CGM Core 3.0.1

CGM Core 3.0.1 — patch release

• Fix: primary admin nav no longer shows a stray vertical scrollbar — the active-tab underline escaped the scrollable nav container by 1px, computing overflow-y to auto (AppLayout)

CGM Core 3.0.0-beta.1

CGM Core 3.0.0-beta.1 � content interoperability platform for WordPress.

Highlights

• React control room � 17-route admin console: Overview, Setup, Queries, Content, Relationships, Data, Reports, Automation, Bulk, Workflow, Search, Graph, Inspector, Configuration, Diagnostics.
• Views-style query platform � nested AND/OR groups with field, relationship, reverse relationship, relationship count, relationship property, data-path and taxonomy rules; aggregation (COUNT/SUM/AVG/MIN/MAX), exposed filters, views displays, relative dates.
• Relationships � forward/reverse platform, model editor, integrity audit + repair, core-store SQL (property, wrap, sort, reverse, count).
• Editorial workflow � registrable states, one-off scheduled transitions, and auto-transition policies (auto-expire / auto-archive).
• Automation (Rules) � event ? conditions ? 12 action types (dispatch, reindex, purge, set meta/term/status, add relationship, notify, webhook, schedule, add term, call action).
• Search + facets � unified search facade with a native WordPress provider and a Typesense provider bridge, plus search-index definitions.
• Graph API � object/relationship graph with a visualizer.
• Bulk operations � run actions against a query result set (Views Bulk Operations parity).
• Config-as-code � export/diff/import/rollback with promote flow.
• Non-CGM providers � WooCommerce, Yoast SEO, Typesense, plus a generic bring-your-own-provider path.
• Gutenberg blocks � Smart Collection and Related Content, plus Query Loop and Dynamic Value.
• Legacy suite compatibility � shims so CGM Authors, SEO, Scheduled Revisions, Homepage Manager, Editorial Intelligence, Tag Manager and Typesense keep working.

Requirements

• WordPress 6.7+
• PHP 8.1+

Notes

This beta transitions from the feature-lock alpha: the full platform surface is implemented and beta is scoped to runtime QA, performance profiling, accessibility, visual polish and compatibility.

CGM Core 3.0.0

CGM Core 3.0.0 — final release

First stable release of the WordPress content interoperability platform.

Security fixes

• Author privilege escalation closed: workflow transitions/schedules now require per-object edit_post caps at both REST and manager layers; cron sweeps use an internal path (WorkflowController/WorkflowManager)
• Private content disclosure closed: query status forcing now keys on
  ead_private_posts instead of edit_posts; non-public saved queries refuse to run outside managers (QueryEngine)
• Relationship traversal leaks closed: relationship reads are visibility-filtered for all non-privileged callers (traversal, dynamic data, reverse reads); RelationshipManager::can() no longer falls through to a generic capability
• Dynamic data REST: keys checked against their public flag centrally; object readability verified; anonymous site-wide reads require real caps
• REST nonce enforcement on every state-changing route (defense-in-depth alongside core cookie checks)
• CSV export guards against formula injection
• Webhook rule action: https-only + private-IP-range SSRF guard with cgm_core/rule_webhook_url_allowed escape hatch
• Registry editor route requires manage/inspect caps instead of edit_posts
• Saved query definitions validated and allowlisted at write time

Bug fixes

• Automation rules created in the UI now persist (client-generated ids)
• Workflow state stays in sync with native WordPress publishing and enforces the registered transition graph
• Cache invalidation dependency IDs aligned between the query engine and invalidator; user/term meta invalidation added; trash/untrash invalidates; relationship hook signature fixed
• JSON-path keys quoted (hyphenated meta keys no longer error); invalid keys compile to NULL
• Network relationship store sanitizes IN() values; term provider supports reverse/count relationship filters; single sort objects normalized
• Saved-query lookup rejects trashed/draft/corrupt definitions; query page param capped; caching limited to page-1 runs of saved queries; usage tracking pruned
• VisibilityPolicy::is_public() added (fixed latent fatal on wildcard-target relationships)
• ListTables state filter only applies to registered CGM post lists; Bootstrap endpoint admits configuration managers; UI pages gate their requests on capabilities

Cleanup

• Removed dead code: Permissions class + cgm_core_can(), PathController, ConfirmDialog, unused UI components, SuiteIntegration no-op hook, 11 unused Radix dependencies
• Uninstall now removes telemetry/rules/notifications/workflow options and the multisite network table under CGM_CORE_REMOVE_DATA_ON_UNINSTALL
• Tooling: PHPStan WordPress stubs, PHPCS covers uninstall/includes, test paths fixed for case-sensitive CI, vite emptyOutDir: true
• Telemetry opt-out filter, Pathauto uniquify hook, CLI export restricted to WP_CONTENT_DIR

Notes

• README corrected to match shipped reality (RSS/feed displays removed, capability model documented)
• Deliberately unchanged: empty registry subclasses (typed public API), build assets tracked in VCS (distributable plugin), auto-transition sweep capped at 200 posts/day (documented in code)