updated plugin ActivityPub version 9.1.0
This commit is contained in:
Gitium
@ -2,8 +2,8 @@
|
||||
Contributors: automattic, pfefferle, mattwiebe, obenland, akirk, jeherve, mediaformat, nuriapena, cavalierlife, andremenrath
|
||||
Tags: fediverse, activitypub, indieweb, activitystream, social web
|
||||
Requires at least: 6.5
|
||||
Tested up to: 6.9
|
||||
Stable tag: 8.3.0
|
||||
Tested up to: 7.0
|
||||
Stable tag: 9.1.0
|
||||
Requires PHP: 7.4
|
||||
License: MIT
|
||||
License URI: http://opensource.org/licenses/MIT
|
||||
@ -61,6 +61,12 @@ This plugin connects your WordPress blog to popular social platforms like Mastod
|
||||
|
||||
*ActivityPub for WordPress* adds Fediverse features to WordPress, but it is not a replacement for platforms like Friendica or Mastodon. If you're looking to host a decentralized social network, consider using [Mastodon](https://joinmastodon.org/) or [Friendica](https://friendi.ca/).
|
||||
|
||||
= Is this a Mastodon crossposter? Can it post to my existing Mastodon account? =
|
||||
|
||||
No. A crossposter pushes copies of your posts to a *separate* account you already have on someone else's server. *ActivityPub for WordPress* does the opposite: it makes your own site a first-class Fediverse account (`@you@example.com`), so people follow your site directly and replies come back as WordPress comments, with no second account required.
|
||||
|
||||
The plugin will not add crossposting to an existing account; that is a deliberate choice, not a missing feature. If you would rather mirror articles to an established Mastodon account, that is a job for a dedicated crossposter plugin.
|
||||
|
||||
= Why "ActivityPub"? =
|
||||
|
||||
The name ActivityPub comes from the two core ideas behind the protocol:
|
||||
@ -72,7 +78,7 @@ Put together, ActivityPub is a protocol for publishing and subscribing to activi
|
||||
|
||||
= How do I solve… =
|
||||
|
||||
We have a **How-To** section in the [docs](https://github.com/Automattic/wordpress-activitypub/tree/trunk/docs/how-to) directory that can help you troubleshoot common issues.
|
||||
We have an **FAQ** section in the [docs](https://github.com/Automattic/wordpress-activitypub/tree/trunk/docs/faq) directory with checklists for the most common problems — for example [follow requests stuck on "pending"](https://github.com/Automattic/wordpress-activitypub/blob/trunk/docs/faq/pending-follow-requests.md) and [comments from the Fediverse not showing up](https://github.com/Automattic/wordpress-activitypub/blob/trunk/docs/faq/missing-comments.md) — and a **How-To** section in the [docs](https://github.com/Automattic/wordpress-activitypub/tree/trunk/docs/how-to) directory for configuring specific setups.
|
||||
|
||||
= Constants =
|
||||
|
||||
@ -111,204 +117,100 @@ For reasons of data protection, it is not possible to see the followers of other
|
||||
|
||||
== Changelog ==
|
||||
|
||||
### 8.3.0 - 2026-05-18
|
||||
### 9.1.0 - 2026-07-22
|
||||
#### Security
|
||||
- Block a recently compromised JavaScript dependency from being installed during builds.
|
||||
- Ensure apps you connect can only act within the access you granted them, and not make wider changes to your site.
|
||||
- Ensure remote profiles and content are served from the address they claim before storing them.
|
||||
- Fix a security issue where a remote actor's profile link could run scripts in the admin area.
|
||||
- Ignore an incoming follow request whose actor resolves to a different account than the one that sent it.
|
||||
|
||||
#### Added
|
||||
- Allow site administrators to post from third-party apps on behalf of the site's blog account.
|
||||
- Store content warnings from posts published through third-party ActivityPub apps so they federate correctly.
|
||||
- Add a filter that allows federating with servers on private or internal networks.
|
||||
- Add an actor autocomplete endpoint so Fediverse apps can offer typeahead search when mentioning people.
|
||||
- Federate the episode summary for Podlove Podcast Publisher episodes.
|
||||
|
||||
#### Changed
|
||||
- Improve compatibility with newer Fediverse servers by recognizing the FEP-3b86 Object Intent link when resolving remote follow and other intent endpoints.
