JPKCom DB
View on GitHub

Changelog — JPKCom FA inline SVG shortcode

Version history of the JPKCom FA inline SVG shortcode WordPress plugin.

Version history of jpkcom-fa-svg-plugin. Entries are taken verbatim from the project's README. A hands-on guide with tips is available in the project guide.

2.0.16

  • Fixed: the shortcode callback was the only function in the plugin without a vendor prefix and without a function_exists() guard — a global jsvg_code(). Any theme or plugin declaring that name caused a fatal redeclare error on load. Renamed to jpkcom_fasvg_shortcode() and guarded like every other function here; jsvg_code() remains as a deprecated shim so code calling it directly keeps working
  • Fixed: the upload path and URL were resolved once while the plugin file was being included. The plugin is Network: true, and on multisite each site has its own upload directory, so the captured value kept pointing at whichever site was active at load time — wrong for anything rendered after switch_to_blog(). The shortcode and the stylesheet registration now go through jpkcom_fasvg_path() / jpkcom_fasvg_url(), which resolve per call. JPKCOM_FASVG_PATH and JPKCOM_FASVG_URL stay for backwards compatibility
  • Changed: those helpers use wp_get_upload_dir() instead of wp_upload_dir(), i.e. the variant that does not try to create the directory — reading icons never needed that side effect, which the load-time call performed on every request
  • Fixed: the <title> id now comes from wp_unique_id() instead of wp_rand( 10, 500000 ). With a few dozen titled icons on one page a collision was unlikely but possible, and a duplicate id silently breaks aria-labelledby and is invalid HTML
  • Changed: the <title> text is escaped with esc_html() rather than esc_attr(). Both produce identical output in WordPress, so this changes nothing visible — it uses the helper that matches the context
  • Changed: all five JPKCOM_FASVG_* constants are now defined()-guarded; four of them were not, so a stray second copy of the file raised "constant already defined" warnings
  • Added: tests/test-hooks.php — 26 cases, 5 red against 2.0.15, including five path-traversal attempts asserting no file outside the icon folder can be read. CI runs it on every pull request and push to main
  • Note: path traversal was already closed before this release and remains so. basename() plus sanitize_file_name() reduce name to a flat string, .svg is always appended, and type is whitelisted — verified against inputs such as ../../../../etc/passwd, solid/../../wp-config, .. and an embedded null byte

2.0.15

  • Changed: the update manifest generator now defaults a missing Network: header to false instead of true, matching WordPress' own default. No change for this plugin, which declares Network: true explicitly
  • CI: the lint and guard workflow now also runs on pushes to main. It only covered pull requests, so a direct push with bypass rights skipped every check
  • Changed: comments, workflow step names and CI output across the repository are now English throughout, and the developer notes in CLAUDE.md were translated and trimmed. No effect on the shipped plugin

2.0.14

  • Changed: Tested up to raised to WordPress 7.1
  • Changed: the bundled updater's runtime floor now matches the plugin's own minimum. It bailed out below WordPress 6.8 while the plugin header has required 6.9 for several releases, so the check could never fire on a supported installation
  • Fixed: the Font Awesome stylesheet now reaches the block editor canvas. It was hooked to enqueue_block_editor_assets, which only loads into the surrounding admin document. From WordPress 7.1 the post editor always renders its canvas in an iframe, so inline SVGs shown in a block preview would have lost the Font Awesome sizing rules (height: 1em, display: inline-block, overflow: visible) and rendered at their intrinsic size. The hook is now enqueue_block_assets, which WordPress runs both when it assembles the iframe assets and on block editor admin screens — the non-iframed editor of WordPress 7.0 and earlier behaves exactly as before
  • Changed: one shared style handle jpkcom-fasvg-style for front end and editor; the separate editor handle jpkcom-fasvg-gutenberg-style is gone. Registration is idempotent, so the inline .svg-inline--fa rule is emitted once per document
  • The front end is untouched: it keeps its own wp_enqueue_scripts registration and deliberately does not rely on enqueue_block_assets, which optimisation plugins unhook to strip the core block library
  • CI: the release manifest's fallback values for requires and tested now say 6.9 and 7.1. They only apply when the README metadata cannot be read, but a stale fallback would have published a minimum the plugin no longer supports

2.0.13

  • Added: plugin banners (assets/banner-1544x500.avif, assets/banner-772x250.avif) — a plain #3c4955 surface with no lettering. The update manifest already advertised these two URLs, but nothing was published under them, so the plugin card in wp-admin had a broken banner

2.0.12

  • CI: the release step no longer copies the staging directory into itself, so the ZIP has no empty jpkcom-fa-svg-plugin/jpkcom-fa-svg-plugin/ folder
  • CI: bumped the pinned GitHub Actions (checkout v7.0.1, setup-python v7.0.0, action-gh-release v3.0.2, fetch-metadata v3.1.0), still pinned to full commit SHAs
  • CI: the release ZIP now excludes the development-only tests/ and tools/ directories
  • CI: security and regression tests now run on every pull request, where a plugin has them

2.0.11

  • Security: update packages are now verified before installation — the verified file is handed to WordPress instead of being downloaded a second time, so the bytes that were checked are the bytes that get installed
  • Security: a missing or unfetchable SHA-256 checksum now aborts the update instead of installing unverified code (previously it silently skipped verification)
  • Security: pinned every GitHub Action to a full commit SHA and added Dependabot with a 7-day cooldown, so a moved tag can no longer change the release build
  • Security: tightened which download the updater claims, so sibling plugins cannot match each other's package
  • Fixed: sprintf() calls in the updater bound named arguments to a variadic parameter, which raises ArgumentCountError on PHP 8.3
  • Fixed: the "View Details" modal could fail with a TypeError when the manifest omitted requires_plugins
  • Performance: a failed manifest fetch is now cached for an hour instead of being retried on every admin request
  • Added: CI workflow on every pull request (PHP lint, named-argument check, YAML validation, action-pinning guard)

2.0.10

  • Docs: corrected the FAQ section heading so it is included in the release manifest, and linked the published PHPDoc API documentation

2.0.9

  • Added secure self-hosted plugin updates via GitHub with SHA256 checksum verification
  • Added an automated release workflow (builds the ZIP, generates the manifest and deploys to gh-pages on tag push)
  • Raised the minimum WordPress version to 6.9 and "Tested up to" to WordPress 7.0
  • Switched license metadata to the SPDX identifier GPL-2.0-or-later with the HTTPS license URI
  • Added PHPDoc-generated API documentation, built and deployed to gh-pages on release
  • Security: prevented path traversal in the [jsvg] name attribute (now sanitized with sanitize_file_name()/basename())
  • Hardening: enabled declare(strict_types=1), tightened parameter/return types, guarded the SVG file read and removed dead code

2.0.8

  • PHP warnings fixed "Undefined variable ..."

2.0.7

  • Tested up to WP v6.8

2.0.6

  • Making use of wp_rand()
  • Fix Stable tag

2.0.5

  • README.md version update

2.0.4

  • README.md meta data update

2.0.3

  • Plugin meta data update

2.0.2

  • README.md update

2.0.1

  • Network support

2.0.0

  • PHP 8.3+
  • WP v6.7+
  • wp-content/uploads folder support

1.0.0

  • Initial Release