v2.3.0

Added

• Automated tests and static analysis (#8–#18). PHPUnit unit, integration and functional suites against a real WordPress, PHPStan, PHPCS with WordPress Coding Standards, PHP compatibility checks and a GitHub Actions workflow.

Changed

• A full namespaced rebuild (#8–#18). Every responsibility lives in a class under TotalMailQueue\, loaded by an inline autoloader and wired in Plugin::boot(). The schema, option keys, cron events, page slugs, nonces and AJAX actions are unchanged, so installs upgrade in place.

Removed

• The procedural admin files, the wp_tmq_* functions and the $wp_tmq_* globals (#8–#18), replaced by the classes above.

Fixed

• No early text-domain notice on WordPress 6.7+ (#18). The cron schedule label is no longer translated, because WordPress asks for it before init.

Security

• Hardened settings, import and endpoints (#8–#18). Settings saves and XML imports go through a key whitelist, imports block external entities, the REST and AJAX endpoints require manage_options, and SMTP passwords are stored with AES-256-CBC and a per-record IV.