v1.11.0

What's Changed

• Include PHPStan in the aggregate check gate by @dknauss in #46
• build(deps): Bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #48
• build(deps): Bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by @dependabot[bot] in #49
• build(deps): Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in #50
• build(deps): Bump github/codeql-action/init from 4.36.3 to 4.37.1 by @dependabot[bot] in #51
• build: keep codeql-action in lockstep at v4.37.1 by @dknauss in #52
• ci: group Dependabot updates + restore missing labels by @dknauss in #53
• feat: optional blocking mode + mail From-name encoding (1.11.0) by @dknauss in #54

Full Changelog: v1.10.6...v1.11.0

Verify this release

• SHA-256: 0c98b32f97255c6c59bee0623efba648d3edc0929c2a5347e063a748ce9f576e
• Checksum: sha256sum -c force-email-two-factor.zip.sha256
• Provenance: gh attestation verify force-email-two-factor.zip --repo dknauss/Require-Email-2FA --signer-workflow dknauss/Require-Email-2FA/.github/workflows/release.yml --source-ref refs/tags/v1.11.0
• Reproduce from source: see docs/SUPPLY-CHAIN-SECURITY.md

v1.10.6

What's Changed

• docs: add CLAUDE.md guidance for AI-assisted development by @dknauss in #38
• test: close under-tested gaps in security-critical paths by @dknauss in #39
• docs+test: correct REST API-login scope; harden review-found gaps by @dknauss in #40
• docs: security model section + plain-language rollout checklist by @dknauss in #42
• release: 1.10.6 by @dknauss in #43
• Update README.md by @dknauss in #44
• Update README to clarify XML-RPC and REST API scope by @dknauss in #45

Full Changelog: v1.10.5...v1.10.6

Verify this release

• SHA-256: 002da79965db7b6ef1af9b16224579793442250eefd02fceec6c620a3cb627d9
• Checksum: sha256sum -c force-email-two-factor.zip.sha256
• Provenance: gh attestation verify force-email-two-factor.zip --repo dknauss/Require-Email-2FA --signer-workflow dknauss/Require-Email-2FA/.github/workflows/release.yml --source-ref refs/tags/v1.10.6
• Reproduce from source: see docs/SUPPLY-CHAIN-SECURITY.md

v1.10.5

What's Changed

• Harden update E2E cache isolation by @dknauss in #32
• Add uninstall cleanup to purge Plugin Update Checker state by @dknauss in #35
• build(deps): Bump actions/attest-build-provenance from 3.0.0 to 4.1.1 by @dependabot[bot] in #33
• build(deps): Bump actions/setup-python from 5.6.0 to 6.3.0 by @dependabot[bot] in #34
• Add multisite uninstall coverage to the E2E suite by @dknauss in #36
• release: 1.10.5 by @dknauss in #37

Full Changelog: v1.10.4...v1.10.5

Verify this release

• SHA-256: 5ed3f9aba515ebd2960ea054f7afccd9b5b2bf4492f6abc0f676ced0df2407b5
• Checksum: sha256sum -c force-email-two-factor.zip.sha256
• Provenance: gh attestation verify force-email-two-factor.zip --repo dknauss/Require-Email-2FA --signer-workflow dknauss/Require-Email-2FA/.github/workflows/release.yml --source-ref refs/tags/v1.10.5
• Reproduce from source: see docs/SUPPLY-CHAIN-SECURITY.md

v1.10.4

What's Changed

• docs: add repository status badges by @dknauss in #30
• release: 1.10.4 by @dknauss in #31

Full Changelog: v1.10.3...v1.10.4

Verify this release

• SHA-256: 6d07653c6a543ea44caeb6986eeefec500d7057cb2575da890c10bdf9df337b1
• Checksum: sha256sum -c force-email-two-factor.zip.sha256
• Provenance: gh attestation verify force-email-two-factor.zip --repo dknauss/Require-Email-2FA --signer-workflow dknauss/Require-Email-2FA/.github/workflows/release.yml --source-ref refs/tags/v1.10.4
• Reproduce from source: see docs/SUPPLY-CHAIN-SECURITY.md

v1.10.3

What's Changed

• ci: harden CodeQL pinning + add Semgrep PHP scanning by @dknauss in #28
• release: 1.10.3 by @dknauss in #29

