2.1.0 - Blocks, spam protection, and review fixes

Adds block editor support and spam protection, and fixes a set of security and correctness bugs found in a full review of the plugin.

Requires WordPress 6.3 and PHP 8.0.

New

• Blocks. Newsletter Signup and Newsletter Preferences are now native blocks. They are rendered on the server and produce the same markup as the shortcodes, so existing styling applies to both. The shortcodes still work.
• Spam protection. A honeypot field and a minimum fill time protect both public forms. Submissions are throttled per IP address and per email address, which stops the form being used to flood an inbox. A suppression list accepts addresses or whole domains, disposable domains can be blocked, and Cloudflare Turnstile is supported when you supply keys.
• Admin actions that were missing. Add a subscriber, bulk unsubscribe, resubscribe, delete, CSV export, and Run Cleanup now work. The logo field uses the WordPress media picker.

Fixed

• Confirmation, unsubscribe, and preferences links never ran their handler. The dispatcher was attached to a hook that had already started.
• An empty confirmation token could confirm a subscription that nobody had confirmed.
• Unsubscribing raised a fatal error for any subscriber who had given consent.
• Saving the schedule raised a fatal error and left the digest unscheduled.
• Clicking a form button sent no action, so unsubscribe, pause, and resume did nothing.
• Admin scripts and styles never loaded on the settings, subscribers, templates, or privacy pages, so the settings tabs were unreachable.
• Upgrading from version 1.x skipped the subscriber migration.
• Digest send times ignored the site timezone, and the monthly digest drifted by a day or two each month.
• The subscriber list showed only subscribed rows while counting every row.

Changed

• Digests are sent in batches through cron, and the email body is rendered once per run instead of once per recipient.
• Schedules are single events that re-arm after each send, so a missing event is recreated automatically.
• Email templates resolve from a child theme, then the parent theme, then the plugin. The built-in duplicate copies are gone.
• The plugin no longer forces every email sent by the site to HTML.

The full review, with each finding and its fix, is in CODE_REVIEW.md in the repository.