This release hardens frontend chat security by sanitizing AI-generated Markdown HTML, improving rendered link safety, and using cryptographic chat session IDs. It also updates the release build and deployment workflow for safer packaging and distribution.
Security
- Hardened frontend chat rendering with DOMPurify sanitization for AI-generated Markdown HTML
- Strengthened chat session IDs with cryptographic random generation
- Improved frontend link safety by removing unsafe URL schemes from rendered answers
- Limited GitHub Actions workflow permissions to read-only contents access
Build and Release
- Added DOMPurify to the release asset build and frontend script dependency chain
- Disabled WordPress.org SVN deployment unless explicitly enabled after plugin approval
- Ensured the release ZIP includes the required DOMPurify vendor asset
Tests
- Added unit test coverage to confirm the frontend chat script depends on DOMPurify
What's Changed
New Contributors
Full Changelog: v1.1.1...v1.1.2
Contributors
dxd5001