v1.6165 — Plugin Check verified submission build

Shadow by Christopher Ross 1.6165 — WordPress.org submission package.

Completes the WordPress.org Plugin Review Team remediation, a distinction pass, and a full Plugin Check run.

✅ Verified

• WordPress.org Plugin Check: 0 errors. Run via the official plugin-check plugin (wp-cli) against a local WordPress 7.0 install. The 5 errors found on the first pass were all fixed; the ~51 remaining notices are advisory DirectQuery / NoCaching / SlowDBQuery warnings inherent to a database-diagnostics plugin (non-blocking for directory approval).
• php -l clean on every file; structural readme checks pass (Stable tag == Version == 1.6165); languages/thisismyurl-shadow.pot generated (1,403 strings).

Highlights

• Security & compliance: hardened input sanitization, output escaping, and prepared SQL; corrected file/directory handling; scoped PHP execution limits; removed the self-hosted GitHub updater; fixed two direct-file-access-guard placements Plugin Check flagged; sanitized two unguarded $_POST price fields; replaced is_writable() with wp_is_writable().
• Backup/restore removed: the local backup ("Vault Lite") now lives in a separate plugin — which retired the unprepared restore SQL and whole-site path handling.
• Accessibility pass (admin UI): visible keyboard focus, live regions, native buttons, contrast fixes, focus management — code-level fixes reviewed by an accessibility specialist (WCAG 2.2 AA).
• Developer documentation: docs/HOOKS.md (~73 actions/filters + "Extending Shadow"), shipped in the package.
• Cleanup: dead code removed, options-autoload footprint reduced, dev tooling excluded from the build, product name reconciled to "Shadow by Christopher Ross".

See readme.txt for the full changelog.

Distribution

The attached thisismyurl-shadow-1.6165.zip is the submission package: slug-rooted (thisismyurl-shadow/), .distignore applied, docs/HOOKS.md + languages/*.pot included, no .git/vendor/tests/scripts/dev tooling.

⚠️ Still recommended before submission

• A live accessibility pass — NVDA + Firefox, VoiceOver + Safari, keyboard-only, Windows High Contrast, axe/Lighthouse on the four admin screens. Code-level fixes are done and specialist-reviewed; the live pass is tracked as PENDING in docs/ACCESSIBILITY.md. This is the one gate that genuinely needs a human at the assistive tech.
• Optional: paste readme.txt into the WordPress.org readme validator as a final formatting check.

v1.6165 — WordPress.org submission candidate

⚠️ Superseded by v1.6165.1

This release was published before WordPress.org Plugin Check was run. Plugin Check then surfaced 5 errors, which were fixed. Because this release is immutable, its attached zip is the pre-check candidate and should not be submitted.

Use the Plugin-Check-verified build (0 errors, same version 1.6165): v1.6165.1.

---

(original candidate release — see v1.6165.1 for the verified build)

v1.6147

Maintenance release. Unifies versioning to the x.Yddd calendar scheme and confirms WordPress 7.0 compatibility. (Build assets are attached automatically by the release workflow.)

1.6143

First full release (class 1). The 0.6xxx line was pre-release on the x.Yddd versioning scheme. Compatible with WordPress 7.0.

Changed

• Standardized the donation link to GitHub Sponsors.

0.6125

WordPress diagnostics and site audits: 230+ automated checks for performance, security, SEO, and accessibility. Adds explicit Contributors section. Requires WordPress 6.0+, PHP 7.4+.

0.6095

0.6095