Skip to content

WPMediaVerse 1.6.0 - Privacy hardening, group conversations, AI alt text

Choose a tag to compare

View all tags
@vapvarun vapvarun released this 06 Jun 10:15
· 783 commits to main since this release
1.6.0
6ea56cd

Privacy hardening across every surface, a large messaging upgrade with group-conversation support, AI-assisted alt text and tagging, and a long list of QA-driven fixes.

  • New - Group-conversation messaging engine with participant roles. Pro 1.6.0 builds group DMs on top of it.
  • New - Per-user messaging controls. Members choose who can DM them and whether their online status is visible, from the dashboard profile editor.
  • New - AI describe results now double as image alt text, with an admin review surface to accept or re-run AI output per media item.
  • New - WP-CLI command wp mvs backfill_ai runs AI describe and tagging on media uploaded before AI was enabled.
  • New - Upload review step. Dashboard and block uploads stage files for a title/description/tags details screen before the upload starts.
  • New - Friends privacy option available in the frontend upload, edit, and album privacy selects.
  • New - Media poster name on grids links to the uploader's profile.
  • New - Async storage-cleanup cycle reclaims local and cloud files when media is deleted, with retry and logging for failed deletes.
  • Improve - Uploads are limited to image, video, and audio. PDF and document uploads are rejected, including via the replace endpoint, and the custom MIME types UI is removed.
  • Improve - Media filenames are hashed by default so uploaded file names no longer leak original names.
  • Improve - Message delete is idempotent, returns precise HTTP codes, and removes the message from the thread and conversation preview immediately.
  • Improve - Notifications dropdown header stays visible while scrolling, and admin data tables scroll horizontally on mobile.
  • Improve - Report UI is Pro-only. The free plugin hides report buttons behind the mvs_reports_enabled filter.
  • Fix - Members-only and private media no longer leak to logged-out or unauthorized viewers across 8 render surfaces and 2 REST routes, including BuddyPress album tabs and activity.
  • Fix - Smart collections with multiple rules resolved to 0 items because query parameters were bound out of order. Tag and category rules also survive the edit modal now instead of being corrupted to names.
  • Fix - Comment @mentions fire notifications, and duplicate reaction, DM, and mention notifications are gone.
  • Fix - Deleting media, albums, collections, or users cleans up every dependent row, including GDPR erasure paths.
  • Fix - Explore Load More renders all media types with thumbnails, and the Load More stack is registered globally for shortcode and block pages.
  • Fix - Single media pages no longer double-count video and audio views.
  • Fix - Permissions matrix covers all roles, survives updates, and can no longer lock out administrators.
  • Fix - Allowed File Types settings persist when a type is unchecked, webhook event selection cannot silently reset, and the webhook HMAC secret survives an empty save.
  • Fix - Activity composer no longer collides with the options row, and activity-form uploads surface errors and accept media tags.
  • Fix - Video poster metadata no longer writes the video URL as a thumbnail, and posters render at the large size.
  • Fix - Album creation slug collisions no longer drop privacy and album type.
  • Fix - Page creation on activation never edits site navigation menus.
  • Fix - Missing thumbnail files no longer break media grids. When a resized variant is absent on disk, the original image is served instead of an error.
  • Fix - Public media now displays correctly on page-cached hosts. Expired-but-authentic image URLs in cached HTML still serve public files; non-public media keeps the strict expiry window. Disable via the mvs_serve_expired_public_urls filter.
  • Security - PDF-upload bypass through the media replace endpoint is closed, and replace honors the same type allowlist as upload.
  • Dev - New filters mvs_collection_media_ids, mvs_reports_enabled, mvs_media_alt_text, mvs_hold_uploads_for_moderation, mvs_profile_privacy_levels, and mvs_serve_expired_public_urls; new actions mvs_album_deleted and mvs_collection_deleted; mvs_media_deleted now fires once from the delete cascade.
  • Compat - Aligned with WPMediaVerse Pro 1.6.0 (https://github.com/vapvarun/wpmediaverse-pro/releases/tag/1.6.0). Install both updates together.
Assets 3
Loading