What's Changed
- Fix: constrain image sizes in email notifications by @faisalahammad in #3637
- Federate enclosures that are not in the media library by @pfefferle in #3728
- Use the Miscellaneous Terms context instead of declaring the terms by @pfefferle in #3704
- Seed "Powered by" with the other default profile fields by @pfefferle in #3730
- Strip emoji from the blog profile ID by @pfefferle in #3731
- fix: only count previously approved normal comments for auto-approval by @faisalahammad in #3636
- Process inbox activities once, after they are stored by @pfefferle in #3732
- Keep the plain mention in statuses posted from Mastodon apps by @akirk in #3734
- Do not answer a request with a term from a taxonomy we do not federate by @pfefferle in #3744
- Open comment links on the page the comment is actually on by @pfefferle in #3678
- Only fetch reactions in the editor for posts the endpoint answers for by @pfefferle in #3752
- Add Polylang integration by @pfefferle in #3756
- Read feature settings on init, not at plugins_loaded by @pfefferle in #3768
- feat(comments): add link to source post for quotes and replies by @faisalahammad in #3754
- Federate the language a Mastodon app sets by @pfefferle in #3777
- Fix <title> tag on the ActivityPub settings page by @pilarmera in #3769
- Strip spans from federated comments by @pfefferle in #3789
- Compose AP comment-type exclusion with other plugins' filters by @pfefferle in #3315
- Do not prepend a mention the reply already carries by @pfefferle in #3680
- Stop posts from carrying an icon by @pfefferle in #3721
- Fix account move verification and notify followers by @pfefferle in #3585
- Add filter for federated comment types by @pfefferle in #3798
- feat(oauth): switch accounts on authorize screen by @faisalahammad in #3799
- Add custom display name and avatar for the blog profile by @faisalahammad in #3755
- Only accept image attachments for profile images by @pfefferle in #3804
- Deliver API replies to posts on other servers by @pfefferle in #3807
- Keep the reason a remote request failed by @pfefferle in #3808
- Add a seek endpoint for collections (SWICG Seek Item) by @pfefferle in #3549
- Fix the dates and hidden recipients on outbox and inbox reads by @pfefferle in #3320
- Remote Actors:
wp_kses()expected unslashed inputs. by @dmsnell in #3812 - Require the read scope on every path to owner data by @pfefferle in #3814
- Check the user's capabilities in the outbox write handlers by @pfefferle in #3815
- Tighten the checks on the app consent screen by @pfefferle in #3816
- Rework the collection classes and fix what it surfaced by @pfefferle in #3527
- Add Federated Quote block (FEP-044f) by @pfefferle in #3803
- Stop re-downloading remote images that are already WebP by @pfefferle in #3818
- take the actor list colours from the theme by @pfefferle in #3837
- one rate limit for every endpoint that has one by @pfefferle in #3830
- open the inspector without the view transition by @pfefferle in #3845
- one snackbar list, css transitions for the drawer by @pfefferle in #3844
- clean up the duplicate cache files #3818 left behind by @pfefferle in #3838
- Preserve canonical post URLs across status changes by @pfefferle in #3854
- Handle malformed ActivityPub object references by @pfefferle in #3855
- Proxy remote objects through one cached entry point by @pfefferle in #3793
- Validate resolved signing-key identities by @pfefferle in #3858
- Fix PHP 8.5 deprecation notices by @pfefferle in #3864
- Keep kses output tests and MathML working with WordPress 7.2 by @pfefferle in #3863
- Improve handling of HTML comments in remote content by @pfefferle in #3865
- Fix local account status counts in Enable Mastodon Apps integration by @akirk in #3884
- Remove the apply_filters attribute of [ap_content] by @pfefferle in #3880
- Only approve quote requests for the requester's own post by @pfefferle in #3881
- Support internationalized WebFinger handles by @pfefferle in #3882
- Cut the handle host at a path by @pfefferle in #3899
- Only approve feature requests for the requester's own collection by @pfefferle in #3891
- Anchor the well-known rewrite rules by @pfefferle in #3902
- Skip unusable attachments on remote posts by @pfefferle in #3866
- Keep reader replies out of the comments feed by @pfefferle in #3911
- Add a Counts style to the Reactions block by @pfefferle in #3917
- Add margin and padding settings to the Reactions block by @pfefferle in #3926
- Use the theme's link color for the Reactions Counts style by @pfefferle in #3927
- Only answer quote and feature requests sent to the owner by @pfefferle in #3925
- Fix the user selection in blocks when a user can't be edited by @pfefferle in #3934
- Show a placeholder for reactions without an action and align the buttons by @pfefferle in #3935
- Keep underscores in hashtags by @faisalahammad in #3939
- Display images attached to Fediverse comments by @pfefferle in #3850
- Only match the site address in signature and actor checks by @pfefferle in #3942
- Only verify signatures made out to this site by @pfefferle in #3964
- Sign the port along with the host by @pfefferle in #3965
- Read X-Original-Host in the RFC 9421 verifier by @pfefferle in #3966
- Only verify signatures for a bare host by @pfefferle in #3967
- Only deliver locally to inbox routes by @pfefferle in #3968
- Keep mismatched Accept headers out of the LiteSpeed cache by @pfefferle in #3969
- Leave moderation alone when searching for a reply by @pfefferle in #3970
- Only feature publicly queryable posts by @pfefferle in #3971
- Only accept follows for the named recipient by @pfefferle in #3972
- Only the author may change a reply by @pfefferle in #3974
- Require signatures to cover this site and the body by @pfefferle in #3977
- Only accept activities signed with the actor's own key by @pfefferle in #3979
- Only accept a Move listed by the actor id by @pfefferle in #3981
- Fill in defaults for registered comment types by @pfefferle in #3982
- Refresh a stored actor when its key fails to verify by @pfefferle in #3983
- Deliver locally on subdirectory and plain-permalink installs by @pfefferle in #3986
- Check content owners' blocks for incoming activities by @pfefferle in #3988
- Leave a failed reply import out of the search redirect by @pfefferle in #3990
New Contributors
- @faisalahammad made their first contribution in #3637
- @pilarmera made their first contribution in #3769
- @dmsnell made their first contribution in #3812
Full Changelog: 9.3.1...9.4.0