What's Changed
- Improve SWICG ActivityPub API Basic Profile conformance for C2S by @pfefferle in #3328
- Add blurhash term to JSON-LD context by @kraftbj in #3327
- Update @tanstack/history to clean release, remove supply-chain pin by @pfefferle in #3346
- Render the reply block as a simple mention link in feeds by @jeherve in #3340
- Use nodeinfo_discovery hook instead of deprecated wellknown_nodeinfo_data by @pfefferle in #3347
- Add FEP-7aa9 consent endpoint for featured collections by @pfefferle in #3277
- Defer Getting Started help-tab video until its panel is visible by @pfefferle in #3350
- Add the quoting post link to quote notification emails by @pfefferle in #3351
- Don't add the classic Fediverse metabox in the block editor by @pfefferle in #3354
- Scope the outbox event stream to the requesting actor by @pfefferle in #3356
- Bind the signing-key host to the actor for RFC 9421 keyIds by @pfefferle in #3357
- Gate outbox visibility on strict ownership instead of capability by @pfefferle in #3358
- Rate-limit the remote-follow lookup endpoint by @pfefferle in #3361
- Scope OAuth token introspection to the caller's own tokens by @pfefferle in #3363
- Restrict quote stamps to quote-authorization meta by @pfefferle in #3364
- Bind inbound Update and Undo activities to the activity actor by @pfefferle in #3360
- Add configurable distribution modes for federation delivery by @pfefferle in #3044
- Add Blurhash placeholders for federated images by @pfefferle in #3355
- Append the query string when rebuilding (request-target) for signature verification by @Kernel-Error in #3369
- Fix fatal error in Stream connector on new follower by @pfefferle in #3372
- Extend soft delete to draft, pending, and private post statuses by @pfefferle in #2860
- Federate comments only when the parent post is federated by @pfefferle in #3374
- Verify Accept sender matches the followed actor by @pfefferle in #3377
- Backfill missing inbox actor from HTTP signature keyId by @pfefferle in #3385
- Remove deprecations from versions 7.0 through 7.4 by @pfefferle in #3387
- Harden the Blurhash encoder against decode bombs, transparency, and metadata races by @kraftbj in #3386
- Fix FEP-8fcf followers-sync authority bypass by @pfefferle in #3390
- Use wp_safe_remote_get() for the Site Health REST API check by @pfefferle in #3391
New Contributors
- @mahangu made their first contribution in #3368
- @Kernel-Error made their first contribution in #3369
Full Changelog: 8.3.0...9.0.0