DevJoynal Downgrade 2.0.4

DevJoynal Downgrade v2.0.4 — Security and Reliability Fix Report

Repository: https://github.com/joynalabddin/downgrade-wordpress-plugin
Release: 2.0.4
Author: Joynal Abdin / DevJoynal

Remediated findings

Audit finding	v2.0.4 remediation
Custom URL checkbox could remain enabled after being unchecked	Added a hidden 0 field so the Settings API persists the disabled state.
Inconsistent compatibility metadata	Aligned readme.txt with the PHP header at WordPress 5.8 minimum, WordPress 7.1 tested target, and PHP 7.4 minimum.
Weak package diagnostics	Added safe GET fallback for servers that reject HEAD, a one-byte range probe, redirect blocking, HTML-response rejection, and transient caching.
First update entry was always rewritten	Added locale-aware selection of the update object and cleared partial, bundled, rollback, and no-content package alternatives.
Custom package lacked integrity verification	Added an optional 64-character SHA-256 setting and upgrader_pre_download verification. A mismatched custom archive is rejected before Core unpacks it.
Inert network-option hook	Removed the unrelated pre_site_option_update_core registration.
Duplicate legacy implementation in source tree	Removed the obsolete downgrade/ directory so devjoynal-downgrade/ is the only authoritative plugin directory.

Verification

The v2.0.4 PHP source passes php -l, git diff --check passes, and 12 focused regression checks pass. The release ZIP is rooted at devjoynal-downgrade/, contains the renamed main file, and has SHA-256 digest:

9cbcda4031a9060939382d27d1d3c9da984468480637fe010a2e8f5ecb54eb64

The checksum verifies the locally built devjoynal-downgrade-2.0.4.zip artifact. The plugin still requires a complete backup and staging validation before any WordPress Core change.