Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

ActivityPub · Version history

ActivityPub changelog and version history

Latest version
9.4.3
Nov 5, 2026 (3 days ago)
Releases
163
since 2018
In the last year
33
about one every 11 days
Tested up to
WordPress 7.1.4
PHP 7.4 or later

Releases each year

  • 20184 releases
  • 201924 releases
  • 20206 releases
  • 20213 releases
  • 20226 releases
  • 202321 releases
  • 202436 releases
  • 202537 releases
  • 202626 releases

202626 releases

  1. ActivityPub 9.4.3Latest

    • Improve how custom emoji are shown in names and replies.
    • Improve the check for commenters with a previously approved comment.
    • Fix two small wording mistakes: notification emails said “You are receiving this emails”, and the dashboard widget said “can not” instead of “cannot”.

  2. ActivityPub 9.4.2

    • The app authorization screen only shows apps that are already known to your site and no longer fetches unknown ones.
    • The check for previously approved commenters now also works on sites that save comments without a comment type, such as WordPress.com.

  3. ActivityPub 9.4.1

    • Only earlier comments of the same verified account count as previously approved: replies from the Fediverse follow your moderation settings, and a Fediverse name and handle typed into the comment form are no longer approved automatically.
    • Imported posts are no longer shared to the Fediverse when they are saved again after the import.
    • Mentions in excerpts link to the profile again.
    • Old posts that were never shared to the Fediverse are no longer shared when a tool, for example a link checker, saves them again.
    • The Federated Quote block now also warns about posts that do not allow quotes on sites with a custom REST API path, such as WordPress.com.

  4. ActivityPub 9.4.0

    • Accounts you blocked can no longer reply to, like, repost or quote your posts and comments.
    • Improve the safety of imported Fediverse posts and comments.
    • Improve verification of signing keys fetched from other servers.
    • Incoming activities are now only accepted when they are signed with the sending account’s own key.
    • Signatures on incoming requests now have to cover the address they were sent to and the content they carry.
    • Add a Counts style to the Fediverse Reactions block that shows comments and reactions as a line of simple links, for example to replace the comments link in a query loop.
    • Add an option to show images attached to Fediverse replies in comments, with local caching and image descriptions.
    • Added a custom name and avatar for the blog profile. Your Fediverse blog account can now use its own display name and profile picture, independent of the WordPress site title and site icon.
    • Added a Federated Quote block to quote posts from the Fediverse. The author of the quoted post is asked for permission, and the quote is marked as verified once they agree.
    • Added a filter that lets plugins decide which comment types are shared with the Fediverse, so custom comment types can be kept local or sent out as replies.
    • Added a Source column to the Comments screen that links incoming replies and quote posts to the post they came from.
    • Fediverse apps can now jump directly to the page of a collection that contains a specific item, instead of paging through from the start.
    • Posts and comments on sites using Polylang are now federated with the language Polylang assigned to them.
    • Posts published from a Mastodon app are now federated with the language the app set, and on sites using Polylang or WPML that language is stored with the multilingual plugin.
    • Profiles and posts now point at the shared Fediverse definitions for content warnings, hashtags, manual follower approval and account moves.
    • Support handles with non-Latin characters and domains with special characters, like @renée@café.example, in mentions, search and profile lookups.
    • The Counts style of the Fediverse Reactions block now uses your theme’s link color, adds a link color setting, and underlines links on hover.
    • The Fediverse Reactions block now has margin and padding settings.
    • The Social Web feed can be filtered by date, to show only posts from before or after a day you pick.
    • You can now log in as a different WordPress user while authorizing an ActivityPub app without losing the authorization request.
    • Endpoints that other sites and apps call now answer a limited number of requests per minute from the same caller, and say so in the RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset response headers.
    • Only accounts that are enabled for ActivityPub can authorize apps to act for them.
    • Posts and profiles fetched from other servers are now cached through the WordPress object cache when the site has one. Updates and confirmed deletions clear the cached copy.
    • The Fediverse Reactions block now lines up its buttons with the same width and shows a lighter label for reactions you can’t answer from the block.
    • The option to turn off content filters in the post template was removed. Federated posts now always use the regular content filters.
    • Account moves are only accepted when the new account lists the old one by its ActivityPub ID, as Mastodon does.
    • Accounts on other servers that change their signing key are no longer rejected until their profile is refreshed.
    • Activities between accounts on the same site are now delivered on sites installed in a subdirectory or using plain permalinks.
    • Activities delivered to accounts on the same site now only reach ActivityPub inboxes.
    • Activities read through the ActivityPub API now fall back to the date your site recorded when the activity itself carries none, so client apps show consistent timestamps.

