v0.1.2 — docs correction

Docs-only release. No PHP logic changes, no functional changes.

Fixed

• Corrected the SMTP AUTH basic-authentication retirement timeline for Microsoft 365, matching Microsoft's 2026-01-27 schedule update. Previous wording read as though SMTP AUTH was already dead; it is on a phased schedule: disabled by default for existing tenants from the end of December 2026, unavailable by default for new tenants from 2027, with the final removal date to be announced in the second half of 2027.
• Updated the install-time budget from "half an hour" to "about an hour" to match the current guide.
• Replaced a stale hardcoded missivus-0.1.1.zip example with the missivus-<version>.zip placeholder already used elsewhere in the install guide.

Affected files: README.md, readme.txt, docs/faq.md, docs/INSTALL.md, missivus.php, CHANGELOG.md.

v0.1.1 — endpoint URLs never reach a log

A security fix, mirroring missivus-matomo v0.1.4. Reported against the Matomo plugin by @textagroup (Kirk Mayo) as missivus-matomo#1. Thank you.

Endpoint override URLs are no longer repeated back into errors, the log, or the admin notice

Endpoint::normalise() refused an unsafe MISSIVUS_GRAPH_BASE_URL / MISSIVUS_LOGIN_BASE_URL correctly, but ended its message with the rejected value verbatim — and that message was then logged by Mailer, attached to wp_mail_failed, and shown by the test-email screen, none of them with a final redaction pass.

So a base URL carrying credentials (https://user:password@host) or a token (?access_token=…) could reach the PHP error log and the WordPress admin. It needs a misconfiguration the site owner authored themselves, and both readers are already trusted surfaces — but it is a credential crossing a boundary it never needed to cross.

Fixed in three independent layers:

• Endpoint no longer assembles what it must not print. Every message is built from scheme, host, port and path only; userinfo, query string and fragment never enter a message at all. A value too malformed to parse, or a host name that fails validation, is reported by reason rather than by value.
• Redactor learned URL shapes — credentials inside a URL (anchored on ://, so an ordinary mailbox address is left alone), any name=value on the new Redactor::SECRET_PARAMS list (access_token, client_secret, code, password, signature, sas, …), and URL fragments.
• Mailer::redact() is now the single final pass on every string the mailer logs, hands to wp_mail_failed, or throws, and Admin\TestEmail applies the same pass to the admin notice.

The vendored transport under src/Vendor/Solvetus/Missivus/ is resynced from missivus-matomo v0.1.4 and remains byte-for-byte identical to it.

tests/Unit/EndpointRedactionTest.php adds eleven tests, two of which define a poisoned base-URL constant in their own PHP process and drive the real failure path — asserting the credential appears in neither the log, the wp_mail_failed payload, nor the admin notice, and that no HTTP request was built at all. 57 tests pass; PHPCS with WordPress-Coding-Standards clean; php -l and PHPCompatibilityWP clean at the 7.2 floor.

Full write-up as finding 3a in docs/SECURITY.md. Nothing to reconfigure on upgrade.

Install

Upload missivus-0.1.1.zip through Plugins → Add New → Upload Plugin, or wp plugin install missivus-0.1.1.zip --activate.

Missivus for WordPress 0.1.0

Initial release. Routes every wp_mail() call through Microsoft Graph sendMail with OAuth2 client credentials and the Mail.Send application permission, sending as one shared mailbox — no SMTP, no delegated login, no paid tier.

• Graph transport vendored unchanged from missivus-matomo: secret and certificate auth (PS256, RS256 escape hatch), transient-cached tokens with a five-minute margin, one retry on 401, secret redaction everywhere.
• Full wp_mail() fidelity: HTML/plain, Cc, Bcc, Reply-To, attachments — automatic draft → upload-session path above 3 MB.
• Forced From with a Reply-To keep and a logged warning; nothing ever fails silently (wp_mail_failed + error log carry the exact redacted Microsoft error).
• wp-config.php constants win over the UI and keep secrets out of the database; write-only secret fields; test-email button gated on the saved configuration.
• PT-PT, FR, ES, IT translations shipped. 46 PHPUnit tests, PHPCS (WordPress-Coding-Standards) clean, Plugin Check passing, PHP 7.2 floor verified.

Install: upload missivus-0.1.0.zip via Plugins → Add New → Upload, then follow docs/INSTALL.md.