ActivityPub

Änderungsprotokoll

7.6.1 – 2025-11-12

Fixed

• Fixed compatibility with Pixelfed and similar platforms by treating activities without recipients as public, ensuring boosts and reposts work correctly.
• Improved delete handling for remote replies by streamlining tombstone detection and simplifying object deletion for more reliable and consistent behavior.
• Made inbox cleanup more reliable and ensuring deduplication only affects the specific activity being removed.

7.6.0 – 2025-11-11

Added

• Add bidirectional transforms between reply and embed blocks for improved user experience.
• Add Command Palette integration for quick navigation to ActivityPub admin pages
• Added a new ap_object post type and taxonomies for storing and managing incoming ActivityPub objects, with updated handlers
• Added a privacy option to hide followers and following lists from profiles while keeping follow relationships intact.
• Added a scheduled task and setting to automatically purge old inbox items, helping maintain site performance and storage control.
• Added fallback to trigger create handling when updates fail for missing posts or comments, ensuring objects are properly created.
• Added immediate dispatch for Accept activities to speed up quoted posts while keeping scheduled processing for compatibility with other instances.
• Added new configuration options to better manage traffic spikes when federating posts, allowing finer control over retry limits, delays, and batch pauses.
• Added support for FEP-8fcf follower synchronization, improving data consistency across servers with new sync headers, digest checks, and reconciliation tasks.
• Add LiteSpeed Cache integration to prevent ActivityPub JSON responses from being cached incorrectly. Includes automatic .htaccess rules and Site Health check to ensure proper configuration.
• Add quote visibility setting for Classic Editor users.
• Add unified attachment processor for handling ActivityPub media imports from both remote URLs and local files, with automatic media block generation and Classic Editor support.
• Integrate Federated Reply block with WP.com Reader’s post share functionality, allowing users to reply to ActivityPub posts directly from the Reader.

Changed

• Added support for FEP-3b86 Activity Intents, extending WebFinger and REST interactions with new Create and Follow intent links.
• Added support for the latest NodeInfo (FEP-0151), with improved federation details, staff info, and software metadata for better ActivityPub compliance.
• Extended inbox support for undoing Like, Create, and Announce activities, with refactored undo logic and improved activity persistence.
• Improved Classic Editor integration by adding better media handling and full test coverage for attachments, permissions, and metadata.
• Improved delivery of public and follower activities by expanding local recipient handling to include all ActivityPub-capable users and follower collections.
• Improved inbox performance by batching and deduplicating activities, reducing redundant processing and improving handling during high activity periods.
• Improved REST API responses with smarter context handling.
• Improved REST collection pagination by using explicit total item counts for more accurate results.
• Moved default visibility handling from the server to the editor UI, ensuring consistent and flexible ActivityPub visibility settings across both block and classic editors.
• Prevented self-announcing by ignoring announces from the blog actor, while still processing announces from user and external actors.
• Refactored activity handling to support multiple recipients per activity, allowing posts and interactions to be linked to several local users at once.
• Refactored avatar handling into a new system that stores and manages avatars per remote actor, improving reliability and preparing for future caching support.
• Refactored the inbox system to use a shared inbox, storing activities once with multiple recipients for improved efficiency and reduced duplication.
• Reorganize integration loader and move Stream integration into dedicated folder structure.
• Reply posts: do not display post title before @mentions in posts that are replies to somebody else
• Simplified configuration by always enabling the shared inbox and removing its separate setting, UI field, and related logic.
• Simplified inbox storage settings, allowing certain activities (like deletes) to be skipped to reduce unnecessary database use.
• Simplify follow() API return types to int|WP_Error for better predictability.
• Updated inbox handling to support multiple users receiving the same activity and improve overall data consistency.
• Updated mailer hooks to send notifications only when activities are successfully handled, preventing emails for failed events.
• Update plugin short description to be more user-friendly.

