• 0.5.1 061329c704

    v0.5.1 Stable

    javier released this 2026-08-15 12:41:15 +00:00 | 17 commits to main since this release

    0.5.1

    Release date: 2026-08-15

    Highlights

    • Stabilization release after a full code + security audit (fresh-context review per AGENTS-deploy.md) and full-range compatibility scans (PHPCompatibility 5.6–8.5, wp-compat laddering). Declared requirements now match the real floors: WordPress 4.4+ (was 4.7) and PHP 8.0+ (was 7.4 — the updater's mixed type hints and str_contains() require 8.0; previously under-declared, which would have been a fatal on 7.4).

    Fixed

    • test_connection() reported "Connected." on non-200 responses and get_catalog() cached auth failures as an empty catalog for the full TTL. Both now check the HTTP status; non-200 responses return an error/empty and are never cached.
    • site_domain() used ltrim( $host, 'www.' ), which strips a character set and mangles hosts starting with w (e.g. webdev.example.comebdev…, breaking premium package URLs). Now strips only the literal www. prefix.
    • Native-update integration no longer injects premium response entries when no decryptable API key exists (the native updater would download into a 403).
    • Opt-in uninstall: also deletes the update_plugins site transient (premium entries embed the API key in the package URL — the plaintext copy must not outlive the plugin) and stops deleting a phantom robotstxt_manager_db_version option nothing ever wrote.

    Changed

    • API-key setting validates the format (UUID-like, 8–127 chars) before storing, rejecting mangled input at save time instead of failing later at connection time.
    • Plugin version 0.5.0 → 0.5.1. No database schema changes (no custom tables).

    Compatibility

    • WordPress: 4.4 - 7.1 (scan-verified: wp-compat clean from 4.4)
    • PHP: 8.0 - 8.5 (scan-verified: PHPCompatibility + manual feature audit)
    Downloads