Release 8.0.0

CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.0.0] - 2026-03-04
+### Security
+- Prevent private recipient lists from being shared when sending activities to other servers. [#2956]
+
+### Added
+- Add a help section to interaction dialogs explaining the Fediverse and why entering a profile is needed. [#2993]
+- Add a notice on the Settings page to easily switch from legacy template mode to automatic mode. [#2985]
+- Add a pre-publish suggestion that recommends a post format for better compatibility with media-focused Fediverse platforms. [#2971]
+- Add a Site Health check that warns when plugins are causing too many federation updates. [#2928]
+- Add backwards compatibility for the `ACTIVITYPUB_DISABLE_SIDELOADING` constant and `activitypub_sideloading_enabled` filter from version 7.9.1. [#2973]
+- Add bot account snippet that marks ActivityPub profiles as automated accounts, displaying a "BOT" badge on Mastodon and other Fediverse platforms. [#2861]
+- Add Cache namespace for remote media caching with CLI commands, improved MIME validation, and filter-based architecture. [#2887]
+- Add federation of video poster images set in the WordPress video block. [#2982]
+- Add Locale from Tags community snippet. [#2923]
+- Add optional Like and Boost action buttons to the Fediverse Reactions block, allowing visitors to interact with posts from their own server. [#2988]
+- Add pre-built Fediverse block patterns for easy profile, follow page, and sidebar setup. [#2891]
+- Add snippet for blockless fediverse reactions [#2958]
+- Add `wp activitypub fetch` CLI command for fetching remote URLs with signed HTTP requests. [#2906]
+
+### Changed
+- Improved active user counting for NodeInfo to include all federated content types and comments. [#2943]
+- Improve language map resolution to strictly follow the ActivityStreams spec. [#2979]
+- Superseded outbox activities are now removed instead of kept, reducing clutter in the outbox. [#2932]
+- The minimum required PHP version is now 7.4. [#2942]
+
+### Fixed
+- Accept incoming activities from servers that use standalone key objects for HTTP Signatures. [#2935]
+- Fix a crash on servers where WordPress uses FTP instead of direct file access for media caching. [#2974]
+- Fix a crash when receiving posts from certain federated platforms that send multilingual content. [#2950]
+- Fix automatic cleanup of old activities failing silently on sites with large numbers of outbox, inbox, or remote post items. [#2929]
+- Fix comment count to properly exclude likes, shares, and notes. [#2913]
+- Fix follow button redirect from Mastodon not being recognized. [#2922]
+- Fix modal overlay not covering the full screen on block themes. [#3000]
+- Fix outbox invalidation canceling pending Accept/Reject responses to QuoteRequests for the same post. [#2911]
+- Fix QuoteRequest handler to derive responding actor from post author instead of inbox recipient. [#2924]
+- Fix reactions block buttons inheriting theme background color on classic themes. [#2996]
+- Fix reactions block layout on small screens and remove unwanted button highlight when clicking action buttons. [#2992]
+- Fix signature verification rejecting valid requests that use lowercase algorithm names in the Digest header. [#2949]
+- Fix soft-deleted posts being served instead of a tombstone when the post is re-saved. [#2991]
+- Improve compatibility with federated services that use a URL reference for the actor's public key. [#2947]
+- Improve handling of all public audience identifiers when sending activities to followers and relays. [#2944]
+
 ## [7.9.1] - 2026-02-09
 ### Added
 - Add option to disable direct file sideloading via `ACTIVITYPUB_DISABLE_SIDELOADING` constant or `activitypub_sideloading_enabled` filter, and `activitypub_remote_media_url` filter for CDN proxying. [#2899]
@@ -1691,6 +1733,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - initial
 
+[8.0.0]: https://github.com/Automattic/wordpress-activitypub/compare/7.9.1...8.0.0
 [7.9.1]: https://github.com/Automattic/wordpress-activitypub/compare/7.9.0...7.9.1
 [7.9.0]: https://github.com/Automattic/wordpress-activitypub/compare/7.8.5...7.9.0
 [7.8.5]: https://github.com/Automattic/wordpress-activitypub/compare/7.8.4...7.8.5

activitypub.php

@@ -3,7 +3,7 @@
  * Plugin Name: ActivityPub
  * Plugin URI: https://github.com/Automattic/wordpress-activitypub
  * Description: The ActivityPub protocol is a decentralized social networking protocol based upon the ActivityStreams 2.0 data format.
- * Version: 7.9.1
+ * Version: 8.0.0
  * Author: Matthias Pfefferle & Automattic
  * Author URI: https://automattic.com/
  * License: MIT
@@ -17,7 +17,7 @@
 
 namespace Activitypub;
 
