fediverse

<div class="article-body"> <p>This release is mostly made up of behind-the-scenes improvements, but one update you’ll notice right away is the refreshed Followers table. It now looks and feels much more like the standard WordPress admin tables: you can customize it with screen options to hide columns or change how many followers are shown per page, and you can now delete individual followers using inline action links. We also polished the layout by increasing information density and improving the readability of date columns.</p><p>We’ve made migrations easier to kick off by automatically resolving account aliases and saving their ID form. That means you can now paste in WebFinger IDs, profile URLs, etc. and the plugin handles the rest, as long as it resolves to an ActivityPub profile.</p><p>This release also fixes a long-time annoyance: unfederated posts (like those published before the plugin was activated or imported later) will no longer be sent out to followers just because they were updated. For now, we use a simple cutoff for posts older than a month, which should cover the majority of those cases.</p><p>Coming Soon: Following Others!</p><p>Most of the work that went into this release is still invisible, hiding behind a feature flag in Advanced Settings (you can find it by opening Screen Options in the ActivityPub settings screen).</p><p>There’s really no functionality around it yet, beyond following accounts from other instances, as we have yet to start processing incoming posts and adding the ability to interact with them. But if you just can’t wait to show your appreciation for other accounts by following them, go wild!</p><p>Behind the same feature flag, we’ve also added initial beta support for Fediverse Starter Kits. This lets new users follow a set of recommended accounts from a predefined list, following <a href="https://github.com/pixelfed/starter-kits/issues/1" rel="nofollow">the format proposed</a> by <span class="h-card"><a href="https://pixelfed.social/dansup" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>dansup</span></a></span> for Pixelfed. For now, only Actor objects are supporteded, but we’re hoping to expand that over time.</p><p>Full Changelog</p><p>Added</p><p>Added a first version of the Follow form, allowing users to follow other Actors by username or profile link.<br>Added initial support for Fediverse Starter Kits, allowing users to follow recommended accounts from a predefined list.<br>Ensure that all schedulers are registered during every plugin update.<br>Followers and Following list tables now support Columns and Pagination screen options.<br>The featured tags endpoint is now available again for all profiles, showing the most frequently used tags by each user.<br>The following endpoint now returns the actual list of users being followed.</p><p>Changed</p><p>Follower tables now look closer to what other tables in WordPress look like.<br>Improved Account-Aliases handling by internally normalizing input formats.<br>Minor performance improvement when querying posts of various types, by avoiding double queries.<br>Set older unfederated posts to local visibility by default.<br>Step counts for the Welcome checklist now only take into account steps that are added in the Welcome class.<br>Table actions are now faster by using the Custom Post Type ID instead of the remote user URI, thanks to the unified Actor Model.<br>The following tables now more closely match the appearance of other WordPress tables and can be filtered by status.</p><p>Fixed</p><p>Ensure correct visibility handling for Undo and Follow requests<br>Ensure that the Actor-ID is always a URL.<br>Fixed a bug in how follow requests were accepted to ensure they work correctly.<br>Fixed an issue where the number of followers shown didn’t always match the actual follower list.<br>Fixed a PHP error that prevented the Follower overview from loading.<br>Fixed missing avatar class so that CSS styles are correctly applied to ActivityPub avatars on the Dashboard.<br>Fixed potential errors when unrelated requests get caught in double-knocking callback.<br>Improved WebFinger fallback to better guess usernames from profile links.<br>Prevent WordPress from loading all admin notices twice on ActivityPub settings pages.<br>Removed follower dates to avoid confusion, as they may not have accurately reflected the actual follow time.<br>Stop purging Follow activities from the Outbox to allow proper Unfollow (Undo) handling.</p><p>Downloads</p><p>WordPress.org: <a href="https://downloads.wordpress.org/plugin/activitypub.7.1.0.zip" rel="nofollow">activitypub.7.1.0.zip</a><br>GitHub: <a href="https://github.com/Automattic/wordpress-activitypub/releases/tag/7.1.0" rel="nofollow">tag/7.1.0</a></p><p>Thank you!</p><p>Big thanks to everyone who contributed code, feedback, testing, or encouragement—this community helps make the fediverse more connected with every release. ❤️</p><p>Update to 7.1.0, try it out, and tell us what you think!</p> </div>