  5. ActivityPub 9.3.1

    • Links to remote profiles in the Followers and Following blocks are now limited to regular web addresses when paging through the list.
    • Replies cached on posts in the blog profile’s reader feed are no longer readable by logged-out visitors through the WordPress REST API.
    • Signatures on incoming requests are now checked against the address the request was actually sent to.

  6. ActivityPub 9.3.0

    • Block markup in posts from remote accounts is now removed before the post is saved.
    • Follow, reply and reaction links advertised by other Fediverse servers now have to be regular web addresses.
    • Followers, cached remote profiles, and reader posts are no longer readable by logged-out visitors through the WordPress REST API, and the setting that hides your follower list is now honoured everywhere.
    • Inline styles are now removed from posts and profiles that come from remote accounts.
    • Posts from remote accounts are now shown in the Social Web reader exactly as the site stored them.
    • Replies from remote accounts are now filtered before they are saved when an administrator imports them through search.
    • Add a notification setting to turn off emails about likes, reposts, and quotes without silencing real comments and replies.
    • Add the Fediverse and ActivityPub logos to the block editor’s icon library on WordPress 7.1 and newer.
    • Federate podcast episodes published with Jetpack, including their audio file and cover art.
    • Enable RFC 9421 HTTP Message Signatures by default.
    • Apps connected through the ActivityPub API now use the standard ActivityPub API permission names. Fetching remote content through your site is treated as reading rather than posting, so an app needs read permission for it.
    • Apps now see the real error when a post they open through your site is missing, instead of a generic failure.
    • Comment author names are no longer altered on comments that did not come from the fediverse.
    • Fixed a crash that could fill the error log when another server edited a reply to a post that is no longer shared to the Fediverse.
    • Fixed an error that could break embeds of Fediverse posts whose author was sent in an unexpected format.
    • Fixed an error that could occur when looking up a profile on another Fediverse server that sends back an unexpected response.
    • Fixed backslashes disappearing from titles and content in posts from remote accounts.
    • Fixed responses to ActivityPub addresses written with different capitalisation not being cached correctly.
    • Fixed the Application actor not being found when its address was written with different capitalisation.
    • Fixed the Mastodon importer creating duplicate posts when an archive was imported a second time.
    • Fixed titles, summaries, captions and display names from remote accounts being stored with stray markup.
    • Imported Mastodon media descriptions now have unsafe HTML removed before they are saved.
    • Imported Mastodon replies now have unsafe HTML removed before they are saved as comments.
    • Improve how blocked accounts are matched.
    • Improve permission checks for third-party apps connected through the ActivityPub API.
    • Improve validation of incoming activities from other servers.
    • Screen readers now announce errors in the follow, reply and reaction dialogs.
    • Text inside hidden page elements, like invisible dialog pop-ups, no longer shows up in posts shared to the Fediverse.
    • The blog profile can be found again from other Fediverse servers on sites that also run Polylang.

  7. ActivityPub 9.2.2

    • Fixed avatars and emoji occasionally failing to cache, and the file warnings that came with it.
    • Fixed deletions from Mastodon and other servers not removing the corresponding comment on your site.
    • Fixed some styles not loading on the Fediverse admin screens and in the Followers and Following blocks.
    • Fixed the editor warning about unsaved changes right after saving a post with an older date.

  8. ActivityPub 9.2.1

    • Fixed duplicate entries and failed undo actions for activities received from other WordPress sites.
    • Fixed posts and profiles not being found on Mastodon and other Fediverse software, which happened when a request asked for ActivityPub data but also accepted HTML as a low-priority fallback.
    • Fixed remote profiles and followers not being found when their address contains unusual characters.
    • Improved checks on boosted content so it is only accepted from the server that published it.
    • Improve escaping of embedded link URLs in federated content.
    • Improve permission checks for admin-only actions.
    • Improve validation of incoming federated activities so the signing key and referenced objects are bound to the sender.

