# Changelog

All notable changes to OpenGraph (by ROBOTSTXT) will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.0.0] - 2026-02-18

### Added
- Automatic format detection for AVIF, WebP, GIF, BMP, SVG, and TIFF featured images
- HTTP HEAD-based resolution of compatible JPEG/PNG alternatives
- Postmeta caching (`_og_image_fallback_url`) with automatic invalidation on featured image change
- Negative caching via transients (1-hour TTL) to avoid repeated failed HEAD requests
- Open Graph meta tags: `og:image`, `og:image:secure_url`, `og:image:width`, `og:image:height`, `og:image:type`
- Direct `wp_head` tag injection (when no SEO plugin is active)
- Yoast SEO integration via `wpseo_opengraph_image` filter
- RankMath integration via `rank_math/opengraph/facebook/og_image` filter
- Global fallback image setting (configurable in Settings > OpenGraph)
- Taxonomy archive image support via `robotstxt_og_taxonomy_image` filter
- Admin settings page (Settings > OpenGraph) with three tabs: Settings, Tools, Diagnostics
- WP-CLI commands: `wp og-fallback resolve` and `wp og-fallback clear-cache`
- REST API: `POST /wp-json/robotstxt-og/v1/resolve/{post_id}` and `GET /wp-json/robotstxt-og/v1/status/{post_id}`
- Developer filters: `robotstxt_og_external_image_enabled`, `robotstxt_og_external_image_timeout`, `robotstxt_og_taxonomy_image`, `robotstxt_og_enable_logging`
- Auto-updater via Gitea (`robotstxt-updater.php`)
- Multisite compatible with per-site configuration
- Full internationalization support (text domain: `robotstxt-og`)
- `uninstall.php` with optional data deletion on plugin removal

### Security
- Nonce verification on all forms and state-changing actions
- `manage_options` capability check on all admin pages, REST endpoints, and WP-CLI commands
- Input sanitization via WordPress APIs throughout
- Output escaping on all dynamic HTML
- WordPress database APIs exclusively (no direct SQL writes; `$wpdb->prepare()` for reads)
- CSRF protection on all state-changing actions

[1.0.0]: https://git.robotstxt.es/ROBOTSTXT/robotstxt-og/releases/tag/1.0.0