v1.3.3

Fixes

Critical

• Front-end fatal — is_plugin_active() guard added for non-admin page loads (Phase 0)
• Linear gradient detection — GRADIENT_LINEAR case added (was silently dropped; Phase 1)

Security (Phase 2)

• esc_url() on image src, add_link_attributes() for custom link
• SSRF host allowlist + image-only MIME restriction on downloads
• current_user_can('manage_options') added to admin handlers
• .htaccess deny-all added to log directory

Logic bugs (Phase 3)

• BOOLEAN_OPERATION/STAR/POLYGON mapped to icon (not image) — SVG export path
• Per-side stroke weight — reads flat strokeTopWeight/strokeLeftWeight etc.
• Partial padding — individual sides applied, missing sides default to 0
• Social icons 'x' matcher — word-boundary regex instead of bare str_contains
• Dead ternary in extract_button_settings — split into proper fallback logic

Data integrity (Phase 3/4)

• to_object list repeater corruption — sequential arrays preserved as arrays (not stdClass with numeric keys)
• Stat parser — EU ambiguous formats return null, negative signs handled

CI

• PHPCS line length errors/warnings resolved
• PHPStan nullCoalesce.offset in image-handler.php resolved

Tests

• 29 new regression tests covering all fixes above
• Existing test suites: 126/126 green
• PHPStan Level 6: 0 errors
• PHPCS: 0 errors