I'm in a somewhat awkward position - but since it's about security, and the only way to (hopefully) reach all Sharkey admins and bring this to their attention is by making a public post, I'll do just that.
You probably know that Sharkey is now based on a Misskey version that is 18 months old - falling behind is very understandable, especially for a long standing fork. But since almost 500 fediverse servers are running on Sharkey (495 according to fedidb), at least security releases are essential.
So I have to let you know that we have now notified the Sharkey devs twice about several upstream vulnerabilities we found (and fixed) in Catodon, with the first time being over a month ago. The latest stable Sharkey release was almost 5 months ago, which means they have yet to be patched in a stable release. In the meantime Misskey has also released security fixes, which have also not landed in a stable release yet.
This is not an attack on Sharkey, I hope this comes as a wakeup call, because Sharkey has truly been a great platform. But the hundreds of Sharkey admins (and users) should know about the unpatched vulnerabilities the software currently carries.
