v0.5.1

changelog.txt

@@ -1,5 +1,30 @@
 == Changelog ==
 
+= 0.5.1 =
+
+_Release date: 2026-08-15_
+
+**Highlights**
+
+* Stabilization release after a full code + security audit (fresh-context review per AGENTS-deploy.md) and full-range compatibility scans (PHPCompatibility 5.6–8.5, wp-compat laddering). Declared requirements now match the real floors: **WordPress 4.4+** (was 4.7) and **PHP 8.0+** (was 7.4 — the updater's `mixed` type hints and `str_contains()` require 8.0; previously under-declared, which would have been a fatal on 7.4).
+
+**Fixed**
+
+* `test_connection()` reported "Connected." on non-200 responses and `get_catalog()` cached auth failures as an empty catalog for the full TTL. Both now check the HTTP status; non-200 responses return an error/empty and are never cached.
+* `site_domain()` used `ltrim( $host, 'www.' )`, which strips a character set and mangles hosts starting with `w` (e.g. `webdev.example.com` → `ebdev…`, breaking premium package URLs). Now strips only the literal `www.` prefix.
+* Native-update integration no longer injects premium `response` entries when no decryptable API key exists (the native updater would download into a 403).
+* Opt-in uninstall: also deletes the `update_plugins` site transient (premium entries embed the API key in the package URL — the plaintext copy must not outlive the plugin) and stops deleting a phantom `robotstxt_manager_db_version` option nothing ever wrote.
+
+**Changed**
+
+* API-key setting validates the format (UUID-like, 8–127 chars) before storing, rejecting mangled input at save time instead of failing later at connection time.
+* Plugin version 0.5.0 → 0.5.1. No database schema changes (no custom tables).
+
+**Compatibility**
+
+* WordPress: 4.4 - 7.1 (scan-verified: wp-compat clean from 4.4)
+* PHP: 8.0 - 8.5 (scan-verified: PHPCompatibility + manual feature audit)
+
 = 0.5.0 =
 
 _Release date: 2026-08-14_