Fixed

• Added a safeguard to ensure the plugin works correctly even when no post types are selected.
• Added a safety check to prevent errors when resolving comment author hostnames without a valid IP address.
• Fixed activity processing to handle QuoteRequest and other edge cases more reliably.
• Fixed an issue with post content templates to ensure the correct fallback is always applied.
• Fixed fatal error when transformer Factory receives WP_Error objects.
• Fixed HTML entity encoding in extra field names when displayed on ActivityPub platforms
• Fixed typo in example, improve quoting description.
• Fix Following table error message to display user input instead of empty string when webfinger lookup fails.
• Fix infinite recursion when storing remote actors with mentions in their bios
• Fix local inbox delivery to use internal REST API instead of HTTP, enabling local follows and proper boost counting.
• Fix logic errors in Move handler: remove redundant assignment and fix variable name collision.
• Fix public key retrieval for GoToSocial profiles with path-based key URLs.
• Improved actor resolution by prioritizing blog actor detection before remote actor checks and refining home page URL handling.
• Improved handling of empty fields for better compatibility with Pixelfed and more consistent fallback behavior across actor names, URLs, and related data.
• Improved hashtag encoding for consistent formatting.
• Improved Jetpack integration by initializing it during the WordPress startup process.
• Refactored Mastodon import handling to use consistent array-based data, improving reliability and compatibility across all import scenarios.
• Reply block now properly validates ActivityPub URLs before setting inReplyTo field

7.5.0 – 2025-10-01

Added

• Added a setting to control who can quote your posts.
• Added support for QuoteRequest activities (FEP-044f), enabling proper handling, validation, and policy-based acceptance or rejection of quote requests.
• Add upgrade routine to enable ActivityPub feeds in WordPress.com Reader
• Add Yoast SEO integration for author archives site health check.
• Improved interaction policies with clearer defaults and better Mastodon compatibility.
• New site health check warns if active Captcha plugins may block ActivityPub comments.
• Sync following meta to enable RSS feed subscriptions for ActivityPub actors in WordPress.com Reader
• You can now follow people and see their updates right in the WordPress.com Reader when using Jetpack or WordPress.com.

Changed

• Added support for fetching actors by account identifiers and improved reliability of actor retrieval.
• Clarify error messages in account modal to specify full profile URL format.
• Improved checks to better identify public Activities.
• Improved compatibility by making the ‚implements‘ field always use multiple entries.
• Improved recipient handling for clarity and improved visibility handling of activities.
• Remote reply blocks now sync account info across all blocks on the same page
• Standardized notification handling with new hooks for better extensibility and consistency.
• Updated sync allowlist to add support for Jetpack notifications of likes and reposts.

Fixed

• Fixed an issue where post metadata in the block editor was missing or failed to update.
• Fix Flag activity object list processing to preserve URL arrays
• Fix PHP warning in bulk edit scenario when post_author is missing from $_REQUEST
• Posts now only fall back to the blog user when blog mode is enabled and no valid author exists, ensuring content negotiation only runs if an Actor is available.

7.4.0 – 2025-09-15

Added

• Add activitypub_json REST field for ap_actor posts to access raw JSON data
• Add Delete activity support for permanently deleted federated comments.
• Added a new WP-CLI command to manage Actors.
• Added confirmation step for bulk removal of ActivityPub capability, asking whether to also delete users from the Fediverse.
• Adds support for virtual deletes and restores, allowing objects to be removed from the fediverse without being deleted locally.
• Add Yoast SEO integration for media pages site health check
• Optimized WebFinger lookups by centralizing and caching account resolution for faster, more consistent handling across lists.

Changed

• Clarified the ‚attachment‘ post type description to explain it refers to media library uploads and recommend disabling federation in most cases.
• Hide site-wide checkbox in block confirmations when accessed from ActivityPub settings page
• Improved ActivityPub compatibility by aligning with Mastodon’s Application Actor.
• It’s now possible to reply to multiple posts using multiple reply blocks.
• Refactored Reply block to use WordPress core embed functionality for better compatibility and performance.
• Use wp_interactivity_config() for static values instead of wp_interactivity_state() to improve performance and code clarity

Deprecated

• ActivityPub now defaults to automated object type selection, with the old manual option moved to Advanced settings for compatibility.

Fixed

• Fix content visibility override issue preventing authors from changing visibility on older posts.
• Fix PHP warning when saving ActivityPub settings.
• Fix query args preservation in collection pagination links
• Fix release script to catch more ‚unreleased‘ deprecation patterns that were previously missed during version updates.
• Fix reply block rendering inconsistency where blocks were always converted to @-mentions in ActivityPub content. Now only first reply blocks become @-mentions, others remain as regular links.
• Stop sending follow notifications to the Application user, since system-level accounts cannot be followed.

