Removed unused baseline-assist and baseline-summary CSS classes.<\/li>\n<\/ul>\n\n1.0.0<\/h4>\n\n
First stable WordPress.org release. The plugin has reached production maturity for the VizProof Timeline integration: multisite-aware updates workflow, asynchronous scan queue with retry\/backoff, admin bar regression badge, REST API surface, and rollback service with local backups in the uploads directory.<\/p>\n\n
WordPress.org review compliance:\n* Removed direct loading of wp-admin\/includes\/misc.php<\/code> (no function from that file was used) and gated remaining require_once ABSPATH . 'wp-admin\/includes\/...'<\/code> calls with function_exists()<\/code> \/ class_exists()<\/code> guards. Each guarded include is followed immediately by a call to a function\/class from that file, per WP.org guidelines.\n* Replaced hardcoded WP_PLUGIN_DIR<\/code> and WP_CONTENT_DIR<\/code> constants in the rollback service with paths derived from plugin_dir_path( __FILE__ )<\/code> via new VIZPROOF_TIMELINE_PLUGIN_FILE<\/code> \/ VIZPROOF_TIMELINE_PLUGIN_DIR<\/code> \/ VIZPROOF_TIMELINE_PLUGIN_URL<\/code> constants. Local backup path validation now reuses the existing wp_upload_dir()<\/code>-based get_local_backup_root()<\/code> helper for consistency.\n* Made REST permission callbacks (can_access_timeline<\/code>, can_launch_runs<\/code>) perform an explicit current_user_can( 'manage_options' )<\/code> capability check (previously delegated only via can_manage_plugin()<\/code>), so static analysis can confirm protection on all 23 endpoints.\n* Hardened enqueue_inline_admin_style()<\/code> \/ enqueue_inline_admin_script()<\/code>: CSS now goes through wp_strip_all_tags()<\/code> before wp_add_inline_style()<\/code>, and inline JS is rejected if it contains a <\/script><\/code> sequence that could break out of the inline <script><\/code> block.\n* Renamed admin bar regression transients from vizproof_adminbar_regressions_*<\/code> to vizproof_timeline_adminbar_regressions_*<\/code> for prefix consistency with the rest of the plugin.<\/p>\n\n0.4.45<\/h4>\n\n
WordPress.org compliance:\n* Replaced admin inline <style><\/code>\/<script><\/code> blocks with wp_add_inline_style()<\/code> \/ wp_add_inline_script()<\/code> attached to enqueued handles.\n* Moved admin bar badge CSS injection to admin_enqueue_scripts<\/code>.\n* Update panel assets now load consistently on update-core.php<\/code>, themes.php<\/code>, and plugins.php<\/code>.\n* Added dedicated nonce handling for post-update request flags (vizproof_after_update_scan<\/code>, vizproof_before_update_baseline<\/code>) and enforced nonce+capability checks before honoring explicit request overrides.<\/p>\n\n0.4.44<\/h4>\n\n
Bug fixes:\n* Fixed post-update scan failing silently when pages already exist on VizProof: the existing page ID from 409 responses was not extracted (nested in proxy body, not at details root).\n* Pre-update baseline promotion now polls until the VizProof run completes (up to ~60s) before promoting, instead of promoting an incomplete run which was always rejected by the API.<\/p>\n\n
Improvements:\n* API logs now display in chronological order by default (oldest\u2192newest) with a toggle button to switch to reverse order.\n* Log rotation: entries older than 7 days are automatically pruned. Retention increased from 120 to 500 entries.\n* Log rows with 4xx errors are highlighted in yellow, 5xx in red.<\/p>\n\n
0.4.43<\/h4>\n\n\n- VizProof update panel now displays on Themes and Plugins admin pages (was limited to update-core.php).<\/li>\n
- Assets (CSS\/JS) are now loaded on themes.php and plugins.php for update panel rendering.<\/li>\n<\/ul>\n\n
0.4.42<\/h4>\n\n
Security:\n* Fixed path traversal in restore_local_plugin_backup: added trailing slash to realpath containment check.\n* Added bearer token redaction in proxy error log bodies.\n* REST rest_save_option now runs options through sanitize_options before update_option.<\/p>\n\n
WordPress compliance:\n* Added load_plugin_textdomain() on init for translation loading outside WP.org directory.\n* Capped get_sites() calls to 500 (was unbounded number=0, caused timeout on large Multisite).\n* Plugin header Description translated to English (WP.org requirement).\n* Merged duplicate REST route registrations for runs\/{id} (GET+DELETE in single call).\n* Complete uninstall cleanup: removes vizproof_lock<\/em>* options, all vizproof_* transients and site transients.<\/p>\n\nAccessibility (WCAG 2.1 AA):\n* Page tree checkboxes now include page title in aria-label (\"Suivre \u2014 Page title\").\n* Added label\/for association on network settings cache delay input.\n* Removed role=\"presentation\" from per-site targets data table.\n* Fixed color contrast: warn badge (#6b5100), pending pill (#7a5300).\n* Added :focus-visible styles on all custom buttons and clickable elements.\n* Replaced invalid<\/p>\n\n
