WPMediaVerse v1.2.1

WPMediaVerse 1.2.1 is the "ready for 100k uploads" release. Cloud-storage migration, faster admin pages on large sites, and customer-reported fixes that affect live sites.

• Fix: BuddyPress activity privacy now follows media privacy. If a media uploaded to a BP activity was set to non-public, the activity card itself was staying visible in the public stream, so the composer text, timestamp, and author leaked. Activity visibility is now derived from the most-restrictive of media privacy and parent album privacy. Album-level privacy changes also fan out to every linked activity.
• Fix: CSS file shared-ui-shell.css renamed to shared-ui-frame.css because some customer firewalls auto-block any file with the word "shell" in its name, which was breaking the dashboard, lightbox, and chat panel on those hosts. The old name is kept as a deprecation shim until 1.3.0.
• Fix: Video uploads no longer crash the upload modal. A type mismatch in the upload preview state was throwing on every video file picked.
• Fix: Video thumbnails render correctly. Where a video had no generated thumbnail yet, the page was loading a broken image instead of falling back to the inline player. The fallback path now runs.
• Fix: bp-verified-member badge now appears next to the author name on /media/{slug}/ and inside the lightbox author row, de-duplicated so it renders exactly once even when bp-verified-member is also active on BuddyPress profile surfaces.
• New: Site-wide counts (total media, views, storage, recent media) now read through a single cached aggregates service instead of running a SUM/COUNT scan on every admin page load.
• New: Full-text search index on media title and description. Search latency at 100,000 rows drops by orders of magnitude. Falls back to standard LIKE on hosts that do not allow ALTER.
• New: View-event retention setting mvs_view_retention_days (default 90, max 730, 0 = unlimited). A daily cron trims old rows from the view-events table in 50,000-row batches. Aggregate view counts are unaffected.
• New: REST API per-page hardening. All 14 list endpoints now clamp per_page to a filterable maximum (default 100). Before 1.2.1, a malicious caller could request 999,999 rows in a single call.
• New: Per-request row cache on the media repository, eliminating N+1 reads across the activity stream and the BuddyBoss imported-media loop.
• New: Typing indicators moved off wp_options to the object cache. Busy DM sites were churning thousands of options-table writes per minute.
• New: WP-CLI command wp mvs migrate-storage --from=<driver> --to=<driver>. Move every media file between local, S3, and BunnyCDN with verify-before-delete safety. Idempotent. Supports --dry-run, --keep-source, --media-id, --limit.
• New: Direct CDN URLs for public media (opt-in: mvs_cloud_direct_public_urls). When enabled and the active driver is cloud, public media short-circuits to the CDN edge URL instead of routing through WordPress. Image requests stop going through PHP. Members-only and private media still flow through the gated /serve endpoint so privacy enforcement remains per-request.
• New: Operator runbook at docs/verification/cloud-storage-verification.md covers fresh upload, delete cleanup, the five migration directions, and failure modes.
• New: Required contract method StorageDriverInterface::download( string $path, string $local_dest ): bool for storage-driver authors. Local, S3, and BunnyCDN drivers implement it.
• New: Filename strategy setting mvs_filename_strategy. original_sanitized (default for upgrades) preserves prior behavior. hashed (default for fresh installs) stores files on disk as a 16-character hex name plus the sanitized extension; the original filename is preserved in metadata and returned via REST and Content-Disposition headers, so users still see "vacation-photo.jpg" on download even though the on-disk file is a3f8c1b2.jpg. Existing media is never renamed.
• New: 98 i18n strings wrapped across chat templates, frontend JavaScript, and Interactivity API view scripts. Translation template regenerated from 1 entry to 1,179 entries.
• New: Action hook mvs_media_privacy_changed( $media_id, $new_privacy, $old_privacy ) fires when the privacy column is updated.
• New: Filter mvs_filename_strategy for site-level filename-strategy overrides.
• New: Filter mvs_rest_pagination_max to override the default per_page clamp.

Pro paired release: https://github.com/vapvarun/wpmediaverse-pro/releases/tag/v1.2.1
Full changelog: https://wbcomdesigns.com/changelog/wpmediaverse-v1-2-1/