v0.4.9
The site tells the console what it runs.
New: software inventory (opt-in) — the CVE sensor's sending half
When enabled (Settings → ovos console → Software inventory, off by default, lockable via OVOS_CONSOLE_INVENTORY in wp-config.php), the plugin reports the installed plugin/mu-plugin/theme list with versions — plus WordPress core and PHP versions — once a day and after anything that changes it: installs, updates, (de)activations, deletions, theme switches, core updates.
The console matches the inventory nightly against the Wordfence Intelligence vulnerability feed and shows CVE findings on its SECURITY view — installed version, the version that fixes it, CVSS, and a PROBED count when the console has already seen requests naming that plugin's path. "You run X, and someone is looking for it" is the signal worth acting on first, and it is what alerts.
Exactly what each entry carries: type, directory slug, version, display name, active flag — never paths, options or user data. Double opt-in: this setting and the project's CVE switch in the console; either one off keeps the feature fully inert. The report is a single fire-and-forget request at shutdown (300 ms connect / 1 s total), never a slowdown; an unchanged report costs the console one timestamp update.
New: automation evidence in the bundled browser client
Reports now carry two zero-config signals: a webdriver admission (headless browsers and the AI agents built on them set it by default) and the external scripts the visitor never even attempted to load — the signature of bots that execute a page's inline JS without fetching its script files, which is what a "jQuery is not defined" from a plain Chrome UA usually is. The console indexes both as the flags field: bot-caused issues facet and filter apart from real-user ones. Evidence only, never suppression.
Changed: the username mask says how much it hides
Masked usernames keep every fourth character instead of collapsing to a fixed m*** (marcin → m***i*), so the mask is as long as the value it replaced — and past 24 characters it states the real length in brackets, because a login field holding thousands of characters is someone trying something. Applied identically in the PHP reporter and the bundled browser client.
Full Changelog: v0.4.8...v0.4.9