|
||||
- Improve compatibility with newer Fediverse servers by recognizing the standardized FEP-3b86 follow link for remote follows.
|
||||
- Refresh bundled scripts to pick up the latest WordPress component updates.
|
||||
- Stagger background data processing after plugin updates to reduce server load on hosts running many sites.
|
||||
- Improve reliability of the Social Web admin screen loading.
|
||||
- Improve the internal handling of the Application actor used for server-to-server requests.
|
||||
|
||||
#### Fixed
|
||||
- Allow third-party apps connected to your site to look up Fediverse users by their handle (like @user@example.com).
|
||||
- Fix ActivityPub blocks and widgets failing to load on cross-origin embeds (such as WordPress.com sites) due to a missing nonce header in the CORS allow-list.
|
||||
- Fix a JavaScript console error that could appear on pages with the Follow, Reactions, Followers, Following, or Remote Reply blocks.
|
||||
- Fix posting an Undo of a Follow through the outbox API failing with a server error or silently leaving the follow in place.
|
||||
- Prevent a PHP warning during the monthly statistics backfill when an outbox item disappears between lookup steps.
|
||||
- Prevent private outbox items authored by the site account from being visible to logged-out visitors at their permalink URLs.
|
||||
- Prevent the site's follower and following lists from being visible to logged-out visitors when the social graph is set to private.
|
||||
- Reduce database overhead on sites with many deleted posts by moving the tombstone registry to its own storage.
|
||||
- Set a real author on posts created via the blog actor outbox so they no longer appear without a byline.
|
||||
- Silence the upcoming WordPress 7.0 deprecation warning about `data-wp-on-async` by switching the plugin's interactive blocks to the new `withSyncEvent()` helper.
|
||||
|
||||
### 8.2.1 - 2026-05-01
|
||||
#### Security
|
||||
- Hardened how the inbox processes large recipient lists in incoming activities.
|
||||
- Ensure a follow can only be declined by the account you followed.
|
||||
- Fixed using the correct cache representation in Surge config
|
||||
- Fix follow requests from some fediverse services staying pending after they are accepted.
|
||||
- Fix likes from some accounts being recorded as multiple duplicate comments.
|
||||
- Fix posts being removed from the Fediverse when edited while scheduled for a future publish date.
|
||||
- Fix repeated deliveries of a like or repost creating new comments after the original was marked as spam or moved to the trash.
|
||||
- Fix Starter Kit imports failing on Fediverse servers that require signed requests.
|
||||
- Fix the scheduled refresh of remote profiles so it actually re-fetches from the remote server. Previously, stale avatars and bios for commenters never updated until they sent a new activity to your site.
|
||||
- Fix URLs with multiple query parameters (such as avatars, images, profile links, and podcast media) being corrupted in content sent to the Fediverse.
|
||||
- Prevent caching non-actor objects (such as notes) as remote profiles.
|
||||
- Refresh cached remote profiles in place during scheduled updates to avoid creating duplicate copies.
|
||||
- Show the Fediverse Preview for scheduled posts instead of the regular post preview.
|
||||
- Stop storing responses from remote servers in the database when they were requested uncached.
|
||||
|
||||
### 9.0.2 - 2026-06-29
|
||||
#### Fixed
|
||||
- Fix monthly and annual Fediverse Stats emails being sent more than once per period when the scheduler ran multiple times.
|
||||
- Improve handling of content received from other servers.
|
||||
|
||||
### 8.2.0 - 2026-04-27
|
||||
#### Security
|
||||
- ActivityPub REST endpoints no longer advertise credentialed cross-origin access. Browser-based clients using OAuth bearer tokens continue to work as before.
|
||||
- Aligned the deprecated signature verifier's clock tolerance with the supported verifiers.
|
||||
- Blocked additional reserved IPv6 ranges from outbound request safety checks.
|
||||
- Decoded percent-encoded forms in the follower sync authority before the safety check.
|
||||
- Fail closed when an OAuth request can't be tied to a client IP, instead of sharing one rate-limit bucket.
|
||||
- Hardened input handling for incoming federated activity types.
|
||||
- Hardened outbound request handling for third-party app connections and live activity streams.
