ROBOTSTXT/robotstxt-documentation-markdown
ROBOTSTXT/robotstxt-documentation-markdown
Watch
7
0
Fork
You've already forked robotstxt-documentation-markdown
 0
Code Issues Pull requests Releases 6 Activity

v1.1.1

Browse source
This commit is contained in:
Javier Casares 2026-06-08 12:31:51 +00:00
commit 7dd3eeaa8a
97 changed files with 4912 additions and 1581 deletions
Download patch file Download diff file Expand all files Collapse all files

53
changelog.txt
View file

@ -1,5 +1,58 @@
== Changelog ==
= 1.1.1 =
_Release date: 2026-06-08_
**Highlights**
* Security hardening: CommonMark raw HTML passthrough disabled, encrypted token no longer autoloaded, HMAC now uses `wp_json_encode()` instead of `serialize()`
* Bug fix: admin notices now visible for all operations (sync, create, update, delete, errors)
* Infrastructure: full dev tooling added (PHPCS, PHPStan, PHPUnit, deploy script)
* Real PHP minimum corrected to 8.0 (confirmed by PHPCompatibility 10.x scan)
**Security**
* CommonMark: disabled raw HTML passthrough (`html_input: strip`, `allow_unsafe_links: false`) — prevents stored XSS if an upstream repository is compromised
* Settings option now stored with `autoload = false` — encrypted GitHub token no longer loaded on every WordPress request (defense in depth)
* Replaced `serialize()` with `wp_json_encode()` in updater HMAC cache (eliminates PHPCS object-injection warning)
* Added strict base64 length validation before IV extraction in `robotstxt_docmd_decrypt_token()`
* Added `base64_decode()` strict return-value check in `robotstxt_docmd_get_file_content()`
**Fixed**
* Admin notices now display results for all operations: mapping created, mapping updated, mapping deleted, sync complete, and error messages — previously only "Settings saved" was shown
* `wp_update_post()` return value now checked during sync — silent post-update failures were previously reported as success
* Wrong textdomain `'robotstxt-smtp'` in updater class corrected to `'robotstxt-documentation-markdown'`
**Changed**
* `robotstxt-updater.php` renamed to `class-robotstxt-updater.php` (WordPress file-naming convention)
* Minimum PHP version header corrected from 8.2 to 8.0 (real minimum confirmed by PHPCompatibility 10.0.0-alpha2 scan — union types, `str_starts_with()`, `str_contains()`, and `mixed` type are the binding constraints)
**Developer**
* Added `composer.json` with full require-dev tooling (PHPCS, PHPStan 2.x, PHPUnit 9.6, PHPCompatibility 10.0.0-alpha2, wp-compat, yoast/phpunit-polyfills)
* Added `phpstan.neon` (level 9), `.phpcs.xml` (WordPress-Core/Docs/Extra), `bin/deploy.sh`, `phpunit.xml.dist`
* PHPUnit: 17 plugin header tests added (`tests/PluginHeadersTest.php`)
* Added `docs/known-issues.md` and `docs/db-migrations.md`
* `class-robotstxt-updater.php`: PHPCS 0 errors, PHPStan level 9 0 errors (full compliance)
**Compatibility**
* WordPress: 6.7 - 7.1
* PHP: 8.0 - 8.5
* MariaDB: 11.4 or newer
**Tests**
* PHP Coding Standards: PHPCS 3.x with WordPress-Core, WordPress-Docs, WordPress-Extra — 0 errors, 0 warnings
* WordPress Coding Standards: WPCS 3.3.0
* PHPStan: level 9, 0 errors (szepeviktor/phpstan-wordpress 2.0.3)
* PHPCompatibility: 10.0.0-alpha2 — PHP 8.0-8.5 validated
* PHPUnit: 17/17 tests pass (plugin header tests)
* Manual testing: WordPress 7.0, 7.1
= 1.1.0 =
_Release date: 2026-03-28_