  9. ActivityPub 9.2.0

    • ActivityPub responses are now served only to clients that ask for ActivityPub data and nothing else, which keeps that data out of page caches meant for regular web pages.
    • Only users enabled for ActivityPub can obtain and use OAuth access tokens.
    • Remove support for the WP REST Cache plugin.
    • Hide the heading on the Followers and Following blocks when its text is cleared, matching the Reactions block.
    • Under Authorized Fetch, ActivityPub responses are no longer stored by page caches such as LiteSpeed or Surge.

  10. ActivityPub 9.1.0

    • Ensure apps you connect can only act within the access you granted them, and not make wider changes to your site.
    • Ensure remote profiles and content are served from the address they claim before storing them.
    • Fix a security issue where a remote actor’s profile link could run scripts in the admin area.
    • Ignore an incoming follow request whose actor resolves to a different account than the one that sent it.
    • Add a filter that allows federating with servers on private or internal networks.
    • Add an actor autocomplete endpoint so Fediverse apps can offer typeahead search when mentioning people.
    • Federate the episode summary for Podlove Podcast Publisher episodes.
    • Improve reliability of the Social Web admin screen loading.
    • Improve the internal handling of the Application actor used for server-to-server requests.
    • Ensure a follow can only be declined by the account you followed.
    • Fixed using the correct cache representation in Surge config
    • Fix follow requests from some fediverse services staying pending after they are accepted.
    • Fix likes from some accounts being recorded as multiple duplicate comments.
    • Fix posts being removed from the Fediverse when edited while scheduled for a future publish date.
    • Fix repeated deliveries of a like or repost creating new comments after the original was marked as spam or moved to the trash.
    • Fix Starter Kit imports failing on Fediverse servers that require signed requests.
    • Fix the scheduled refresh of remote profiles so it actually re-fetches from the remote server. Previously, stale avatars and bios for commenters never updated until they sent a new activity to your site.
    • Fix URLs with multiple query parameters (such as avatars, images, profile links, and podcast media) being corrupted in content sent to the Fediverse.
    • Prevent caching non-actor objects (such as notes) as remote profiles.
    • Refresh cached remote profiles in place during scheduled updates to avoid creating duplicate copies.
    • Show the Fediverse Preview for scheduled posts instead of the regular post preview.
    • Stop storing responses from remote servers in the database when they were requested uncached.

  11. ActivityPub 9.0.2

    • Improve handling of content received from other servers.

  12. ActivityPub 9.0.1

    • Add FAQ guides that help solve follow requests stuck on “pending” and comments from the Fediverse not showing up.
    • Notify followers about your new preference when the Starter Kit policy setting changes, so other servers no longer act on an outdated one.
    • Publish the Starter Kit consent policy only on your own blog and author profiles, no longer on system or third-party profiles.
    • Starter Kit consent now also works for the blog profile, not just for individual authors.

