From e192bfa37afddb96e4b3f9f5b8ec17dd1ae87270 Mon Sep 17 00:00:00 2001 From: Matthias Pfefferle Date: Tue, 27 Oct 2026 19:03:58 +0100 Subject: [PATCH] Release 9.4.0 --- .github/changelog/3529-avatar-email-max-width | 4 - .github/changelog/actor-list-theme-colors | 4 - .../add-allowed-comment-types-filter | 4 - .../add-enable-mastodon-apps-status-language | 4 - .github/changelog/add-feed-date-filter | 4 - .github/changelog/add-idn-webfinger | 4 - .github/changelog/add-interactions-rate-limit | 4 - .github/changelog/add-miscellany-context | 4 - .../changelog/add-oauth-authorize-switch-user | 4 - .github/changelog/add-polylang-integration | 4 - .github/changelog/add-proxy-cache-layer | 4 - .github/changelog/add-quote-block | 4 - .github/changelog/add-quote-source-link | 4 - .github/changelog/add-reactions-counts-style | 4 - .github/changelog/add-seek-item-endpoint | 4 - .github/changelog/admin-page-title | 4 - .../changelog/anchor-oauth-metadata-rewrite | 4 - .github/changelog/block-user-options | 4 - .github/changelog/cache-duplicate-cleanup | 4 - .../feature-blog-profile-name-avatar | 4 - .../changelog/fix-3579-auto-approved-comments | 4 - .../changelog/fix-3868-underscore-hashtags | 4 - .../changelog/fix-account-move-verification | 4 - .github/changelog/fix-activity-date-fallback | 4 - .github/changelog/fix-attachment-id-sanitize | 4 - .../fix-blocked-actor-relationship-removal | 4 - .../changelog/fix-collection-link-query-args | 4 - .github/changelog/fix-comment-images | 4 - .github/changelog/fix-comment-permalink-page | 4 - .../fix-comment-query-type-coexistence | 4 - .github/changelog/fix-draft-signature-port | 4 - .../changelog/fix-duplicate-cached-avatars | 4 - .../fix-duplicate-inbox-notifications | 4 - .github/changelog/fix-duplicate-snackbar | 4 - .../changelog/fix-ema-local-statuses-count | 4 - .../changelog/fix-emoji-in-blog-identifier | 4 - .../changelog/fix-feature-request-ownership | 4 - .github/changelog/fix-featured-password | 4 - .github/changelog/fix-follow-target | 4 - .../fix-guid-lookup-special-characters | 4 - .github/changelog/fix-http-transport-error | 4 - .github/changelog/fix-inbox-hidden-recipients | 4 - .github/changelog/fix-inspector-corners | 4 - .github/changelog/fix-late-option-reads | 4 - .github/changelog/fix-legacy-post-withdrawal | 4 - .github/changelog/fix-litespeed-vary | 4 - .github/changelog/fix-local-inbox-route | 4 - .../fix-mastodon-app-mention-federation | 4 - .github/changelog/fix-mathml-annotation-xml | 4 - .../changelog/fix-move-canonical-target-id | 4 - .github/changelog/fix-oauth-client-hardening | 4 - .github/changelog/fix-oauth-scope-read-paths | 4 - .github/changelog/fix-object-uri-resolution | 4 - .github/changelog/fix-off-site-enclosures | 4 - .github/changelog/fix-outbox-item-gmt-date | 4 - .github/changelog/fix-outbox-reply-to-remote | 4 - .github/changelog/fix-outbox-title-error | 4 - .github/changelog/fix-outbox-unreadable-row | 4 - .../changelog/fix-outbox-write-capabilities | 4 - .github/changelog/fix-photon-snippet-args | 4 - .github/changelog/fix-php-85-deprecations | 4 - .github/changelog/fix-post-icon-duplication | 4 - .../changelog/fix-powered-by-default-field | 4 - .github/changelog/fix-quote-request-ownership | 4 - .../changelog/fix-reactions-editor-request | 4 - .github/changelog/fix-reader-comments-feed | 4 - .../fix-remote-actor-summary-escaping | 4 - .../changelog/fix-remote-attachment-parsing | 4 - .github/changelog/fix-render-as-visitor | 4 - .github/changelog/fix-reply-mention-duplicate | 4 - .github/changelog/fix-request-recipient | 4 - .github/changelog/fix-rfc9421-original-host | 4 - .../changelog/fix-search-import-moderation | 4 - .github/changelog/fix-signature-bare-host | 4 - .github/changelog/fix-signature-host | 4 - .github/changelog/fix-signature-key-authority | 4 - .github/changelog/fix-site-url-checks | 4 - .../fix-strip-spans-in-federated-comments | 4 - .github/changelog/fix-summary-filters | 4 - .github/changelog/fix-summary-more-tag | 4 - .../fix-unfederated-term-negotiation | 4 - .github/changelog/fix-webfinger-handle-host | 4 - .github/changelog/harden-imported-content | 4 - .../keep-comment-flood-protection-setting | 4 - ...mit-delete-verification-exception-to-inbox | 4 - .../oauth-authorize-requires-activitypub | 4 - .../changelog/reactions-action-placeholder | 4 - .github/changelog/reactions-block-spacing | 4 - .github/changelog/reactions-button-font | 4 - .github/changelog/reactions-counts-link-color | 4 - ...tore-akismet-nonce-after-federated-comment | 4 - .../update-deprecate-content-apply-filters | 4 - CHANGELOG.md | 104 ++++++++++++++++ activitypub.php | 4 +- build/extra-fields/block.json | 2 +- build/follow-me/block.json | 2 +- build/followers/block.json | 2 +- build/following/block.json | 2 +- build/posts-and-replies/block.json | 2 +- build/quote/block.json | 2 +- build/reactions/block.json | 2 +- build/remote-reply/block.json | 2 +- build/reply/block.json | 2 +- build/stats/block.json | 2 +- includes/activity/class-base-object.php | 2 +- includes/activity/class-generic-object.php | 2 +- includes/cache/class-comment-media.php | 2 +- includes/cache/class-file.php | 2 +- includes/cache/class-media.php | 12 +- includes/class-blocks.php | 14 +-- includes/class-comment.php | 2 +- includes/class-http.php | 6 +- includes/class-mention.php | 2 +- includes/class-migration.php | 4 +- includes/class-proxy.php | 8 +- includes/class-sanitize.php | 2 +- includes/class-shortcodes.php | 2 +- includes/class-webfinger.php | 2 +- includes/collection/class-interactions.php | 16 +-- includes/collection/class-posts.php | 2 +- includes/collection/class-remote-actors.php | 8 +- includes/functions-post.php | 10 +- includes/functions-url.php | 8 +- includes/functions.php | 2 +- includes/handler/class-accept.php | 2 +- includes/handler/class-delete.php | 4 +- includes/handler/class-reject.php | 4 +- includes/oauth/class-client.php | 2 +- .../rest/class-actors-inbox-controller.php | 2 +- includes/rest/class-followers-controller.php | 2 +- includes/rest/class-following-controller.php | 2 +- .../rest/class-interaction-controller.php | 4 +- includes/rest/class-liked-controller.php | 2 +- includes/rest/class-outbox-controller.php | 2 +- includes/rest/class-seek-controller.php | 6 +- includes/rest/trait-collection.php | 8 +- includes/rest/trait-rate-limit.php | 6 +- includes/rest/trait-verification.php | 2 +- includes/scheduler/class-comment.php | 2 +- includes/scheduler/class-post.php | 2 +- includes/scheduler/class-quote-request.php | 8 +- includes/transformer/class-base.php | 2 +- includes/transformer/class-post.php | 12 +- includes/wp-admin/class-admin.php | 2 +- readme.txt | 113 ++++++++++++++++-- .../disable-wp-rest-api.php | 2 +- src/extra-fields/block.json | 2 +- src/follow-me/block.json | 2 +- src/followers/block.json | 2 +- src/following/block.json | 2 +- src/posts-and-replies/block.json | 2 +- src/quote/block.json | 2 +- src/reactions/block.json | 2 +- src/remote-reply/block.json | 2 +- src/reply/block.json | 2 +- src/stats/block.json | 2 +- 156 files changed, 325 insertions(+), 490 deletions(-) delete mode 100644 .github/changelog/3529-avatar-email-max-width delete mode 100644 .github/changelog/actor-list-theme-colors delete mode 100644 .github/changelog/add-allowed-comment-types-filter delete mode 100644 .github/changelog/add-enable-mastodon-apps-status-language delete mode 100644 .github/changelog/add-feed-date-filter delete mode 100644 .github/changelog/add-idn-webfinger delete mode 100644 .github/changelog/add-interactions-rate-limit delete mode 100644 .github/changelog/add-miscellany-context delete mode 100644 .github/changelog/add-oauth-authorize-switch-user delete mode 100644 .github/changelog/add-polylang-integration delete mode 100644 .github/changelog/add-proxy-cache-layer delete mode 100644 .github/changelog/add-quote-block delete mode 100644 .github/changelog/add-quote-source-link delete mode 100644 .github/changelog/add-reactions-counts-style delete mode 100644 .github/changelog/add-seek-item-endpoint delete mode 100644 .github/changelog/admin-page-title delete mode 100644 .github/changelog/anchor-oauth-metadata-rewrite delete mode 100644 .github/changelog/block-user-options delete mode 100644 .github/changelog/cache-duplicate-cleanup delete mode 100644 .github/changelog/feature-blog-profile-name-avatar delete mode 100644 .github/changelog/fix-3579-auto-approved-comments delete mode 100644 .github/changelog/fix-3868-underscore-hashtags delete mode 100644 .github/changelog/fix-account-move-verification delete mode 100644 .github/changelog/fix-activity-date-fallback delete mode 100644 .github/changelog/fix-attachment-id-sanitize delete mode 100644 .github/changelog/fix-blocked-actor-relationship-removal delete mode 100644 .github/changelog/fix-collection-link-query-args delete mode 100644 .github/changelog/fix-comment-images delete mode 100644 .github/changelog/fix-comment-permalink-page delete mode 100644 .github/changelog/fix-comment-query-type-coexistence delete mode 100644 .github/changelog/fix-draft-signature-port delete mode 100644 .github/changelog/fix-duplicate-cached-avatars delete mode 100644 .github/changelog/fix-duplicate-inbox-notifications delete mode 100644 .github/changelog/fix-duplicate-snackbar delete mode 100644 .github/changelog/fix-ema-local-statuses-count delete mode 100644 .github/changelog/fix-emoji-in-blog-identifier delete mode 100644 .github/changelog/fix-feature-request-ownership delete mode 100644 .github/changelog/fix-featured-password delete mode 100644 .github/changelog/fix-follow-target delete mode 100644 .github/changelog/fix-guid-lookup-special-characters delete mode 100644 .github/changelog/fix-http-transport-error delete mode 100644 .github/changelog/fix-inbox-hidden-recipients delete mode 100644 .github/changelog/fix-inspector-corners delete mode 100644 .github/changelog/fix-late-option-reads delete mode 100644 .github/changelog/fix-legacy-post-withdrawal delete mode 100644 .github/changelog/fix-litespeed-vary delete mode 100644 .github/changelog/fix-local-inbox-route delete mode 100644 .github/changelog/fix-mastodon-app-mention-federation delete mode 100644 .github/changelog/fix-mathml-annotation-xml delete mode 100644 .github/changelog/fix-move-canonical-target-id delete mode 100644 .github/changelog/fix-oauth-client-hardening delete mode 100644 .github/changelog/fix-oauth-scope-read-paths delete mode 100644 .github/changelog/fix-object-uri-resolution delete mode 100644 .github/changelog/fix-off-site-enclosures delete mode 100644 .github/changelog/fix-outbox-item-gmt-date delete mode 100644 .github/changelog/fix-outbox-reply-to-remote delete mode 100644 .github/changelog/fix-outbox-title-error delete mode 100644 .github/changelog/fix-outbox-unreadable-row delete mode 100644 .github/changelog/fix-outbox-write-capabilities delete mode 100644 .github/changelog/fix-photon-snippet-args delete mode 100644 .github/changelog/fix-php-85-deprecations delete mode 100644 .github/changelog/fix-post-icon-duplication delete mode 100644 .github/changelog/fix-powered-by-default-field delete mode 100644 .github/changelog/fix-quote-request-ownership delete mode 100644 .github/changelog/fix-reactions-editor-request delete mode 100644 .github/changelog/fix-reader-comments-feed delete mode 100644 .github/changelog/fix-remote-actor-summary-escaping delete mode 100644 .github/changelog/fix-remote-attachment-parsing delete mode 100644 .github/changelog/fix-render-as-visitor delete mode 100644 .github/changelog/fix-reply-mention-duplicate delete mode 100644 .github/changelog/fix-request-recipient delete mode 100644 .github/changelog/fix-rfc9421-original-host delete mode 100644 .github/changelog/fix-search-import-moderation delete mode 100644 .github/changelog/fix-signature-bare-host delete mode 100644 .github/changelog/fix-signature-host delete mode 100644 .github/changelog/fix-signature-key-authority delete mode 100644 .github/changelog/fix-site-url-checks delete mode 100644 .github/changelog/fix-strip-spans-in-federated-comments delete mode 100644 .github/changelog/fix-summary-filters delete mode 100644 .github/changelog/fix-summary-more-tag delete mode 100644 .github/changelog/fix-unfederated-term-negotiation delete mode 100644 .github/changelog/fix-webfinger-handle-host delete mode 100644 .github/changelog/harden-imported-content delete mode 100644 .github/changelog/keep-comment-flood-protection-setting delete mode 100644 .github/changelog/limit-delete-verification-exception-to-inbox delete mode 100644 .github/changelog/oauth-authorize-requires-activitypub delete mode 100644 .github/changelog/reactions-action-placeholder delete mode 100644 .github/changelog/reactions-block-spacing delete mode 100644 .github/changelog/reactions-button-font delete mode 100644 .github/changelog/reactions-counts-link-color delete mode 100644 .github/changelog/restore-akismet-nonce-after-federated-comment delete mode 100644 .github/changelog/update-deprecate-content-apply-filters diff --git a/.github/changelog/3529-avatar-email-max-width b/.github/changelog/3529-avatar-email-max-width deleted file mode 100644 index 34f9202392..0000000000 --- a/.github/changelog/3529-avatar-email-max-width +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed oversized images in email notifications from remote users. Avatars and inline post images now resize to fit the email width instead of overflowing the screen. diff --git a/.github/changelog/actor-list-theme-colors b/.github/changelog/actor-list-theme-colors deleted file mode 100644 index d93d4472cb..0000000000 --- a/.github/changelog/actor-list-theme-colors +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -The Followers and Following blocks now take their colours and font from the theme, so they are readable on dark themes, and they offer the usual colour, font size and spacing controls in the editor. diff --git a/.github/changelog/add-allowed-comment-types-filter b/.github/changelog/add-allowed-comment-types-filter deleted file mode 100644 index cda187ada8..0000000000 --- a/.github/changelog/add-allowed-comment-types-filter +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Added a filter that lets plugins decide which comment types are shared with the Fediverse, so custom comment types can be kept local or sent out as replies. diff --git a/.github/changelog/add-enable-mastodon-apps-status-language b/.github/changelog/add-enable-mastodon-apps-status-language deleted file mode 100644 index da619cc1a9..0000000000 --- a/.github/changelog/add-enable-mastodon-apps-status-language +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Posts published from a Mastodon app are now federated with the language the app set, and on sites using Polylang or WPML that language is stored with the multilingual plugin. diff --git a/.github/changelog/add-feed-date-filter b/.github/changelog/add-feed-date-filter deleted file mode 100644 index dfa9c1bb8c..0000000000 --- a/.github/changelog/add-feed-date-filter +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -The Social Web feed can be filtered by date, to show only posts from before or after a day you pick. diff --git a/.github/changelog/add-idn-webfinger b/.github/changelog/add-idn-webfinger deleted file mode 100644 index 5649785596..0000000000 --- a/.github/changelog/add-idn-webfinger +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Support handles with non-Latin characters and domains with special characters, like @renée@café.example, in mentions, search and profile lookups. diff --git a/.github/changelog/add-interactions-rate-limit b/.github/changelog/add-interactions-rate-limit deleted file mode 100644 index a843b3fd23..0000000000 --- a/.github/changelog/add-interactions-rate-limit +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: changed - -Endpoints that other sites and apps call now answer a limited number of requests per minute from the same caller, and say so in the `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` response headers. diff --git a/.github/changelog/add-miscellany-context b/.github/changelog/add-miscellany-context deleted file mode 100644 index e304b07ed5..0000000000 --- a/.github/changelog/add-miscellany-context +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: added - -Profiles and posts now point at the shared Fediverse definitions for content warnings, hashtags, manual follower approval and account moves. diff --git a/.github/changelog/add-oauth-authorize-switch-user b/.github/changelog/add-oauth-authorize-switch-user deleted file mode 100644 index 5f6646b6bc..0000000000 --- a/.github/changelog/add-oauth-authorize-switch-user +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -You can now log in as a different WordPress user while authorizing an ActivityPub app without losing the authorization request. diff --git a/.github/changelog/add-polylang-integration b/.github/changelog/add-polylang-integration deleted file mode 100644 index 7b3c597d9a..0000000000 --- a/.github/changelog/add-polylang-integration +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Posts and comments on sites using Polylang are now federated with the language Polylang assigned to them. diff --git a/.github/changelog/add-proxy-cache-layer b/.github/changelog/add-proxy-cache-layer deleted file mode 100644 index a3d83aa8e5..0000000000 --- a/.github/changelog/add-proxy-cache-layer +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: changed - -Posts and profiles fetched from other servers are now cached through the WordPress object cache when the site has one. Updates and confirmed deletions clear the cached copy. diff --git a/.github/changelog/add-quote-block b/.github/changelog/add-quote-block deleted file mode 100644 index 17981f5aa8..0000000000 --- a/.github/changelog/add-quote-block +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Added a Federated Quote block to quote posts from the Fediverse. The author of the quoted post is asked for permission, and the quote is marked as verified once they agree. diff --git a/.github/changelog/add-quote-source-link b/.github/changelog/add-quote-source-link deleted file mode 100644 index 809c6ee18c..0000000000 --- a/.github/changelog/add-quote-source-link +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Added a Source column to the Comments screen that links incoming replies and quote posts to the post they came from. diff --git a/.github/changelog/add-reactions-counts-style b/.github/changelog/add-reactions-counts-style deleted file mode 100644 index eab1da6136..0000000000 --- a/.github/changelog/add-reactions-counts-style +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Add a Counts style to the Fediverse Reactions block that shows comments and reactions as a line of simple links, for example to replace the comments link in a query loop. diff --git a/.github/changelog/add-seek-item-endpoint b/.github/changelog/add-seek-item-endpoint deleted file mode 100644 index e0b6bce301..0000000000 --- a/.github/changelog/add-seek-item-endpoint +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Fediverse apps can now jump directly to the page of a collection that contains a specific item, instead of paging through from the start. diff --git a/.github/changelog/admin-page-title b/.github/changelog/admin-page-title deleted file mode 100644 index 51cf108605..0000000000 --- a/.github/changelog/admin-page-title +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -The browser tab title of the settings page now shows the name of the current tab. diff --git a/.github/changelog/anchor-oauth-metadata-rewrite b/.github/changelog/anchor-oauth-metadata-rewrite deleted file mode 100644 index 6f541e5850..0000000000 --- a/.github/changelog/anchor-oauth-metadata-rewrite +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed the plugin answering WebFinger, NodeInfo and OAuth server discovery requests meant for other plugins, such as IndieAuth. diff --git a/.github/changelog/block-user-options b/.github/changelog/block-user-options deleted file mode 100644 index c74766e1d5..0000000000 --- a/.github/changelog/block-user-options +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed the user selection in the Follow Me and other ActivityPub blocks disappearing when the site has a user you are not allowed to edit. diff --git a/.github/changelog/cache-duplicate-cleanup b/.github/changelog/cache-duplicate-cleanup deleted file mode 100644 index 3557b64c8a..0000000000 --- a/.github/changelog/cache-duplicate-cleanup +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Duplicate copies of cached profile pictures and images that earlier versions left behind are removed on update, and `wp activitypub cache cleanup` removes them on demand. diff --git a/.github/changelog/feature-blog-profile-name-avatar b/.github/changelog/feature-blog-profile-name-avatar deleted file mode 100644 index d1251e3af2..0000000000 --- a/.github/changelog/feature-blog-profile-name-avatar +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Added a custom name and avatar for the blog profile. Your Fediverse blog account can now use its own display name and profile picture, independent of the WordPress site title and site icon. diff --git a/.github/changelog/fix-3579-auto-approved-comments b/.github/changelog/fix-3579-auto-approved-comments deleted file mode 100644 index fda27db2fe..0000000000 --- a/.github/changelog/fix-3579-auto-approved-comments +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed normal replies from distant accounts sometimes being auto-approved just because that account had previously liked or reposted a post. diff --git a/.github/changelog/fix-3868-underscore-hashtags b/.github/changelog/fix-3868-underscore-hashtags deleted file mode 100644 index 240bdd1971..0000000000 --- a/.github/changelog/fix-3868-underscore-hashtags +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Tags with underscores, like veranda_vestli, now keep their underscores when shared to the fediverse instead of being changed to camelCase. diff --git a/.github/changelog/fix-account-move-verification b/.github/changelog/fix-account-move-verification deleted file mode 100644 index dd9955c119..0000000000 --- a/.github/changelog/fix-account-move-verification +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fix Fediverse account migration so a move is verified before it takes effect and reliably reaches your followers on other servers. diff --git a/.github/changelog/fix-activity-date-fallback b/.github/changelog/fix-activity-date-fallback deleted file mode 100644 index fd17431686..0000000000 --- a/.github/changelog/fix-activity-date-fallback +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Activities read through the ActivityPub API now fall back to the date your site recorded when the activity itself carries none, so client apps show consistent timestamps. diff --git a/.github/changelog/fix-attachment-id-sanitize b/.github/changelog/fix-attachment-id-sanitize deleted file mode 100644 index e666dd4bdd..0000000000 --- a/.github/changelog/fix-attachment-id-sanitize +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Only image attachments are accepted for the blog avatar and the header images. diff --git a/.github/changelog/fix-blocked-actor-relationship-removal b/.github/changelog/fix-blocked-actor-relationship-removal deleted file mode 100644 index 7171fdc02a..0000000000 --- a/.github/changelog/fix-blocked-actor-relationship-removal +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Blocking a remote account now removes it from your followers and following lists, whichever form of its address you used. diff --git a/.github/changelog/fix-collection-link-query-args b/.github/changelog/fix-collection-link-query-args deleted file mode 100644 index d5bd0b5e74..0000000000 --- a/.github/changelog/fix-collection-link-query-args +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Links to the pages of a collection no longer pass on unknown query arguments, which could point them at the wrong address. diff --git a/.github/changelog/fix-comment-images b/.github/changelog/fix-comment-images deleted file mode 100644 index 7dbae3f081..0000000000 --- a/.github/changelog/fix-comment-images +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -Add an option to show images attached to Fediverse replies in comments, with local caching and image descriptions. diff --git a/.github/changelog/fix-comment-permalink-page b/.github/changelog/fix-comment-permalink-page deleted file mode 100644 index 2b8b4214c6..0000000000 --- a/.github/changelog/fix-comment-permalink-page +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Links to a comment now open the page it is actually on, instead of a later page, on posts with many likes or reposts. diff --git a/.github/changelog/fix-comment-query-type-coexistence b/.github/changelog/fix-comment-query-type-coexistence deleted file mode 100644 index 8c096f88b1..0000000000 --- a/.github/changelog/fix-comment-query-type-coexistence +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Stop ActivityPub Likes, Reposts, and Quotes from leaking into the front-end comment list on sites that also use other comment-filtering plugins. diff --git a/.github/changelog/fix-draft-signature-port b/.github/changelog/fix-draft-signature-port deleted file mode 100644 index 8c0f3c341d..0000000000 --- a/.github/changelog/fix-draft-signature-port +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed requests to servers on a non-standard port being rejected because their signature did not include the port. diff --git a/.github/changelog/fix-duplicate-cached-avatars b/.github/changelog/fix-duplicate-cached-avatars deleted file mode 100644 index 9dcffea6b1..0000000000 --- a/.github/changelog/fix-duplicate-cached-avatars +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed profile pictures being downloaded again on every page view, leaving a copy behind each time and filling up the uploads folder. diff --git a/.github/changelog/fix-duplicate-inbox-notifications b/.github/changelog/fix-duplicate-inbox-notifications deleted file mode 100644 index 34e63667fa..0000000000 --- a/.github/changelog/fix-duplicate-inbox-notifications +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fewer duplicate email notifications when another server delivers the same message more than once, and a reply that mentions you no longer also sends a separate mention email. diff --git a/.github/changelog/fix-duplicate-snackbar b/.github/changelog/fix-duplicate-snackbar deleted file mode 100644 index dd135ddee2..0000000000 --- a/.github/changelog/fix-duplicate-snackbar +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Notifications in the Social Web screen no longer show up twice. diff --git a/.github/changelog/fix-ema-local-statuses-count b/.github/changelog/fix-ema-local-statuses-count deleted file mode 100644 index af4df72fa3..0000000000 --- a/.github/changelog/fix-ema-local-statuses-count +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fix local account post counts in Mastodon apps when using Enable Mastodon Apps. diff --git a/.github/changelog/fix-emoji-in-blog-identifier b/.github/changelog/fix-emoji-in-blog-identifier deleted file mode 100644 index a6d8fd7386..0000000000 --- a/.github/changelog/fix-emoji-in-blog-identifier +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Emoji in the blog profile ID are now dropped instead of being turned into a string of codes that other servers could not resolve. diff --git a/.github/changelog/fix-feature-request-ownership b/.github/changelog/fix-feature-request-ownership deleted file mode 100644 index e1dbc3bb26..0000000000 --- a/.github/changelog/fix-feature-request-ownership +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Feature requests are now only approved for collections that belong to the account asking. diff --git a/.github/changelog/fix-featured-password b/.github/changelog/fix-featured-password deleted file mode 100644 index 76c2e91129..0000000000 --- a/.github/changelog/fix-featured-password +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Password-protected sticky posts are no longer listed in your featured posts on the Fediverse. diff --git a/.github/changelog/fix-follow-target b/.github/changelog/fix-follow-target deleted file mode 100644 index 04fcbf04ba..0000000000 --- a/.github/changelog/fix-follow-target +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Follow requests are now only accepted when they are meant for the account that received them, and profile links on other sites no longer count as accounts on your site. diff --git a/.github/changelog/fix-guid-lookup-special-characters b/.github/changelog/fix-guid-lookup-special-characters deleted file mode 100644 index 1ad7f728ec..0000000000 --- a/.github/changelog/fix-guid-lookup-special-characters +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed followers, remote profiles and received activities not being found again when their address contains an ampersand, including on WordPress 7.2. diff --git a/.github/changelog/fix-http-transport-error b/.github/changelog/fix-http-transport-error deleted file mode 100644 index f5c4066635..0000000000 --- a/.github/changelog/fix-http-transport-error +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Connection problems with other servers now explain what went wrong instead of failing without a reason. diff --git a/.github/changelog/fix-inbox-hidden-recipients b/.github/changelog/fix-inbox-hidden-recipients deleted file mode 100644 index 19c9a44bc6..0000000000 --- a/.github/changelog/fix-inbox-hidden-recipients +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Hidden recipients of a received activity are no longer included when an app reads or streams your inbox. diff --git a/.github/changelog/fix-inspector-corners b/.github/changelog/fix-inspector-corners deleted file mode 100644 index 0b8888f592..0000000000 --- a/.github/changelog/fix-inspector-corners +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Opening a post in the Social Web screen no longer distorts the panel corners or folds the list. diff --git a/.github/changelog/fix-late-option-reads b/.github/changelog/fix-late-option-reads deleted file mode 100644 index 36152d3135..0000000000 --- a/.github/changelog/fix-late-option-reads +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed the ActivityPub API, relay mode, and OpenGraph metadata silently staying off on some multisite hosts that select the site after plugins have loaded. diff --git a/.github/changelog/fix-legacy-post-withdrawal b/.github/changelog/fix-legacy-post-withdrawal deleted file mode 100644 index 8b34dadca7..0000000000 --- a/.github/changelog/fix-legacy-post-withdrawal +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Improve handling of post URLs when changing publication status. diff --git a/.github/changelog/fix-litespeed-vary b/.github/changelog/fix-litespeed-vary deleted file mode 100644 index d850c324e0..0000000000 --- a/.github/changelog/fix-litespeed-vary +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed LiteSpeed Cache possibly showing visitors the technical ActivityPub version of a page instead of the normal page. diff --git a/.github/changelog/fix-local-inbox-route b/.github/changelog/fix-local-inbox-route deleted file mode 100644 index 37e2a89825..0000000000 --- a/.github/changelog/fix-local-inbox-route +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Activities delivered to accounts on the same site now only reach ActivityPub inboxes. diff --git a/.github/changelog/fix-mastodon-app-mention-federation b/.github/changelog/fix-mastodon-app-mention-federation deleted file mode 100644 index 5c0a14d4a6..0000000000 --- a/.github/changelog/fix-mastodon-app-mention-federation +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -People mentioned in a post written from a Mastodon app are notified about it again. diff --git a/.github/changelog/fix-mathml-annotation-xml b/.github/changelog/fix-mathml-annotation-xml deleted file mode 100644 index f0b1261baf..0000000000 --- a/.github/changelog/fix-mathml-annotation-xml +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed math formulas, and everything after them, disappearing from posts on WordPress 7.2 when the formula includes an HTML annotation. diff --git a/.github/changelog/fix-move-canonical-target-id b/.github/changelog/fix-move-canonical-target-id deleted file mode 100644 index 152837877b..0000000000 --- a/.github/changelog/fix-move-canonical-target-id +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fix Fediverse account migration being ignored by some servers when the new account is entered using an alternate address. diff --git a/.github/changelog/fix-oauth-client-hardening b/.github/changelog/fix-oauth-client-hardening deleted file mode 100644 index 0aea59584b..0000000000 --- a/.github/changelog/fix-oauth-client-hardening +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Tightened the checks on the screen where you approve apps for your account. diff --git a/.github/changelog/fix-oauth-scope-read-paths b/.github/changelog/fix-oauth-scope-read-paths deleted file mode 100644 index 00d851fe0a..0000000000 --- a/.github/changelog/fix-oauth-scope-read-paths +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Apps connected to your account now only see what you granted them access to. diff --git a/.github/changelog/fix-object-uri-resolution b/.github/changelog/fix-object-uri-resolution deleted file mode 100644 index f354466f3e..0000000000 --- a/.github/changelog/fix-object-uri-resolution +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Handle incomplete Fediverse object references without errors. diff --git a/.github/changelog/fix-off-site-enclosures b/.github/changelog/fix-off-site-enclosures deleted file mode 100644 index 00d7ed750a..0000000000 --- a/.github/changelog/fix-off-site-enclosures +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Podcast episodes and other attached files hosted outside your media library are now included when a post is sent to the Fediverse. diff --git a/.github/changelog/fix-outbox-item-gmt-date b/.github/changelog/fix-outbox-item-gmt-date deleted file mode 100644 index 5a5a2f1ee0..0000000000 --- a/.github/changelog/fix-outbox-item-gmt-date +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Queued activities now record their publication and edit times correctly on sites that are not set to UTC. diff --git a/.github/changelog/fix-outbox-reply-to-remote b/.github/changelog/fix-outbox-reply-to-remote deleted file mode 100644 index 9d89d93a44..0000000000 --- a/.github/changelog/fix-outbox-reply-to-remote +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Replies sent through the ActivityPub API to posts on other servers are now delivered instead of being rejected. diff --git a/.github/changelog/fix-outbox-title-error b/.github/changelog/fix-outbox-title-error deleted file mode 100644 index f1c5a0e3f0..0000000000 --- a/.github/changelog/fix-outbox-title-error +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed a possible error when preparing an activity in the outbox whose object is not a full object. diff --git a/.github/changelog/fix-outbox-unreadable-row b/.github/changelog/fix-outbox-unreadable-row deleted file mode 100644 index 9491fd444a..0000000000 --- a/.github/changelog/fix-outbox-unreadable-row +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -A queued activity that cannot be read no longer stops the ones queued behind it from being sent. diff --git a/.github/changelog/fix-outbox-write-capabilities b/.github/changelog/fix-outbox-write-capabilities deleted file mode 100644 index 569a1a7b5c..0000000000 --- a/.github/changelog/fix-outbox-write-capabilities +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Apps that post on behalf of the blog can now only change or delete content that the connected user is allowed to change or delete. diff --git a/.github/changelog/fix-photon-snippet-args b/.github/changelog/fix-photon-snippet-args deleted file mode 100644 index 4e0cfbff1b..0000000000 --- a/.github/changelog/fix-photon-snippet-args +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed a fatal error on sites using the Photon snippet, which now also serves images in Fediverse replies through the CDN. diff --git a/.github/changelog/fix-php-85-deprecations b/.github/changelog/fix-php-85-deprecations deleted file mode 100644 index d1896f7656..0000000000 --- a/.github/changelog/fix-php-85-deprecations +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed deprecation notices on PHP 8.5. diff --git a/.github/changelog/fix-post-icon-duplication b/.github/changelog/fix-post-icon-duplication deleted file mode 100644 index 7638385c50..0000000000 --- a/.github/changelog/fix-post-icon-duplication +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Posts no longer send a second, smaller copy of the featured image, or the site icon when there is no featured image, which some apps showed as an extra image under the post. diff --git a/.github/changelog/fix-powered-by-default-field b/.github/changelog/fix-powered-by-default-field deleted file mode 100644 index 4458ce91cf..0000000000 --- a/.github/changelog/fix-powered-by-default-field +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -The "Powered by WordPress" profile field no longer shows up twice, no longer comes back after you delete it, and no longer triggers a warning when the plugin is first activated. diff --git a/.github/changelog/fix-quote-request-ownership b/.github/changelog/fix-quote-request-ownership deleted file mode 100644 index 513f472a51..0000000000 --- a/.github/changelog/fix-quote-request-ownership +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Quote requests are now only approved for posts that belong to the account asking. diff --git a/.github/changelog/fix-reactions-editor-request b/.github/changelog/fix-reactions-editor-request deleted file mode 100644 index 6498631917..0000000000 --- a/.github/changelog/fix-reactions-editor-request +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -The Reactions block no longer requests reactions in the editor for drafts, pages, and other content that is not shared to the Fediverse, which caused failed requests on every editor load. diff --git a/.github/changelog/fix-reader-comments-feed b/.github/changelog/fix-reader-comments-feed deleted file mode 100644 index a35ab08731..0000000000 --- a/.github/changelog/fix-reader-comments-feed +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Replies to posts from accounts you follow no longer show up in your comments feed and comment widgets. diff --git a/.github/changelog/fix-remote-actor-summary-escaping b/.github/changelog/fix-remote-actor-summary-escaping deleted file mode 100644 index abd439b910..0000000000 --- a/.github/changelog/fix-remote-actor-summary-escaping +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Descriptions of remote accounts with quotes or links in them are no longer saved with stray backslashes. diff --git a/.github/changelog/fix-remote-attachment-parsing b/.github/changelog/fix-remote-attachment-parsing deleted file mode 100644 index 703fcd8e66..0000000000 --- a/.github/changelog/fix-remote-attachment-parsing +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Skip unusable attachments on posts from other servers instead of showing them as broken images. diff --git a/.github/changelog/fix-render-as-visitor b/.github/changelog/fix-render-as-visitor deleted file mode 100644 index 4c22010790..0000000000 --- a/.github/changelog/fix-render-as-visitor +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Federated posts and comments now always show what a logged-out visitor sees, not the version shown to the logged-in author. diff --git a/.github/changelog/fix-reply-mention-duplicate b/.github/changelog/fix-reply-mention-duplicate deleted file mode 100644 index 425c4a889c..0000000000 --- a/.github/changelog/fix-reply-mention-duplicate +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Replies written through an ActivityPub app no longer mention the person you are replying to twice. diff --git a/.github/changelog/fix-request-recipient b/.github/changelog/fix-request-recipient deleted file mode 100644 index 811aeb88da..0000000000 --- a/.github/changelog/fix-request-recipient +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Quote and feature requests are now only answered when they were sent to the account they ask. diff --git a/.github/changelog/fix-rfc9421-original-host b/.github/changelog/fix-rfc9421-original-host deleted file mode 100644 index 005863d93a..0000000000 --- a/.github/changelog/fix-rfc9421-original-host +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed signed requests from other servers being rejected on sites behind a proxy that changes the host name. diff --git a/.github/changelog/fix-search-import-moderation b/.github/changelog/fix-search-import-moderation deleted file mode 100644 index 01b81f4cbb..0000000000 --- a/.github/changelog/fix-search-import-moderation +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Replies found by searching for their address now follow your comment moderation settings instead of being approved right away. diff --git a/.github/changelog/fix-signature-bare-host b/.github/changelog/fix-signature-bare-host deleted file mode 100644 index 3bf4afa0ec..0000000000 --- a/.github/changelog/fix-signature-bare-host +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Signed requests from other servers are now checked more strictly, and requests that are not meant for your site are rejected before the sender's key is fetched. diff --git a/.github/changelog/fix-signature-host b/.github/changelog/fix-signature-host deleted file mode 100644 index 6c90a707de..0000000000 --- a/.github/changelog/fix-signature-host +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Signed requests from other servers are now only accepted when they are addressed to your site's address. Sites reached under more than one domain can allow the others with the `activitypub_signature_original_hosts` filter. diff --git a/.github/changelog/fix-signature-key-authority b/.github/changelog/fix-signature-key-authority deleted file mode 100644 index dfd748983f..0000000000 --- a/.github/changelog/fix-signature-key-authority +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: security - -Improve verification of signing keys fetched from other servers. diff --git a/.github/changelog/fix-site-url-checks b/.github/changelog/fix-site-url-checks deleted file mode 100644 index 01c4cbb546..0000000000 --- a/.github/changelog/fix-site-url-checks +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Incoming requests and account lookups now only match the site address, not the WordPress address. diff --git a/.github/changelog/fix-strip-spans-in-federated-comments b/.github/changelog/fix-strip-spans-in-federated-comments deleted file mode 100644 index 46101aee43..0000000000 --- a/.github/changelog/fix-strip-spans-in-federated-comments +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Links in replies received from the Fediverse now display correctly on WordPress 7.1. diff --git a/.github/changelog/fix-summary-filters b/.github/changelog/fix-summary-filters deleted file mode 100644 index 9448091c2e..0000000000 --- a/.github/changelog/fix-summary-filters +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Post summaries now respect plugins that change or hide parts of the post content. diff --git a/.github/changelog/fix-summary-more-tag b/.github/changelog/fix-summary-more-tag deleted file mode 100644 index cc26139919..0000000000 --- a/.github/changelog/fix-summary-more-tag +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Post summaries now stop at the "Read more" tag everywhere and keep the title of Details blocks. diff --git a/.github/changelog/fix-unfederated-term-negotiation b/.github/changelog/fix-unfederated-term-negotiation deleted file mode 100644 index d22be172d9..0000000000 --- a/.github/changelog/fix-unfederated-term-negotiation +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed the search page and the posts page redirecting to a category or tag, or being served as one, on sites that filter content by language, such as Polylang. diff --git a/.github/changelog/fix-webfinger-handle-host b/.github/changelog/fix-webfinger-handle-host deleted file mode 100644 index 4ae5fbcd9c..0000000000 --- a/.github/changelog/fix-webfinger-handle-host +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Domain blocks now also apply to handles that have a path after the domain, like @user@example.com/x. diff --git a/.github/changelog/harden-imported-content b/.github/changelog/harden-imported-content deleted file mode 100644 index ab6940d1bc..0000000000 --- a/.github/changelog/harden-imported-content +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: security - -Improve the safety of imported Fediverse posts and comments. diff --git a/.github/changelog/keep-comment-flood-protection-setting b/.github/changelog/keep-comment-flood-protection-setting deleted file mode 100644 index 6da342bcb2..0000000000 --- a/.github/changelog/keep-comment-flood-protection-setting +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Sites that turned off comment flood protection no longer get it switched back on by an incoming comment from the Fediverse. diff --git a/.github/changelog/limit-delete-verification-exception-to-inbox b/.github/changelog/limit-delete-verification-exception-to-inbox deleted file mode 100644 index 7079b48e8c..0000000000 --- a/.github/changelog/limit-delete-verification-exception-to-inbox +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Ensure that only account deletions delivered to your site can skip the usual sender verification. diff --git a/.github/changelog/oauth-authorize-requires-activitypub b/.github/changelog/oauth-authorize-requires-activitypub deleted file mode 100644 index 3bf6131890..0000000000 --- a/.github/changelog/oauth-authorize-requires-activitypub +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: changed - -Only accounts that are enabled for ActivityPub can authorize apps to act for them. diff --git a/.github/changelog/reactions-action-placeholder b/.github/changelog/reactions-action-placeholder deleted file mode 100644 index 1358709553..0000000000 --- a/.github/changelog/reactions-action-placeholder +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: changed - -The Fediverse Reactions block now lines up its buttons with the same width and shows a lighter label for reactions you can't answer from the block. diff --git a/.github/changelog/reactions-block-spacing b/.github/changelog/reactions-block-spacing deleted file mode 100644 index d95d9e07cd..0000000000 --- a/.github/changelog/reactions-block-spacing +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -The Fediverse Reactions block now has margin and padding settings. diff --git a/.github/changelog/reactions-button-font b/.github/changelog/reactions-button-font deleted file mode 100644 index 52b8c74000..0000000000 --- a/.github/changelog/reactions-button-font +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Fixed the reaction buttons using the browser font instead of the theme font, which made them smaller than the placeholder for reactions without an action. diff --git a/.github/changelog/reactions-counts-link-color b/.github/changelog/reactions-counts-link-color deleted file mode 100644 index 1529e98203..0000000000 --- a/.github/changelog/reactions-counts-link-color +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: added - -The Counts style of the Fediverse Reactions block now uses your theme's link color, adds a link color setting, and underlines links on hover. diff --git a/.github/changelog/restore-akismet-nonce-after-federated-comment b/.github/changelog/restore-akismet-nonce-after-federated-comment deleted file mode 100644 index 7f82bd9851..0000000000 --- a/.github/changelog/restore-akismet-nonce-after-federated-comment +++ /dev/null @@ -1,4 +0,0 @@ -Significance: patch -Type: fixed - -Restore spam-protection checks for regular comments after a comment arrives from the fediverse. diff --git a/.github/changelog/update-deprecate-content-apply-filters b/.github/changelog/update-deprecate-content-apply-filters deleted file mode 100644 index a2d75876e7..0000000000 --- a/.github/changelog/update-deprecate-content-apply-filters +++ /dev/null @@ -1,4 +0,0 @@ -Significance: minor -Type: removed - -The option to turn off content filters in the post template was removed. Federated posts now always use the regular content filters. diff --git a/CHANGELOG.md b/CHANGELOG.md index 0d51491467..0e50c84642 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,109 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [9.4.0] - 2026-10-27 +### Security +- Improve the safety of imported Fediverse posts and comments. [#3865] +- Improve verification of signing keys fetched from other servers. [#3858] + +### Added +- Add a Counts style to the Fediverse Reactions block that shows comments and reactions as a line of simple links, for example to replace the comments link in a query loop. [#3917] +- Add an option to show images attached to Fediverse replies in comments, with local caching and image descriptions. [#3850] +- Added a custom name and avatar for the blog profile. Your Fediverse blog account can now use its own display name and profile picture, independent of the WordPress site title and site icon. [#3755] +- Added a Federated Quote block to quote posts from the Fediverse. The author of the quoted post is asked for permission, and the quote is marked as verified once they agree. [#3803] +- Added a filter that lets plugins decide which comment types are shared with the Fediverse, so custom comment types can be kept local or sent out as replies. [#3798] +- Added a Source column to the Comments screen that links incoming replies and quote posts to the post they came from. [#3754] +- Fediverse apps can now jump directly to the page of a collection that contains a specific item, instead of paging through from the start. [#3549] +- Posts and comments on sites using Polylang are now federated with the language Polylang assigned to them. [#3756] +- Posts published from a Mastodon app are now federated with the language the app set, and on sites using Polylang or WPML that language is stored with the multilingual plugin. [#3777] +- Profiles and posts now point at the shared Fediverse definitions for content warnings, hashtags, manual follower approval and account moves. [#3704] +- Support handles with non-Latin characters and domains with special characters, like @renée@café.example, in mentions, search and profile lookups. [#3882] +- The Counts style of the Fediverse Reactions block now uses your theme's link color, adds a link color setting, and underlines links on hover. [#3927] +- The Fediverse Reactions block now has margin and padding settings. [#3926] +- The Social Web feed can be filtered by date, to show only posts from before or after a day you pick. [#3840] +- You can now log in as a different WordPress user while authorizing an ActivityPub app without losing the authorization request. [#3799] + +### Changed +- Endpoints that other sites and apps call now answer a limited number of requests per minute from the same caller, and say so in the `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` response headers. [#3830] +- Only accounts that are enabled for ActivityPub can authorize apps to act for them. [#3830] +- Posts and profiles fetched from other servers are now cached through the WordPress object cache when the site has one. Updates and confirmed deletions clear the cached copy. [#3793] +- The Fediverse Reactions block now lines up its buttons with the same width and shows a lighter label for reactions you can't answer from the block. [#3935] + +### Removed +- The option to turn off content filters in the post template was removed. Federated posts now always use the regular content filters. [#3880] + +### Fixed +- Activities delivered to accounts on the same site now only reach ActivityPub inboxes. [#3968] +- Activities read through the ActivityPub API now fall back to the date your site recorded when the activity itself carries none, so client apps show consistent timestamps. [#3320] +- Apps connected to your account now only see what you granted them access to. [#3814] +- Apps that post on behalf of the blog can now only change or delete content that the connected user is allowed to change or delete. [#3815] +- A queued activity that cannot be read no longer stops the ones queued behind it from being sent. [#3320] +- Blocking a remote account now removes it from your followers and following lists, whichever form of its address you used. [#3527] +- Connection problems with other servers now explain what went wrong instead of failing without a reason. [#3808] +- Descriptions of remote accounts with quotes or links in them are no longer saved with stray backslashes. [#3812] +- Domain blocks now also apply to handles that have a path after the domain, like @user@example.com/x. [#3899] +- Duplicate copies of cached profile pictures and images that earlier versions left behind are removed on update, and `wp activitypub cache cleanup` removes them on demand. [#3838] +- Emoji in the blog profile ID are now dropped instead of being turned into a string of codes that other servers could not resolve. [#3731] +- Ensure that only account deletions delivered to your site can skip the usual sender verification. [#3549] +- Feature requests are now only approved for collections that belong to the account asking. [#3891] +- Federated posts and comments now always show what a logged-out visitor sees, not the version shown to the logged-in author. [#3876] +- Fewer duplicate email notifications when another server delivers the same message more than once, and a reply that mentions you no longer also sends a separate mention email. [#3732] +- Fixed a fatal error on sites using the Photon snippet, which now also serves images in Fediverse replies through the CDN. [#3850] +- Fixed a possible error when preparing an activity in the outbox whose object is not a full object. [#3527] +- Fixed deprecation notices on PHP 8.5. [#3864] +- Fixed followers, remote profiles and received activities not being found again when their address contains an ampersand, including on WordPress 7.2. [#3862] +- Fixed LiteSpeed Cache possibly showing visitors the technical ActivityPub version of a page instead of the normal page. [#3969] +- Fixed math formulas, and everything after them, disappearing from posts on WordPress 7.2 when the formula includes an HTML annotation. [#3863] +- Fixed normal replies from distant accounts sometimes being auto-approved just because that account had previously liked or reposted a post. [#3636] +- Fixed oversized images in email notifications from remote users. Avatars and inline post images now resize to fit the email width instead of overflowing the screen. [#3637] +- Fixed profile pictures being downloaded again on every page view, leaving a copy behind each time and filling up the uploads folder. [#3818] +- Fixed requests to servers on a non-standard port being rejected because their signature did not include the port. [#3965] +- Fixed signed requests from other servers being rejected on sites behind a proxy that changes the host name. [#3966] +- Fixed the ActivityPub API, relay mode, and OpenGraph metadata silently staying off on some multisite hosts that select the site after plugins have loaded. [#3768] +- Fixed the plugin answering WebFinger, NodeInfo and OAuth server discovery requests meant for other plugins, such as IndieAuth. [#3902] +- Fixed the reaction buttons using the browser font instead of the theme font, which made them smaller than the placeholder for reactions without an action. +- Fixed the search page and the posts page redirecting to a category or tag, or being served as one, on sites that filter content by language, such as Polylang. [#3744] +- Fixed the user selection in the Follow Me and other ActivityPub blocks disappearing when the site has a user you are not allowed to edit. [#3934] +- Fix Fediverse account migration being ignored by some servers when the new account is entered using an alternate address. [#3585] +- Fix Fediverse account migration so a move is verified before it takes effect and reliably reaches your followers on other servers. [#3585] +- Fix local account post counts in Mastodon apps when using Enable Mastodon Apps. [#3884] +- Follow requests are now only accepted when they are meant for the account that received them, and profile links on other sites no longer count as accounts on your site. [#3972] +- Handle incomplete Fediverse object references without errors. [#3855] +- Hidden recipients of a received activity are no longer included when an app reads or streams your inbox. [#3320] +- Improve handling of post URLs when changing publication status. [#3854] +- Incoming requests and account lookups now only match the site address, not the WordPress address. [#3942] +- Links in replies received from the Fediverse now display correctly on WordPress 7.1. [#3789] +- Links to a comment now open the page it is actually on, instead of a later page, on posts with many likes or reposts. [#3678] +- Links to the pages of a collection no longer pass on unknown query arguments, which could point them at the wrong address. [#3549] +- Notifications in the Social Web screen no longer show up twice. [#3844] +- Only image attachments are accepted for the blog avatar and the header images. [#3804] +- Opening a post in the Social Web screen no longer distorts the panel corners or folds the list. [#3845] +- Password-protected sticky posts are no longer listed in your featured posts on the Fediverse. [#3971] +- People mentioned in a post written from a Mastodon app are notified about it again. [#3734] +- Podcast episodes and other attached files hosted outside your media library are now included when a post is sent to the Fediverse. [#3728] +- Posts no longer send a second, smaller copy of the featured image, or the site icon when there is no featured image, which some apps showed as an extra image under the post. [#3721] +- Post summaries now respect plugins that change or hide parts of the post content. [#3902] +- Post summaries now stop at the "Read more" tag everywhere and keep the title of Details blocks. [#3877] +- Queued activities now record their publication and edit times correctly on sites that are not set to UTC. [#3320] +- Quote and feature requests are now only answered when they were sent to the account they ask. [#3925] +- Quote requests are now only approved for posts that belong to the account asking. [#3881] +- Replies found by searching for their address now follow your comment moderation settings instead of being approved right away. [#3970] +- Replies sent through the ActivityPub API to posts on other servers are now delivered instead of being rejected. [#3807] +- Replies to posts from accounts you follow no longer show up in your comments feed and comment widgets. [#3911] +- Replies written through an ActivityPub app no longer mention the person you are replying to twice. [#3680] +- Restore spam-protection checks for regular comments after a comment arrives from the fediverse. [#3527] +- Signed requests from other servers are now checked more strictly, and requests that are not meant for your site are rejected before the sender's key is fetched. [#3967] +- Signed requests from other servers are now only accepted when they are addressed to your site's address. Sites reached under more than one domain can allow the others with the `activitypub_signature_original_hosts` filter. [#3964] +- Sites