v1.1.1

readme.txt

@@ -2,9 +2,9 @@
 Contributors: robotstxt
 Tags: github, documentation, markdown, sync, automation
 Requires at least: 6.7
-Tested up to: 7.0
-Requires PHP: 8.2
-Stable tag: 1.1.0
+Tested up to: 7.1
+Requires PHP: 8.0
+Stable tag: 1.1.1
 License: GPLv3 or later
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
 
@@ -178,13 +178,41 @@ Then go to Documentation → Settings, and you'll see a "Debug Tools" section at
 
 == Compatibility ==
 
-* WordPress: 6.7 - 6.9
-* PHP: 8.2 - 8.5
+* WordPress: 6.7 - 7.1
+* PHP: 8.0 - 8.5
 
 == Changelog ==
 
 For the complete changelog, see [changelog.txt](https://git.robotstxt.es/ROBOTSTXT/robotstxt-documentation-markdown/raw/branch/main/changelog.txt).
 
+= 1.1.1 - 2026-06-08 =
+
+**Security**
+
+* CommonMark: disabled raw HTML passthrough (`html_input: strip`, `allow_unsafe_links: false`) — prevents stored XSS via a compromised upstream repository
+* Settings option now stored with `autoload = false` — encrypted GitHub token no longer loaded on every WordPress request
+* Replaced `serialize()` with `wp_json_encode()` in updater HMAC cache signature
+* Added strict base64 length validation before IV extraction in token decryption
+* Added `base64_decode()` return-value check in GitHub file content fetch
+
+**Fixed**
+
+* Admin notices now display results for all operations: mapping created, updated, deleted, sync complete, and errors — previously only "Settings saved" was shown
+* `wp_update_post()` return value now checked during sync — silent failures no longer reported as success
+* Wrong textdomain in updater class (`'robotstxt-smtp'` → `'robotstxt-documentation-markdown'`)
+
+**Changed**
+
+* Renamed `robotstxt-updater.php` → `class-robotstxt-updater.php` (WordPress file naming convention)
+* Minimum PHP version corrected to 8.0 (real minimum confirmed by PHPCompatibility scan — no PHP 8.1 or 8.2 specific features used)
+
+**Developer**
+
+* Added full tooling: `composer.json`, `phpstan.neon` (level 9), `.phpcs.xml`, `bin/deploy.sh`, `phpunit.xml.dist`
+* PHPCompatibility updated to 10.0.0-alpha2 (PHP 8.x feature detection)
+* PHPUnit: 17 plugin header tests added
+* PHPCS, PHPStan level 9, PHPUnit all pass with 0 errors
+
 = 1.1.0 - 2026-03-28 =
 
 **Security**