  13. ActivityPub 9.0.0

    • Enforce the signing-key host check on incoming federated activities regardless of how the key identifier is formatted.
    • Fix the real-time activity stream so it only returns the requesting user’s own activities.
    • Harden the Site Health connectivity check so it cannot be used to reach unsafe network addresses.
    • Only share comment replies in the Fediverse when the post they belong to is itself federated, so replies on private or non-federated posts stay private.
    • Prevent a remote server from discovering which of your followers belong to a third-party server it does not control.
    • Prevent logged-in users from viewing another user’s private outbox activities.
    • Prevent remote servers from modifying or deleting federated profiles, posts, and interactions they do not own.
    • Rate-limit the remote-follow lookup to prevent it from being abused to trigger outbound requests.
    • Stop the OAuth token introspection endpoint from revealing another user’s token details to logged-in users.
    • Stop the quote-authorization stamp from exposing a post’s other metadata.
    • Add a Distribution Mode setting to control how quickly posts are delivered to followers.
    • Add an opt-in setting to consent to inclusion in Starter Kits (also called Starter Packs or Featured Collections). Off by default. Find it under Settings, ActivityPub, Activities.
    • C2S clients can now request canonical SWICG ActivityPub API scope names such as activitypub:read:all and activitypub:write:all, and the OAuth discovery metadata advertises them.
    • C2S token responses now include activitypub_actor_id so clients following the SWICG ActivityPub API Basic Profile can discover the authenticated actor.
    • Generate a blurred color preview (blurhash) for images so other fediverse apps can show a placeholder while your photos load.
    • Quote notification emails now include a link to the post that quoted you, so you can review and respond more quickly.
    • Warn in the editor before making a post that’s already shared on the Fediverse a draft, private, or password-protected, since followers’ copies will be removed.
    • Add the blurhash term to the outbound JSON-LD @context so attachments that include a blurhash property are strictly correct JSON-LD, matching Mastodon’s own context shape.
    • Federated posts moved to draft, pending, private, trash, or password-protected now send a Delete to followers (previously sent a placeholder “editing” Update or were silent).
    • OAuth rate-limit responses now include a Retry-After header so clients know how long to wait before retrying.
    • Updated a build dependency to a clean release now that a fixed version is available.
    • Removed functions, methods, and the Follower class that were deprecated in versions 7.0 through 7.4.
    • Fix a fatal error when receiving a new follower while the Stream plugin is active.
    • Fix a follow request being marked as accepted when the confirmation came from a different account than the one being followed.
    • Fix the Fediverse settings appearing twice and visibility changes not saving in the block editor when the Classic Editor plugin is also active.
    • Fix the introduction video failing to load on the Getting Started help screen.
    • Follower synchronization with Mastodon no longer fails, signed requests with query strings now verify correctly.
    • Harden the Blurhash encoder: skip decompression-bomb images before decoding, flatten transparency onto white so transparent logos no longer produce near-black placeholders, and defer the cron encode until attachment metadata is saved.
    • Images and videos placed in a Media & Text block are now included when a post is shared to the Fediverse.
    • Requests from other platforms to feature your posts are now handled correctly instead of being ignored.

