v1.2.0
This commit is contained in:
parent
693e5ae2e6
commit
7d3fc1969d
52 changed files with 1776 additions and 295 deletions
|
|
@ -1,5 +1,65 @@
|
|||
== Changelog ==
|
||||
|
||||
= 1.2.0 =
|
||||
|
||||
_Release date: 2026-08-07_
|
||||
|
||||
**Highlights**
|
||||
|
||||
* New: synced post title is taken from the first H1 in the Markdown (and stripped from the body)
|
||||
* New: repo-relative links are rewritten to the matching WordPress permalink
|
||||
* New: repository images are sideloaded into the Media Library and referenced by attachment URL
|
||||
* All deferred findings from the 1.1.1 pre-deploy audit resolved
|
||||
* GitHub token encryption hardened with HKDF-SHA256 key derivation (with transparent migration of existing tokens)
|
||||
* CSRF nonce added to the Discover Files "Refresh" action
|
||||
* Minimum WordPress raised to 6.8; verified compatible with WordPress 7.1; PHP minimum declarations made consistent at 8.0 across all files
|
||||
|
||||
**Added**
|
||||
|
||||
* **Title from H1:** the synced post title is now taken from the first `# H1` heading in the Markdown (inline formatting stripped to plain text), with the H1 removed from the body to avoid a duplicate heading. Falls back to the filename-derived title when no H1 is present
|
||||
* **Internal link translation:** repo-relative Markdown links (e.g. `./api.md`, `../README.md`) are rewritten to the permalink of the matching mapped WordPress content. External, `mailto:`, and anchor links are left untouched; links with no matching mapping keep their original URL
|
||||
* **Repository image sideloading:** images referenced in the Markdown are downloaded from the repository, added to the Media Library, and their references replaced with the attachment URL. Already-imported images are reused on subsequent syncs (tracked per post); removed images are kept in the Media Library (non-destructive)
|
||||
|
||||
**Security**
|
||||
|
||||
* Patched CVE-2026-71478 (and advisory GHSA-2q4p-g7hv-5rgv) in league/commonmark — an unsafe-link filter bypass that could defeat `allow_unsafe_links: false`. Updated league/commonmark 2.8.2 → 2.9.0
|
||||
* GitHub token encryption now derives its AES-256 key with HKDF-SHA256 from `wp_salt('auth')` instead of using the salt directly; existing tokens are migrated transparently to the new `v2:` format on first decrypt (covers the cron path too)
|
||||
* Discover Files "Refresh from GitHub" action is now nonce-protected — previously a crafted link could force an unrequested GitHub API call (CSRF)
|
||||
* GitHub API request paths are now `rawurlencode()`d (defensive hardening)
|
||||
* Sideloaded images are validated by extension (jpg, jpeg, png, gif, webp) and size (< 10 MB) before storage; SVG is intentionally excluded
|
||||
|
||||
**Fixed**
|
||||
|
||||
* "Using cached data / fetching fresh data" indicator on Discover Files now reflects reality — it always showed "cached" because the cache was tested after being populated
|
||||
* `target_post_type` is now validated against registered public post types on save, falling back to `page`
|
||||
* Debug action dispatch refactored into a single `switch`, each case retaining its `check_admin_referer()` check, to reduce the chance of a missing nonce check
|
||||
|
||||
**Changed**
|
||||
|
||||
* Inline `onclick` confirm on Delete replaced with a `data-confirm` attribute + delegated handler (CSP-friendlier, less fragile)
|
||||
* Add Mapping "existing content" dropdown now queries only public post types (excludes attachments and the internal mapping CPT) with `no_found_rows` for better performance on large sites
|
||||
|
||||
**Compatibility**
|
||||
|
||||
* WordPress: 6.8 - 7.1
|
||||
* PHP: 8.0 - 8.5
|
||||
* MariaDB: 11.4 or newer
|
||||
|
||||
**Developer**
|
||||
|
||||
* Added `bin/preflight.sh` — automated pre-deploy gate (PHPCS, PHPStan 9, PHPCompatibility, PHPUnit, `composer audit`, candidate-ZIP inspection); PASS/FAIL report per section, never invokes `deploy.sh`
|
||||
* Added `.claude/settings.json` deny rules (`deploy.sh`, `git push/tag/merge`) enforcing the AGENTS.md operating boundaries mechanically
|
||||
* `composer.json` `require-dev` completed and pinned: added `dealerdirect/phpcodesniffer-composer-installer` + `phpcsstandards/phpcsutils`; pinned `squizlabs/php_codesniffer` and `johnbillion/wp-compat`
|
||||
* Patched two high-severity CVEs in dev tooling (not shipped — `deploy.sh` uses `--no-dev`): `squizlabs/php_codesniffer` 3.13.5 → 3.13.6 (CVE-2026-67434), `wp-coding-standards/wpcs` 3.3.0 → 3.4.1 (CVE-2026-45293). `composer audit` fully clean
|
||||
|
||||
**Tests**
|
||||
|
||||
* PHP Coding Standards: PHPCS with WordPress-Core, WordPress-Docs, WordPress-Extra — 0 errors
|
||||
* PHPStan: level 9, 0 errors
|
||||
* PHPCompatibility: PHP 8.0-8.5 validated
|
||||
* PHPUnit: plugin header tests pass
|
||||
* Manual testing: WordPress 7.1
|
||||
|
||||
= 1.1.1 =
|
||||
|
||||
_Release date: 2026-06-08_
|
||||
|
|
|
|||
Loading…
Reference in a new issue