Skip to content

0.8.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Aug 18:55
· 122 commits to main since this release
0.8.0
80855f6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Home is now the merged Timeline feed: the user's own Marks interleaved with cached posts from subscribed sites, replacing what was a Recent Marks list of only their own Marks. Opening a subscribed post fetches and shows its full content in place; pulling down from the top of the list refreshes every active subscription. (#102, part of #78)
  • Search now covers the whole Timeline (Marks and subscription posts) instead of only the user's own Marks, with a new Source filter next to the existing type chips to narrow it back down to "My Marks" or one specific subscribed site. (#103, part of #78)
  • A Settings → Daymark screen for managing subscriptions: subscribe to a site by URL, see its status and when it was last fetched, refresh it on demand, and unsubscribe. Also reachable via a new "Subscriptions" action link on the Plugins list screen. The Subscribe button shows a loading state while the request is in flight. (#104, part of #78)
  • Home's Recent Marks list now shows the same comment/like stat row as the public Timeline card — a zero count stays a dimmed icon-only, a real count shows next to a bolder icon. Resolves the compactness side of #42 in favor of the shared visual language. (#72)
  • A Mark's own permalink page now carries outbound POSSE-quality microformats2 markup: h-entry (with e-content, p-name/p-summary, dt-published, u-url, and u-photo/u-video/u-audio for attached media) and an author h-card (p-author, p-name, u-photo). A new rel=me field on the native Users → Your Profile screen renders as a rel="me" link next to the h-card when set. Deliberately leaves out u-email — a WordPress account email isn't meant to be public, and it's optional in the h-card spec. (part of #78)

Removed

  • The public /timeline page, the daymark/timeline block, and the [daymark_timeline] shortcode. Timeline is now an interleaved, multi-source view (your own Marks plus subscribed sites' posts, via Home) that only makes sense inside the authenticated app — a public page under the same name showing something narrower was confusing and redundant. An existing install's /timeline page is hard-deleted on upgrade (real 404, no redirect); individual Mark permalinks, your site's RSS/Atom feed, and the other four section pages (/images, /videos, /audio, /notes) are unaffected. (part of #78)

Changed

  • For developers: Requires PHP is now 8.2 (was 8.1) — PHP 8.1 stopped receiving security fixes. phpunit/phpunit stays on ^9.6 rather than moving to 11.x: WordPress core's own PHPUnit test scaffold still calls a method PHPUnit 10 removed, so every test run under PHPUnit 10+ fails regardless of anything in this plugin. Tracked in #106 for whenever core fixes it.
  • For developers: CONTRIBUTING.md's crediting-contributors section now says explicitly that Claude Code gets a Co-Authored-By: trailer too, alongside human contributors, when it wrote or materially helped write a change. (#108)
  • For developers: CONTRIBUTING.md's release checklist now opens with a dependency update check (npm/composer outdated and audit, patch/minor routinely, majors held for a deliberate compatibility review) and a bundle size/tree-shaking check, before opening the release PR. (#105)
  • For developers: this release's dependency check found nothing to update — npm outdated and composer outdated --direct are clean apart from the already-tracked phpunit/phpunit hold-back (see above). npm audit reports 32 advisories, all in webpack-dev-server's transitive chain under the @wordpress/scripts devDependency (local build/watch tooling only — the plugin ships no npm dependencies and none of this reaches the distribution zip); composer audit is clean. Bundle size unchanged at 778 bytes.

Fixed

  • A subscribed post's fetched full content no longer leaks the raw page's <script>/<style> source as visible text in the click-through detail view. wp_kses_post() only strips those tags, not their enclosed text, so a fetched page's tracking scripts and print styles were showing up as plain text; the fetch now narrows to the page's <body> and drops script/style elements entirely (tag and content) before sanitizing. (#102)
  • The app now only ever lives at /daymark even on an install that migrated from Moment before the 0.7.0 fix shipped. That fix only stopped a future migration from carrying the old base forward — a site that had already migrated kept it stuck at e.g. /moment forever, since that setting is deliberately never re-checked once resolved. It's now self-corrected on first use: the old value moves to the redirect (same as a fresh migration), and the "Open Daymark" link on the Installed Plugins screen and every other app URL correctly point at /daymark. (#71)
  • A Mark migrated from Moment (which never set a featured image) now shows its thumbnail in Home's Recent Marks list, the same way it already did on the public Timeline: the list reads the featured image first, then falls back to the Mark's own first image attachment, instead of only ever checking the featured image. (#72)
  • A generated title for a long caption with no spaces (e.g. Japanese, which wp_trim_words() only shortens on a CJK-translated locale) is now trimmed to a character-count backstop instead of used in full. The limit is filterable via daymark_title_max_chars. (#75, fixes #74)
  • The "+ New Mark" launcher's Image/Video/Audio/Note bubbles now genuinely burst outward from the button and settle back into it, instead of mostly fading in near their own final position with a slight scale. A scroll that happens while a bubble is still mid fan-out (including one an automated click's own scroll-into-view step can trigger) no longer closes the launcher out from under itself before it's had a chance to become tappable. (#72)

Security

  • A cached subscription post could previously be edited or deleted through WordPress's own generic REST API (wp/v2/subscription-posts), auto-registered because the post type was show_in_rest => true and gated only by ordinary edit/delete-post capabilities — entirely separate from, and bypassing, Daymark's own read-only routes. Nothing in the app ever used that generic endpoint; it's now disabled, so a cached copy of someone else's content can only ever be written by the subscription poller itself. (#103)
  • For developers: bumped nanoid, a transitive devDependency of @wordpress/scripts' bundled Lighthouse tooling, to resolve a high-severity advisory. Dev-tooling only — never invoked by this project's own build/test scripts and never shipped in the plugin zip. (#105)

Deprecated

  • Daymark_Migration (the one-time Moment → Daymark storage conversion) is soft-deprecated ahead of removal in 0.9.0. No behavior change for anyone still upgrading from Moment (≤ 0.5.0) — sites with real legacy data to convert now also get a logged _deprecated_function() notice (visible under WP_DEBUG) at the moment the conversion runs, as a heads-up before it's removed. (#69)

Full Changelog: 0.7.0...0.8.0

Assets 3
Loading