  14. ActivityPub 8.3.0

  15. ActivityPub 8.2.1

  16. ActivityPub 8.2.0

  17. ActivityPub 8.1.1

  18. ActivityPub 8.1.0

  19. ActivityPub 8.0.2

  20. ActivityPub 8.0.1

  21. ActivityPub 8.0.0

  22. ActivityPub 7.9.1

  23. ActivityPub 7.9.0

  24. ActivityPub 7.8.5

  25. ActivityPub 7.8.4

  26. ActivityPub 7.8.3

202537 releases

  1. ActivityPub 7.8.2

  2. ActivityPub 7.8.1

  3. ActivityPub 7.8.0

  4. ActivityPub 7.7.1

  5. ActivityPub 7.7.0

  6. ActivityPub 7.6.1

  7. ActivityPub 7.6.0

  8. ActivityPub 7.5.0

  9. ActivityPub 7.4.0

  10. ActivityPub 7.3.0

  11. ActivityPub 7.2.0

  12. ActivityPub 7.1.0

  13. ActivityPub 7.0.1

  14. ActivityPub 7.0.0

  15. ActivityPub 6.0.2

  16. ActivityPub 6.0.1

  17. ActivityPub 6.0.0

  18. ActivityPub 5.9.2

  19. ActivityPub 5.9.1

  20. ActivityPub 5.9.0

  21. ActivityPub 5.8.0

  22. ActivityPub 5.7.0

  23. ActivityPub 5.6.1

  24. ActivityPub 5.6.0

  25. ActivityPub 5.5.0

  26. ActivityPub 5.4.1

  27. ActivityPub 5.4.0

  28. ActivityPub 5.3.2

  29. ActivityPub 5.3.1

  30. ActivityPub 5.3.0

  31. ActivityPub 5.2.0

  32. ActivityPub 5.1.0

  33. ActivityPub 5.0.0

  34. ActivityPub 4.7.3

  35. ActivityPub 4.7.2

  36. ActivityPub 4.7.1

  37. ActivityPub 4.7.0

202436 releases

  1. ActivityPub 4.6.0

  2. ActivityPub 4.5.1

  3. ActivityPub 4.5.0

  4. ActivityPub 4.4.0

  5. ActivityPub 4.3.0

  6. ActivityPub 0.17.0

  7. ActivityPub 4.2.1

  8. ActivityPub 4.2.0

  9. ActivityPub 4.1.1

  10. ActivityPub 4.1.0

  11. ActivityPub 4.0.2

  12. ActivityPub 4.0.1

  13. ActivityPub 4.0.0

  14. ActivityPub 3.3.3

  15. ActivityPub 3.3.2

  16. ActivityPub 3.3.1

  17. ActivityPub 3.3.0

  18. ActivityPub 3.2.5

  19. ActivityPub 3.2.4

  20. ActivityPub 3.2.3

  21. ActivityPub 3.2.2

  22. ActivityPub 3.2.1

  23. ActivityPub 3.2.0

  24. ActivityPub 3.1.0

  25. ActivityPub 3.0.0

  26. ActivityPub 2.6.1

  27. ActivityPub 2.6.0

  28. ActivityPub 2.5.0

  29. ActivityPub 2.4.0

  30. ActivityPub 2.3.1

  31. ActivityPub 2.3.0

  32. ActivityPub 2.2.0

  33. ActivityPub 2.1.1

  34. ActivityPub 2.1.0

  35. ActivityPub 2.0.1

  36. ActivityPub 2.0.0

202321 releases

  1. ActivityPub 1.3.0

  2. ActivityPub 1.2.0

  3. ActivityPub 1.1.0

  4. ActivityPub 1.0.10

  5. ActivityPub 1.0.9

  6. ActivityPub 1.0.8

  7. ActivityPub 1.0.7

  8. ActivityPub 1.0.6

  9. ActivityPub 1.0.5

  10. ActivityPub 1.0.4

  11. ActivityPub 1.0.3

  12. ActivityPub 1.0.2

  13. ActivityPub 1.0.1

  14. ActivityPub 1.0.0

  15. ActivityPub 0.16.5

  16. ActivityPub 0.16.4

  17. ActivityPub 0.16.3

  18. ActivityPub 0.16.2

  19. ActivityPub 0.16.1

  20. ActivityPub 0.16.0

  21. ActivityPub 0.15.0

20226 releases

  1. ActivityPub 0.14.3

  2. ActivityPub 0.14.2

  3. ActivityPub 0.14.1

  4. ActivityPub 0.14.0

  5. ActivityPub 0.13.4

  6. ActivityPub 0.13.3

20213 releases

  1. ActivityPub 0.13.2

  2. ActivityPub 0.13.1

  3. ActivityPub 0.13.0

20206 releases

  1. ActivityPub 0.12.0

  2. ActivityPub 0.11.2

  3. ActivityPub 0.11.1

  4. ActivityPub 0.11.0

  5. ActivityPub 0.10.1

  6. ActivityPub 0.10.0

201924 releases

  1. ActivityPub 0.9.1

  2. ActivityPub 0.9.0

  3. ActivityPub 0.8.3

  4. ActivityPub 0.8.2

  5. ActivityPub 0.8.1

  6. ActivityPub 0.8.0

  7. ActivityPub 0.7.4

  8. ActivityPub 0.7.3

  9. ActivityPub 0.7.2

  10. ActivityPub 0.7.1

  11. ActivityPub 0.7.0

  12. ActivityPub 0.6.0

  13. ActivityPub 0.5.1

  14. ActivityPub 0.5.0

  15. ActivityPub 0.4.4

  16. ActivityPub 0.4.3

  17. ActivityPub 0.4.2

  18. ActivityPub 0.4.1

  19. ActivityPub 0.4.0

  20. ActivityPub 0.3.2

  21. ActivityPub 0.3.1

  22. ActivityPub 0.3.0

  23. ActivityPub 0.2.1

  24. ActivityPub 0.2.0

20184 releases

  1. ActivityPub 0.1.1

  2. ActivityPub 0.1.0

  3. ActivityPub 0.0.2

  4. ActivityPub 0.0.1

Questions about ActivityPub’s releases

What is the latest version of ActivityPub?

9.4.3, released on Nov 5, 2026 (3 days ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.

How often is ActivityPub updated?

33 releases in the last year, about one every 11 days. Its first release on WordPress.org dates from September 2018.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in ActivityPub’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.