Release 1.1.1 - #11
Merged
Merged
Conversation
Version bump and changelog cut for the security patch release. The Unreleased entries move to [1.1.1] unchanged, with the breaking MAINWP_APP_PASSWORD identity-binding note leading the section.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe package version changes to 1.1.1. The changelog adds the dated release and comparison links, while troubleshooting guidance updates its upgrade reference to 1.1.1. ChangesRelease metadata
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
1.1.0 was tagged but never published; npm users jump from 1.1.0-beta.1 straight to 1.1.1, so the troubleshooting note should name the version they actually install.
The Security section listed three of the shipped fixes and skipped the rest, including the password prompt echoing typed characters in cleartext, the async-schema validation bypass, and the ReDoS hardening. The release audit flagged the gap; wording follows the fix commit (3cb1430). Also extends the output-layer escape-stripping entry to name the surfaces it covers and records the brace-expansion resolution with its consumer-install caveat.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version bump to 1.1.1 and the changelog cut for the security patch release. The Unreleased entries move to
[1.1.1] - 2026-07-27unchanged; the breakingMAINWP_APP_PASSWORDidentity-binding note leads the section. Footer compare links updated for the new tag.No code changes. Publish runs from the
v1.1.1tag after the tarball proof, per the release train.Summary by CodeRabbit