|
||||
- Hardened outbound request safety to cover IPv6-only third-party hosts.
|
||||
- Per-IP rate limits now only trust the actual TCP peer by default, so an attacker on a directly-exposed site cannot bypass the cap by spoofing X-Forwarded-For or similar proxy headers. Sites behind a trusted reverse proxy (Cloudflare, Akamai, nginx) can opt the relevant header back in via the new "activitypub_client_ip_sources" filter.
|
||||
- Reject follower sync requests targeted at internal-network hosts at the route layer.
|
||||
- Required signatures on HEAD requests to peer-only endpoints.
|
||||
|
||||
#### Changed
|
||||
- Development tooling: require PHPUnit 9.6.33 or newer (security fix CVE-2026-24765). No runtime impact for end users.
|
||||
- OAuth public clients must now use PKCE by default, matching OAuth 2.1. Site operators can relax this via the activitypub_oauth_require_pkce filter if legacy clients need to connect.
|
||||
- Returned the standard rate-limit response from the OAuth token endpoint when too many requests are sent.
|
||||
|
||||
#### Fixed
|
||||
- Delete activities no longer bypass signature verification on endpoints that explicitly require it.
|
||||
- OAuth token revocation now verifies the caller owns the token being revoked.
|
||||
- Tighten HTTP signature verification: narrow the clock-skew window, reject signatures that carry no freshness timestamp, and cap unreasonable expiry times. Peers that sign without a Date or creation timestamp will no longer verify.
|
||||
- Trim dev-only configuration files from the plugin release package.
|
||||
|
||||
### 8.1.1 - 2026-04-22
|
||||
### 9.0.1 - 2026-06-15
|
||||
#### Added
|
||||
- Added the `activitypub_post_object_type` filter so plugins can override the federated object type (Note, Article, Page) for a post.
|
||||
|
||||
#### Changed
|
||||
- Always flush rewrite rules at the end of a plugin migration so that users upgrading across multiple versions do not miss a flush.
|
||||
- Add FAQ guides that help solve follow requests stuck on "pending" and comments from the Fediverse not showing up.
|
||||
|
||||
#### Fixed
|
||||
- Fix the Fediverse stats widget on sites where the REST namespace is remapped, such as WordPress.com.
|
||||
- Harden the reactions API response so stored author names and URLs cannot introduce markup or non-HTTP schemes into the JSON output.
|
||||
- Stop hiding posts that contain a federated reply block from the main blog listing and the admin post list on sites that do not use the Posts and Replies block.
|
||||
- Notify followers about your new preference when the Starter Kit policy setting changes, so other servers no longer act on an outdated one.
|
||||
- Publish the Starter Kit consent policy only on your own blog and author profiles, no longer on system or third-party profiles.
|
||||
- Starter Kit consent now also works for the blog profile, not just for individual authors.
|
||||
|
||||
### 8.1.0 - 2026-04-21
|
||||
### 9.0.0 - 2026-06-10
|
||||
#### Security
|
||||
- Add rate limiting to app registration to prevent abuse.
|
||||
- Fix blog actor outbox exposing private activities to unauthenticated visitors.
|
||||
- Restrict localhost URL allowance to local development environments only.
|
||||
- Verify that the signing key belongs to the same server as the activity actor.
|
||||
- Enforce the signing-key host check on incoming federated activities regardless of how the key identifier is formatted.
|
||||
- Fix the real-time activity stream so it only returns the requesting user's own activities.
|
||||
- Harden the Site Health connectivity check so it cannot be used to reach unsafe network addresses.
|
||||
- Only share comment replies in the Fediverse when the post they belong to is itself federated, so replies on private or non-federated posts stay private.
|
||||
- Prevent a remote server from discovering which of your followers belong to a third-party server it does not control.
|
||||
- Prevent logged-in users from viewing another user's private outbox activities.
|
||||
- Prevent remote servers from modifying or deleting federated profiles, posts, and interactions they do not own.
|
||||
- Rate-limit the remote-follow lookup to prevent it from being abused to trigger outbound requests.
|
||||
- Stop the OAuth token introspection endpoint from revealing another user's token details to logged-in users.
|
||||
- Stop the quote-authorization stamp from exposing a post's other metadata.
