ROBOTSTXT/robotstxt-documentation-markdown
ROBOTSTXT/robotstxt-documentation-markdown
Watch
6
0
Fork
You've already forked robotstxt-documentation-markdown
 0
Code Issues Pull requests Releases 6 Activity
6 releases 6 tags
  • 1.2.0 7d3fc1969d

    v1.2.0 Stable

    javier released this 2026-08-08 08:54:38 +00:00 | 2 commits to main since this release

    1.2.0

    Release date: 2026-08-07

    Highlights

    • New: synced post title is taken from the first H1 in the Markdown (and stripped from the body)
    • New: repo-relative links are rewritten to the matching WordPress permalink
    • New: repository images are sideloaded into the Media Library and referenced by attachment URL
    • All deferred findings from the 1.1.1 pre-deploy audit resolved
    • GitHub token encryption hardened with HKDF-SHA256 key derivation (with transparent migration of existing tokens)
    • CSRF nonce added to the Discover Files "Refresh" action
    • Minimum WordPress raised to 6.8; verified compatible with WordPress 7.1; PHP minimum declarations made consistent at 8.0 across all files

    Added

    • Title from H1: the synced post title is now taken from the first # H1 heading in the Markdown (inline formatting stripped to plain text), with the H1 removed from the body to avoid a duplicate heading. Falls back to the filename-derived title when no H1 is present
    • Internal link translation: repo-relative Markdown links (e.g. ./api.md, ../README.md) are rewritten to the permalink of the matching mapped WordPress content. External, mailto:, and anchor links are left untouched; links with no matching mapping keep their original URL
    • Repository image sideloading: images referenced in the Markdown are downloaded from the repository, added to the Media Library, and their references replaced with the attachment URL. Already-imported images are reused on subsequent syncs (tracked per post); removed images are kept in the Media Library (non-destructive)

    Security

    • Patched CVE-2026-71478 (and advisory GHSA-2q4p-g7hv-5rgv) in league/commonmark — an unsafe-link filter bypass that could defeat allow_unsafe_links: false. Updated league/commonmark 2.8.2 → 2.9.0
    • GitHub token encryption now derives its AES-256 key with HKDF-SHA256 from wp_salt('auth') instead of using the salt directly; existing tokens are migrated transparently to the new v2: format on first decrypt (covers the cron path too)
    • Discover Files "Refresh from GitHub" action is now nonce-protected — previously a crafted link could force an unrequested GitHub API call (CSRF)
    • GitHub API request paths are now rawurlencode()d (defensive hardening)
    • Sideloaded images are validated by extension (jpg, jpeg, png, gif, webp) and size (< 10 MB) before storage; SVG is intentionally excluded

    Fixed

    • "Using cached data / fetching fresh data" indicator on Discover Files now reflects reality — it always showed "cached" because the cache was tested after being populated
    • target_post_type is now validated against registered public post types on save, falling back to page
    • Debug action dispatch refactored into a single switch, each case retaining its check_admin_referer() check, to reduce the chance of a missing nonce check

    Changed

    • Inline onclick confirm on Delete replaced with a data-confirm attribute + delegated handler (CSP-friendlier, less fragile)
    • Add Mapping "existing content" dropdown now queries only public post types (excludes attachments and the internal mapping CPT) with no_found_rows for better performance on large sites

    Compatibility

    • WordPress: 6.8 - 7.1
    • PHP: 8.0 - 8.5
    • MariaDB: 11.4 or newer

    Developer

    • Added bin/preflight.sh — automated pre-deploy gate (PHPCS, PHPStan 9, PHPCompatibility, PHPUnit, composer audit, candidate-ZIP inspection); PASS/FAIL report per section, never invokes deploy.sh
    • Added .claude/settings.json deny rules (deploy.sh, git push/tag/merge) enforcing the AGENTS.md operating boundaries mechanically
    • composer.json require-dev completed and pinned: added dealerdirect/phpcodesniffer-composer-installer + phpcsstandards/phpcsutils; pinned squizlabs/php_codesniffer and johnbillion/wp-compat
    • Patched two high-severity CVEs in dev tooling (not shipped — deploy.sh uses --no-dev): squizlabs/php_codesniffer 3.13.5 → 3.13.6 (CVE-2026-67434), wp-coding-standards/wpcs 3.3.0 → 3.4.1 (CVE-2026-45293). composer audit fully clean

    Tests

    • PHP Coding Standards: PHPCS with WordPress-Core, WordPress-Docs, WordPress-Extra — 0 errors
    • PHPStan: level 9, 0 errors
    • PHPCompatibility: PHP 8.0-8.5 validated
    • PHPUnit: plugin header tests pass
    • Manual testing: WordPress 7.1
    Downloads