Merge tag '2.3.2'

Fedify 2.3.2

Author: dahlia

CHANGES.md

@@ -331,7 +331,7 @@ To be released.
 Version 2.3.2
 -------------
 
-To be released.
+Released on July 15, 2026.
 
 ### @fedify/fedify
 
@@ -345,7 +345,7 @@ To be released.
     caller.  Both requests, including any redirect hops, are now validated
     against private and non-public addresses, consistent with the protections
     already applied to WebFinger lookups and the built-in document loader.
-    [[GHSA-hqph-j65v-8cq5]]
+    [[CVE-2026-62857]]
 
  -  Fixed custom collection dispatchers registered through
     `FederationBuilder.setCollectionDispatcher()` and
@@ -375,7 +375,7 @@ To be released.
     npm publish artifact skipped the `prepack` step that materializes the
     symlinked skill directory before packing.
 
-[GHSA-hqph-j65v-8cq5]: https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5
+[CVE-2026-62857]: https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5
 [#849]: https://github.com/fedify-dev/fedify/issues/849
 [#851]: https://github.com/fedify-dev/fedify/pull/851
 [#916]: https://github.com/fedify-dev/fedify/issues/916
@@ -964,7 +964,7 @@ Released on June 25, 2026.
 Version 2.2.7
 -------------
 
-To be released.
+Released on July 15, 2026.
 
 ### @fedify/fedify
 
@@ -978,7 +978,7 @@ To be released.
     caller.  Both requests, including any redirect hops, are now validated
     against private and non-public addresses, consistent with the protections
     already applied to WebFinger lookups and the built-in document loader.
-    [[GHSA-hqph-j65v-8cq5]]
+    [[CVE-2026-62857]]
 
  -  Fixed custom collection dispatchers registered through
     `FederationBuilder.setCollectionDispatcher()` and
@@ -1438,7 +1438,7 @@ Released on April 28, 2026.
 Version 2.1.18
 --------------
 
-To be released.
+Released on July 15, 2026.
 
 ### @fedify/fedify
 
@@ -1452,7 +1452,7 @@ To be released.
     caller.  Both requests, including any redirect hops, are now validated
     against private and non-public addresses, consistent with the protections
     already applied to WebFinger lookups and the built-in document loader.
-    [[GHSA-hqph-j65v-8cq5]]
+    [[CVE-2026-62857]]
 
  -  Fixed custom collection dispatchers registered through
     `FederationBuilder.setCollectionDispatcher()` and
@@ -2077,7 +2077,7 @@ Released on March 24, 2026.
 Version 2.0.22
 --------------
 
-To be released.
+Released on July 15, 2026.
 
 ### @fedify/fedify
 
@@ -2091,7 +2091,7 @@ To be released.
     caller.  Both requests, including any redirect hops, are now validated
     against private and non-public addresses, consistent with the protections
     already applied to WebFinger lookups and the built-in document loader.
-    [[GHSA-hqph-j65v-8cq5]]
+    [[CVE-2026-62857]]
 
  -  Fixed custom collection dispatchers registered through
     `FederationBuilder.setCollectionDispatcher()` and
@@ -3137,7 +3137,7 @@ Released on February 22, 2026.
 Version 1.10.12
 ---------------
 
-To be released.
+Released on July 15, 2026.
 
 ### @fedify/fedify
 
@@ -3151,7 +3151,7 @@ To be released.
     caller.  Both requests, including any redirect hops, are now validated
     against private and non-public addresses, consistent with the protections
     already applied to WebFinger lookups and the built-in document loader.
-    [[GHSA-hqph-j65v-8cq5]]
+    [[CVE-2026-62857]]
 
 
 Version 1.10.11
@@ -3421,7 +3421,7 @@ Released on December 24, 2025.
 Version 1.9.13
 --------------
 
-To be released.
+Released on July 15, 2026.
 
 ### @fedify/fedify
 
@@ -3435,7 +3435,7 @@ To be released.
     caller.  Both requests, including any redirect hops, are now validated
     against private and non-public addresses, consistent with the protections
     already applied to WebFinger lookups and the built-in document loader.
-    [[GHSA-hqph-j65v-8cq5]]
+    [[CVE-2026-62857]]
 
 
 Version 1.9.12