Lemmy

A federated, open-source link aggregator and discussion platform, similar to Reddit. Built on ActivityPub. Wide range of cross-platform client apps.

Open Source

Lemmy Source Code

Author

LemmyNet

Description

๐Ÿ€ A decentralised discussion platform for communities.

#activitypub#chat#fediverse#lemmy#link-aggregator#reddit#rust

Homepage

https://join-lemmy.org

Repository

  • LicenseAGPL-3.0
  • Created14 Feb 19
  • Primary languageRust
  • Size39,781 KB
  • Stars14,579
  • Forks967
  • Watchers14,579

Language Usage

Language Usage

Project Health

  • Last commit21 days ago
  • Open issues131
  • Latest releasev0.17.3-rc.2

Recent Commits

  • Nutomic(12 Aug 26)

    Allow OAuth registration even if registration disabled (fixes #6644) (#6645)

  • Nutomic(12 Aug 26)

    Update comment for verify_mod_action (#6640)

  • Dessalines(06 Aug 26)

    Use a more up to date html to markdown library (#6630) * Use a more up to date html to markdown library - I'm currently having this swallow errors to prevent a larger refactor, but we could have it return errors for incorrect html. * Running nightly fmt * Fixing test * Fixing test * Fixing tests again * Fixing again * Fix

  • Nutomic(05 Aug 26)

    Remove duplicate check functions (fixes #6311) (#6639) * Remove duplicate check functions (fixes #6311) * more cleanup * add missing checks

  • Nutomic(05 Aug 26)

    Clarify security policy (#6638)

  • Nutomic(05 Aug 26)

    Fixes for Oauth (ref #6609) (#6637) * Oauth: filter out empty strings * id_claim can be int * enforce pkce * fix login_response.registration_created * Check if verification email can be sent before submitting transaction * stricter validation of redirect uri

  • Tai Nguyen(05 Aug 26)

    Move bulk database operations to background tasks (#6627) * Move bulk database operations to background tasks (#6364) Ban, unban, and purge operations now run their bulk content removal via spawn_try_task instead of blocking the API response. The ban/purge itself is committed synchronously; post/comment removal happens asynchronously. Community ban data removal moved out of the DB transaction since spawn_try_task cannot run inside it. Tests updated to poll for removed state instead of asserting immediately. * Add comment explaining why spawn_try_task is outside transaction * comment * fmt * Fix delete user test * Use waitUntil for person deletion checks in test User deletion now runs as a background task, so getPersonDetails may still succeed immediately after deleteUser returns. Use waitUntil to poll until the person is actually deleted. * Remove unused statusNotFound import --------- Co-authored-by: Dessalines <[email protected]> Co-authored-by: Felix Ableitner <[email protected]>

  • tracyspacy(04 Aug 26)

    feat: List community followers for admins and community mods (#6623) * feat: list community followers * fix: add follow_state==Accepted * fix: join community_actions * fix: add skip_serializing_none to PersonView * fix: remove separate endpoint and enhance list_persons * test: add list_community_followers_test * fix: replace expect with ok_or() in test * chore: update comments * apply fmt

  • Nutomic(04 Aug 26)

    Redirect when fetching remote community/person over apub (fixes #6629) (#6631) * Redirect when fetching remote community/person over apub (fixes #6629) * merge logic --------- Co-authored-by: Dessalines <[email protected]>

  • Nutomic(04 Aug 26)

    Add missing validations for settings import (#6635)

  • Dessalines(03 Aug 26)

    Try parsing email with Option<String> (#6628) Context: #6609

  • Dessalines(28 Jul 26)

    Fix readme images. (#6588) * Fix readme images. - Fixes #6587 * Higher quality ones * Remove gitea mirror

  • Dessalines(28 Jul 26)

    Allow OAuth missing email. (#6619) * Allow OAuth missing email. - #6609 * Fixing clippy * Use option instead of result for local_user_view

  • Dessalines(28 Jul 26)

    Make sure PostOrCommentCombined doesnt show deleted / removed bodies. (#6620) * Make sure PostOrCommentCombined doesnt show deleted / removed bodies. - Fixes #6617 * Fixing comment * Removing pointless comment and post creator is_admin functions.

