It's the Accept: header coming from a random third party, not the plugin.
My hosting doesn't log that header, but I'd guess that third party is sending an Accept with incorrect casing.
The .htaccess RewriteCond didn't pick it up, so didn't add the Cache-Control:vary suffix.
However, the ActivityPub plugin matched the header regardless of case and returned the activitystreams json as expected. Which may be correct behaviour in itself.
It is then returned for all Accept types
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.