<div class="article-body"> <p>We’ve rolled out an update that makes sharing content to the fediverse via ActivityPub even better—especially when it comes to images in comments. Now, when you include an HTML &lt;img&gt; tag that points to a file in your WordPress media library, that image is bundled as a proper attachment in the ActivityStreams payload. This means your followers on other platforms will see both your comment and its image, making conversations more vivid and engaging.</p><p>To protect your privacy and security, only images hosted in your own WordPress media library are supported. Images from external sources are intentionally skipped.</p><p>Smoother Following, Better Interactions</p><p>If you’ve turned on the “Following User Interface” feature in the advanced settings, you’ll see a few nice improvements. The followers list now shows whether you’re already following someone—and if not, you can follow them back with just one click.</p><p>We’ve also made it easier to follow people from other sites. When you click “Follow” on someone else’s blog, you’ll now be taken to your own site to complete it. It keeps things simple and familiar, even when you start following someone from another site.</p><p>Better Support for Multibyte Text</p><p>Finally, we’ve improved how multibyte characters (like those in Greek and other non-Latin scripts) are handled when generating post summaries for the fediverse. We’ve replaced byte-based string functions with multibyte-safe alternatives and reordered text processing steps to avoid errors.</p><p>Full Changelog</p><p>Added</p><p>Add image attachment support to federated comments – HTML images in comment content now include proper ActivityStreams attachment fields.<br>Link to the following internal dialog for remote interactions, if the feature is enabled.<br>The followers list now shows follow status and allows quick follow-back actions.<br>Trigger Actor updates on (un)setting a post as sticky.<br>You can now use OrderedCollections as starter packs — just drop in the output from a Follower or Following endpoint.</p><p>Changed</p><p>Ensure that tests run in production-like conditions, avoiding interference from local development tools.<br>Moved HTTP request signing to a filter instead of calling it directly.</p><p>Fixed</p><p>Allow non-administrator users to use Follow Me and Followers blocks.<br>Correct linking from followers to the following list.<br>Fix avatar rendering for followers with missing icon property.<br>Fix multibyte character corruption in post summaries, preventing Greek and other non-ASCII text from being garbled during text processing.<br>Informational Fediverse blocks are no longer rendered when posts get added to the Outbox.</p><p>Downloads</p><p>WordPress.org: <a href="https://downloads.wordpress.org/plugin/activitypub.7.2.0.zip" rel="nofollow">activitypub.7.2.0.zip</a><br>GitHub: <a href="https://github.com/Automattic/wordpress-activitypub/releases/tag/7.2.0" rel="nofollow">tag/7.2.0</a></p><p>Thank you!</p><p>Huge thanks to everyone who shared code, gave feedback, tested, or simply cheered us on! Together, we’re building a more connected fediverse, one release at a time. ❤️</p><p>We’ve just released version 7.2.0, give it a spin and let us know what you think!</p> </div>

<div class="article-body"> <p>Ever wonder how your site proves it’s really you talking to the rest of the Fediverse? It’s not magic—it’s HTTP signatures, the digital equivalent of a secret handshake. With our next release, we’re making that handshake a lot more universal (and a little less awkward).</p><p>Why HTTP Signatures Matter</p><p>When you interact with the Fediverse, you want to know that the messages you send and receive are genuine. <a href="https://swicg.github.io/activitypub-http-signature/" rel="nofollow">HTTP signatures</a> are the technology that makes this possible. Every time your site sends a message, it includes a digital signature—like sealing an envelope with your personal stamp. This signature proves that your content really came from your account and that no one has tampered with it along the way. As a result, you can trust that your interactions across the network are authentic.</p><p>A Bit of Background: draft-cavage and RFC 9421</p><p>If you’ve heard about HTTP signatures, you might have come across terms like “draft-cavage” and “RFC 9421.” These are just different versions of the rules for how those digital signatures are created and checked.</p><p>For a long time, most of the Fediverse has used what’s called <a href="https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12" rel="nofollow">the draft-cavage-12 specification</a>. Think of this as a set of instructions that people agreed to try out, but that hadn’t been officially finalized. It worked well enough to let sites talk to each other securely, but because it was just a draft, there were sometimes small differences in how different software used it.</p><p>Recently, the community agreed on a final, official version of these rules, called <a href="https://www.rfc-editor.org/rfc/rfc9421.html" rel="nofollow">RFC 9421</a>. This is now the standard way to create and verify HTTP signatures. This makes it easier for sites and servers to understand each other and work together, since everyone is following the same process.</p><p>Incoming Support for the New Standard, Out of the Box</p><p>With this update, the plugin will support incoming HTTP signatures that use the new standard right away. There’s nothing extra you need to do. This means that when other servers use the new, official approach for signatures, your site will recognize and accept them. By making support for the new standard easy and automatic, the plugin helps move the Fediverse forward, encouraging more sites to adopt this approach and making connections across the network more reliable.</p><p>Outgoing Requests and the Double Knock Approach</p><p>There’s a new setting for outgoing requests, but for most people, there’s no need to touch it. This option is really for the folks who like to be on the cutting edge and want to start using the new standard for outgoing messages right away. If that sounds like you, here’s how to find it: head to the ActivityPub settings in your dashboard, open “Screen Options” at the top right, and enable “Advanced Settings.” Then, click on the Advanced Settings tab and turn on “Use modern signature format for Fediverse communications.”</p><p>But don’t feel any pressure—leaving this setting off is perfectly fine. The plugin already handles incoming messages with the new standard out of the box, and we’ll automatically enable outgoing support for everyone once the wider Fediverse is ready. For now, this is just an option for early adopters.</p><p>If you do turn it on, the plugin uses what we call the “double knock” approach. It’ll try the new standard first, and if the other server isn’t ready for it, it’ll automatically fall back to the older method. So, you can experiment without worrying about breaking communication with anyone.</p><p>Improved Verification for Existing Signatures</p><p>The plugin also brings improvements to how it handles signatures that use the older method, especially those using the hs2019 algorithm. Now, when a signed message arrives, the plugin fetches the sender’s public key and uses it to determine the correct way to verify the signature, following the specification more closely. This means more reliable verification and fewer errors, making your experience smoother and more predictable.</p><p>Looking Forward</p><p>With this update, the plugin helps move the Fediverse toward a shared standard for signing and verifying messages. By supporting both the new standard and the older method, you’re making it easier for everyone to communicate using the same agreed-upon approach. There’s no change in security, but you’re part of making the network more consistent and helping the community take the next step forward.</p><p>We hope this explanation helps clarify these technical changes. If you have any questions about HTTP signatures or how our plugin interacts with the Fediverse, please don’t hesitate to reach out in the comments below.</p> </div>