that turned off comment flood protection no longer get it switched back on by an incoming comment from the Fediverse. [#3527] +- Skip unusable attachments on posts from other servers instead of showing them as broken images. [#3866] +- Stop ActivityPub Likes, Reposts, and Quotes from leaking into the front-end comment list on sites that also use other comment-filtering plugins. [#3315] +- Tags with underscores, like veranda_vestli, now keep their underscores when shared to the fediverse instead of being changed to camelCase. [#3939] +- The "Powered by WordPress" profile field no longer shows up twice, no longer comes back after you delete it, and no longer triggers a warning when the plugin is first activated. [#3730] +- The browser tab title of the settings page now shows the name of the current tab. [#3769] +- The Followers and Following blocks now take their colours and font from the theme, so they are readable on dark themes, and they offer the usual colour, font size and spacing controls in the editor. [#3837] +- The Reactions block no longer requests reactions in the editor for drafts, pages, and other content that is not shared to the Fediverse, which caused failed requests on every editor load. [#3752] +- Tightened the checks on the screen where you approve apps for your account. [#3816] + ## [9.3.1] - 2026-09-02 ### Security - Links to remote profiles in the Followers and Following blocks are now limited to regular web addresses when paging through the list. [#3718] @@ -2042,6 +2145,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added - initial +[9.4.0]: https://github.com/Automattic/wordpress-activitypub/compare/9.3.1...9.4.0 [9.3.1]: https://github.com/Automattic/wordpress-activitypub/compare/9.3.0...9.3.1 [9.3.0]: https://github.com/Automattic/wordpress-activitypub/compare/9.2.2...9.3.0 [9.2.2]: https://github.com/Automattic/wordpress-activitypub/compare/9.2.1...9.2.2 diff --git a/activitypub.php b/activitypub.php index 7c0ddd8281..e139e33f56 100644 --- a/activitypub.php +++ b/activitypub.php @@ -3,7 +3,7 @@ * Plugin Name: ActivityPub * Plugin URI: https://github.com/Automattic/wordpress-activitypub * Description: The ActivityPub protocol is a decentralized social networking protocol based upon the ActivityStreams 2.0 data format. - * Version: 9.3.1 + * Version: 9.4.0 * Author: Matthias Pfefferle & Automattic * Author URI: https://automattic.com/ * License: MIT @@ -17,7 +17,7 @@ namespace Activitypub; -\define( 'ACTIVITYPUB_PLUGIN_VERSION', '9.3.1' ); +\define( 'ACTIVITYPUB_PLUGIN_VERSION', '9.4.0' ); // Plugin related constants. \define( 'ACTIVITYPUB_PLUGIN_DIR', plugin_dir_path( __FILE__ ) ); diff --git a/build/extra-fields/block.json b/build/extra-fields/block.json index fb8587ab67..b9582beb45 100644 --- a/build/extra-fields/block.json +++ b/build/extra-fields/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/extra-fields", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Fediverse Extra Fields", "category": "widgets", "description": "Display extra fields from Fediverse user profiles.", diff --git a/build/follow-me/block.json b/build/follow-me/block.json index c027135f9e..f205f8c285 100644 --- a/build/follow-me/block.json +++ b/build/follow-me/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/follow-me", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Follow me on the Fediverse", "category": "widgets", "description": "Display your Fediverse profile so that visitors can follow you.", diff --git a/build/followers/block.json b/build/followers/block.json index 269ab64178..483637a4d0 100644 --- a/build/followers/block.json +++ b/build/followers/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/followers", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Fediverse Followers", "category": "widgets", "description": "Display your followers from the Fediverse on your website.", diff --git a/build/following/block.json b/build/following/block.json index edcb6e680c..7b1c5a6760 100644 --- a/build/following/block.json +++ b/build/following/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/following", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Fediverse Following", "category": "widgets", "description": "Display the accounts you follow in the Fediverse on your website.", diff --git a/build/posts-and-replies/block.json b/build/posts-and-replies/block.json index 74da37f479..51637de94c 100644 --- a/build/posts-and-replies/block.json +++ b/build/posts-and-replies/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/posts-and-replies", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Posts and Replies", "category": "widgets", "description": "Display a tab bar to filter between posts only and posts with replies on author archives.", diff --git a/build/quote/block.json b/build/quote/block.json index 3091b676d0..a1e786e435 100644 --- a/build/quote/block.json +++ b/build/quote/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "apiVersion": 3, "name": "activitypub/quote", - "version": "9.3.1", + "version": "9.4.0", "title": "Federated Quote", "category": "widgets", "icon": "format-quote", diff --git a/build/reactions/block.json b/build/reactions/block.json index c98a08dab0..b0a7e8147c 100644 --- a/build/reactions/block.json +++ b/build/reactions/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/reactions", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Fediverse Reactions", "category": "widgets", "icon": "heart", diff --git a/build/remote-reply/block.json b/build/remote-reply/block.json index f18b55b811..f07d1d18e6 100644 --- a/build/remote-reply/block.json +++ b/build/remote-reply/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/remote-reply", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Reply on the Fediverse", "category": "widgets", "description": "Allow visitors to reply to your posts from their Fediverse account.", diff --git a/build/reply/block.json b/build/reply/block.json index 8e86919863..f333d3757e 100644 --- a/build/reply/block.json +++ b/build/reply/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "apiVersion": 3, "name": "activitypub/reply", - "version": "9.3.1", + "version": "9.4.0", "title": "Federated Reply", "category": "widgets", "icon": "admin-comments", diff --git a/build/stats/block.json b/build/stats/block.json index e273c58724..fef17bfd7a 100644 --- a/build/stats/block.json +++ b/build/stats/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/stats", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "ActivityPub Stats", "category": "widgets", "description": "Display your annual Fediverse stats as a shareable card.", diff --git a/includes/activity/class-base-object.php b/includes/activity/class-base-object.php index bf7c9ee653..cc84b33189 100644 --- a/includes/activity/class-base-object.php +++ b/includes/activity/class-base-object.php @@ -645,7 +645,7 @@ class Base_Object extends Generic_Object { * URI of the QuoteAuthorization object issued by the quoted author. * * @see https://w3id.org/fep/044f#quoteAuthorization - * @since unreleased + * @since 9.4.0 * * @var string|null */ diff --git a/includes/activity/class-generic-object.php b/includes/activity/class-generic-object.php index bb6372b47f..b91bf33483 100644 --- a/includes/activity/class-generic-object.php +++ b/includes/activity/class-generic-object.php @@ -368,7 +368,7 @@ public function get_json_ld_context() { /** * Whether a property name is declared as a term in the JSON-LD context. * - * @since unreleased + * @since 9.4.0 * * @param string $key The property name as it appears on the wire. * diff --git a/includes/cache/class-comment-media.php b/includes/cache/class-comment-media.php index 248fe7d9c1..298d61ebbd 100644 --- a/includes/cache/class-comment-media.php +++ b/includes/cache/class-comment-media.php @@ -16,7 +16,7 @@ * Images are stored in /wp-content/uploads/activitypub/comments/{comment_id}/ * and removed as soon as the comment is deleted, edited, or no longer approved. * - * @since unreleased + * @since 9.4.0 */ class Comment_Media extends Media { /** diff --git a/includes/cache/class-file.php b/includes/cache/class-file.php index aabb078eae..c5ac7273da 100644 --- a/includes/cache/class-file.php +++ b/includes/cache/class-file.php @@ -361,7 +361,7 @@ public static function delete_directory( $basedir ) { * Each directory is scanned twice, retaining only the newest copy per hash rather than every * duplicate. Subdirectories are cleaned before this directory's files are removed. * - * @since unreleased + * @since 9.4.0 * * @param string $directory The cache directory to walk, subdirectories included. * @param bool $delete Whether to remove and move the files. Default false, count only. diff --git a/includes/cache/class-media.php b/includes/cache/class-media.php index 037a800835..12f024748a 100644 --- a/includes/cache/class-media.php +++ b/includes/cache/class-media.php @@ -45,7 +45,7 @@ class Media extends File { /** * Context identifier for comment media. * - * @deprecated unreleased Use {@see Comment_Media::CONTEXT}. + * @deprecated 9.4.0 Use {@see Comment_Media::CONTEXT}. * * @var string */ @@ -54,7 +54,7 @@ class Media extends File { /** * Base directory for comment media. * - * @deprecated unreleased Use {@see Comment_Media::BASE_DIR}. + * @deprecated 9.4.0 Use {@see Comment_Media::BASE_DIR}. * * @var string */ @@ -152,7 +152,7 @@ public static function maybe_cleanup( $post_id ) { /** * Get storage paths based on context. * - * @deprecated unreleased Use {@see Media::get_storage_paths()} or {@see Comment_Media::get_storage_paths()}. + * @deprecated 9.4.0 Use {@see Media::get_storage_paths()} or {@see Comment_Media::get_storage_paths()}. * * @param string|int $entity_id The entity identifier. * @param string $context The context ('media' or 'comment_media'). @@ -165,7 +165,7 @@ public static function maybe_cleanup( $post_id ) { * } */ public static function get_storage_paths_for_context( $entity_id, $context = self::CONTEXT ) { - \_deprecated_function( __METHOD__, 'unreleased', 'Activitypub\Cache\Media::get_storage_paths or Activitypub\Cache\Comment_Media::get_storage_paths' ); + \_deprecated_function( __METHOD__, '9.4.0', 'Activitypub\Cache\Media::get_storage_paths or Activitypub\Cache\Comment_Media::get_storage_paths' ); return Comment_Media::CONTEXT === $context ? Comment_Media::get_storage_paths( $entity_id ) : self::get_storage_paths( $entity_id ); } @@ -173,14 +173,14 @@ public static function get_storage_paths_for_context( $entity_id, $context = sel /** * Invalidate cached media for a comment. * - * @deprecated unreleased Use {@see Comment_Media::clear_cached_images()}. + * @deprecated 9.4.0 Use {@see Comment_Media::clear_cached_images()}. * * @param int $comment_id The comment ID. * * @return bool True on success, false on failure. */ public static function invalidate_comment( $comment_id ) { - \_deprecated_function( __METHOD__, 'unreleased', 'Activitypub\Cache\Comment_Media::clear_cached_images' ); + \_deprecated_function( __METHOD__, '9.4.0', 'Activitypub\Cache\Comment_Media::clear_cached_images' ); return Comment_Media::invalidate_entity( $comment_id ); } diff --git a/includes/class-blocks.php b/includes/class-blocks.php index ee47d54578..017754d260 100644 --- a/includes/class-blocks.php +++ b/includes/class-blocks.php @@ -149,7 +149,7 @@ public static function handle_in_reply_to_get_param() { * The script reads the parameter itself and prefills the matching block, so nothing * is read here beyond the presence of the parameter. * - * @since unreleased + * @since 9.4.0 * * @param string $param The URL parameter carrying the address. * @param string $script The build folder and script handle suffix. @@ -170,7 +170,7 @@ private static function enqueue_intent_script( $param, $script ) { /** * Enqueue the quote intent script if the quotation_of GET param is set. * - * @since unreleased + * @since 9.4.0 * * @return void */ @@ -711,7 +711,7 @@ public static function render_image_block( $attrs, $content, $block = null ) { /** * Get the remote URL of an image block. * - * @since unreleased + * @since 9.4.0 * * @param array $attrs The image block attributes. * @@ -729,7 +729,7 @@ public static function get_image_url( $attrs ) { /** * Render the description of an image that is not shown. * - * @since unreleased + * @since 9.4.0 * * @param array $attrs The image block attributes. * @@ -897,7 +897,7 @@ public static function render_reply_block( $attrs ) { /** * Render the Quote block. * - * @since unreleased + * @since 9.4.0 * * @see https://indieweb.org/quotation * @@ -961,7 +961,7 @@ public static function render_quote_block( $attrs, $content = '', $block = null * Comments come first, with the labels core uses. The reaction types bring their icons and * labels from the comment type registry. * - * @since unreleased + * @since 9.4.0 * * @return array[] Types keyed by comment type, each with `icon`, `count_single` and `count_plural`. */ @@ -1334,7 +1334,7 @@ public static function generate_reply_link( $block_content, $block ) { * * Receivers render the quoted post from the `quote` property; inlining the embed would duplicate it. * - * @since unreleased + * @since 9.4.0 * * @param string $block_content The block content. * @param array $block The block data. diff --git a/includes/class-comment.php b/includes/class-comment.php index 0584644b0d..8e28cd0811 100644 --- a/includes/class-comment.php +++ b/includes/class-comment.php @@ -495,7 +495,7 @@ public static function comment_feed_where( $where ) { /** * Keeps replies to remote posts out of the Recent Comments widget and the Latest Comments block. * - * @since unreleased + * @since 9.4.0 * * @param array $args The comment query arguments. * diff --git a/includes/class-http.php b/includes/class-http.php index 026568f47d..a6abac6ecf 100644 --- a/includes/class-http.php +++ b/includes/class-http.php @@ -280,7 +280,7 @@ public static function generate_cache_key( $url ) { /** * Get a remote object. * - * @deprecated unreleased Use {@see Proxy::get()}, which owns the cache and the checks that + * @deprecated 9.4.0 Use {@see Proxy::get()}, which owns the cache and the checks that * an object is served under its own id. * * @param array|string $url_or_object The Object or the Object URL. @@ -289,7 +289,7 @@ public static function generate_cache_key( $url ) { * @return array|\WP_Error The Object data as array or WP_Error on failure. */ public static function get_remote_object( $url_or_object, $cached = true ) { - \_deprecated_function( __METHOD__, 'unreleased', 'Activitypub\Proxy::get' ); + \_deprecated_function( __METHOD__, '9.4.0', 'Activitypub\Proxy::get' ); $args = array( 'cached' => (bool) $cached ); @@ -305,7 +305,7 @@ public static function get_remote_object( $url_or_object, $cached = true ) { * * Short for errors worth retrying and for connection failures, longer for the rest. * - * @since unreleased + * @since 9.4.0 * * @param int $code The HTTP status code, 