First feature + hardening release since the initial 1.0.0.
New
- Per-hashtag account filter and a global brand account setting.
- Account feed:
[outpost_account_feed]shortcode and the Mastodon Account Feed block (original posts only). - Redirect to the setup wizard on first activation.
Security
- Abuse controls (honeypot + per-IP rate limit) on the public subscribe endpoint.
- Subscription lookup now emails management links instead of exposing unsubscribe tokens, and no longer reveals whether an address is subscribed.
- Unsubscribe requires a POST confirmation, so link prefetch can't opt people out.
- Saving settings no longer re-runs activation or re-shows the setup wizard.
Accessibility
- Localized email
lang, higher-contrast email and link colors, unique element IDs for repeated feeds/forms.
Performance & quality
- Paginated the subscribers admin screen; explicit option autoload.
- Hardened the schema migration to add columns deterministically (not via dbDelta diffing).
- PHPCS (WordPress-Extra) + PHPCompatibility, CI on a PHP 8.2 / 8.3 matrix. Minimum PHP is now 8.2.
All work was behaviorally verified in a real WordPress install (including live Mastodon API calls and full subscribe/unsubscribe HTTP flows).