Borges Bibliography Builder

Changelog

1.5.0

Security release. Updating is recommended for all sites.

• Security: Fixed a denial-of-service weakness in the public bibliography REST route, present in 1.4.2 and earlier. Reading a bibliography ran its stored citation text through WordPress tag stripping with no length limit, and past roughly 600 KB that operation degrades badly — a single oversized value saved into a published post cost about 12 seconds of pinned CPU on every read, on a route that requires no login and can be requested repeatedly at no cost to the caller. Stored text is now truncated to 64 KB before stripping, so existing bibliographies still render. This is the change that makes updating worthwhile.
• Security: Applied the same 64 KB limit to citation text sent to the formatter endpoint, where any user who can reach the block editor could otherwise tie up a CPU core per request.

The three changes below are hardening. None of them was exploitable; each was a case where the plugin happened to be safe because of how some unrelated code was written, which is a property that quietly stops holding when that code changes.

• Hardening: Bibliography data in a post type registered as non-public is no longer readable without authentication. Published status alone previously satisfied the check. Anyone able to edit the post still has access.
• Hardening: Links generated from citation text are now restricted to http and https, and any other scheme renders as plain text. Nothing downstream would have caught a javascript: link; the only thing preventing one was the URL-detection pattern requiring a literal http(s):// prefix, which a later improvement to that pattern could have removed.
• Hardening: PubMed/PMID lookups now use WordPress’s safe HTTP client, so every redirect in the chain is validated against the site’s own network.
• Escape two Unicode line-separator characters in the JSON-LD and CSL-JSON output blocks. Not a security issue — these blocks are never executed — but the characters terminate a line for a JavaScript parser and would break a consumer that evaluates a block instead of parsing it.
• Update the Block Accessibility Checks (BAC) integration for BAC 4.0, which replaced the registration API and renamed its editor filter hooks. All four bibliography checks — empty bibliography, missing heading, raw URL link text, and all metadata outputs disabled — are now admin-configurable from BAC’s unified settings screen.
• The BAC integration now requires Block Accessibility Checks 4.0 or later. On BAC 3.x the integration stays dormant and no bibliography checks appear; Borges itself works normally whether BAC is outdated or not installed at all.
• Add a regression test that validates every shipped bibliography markup format against the block’s own deprecation chain, guarding existing posts against “Attempt Block Recovery” prompts after an upgrade.
• Fix the end-to-end test covering the Block Accessibility Checks integration, which silently skipped itself and left the integration without real coverage.
• Add a second WordPress Playground demo that boots the current development build alongside the released-version demo.
• Add a scheduled monitor that verifies each Playground demo link stays reachable.
• Publish hand-verified size, footprint, and runtime-overhead metrics, each paired with the command used to re-derive it, and add a continuous-integration check that fails when the recorded lines-of-code figures or the no-persistent-storage audit drift.

1.4.2

• Resolve DOI and labeled PMID identifiers embedded in free-text citation pastes through the existing CrossRef and PubMed resolver paths.
• Fall back from embedded-identifier resolution to the heuristic free-text parser before showing unsupported-input guidance.
• Add free-text sample documentation for supported embedded DOI/PMID citation inputs.
• Stabilize numeric citation reorder E2E coverage against editor readiness races.
• Clarify that RIS is supported for export, not import.

1.4.1

• Clean up after the plugin when it is deleted: uninstalling now removes the plugin’s cached data — the formatter and PubMed/PMID transients (across all sites on multisite) and its object-cache groups where the host supports it. Bibliography blocks already saved in your posts are left untouched.