0 for a connection failure. * diff --git a/includes/class-mention.php b/includes/class-mention.php index 6358703948..b011a37e8f 100644 --- a/includes/class-mention.php +++ b/includes/class-mention.php @@ -207,7 +207,7 @@ public static function extract_mentions( $mentions, $post_content ) { * A mention link marks itself with the `mention` class, the microformats convention Mastodon * and the plugin share, or with `rel="mention"`. * - * @since unreleased + * @since 9.4.0 * * @param string $content The content. * diff --git a/includes/class-migration.php b/includes/class-migration.php index 2e1b157f6a..0e4dd0d031 100644 --- a/includes/class-migration.php +++ b/includes/class-migration.php @@ -235,7 +235,7 @@ public static function maybe_migrate() { self::migrate_application_keypair_option(); self::delete_application_outbox_items(); } - if ( \version_compare( $version_from_db, 'unreleased', '<' ) && ! \wp_next_scheduled( 'activitypub_remove_duplicate_cache_files' ) ) { + if ( \version_compare( $version_from_db, '9.4.0', '<' ) && ! \wp_next_scheduled( 'activitypub_remove_duplicate_cache_files' ) ) { // A filesystem walk, so off the upgrade request and onto cron. \wp_schedule_single_event( \time() + MINUTE_IN_SECONDS, 'activitypub_remove_duplicate_cache_files' ); } @@ -1396,7 +1396,7 @@ public static function migrate_application_keypair_option() { * `-N` copy each time; see {@see File::remove_duplicates()}. Running this twice is * harmless, the second pass finds nothing. * - * @since unreleased + * @since 9.4.0 * * @return void */ diff --git a/includes/class-proxy.php b/includes/class-proxy.php index fe54bbd4de..0d174c5809 100644 --- a/includes/class-proxy.php +++ b/includes/class-proxy.php @@ -28,13 +28,13 @@ * A remote document is always an array and an error always an object, so a string can * never be mistaken for either. * - * @since unreleased + * @since 9.4.0 */ class Proxy { /** * Get a remote object. * - * @since unreleased + * @since 9.4.0 * * An identifier that is not a string, or that hides its authority behind `user@host`, is * refused; see the checks in the body. @@ -190,7 +190,7 @@ public static function get( $id, $args = array() ) { * * For evictions the site decides on itself, see {@see Proxy::purge()}. * - * @since unreleased + * @since 9.4.0 * * @param string|array|null $id The ActivityPub id, or an object with an id. * @param string|array $actor The actor the activity came from. @@ -213,7 +213,7 @@ public static function delete( $id, $actor ) { * For a deletion the site has confirmed itself, or plain housekeeping. Everything an * activity asks for goes through {@see Proxy::delete()}, which requires an actor. * - * @since unreleased + * @since 9.4.0 * * @param string|array|null $id The ActivityPub id, or an object with an id. * diff --git a/includes/class-sanitize.php b/includes/class-sanitize.php index e4948904a2..80832f963d 100644 --- a/includes/class-sanitize.php +++ b/includes/class-sanitize.php @@ -274,7 +274,7 @@ public static function webfinger( $value ) { /** * Sanitize an attachment ID that must point to an image. Returns 0 for anything else. * - * @since unreleased + * @since 9.4.0 * * @param int|string $value The value to sanitize. * diff --git a/includes/class-shortcodes.php b/includes/class-shortcodes.php index 9ba9182114..14ac22a981 100644 --- a/includes/class-shortcodes.php +++ b/includes/class-shortcodes.php @@ -159,7 +159,7 @@ public static function content( $attributes, $content, $tag ) { // phpcs:ignore } if ( isset( $attributes['apply_filters'] ) && 'no' === $attributes['apply_filters'] ) { - \_doing_it_wrong( __METHOD__, \esc_html__( 'The apply_filters attribute was removed. To keep a filter out of federated content, remove it in the activitypub_before_get_content action instead.', 'activitypub' ), 'unreleased' ); + \_doing_it_wrong( __METHOD__, \esc_html__( 'The apply_filters attribute was removed. To keep a filter out of federated content, remove it in the activitypub_before_get_content action instead.', 'activitypub' ), '9.4.0' ); } // Prevent inception. diff --git a/includes/class-webfinger.php b/includes/class-webfinger.php index 85687d7f8a..7956055f9d 100644 --- a/includes/class-webfinger.php +++ b/includes/class-webfinger.php @@ -65,7 +65,7 @@ public static function get_user_resource( $user_id ) { * An internationalized handle gets the form RFC 7565 asks for: the userpart percent-encoded * and the host as A-label. * - * @since unreleased + * @since 9.4.0 * * @param string $handle The handle, `user@host`. * diff --git a/includes/collection/class-interactions.php b/includes/collection/class-interactions.php index 84cfe8afe7..e6315cf95f 100644 --- a/includes/collection/class-interactions.php +++ b/includes/collection/class-interactions.php @@ -248,7 +248,7 @@ public static function add_reaction( $activity ) { /** * Resolve an interaction target to its WordPress post ID. * - * @since unreleased + * @since 9.4.0 * * @param string $url The target URL. * @param int|null $parent_comment_id Optional. The resolved parent comment ID. @@ -429,7 +429,7 @@ public static function allowed_comment_html( $allowed_tags, $context = '' ) { * verification cannot apply to this submission route. A named method (rather * than an anonymous closure) is used so it can be removed by reference again. * - * @since unreleased + * @since 9.4.0 * * @return string Always `inactive`. */ @@ -473,7 +473,7 @@ public static function activity_to_comment( $activity, $user_id = null ) { /** * Prepare comment fields for a local author. * - * @since unreleased + * @since 9.4.0 * * @param array $activity The Activity array. * @param int $user_id The local WordPress user ID. @@ -501,7 +501,7 @@ private static function prepare_local_comment_data( $activity, $user_id ) { /** * Prepare comment fields for a remote author. * - * @since unreleased + * @since 9.4.0 * * @param array $activity The Activity array. * @@ -555,7 +555,7 @@ private static function prepare_remote_comment_data( $activity ) { /** * Get the image attachments displayed in a remote comment. * - * @since unreleased + * @since 9.4.0 * * @param array $activity_object The ActivityPub object. * @param bool $check_hosts Optional. Whether the hosts must be public. Default true. @@ -571,7 +571,7 @@ public static function get_image_attachments( $activity_object, $check_hosts = t /** * Filters the maximum number of image attachments displayed in a Fediverse comment. * - * @since unreleased + * @since 9.4.0 * * @param int $limit Maximum number of images. Default 3. Zero disables image attachments. * @param array $activity_object The ActivityPub object. @@ -599,7 +599,7 @@ public static function get_image_attachments( $activity_object, $check_hosts = t /** * Prepare ActivityPub-specific comment metadata. * - * @since unreleased + * @since 9.4.0 * * @param array $activity The Activity array. * @@ -681,7 +681,7 @@ public static function persist( $comment_data, $action = self::INSERT ) { * Results are cached against WordPress's comment cache generation so inserts, * updates, deletions, and comment meta changes invalidate them automatically. * - * @since unreleased + * @since 9.4.0 * * @param int $post_id The post ID. * diff --git a/includes/collection/class-posts.php b/includes/collection/class-posts.php index 87e23d755d..233c3e006f 100644 --- a/includes/collection/class-posts.php +++ b/includes/collection/class-posts.php @@ -216,7 +216,7 @@ public static function delete( $post_id ) { /** * Serialize a Reply block for the given URL. * - * @since unreleased + * @since 9.4.0 * * @param string $url The URL of the object being replied to. * diff --git a/includes/collection/class-remote-actors.php b/includes/collection/class-remote-actors.php index 8e482c0167..c62276195e 100644 --- a/includes/collection/class-remote-actors.php +++ b/includes/collection/class-remote-actors.php @@ -162,7 +162,7 @@ public static function update( $post, $actor ) { /** * Persist prepared remote actor post data. * - * @since unreleased + * @since 9.4.0 * * @param array $args Prepared post data. An ID indicates an update. * @@ -212,7 +212,7 @@ public static function delete( $post_id ) { /** * Get the IDs of the local users a remote actor follows. * - * @since unreleased + * @since 9.4.0 * * @param int $post_id The remote actor post ID. * @@ -234,7 +234,7 @@ private static function get_follower_ids( $post_id ) { * Every write to an actor post or its follower meta has to end up here; a bare * `wp_delete_post()` or `add_post_meta()` elsewhere leaves a stale inbox list behind. * - * @since unreleased + * @since 9.4.0 * * @param int[] $user_ids The local users whose follower inbox lists include the actor. * @@ -745,7 +745,7 @@ private static function prepare_custom_post_type( $actor ) { * stopgap for a missing incoming/outgoing serialization-context split; until that exists, every * storage path (see also Inbox storage) needs the same treatment. * - * @since unreleased + * @since 9.4.0 * * @param Actor $actor The actor to serialize. * diff --git a/includes/functions-post.php b/includes/functions-post.php index 12eacff43f..f6da8808ff 100644 --- a/includes/functions-post.php +++ b/includes/functions-post.php @@ -459,7 +459,7 @@ function get_post_id( $id ) { /** * Get the post URL, preserving its published permalink after withdrawal. * - * @since unreleased + * @since 9.4.0 * * @param \WP_Post $post The post. * @@ -533,7 +533,7 @@ function get_content_visibility( $post_id ) { /** * Get the quote intent URI as a JavaScript URI. * - * @since unreleased + * @since 9.4.0 * * @return string The quote intent URI. */ @@ -547,7 +547,7 @@ function get_quote_intent_js() { /** * Get the quote intent URI. * - * @since unreleased + * @since 9.4.0 * * @return string The quote intent URI. */ @@ -555,7 +555,7 @@ function get_quote_intent_url() { /** * Filters the quote intent parameters. * - * @since unreleased + * @since 9.4.0 * * @param array $params The quote intent parameters. */ @@ -569,7 +569,7 @@ function get_quote_intent_url() { /** * Filters the quote intent URL. * - * @since unreleased + * @since 9.4.0 * * @param string $url The quote intent URL. */ diff --git a/includes/functions-url.php b/includes/functions-url.php index e93de9a280..4d4eee1076 100644 --- a/includes/functions-url.php +++ b/includes/functions-url.php @@ -60,7 +60,7 @@ function normalize_host( $host ) { * `xn--caf-dma.example`), which is the form `acct:` URIs and DNS use. ASCII hosts, IPv6 * literals included, are returned as they are. * - * @since unreleased + * @since 9.4.0 * * @param string $host The host. * @@ -160,7 +160,7 @@ function fold_authority( $authority ) { * request. Only a host this site answers on may enter a signature base, or a signature made out * to another server would verify here when it is replayed to the same path with that server's name. * - * @since unreleased + * @since 9.4.0 * * @param string $authority A host, optionally bracketed and optionally with a port. * @@ -208,7 +208,7 @@ function is_signature_host( $authority ) { * and as WordPress' HTTP transports send it. A signature over the host has to name this value, * or a server on a non-default port cannot verify it. * - * @since unreleased + * @since 9.4.0 * * @param string $url The URL. * @@ -242,7 +242,7 @@ function get_authority( $url ) { * ones are whatever an admin entered. A host of `.` or `[]` folds away to nothing and is dropped, so * it never matches an unset old host. * - * @since unreleased + * @since 9.4.0 * * @param string|null $host The host. * diff --git a/includes/functions.php b/includes/functions.php index 0e05b8584c..135e532b4f 100644 --- a/includes/functions.php +++ b/includes/functions.php @@ -366,7 +366,7 @@ function get_embed_html( $url, $inline_css = true ) { /** * Check whether terms of a taxonomy are federated. * - * @since unreleased + * @since 9.4.0 * * @param string $taxonomy The taxonomy name. * diff --git a/includes/handler/class-accept.php b/includes/handler/class-accept.php index 5d75e10623..2d985288bc 100644 --- a/includes/handler/class-accept.php +++ b/includes/handler/class-accept.php @@ -103,7 +103,7 @@ private static function accept_follow( $accept, $user_ids ) { * Accept a "QuoteRequest" of ours: verify and store the QuoteAuthorization stamp. * * @see https://codeberg.org/fediverse/fep/src/branch/main/fep/044f/fep-044f.md#quoteauthorization - * @since unreleased + * @since 9.4.0 * * @param array $accept The activity-object. * @param \WP_Post $outbox_post Our QuoteRequest outbox item. diff --git a/includes/handler/class-delete.php b/includes/handler/class-delete.php index 83562a2855..6d0d83ee45 100644 --- a/includes/handler/class-delete.php +++ b/includes/handler/class-delete.php @@ -122,7 +122,7 @@ public static function handle_delete( $activity, $user_ids, $activity_object = n /** * Revoke a QuoteAuthorization stamp the quoted author deleted. * - * @since unreleased + * @since 9.4.0 * * @param array $activity The Activity object. * @param int[]|int $user_ids The local user IDs. @@ -417,7 +417,7 @@ public static function skip_inbox_storage( $skip, $data ) { * arrives. * * @since 8.2.0 The `$force_signature` parameter is now respected. - * @since unreleased Limited to POST deliveries to an inbox route. + * @since 9.4.0 Limited to POST deliveries to an inbox route. * * @param bool $defer Whether to defer signature verification. * @param \WP_REST_Request $request The request object. diff --git a/includes/handler/class-reject.php b/includes/handler/class-reject.php index 122a3039e1..939f0fefe2 100644 --- a/includes/handler/class-reject.php +++ b/includes/handler/class-reject.php @@ -102,7 +102,7 @@ private static function reject_follow( $reject, $user_ids ) { /** * Reject a "QuoteRequest" of ours: the quote part is dropped from the post. * - * @since unreleased + * @since 9.4.0 * * @param array $reject The activity-object. * @param \WP_Post $outbox_post Our QuoteRequest outbox item. @@ -148,7 +148,7 @@ private static function reject_quote_request( $reject, $outbox_post, $user_ids ) /** * Only the quoted object's author may answer our QuoteRequest. * - * @since unreleased + * @since 9.4.0 * * @param array $reject The activity-object. * @param string $quoted_uri The quoted object URI. diff --git a/includes/oauth/class-client.php b/includes/oauth/class-client.php index 99d294ba76..bbb61d5714 100644 --- a/includes/oauth/class-client.php +++ b/includes/oauth/class-client.php @@ -760,7 +760,7 @@ public function get_client_uri() { * host and without a user name. The check runs on read to also cover values stored before it existed. * * @since 8.1.0 - * @since unreleased Only returns http(s) URLs with a host and no user name. + * @since 9.4.0 Only returns http(s) URLs with a host and no user name. * * @return string A URL for the client, or empty string if none available. */ diff --git a/includes/rest/class-actors-inbox-controller.php b/includes/rest/class-actors-inbox-controller.php index 59b1dde252..0150ad348f 