ActivityPub

Changelog

9.1.0 – 2026-07-22

Security

• Ensure apps you connect can only act within the access you granted them, and not make wider changes to your site.
• Ensure remote profiles and content are served from the address they claim before storing them.
• Fix a security issue where a remote actor’s profile link could run scripts in the admin area.
• Ignore an incoming follow request whose actor resolves to a different account than the one that sent it.

Added

• Add a filter that allows federating with servers on private or internal networks.
• Add an actor autocomplete endpoint so Fediverse apps can offer typeahead search when mentioning people.
• Federate the episode summary for Podlove Podcast Publisher episodes.

Changed

• Improve reliability of the Social Web admin screen loading.
• Improve the internal handling of the Application actor used for server-to-server requests.

Fixed

• Ensure a follow can only be declined by the account you followed.
• Fixed using the correct cache representation in Surge config
• Fix follow requests from some fediverse services staying pending after they are accepted.
• Fix likes from some accounts being recorded as multiple duplicate comments.
• Fix posts being removed from the Fediverse when edited while scheduled for a future publish date.
• Fix repeated deliveries of a like or repost creating new comments after the original was marked as spam or moved to the trash.
• Fix Starter Kit imports failing on Fediverse servers that require signed requests.
• Fix the scheduled refresh of remote profiles so it actually re-fetches from the remote server. Previously, stale avatars and bios for commenters never updated until they sent a new activity to your site.
• Fix URLs with multiple query parameters (such as avatars, images, profile links, and podcast media) being corrupted in content sent to the Fediverse.
• Prevent caching non-actor objects (such as notes) as remote profiles.
• Refresh cached remote profiles in place during scheduled updates to avoid creating duplicate copies.
• Show the Fediverse Preview for scheduled posts instead of the regular post preview.
• Stop storing responses from remote servers in the database when they were requested uncached.

9.0.2 – 2026-06-29

Fixed

• Improve handling of content received from other servers.

9.0.1 – 2026-06-15

Added

• Add FAQ guides that help solve follow requests stuck on “pending” and comments from the Fediverse not showing up.

Fixed

• Notify followers about your new preference when the Starter Kit policy setting changes, so other servers no longer act on an outdated one.
• Publish the Starter Kit consent policy only on your own blog and author profiles, no longer on system or third-party profiles.
• Starter Kit consent now also works for the blog profile, not just for individual authors.

9.0.0 – 2026-06-10

Security

• Enforce the signing-key host check on incoming federated activities regardless of how the key identifier is formatted.
• Fix the real-time activity stream so it only returns the requesting user’s own activities.
• Harden the Site Health connectivity check so it cannot be used to reach unsafe network addresses.
• Only share comment replies in the Fediverse when the post they belong to is itself federated, so replies on private or non-federated posts stay private.
• Prevent a remote server from discovering which of your followers belong to a third-party server it does not control.
• Prevent logged-in users from viewing another user’s private outbox activities.
• Prevent remote servers from modifying or deleting federated profiles, posts, and interactions they do not own.
• Rate-limit the remote-follow lookup to prevent it from being abused to trigger outbound requests.
• Stop the OAuth token introspection endpoint from revealing another user’s token details to logged-in users.
• Stop the quote-authorization stamp from exposing a post’s other metadata.

Added

• Add a Distribution Mode setting to control how quickly posts are delivered to followers.
• Add an opt-in setting to consent to inclusion in Starter Kits (also called Starter Packs or Featured Collections). Off by default. Find it under Settings, ActivityPub, Activities.
• C2S clients can now request canonical SWICG ActivityPub API scope names such as activitypub:read:all and activitypub:write:all, and the OAuth discovery metadata advertises them.
• C2S token responses now include activitypub_actor_id so clients following the SWICG ActivityPub API Basic Profile can discover the authenticated actor.
• Generate a blurred color preview (blurhash) for images so other fediverse apps can show a placeholder while your photos load.
• Quote notification emails now include a link to the post that quoted you, so you can review and respond more quickly.
• Warn in the editor before making a post that’s already shared on the Fediverse a draft, private, or password-protected, since followers’ copies will be removed.

Changed

• Add the blurhash term to the outbound JSON-LD @context so attachments that include a blurhash property are strictly correct JSON-LD, matching Mastodon’s own context shape.
• Federated posts moved to draft, pending, private, trash, or password-protected now send a Delete to followers (previously sent a placeholder “editing” Update or were silent).
• OAuth rate-limit responses now include a Retry-After header so clients know how long to wait before retrying.
• Updated a build dependency to a clean release now that a fixed version is available.

Removed

• Removed functions, methods, and the Follower class that were deprecated in versions 7.0 through 7.4.

Fixed

• Fix a fatal error when receiving a new follower while the Stream plugin is active.
• Fix a follow request being marked as accepted when the confirmation came from a different account than the one being followed.
• Fix the Fediverse settings appearing twice and visibility changes not saving in the block editor when the Classic Editor plugin is also active.
• Fix the introduction video failing to load on the Getting Started help screen.
• Follower synchronization with Mastodon no longer fails, signed requests with query strings now verify correctly.
• Harden the Blurhash encoder: skip decompression-bomb images before decoding, flatten transparency onto white so transparent logos no longer produce near-black placeholders, and defer the cron encode until attachment metadata is saved.
• Images and videos placed in a Media & Text block are now included when a post is shared to the Fediverse.
• Requests from other platforms to feature your posts are now handled correctly instead of being ignored.
• RSS and Atom feeds now show a simple @username mention in place of the reply block’s full embed card, which only renders properly when the plugin’s frontend CSS is loaded.
• Stop a deprecation notice from appearing in the error log when the NodeInfo plugin is also active.

See full Changelog on GitHub.