|
||||
|
||||
#### Added
|
||||
- Add a "Posts and Replies" tab bar for author archives that filters between posts and replies, similar to Mastodon's profile view.
|
||||
- Add a liked collection to actor profiles, showing all posts the actor has liked.
|
||||
- Add a seasonal starter pattern that suggests sharing Fediverse stats when creating a new post in December and January.
|
||||
- Add a stats block that displays annual Fediverse statistics as a card on the site and as a shareable image on the Fediverse, with automatic color and font adoption from the site's theme.
|
||||
- Added `activitypub_pre_get_by_id` filter to allow plugins to register custom virtual actors resolved by ID.
|
||||
- Add EXIF metadata support for image attachments using Vernissage namespace.
|
||||
- Add new Fediverse Following Page and Profile Page block patterns.
|
||||
- Add OAuth server metadata and registration endpoint discovery to actor profiles.
|
||||
- Add real-time streaming for inbox and outbox updates via Server-Sent Events (SSE).
|
||||
- Add support for Block, Add (pin post), and Remove (unpin post) activities via Client-to-Server API.
|
||||
- Add support for check-in activities posted via compatible apps.
|
||||
- Add support for importing Starter Packs in both the Pixelfed and Mastodon formats.
|
||||
- Add tags.pub integration to supplement tag timelines with posts from across the Fediverse.
|
||||
- Support for ActivityPub Client-to-Server (C2S) protocol, allowing apps like federated clients to create, edit, and delete posts on your behalf.
|
||||
- Add a Distribution Mode setting to control how quickly posts are delivered to followers.
|
||||
- Add an opt-in setting to consent to inclusion in Starter Kits (also called Starter Packs or Featured Collections). Off by default. Find it under Settings, ActivityPub, Activities.
|
||||
- C2S clients can now request canonical SWICG ActivityPub API scope names such as `activitypub:read:all` and `activitypub:write:all`, and the OAuth discovery metadata advertises them.
|
||||
- C2S token responses now include `activitypub_actor_id` so clients following the SWICG ActivityPub API Basic Profile can discover the authenticated actor.
|
||||
- Generate a blurred color preview (blurhash) for images so other fediverse apps can show a placeholder while your photos load.
|
||||
- Quote notification emails now include a link to the post that quoted you, so you can review and respond more quickly.
|
||||
- Warn in the editor before making a post that's already shared on the Fediverse a draft, private, or password-protected, since followers' copies will be removed.
|
||||
|
||||
#### Changed
|
||||
- Block patterns for follow, following, and profile pages are now only suggested when editing pages.
|
||||
- Fix notification pagination when using Enable Mastodon Apps: use date-constrained queries instead of truncating the shared notification pool, and expose `$limit`, `$before_date`, and `$after_date` as additional filter arguments so third-party handlers can fetch the correct window.
|
||||
- Improve the pre-publish format suggestion panel with clearer messages and a confirmation after applying a format.
|
||||
- Podcast episodes now respect the configured object type setting instead of always being sent as "Note".
|
||||
- Show reaction action buttons even when a post has no reactions yet.
|
||||
- Add the `blurhash` term to the outbound JSON-LD `@context` so attachments that include a `blurhash` property are strictly correct JSON-LD, matching Mastodon's own context shape.
|
||||
- Federated posts moved to draft, pending, private, trash, or password-protected now send a Delete to followers (previously sent a placeholder "editing" Update or were silent).
|
||||
- OAuth rate-limit responses now include a `Retry-After` header so clients know how long to wait before retrying.
|
||||
- Updated a build dependency to a clean release now that a fixed version is available.
|
||||
|
||||
#### Removed
|
||||
- Removed functions, methods, and the Follower class that were deprecated in versions 7.0 through 7.4.
|
||||
|
||||
#### Fixed
|
||||
- ActivityPub endpoints that surface comment, reply, like, share, and remote-reply metadata now honor the parent post's visibility setting.
|
||||
- Added validation for SSE access tokens passed via query parameter.
|
||||
- Fix account migration (Move) not working when moving back to an external account.
|
||||
- Fix a fatal error during activity delivery when the outbox item has been deleted.
|
||||
- Fix a fatal error when receiving activities with a non-string language property.
|
||||
- Fix a fatal `array_keys(null)` in `Comment::get_comment_type_slugs()` that could take down any request where a third-party plugin transitioned a custom comment type before `add_comment_type()` had been called.
