v1.2.0

Security and bug-fix release following a full codebase security + code audit. Recommended for all users.

Security

• Neutralize CSV formula injection in entry exports (CWE-1236) — untrusted form values are now escaped before reaching Excel/Sheets

Fixed

• Bulk delete on the entries page (never executed due to GET/POST mismatch)
• Email notification template settings now actually used for Divi notifications ({form_name}, {all_fields}, etc.)
• CORS for app-scheme origins like capacitor://localhost (previously stripped, breaking mobile WebView clients)
• WPForms entries stored in native field structure — they now render in the WPForms admin
• WPForms notifications receive the entry ID so {entry_id} smart tags resolve
• Gravity Forms multi-input fields (Name, Address, Checkbox) — values were silently dropped
• Validation failures and non-scalar field values return 400 instead of 500 / PHP fatals
• /fields endpoint returns normalized fields with submit keys for Divi forms

Added

• Multisite support: per-site tables on network activation, new-site provisioning, full multisite uninstall cleanup
• Database schema upgrade path (packrelay_db_version) so auto-updates re-run migrations
• Translation loading (load_plugin_textdomain)
• Vary: Origin header on cached REST responses; form names stored on REST entries

Performance

• Firebase SDK now lazy-loaded (no longer instantiated on every page view)
• CSV export uses keyset pagination (was O(n²) on large tables)
• Google Fonts CDN removed from wp-admin (GDPR)

Full audit details: AUDIT-REPORT-2026-06-10.md

🤖 Generated with Claude Code