  • Pavlos Smith(28 Jul 26)

    Refactored report updates with update form and renamed resolve_reason to conclusion (#6622) * Fix resolve reason optional update (WIP) * Updated other report types also, need to fix tests and rename UpdateReportForm with specific name for each type * Renamed report update forms, fixed tests * Created migration to rename resolve reason column to conclusion, changed some example texts in tests

  • Nutomic(27 Jul 26)

    Update Rust formatting (#6625)

  • EduardoLZevallos(23 Jul 26)

    Add Content-Disposition header for proxied images (#6440) * Add Content-Disposition header for proxied images * address PR feedback, simplify code * address additional pr comments * format * address pr feedback * fix failing ci checks * fix cargo clippy * run rust formatting * address clippy error with expect(), clean up redundant checks in test. set_content_disposition only called if a download_filename exist. filename is no longer optional in set_content_disposition * remove ref use & * remove redundant not.toBeNull assertions in image proxy test * Fix clippy unwrap lint in content disposition test * Format content disposition test assertion * Fix image proxy test flakiness by retrying Content-Disposition check The 'Images in remote image post are proxied if setting enabled' test was fetching the proxied thumbnail URL immediately after post creation, before pictrs had finished downloading and caching the remote image. This caused a race condition where the Content-Disposition header was sometimes missing, leading to CI failures. Replace the single-shot fetch with a waitUntilSuccess retry loop that polls the proxied URL until the response is OK and the expected Content-Disposition header is present. This matches the existing pattern used elsewhere in the test suite for waiting on backgrounded pictrs operations. * Revert "Fix image proxy test flakiness by retrying Content-Disposition check" This reverts commit 6f25c62cfd69a9f86c3194d31c9d67ec44721d1f. * Add trace statements for Content-Disposition debugging in image proxy * Add retry loop for Content-Disposition check in image proxy test The test fetches the proxied thumbnail URL immediately after post creation, before pictrs has finished downloading and resizing the remote image. This causes a race condition where pictrs returns 404 while processing, which means the Content-Disposition header is not present yet. Replace the single-shot fetch with a waitUntilSuccess retry loop that polls the proxied URL until the response is OK and the expected Content-Disposition header is present. This matches the existing pattern used elsewhere in the test suite for waiting on backgrounded pictrs operations. Debug trace statements in the Rust image proxy code are retained for future diagnosis if needed. * Increase test retry delays for Content-Disposition check (test only) This is a test to see if the issue is simply that pictrs needs more time to download and process the remote image on slow CI machines. Increases the retry count from 10 to 15 and adds longer delays (up to 10s) for the waitUntilSuccess polling in expectProxiedImageContentDisposition. Debug trace statements in the Rust image proxy code are retained for diagnosis. If this doesn't fix the issue, we'll revert. * Fix Content-Disposition filename for federated proxy images (fixes #6354) When a federated post's thumbnail_url is itself a proxy URL from another Lemmy instance, the receiving instance re-proxies it, causing download_filename_from_url to extract the proxy path (/api/v4/image/proxy) instead of the original image filename. Add unwrap_proxy_url helper that recursively extracts the original image URL from nested proxy URLs. Use it for both file-type and filename derivation in image_proxy handler. Also fix test: strip max_size before fetching proxied thumbnail in expectProxiedImageContentDisposition, since pict-rs danger-dummy-mode hangs on image/process.*?proxy= requests. The Content-Disposition header logic is identical for image/original?proxy= and image/process.*?proxy=. * Remove debug eprintln traces left over from debugging * Fix clippy collapsible_if in unwrap_proxy_url Flatten the nested if/if-let chain in crates/routes/src/images/download.rs by using an early return and an iterator combinator pipeline. This resolves clippy::collapsible_if warnings while preserving the existing behavior of recursively extracting the original image URL from nested Lemmy proxy URLs. * Fix image proxy URL detection and download filename derivation - Add is_proxy_url helper that detects both /api/v4/image/proxy and /api/v3/image_proxy for compatibility with 0.19 federation - Rename download_filename_from_url to download_filename_from_url_path to reflect it takes a path, not a full URL - Use non-null assertion (!) instead of nullish coalescing (?? '') in test - Remove redundant if guards around thumbnail_url in test * run cargo +nightly fmt * Inline single-use inlineContentDisposition helper --------- Co-authored-by: eduardo <[email protected]>