100644 --- a/includes/rest/class-actors-inbox-controller.php +++ b/includes/rest/class-actors-inbox-controller.php @@ -310,7 +310,7 @@ private function get_query_args( $request ) { * The inbox route's permission callback already refuses a non-owner, so unlike the outbox this * method needs no seek gate of its own. * - * @since unreleased + * @since 9.4.0 * * @param string $item The ActivityPub activity ID. * @param \WP_REST_Request $request Full details about the request. diff --git a/includes/rest/class-followers-controller.php b/includes/rest/class-followers-controller.php index 7b0b7c695d..c6a9c05f0c 100644 --- a/includes/rest/class-followers-controller.php +++ b/includes/rest/class-followers-controller.php @@ -248,7 +248,7 @@ static function ( $item ) use ( $context ) { /** * Get the position of a follower in the collection, under the collection's own query rules. * - * @since unreleased + * @since 9.4.0 * * @param string $item The ActivityPub actor ID of the follower. * @param \WP_REST_Request $request Full details about the request. diff --git a/includes/rest/class-following-controller.php b/includes/rest/class-following-controller.php index 1c6237f32a..65c9814ddf 100644 --- a/includes/rest/class-following-controller.php +++ b/includes/rest/class-following-controller.php @@ -152,7 +152,7 @@ static function ( $item ) use ( $context ) { /** * Get the position of a followed actor in the collection, under the collection's own query rules. * - * @since unreleased + * @since 9.4.0 * * @param string $item The ActivityPub actor ID of the followed actor. * @param \WP_REST_Request $request Full details about the request. diff --git a/includes/rest/class-interaction-controller.php b/includes/rest/class-interaction-controller.php index 7781d6252e..7719951866 100644 --- a/includes/rest/class-interaction-controller.php +++ b/includes/rest/class-interaction-controller.php @@ -38,7 +38,7 @@ class Interaction_Controller extends \WP_REST_Controller { /** * Readable intent aliases mapped to their FEP-3b86 activity-type intent. * - * @since unreleased + * @since 9.4.0 * * @var string[] */ @@ -188,7 +188,7 @@ public function get_item( $request ) { /** * Filters the URL used for quoting an ActivityPub object. * - * @since unreleased + * @since 9.4.0 * * @param string $redirect_url The URL to redirect to. * @param string $uri The URI of the object to quote. diff --git a/includes/rest/class-liked-controller.php b/includes/rest/class-liked-controller.php index 63ed05de8c..f23f795904 100644 --- a/includes/rest/class-liked-controller.php +++ b/includes/rest/class-liked-controller.php @@ -126,7 +126,7 @@ public function get_items( $request ) { /** * Get the position of an object in the liked collection. * - * @since unreleased + * @since 9.4.0 * * @param string $item The ActivityPub object ID of the liked object. * @param \WP_REST_Request $request Full details about the request. diff --git a/includes/rest/class-outbox-controller.php b/includes/rest/class-outbox-controller.php index 1b63d570ef..b808300e9e 100644 --- a/includes/rest/class-outbox-controller.php +++ b/includes/rest/class-outbox-controller.php @@ -317,7 +317,7 @@ private function get_query_args( $request ) { * the position counts only the activities they can see, so it cannot reveal how many private * ones precede it. * - * @since unreleased + * @since 9.4.0 * * @param string $item The ActivityPub activity ID. * @param \WP_REST_Request $request Full details about the request. diff --git a/includes/rest/class-seek-controller.php b/includes/rest/class-seek-controller.php index 2291eb12fa..c04f110306 100644 --- a/includes/rest/class-seek-controller.php +++ b/includes/rest/class-seek-controller.php @@ -23,7 +23,7 @@ * * @see https://swicg.github.io/activitypub-api/seekitem * - * @since unreleased + * @since 9.4.0 */ class Seek_Controller extends \WP_REST_Controller { use Verification; @@ -45,7 +45,7 @@ class Seek_Controller extends \WP_REST_Controller { /** * Whether a seek dispatch is currently in flight. * - * @since unreleased + * @since 9.4.0 * * @var bool */ @@ -120,7 +120,7 @@ public function get_item_permissions_check( $request ) { * than the requested route, because patterns match case-insensitively: a route of `/…/Seek` * resolves back to this endpoint and would slip past a comparison against the requested route. * - * @since unreleased + * @since 9.4.0 * * @param string $route The route of the request about to be dispatched. * diff --git a/includes/rest/trait-collection.php b/includes/rest/trait-collection.php index 2165c3d620..753f8f5ed0 100644 --- a/includes/rest/trait-collection.php +++ b/includes/rest/trait-collection.php @@ -120,7 +120,7 @@ public function prepare_collection_response( $response, $request ) { /** * Collect the query arguments that belong in a collection's id and page links. * - * @since unreleased + * @since 9.4.0 * * @param \WP_REST_Request $request The collection request. * @@ -154,7 +154,7 @@ private function get_collection_query_params( $request ) { * * @see https://swicg.github.io/activitypub-api/seekitem * - * @since unreleased + * @since 9.4.0 * * @return array The argument definition. */ @@ -193,7 +193,7 @@ public function get_item_index( $item, $request ) { // phpcs:ignore VariableAnal * * @see https://swicg.github.io/activitypub-api/seekitem * - * @since unreleased + * @since 9.4.0 * * @param \WP_REST_Request $request The request object. * @param string $collection_id The plain collection ID (URL without query arguments). @@ -263,7 +263,7 @@ private function with_posts_where( $where, $callback ) { * Mirrors an `orderby` of ID, so the count of matching posts is the cursor's zero-based index. * Shared by the ID-ordered collections (followers, following). * - * @since unreleased + * @since 9.4.0 * * @param int $id The cursor post's ID. * @param string $order The collection's sort order, `asc` or `desc`. diff --git a/includes/rest/trait-rate-limit.php b/includes/rest/trait-rate-limit.php index 1b8bc7cb06..05fb245e6f 100644 --- a/includes/rest/trait-rate-limit.php +++ b/includes/rest/trait-rate-limit.php @@ -22,7 +22,7 @@ * be identified at all is refused: without a key there is nothing to count, so letting it through * would be the same as having no limit. * - * @since unreleased + * @since 9.4.0 */ trait Rate_Limit { /** @@ -44,7 +44,7 @@ trait Rate_Limit { * answer is therefore remembered per request object, so one request spends one unit however * often it is asked, and forgotten once its response has been stamped. * - * @since unreleased + * @since 9.4.0 * * @param string $bucket What is being limited, for example `interactions`. * @param int $limit How many requests a caller may make per minute. @@ -85,7 +85,7 @@ private function count_request( $bucket, $limit ) { /** * Filters how many requests a caller may make per minute. * - * @since unreleased + * @since 9.4.0 * * @param int $limit The allowance the endpoint asks for. * @param string $bucket What is being limited, for example `interactions`. diff --git a/includes/rest/trait-verification.php b/includes/rest/trait-verification.php index 32a0b770d1..b69be31fb2 100644 --- a/includes/rest/trait-verification.php +++ b/includes/rest/trait-verification.php @@ -339,7 +339,7 @@ protected function show_social_graph( $request ) { * consented to, so reading owner-only material additionally requires the `read` scope. A * WordPress session is not scope-limited. * - * @since unreleased + * @since 9.4.0 * * @param \WP_REST_Request $request The request object. * @return bool True if the owner may read owner-only material. diff --git a/includes/scheduler/class-comment.php b/includes/scheduler/class-comment.php index 69a6cab845..fe1f8ac06c 100644 --- a/includes/scheduler/class-comment.php +++ b/includes/scheduler/class-comment.php @@ -73,7 +73,7 @@ public static function schedule_comment_activity( $new_status, $old_status, $com * * Remove a type to keep it local, add a custom type to federate it. * - * @since unreleased + * @since 9.4.0 * * @param string[] $allowed_types Comment type slugs that are federated. * @param \WP_Comment $comment The comment being processed. diff --git a/includes/scheduler/class-post.php b/includes/scheduler/class-post.php index 28bfa816d7..aba2f35a61 100644 --- a/includes/scheduler/class-post.php +++ b/includes/scheduler/class-post.php @@ -52,7 +52,7 @@ public static function init() { /** * Preserve the published URL before post fields and terms change. * - * @since unreleased + * @since 9.4.0 * * @param int $post_id Post ID. * @return void diff --git a/includes/scheduler/class-quote-request.php b/includes/scheduler/class-quote-request.php index e4b4a26387..dfee072978 100644 --- a/includes/scheduler/class-quote-request.php +++ b/includes/scheduler/class-quote-request.php @@ -19,13 +19,13 @@ * Sends the FEP-044f QuoteRequest for local quote posts. * * @see https://codeberg.org/fediverse/fep/src/branch/main/fep/044f/fep-044f.md - * @since unreleased + * @since 9.4.0 */ class Quote_Request { /** * Initialize the class, registering WordPress hooks. * - * @since unreleased + * @since 9.4.0 * * @return void */ @@ -36,7 +36,7 @@ public static function init() { /** * Send a QuoteRequest for a quote post that has none out for its current quoted URL. * - * @since unreleased + * @since 9.4.0 * * @param int $outbox_id The outbox item ID. * @param Activity $activity The activity object. @@ -124,7 +124,7 @@ public static function maybe_send_request( $outbox_id, $activity, $user_id ) { * * A block whose URL was cleared quotes as little as a block that was deleted. * - * @since unreleased + * @since 9.4.0 * * @param \WP_Post $post The post. * diff --git a/includes/transformer/class-base.php b/includes/transformer/class-base.php index 5deb2bb572..cfe112add4 100644 --- a/includes/transformer/class-base.php +++ b/includes/transformer/class-base.php @@ -428,7 +428,7 @@ protected function get_in_reply_to() { /** * Returns the URI of the quoted object. * - * @since unreleased + * @since 9.4.0 * * @return string|null The quoted object URI or null if the item is not a quote post. */ diff --git a/includes/transformer/class-post.php b/includes/transformer/class-post.php index f22eb66826..5a0270fcbb 100644 --- a/includes/transformer/class-post.php +++ b/includes/transformer/class-post.php @@ -92,7 +92,7 @@ class Post extends Base { /** * The quoted object URI, or null once resolved to "not a quote". * - * @since unreleased + * @since 9.4.0 * * @var string|null|false */ @@ -323,7 +323,7 @@ protected function get_image() { * getter onto the property of the same name, and FEP-b2b8 reserves `icon` for the author's * avatar. * - * @since unreleased Renamed from `get_icon()`, so it no longer maps onto the object. + * @since 9.4.0 Renamed from `get_icon()`, so it no longer maps onto the object. * * @see https://fediverse.codeberg.page/fep/fep/b2b8/ * @@ -693,7 +693,7 @@ protected function get_in_reply_to() { * Returns the URI quoted by the first valid Quote block. * * @see https://codeberg.org/fediverse/fep/src/branch/main/fep/044f/fep-044f.md - * @since unreleased + * @since 9.4.0 * * @return string|null The quoted object URI, or null if there is none or the quote was rejected. */ @@ -727,7 +727,7 @@ public function get_quote() { /** * Returns the Fedibird alias of the quote property. * - * @since unreleased + * @since 9.4.0 * * @return string|null The quoted object URI. */ @@ -738,7 +738,7 @@ protected function get_quote_uri() { /** * Returns the Misskey alias of the quote property. * - * @since unreleased + * @since 9.4.0 * * @return string|null The quoted object URI. */ @@ -749,7 +749,7 @@ protected function get__misskey_quote() { /** * Returns the QuoteAuthorization stamp URI once the quoted author accepted. * - * @since unreleased + * @since 9.4.0 * * @return string|null The stamp URI or null. */ diff --git a/includes/wp-admin/class-admin.php b/includes/wp-admin/class-admin.php index b5503350a2..3c8ca568eb 100644 --- a/includes/wp-admin/class-admin.php +++ b/includes/wp-admin/class-admin.php @@ -656,7 +656,7 @@ public static function manage_comments_custom_column( $column, $comment_id ) { * Only the browsable `source_url` is linked, not the ActivityPub ID: reactions like Likes * and Announces store only that, and it is not always a page. * - * @since unreleased + * @since 9.4.0 * * @param int $comment_id The comment id. * diff --git a/readme.txt b/readme.txt index c8c01b52db..a49f3f240f 100644 --- a/readme.txt +++ b/readme.txt @@ -3,7 +3,7 @@ Contributors: automattic, pfefferle, mattwiebe, obenland, akirk, jeherve, mediaf Tags: fediverse, activitypub, indieweb, activitystream, social web Requires at least: 6.5 Tested up to: 7.1 -Stable tag: 9.3.1 +Stable tag: 9.4.0 Requires PHP: 7.4 License: MIT License URI: http://opensource.org/licenses/MIT @@ -117,6 +117,109 @@ For reasons of data protection, it is not possible to see the followers of other == Changelog == +### 9.4.0 - 2026-10-27 +#### Security +- Improve the safety of imported Fediverse posts and comments. +- Improve verification of signing keys fetched from other servers. + +#### Added +- Add a Counts style to the Fediverse Reactions block that shows comments and reactions as a line of simple links, for example to replace the comments link in a query loop. +- Add an option to show images attached to Fediverse replies in comments, with local caching and image descriptions. +- Added a custom name and avatar for the blog profile. Your Fediverse blog account can now use its own display name and profile picture, independent of the WordPress site title and site icon. +- Added a Federated Quote block to quote posts from the Fediverse. The author of the quoted post is asked for permission, and the quote is marked as verified once they agree. +- Added a filter that lets plugins decide which comment types are shared with the Fediverse, so custom comment types can be kept local or sent out as replies. +- Added a Source column to the Comments screen that links incoming replies and quote posts to the post they came from. +- Fediverse apps can now jump directly to the page of a collection that contains a specific item, instead of paging through from the start. +- Posts and comments on sites using Polylang are now federated with the language Polylang assigned to them. +- Posts published from a Mastodon app are now federated with the language the app set, and on sites using Polylang or WPML that language is stored with the multilingual plugin. +- Profiles and posts now point at the shared Fediverse definitions for content warnings, hashtags, manual follower approval and account moves. +- Support handles with non-Latin characters and domains with special characters, like @renée@café.example, in mentions, search and profile lookups. +- The Counts style of the Fediverse Reactions block now uses your theme's link color, adds a link color setting, and underlines links on hover. +- The Fediverse Reactions block now has margin and padding