Repository navigation
Releases: spotship/wordpress-insurance
Releases · spotship/wordpress-insurance
Release list
v1.1.1
v1.1.1-dev.1
v1.1.0
v1.1.0-dev.1
v1.0.1-dev.1
v1.0.0
1.0.0 (2026-10-08)
Bug Fixes
- deps: ENG-6572 take the http-cache-semantics patch for cross-user cache disclosure (#5) (2c18c5e), closes hi#severity
Features
v1.0.0-dev.2
1.0.0-dev.2 (2026-10-07)
Bug Fixes
- deps: ENG-6572 take the http-cache-semantics patch for cross-user cache disclosure (#5) (2c18c5e), closes hi#severity
v1.0.0-dev.1
1.0.0-dev.1 (2026-10-06)
History note — 2026-10-06.
devwas squashed after this release was
cut, so the per-commit links these notes were generated with no longer
resolve from any branch and have been removed. The entries themselves are
unchanged. The work they describe is now the single commit
c3bb644,
and the original 121-commit history is preserved on the
backup/dev-20261006-pre-squash
branch.
Bug Fixes
- a control changed mid-flight must retire the submissionId, not just the lock
- a customer's brand colour could make the submit button unreadable
- a notes error could not reach the notes field, on either product
- a re-bind must change the binding and nothing else
- a test helper named count() is a fatal, not an override
- a v0.2.0 tag could publish a 0.1.0 artifact
- a11y: make the scrollable rate table reachable by keyboard
- api: stop double-encoding search terms, and correct the stale lock test
- cargo: product-aware rate table, destination chips and risk-zone population
- compare scheme and port in the same-origin check, and make releases transactional
- create the e2e administrator instead of assuming wp-env's default
- do not wait for a particular URL after the admin login
- e2e: put the stand-in upstream on a port WordPress will accept
- every IPv6 visitor behind a Cloudflare edge shared one rate-limit bucket
- i18n: refresh the catalogue, and make staleness detectable
- isolate form instances and honour error statuses in the browser
- js: make commit() the actual single writer, and enforce it with tests
- limiter: carry the window expiry in the value, not in the storage TTL
- MIN_AGE 3s silently destroyed real enquiries, and told bots the number
- neither block appeared in the editor
- one 429 reported as three different causes
- PHPCS warnings on the two option_id reads
- phpcs: resolve the static-analysis failures CI surfaced
- phpstan: declare the template variable contracts, keep the JSON guard
- proxy: compare hosts in the same-origin check, not normalised URLs
- rates: refresh the backend fixture and add the drift alarm it needed
- rates: render the disclaimers the endpoint serves, and document test status
- register assets on init, not plugins_loaded
- release: stop shipping internal documentation to customer servers
- release: stop the credential scan refusing every build it will ever see
- security: draw the plaintext line at routable hosts, not at https
- security: refuse to carry a plaintext base url through a re-bind
- stop inventing a receipt, make the rates lock atomic, declare stale rates
- stop the admin login racing its own POST
- templates: remove orphan <?php opener in the cargo template
- tests: correct the settings mock CI caught, and commit composer.lock
- tests: give the integration suite its own bootstrap, and close release gaps
- tests: make the unit bootstrap able to load the plugin, plus repo scaffolding
- the admin login was typing the password into the username field
- the cargo risk-zone select was empty against the real backend
- the evidence file called a writing run read-only
- the evidence file kept describing a commit that was no longer HEAD
- the evidence script picked its run by a coin toss
- the integration matrix skipped PHP 8.2
- the leak check ran against wp-admin, not the form page
- the next release tag would have failed, and a test was a tautology
- the one-click re-bind never re-bound anything
- the probe gated nothing and the re-bind test could not pass
- the query encoding bug CI caught, plus the e2e harness faults
- the rate limiter counted in PHP, so concurrency beat it
- the rate table was built against a payload the API never emits
- the rate_limited diagnostic state was defined and never written
- the rates fetch lock could be released by a request that had lost it
- the real-backend persistence suite could not have passed
- the replay was POSTing to a path that does not exist
- the staging spec asserted fields the browser can never see
- the staging suite would have 401'd on every call it makes
- the staging workflow's evidence step never parsed as shell
- two requests could both take over the same stale rates lock
- uninstall left a live API key on every other site of a multisite network
- update the wp-env database to match core before seeding
- wait out the minimum form age in the failure specs, and run Elementor
Features
- admin: settings screen, connection test, diagnostics and one-click re-bind
- api: upstream HTTP client with normalised results
- assets: front-end script and scoped stylesheet
- diagnostics: support ledger and copyable blob
- guard: HMAC signature, timing trap and honeypot
- install the semantic-release that package.json claimed to have
- limiter: per-IP rate limiting with validated Cloudflare handling
- payloads: payload mapping and allow-listed response trimming
- plugin bootstrap, uninstall handler and readme
- proxy: spotship/v1 routes, with every local refusal above the decoy gates
- rates: tiered rates cache with the 401 short-circuit
- renderer: shared renderer, templates and accessible field partials
- settings: settings storage, sanitisation and origin binding
- surface: shortcodes, blocks and bootstrap registration