This commit is contained in:
Javier Casares 2026-08-24 11:42:10 +00:00
commit 80a2202d6e
18 changed files with 305 additions and 122 deletions

View file

@ -4,7 +4,7 @@ Tags: github, documentation, markdown, sync, automation
Requires at least: 4.2
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.2.1
Stable tag: 1.2.2
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html
@ -189,6 +189,22 @@ Then go to Documentation → Settings, and you'll see a "Debug Tools" section at
For the complete changelog, see [changelog.txt](https://www.robotstxt.software/plugins/robotstxt-documentation-markdown/).
= 1.2.2 - 2026-08-24 =
**Changed**
* Manager (by ROBOTSTXT) detection now uses the ecosystem presence constant `ROBOTSTXT_MANAGER_NOTICED` (Manager 1.6.2+), falling back to a plugin-list scan for older Manager versions — same function name and behavior for callers
* New unit tests for both detection paths (constant defined / plugin-list fallback)
**Compatibility**
* WordPress: 4.2 - 7.1 (floor re-verified with WP-Compat; smoke-tested on 7.2-alpha)
* PHP: 8.0 - 8.5 (floor re-verified with PHPCompatibility 5.6-8.5 full-range scan)
**Translations**
* Spanish (es_ES) and Catalan (ca): verified complete and in sync (156 strings, no changes needed)
= 1.2.1 - 2026-08-17 =
**Changed**
@ -238,42 +254,11 @@ For the complete changelog, see [changelog.txt](https://www.robotstxt.software/p
* Inline `onclick` confirm on Delete replaced with a `data-confirm` attribute + delegated handler (CSP-friendlier, less fragile)
* Add Mapping "existing content" dropdown now queries only public post types (excludes attachments and the internal mapping CPT) with `no_found_rows` for better performance on large sites
**Compatibility**
* Minimum WordPress raised to 6.8 (latest stable + two previous majors)
* Verified compatible with WordPress 7.1
* Declared PHP minimum made consistent across `readme.txt`, `composer.json`, `phpstan.neon`, and the PHPCompatibility scan range — real minimum remains 8.0
= 1.1.1 - 2026-06-08 =
**Security**
* CommonMark: disabled raw HTML passthrough (`html_input: strip`, `allow_unsafe_links: false`) — prevents stored XSS via a compromised upstream repository
* Settings option now stored with `autoload = false` — encrypted GitHub token no longer loaded on every WordPress request
* Replaced `serialize()` with `wp_json_encode()` in updater HMAC cache signature
* Added strict base64 length validation before IV extraction in token decryption
* Added `base64_decode()` return-value check in GitHub file content fetch
**Fixed**
* Admin notices now display results for all operations: mapping created, updated, deleted, sync complete, and errors — previously only "Settings saved" was shown
* `wp_update_post()` return value now checked during sync — silent failures no longer reported as success
* Wrong textdomain in updater class (`'robotstxt-smtp'` → `'robotstxt-documentation-markdown'`)
**Changed**
* Renamed `robotstxt-updater.php` → `class-robotstxt-updater.php` (WordPress file naming convention)
* Minimum PHP version corrected to 8.0 (real minimum confirmed by PHPCompatibility scan — no PHP 8.1 or 8.2 specific features used)
**Developer**
* Added full tooling: `composer.json`, `phpstan.neon` (level 9), `.phpcs.xml`, `bin/deploy.sh`, `phpunit.xml.dist`
* PHPCompatibility updated to 10.0.0-alpha2 (PHP 8.x feature detection)
* PHPUnit: 17 plugin header tests added
* PHPCS, PHPStan level 9, PHPUnit all pass with 0 errors
== Upgrade Notice ==
= 1.2.2 =
Manager (by ROBOTSTXT) detection updated: now uses the ROBOTSTXT_MANAGER_NOTICED presence constant (Manager 1.6.2+) with a fallback for older Manager versions.
= 1.2.1 =
Automatic updates now require the Manager (by ROBOTSTXT) plugin. A notice with the download link is shown on the Plugins and Settings pages.