Fedify 2.1.6

Released on April 20, 2026.

@fedify/astro

• Restored the npm entrypoint contract for @fedify/astro by making the build emit dist/*.js and dist/*.d.ts files that match the published package metadata again. This fixes package resolution failures caused by package.json exporting files that did not exist in the npm tarball. [#699, #701]

@fedify/cli

• Fixed fedify lookup failing to look up URLs on private or localhost addresses unless -p/--allow-private-address was passed, which was a regression introduced in Fedify 2.1.0 when the CLI began forwarding the allowPrivateAddress option to the underlying document loader. URLs explicitly provided on the command line now always allow private addresses, while URLs discovered during -t/--traverse honor the option to mitigate SSRF attacks against private addresses. Recursive fetches via --recurse continue to always disallow private addresses regardless of the option. [#696, #698 by Chanhaeng Lee]