ActivityPub

Rexistro de cambios

9.3.1 – 02-09-2026

Security

• Links to remote profiles in the Followers and Following blocks are now limited to regular web addresses when paging through the list.
• Replies cached on posts in the blog profile’s reader feed are no longer readable by logged-out visitors through the WordPress REST API.
• Signatures on incoming requests are now checked against the address the request was actually sent to.

9.3.0 – 2026-09-02

Security

• Block markup in posts from remote accounts is now removed before the post is saved.
• Follow, reply and reaction links advertised by other Fediverse servers now have to be regular web addresses.
• Followers, cached remote profiles, and reader posts are no longer readable by logged-out visitors through the WordPress REST API, and the setting that hides your follower list is now honoured everywhere.
• Inline styles are now removed from posts and profiles that come from remote accounts.
• Posts from remote accounts are now shown in the Social Web reader exactly as the site stored them.
• Replies from remote accounts are now filtered before they are saved when an administrator imports them through search.

Added

• Add a notification setting to turn off emails about likes, reposts, and quotes without silencing real comments and replies.
• Add the Fediverse and ActivityPub logos to the block editor’s icon library on WordPress 7.1 and newer.
• Federate podcast episodes published with Jetpack, including their audio file and cover art.

Changed

• Enable RFC 9421 HTTP Message Signatures by default.

Fixed

• Apps connected through the ActivityPub API now use the standard ActivityPub API permission names. Fetching remote content through your site is treated as reading rather than posting, so an app needs read permission for it.
• Apps now see the real error when a post they open through your site is missing, instead of a generic failure.
• Comment author names are no longer altered on comments that did not come from the fediverse.
• Fixed a crash that could fill the error log when another server edited a reply to a post that is no longer shared to the Fediverse.
• Fixed an error that could break embeds of Fediverse posts whose author was sent in an unexpected format.
• Fixed an error that could occur when looking up a profile on another Fediverse server that sends back an unexpected response.
• Fixed backslashes disappearing from titles and content in posts from remote accounts.
• Fixed responses to ActivityPub addresses written with different capitalisation not being cached correctly.
• Fixed the Application actor not being found when its address was written with different capitalisation.
• Fixed the Mastodon importer creating duplicate posts when an archive was imported a second time.
• Fixed titles, summaries, captions and display names from remote accounts being stored with stray markup.
• Imported Mastodon media descriptions now have unsafe HTML removed before they are saved.
• Imported Mastodon replies now have unsafe HTML removed before they are saved as comments.
• Improve how blocked accounts are matched.
• Improve permission checks for third-party apps connected through the ActivityPub API.
• Improve validation of incoming activities from other servers.
• Screen readers now announce errors in the follow, reply and reaction dialogs.
• Text inside hidden page elements, like invisible dialog pop-ups, no longer shows up in posts shared to the Fediverse.
• The blog profile can be found again from other Fediverse servers on sites that also run Polylang.

9.2.2 – 2026-08-11

Fixed

• Fixed avatars and emoji occasionally failing to cache, and the file warnings that came with it.
• Fixed deletions from Mastodon and other servers not removing the corresponding comment on your site.
• Fixed some styles not loading on the Fediverse admin screens and in the Followers and Following blocks.
• Fixed the editor warning about unsaved changes right after saving a post with an older date.

9.2.1 – 2026-08-03

Fixed

• Fixed duplicate entries and failed undo actions for activities received from other WordPress sites.
• Fixed posts and profiles not being found on Mastodon and other Fediverse software, which happened when a request asked for ActivityPub data but also accepted HTML as a low-priority fallback.
• Fixed remote profiles and followers not being found when their address contains unusual characters.
• Improved checks on boosted content so it is only accepted from the server that published it.
• Improve escaping of embedded link URLs in federated content.
• Improve permission checks for admin-only actions.
• Improve validation of incoming federated activities so the signing key and referenced objects are bound to the sender.

9.2.0 – 2026-07-31

Changed

• ActivityPub responses are now served only to clients that ask for ActivityPub data and nothing else, which keeps that data out of page caches meant for regular web pages.
• Only users enabled for ActivityPub can obtain and use OAuth access tokens.

Removed

• Remove support for the WP REST Cache plugin.

Fixed

• Hide the heading on the Followers and Following blocks when its text is cleared, matching the Reactions block.
• Under Authorized Fetch, ActivityPub responses are no longer stored by page caches such as LiteSpeed or Surge.

9.1.0 – 2026-07-22

Security

• Ensure apps you connect can only act within the access you granted them, and not make wider changes to your site.
• Ensure remote profiles and content are served from the address they claim before storing them.
• Fix a security issue where a remote actor’s profile link could run scripts in the admin area.
• Ignore an incoming follow request whose actor resolves to a different account than the one that sent it.

Added

• Add a filter that allows federating with servers on private or internal networks.
• Add an actor autocomplete endpoint so Fediverse apps can offer typeahead search when mentioning people.
• Federate the episode summary for Podlove Podcast Publisher episodes.

Changed

• Improve reliability of the Social Web admin screen loading.
• Improve the internal handling of the Application actor used for server-to-server requests.

