Edit Flow 0.11.0

This release completes the security-review remediation begun in 0.10.4. It resolves the remaining issues from a full audit of the plugin's authenticated code paths — the headline stored XSS in the editorial-metadata location field, two information-disclosure issues (the iCal feed and the Story Budget), and a long tail of defence-in-depth hardening across access control, input handling, deserialisation, output escaping, and client-side code. None are known to be exploited in the wild, but all users are encouraged to update.

Breaking: the iCal subscription feed now uses a per-user, revocable secret instead of a single site-wide key. Existing calendar-subscription URLs will stop working, and each user must copy their new feed URL from the calendar's Screen Options. This is the reason for the minor version bump.

Security

• fix: escape the editorial metadata location field to close a stored XSS by @GaryJones in #970
• fix: restrict Story Budget to a user's own posts when they cannot edit others' by @GaryJones in #972
• fix: escape the custom status name in the Custom Statuses list table by @GaryJones in #973
• fix: stop the calendar metadata AJAX creating arbitrary taxonomy terms by @GaryJones in #974
• fix: secure the calendar iCal feed against unauthenticated disclosure by @GaryJones in #975
• fix: harden the settings and screen-options save handlers by @GaryJones in #984
• fix: require a nonce to change Story Budget filters by @GaryJones in #985
• fix: restrict notification subscriptions and harden the webhook sender by @GaryJones in #987
• fix: gate calendar quick-create on the post type's create capability by @GaryJones in #988
• fix: harden custom status migration and the publish-timestamp workaround by @GaryJones in #989
• fix: block PHP object injection when decoding term descriptions by @GaryJones in #990
• fix: harden admin form and AJAX input handling by @GaryJones in #992
• fix: escape admin screen output consistently by @GaryJones in #993
• refactor: tidy up bootstrap and select-form code quality by @GaryJones in #995
• fix: harden client-side JS DOM and selector handling by @GaryJones in #996

Fixed

• fix: prevent a critical error on the user groups dashboard when no groups exist by @Morpheus636 in #982
• fix: correct checkbox-attribute escaping and the "no one notified" message in the user-select form by @jerclarke in #980
• fix: use the slug-specific template when previewing custom statuses by @GaryJones in #994
• fix: correct stale URLs in the module help sidebar panels by @thisismyurl in #967

Documentation

• docs: correct GitHub brand capitalisation across modules and docs by @GaryJones in #971
• docs: fix the broken CHANGELOG.md link in the plugin readme by @GaryJones in #983

Maintenance

• ci: speed up CI with targeted caching and fewer jobs by @GaryJones in #951
• ci: stop the integration test suite terminating early by @GaryJones in #991
• ci: guard against non-npmjs registry URLs in the lockfile by @GaryJones in #1000
• ci: hold React-19-blocking @WordPress updates in Dependabot by @GaryJones in #1004
• Routine dependency updates for npm packages and GitHub Actions

New Contributors

• @thisismyurl made their first contribution in #967
• @Morpheus636 made their first contribution in #982

Full Changelog: 0.10.4...0.11.0

Edit Flow 0.10.4

This release is dominated by defence-in-depth hardening following a security review of the plugin's authenticated code paths. None of the issues are known to be exploited in the wild, but all users are encouraged to update.

Security

• fix: require manage_options on the Add Custom Status form handler by @GaryJones in #940
• fix: correct ICS text escaping per RFC 5545 (semicolons, commas, backslashes, newlines) by @GaryJones in #941
• fix: stop double-escaping editorial comment author fields by @GaryJones in #942
• fix: use correct wp_kses arguments in inline-save error paths by @GaryJones in #943
• fix: harden calendar trashed-message Undo URL construction against query-arg injection by @GaryJones in #944
• fix: strip HTML from filter-supplied editorial metadata CSS to prevent </style> breakout by @GaryJones in #945
• fix: validate metadata term in calendar AJAX update handler by @GaryJones in #946
• fix: require edit_post access on notification subscription AJAX handlers by @Copilot in #931

