LoginSign Up
← Back to all sparks
D

diaspora

COMMS
Velocity0.0

Distributed open-source social network

diasporafoundation.org ↗

The original federated social network now ships roughly once every two years.

federated-socialself-hostedsecurity-maintenancepublic-apiruby-on-railslow-cadence
◆Current state
diaspora* is a decentralised social network run as independent pods by volunteer administrators. Release cadence has collapsed to near-dormancy: 0.9.0.0 arrived in June 2024 after a two-year gap, and 0.9.1.0 followed in April 2026 — the release notes open with "it's been a while." What still ships reliably is security work, including a fixed SSRF vulnerability in the OpenID Connect implementation and, earlier, image-processing hardening adapted from Mastodon's fix.
◆Where it's heading
The one real forward move in this window was 0.9.0.0, which opened a supported public API and switched configuration to TOML with notice that YAML support ends at 1.0. Everything since has been maintenance. The project's own framing — a minor version described as not too exciting, urging podmins to update because it is a security release — sets the expectation plainly: diaspora* is being kept safe to run rather than developed toward anything new.
◆Prediction
A 1.0 release removing YAML configuration support is the stated next milestone, but with two years between the last two releases the timing is unpredictable. The more likely near-term event is another security-driven patch.

◆Recent moves

  1. 3mo ago

    diaspora* 0.9.1.0 patches an SSRF hole in its OIDC implementation

    The first release in nearly two years, and the project describes it as a security update podmins should apply promptly. The headline fix closes a vulnerability where malicious client registrations against the OpenID Connect API could trigger HTTP requests inside a pod's private network — a real exposure for anyone running a pod alongside other internal services.

    View source ↗
  2. 2y ago

    diaspora* 0.9.0.0 opens a supported API and moves config to TOML

    ⚡ SPARK

    The one release in this window that changes what the project is capable of: a supported public API for third-party applications, and a configuration format migration to TOML with YAML support scheduled to end at 1.0. Everything after this is maintenance, which makes 0.9.0.0 the last point where the roadmap moved.

    View source ↗
  3. 3y ago

    diaspora* 0.7.18.2 hardens user image processing

    A targeted security release addressing image-processing risks in user uploads, adapted from Mastodon's fix for the same class of issue. The project notes its own attack surface is smaller and some systems already ship restrictive ImageMagick policies, but shipped the fix to cover every configuration.

    View source ↗
  4. 3y ago

    diaspora* 0.7.18.1 fixes startup with multiple bundler versions

    A single-fix release updating binstubs so a pod can start when more than one bundler version is installed. It affects installation only and changes nothing users can see.

    View source ↗
  5. 4y ago

    diaspora* 0.7.18.0 upgrades to Rails 6.1

    Entirely internal work: the Rails 6.1 upgrade, removal of unmaintained dependencies including compass-rails and entypo-rails, a switch to sassc-rails for faster asset compilation, and Sidekiq 7 deprecation warnings cleared. Podmins get a faster precompile and a suggested Ruby version bump to 2.7; users see nothing.

    View source ↗
  6. 4y ago

    diaspora* 0.7.17.0 blocks mass assignment of password and 2FA settings

    Two security fixes: a Rails bump to 5.2.7 covering two CVEs, and a change preventing users from mass-assigning their own password and two-factor settings alongside other parameters. The second was externally reported, and it is the more consequential of the pair for account safety.

    View source ↗