fediverse

Found this via Aurynn Shaw:

When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.

Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.

Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server. Now that server is allowed to fetch all your private posts. And when it knows the posts, it has to decide who to show them. When you accept a follower, you not only place your trust to keep a secret on them, but also on their admin and the software they are running.

Edited to add the last block quote.

Fediverse life just got a little easier! This release is all about giving you more confidence in how you manage your users — and making your follower, following, and block lists feel lightning fast. Let’s dive in.

Clean Breaks, Done Right

Until now, removing someone’s ActivityPub capability in WordPress only affected their local account. Their presence in the Fediverse lingered on. With this release, you’re in charge of what happens next.

When you remove ActivityPub capabilities from users on your site, you’ll now see a confirmation step:

With this change, you can decide whether you’re simply adjusting roles inside WordPress, or making a complete exit across the network.

We’ve also expanded delete handling to cover more scenarios:

Comment removal: Permanently deleted federated comments now send a Delete activity across the Fediverse.
Virtual deletes & restores: You can now remove objects from the Fediverse without deleting them locally — and bring them back if needed.
WP-CLI command for Actors: A new command makes it easier to manage and clean up Actors directly from the command line.

Together, these tools make sure your Fediverse presence stays consistent with the choices you make in WordPress.

Lists That Load in a Snap

Managing your Fediverse connections shouldn’t feel slow — and now it doesn’t. The follower, following, and block lists are noticeably faster and more reliable in this release.

Behind the scenes, we cleaned up and centralized how account information is resolved. Instead of each list handling things in its own way, they now all share a single, streamlined method with built-in caching. That means less duplication, less waiting, and a smoother experience every time you browse your lists — even on larger sites.

Full Changelog

Added

Add activitypub_json REST field for ap_actor posts to access raw JSON data.
Add Delete activity support for permanently deleted federated comments.
Added a new WP-CLI command to manage Actors.
Added confirmation step for bulk removal of ActivityPub capability, asking whether to also delete users from the Fediverse.
Adds support for virtual deletes and restores, allowing objects to be removed from the fediverse without being deleted locally.
Add Yoast SEO integration for media pages site health check.
Optimized WebFinger lookups by centralizing and caching account resolution for faster, more consistent handling across lists.

Changed

Clarified the ‘attachment’ post type description to explain it refers to media library uploads and recommend disabling federation in most cases.
Hide site-wide checkbox in block confirmations when accessed from ActivityPub settings page.
Improved ActivityPub compatibility by aligning with Mastodon’s Application Actor.
It’s now possible to reply to multiple posts using multiple reply blocks.
Refactored Reply block to use WordPress core embed functionality for better compatibility and performance.
Use wp_interactivity_config() for static values instead of wp_interactivity_state() to improve performance and code clarity.

Deprecated

ActivityPub now defaults to automated object type selection, with the old manual option moved to Advanced settings for compatibility.

Fixed

Fix content visibility override issue preventing authors from changing visibility on older posts.
Fix PHP warning when saving ActivityPub settings.
Fix query args preservation in collection pagination links.
Fix release script to catch more ‘unreleased’ deprecation patterns that were previously missed during version updates.
Fix reply block rendering inconsistency where blocks were always converted to @-mentions in ActivityPub content. Now only first reply blocks become @-mentions, others remain as regular links.
Stop sending follow notifications to the Application user, since system-level accounts cannot be followed.

Downloads

WordPress.org: activitypub.7.4.0.zip
GitHub: tag/7.4.0

Thanks

High-fives to everyone who helped chart the course, whether you coded, tested, spotted bugs, or just cheered from the sidelines. You keep this ship flying! 🚀

Version 7.4.0 has just landed—jump in and tell us how it feels out there in the Fediverse.

ALT

ALT