4.4.0

Security

• Keep multisite record reads inside the current site. A requested blog_id is now honoured only for users with manage_network_options, which closes a path where a site-level view_stream user could read the activity of another site with ?blog_id=N.
• Stop the use of HTTP_REFERER as proof of network-admin authority in ajax_network_admin(). A true network capability is now necessary, so a forged Referer can no longer lift the per-blog restriction or make Stream record actions against blog_id 0.
• Make a network capability necessary for the update-settings and create-exclusion-rule abilities when the write goes to a network-wide option.
• Remove secret values from option-change records, so integration credentials are no longer stored as cleartext in stream_meta. This covers the WooCommerce, EDD, Jetpack, Gravity Forms, and Settings connectors. A secret value now shows as [redacted].
• Withhold alert destination credentials, such as Slack webhook URLs and IFTTT Maker keys, from the stream/get-alerts ability output.
• Correct the GHCR publish condition in docker-images.yml, which also matched an unprotected branch name.

Harden multisite authorization and stop logging integration credentials by @PatelUtkarsh in #1958

Bug Fixes

• Fix false "SITE IS DISCONNECTED" error on empty query results by @anamwp in #1966
• Fix fatal in role_can_view() when cap check fires before init by @andreilupu in #1963
• Guard false user in retrieve_password by @faisalahammad in #1931

Enhancements

• Add the wp_stream_secret_alert_meta_keys filter, so a custom alert type registered with wp_stream_alert_types can declare its own destination secrets for redaction.
• Add Connector::is_secret_key() and Connector::redact_secret_values() as reusable redaction helpers for custom connectors. PUBLIC_KEY_PATTERNS keeps the published half of a key pair, such as public_key and site_key, unless the name also holds a secret marker.
• Add Network::can_view_network_records() as the single authority check for access to network-scoped records.

Development

• Add PHPUnit coverage for the hardened multisite, redaction, and CLI paths: Network, the Connector redaction helpers, CLI::connection(), Admin, and the Gravity Forms, Jetpack, Settings, and Users connectors.
• Update development dependencies: Node.js to ^24.20.0, globals to ^17.11.0, @playwright/test to ^1.62.1, npm-run-all2 to ^9.0.3, and squizlabs/php_codesniffer to 3.13.6 (#1943, #1947, #1949, #1951, #1952, #1953, #1954, #1960, #1964, #1965, #1970).

Upgrade Notice

On multisite, access to the records of another site and changes to network-wide settings now need the manage_network_options capability. Stream no longer writes integration credentials into option-change records.

New Contributors

• @anamwp made their first contribution in #1966
• @andreilupu made their first contribution in #1963
• @faisalahammad made their first contribution in #1931

Full details in changelog.md.

Full Changelog: v4.3.0...v4.4.0