Fixed

• Ensure a follow can only be declined by the account you followed.
• Fixed using the correct cache representation in Surge config
• Fix follow requests from some fediverse services staying pending after they are accepted.
• Fix likes from some accounts being recorded as multiple duplicate comments.
• Fix posts being removed from the Fediverse when edited while scheduled for a future publish date.
• Fix repeated deliveries of a like or repost creating new comments after the original was marked as spam or moved to the trash.
• Fix Starter Kit imports failing on Fediverse servers that require signed requests.
• Fix the scheduled refresh of remote profiles so it actually re-fetches from the remote server. Previously, stale avatars and bios for commenters never updated until they sent a new activity to your site.
• Fix URLs with multiple query parameters (such as avatars, images, profile links, and podcast media) being corrupted in content sent to the Fediverse.
• Prevent caching non-actor objects (such as notes) as remote profiles.
• Refresh cached remote profiles in place during scheduled updates to avoid creating duplicate copies.
• Show the Fediverse Preview for scheduled posts instead of the regular post preview.
• Stop storing responses from remote servers in the database when they were requested uncached.

9.0.2 – 2026-06-29

Fixed

• Improve handling of content received from other servers.

9.0.1 – 2026-06-15

Added

• Add FAQ guides that help solve follow requests stuck on “pending” and comments from the Fediverse not showing up.

Fixed

• Notify followers about your new preference when the Starter Kit policy setting changes, so other servers no longer act on an outdated one.
• Publish the Starter Kit consent policy only on your own blog and author profiles, no longer on system or third-party profiles.
• Starter Kit consent now also works for the blog profile, not just for individual authors.

9.0.0 – 2026-06-10

Security

• Enforce the signing-key host check on incoming federated activities regardless of how the key identifier is formatted.
• Fix the real-time activity stream so it only returns the requesting user’s own activities.
• Harden the Site Health connectivity check so it cannot be used to reach unsafe network addresses.
• Only share comment replies in the Fediverse when the post they belong to is itself federated, so replies on private or non-federated posts stay private.
• Prevent a remote server from discovering which of your followers belong to a third-party server it does not control.
• Prevent logged-in users from viewing another user’s private outbox activities.
• Prevent remote servers from modifying or deleting federated profiles, posts, and interactions they do not own.
• Rate-limit the remote-follow lookup to prevent it from being abused to trigger outbound requests.
• Stop the OAuth token introspection endpoint from revealing another user’s token details to logged-in users.
• Stop the quote-authorization stamp from exposing a post’s other metadata.

Added

• Add a Distribution Mode setting to control how quickly posts are delivered to followers.
• Add an opt-in setting to consent to inclusion in Starter Kits (also called Starter Packs or Featured Collections). Off by default. Find it under Settings, ActivityPub, Activities.
• C2S clients can now request canonical SWICG ActivityPub API scope names such as activitypub:read:all and activitypub:write:all, and the OAuth discovery metadata advertises them.
• C2S token responses now include activitypub_actor_id so clients following the SWICG ActivityPub API Basic Profile can discover the authenticated actor.
• Generate a blurred color preview (blurhash) for images so other fediverse apps can show a placeholder while your photos load.
• Quote notification emails now include a link to the post that quoted you, so you can review and respond more quickly.
• Warn in the editor before making a post that’s already shared on the Fediverse a draft, private, or password-protected, since followers’ copies will be removed.

Changed

• Add the blurhash term to the outbound JSON-LD @context so attachments that include a blurhash property are strictly correct JSON-LD, matching Mastodon’s own context shape.
• Federated posts moved to draft, pending, private, trash, or password-protected now send a Delete to followers (previously sent a placeholder “editing” Update or were silent).
• OAuth rate-limit responses now include a Retry-After header so clients know how long to wait before retrying.
• Updated a build dependency to a clean release now that a fixed version is available.

Removed

• Removed functions, methods, and the Follower class that were deprecated in versions 7.0 through 7.4.

Fixed

• Fix a fatal error when receiving a new follower while the Stream plugin is active.
• Fix a follow request being marked as accepted when the confirmation came from a different account than the one being followed.
• Fix the Fediverse settings appearing twice and visibility changes not saving in the block editor when the Classic Editor plugin is also active.
• Fix the introduction video failing to load on the Getting Started help screen.
• Follower synchronization with Mastodon no longer fails, signed requests with query strings now verify correctly.
• Harden the Blurhash encoder: skip decompression-bomb images before decoding, flatten transparency onto white so transparent logos no longer produce near-black placeholders, and defer the cron encode until attachment metadata is saved.
• Images and videos placed in a Media & Text block are now included when a post is shared to the Fediverse.
• Requests from other platforms to feature your posts are now handled correctly instead of being ignored.
• RSS and Atom feeds now show a simple @username mention in place of the reply block’s full embed card, which only renders properly when the plugin’s frontend CSS is loaded.
• Stop a deprecation notice from appearing in the error log when the NodeInfo plugin is also active.

Consulta o rexistro de cambios completo en GitHub.