Changelog

All notable changes to Documentation Markdown are documented in this file.

For the WordPress.org–formatted changelog, see changelog.txt.

[1.1.1] — 2026-06-08

CommonMark: disabled raw HTML passthrough (html_input: strip, allow_unsafe_links: false) — prevents stored XSS if an upstream repository is compromised
Plugin settings option now stored with autoload = false — encrypted GitHub token no longer loaded on every WordPress request
Replaced serialize() with wp_json_encode() in updater HMAC cache signature (eliminates object-injection risk surface)
Added strict base64 length validation in robotstxt_docmd_decrypt_token() before IV extraction
Added base64_decode() strict return-value check in robotstxt_docmd_get_file_content()

Admin notices now display results for all operations (mapping created/updated/deleted, sync complete, error messages); previously only "Settings saved" appeared
wp_update_post() return value now checked during sync — silent failures previously reported as success
Wrong textdomain 'robotstxt-smtp' in updater class corrected to 'robotstxt-documentation-markdown'

robotstxt-updater.php renamed to class-robotstxt-updater.php (WordPress file-naming convention)
Requires PHP header corrected to 8.0 (real minimum confirmed by PHPCompatibility scan — union types, str_starts_with(), str_contains(), mixed type are the binding constraints; no 8.1/8.2-specific features used)

Added composer.json with full require-dev tooling (PHPCS, PHPStan 2.x, PHPUnit 9.6, PHPCompatibility 10.0.0-alpha2, wp-compat, yoast/phpunit-polyfills)
Added phpstan.neon (level 9), .phpcs.xml (WordPress standards), bin/deploy.sh, phpunit.xml.dist
17 PHPUnit plugin header tests added (tests/PluginHeadersTest.php)
Added docs/known-issues.md and docs/db-migrations.md
class-robotstxt-updater.php: PHPCS 0 errors, PHPStan level 9 0 errors
PHPCompatibility updated to 10.0.0-alpha2 (PHP 8.x feature detection)

Access level changed from manage_options (administrator) to edit_pages (editor)