Fixed

• fix: show "Immediately" for custom status posts in the block editor by @GaryJones in #938
• fix: stop passing null to wp_kses_post in list-table single_row (removes five PHP 8.1+ deprecations per row) by @GaryJones in #947
• fix: stop passing null to wp_kses_post on inline-save success (removes deprecations on Quick Edit) by @GaryJones in #948

Documentation

• docs: add AGENTS.md with structured agent guidance by @GaryJones in #906
• docs: add missing license fields to readme by @GaryJones in #889
• docs: update WordPress forums link in README by @MxchaelA8C in #929

Maintenance

• chore: exclude eslint from the Dependabot dev-dependencies group by @GaryJones in #919
• Routine dependency updates for npm packages and GitHub Actions

New Contributors

• @MxchaelA8C made their first contribution in #929
• @Copilot made their first contribution in #931

Full Changelog: 0.10.3...0.10.4

Edit Flow 0.10.3

Added

• feat: add WordPress Playground blueprint for live preview by @GaryJones in #885

Fixed

• fix: prevent Edit Flow nonce checks from killing unrelated forms by @GaryJones in #883
• fix: add missing imports for Extended Post Status block editor panel by @GaryJones in #884

Documentation

• docs: move Development section from README to CONTRIBUTING by @GaryJones in #880

Maintenance

• ci: optimise CI workflows with path filters and split tests by @GaryJones in #881
• test: add integration test for revision nonce handling by @GaryJones in #879

Full Changelog: 0.10.2...0.10.3

Edit Flow 0.10.2

Fixed

• fix: skip revisions in notifications save to prevent nonce verification failure - this completes the fix started in #873 for the "Cheatin' uh?" error when saving posts with notifications

Changed

• build: add .gitattributes to exclude dev files from release archives
• build: remove obsolete files (bin/, documentation/, bundled translations, PUBLISHING.md)

Full Changelog: 0.10.1...0.10.2

Edit Flow 0.10.1

Fixed

• fix: correct nonce action for Classic Editor post saves by @GaryJones in #873
• fix: return JSON response for user group subscription AJAX saves by @GaryJones in #874

Maintenance

• ci: optimise workflow efficiency and reduce redundancy by @GaryJones in #871
• chore: consolidate WordPress.org assets in .wordpress-org directory by @GaryJones in #872

Full Changelog: 0.10.0...0.10.1

0.10.0

PHP Compatibility: Minimum PHP version has been lowered from 8.0 to 7.4 for broader compatibility.

Fixed

• fix(story-budget): respect ef_story_budget_taxonomy_used filter in dropdown by @GaryJones in #861
• fix: prevent spurious "Leave site?" warning on new posts with custom statuses by @GaryJones in #860
• fix: scope module asset loading to relevant pages only by @GaryJones in #858
• fix: allow text selection in calendar overlay without triggering drag by @GaryJones in #857
• fix: update post date to current time when publishing from custom status by @GaryJones in #856
• fix: resolve calendar drag-and-drop not persisting post date changes by @GaryJones in #854
• fix: guard against null return from get_edit_post_link() and get_permalink() by @GaryJones in #853
• fix: prevent get_custom_statuses() from corrupting WordPress's term cache by @GaryJones in #852
• fix: add Private option to bulk edit status dropdown by @GaryJones in #851
• fix: resolve stale cache causing incorrect display in custom status Quick Edit by @GaryJones in #849
• fix: add type guard to prevent PHP warning in preview link filter by @GaryJones in #834

Added

• feat(custom-status): add status migration tool and WP-CLI commands by @GaryJones in #859
• feat(notifications): add Post Author and Auto-subscribed badges by @GaryJones in #847
• feat(story-budget): improve UX with Screen Options and collapsible categories by @GaryJones in #846

Changed

• style(story-budget): refresh print stylesheet for modern WordPress by @GaryJones in #848

