1.2.0
Latest2 new1 security19 changes
New
- Added a self-contained local environment using `@wordpress/env` with the Playground runtime. See `DEVELOPMENT.md`.
- Added `.gitattributes` so development files are excluded from theme packages built with `git archive`.
Security
- Security
Changes
- Fatal PHP parse error in `archive.php` that broke date and generic archive pages.
- Live search now URL-encodes the query, so searches containing `&`, `#` or `+` work.
- Post view counter now records views through an AJAX request, so counts keep working behind page caching and no longer write to the database on every page render.
- Meta box definitions are built at `admin_init`, resolving the WordPress 6.7 "translation loading triggered too early" notice.
- Google Fonts are always loaded over HTTPS with `display=swap`.
- Logo, favicon, footer copyright and site name are escaped on output.
- Search placeholder text is escaped and no longer injected into inline JavaScript handlers.
- Custom colour options are validated as hex colours and the custom CSS option is stripped of tags before being inlined.
- HelpJet added as a recommended plugin.
- Search forms use the `placeholder` attribute and retain the current search query.
- Post view count output is translatable and pluralised.
- Unused `options.php` (the options panel lives in the KnowHow Tools plugin).
- Internet Explorer 6 to 8 support scripts: HTML5 shim, Selectivizr and jQuery browser sniffing.
- Bundled plugins
- KnowHow Tools 1.0.2 (replaces 1.0.1, sites already running 1.0.1 are prompted to update from the TGM screen)
- Meta Box library loads its text domain on `init` instead of at plugin load, removing the WordPress 6.7 "Translation loading for the meta-box domain was triggered too early" notice shown at the top of admin pages.
- Meta Box about page reads plugin headers without translating them, which was a second trigger of the same notice.
- Meta Box nonce check no longer uses `FILTER_SANITIZE_STRING`, deprecated in PHP 8.1.
- Development