Full Changelog: v1.10.2...v1.10.3

Verify this release

• SHA-256: 3df7df19484e9a52752fd5bc90bffa2e8a60435e5b90e6a3f921a47ded21973e
• Checksum: sha256sum -c force-email-two-factor.zip.sha256
• Provenance: gh attestation verify force-email-two-factor.zip --repo dknauss/Require-Email-2FA --signer-workflow dknauss/Require-Email-2FA/.github/workflows/release.yml --source-ref refs/tags/v1.10.3
• Reproduce from source: see docs/SUPPLY-CHAIN-SECURITY.md

v1.10.1

What's Changed

• 1.10.1: dependency notice reflects missing vs. installed-but-inactive Two Factor by @dknauss in #21
• ci: add PHPStan (level 5) with WordPress stubs and a baseline by @dknauss in #20

Full Changelog: v1.10.0...v1.10.1

v1.10.0

What's Changed

• 1.9.1: address v1.9.0 security review (Codex) by @dknauss in #17
• Add GitHub release update E2E test by @dknauss in #18
• 1.10.0: self-update opt-out + Site Health check, security-review follow-ups by @dknauss in #19

Full Changelog: v1.9.0...v1.10.0

v1.9.0

Multisite: network-only, with a guided dependency

• On multisite the plugin is now network-only — per-site activation is refused with a "must be Network Activated" notice (admin UI + WP-CLI).
• Two dependency notices: an actionable Network Admin notice (one-click install + network-activate Two Factor) and a per-site heads-up on sites where Two Factor isn't loaded.
• The one-click installer network-activates Two Factor and checks install_plugins + manage_network_plugins independently.

Self-hosted updates from GitHub Releases

• Installed sites now receive updates straight from this repo's Releases via Plugin Update Checker (vendored and pinned in-repo). The Update URI header also prevents any same-slug WordPress.org plugin from hijacking updates.
• This release ships the first force-email-two-factor.zip asset, so 1.9.0 → future versions auto-update.

Copy & docs

• Harmonized dependency-notice wording ("The Require Email 2FA plugin is not enforcing email 2FA…"); new FAQ on expired email codes.

Security / CI

• Release pipeline is a pure `git archive` of reviewed, in-repo bytes (no release-time Packagist resolution); CI Actions pinned by SHA; real-multisite E2E added to CI.

v1.8.1

Metadata/header/docs release — no plugin runtime or behavior changes since 1.8.0.

• Plugin header: add Plugin URI and Text Domain; set Author: Pixel (with Author URI: https://wearepixel.ca); remove the invalid Network: false header (Plugin Check plugin_header_invalid_network).
• readme.txt: correct the Contributors username to dpknauss.
• New interactive WordPress Playground "try it live" demo — lands on the Plugins screen with the guided "Install & activate Two Factor" notice and sample users.
• Tooling: enable the WordPress.WP.I18n sniff with a pinned text domain; bump pinned GitHub Actions (checkout, setup-node, upload-artifact).

Verified: PHPCS clean (incl. i18n) and Plugin Check reports "No errors found."

v1.8.0

Softens the Two Factor dependency from a hard activation gate to a guided soft-check.

Highlights

• No more dead-end activation. Replaces the hard Requires Plugins: two-factor gate: the plugin now activates on its own and safely no-ops until Two Factor is active, instead of failing with "required plugins are missing."
• Guided fix. While Two Factor is inactive, an admin notice warns that 2FA is NOT being enforced and offers a one-click install/activate from WordPress.org (nonce- and capability-checked).
• force_2fa_dependency_met() is now the single source of truth, reused by the enforcement filter and the notice.
• New unit-tested helpers force_2fa_should_nag() / force_2fa_required_install_cap(); admin_notices + admin_post hooks wired.
• Plugin description clarified to "the default, required login factor."
• Docs: clearer mu-plugin setup — flat loader in mu-plugins/, full plugin stays in plugins/, with a directory diagram and how to disable.

Tests

42 unit/integration tests pass; PHPCS clean; Playground real-activation check green.

Full changelog: see readme.txt.