|
||||
- Fix a missing script dependency notice on the admin page in WordPress 6.9.1 and later.
|
||||
- Fix BuddyPress @mention filter corrupting Fediverse Followers and Following blocks.
|
||||
- Fix cleanup jobs silently doing nothing on sites where purge retention options were not set.
|
||||
- Fix comments on remote posts being incorrectly held in moderation.
|
||||
- Fix double-encoded HTML entities in post titles on the Fediverse Stats dashboard.
|
||||
- Fixed an issue where quote authorization stamps could reference unrelated posts.
|
||||
- Fixed double-encoding of special characters in comment author names on updates.
|
||||
- Fixed emoji shortcode replacement to handle special characters in emoji names correctly.
|
||||
- Fix fatal error when other plugins hook into the user agent filter expecting two arguments.
|
||||
- Fix Fediverse Preview showing the standard web view instead of the ActivityPub preview for draft posts.
|
||||
- Fix OAuth authentication failing for local development clients using localhost subdomains.
|
||||
- Fix performance regression from reply-exclusion filter by skipping it for queries targeting non-ActivityPub post types.
|
||||
- Fix Reader feed failing to load with newer WordPress versions.
|
||||
- Fix remote actor avatars getting stuck on broken URLs when the original image becomes unavailable.
|
||||
- Fix Site Health check showing an empty error message when the WebFinger endpoint is not reachable.
|
||||
- Fix the Fediverse profile "Joined" date showing the oldest post date instead of when the site started federating.
|
||||
- Fix the Fediverse profile showing an inflated post count by excluding incoming comments from the total.
|
||||
- Fix Update handler using stale local actor data instead of the activity payload
|
||||
- Improved HTTP Signature validation for requests with a missing Date header.
|
||||
- Only allow S256 as PKCE code challenge method for OAuth authorization.
|
||||
- Prevent third-party plugin UI elements and scripts from appearing in federated content.
|
||||
- Require signed peer requests for the followers synchronization endpoint per FEP-8fcf.
|
||||
- Show a styled error page instead of raw technical output when an OAuth application cannot be reached during authorization.
|
||||
- Strip private recipient fields from all outgoing activities to prevent leaking private audiences.
|
||||
- Sync ActivityPub blog actor settings via Jetpack.
|
||||
- Use ap_actor post ID for remote account IDs instead of remapping URI strings.
|
||||
- Use safe HTTP request for signature retry to prevent requests to private IP ranges.
|
||||
- Validate emoji updated timestamps before storing them.
|
||||
|
||||
### 8.0.2 - 2026-03-17
|
||||
#### Security
|
||||
- Prevent non-public posts (drafts, scheduled, pending review) from being accessible via ActivityPub.
|
||||
|
||||
### 8.0.1 - 2026-03-11
|
||||
#### Changed
|
||||
- Simplify the follow page block pattern to avoid duplicate headings and improve accessibility.
|
||||
|
||||
#### Fixed
|
||||
- Fix dark sidebar colors appearing incorrectly with non-default admin color schemes.
|
||||
- Fix Fediverse Reactions block not aligning with post content in block themes.
|
||||
- Fix new posts being marked as modified on load, which prevented Gutenberg's starter pattern modal from appearing.
|
||||
|
||||
### 8.0.0 - 2026-03-04
|
||||
#### Security
|
||||
- Prevent private recipient lists from being shared when sending activities to other servers.
|
||||
|
||||
#### Added
|
||||
- Add a help section to interaction dialogs explaining the Fediverse and why entering a profile is needed.
|
||||
- Add a notice on the Settings page to easily switch from legacy template mode to automatic mode.
|
||||
- Add a pre-publish suggestion that recommends a post format for better compatibility with media-focused Fediverse platforms.
|
||||
- Add a Site Health check that warns when plugins are causing too many federation updates.
|
||||
- Add backwards compatibility for the `ACTIVITYPUB_DISABLE_SIDELOADING` constant and `activitypub_sideloading_enabled` filter from version 7.9.1.
|
||||
- Add bot account snippet that marks ActivityPub profiles as automated accounts, displaying a "BOT" badge on Mastodon and other Fediverse platforms.
