This commit is contained in:
Javier Casares 2026-08-17 16:07:31 +00:00
commit 21df13f02a
5 changed files with 76 additions and 9 deletions

View file

@ -1,5 +1,18 @@
== Changelog ==
= 1.4.0 =
_Release date: 2026-08-17_
**Changed**
* Premium package URLs use short-lived download tokens (Core 1.9.0+ `POST /me/download-token`): the updater exchanges the account key each update cycle and embeds the 15-minute token instead of the API key, so the long-lived key no longer sits in the `update_plugins` transient or server access logs. Falls back to the API-key flow automatically on older Core. (Closes the 0.5.1 audit finding.)
**Compatibility**
* WordPress: 4.4 - 7.1 (scan-verified: wp-compat clean from 4.4)
* PHP: 8.0 - 8.5 (scan-verified: PHPCompatibility + manual feature audit)
= 1.3.1 =
_Release date: 2026-08-17_