<<\/p>\n\n
h3> inside<\/p>\n\n
<<\/p>\n\n
legend> with styled<\/p>\n\n
<<\/p>\n\n
legend> in automation fieldsets.<\/p>\n\n
i18n:\n* Translated network config mode radio labels to French (was mixed EN\/FR).\n* Wired ~10 hardcoded strings in inline JS bridge to t() translation helper.\n* Translated 8 untranslated msgstr entries in fr_FR.po (update summary labels, Status, etc.).<\/p>\n\n
Cleanup:\n* Removed dead SETTINGS_MENU_SLUG constant and render_settings_page() method.\n* Removed ~6 unused CSS selectors (activity-item, summary-list, health-check).\n* Capped scan history to 100 entries (was unbounded).\n* Added TODO comments on duplicated inline blocks for future consolidation.<\/p>\n\n
0.4.41<\/h4>\n\n\n- Fixed proxy_vizproof_request silently failing when receiving pre-normalization options with empty api_token (self-decrypt from api_token_encrypted).<\/li>\n
- Fixed scan lock race condition on standard WP installs (no Redis): replaced non-atomic transient fallback with INSERT IGNORE for cross-process atomicity.<\/li>\n
- Removed orphan SETTINGS_MENU_SLUG from is_vizproof_admin_request allowlists (page never registered in admin_menu).<\/li>\n
- Removed dead code: register_admin_menu, register_network_admin_menu, register_settings from service-base (duplicated in main plugin file, never hooked).<\/li>\n<\/ul>\n\n
0.4.40<\/h4>\n\n\n- Fixed PHP parse error caused by Unicode smart quotes in French translation strings.<\/li>\n
- Fixed dead links: \"R\u00e9glages avanc\u00e9s\" and \"Choisir le projet\" pointed to unregistered SETTINGS_MENU_SLUG page.<\/li>\n
- Simplified redundant boolean comparisons (=== true \/ === false) in update panel JS.<\/li>\n
- Further compacted update panel CSS: tighter padding, margins, and gaps across all panel sections.<\/li>\n<\/ul>\n\n
0.4.39<\/h4>\n\n\n- Fixed redundant boolean logic in token storage validation.<\/li>\n
- Fixed race condition in scan lock using atomic wp_cache_add.<\/li>\n
- Fixed REST route methods for favorite endpoints (PATCH only instead of PUT+PATCH).<\/li>\n
- Fixed function_exists guard in uninstall.php referencing wrong function name.<\/li>\n
- Simplified site picker: merged auto-detect into project loading, \"Create from WordPress\" is now a secondary link.<\/li>\n
- Added AJAX save for project selection (no full page reload between onboarding steps).<\/li>\n
- Grouped automation settings into sub-sections: Planification, Comportement post-update, Notifications.<\/li>\n
- Moved API logs behind a collapsible \"Outils d\u00e9veloppeur\" toggle on the dashboard.<\/li>\n
- Added empty state on the timeline when no runs exist.<\/li>\n
- Translated raw API status strings (partial_failed, queued, etc.) to human-readable French in the update panel.<\/li>\n
- Replaced setInterval polling with MutationObserver only in the timeline bridge script.<\/li>\n
- Added aria-live attributes on all dynamically updated zones (state, runs, diffs, update panel).<\/li>\n
- Fixed timeline filter labels: proper label-for associations instead of span wrappers.<\/li>\n
- Restructured network settings form with fieldset groups (Connexion API, Comportement des scans, Notifications).<\/li>\n
- Compacted update panel on update-core.php: single-row header, inline checkboxes, collapsible pipeline steps.<\/li>\n
- Stale scan results from previous updates are no longer shown on the update listing page.<\/li>\n<\/ul>\n\n
0.4.38<\/h4>\n\n\n- Improved update-flow reliability for async and sync scan events.<\/li>\n
- Improved multisite admin URL routing between site and network contexts.<\/li>\n
- Improved pre-update baseline behavior by promoting successful pre-update runs.<\/li>\n
- Improved update panel consistency for partial-failure handling.<\/li>\n
- Improved layout width handling on update-core screens.<\/li>\n<\/ul>\n\n
0.4.0<\/h4>\n\n\n- Added asynchronous queue support with retry\/backoff.<\/li>\n
- Added update workflows and visual regression notifications in wp-admin.<\/li>\n
- Added multisite support for per-site and network-wide modes.<\/li>\n<\/ul>","raw_excerpt":"Run VizProof scans from WordPress updates, review visual diffs in wp-admin, and automate recurring checks.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/295356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=295356"}],"author":[{"embeddable":true,"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/tommybordas"}],"wp:attachment":[{"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=295356"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=295356"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=295356"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=295356"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=295356"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/pap-cw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=295356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}