JPKCom DB
Auf GitHub ansehen (öffnet in neuem Tab)

Changelog — JPKCom Rank Math Options

Versionsverlauf des WordPress-Plugins JPKCom Rank Math Options.

Versionsverlauf von jpkcom-rank-math-options (öffnet in neuem Tab). Die Einträge stammen unverändert aus der README des Projekts. Eine ausführliche Anleitung mit Tipps findest du im Projekt-Guide.

1.0.13

  • Added: updates for inactive JPKCom plugins. WordPress never runs the code of a deactivated plugin, so its own updater never ran and it was never offered an update. Every JPKCom plugin now ships updater 1.5.0; one copy answers for all installed JPKCom plugins, active or not, with the update row, the icon and "View details". The SHA-256 check applies to an inactive plugin exactly as to an active one. On multisite, at least one JPKCom plugin must be network-active or active on the main site
  • Security: the stored list of plugin updates no longer contains JPKCom download URLs; they are added back only while a JPKCom updater is loaded, so a request without one cannot install an unverified package. The checksum check now also verifies a package another plugin supplied instead of accepting it, and recognises every GitHub address of a release file
  • Changed: plugins installed as a Git (or other version-control) checkout or in a renamed folder are told about a new release but never updated automatically, because an update would delete the checkout or the renamed folder. Update information is fetched only for users who can update plugins, in WordPress's update cron and in WP-CLI, never for anonymous visitors

1.0.12

  • Added: a plugin icon. The update manifest now points WordPress to the JPKCom logo, so the Updates screen (Dashboard → Updates) shows it next to this plugin instead of the generic pattern wordpress.org generates from the slug

1.0.11

  • Security: the plugin header now carries Update URI: https://github.com/JPKCom/jpkcom-rank-math-options. Without it, WordPress also asks wordpress.org for updates under this plugin's slug, so a same-named plugin published there with a higher version would be offered as an update of this one. With the header, wordpress.org answers nothing for this plugin and updates come only from this repository
  • Changed: the updater keeps its manifest cache, its failure marker and its fetch lock in site transients. On multisite the network now fetches the manifest once instead of once per site; on a single site nothing changes. The old per-site entries expire on their own within a day
  • Changed: the release workflow downloads phpDocumentor from a fixed GitHub release and verifies its SHA-256 before running it, instead of executing whatever phpdoc.org serves that day. No effect on the shipped plugin

1.0.10

  • Fixed: Rank Math's usage tracking was not actually being switched off. The plugin rewrote a usage_tracking key in rank-math-options-general, but that settings field is declared 'save_field' => false, is never stored in that option, and nothing reads the tracking state from it. The real switch is the standalone rank_math_mixpanel_optin option, which Optin::can_track() and Optin::is_enabled() consult. Measured against Rank Math 1.0.275: with tracking opted in, can_track() returned true despite this plugin being active; it now returns false
  • Added: the stored opt-in value can no longer become true either (pre_update_option_rank_math_mixpanel_optin). Without that, an opt-in would leave true in the database and deactivating or removing this plugin later would silently switch tracking on
  • Fixed: the llms.txt intro paragraph is now removed through rank_math/llms_txt/remove_credit, the filter Rank Math has since added around exactly those two output lines. The previous implementation buffered the response on template_redirect and compared the request path against the literal /llms.txt, so it never ran on an installation in a subdirectory, where the path is /subdir/llms.txt — precisely the case it was written for. Output is byte-identical; roughly 20 lines of output buffering and regex are gone
  • Removed: the option_rank-math-options-general filter, which no longer served a purpose once telemetry moved to the option Rank Math actually consults
  • Added: tests/test-hooks.php covers the hook surface and every callback; CI runs it on every pull request and push to main
  • Docs: CLAUDE.md described one filter where there are six, explained rank_math/can_edit_file with multisite instead of the DISALLOW_FILE_EDIT/DISALLOW_FILE_MODS constants it actually overrides, claimed releases are triggered by release: published rather than a tag push, and said the version lives in three places while listing five
  • Note: no behaviour change to rank_math/can_edit_file. Its only effect is to override an explicit DISALLOW_FILE_EDIT or DISALLOW_FILE_MODS; with neither constant defined Rank Math already allows the editors. See CLAUDE.md for the trade-off

1.0.9

  • Changed: the update manifest generator now defaults a missing Network: header to false instead of true, matching WordPress' own default. No change for this plugin, which declares Network: true explicitly
  • CI: the lint and guard workflow now also runs on pushes to main. It only covered pull requests, so a direct push with bypass rights skipped every check
  • Changed: comments, workflow step names and CI output across the repository are now English throughout, and the developer notes in CLAUDE.md were translated and trimmed. No effect on the shipped plugin