7.3.0 – 2025-08-28

Added

• Add actor blocking functionality with list table interface for managing blocked users and site-wide blocks
• Add code coverage reporting to GitHub Actions PHPUnit workflow with dedicated coverage job using Xdebug
• Add comprehensive blocking and moderation system for ActivityPub with user-specific and site-wide controls for actors, domains, and keywords.
• Add comprehensive unit tests for Followers and Following table classes with proper ActivityPub icon object handling.
• Added link and explanation for the existing Starter Kit importer on the help tab of the Following pages.
• Adds a self-destruct feature to remove a blog from the Fediverse by sending Delete activities to followers.
• Adds a User Interface to select accounts during Starter Kit import
• Adds support for importing Starter Kits from a link (URL).
• Adds support for searching (remote) URLs similar to Mastodon, redirecting to existing replies or importing them if missing.
• Adds support for sending Delete activities when a user is removed.
• Adds support for Starter Kit collections in the ActivityPub API.
• A global Inbox handler and persistence layer to log incoming Create and Update requests for debugging and verifying Activity handling.
• Follower lists now include the option to block individual accounts.
• Improved handling of deleted content with a new unified system for better tracking and compatibility.
• Moderation now checks blocked keywords across all language variants of the content, summary and name fields.
• When activated or deactivated network-wide, the plugin now refreshes rewrite rules across all sites.

Changed

• Add default avatars for actors without icons in admin tables
• Added support for list of Actor IDs in Starter Kits.
• Improve Following class documentation and optimize count methods for better performance
• Refactor actor blocking with unified API for better maintainability

Fixed

• Blocks relying on user selectors no longer error due to a race condition when fetching users.
• Fix duplicate HTML IDs and missing form labels in modal blocks
• Fix malformed ActivityPub handles for users with email-based logins (e.g., from Site Kit Google authentication)
• Fix PHP 8.4 deprecation warnings by preventing null values from being passed to WordPress core functions
• Improves handling of author URLs by converting them to a proper format.
• Improves REST responses by skipping invalid actors in Followers and Following controllers.
• More reliable Actor checks during the follow process.
• Prevents Application users from being followed.
• Proper implementation of FEP 844e.
• Switches ActivityPub summaries to plain text for better compatibility.

7.2.0 – 2025-07-30

Added

• Add image attachment support to federated comments – HTML images in comment content now include proper ActivityStreams attachment fields.
• Link to the following internal dialog for remote interactions, if the feature is enabled.
• The followers list now shows follow status and allows quick follow-back actions.
• Trigger Actor updates on (un)setting a post as sticky.
• You can now use OrderedCollections as starter packs — just drop in the output from a Follower or Following endpoint.

Changed

• Ensure that tests run in production-like conditions, avoiding interference from local development tools.
• Moved HTTP request signing to a filter instead of calling it directly.

Fixed

• Allow non-administrator users to use Follow Me and Followers blocks
• Correct linking from followers to the following list
• Fix avatar rendering for followers with missing icon property
• Fix multibyte character corruption in post summaries, preventing Greek and other non-ASCII text from being garbled during text processing.
• Informational Fediverse blocks are no longer rendered when posts get added to the Outbox.

7.1.0 – 2025-07-23

Added

• Added a first version of the Follow form, allowing users to follow other Actors by username or profile link.
• Added initial support for Fediverse Starter Kits, allowing users to follow recommended accounts from a predefined list.
• Ensure that all schedulers are registered during every plugin update.
• Followers and Following list tables now support Columns and Pagination screen options.
• The featured tags endpoint is now available again for all profiles, showing the most frequently used tags by each user.
• The following endpoint now returns the actual list of users being followed.

Changed

• Follower tables now look closer to what other tables in WordPress look like.
• Improved Account-Aliases handling by internally normalizing input formats.
• Minor performance improvement when querying posts of various types, by avoiding double queries.
• Set older unfederated posts to local visibility by default.
• Step counts for the Welcome checklist now only take into account steps that are added in the Welcome class.
• Table actions are now faster by using the Custom Post Type ID instead of the remote user URI, thanks to the unified Actor Model.
• The following tables now more closely match the appearance of other WordPress tables and can be filtered by status.