settings. +- The Social Web feed can be filtered by date, to show only posts from before or after a day you pick. +- You can now log in as a different WordPress user while authorizing an ActivityPub app without losing the authorization request. + +#### Changed +- Endpoints that other sites and apps call now answer a limited number of requests per minute from the same caller, and say so in the `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` response headers. +- Only accounts that are enabled for ActivityPub can authorize apps to act for them. +- Posts and profiles fetched from other servers are now cached through the WordPress object cache when the site has one. Updates and confirmed deletions clear the cached copy. +- The Fediverse Reactions block now lines up its buttons with the same width and shows a lighter label for reactions you can't answer from the block. + +#### Removed +- The option to turn off content filters in the post template was removed. Federated posts now always use the regular content filters. + +#### Fixed +- Activities delivered to accounts on the same site now only reach ActivityPub inboxes. +- Activities read through the ActivityPub API now fall back to the date your site recorded when the activity itself carries none, so client apps show consistent timestamps. +- Apps connected to your account now only see what you granted them access to. +- Apps that post on behalf of the blog can now only change or delete content that the connected user is allowed to change or delete. +- A queued activity that cannot be read no longer stops the ones queued behind it from being sent. +- Blocking a remote account now removes it from your followers and following lists, whichever form of its address you used. +- Connection problems with other servers now explain what went wrong instead of failing without a reason. +- Descriptions of remote accounts with quotes or links in them are no longer saved with stray backslashes. +- Domain blocks now also apply to handles that have a path after the domain, like @user@example.com/x. +- Duplicate copies of cached profile pictures and images that earlier versions left behind are removed on update, and `wp activitypub cache cleanup` removes them on demand. +- Emoji in the blog profile ID are now dropped instead of being turned into a string of codes that other servers could not resolve. +- Ensure that only account deletions delivered to your site can skip the usual sender verification. +- Feature requests are now only approved for collections that belong to the account asking. +- Federated posts and comments now always show what a logged-out visitor sees, not the version shown to the logged-in author. +- Fewer duplicate email notifications when another server delivers the same message more than once, and a reply that mentions you no longer also sends a separate mention email. +- Fixed a fatal error on sites using the Photon snippet, which now also serves images in Fediverse replies through the CDN. +- Fixed a possible error when preparing an activity in the outbox whose object is not a full object. +- Fixed deprecation notices on PHP 8.5. +- Fixed followers, remote profiles and received activities not being found again when their address contains an ampersand, including on WordPress 7.2. +- Fixed LiteSpeed Cache possibly showing visitors the technical ActivityPub version of a page instead of the normal page. +- Fixed math formulas, and everything after them, disappearing from posts on WordPress 7.2 when the formula includes an HTML annotation. +- Fixed normal replies from distant accounts sometimes being auto-approved just because that account had previously liked or reposted a post. +- Fixed oversized images in email notifications from remote users. Avatars and inline post images now resize to fit the email width instead of overflowing the screen. +- Fixed profile pictures being downloaded again on every page view, leaving a copy behind each time and filling up the uploads folder. +- Fixed requests to servers on a non-standard port being rejected because their signature did not include the port. +- Fixed signed requests from other servers being rejected on sites behind a proxy that changes the host name. +- Fixed the ActivityPub API, relay mode, and OpenGraph metadata silently staying off on some multisite hosts that select the site after plugins have loaded. +- Fixed the plugin answering WebFinger, NodeInfo and OAuth server discovery requests meant for other plugins, such as IndieAuth. +- Fixed the reaction buttons using the browser font instead of the theme font, which made them smaller than the placeholder for reactions without an action. +- Fixed the search page and the posts page redirecting to a category or tag, or being served as one, on sites that filter content by language, such as Polylang. +- Fixed the user selection in the Follow Me and other ActivityPub blocks disappearing when the site has a user you are not allowed to edit. +- Fix Fediverse account migration being ignored by some servers when the new account is entered using an alternate address. +- Fix Fediverse account migration so a move is verified before it takes effect and reliably reaches your followers on other servers. +- Fix local account post counts in Mastodon apps when using Enable Mastodon Apps. +- Follow requests are now only accepted when they are meant for the account that received them, and profile links on other sites no longer count as accounts on your site. +- Handle incomplete Fediverse object references without errors. +- Hidden recipients of a received activity are no longer included when an app reads or streams your inbox. +- Improve handling of post URLs when changing publication status. +- Incoming requests and account lookups now only match the site address, not the WordPress address. +- Links in replies received from the Fediverse now display correctly on WordPress 7.1. +- Links to a comment now open the page it is actually on, instead of a later page, on posts with many likes or reposts. +- Links to the pages of a collection no longer pass on unknown query arguments, which could point them at the wrong address. +- Notifications in the Social Web screen no longer show up twice. +- Only image attachments are accepted for the blog avatar and the header images. +- Opening a post in the Social Web screen no longer distorts the panel corners or folds the list. +- Password-protected sticky posts are no longer listed in your featured posts on the Fediverse. +- People mentioned in a post written from a Mastodon app are notified about it again. +- Podcast episodes and other attached files hosted outside your media library are now included when a post is sent to the Fediverse. +- Posts no longer send a second, smaller copy of the featured image, or the site icon when there is no featured image, which some apps showed as an extra image under the post. +- Post summaries now respect plugins that change or hide parts of the post content. +- Post summaries now stop at the "Read more" tag everywhere and keep the title of Details blocks. +- Queued activities now record their publication and edit times correctly on sites that are not set to UTC. +- Quote and feature requests are now only answered when they were sent to the account they ask. +- Quote requests are now only approved for posts that belong to the account asking. +- Replies found by searching for their address now follow your comment moderation settings instead of being approved right away. +- Replies sent through the ActivityPub API to posts on other servers are now delivered instead of being rejected. +- Replies to posts from accounts you follow no longer show up in your comments feed and comment widgets. +- Replies written through an ActivityPub app no longer mention the person you are replying to twice. +- Restore spam-protection checks for regular comments after a comment arrives from the fediverse. +- Signed requests from other servers are now checked more strictly, and requests that are not meant for your site are rejected before the sender's key is fetched. +- Signed requests from other servers are now only accepted when they are addressed to your site's address. Sites reached under more than one domain can allow the others with the `activitypub_signature_original_hosts` filter. +- Sites that turned off comment flood protection no longer get it switched back on by an incoming comment from the Fediverse. +- Skip unusable attachments on posts from other servers instead of showing them as broken images. +- Stop ActivityPub Likes, Reposts, and Quotes from leaking into the front-end comment list on sites that also use other comment-filtering plugins. +- Tags with underscores, like veranda_vestli, now keep their underscores when shared to the fediverse instead of being changed to camelCase. +- The "Powered by WordPress" profile field no longer shows up twice, no longer comes back after you delete it, and no longer triggers a warning when the plugin is first activated. +- The browser tab title of the settings page now shows the name of the current tab. +- The Followers and Following blocks now take their colours and font from the theme, so they are readable on dark themes, and they offer the usual colour, font size and spacing controls in the editor. +- The Reactions block no longer requests reactions in the editor for drafts, pages, and other content that is not shared to the Fediverse, which caused failed requests on every editor load. +- Tightened the checks on the screen where you approve apps for your account. + ### 9.3.1 - 2026-09-02 #### Security - Links to remote profiles in the Followers and Following blocks are now limited to regular web addresses when paging through the list. @@ -281,13 +384,9 @@ See full Changelog on [GitHub](https://github.com/Automattic/wordpress-activityp == Upgrade Notice == -= 9.3.0 = - -Posts sent to other servers are now signed with the newer RFC 9421 standard by default, so if deliveries to one server stop arriving, turn it off again in the Advanced tab of the ActivityPub settings, which you can show from Screen Options. - -= 9.2.0 = += 9.4.0 = -Support for the WP REST Cache plugin has been removed. If you use it, ActivityPub pages are no longer cached by it, but everything else works as before. +When people answer your posts from the Fediverse with a photo, it can now show right below their comment. Turn on images in replies in the ActivityPub settings. == Installation == diff --git a/snippets/disable-wp-rest-api/disable-wp-rest-api.php b/snippets/disable-wp-rest-api/disable-wp-rest-api.php index 00fe845776..bcd6c3c251 100644 --- a/snippets/disable-wp-rest-api/disable-wp-rest-api.php +++ b/snippets/disable-wp-rest-api/disable-wp-rest-api.php @@ -25,7 +25,7 @@ /** * Allow the current ActivityPub request through Disable WP REST API. * - * @since unreleased + * @since 9.4.0 * * @param false|string|string[] $allowed Existing allowed request URIs. * @return false|string|string[] Allowed request URIs. diff --git a/src/extra-fields/block.json b/src/extra-fields/block.json index 32eb2138a2..d5ce2e93a4 100644 --- a/src/extra-fields/block.json +++ b/src/extra-fields/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/extra-fields", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Fediverse Extra Fields", "category": "widgets", "description": "Display extra fields from Fediverse user profiles.", diff --git a/src/follow-me/block.json b/src/follow-me/block.json index 88f13111aa..87f584327d 100644 --- a/src/follow-me/block.json +++ b/src/follow-me/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/follow-me", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Follow me on the Fediverse", "category": "widgets", "description": "Display your Fediverse profile so that visitors can follow you.", diff --git a/src/followers/block.json b/src/followers/block.json index 1483af0ce5..44c08ebdb0 100644 --- a/src/followers/block.json +++ b/src/followers/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/followers", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Fediverse Followers", "category": "widgets", "description": "Display your followers from the Fediverse on your website.", diff --git a/src/following/block.json b/src/following/block.json index 48266c0813..c9d204896b 100644 --- a/src/following/block.json +++ b/src/following/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/following", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Fediverse Following", "category": "widgets", "description": "Display the accounts you follow in the Fediverse on your website.", diff --git a/src/posts-and-replies/block.json b/src/posts-and-replies/block.json index 85fc31b555..aca01304d2 100644 --- a/src/posts-and-replies/block.json +++ b/src/posts-and-replies/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/posts-and-replies", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Posts and Replies", "category": "widgets", "description": "Display a tab bar to filter between posts only and posts with replies on author archives.", diff --git a/src/quote/block.json b/src/quote/block.json index bfa31653e7..7797b65dcb 100644 --- a/src/quote/block.json +++ b/src/quote/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "apiVersion": 3, "name": "activitypub/quote", - "version": "9.3.1", + "version": "9.4.0", "title": "Federated Quote", "category": "widgets", "icon": "format-quote", diff --git a/src/reactions/block.json b/src/reactions/block.json index 7b509dc2e8..91c3db9ce3 100644 --- a/src/reactions/block.json +++ b/src/reactions/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/reactions", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Fediverse Reactions", "category": "widgets", "icon": "heart", diff --git a/src/remote-reply/block.json b/src/remote-reply/block.json index 1f333a4e7a..ff11af6b09 100644 --- a/src/remote-reply/block.json +++ b/src/remote-reply/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/remote-reply", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "Reply on the Fediverse", "category": "widgets", "description": "Allow visitors to reply to your posts from their Fediverse account.", diff --git a/src/reply/block.json b/src/reply/block.json index 7faf8cbf5a..69d65b127a 100644 --- a/src/reply/block.json +++ b/src/reply/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "apiVersion": 3, "name": "activitypub/reply", - "version": "9.3.1", + "version": "9.4.0", "title": "Federated Reply", "category": "widgets", "icon": "admin-comments", diff --git a/src/stats/block.json b/src/stats/block.json index f278be0e55..9d081929bc 100644 --- a/src/stats/block.json +++ b/src/stats/block.json @@ -2,7 +2,7 @@ "$schema": "https://schemas.wp.org/trunk/block.json", "name": "activitypub/stats", "apiVersion": 3, - "version": "9.3.1", + "version": "9.4.0", "title": "ActivityPub Stats", "category": "widgets", "description": "Display your annual Fediverse stats as a shareable card.",