  • Pavlos Smith(14 Jul 26)

    Add report resolve reason (#6612) * Added report resolve reason fields, work in progress * Report resolve reason works, federation and notification TODO * Removed TODO comments, fixed tests * sql format

  • Nutomic(14 Jul 26)

    Handle create post activity from Mitra (fixes #6577) (#6611)

  • Nutomic(10 Jul 26)

    Switch to jemalloc (#6608)

  • Nutomic(06 Jul 26)

    Change more activity types to accept both id or embed (fixes #2106) (#6600) * Change more activity types to accept both id or embed (fixes #2106) * clippy

  • Nutomic(06 Jul 26)

    Fix for accepting Mitra create activity (fixes #6577) (#6601)

  • Nutomic(03 Jul 26)

    Proper fix for accept activity with object id (fixes 6595) (#6599) * Proper fix for accept activity with object id (fixes #6595) * cleanup

  • Dessalines(03 Jul 26)

    Add typos check to CI. (#6560) * Add typos check to CI. * Move below prettier * Also exclude readmes * Running typos * A few more * No reason to use nightly rust image for typos.

  • Felix Ableitner(03 Jul 26)

    Version 1.0.0-beta.1

  • Nutomic(30 Jun 26)

    Fix private message sending from 0.19 to 1.0 (fixes #6591) (#6597)

  • Nutomic(29 Jun 26)

    Handle accept activity with object id (fixes 6595) (#6596)

  • Dessalines(23 Jun 26)

    Adding community moderators to GetPost (#6593) - Fixes #6592

  • Waqqas Sheikh(22 Jun 26)

    Update activity count of dead communities (fixes #5794) (#6589) The `community_aggregates_activity` function returns a mapping of community and activity count. A scheduled task updates the community record with the activity count. The query used in `community_aggregates_activity` mistakenly omits dead communities. This causes the recorded activity count to go stale which causes the issue. The fix is to add an update query at the end of the scheduled task that resets the activity count to 0 for those communities that were not returned by the query.

  • Waqqas Sheikh(16 Jun 26)

    Adds additional attachments to end of post (fixes #6229) (#6585) * Adds additional attachments to end of post (fixes #6229) When activities of posts have both an image and a link attachment, lemmy only takes the image attachment. The link attachment is dropped. The solution is to add the additional links at the end of the post body (similar to how multiple attachments are handled for comments) This fixes issue 6229. * Address lint issues (needless borrow) * Remove test comment that documents old behavior

Lemmy Security

5.3/10

Repo Security Summary

Updated 24 Aug 26

  • PackagingN/A
  • Maintained10/10
  • Code-Review9/10
  • Dangerous-WorkflowN/A
  • Token-PermissionsN/A
  • Security-Policy10/10
  • CII-Best-Practices0/10
  • Binary-Artifacts10/10
  • License10/10
  • Fuzzing0/10
  • Signed-Releases0/10
  • Branch-ProtectionN/A
  • Pinned-Dependencies0/10
  • SAST0/10

Security Advisories (23)

  • mediumPatched

    CVE-2026-54738Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

  • lowPatched

    CVE-2026-54743Stored XSS via markdown image alt-text in lemmy-ui html5-embed

  • mediumPatched

    CVE-2026-54739Login Endpoint User Enumeration via HTTP Response Code Differential

