v1.9.0

[1.9.0] - 2026-10-12

Release summary: This minor release hardens comment ingestion with a honeypot anti-spam field and per-IP throttling, completes CSP nonce coverage across every inline admin script, and lands a large static-analysis-driven cleanup that corrects hundreds of PHPDoc/type annotations across the codebase.

Added

• Comment honeypot anti-spam – Hidden website field on the blog single-post template silently accepts (without storing) bot-submitted comments
• Per-IP comment throttling – Sliding-window rate limit (10 per 10 minutes) returns 429 Too Many Requests with Retry-After
• CSP nonces on inline scripts – Every inline <script> in admin/auth layouts now carries a nonce from the CSP_NONCE constant
• Data request request_updated migration – New CLI-only install/migrate-data-request-updated-column.php

Changed

• DAOs use explicit SELECT_COLUMNS constants / column lists instead of SELECT *
• AppConfig::writeConfiguration() embeds the resolved payload inline
• LogError/PassPhraseKey switch private static access from static:: to self::

Fixed

• CSRF token timing on privacy policy (token regenerated only after POST validation)
• index.php fails cleanly with HTTP 500 when the app is unconfigured
• Optional-dependency guards (BombScanner, UserDao, DB handles, WMI)
• DbMySQLi returns false on failed prepared statements
• CIDR netmask, elapsed-week, plugin sort-order, and unique-id cast edge cases

Security

• CSP script-src now includes the shared nonce source
• Honeypot detection and per-IP throttling reduce comment spam and abuse
• PHPStan level-1 static analysis clean across the release payload

Codename

Maleo Senkawor (retained) – Honoring Macrocephalon maleo, the critically endangered megapode endemic to Sulawesi, Indonesia.

Previous release: v1.8.3 · Commits since: 172

See CHANGELOG.md for the full changelog.