migration. [#517]

Hollo 0.9.4

Released on June 4, 2026.

• Upgraded Fedify to 2.2.4 to address a security vulnerability in SSRF mitigation. [CVE-2026-50131]

Hollo 0.8.7

Released on June 4, 2026.

• Upgraded Fedify to 2.1.15 to address a security vulnerability in SSRF mitigation. [CVE-2026-50131]