v1.2.2

Changelog

Release date: 10 September 2026

Changed

• Server-side highlighting is faster on pages with several code blocks, and very large blocks now fall back to unhighlighted text rather than stalling the page — the threshold is filterable with the new wzcbh_server_highlight_max_bytes.
• Settings screens and per-block help text now use American English.

Security

• Hardened settings sanitization so every field type is sanitized before it is stored, with choice fields validated against the options they register.
• Hardened textarea sanitization in the settings framework.
• The color scheme setting is now validated everywhere it is used to build a file path.

Fixed

• A file name containing $0, $1 or \0 was written into the block's markup as the surrounding tag text instead of the name itself; line ranges and download file names were affected the same way.
• Copying a code block in server-side mode added a blank line after every highlighted line.
• Server-side mode repeated the language class the block had already saved, and could add an empty class attribute.
• data-title, data-line and data-start were written twice on every code block.
• With line highlighting on, server-side mode could render one line more than the line-number gutter showed, and the extra line could pick up the highlight.
• A "Highlight lines" value spanning a very large range, such as 1-999999999, exhausted memory while the page was rendering.
• The "Settings" link in the admin banner, and the redirect at the end of the setup wizard, pointed at an address that returned a permissions error.
• Code blocks stopped the page rendering when a theme or plugin made the main query return post IDs rather than posts.
• Deprecation notices on PHP 8.6 from calling trim() without an explicit second argument.

Full Changelog: v1.2.1...v1.2.2