1.0.8

  • Changed: Tested up to raised to WordPress 7.1
  • Changed: the bundled updater's runtime floor now matches the plugin's own minimum. It bailed out below WordPress 6.8 while the plugin header has required 6.9 for several releases, so the check could never fire on a supported installation
  • CI: the release manifest's fallback values for requires and tested now say 6.9 and 7.1. They only apply when the README metadata cannot be read, but a stale fallback would have published a minimum the plugin no longer supports

1.0.7

  • Added: plugin banners (assets/banner-1544x500.avif, assets/banner-772x250.avif) — a plain #3c4955 surface with no lettering. The update manifest already advertised these two URLs, but nothing was published under them, so the plugin card in wp-admin had a broken banner

1.0.6

  • CI: the release step no longer copies the staging directory into itself, so the ZIP has no empty jpkcom-rank-math-options/jpkcom-rank-math-options/ folder
  • CI: bumped the pinned GitHub Actions (checkout v7.0.1, setup-python v7.0.0, action-gh-release v3.0.2, fetch-metadata v3.1.0), still pinned to full commit SHAs
  • CI: the release ZIP now excludes the development-only tests/ and tools/ directories
  • CI: security and regression tests now run on every pull request, where a plugin has them

1.0.5

  • Security: update packages are now verified before installation — the verified file is handed to WordPress instead of being downloaded a second time, so the bytes that were checked are the bytes that get installed
  • Security: a missing or unfetchable SHA-256 checksum now aborts the update instead of installing unverified code (previously it silently skipped verification)
  • Security: pinned every GitHub Action to a full commit SHA and added Dependabot with a 7-day cooldown, so a moved tag can no longer change the release build
  • Security: tightened which download the updater claims, so sibling plugins cannot match each other's package
  • Fixed: sprintf() calls in the updater bound named arguments to a variadic parameter, which raises ArgumentCountError on PHP 8.3
  • Fixed: the "View Details" modal could fail with a TypeError when the manifest omitted requires_plugins
  • Performance: a failed manifest fetch is now cached for an hour instead of being retried on every admin request
  • Added: CI workflow on every pull request (PHP lint, named-argument check, YAML validation, action-pinning guard)

1.0.4

  • Normalized license fallback defaults (updater and release workflow) to GPL-2.0-or-later with the HTTPS license URI

1.0.3

  • Security: updater prefers an exact match against the manifest download_url over the slug heuristic, so a tampered manifest can no longer bypass the checksum gate
  • Security: timing-safe checksum comparison (hash_equals()) with an is_string() guard against hash_file() failures
  • Security: manifest fetch via wp_safe_remote_get() (SSRF defense-in-depth)
  • Fixed PHP warning and missing contributor names in the plugin detail popup (display_name now provided)
  • Fixed PHP warning/deprecation on wp plugin list by completing the no_update transient entry (new_version, package, tested, requires_php)

1.0.2

  • Fix sitemap credit filter name — v1.0.1 targeted the non-existent rank_math/sitemap/remove_credits; Rank Math actually fires the singular rank_math/sitemap/remove_credit
  • Rework telemetry disable — v1.0.1's rank_math/usage_tracking filter does not exist in Rank Math. Replaced with an option_rank-math-options-general filter that rewrites the usage_tracking key to off on read, which is the only reliable hook point since Rank Math's tracker class reads a plain option
  • Clean up llms.txt — strips Rank Math's intro paragraph preceding the first Markdown H1 so the file conforms to the llms.txt spec (the line is hardcoded in Rank Math and has no filter; we intercept the response body on template_redirect)

1.0.1

  • Remove Rank Math frontend credit — applies rank_math/frontend/remove_credit_notice to strip the "Powered by Rank Math" HTML comment
  • Remove sitemap credit — applies rank_math/sitemap/remove_credits to remove the "Generator" line from the XML sitemap (see v1.0.2 — filter name was wrong)
  • Disable telemetry — applies rank_math/usage_tracking returning false (see v1.0.2 — filter does not exist)
  • Hide admin bar menu — removes the Rank Math node from the WordPress admin bar via remove_node( 'rank-math' ) at priority 999

1.0.0

  • Initial release
  • rank_math/can_edit_file filter returning true to unlock robots.txt / .htaccess editing
  • GitHub-based self-hosted plugin updater with SHA256 checksum verification
  • Network-capable plugin header