  • lowPatched

    GHSA-5qxq-g3f3-57p5Multi-community `Update` has no actor authorization

  • lowPatched

    GHSA-9wj2-3cv5-cqrxPrivate community profile and moderators leak via federation HTTP

  • lowUnpatched

    CVE-2026-54742`CollectionAdd::Featured` does not check the post is in the community

  • lowPatched

    GHSA-95q8-x6r6-672mPrivate community data exposed through community, saved, liked, and modlog API views

  • lowPatched

    CVE-2026-54741Blocked users can edit private messages sent before the block

  • lowPatched

    GHSA-jmxc-hhwx-gvv3Private Lemmy instances expose multi-community metadata without authentication

  • mediumPatchedCVSS 6.5

    CVE-2026-54740Lower-ranked federated moderator can remove higher-ranked moderators

  • lowPatched

    GHSA-vh35-q865-92vrFederated Block activity can ban local users without site admin authorization

  • lowPatched

    GHSA-qxrw-f6fh-34r7Resend verification endpoint exposes registered email addresses

  • mediumUnpatchedCVSS 6.3

    CVE-2026-42180SSRF in /api/v3/post via Webmention dispatch

  • mediumUnpatchedCVSS 6.5

    CVE-2026-42181SSRF and internal image disclosure in post link metadata via unvalidated og:image

  • lowUnpatched

    GHSA-c482-7gjx-pp36Blind SSRF in /api/v3/resolve_object, normal user can reach internal services and make outbound requests

  • mediumPatchedCVSS 6.5

    CVE-2026-33693SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

  • mediumPatched

    CVE-2026-29178Unauthenticated SSRF via file_type query parameter injection in image endpoint

  • lowPatched

    GHSA-x57w-mr53-3f5hDB performance issues

  • mediumPatched

    GHSA-373q-r73m-8mrgLocal users can delete arbitrary entries from the local_image table

  • mediumPatched

    GHSA-7xwp-jqhc-v6vwLocal users can delete arbitrary pict-rs media

  • mediumPatched

    GHSA-wr2m-38xh-rpc9Purging users or communities or banning users can delete images they didn't upload/exclusively use

  • mediumUnpatchedCVSS 4

    CVE-2025-25194Server-Side Request Forgery (SSRF) in activitypub_federation

  • highPatchedCVSS 7.5

    CVE-2024-23649Any authenticated user may obtain private message details from other users on the same instance

Lemmy Website

Website

Lemmy - A decentralised discussion platform for communities

Lemmy

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address65.21.61.25
  • Hostnamestatic.25.61.21.65.clients.your-server.de
  • LocationHelsinki,Uusimaa,Finland,EU
  • ISPHetzner Online GmbH
  • ASNAS24940

Associated Countries

  • USUS
  • FIFI

Safety Score

Website marked as safe

100%

Blacklist Check

join-lemmy.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

Lemmy Android App

APK Info

De-Googled Compatibility

Native4.00/ 44 ratings
microG4.00/ 43 ratings
  • GrapheneOSNative4.0 / 4(2)
  • LineageOSmicroG4.0 / 4(2)

Tested on Android 11โ€“16 ยท Updated 09 Oct 25 ยท View on Plexus โ†’

Trackers

No trackers found

    Permissions

    • Access Network State
    • Internet
    • Read External Storage
    • Read Media Audio
    • Read Media Images
    • Read Media Video
    • Write External Storage
    • Dynamic Receiver Not Exported Permission

    Lemmy Reviews

    More Social Networks

    About the Data: Lemmy

    Change History

    Edit Lemmy Data

    You can edit Lemmy's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
    Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

    Origin Data

    Modify Data

    API

    You can access Lemmy's data programmatically via our API. Simply make a GET request to:

    https://api.awesome-privacy.xyz/v1/services/lemmy

    The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

    Share Lemmy

    Help your friends compare Social Networks, and pick privacy-respecting software and services.
    Share Lemmy and Awesome Privacy with your network!