PHP Checker 1.2.1

The Hack Repair Guy's PHP Checker 1.2.1

Reliability and security hardening

• Bound pending-update ZIP archives to 256 MiB, 20,000 entries, and 1 GiB of declared uncompressed content before indexing. The existing 2 MiB per-file scan ceiling remains.
• Bind an active scan to its job token and initiating administrator. Atomic claims and a step lock prevent overlapping requests from replacing scan state; a stale step cannot restore a stopped job.
• Attribute runtime deprecations correctly when PHP reports a canonical plugin path that differs from WordPress's symlinked plugin directory.
• Select the release asset whose filename exactly matches the tagged version, regardless of asset order.
• Remove tracked per-user email cooldown transients during uninstall.

Maintenance

• Split report evaluation and formatting from the request controller, and split admin view preparation and panels into separate files without changing the report layout.
• Expanded scanner, ZIP, runtime-handler, token-guard, updater, and uninstall fixtures.

Verification

• php tests/run.php: 103 assertions passed.
• phpcs --standard=phpcs.xml.dist: 23/23 first-party PHP files passed with no errors or warnings.
• JavaScript syntax and git diff --check passed.
• Reviewed the local WordPress admin page in Ego Lite, including scan controls, verdict, component report, settings, and footer. This was a local test, not a production deployment test.