-\define( 'ACTIVITYPUB_PLUGIN_VERSION', '7.9.1' );
+\define( 'ACTIVITYPUB_PLUGIN_VERSION', '8.0.0' );
 
 // Plugin related constants.
 \define( 'ACTIVITYPUB_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

includes/cache/class-file.php

@@ -292,7 +292,7 @@ public static function invalidate_entity( $entity_id ) {
 	 * the web server — the same assumption WordPress core makes for media
 	 * uploads in _wp_handle_upload().
 	 *
-	 * @since unreleased
+	 * @since 8.0.0
 	 *
 	 * @return \WP_Filesystem_Direct The direct filesystem instance.
 	 */
@@ -312,7 +312,7 @@ protected static function get_filesystem() {
 	/**
 	 * Delete a directory and all its contents.
 	 *
-	 * @since unreleased
+	 * @since 8.0.0
 	 *
 	 * @param string $basedir The directory path to delete.
 	 *

includes/class-blocks.php

@@ -723,7 +723,7 @@ class="activitypub-modal__close wp-element-button"
 	 * Outputs a collapsible `<details>` element that explains decentralized
 	 * interactions to users unfamiliar with the Fediverse.
 	 *
-	 * @since unreleased
+	 * @since 8.0.0
 	 */
 	public static function render_modal_help() {
 		?>

includes/class-cache.php

@@ -53,11 +53,11 @@ public static function is_enabled() {
 		 * {@see 'activitypub_remote_cache_enabled'} in a subsequent release.
 		 *
 		 * @since 7.9.1
-		 * @deprecated unreleased Use {@see 'activitypub_remote_cache_enabled'} instead.
+		 * @deprecated 8.0.0 Use {@see 'activitypub_remote_cache_enabled'} instead.
 		 *
 		 * @param bool $enabled Whether sideloading is enabled. Default true.
 		 */
-		if ( ! \apply_filters_deprecated( 'activitypub_sideloading_enabled', array( true ), 'unreleased', 'activitypub_remote_cache_enabled' ) ) {
+		if ( ! \apply_filters_deprecated( 'activitypub_sideloading_enabled', array( true ), '8.0.0', 'activitypub_remote_cache_enabled' ) ) {
 			return false;
 		}
 

includes/class-comment.php

@@ -936,7 +936,7 @@ public static function pre_wp_update_comment_count_now( $new_count, $old_count,
 				 * a single query can exclude types from multiple plugins. Other
 				 * plugins can hook here to add their own comment types.
 				 *
-				 * @since unreleased
+				 * @since 8.0.0
 				 *
 				 * @param string[] $excluded_types The comment type slugs to exclude.
 				 * @param int      $post_id        The post ID.

includes/class-dispatcher.php

@@ -329,7 +329,7 @@ private static function send_to_local_inbox( $inbox_url, $json ) {
 	 * Used as a temporary filter on `activitypub_activity_object_array` so that
 	 * `to_json()` handles encoding consistently.
 	 *
-	 * @since unreleased
+	 * @since 8.0.0
 	 *
 	 * @see https://www.w3.org/TR/activitypub/#delivery
 	 *

includes/class-migration.php

@@ -220,7 +220,7 @@ public static function maybe_migrate() {
 			\wp_schedule_single_event( \time(), 'activitypub_migrate_actor_emoji' );
 		}
 
-		if ( \version_compare( $version_from_db, 'unreleased', '<' ) ) {
+		if ( \version_compare( $version_from_db, '8.0.0', '<' ) ) {
 			Activitypub::flush_rewrite_rules();
 		}
 

includes/class-webfinger.php

@@ -280,7 +280,7 @@ public static function guess( $actor_or_uri ) {
 	/**
 	 * Get the Intent endpoint for a given URI and intent.
 	 *
-	 * @since unreleased
+	 * @since 8.0.0
 	 *
 	 * @see https://codeberg.org/fediverse/fep/src/branch/main/fep/3b86/fep-3b86.md
 	 *

includes/collection/class-remote-actors.php

@@ -690,7 +690,7 @@ public static function get_public_key( $key_id ) {
 	 * 2. Actor objects with a `publicKey` URL reference (e.g. `tags.pub`).
 	 *    The URL is dereferenced and the key's owner is verified against the actor.
 	 *
-	 * @since unreleased
+	 * @since 8.0.0
 	 *
 	 * @param array $data The fetched actor JSON data.
 	 *

includes/rest/class-post-controller.php

@@ -207,7 +207,7 @@ public function get_context( $request ) {
 	/**
 	 * Get the remote intent template for a post.
 	 *
-	 * @since unreleased
+	 * @since 8.0.0
 	 *
 	 * @param \WP_REST_Request $request The request.
 	 *