Release 0.1.3 — Atmosphere 2.0.0 and ActivityPub 9.0.2 · Automattic/fosse

Fourth preview of FOSSE. Headlined by a major bundled Atmosphere upgrade (2.0.0) and ActivityPub 9.0.2, plus Bluesky OAuth and admin hardening.

What's changed since 0.1.2

Bundled wordpress-atmosphere updated to 2.0.0 (#230, #218) — block-editor support (reactions block, pre-publish panel, editor plugin), native @handle.tld mention support with DID resolution, a REST layer (reactions, client metadata, pre-publish), and a preview transformer. The legacy meta-box is retired.
Bundled wordpress-activitypub updated to 9.0.2 (#218, #205) — FOSSE now defers to ActivityPub's native Blurhash encoder and drops its own copy (#206, #219).
Bundled-backend coexistence — bundled backends load when a standalone plugin is inactive, with excludes hygiene (#228), and orphaned trunk-only files are pruned from the bundled Atmosphere (#229).
Bluesky OAuth reliability — handle authorization denial and auth-server errors gracefully (#195), and never redirect a connect to a non-HTTPS authorize URL (#211).
Admin hardening — preserve a saved site handle on collision and stop hidden-field submits (#199), scope admin asset enqueue and guard the wizard redirect against POST (#197), skip per-user notice consumption during AJAX and cron requests (#194), and pin a filter-safe sentinel read in the object-type migration (#202).
Build & packaging — harden the build-zip script and pin all workflow actions to commit SHAs (#192, #190), exclude docs/ and CONTRIBUTING.md from the plugin zip (#207), and keep the AP Blurhash test stub out of the autoloader classmaps (#210).

Still a preview release. Options, admin UI, and internal APIs may shift before 1.0.

Download fosse.zip (attached below), then in WordPress go to Plugins → Add New → Upload Plugin, activate, and walk the setup wizard.

Issues and pull requests welcome at https://github.com/Automattic/fosse.