|
||||
- Add Cache namespace for remote media caching with CLI commands, improved MIME validation, and filter-based architecture.
|
||||
- Add federation of video poster images set in the WordPress video block.
|
||||
- Add Locale from Tags community snippet.
|
||||
- Add optional Like and Boost action buttons to the Fediverse Reactions block, allowing visitors to interact with posts from their own server.
|
||||
- Add pre-built Fediverse block patterns for easy profile, follow page, and sidebar setup.
|
||||
- Add snippet for blockless fediverse reactions
|
||||
- Add `wp activitypub fetch` CLI command for fetching remote URLs with signed HTTP requests.
|
||||
|
||||
#### Changed
|
||||
- Improved active user counting for NodeInfo to include all federated content types and comments.
|
||||
- Improve language map resolution to strictly follow the ActivityStreams spec.
|
||||
- Superseded outbox activities are now removed instead of kept, reducing clutter in the outbox.
|
||||
- The minimum required PHP version is now 7.4.
|
||||
|
||||
#### Fixed
|
||||
- Accept incoming activities from servers that use standalone key objects for HTTP Signatures.
|
||||
- Fix a crash on servers where WordPress uses FTP instead of direct file access for media caching.
|
||||
- Fix a crash when receiving posts from certain federated platforms that send multilingual content.
|
||||
- Fix automatic cleanup of old activities failing silently on sites with large numbers of outbox, inbox, or remote post items.
|
||||
- Fix comment count to properly exclude likes, shares, and notes.
|
||||
- Fix follow button redirect from Mastodon not being recognized.
|
||||
- Fix modal overlay not covering the full screen on block themes.
|
||||
- Fix outbox invalidation canceling pending Accept/Reject responses to QuoteRequests for the same post.
|
||||
- Fix QuoteRequest handler to derive responding actor from post author instead of inbox recipient.
|
||||
- Fix reactions block buttons inheriting theme background color on classic themes.
|
||||
- Fix reactions block layout on small screens and remove unwanted button highlight when clicking action buttons.
|
||||
- Fix signature verification rejecting valid requests that use lowercase algorithm names in the Digest header.
|
||||
- Fix soft-deleted posts being served instead of a tombstone when the post is re-saved.
|
||||
- Improve compatibility with federated services that use a URL reference for the actor's public key.
|
||||
- Improve handling of all public audience identifiers when sending activities to followers and relays.
|
||||
- Fix a fatal error when receiving a new follower while the Stream plugin is active.
|
||||
- Fix a follow request being marked as accepted when the confirmation came from a different account than the one being followed.
|
||||
- Fix the Fediverse settings appearing twice and visibility changes not saving in the block editor when the Classic Editor plugin is also active.
|
||||
- Fix the introduction video failing to load on the Getting Started help screen.
|
||||
- Follower synchronization with Mastodon no longer fails, signed requests with query strings now verify correctly.
|
||||
- Harden the Blurhash encoder: skip decompression-bomb images before decoding, flatten transparency onto white so transparent logos no longer produce near-black placeholders, and defer the cron encode until attachment metadata is saved.
|
||||
- Images and videos placed in a Media & Text block are now included when a post is shared to the Fediverse.
|
||||
- Requests from other platforms to feature your posts are now handled correctly instead of being ignored.
|
||||
- RSS and Atom feeds now show a simple `@username` mention in place of the reply block's full embed card, which only renders properly when the plugin's frontend CSS is loaded.
|
||||
- Stop a deprecation notice from appearing in the error log when the NodeInfo plugin is also active.
|
||||
|
||||
See full Changelog on [GitHub](https://github.com/Automattic/wordpress-activitypub/blob/trunk/CHANGELOG.md).
|
||||
|
||||
== Upgrade Notice ==
|
||||
|
||||
= 8.1.0 =
|
||||
= 9.0.0 =
|
||||
|
||||
See your year on the Fediverse with the new Stats feature, bringing your highlights together in one simple view you can share anywhere.
|
||||
Posts you switch to draft, pending, private, or password-protected are now fully removed from the Fediverse, so unpublished content no longer lingers on other servers. Note that re-publishing may not restore them on some platforms.
|
||||
|
||||
== Installation ==
|
||||
|
||||
|
||||
Reference in New Issue
Block a user