v0.5.3

changelog.txt

@@ -1,5 +1,42 @@
 == Changelog ==
 
+= 0.5.3 =
+
+_Release date: 2026-08-15_
+
+**Added**
+
+* Authenticated encryption for the stored API key (same encrypt-then-MAC scheme as Core 1.6.0): tampered payloads fail closed, and encryption refuses to run without real WordPress salts. Legacy-stored keys keep decrypting and re-encrypt on the next save.
+
+**Changed**
+
+* Plugin version 0.5.2 → 0.5.3. No database schema changes (no custom tables).
+
+**Compatibility**
+
+* WordPress: 4.4 - 7.1 (scan-verified: wp-compat clean from 4.4)
+* PHP: 8.0 - 8.5 (scan-verified: PHPCompatibility + manual feature audit)
+
+= 0.5.2 =
+
+_Release date: 2026-08-15_
+
+**Fixed**
+
+* Manager-panel Install/Update failed while the native WordPress updater worked. Two defects in the panel's upgrader path (`Robotstxt_Manager_Installer`):
+  1. `ensure_plugin_functions()` required only `class-wp-upgrader.php`, which since the WordPress 5.3 class split no longer defines `Plugin_Upgrader` (it lives in `class-plugin-upgrader.php`). In a stock `admin-post.php` context nothing else loads it → fatal error. Both files are now required.
+  2. The overwrite flag was passed to `Plugin_Upgrader::install()` as `'overwrite'`, but current WordPress reads `'overwrite_package'` — the unknown key was silently discarded, `clear_destination` stayed false, and the install failed against the existing folder. Both keys are now passed (the unused one is ignored by `wp_parse_args()`), keeping compatibility across WP versions.
+* Verified end-to-end on the live store: panel-path download → overwrite-install succeeds, plugin remains active.
+
+**Changed**
+
+* Plugin version 0.5.1 → 0.5.2. No database schema changes (no custom tables).
+
+**Compatibility**
+
+* WordPress: 4.4 - 7.1 (scan-verified: wp-compat clean from 4.4)
+* PHP: 8.0 - 8.5 (scan-verified: PHPCompatibility + manual feature audit)
+
 = 0.5.1 =
 
 _Release date: 2026-08-15_