Accept actorless FeatureRequest activities

CHANGES.md

@@ -8,6 +8,28 @@ Version 2.4.3
 
 To be released.
 
+### @fedify/fedify
+
+ -  Fixed `getAuthenticatedDocumentLoader()` skipping URL scheme validation
+    when `allowPrivateAddress` was enabled.  Unsupported schemes are now
+    rejected before fetching, including redirect and alternate document
+    targets.  [[#1291], [#1292]]
+ -  Fixed the inbox rejecting FEP-7aa9 `FeatureRequest` activities without
+    an `actor`, allowing applications to receive collection inclusion
+    requests from Mastodon.  Requests are accepted only when authenticated
+    as the referenced collection's owner.  [[#1289], [#1291]]
+
+[#1289]: https://github.com/fedify-dev/fedify/issues/1289
+[#1291]: https://github.com/fedify-dev/fedify/pull/1291
+[#1292]: https://github.com/fedify-dev/fedify/issues/1292
+
+### @fedify/vocab-runtime
+
+ -  Fixed `getDocumentLoader()` skipping URL scheme validation when
+    `allowPrivateAddress` was enabled.  Unsupported schemes are now rejected
+    before fetching, including redirect and alternate document targets.
+    [[#1291], [#1292]]
+
 
 Version 2.4.2
 -------------

changes.d/fedify/actorless-feature-requests.md

@@ -0,0 +1,9 @@
+---
+links:
+  '#1289': https://github.com/fedify-dev/fedify/issues/1289
+  '#1291': https://github.com/fedify-dev/fedify/pull/1291
+---
+ -  Fixed the inbox rejecting FEP-7aa9 `FeatureRequest` activities without
+    an `actor`, allowing applications to receive collection inclusion
+    requests from Mastodon.  Requests are accepted only when authenticated
+    as the referenced collection's owner.  [[#1289], [#1291]]

changes.d/fedify/document-url-schemes.md

@@ -0,0 +1,4 @@
+ -  Fixed `getAuthenticatedDocumentLoader()` skipping URL scheme validation
+    when `allowPrivateAddress` was enabled.  Unsupported schemes are now
+    rejected before fetching, including redirect and alternate document
+    targets.  [[#1291], [#1292]]

changes.d/vocab-runtime/document-url-schemes.md

@@ -0,0 +1,4 @@
+ -  Fixed `getDocumentLoader()` skipping URL scheme validation when
+    `allowPrivateAddress` was enabled.  Unsupported schemes are now rejected
+    before fetching, including redirect and alternate document targets.
+    [[#1291], [#1292]]