WP Sudo v4.8.0 — Research Snapshot

Versions before 4.9.0 automatically replayed an intercepted request after reauthentication (#322). Do not use this version.

RESEARCH PROTOTYPE ONLY. Do not install on production, public staging, or any site containing real users, credentials, or data. Use only in WordPress Playground or a disposable local test environment.

What's Changed

• release: v4.7.0 phase 2 — post-tag blueprint + release-status by @dknauss in #200
• docs(state): reconcile — Milestones A+B released as v4.7.0 by @dknauss in #201
• docs(release-status): retire stale v4.5-era 'unreleased main' narrative by @dknauss in #202
• docs(state): handoff — stage design pass for #182 then #179 by @dknauss in #203
• chore(deps): override adm-zip to ^0.6.0 (CVE-2026-39244) by @dknauss in #212
• chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #216
• chore(deps-dev): bump @wordpress/env from 11.10.0 to 11.11.0 by @dependabot[bot] in #209
• fix(admin): make governance capabilities readable on the user profile by @dknauss in #205
• docs: core recent-auth gate — spec, POC patches, demo reconciliation by @dknauss in #210
• fix(security): gate REST POST on user account-mutation rules by @dknauss in #213
• chore(deps): bump slackapi/slack-github-action from 3 to 4 by @dependabot[bot] in #208
• chore(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #207
• ci: harden wp-env startup against hangs in E2E workflows by @dknauss in #217
• feat(gate): user.change_email rule + non-replayable profile saves by @dknauss in #214
• fix(security): gate REST writes to critical settings (siteurl/admin_email) by @dknauss in #215
• docs: record PR 215 review false-positive by @dknauss in #218
• feat(editor): in-editor sudo session indicator (#182) — server-side data feed by @dknauss in #204
• feat(lockdown): role/capability drift audit — audit-only MVP (#179) by @dknauss in #206
• docs: 4.8.0 release notes (CHANGELOG date + readme.txt entry) by @dknauss in #220
• chore(release): bump version to 4.8.0 by @dknauss in #221

Full Changelog: v4.7.0...v4.8.0