Skip to content

1.1.1 - Identifier prefix cleanup & debug-log gating

Choose a tag to compare

View all tags
@nolderoos nolderoos released this 14 May 14:59
· 7 commits to main since this release
1.1.1
1e8f78d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A proactive hardening release that extends the 1.1.0 WordPress.org review work. No new features — every change is naming consistency, security hardening, or internal correctness.

What changed

  • Short ot_ / _ot_ prefix removed from the rest of the plugin's identifiers. The round-1 wp.org review scoped the prefix finding to the custom post type slugs (fixed in 1.1.0 → opentr_*). This release extends the cleanup to every other shared/global identifier:
    • Postmeta keys — _ot_* → _opentrust_* (all ~44 plugin-owned keys)
    • Policy URL query variables — ot_policy_slug / ot_version → opentrust_*
    • Meta box IDs, admin list-table column IDs, and import/export form field names → opentrust_*
  • Diagnostic error_log() calls are now gated behind WP_DEBUG via a single centralized helper, so production sites stay quiet while the failure detail is still available to developers debugging an install.
  • Bundled translation template regenerated. Database schema version bumped to 5.

Database migration

An automatic, idempotent v4 → v5 migration rewrites existing postmeta to the new keys on the first load after upgrade — it runs once, retries safely if interrupted, and busts the relevant caches. Post content, meta values, revisions, version history, and WPML/Polylang translation links are all preserved, and existing trust-center URLs are unaffected.

Upgrade notes

  • No manual action is required. A database backup before upgrading is recommended, as with any schema migration.
  • If you maintain custom code that references the old _ot_* postmeta keys or the ot_policy_slug / ot_version query variables directly, update those references to the new _opentrust_* / opentrust_* names.
  • Pre-1.1.1 export archives still import correctly — the importer transparently remaps the old keys.

Verification

All CI green (PHP lint 8.1–8.4, PHPStan, Semgrep, security scan, WordPress Plugin Check, POT freshness, version consistency). Reviewed by multiple independent audit passes — one migration-ordering bug (duplicate UUID rows on a v1→1.1.1 jump) was caught and fixed before release. Functionally tested on a clean WordPress install.

Full Changelog: 1.1.0...1.1.1

Assets 3
Loading