v1.4.0 - Security Hardening, Global Settings & WordPress 7.1 Support

What's Changed in v1.4.0

🔒 Security & WordPress.org Plugin Directory Compliance

• Late Output Escaping Architecture: Enforced context-aware late escaping (esc_html, esc_attr, esc_url, wp_kses) strictly at the point of output across all rendered HTML, attributes, and URLs to satisfy WordPress review standards.
• Accent Color Sanitization: Added strict validation for accent colors via sanitize_hex_color() / sanitize_text_field() to prevent arbitrary CSS injection.

⚙️ Global Plugin Settings

• Added a new settings dashboard under Settings → Credits (options-general.php?page=credits-shortcode) with WordPress native color pickers (wp-color-picker) allowing site administrators to configure site-wide default credit types and accent colors.
• Added uninstall.php for clean option cleanup on deletion.

🧩 Gutenberg Block & Theme Enhancements

• Switched block registration to register_block_type_from_metadata() using modern block.json (API v3).
• Gutenberg block editor dynamically inherits default styling and localized strings via wp.i18n and wp_localize_script.

🧪 Test Suite & CI/CD

• Added comprehensive PHPUnit test suite (32 unit & security tests, 143 assertions) covering renderer sanitization, security edge cases, and settings validation.
• Added GitHub Actions automated CI workflow.

📋 Compatibility

• Requires at least: WordPress 5.0
• Tested up to: WordPress 7.1
• Requires PHP: 7.4+