9.4.0

What's Changed

• Fix: constrain image sizes in email notifications by @faisalahammad in #3637
• Federate enclosures that are not in the media library by @pfefferle in #3728
• Use the Miscellaneous Terms context instead of declaring the terms by @pfefferle in #3704
• Seed "Powered by" with the other default profile fields by @pfefferle in #3730
• Strip emoji from the blog profile ID by @pfefferle in #3731
• fix: only count previously approved normal comments for auto-approval by @faisalahammad in #3636
• Process inbox activities once, after they are stored by @pfefferle in #3732
• Keep the plain mention in statuses posted from Mastodon apps by @akirk in #3734
• Do not answer a request with a term from a taxonomy we do not federate by @pfefferle in #3744
• Open comment links on the page the comment is actually on by @pfefferle in #3678
• Only fetch reactions in the editor for posts the endpoint answers for by @pfefferle in #3752
• Add Polylang integration by @pfefferle in #3756
• Read feature settings on init, not at plugins_loaded by @pfefferle in #3768
• feat(comments): add link to source post for quotes and replies by @faisalahammad in #3754
• Federate the language a Mastodon app sets by @pfefferle in #3777
• Fix <title> tag on the ActivityPub settings page by @pilarmera in #3769
• Strip spans from federated comments by @pfefferle in #3789
• Compose AP comment-type exclusion with other plugins' filters by @pfefferle in #3315
• Do not prepend a mention the reply already carries by @pfefferle in #3680
• Stop posts from carrying an icon by @pfefferle in #3721
• Fix account move verification and notify followers by @pfefferle in #3585
• Add filter for federated comment types by @pfefferle in #3798
• feat(oauth): switch accounts on authorize screen by @faisalahammad in #3799
• Add custom display name and avatar for the blog profile by @faisalahammad in #3755
• Only accept image attachments for profile images by @pfefferle in #3804
• Deliver API replies to posts on other servers by @pfefferle in #3807
• Keep the reason a remote request failed by @pfefferle in #3808
• Add a seek endpoint for collections (SWICG Seek Item) by @pfefferle in #3549
• Fix the dates and hidden recipients on outbox and inbox reads by @pfefferle in #3320
• Remote Actors: wp_kses() expected unslashed inputs. by @dmsnell in #3812
• Require the read scope on every path to owner data by @pfefferle in #3814
• Check the user's capabilities in the outbox write handlers by @pfefferle in #3815
• Tighten the checks on the app consent screen by @pfefferle in #3816
• Rework the collection classes and fix what it surfaced by @pfefferle in #3527
• Add Federated Quote block (FEP-044f) by @pfefferle in #3803
• Stop re-downloading remote images that are already WebP by @pfefferle in #3818
• take the actor list colours from the theme by @pfefferle in #3837
• one rate limit for every endpoint that has one by @pfefferle in #3830
• open the inspector without the view transition by @pfefferle in #3845
• one snackbar list, css transitions for the drawer by @pfefferle in #3844
• clean up the duplicate cache files #3818 left behind by @pfefferle in #3838
• Preserve canonical post URLs across status changes by @pfefferle in #3854
• Handle malformed ActivityPub object references by @pfefferle in #3855
• Proxy remote objects through one cached entry point by @pfefferle in #3793
• Validate resolved signing-key identities by @pfefferle in #3858
• Fix PHP 8.5 deprecation notices by @pfefferle in #3864
• Keep kses output tests and MathML working with WordPress 7.2 by @pfefferle in #3863
• Improve handling of HTML comments in remote content by @pfefferle in #3865
• Fix local account status counts in Enable Mastodon Apps integration by @akirk in #3884
• Remove the apply_filters attribute of [ap_content] by @pfefferle in #3880
• Only approve quote requests for the requester's own post by @pfefferle in #3881
• Support internationalized WebFinger handles by @pfefferle in #3882
• Cut the handle host at a path by @pfefferle in #3899
• Only approve feature requests for the requester's own collection by @pfefferle in #3891
• Anchor the well-known rewrite rules by @pfefferle in #3902
• Skip unusable attachments on remote posts by @pfefferle in #3866
• Keep reader replies out of the comments feed by @pfefferle in #3911
• Add a Counts style to the Reactions block by @pfefferle in #3917
• Add margin and padding settings to the Reactions block by @pfefferle in #3926
• Use the theme's link color for the Reactions Counts style by @pfefferle in #3927
• Only answer quote and feature requests sent to the owner by @pfefferle in #3925
• Fix the user selection in blocks when a user can't be edited by @pfefferle in #3934
• Show a placeholder for reactions without an action and align the buttons by @pfefferle in #3935
• Keep underscores in hashtags by @faisalahammad in #3939
• Display images attached to Fediverse comments by @pfefferle in #3850
• Only match the site address in signature and actor checks by @pfefferle in #3942
• Only verify signatures made out to this site by @pfefferle in #3964
• Sign the port along with the host by @pfefferle in #3965
• Read X-Original-Host in the RFC 9421 verifier by @pfefferle in #3966
• Only verify signatures for a bare host by @pfefferle in #3967
• Only deliver locally to inbox routes by @pfefferle in #3968
• Keep mismatched Accept headers out of the LiteSpeed cache by @pfefferle in #3969
• Leave moderation alone when searching for a reply by @pfefferle in #3970
• Only feature publicly queryable posts by @pfefferle in #3971
• Only accept follows for the named recipient by @pfefferle in #3972
• Only the author may change a reply by @pfefferle in #3974
• Require signatures to cover this site and the body by @pfefferle in #3977
• Only accept activities signed with the actor's own key by @pfefferle in #3979
• Only accept a Move listed by the actor id by @pfefferle in #3981
• Fill in defaults for registered comment types by @pfefferle in #3982
• Refresh a stored actor when its key fails to verify by @pfefferle in #3983
• Deliver locally on subdirectory and plain-permalink installs by @pfefferle in #3986
• Check content owners' blocks for incoming activities by @pfefferle in #3988
• Leave a failed reply import out of the search redirect by @pfefferle in #3990

New Contributors

• @faisalahammad made their first contribution in #3637
• @pilarmera made their first contribution in #3769
• @dmsnell made their first contribution in #3812

Full Changelog: 9.3.1...9.4.0