BotKit by Fedify

We've released BotKit 0.3.1 with an important security fix.

This update addresses CVE-2025-68475 (High severity, CVSS 7.5), a ReDoS vulnerability in Fedify's HTML parsing that could cause denial of service.

If you're using BotKit 0.3.x, please upgrade to 0.3.1 as soon as possible.

• 📦 Release notes
• 🔐 Security advisory

#BotKit #Fedify #ActivityPub #fediverse #security

@stuartyeates@cloudisland.nz No, BotKit does not have such limit!

🔒 Security Update for BotKit Users

We've released #security patch versions BotKit 0.1.2 and 0.2.2 to address CVE-2025-54888, a security #vulnerability discovered in #Fedify. These updates incorporate the latest patched version of Fedify to ensure your bots remain secure.

We strongly recommend all #BotKit users update to the latest patch version immediately. Thank you for keeping the #fediverse safe! 🛡️

#fedidev

We're pleased to announce that #Node.js support has been merged and will be available in #BotKit 0.3.0.

Now you can build your #ActivityPub bots with both #Deno and Node.js, giving you more flexibility in choosing your preferred runtime environment.

Stay tuned for BotKit 0.3.0!

#fedidev #fediverse

Coming soon in #BotKit 0.2.0: Native #quote post support!

We're excited to share a preview of the upcoming quoting features in BotKit 0.2.0. This update will make it easier for your bots to engage with quoted content across the fediverse.

The quoting feature set includes:

• Detecting when someone quotes your bot's posts with the new Bot.onQuote event handler
• Accessing quoted content through the Message.quoteTarget property
• Creating quote posts using the quoteTarget option in Session.publish() and Message.reply() methods

Here's a quick example of how you can use the quote detection:

bot.onQuote = async (session, quote) => {
  // The quote parameter is a Message object representing the post that quoted your bot
  await quote.reply(text`Thanks for quoting my post, ${quote.actor}!`);
  
  // You can access the original quoted message
  const originalPost = quote.quoteTarget;
  console.log(`Original message: ${originalPost?.text}`);
};

And creating quote posts is just as simple:

// Quote in a new post
await session.publish(
  text`I'm quoting this interesting message!`,
  { quoteTarget: someMessage }
);

// Or quote in a reply
await message.reply(
  text`Interesting point! I'm quoting another relevant post here.`,
  { quoteTarget: anotherMessage }
);

Remember that quoting behavior may vary across different #ActivityPub implementations—some platforms like Misskey display quotes prominently, while others like Mastodon might implement them differently.

Want to try these features right now? You can install the development version from @fedify@jsr.io:

deno add jsr:@fedify/botkit@0.2.0-dev.90+d6ab4bdc

We're looking forward to seeing how you use these quoting capabilities in your bots!

#fedidev

We're excited to introduce emoji reactions in the upcoming #BotKit 0.2.0 release!

With the new @fedify@jsr.io method, your bot can now react to messages using standard Unicode #emojis:

await message.react(emoji`👍`);

#Custom_emoji support is also included, allowing your bot to react with server-specific emojis:

const emojis = bot.addCustomEmojis({
  // Use a remote image URL:
  yesBlob: {
    url: "https://cdn3.emoji.gg/emojis/68238-yesblob.png",
    mediaType: "image/png",
  },
  // Use a local image file:
  noBlob: {
    file: `${import.meta.dirname}/emojis/no_blob.png`,
    mediaType: "image/webp",
  },
});

await message.react(emojis.yesBlob);

Reactions can be removed using the @fedify@jsr.io method:

const reaction = await message.react(emoji`❤️`);
await reaction.unreact();

Want to try these features now? You can install the development version from @fedify@jsr.io today:

deno add jsr:@fedify/botkit@0.2.0-dev.84+c997c6a6

We're looking forward to seeing how your bots express themselves with this new feature!

#emoji_reaction #fedidev #ActivityPub

We're excited to announce that #BotKit 0.2.0 will introduce custom emoji support! This feature allows your bots to express themselves with more personality and engagement.

What's included:

• Add custom emojis to your bot with Bot.addCustomEmojis()
• Use emoji in messages with the customEmoji() function
• Support for both local image files and remote URLs as emoji sources
• Full integration with BotKit's text formatting system

Simple example:

// Define custom emojis
const emojis = bot.addCustomEmojis({
  botkit: { file: "./botkit.png", type: "image/png" },
  fedify: { url: "https://fedify.dev/logo.png", type: "image/png" }
});

// Use in messages
await session.publish(
  text`Hello world! ${customEmoji(emojis.botkit)}`
);

Want to try it early? You can install the development version from @fedify@jsr.io today:

deno add jsr:@fedify/botkit@0.2.0-dev.82+8a0438e6

#ActivityPub #fedidev #custom_emoji