2026.07.001

First release under the YYYY.MM.VVV version scheme.

• Fixed cache-write race: unique per-writer temp files restore atomic renames
• Added post-type guard on snippet updates and cache invalidation on external post mutations (save/delete/trash/untrash)
• Error notices now surface failed create/update/toggle/delete instead of fake success
• Fixed autoload migration ('no' + cache flush), uninstall infinite-loop guard, safe-mode notice link
• Accessibility: toggle label-in-name, Space-key activation, 24px targets, aria-describedby on fields
• Full multi-reviewer audit + cross-model review; details in #2

v2026.04.04

What's Changed

Security

• All code paths (snippets + header/footer) now require unfiltered_html capability, closing a multisite privilege escalation gap where non-super-admins could inject arbitrary JS/HTML
• PHP snippet cache moved from wp-content/uploads/ to wp-content/cache/ — no longer relies on .htaccess to block direct web access, fixing exposure on Nginx

Bug Fixes

• clear_cache() now removes stale PHP cache files when snippets are deleted, deactivated, or change type
• Migration path (v1.2) cleans up old cache location on upgrade

Improvements

• Consolidated snippet cache: single transient instead of 3-4 DB queries per page load
• PHP snippets use content-addressed cached files (written once per code change, not per request)
• Admin JS extracted to properly enqueued assets/admin.js

Accessibility

• role="alert" on all admin notices for screen reader announcement
• Descriptive aria-label on all snippet actions (edit, delete, toggle)
• CodeMirror keyboard trap fixed with Escape key handler + visible hint

Full Changelog: v2026.03.10...v2026.04.04

v2026.03.10

What's New

Security & Hardening

• Added uninstall.php for clean plugin removal (deletes CPT posts and options)
• Custom hook name validation with regex
• Server-side priority clamping (1-999)
• Fixed priority 0 edge case (elvis operator treating '0' as falsy)
• Sanitize GET params before nonce verification
• Fixed double wp_unslash in header/footer save path
• Always log snippet errors to error_log() (not just when WP_DEBUG)
• Trim whitespace-only snippet code before execution

Performance

• Transient caching for snippet queries (invalidated on save/delete/toggle)
• update_meta_cache() to eliminate N+1 meta queries
• In-memory cache for "everywhere" snippets (eliminates duplicate queries per request)
• Consolidated priority sorting into get_snippets()

Accessibility

• Status toggle links get role="button" and aria-label
• Name input gets aria-required="true" with visual required indicator
• Added :focus styles for toggle and delete buttons
• Fixed color contrast: inactive status, active status, and footer tagline now meet WCAG AA

Other

• Added uniqid() to temp file names for concurrency safety
• Excluded log files from plugin zip

v2026.02.12

Initial release of Awesome Code Snippets Pro Max

Features:

• Code snippet management with categories
• Syntax highlighting via Prism.js
• Header/footer code injection
• Shortcode support for embedding snippets
• Safe Mode - recover from bad snippets by adding ?acspm-safe-mode=1 to any URL