Maintenance

• ci: automate WordPress.org deployment with GitHub Actions by @GaryJones in #867
• fix: resolve all PHPCS violations for WordPress coding standards by @GaryJones in #866
• ci: add PHP lint workflow for syntax and coding standards checks by @GaryJones in #865
• refactor(editorial-metadata): replace unmaintained timepicker addon with native inputs by @GaryJones in #864
• chore: remove unused VIP feature flag setting and related code by @GaryJones in #862
• chore: rename workflow to match plugin standards by @GaryJones in #850
• chore: migrate build system from webpack to wp-scripts by @GaryJones in #845
• chore: simplify ESLint config after eslint-plugin-wpvip fix by @GaryJones in #844
• ci: standardise test matrix and update readme by @GaryJones in #840
• chore: migrate to ESLint 9 with flat config by @GaryJones in #839
• chore: migrate dependabot reviewers to CODEOWNERS by @GaryJones in #836
• ci: Improve CI infrastructure and expand PHP compatibility by @GaryJones in #835
• ci: pin E2E tests to Ubuntu 22.04 for Playwright compatibility by @GaryJones in #833

New Contributors

• @hanifn made their first contribution in #729
• @srtfisher made their first contribution in #743

Full Changelog: 0.9.9...0.10.0

0.9.9

What's Changed

• Bump the minimum PHP version to 8.0 and WP version to 6.0 by @alecgeatches and @ingeniumed
• Update the node version to 20, and upgrade the JS packages to their latest versions by @alecgeatches and @ingeniumed
• Fix all the e2e tests, and update the GitHub Actions by @alecgeatches and @ingeniumed

Full Changelog: 0.9.8...0.9.9

0.9.8

What's Changed

• Fix WP 5.9 deprecation notice with who in WP_User_Query by @rebeccahum in #701
• Add PHP 8.2 fixes by @rebeccahum in #700
• Bump @babel/traverse from 7.1.6 to 7.23.2 by @dependabot in #714
• Bump version to 0.9.8 by @rebeccahum in #719

Full Changelog: 0.9.7...0.9.8

0.9.7

What's Changed

• Allow scheduled posts to be shifted around on calendar by @cojennin in #614
• Add back unpublish status, small css tweak for statuses by @cojennin in #613
• Renaming some frontend calendar configuration variable by @cojennin in #615
• Swap join() with implode() by @mjangda in #627
• Remove Travis mentions in the repo by @htdat in #642
• Fix: Give each attribute in Edit Flow settings page a different id by @htdat in #650
• PHP 8.0 and PHPCS: partly fix compatibility with composer packages by @htdat in #643
• Fix test_story_budget_set_number_days_filter_invalid in PHP 8.0 by @htdat in #644
• Fix: updating post slugs in Quick Edit and Classic Editor by @htdat in #648
• add 'cs' script to composer for easy running of phpcs by @trepmal in #653
• Fix jQuery warnings as WordPress upgraded it from 1.12.4-wp to 3.5.1 by @htdat in #649
• Remove redundant jQuery selector #the-list a.editinline by @htdat in #668
• Remove redundant jQuery selector #toggle_details by @htdat in #669
• Fixes non-variable being passed by reference by @mikeyarce in #667

Maintenance

• Bump npm from 6.14.4 to 6.14.6 by @dependabot in #617
• Bump websocket-extensions from 0.1.3 to 0.1.4 by @dependabot in #616
• Add Security Policy by @mjangda in #628
• Move from Travis CI to GitHub Actions by @htdat in #635
• E2E: Update the way selecting a future date for schedulePost by @htdat in #665
• Bump merge-deep from 3.0.2 to 3.0.3 by @dependabot in #659
• Update npm packages by @htdat in #645

Full Changelog: 0.9.6...0.9.7

0.9.5

Changelog

• Bug fix: Fix bug preventing previewing posts authored by other users (#597 -- props mallorydxw)
• Imrpovement: Status dropdowns are now be Edit Flow specific but filterable (#595)
• Improvement: Support i18n in Story Budget date picker (#569)
• Bug fix: Prevent multiple custom fields from being created (#591)
• Bug fix: Fix slug behavior (#575)