-
v1.4.0 Stable
released this
2026-08-17 16:07:34 +00:00 | 8 commits to main since this release1.4.0
Release date: 2026-08-17
Changed
- Premium package URLs use short-lived download tokens (Core 1.9.0+
POST /me/download-token): the updater exchanges the account key each update cycle and embeds the 15-minute token instead of the API key, so the long-lived key no longer sits in theupdate_pluginstransient or server access logs. Falls back to the API-key flow automatically on older Core. (Closes the 0.5.1 audit finding.)
Compatibility
- WordPress: 4.4 - 7.1 (scan-verified: wp-compat clean from 4.4)
- PHP: 8.0 - 8.5 (scan-verified: PHPCompatibility + manual feature audit)
Downloads
- Premium package URLs use short-lived download tokens (Core 1.9.0+