Fixed

• Ensure correct visibility handling for Undo and Follow requests
• Ensure that the Actor-ID is always a URL.
• Fixed a bug in how follow requests were accepted to ensure they work correctly.
• Fixed an issue where the number of followers shown didn’t always match the actual follower list.
• Fixed a PHP error that prevented the Follower overview from loading.
• Fixed missing avatar class so that CSS styles are correctly applied to ActivityPub avatars on the Dashboard.
• Fixed potential errors when unrelated requests get caught in double-knocking callback.
• Improved WebFinger fallback to better guess usernames from profile links.
• Prevent WordPress from loading all admin notices twice on ActivityPub settings pages.
• Removed follower dates to avoid confusion, as they may not have accurately reflected the actual follow time.
• Stop purging Follow activities from the Outbox to allow proper Unfollow (Undo) handling.

7.0.1 – 2025-07-10

Fixed

• When deleting interactions for cleaned up actors, we use the actor’s URL again to retrieve their information instead of our internal ID.

7.0.0 – 2025-07-09

Added

• Added basic support for handling remote rejections of follow requests.
• Added basic support for RFC-9421 style signatures for incoming activities.
• Added initial Following support for Actors, hidden for now until plugins add support.
• Added missing „Advanced Settings“ details to Site Health debug information.
• Added option to auto-approve reactions like likes and reposts.
• Added support for namespaced attributes and the dcterms:subject field (FEP-b2b8), as a first step toward phasing out summary-based content warnings.
• Added support for the WP Rest Cache plugin to help with caching REST API responses.
• Documented support for FEP-844e.
• Optional support for RFC-9421 style signatures for outgoing activities, including retry with Draft-Cavage-style signature.
• Reactions block now supports customizing colors, borders, box-shadows, and typography.
• Support for sending follow requests to remote actors is now in place, including outbox delivery and status updates—UI integration will follow later.

Changed

• Comment feeds now show only comments by default, with a new type filter (e.g., like, all) to customize which reactions appear.
• Consistent naming of Blog user in Block settings.
• hs2019 signatures for incoming REST API requests now have their algorithm determined based on their public key.
• Likes, comments, and reposts from the Fediverse now require either a name or preferredUsername to be set when the Discussion option require_name_email is set to true. It falls back to „Anonymous“, if not.
• Management of public/private keys for Actors now lives in the Actors collection, in preparation for Signature improvements down the line.
• Notification emails for new reactions received from the Fediverse now link to the moderation page instead of the edit page, preventing errors and making comment management smoother.
• Plugins now have full control over which Settings tabs are shown in Settings > Activitypub.
• Reworked follower structure to simplify handling and enable reuse for following mechanism.
• Screen options in the Activitypub settings page are now filterable.
• Setting the blog identifier to empty will no longer trigger an error message about it being the same as an existing user name.
• Step completion tracking in the Welcome tab now even works when the number of steps gets reduced.
• The image attachment setting is no longer saved to the database if it matches the default value.
• The welcome page now links to the correct profile when Blog Only mode was selected in the profile mode step.
• Unified retrieval of comment avatars and re-used core filters to give access to third-part plugins.

Fixed

• Allow interaction redirect URLs that contain an ampersand.
• Comments received from the Fediverse no longer show an Edit link in the comment list, despite not being editable.
• Fixed an issue where links to remote likes and boosts could open raw JSON instead of a proper page.
• Fixed a potential error when getting an Activitypub ID based on a user ID.
• HTTP signatures using the hs2019 algorithm now get accepted without error.
• Improved compatibility with older follower data.
• Inbox requests that are missing an algorithm parameter in their signature no longer create a PHP warning.
• Interaction attempts that pass a webfinger ID instead of a URL will work again.
• Names containing HTML entities now get displayed correctly in the Reactions block’s list of users.
• Prevent storage of empty or default post meta values.
• The amount of avatars shown in the Reactions block no longer depends on the amount of likes, but is comment type agnostic.
• The command-line interface extension, accidentally removed in a recent cleanup, has been restored.
• The image attachment setting now correctly respects a value of 0, instead of falling back to the default.
• The Welcome screen now loads with proper styling when shown as a fallback.
• Using categories as hashtags has been removed to prevent conflicts with tags of the same name.
• When verifying signatures on incoming requests, the digest header now gets checked as expected.

See full Changelog on GitHub.