1.4.0

• Add optional per-entry Cite / Export affordances to the public bibliography: a static, no-JS <details> disclosure panel under each entry with the citation text and one-click downloads for RIS, CSL-JSON, BibTeX, and BibLaTeX. Enable it per block with the new “Per-entry Cite / Export” toggle in the Metadata output panel; off by default.
• Pre-compute BibTeX and BibLaTeX export data in the editor so the front-end downloads work without activating the plugin, and derive readable download filenames from each citation (for example, watson1953.ris).
• Only pre-compute export data when the feature is enabled, so bibliographies that do not use Cite / Export incur no extra editor work.
• Use a secure-context-safe helper for generating citation and bibliography IDs.
• Remove a dead, never-loaded duplicate of the PMID resolver (includes/pmid.php) to eliminate a function-redeclare risk.
• Fix DOI imports for works that Crossref labels with a non-standard type such as “monograph” (common for university-press books), which previously failed to import; unrecognized types now map to a sensible CSL type or fall back gracefully instead of aborting the import.
• Fix the default Chicago Notes-Bibliography style (and OSCOLA and MLA) dropping the publication year on every entry; those styles used an issued-date form the formatter does not render. All bundled styles now show the year, guarded by a regression test.
• Title-case author names and titles that Crossref or PubMed return in ALL CAPS (e.g. “TURING” / “I.—COMPUTING MACHINERY AND INTELLIGENCE”) so they no longer render shouting; already-cased text, initials, organizations, and non-Latin scripts are left untouched.

1.3.4

• Refresh the translation template and 19 seed PO/MO locale pairs from current source strings.
• Add i18n artifact validation to CI so POT, PO, MO, and public language-pack wording stay aligned.
• Clarify that bundled seed language files are translator/import material and WordPress.org Languages remains canonical for official packs.
• Update docs for the current maintenance state and archive historical planning notes out of active paths.

1.3.3

• Restore DOI imports in browser-based WordPress Playground by resolving DOI metadata through Crossref’s CORS-friendly CSL transform endpoint.
• Serialize DOI lookups to respect Crossref’s public concurrency limit when multiple DOIs are pasted together.
• Add a PubMed/PMID sample to the Playground starter content alongside DOI and BibTeX examples.

1.3.2

• Add optional Block Accessibility Checks compatibility: soft-detects the BAC plugin and registers four editor checks (empty bibliography, missing heading, raw URL link text, all metadata disabled). Borges works normally when BAC is absent.
• Harden Playwright E2E plugin-row locator to exclude WordPress update notice rows, fixing CI strict-mode violations.
• Regenerate translation template (POT) with 81 strings, up from 41; covers PHP error messages, BAC check strings, BibLaTeX export labels, and citation reorder controls.
• Extend banner generation script with locale and RTL support flags.

1.3.1

• Raise per-bibliography hard cap from 50 to 200 citations. Bibliographies between 100 and 199 citations now show a dismissible editor notice warning about potential formatting slowness on shared hosting. The per-paste limit (50 entries) is unchanged.

1.3.0

• Enforce an explicit 50-citation total cap per bibliography block with inline editor warnings, replacing the silent 51-entry formatter cliff.
• Guard all async editor mutation flows (paste/import, manual add, delete, style switch, structured edit) against stale results from superseded in-flight format requests.
• Remove redundant formatter call in the manual-entry add path; the merged bibliography is now formatted once instead of twice.
• Prune non-runtime vendor documentation and images from the release zip and exclude composer.lock, reducing release package weight.
• Cache successful PMID proxy responses and deduplicate pending DOI resolution requests to reduce avoidable network traffic.
• Refactor editor side-effects into focused hooks: useCitationImportActions, useManualCitationActions, and useBibliographyExportActions.
• Extract PHP PMID resolver, cache, and permission logic into includes/pmid.php.

1.2.0

• Add BibLaTeX export from the editor exports panel.
• Highlight 1.2.0 interoperability features, recent 1.1.x accessibility fixes, and ABNT (Associação Brasileira de Normas Técnicas / NBR 6023:2018) support in the readmes and changelogs.
• Add PMID input resolution through an authenticated WordPress REST proxy to the NCBI/PMC Literature Citation Exporter API.
• Add manual reordering controls for numeric citation styles, including keyboard Alt+Arrow movement.
• Reformat the full bibliography after citation mutations so cached display text, sort order, and metadata stay aligned.
• Improve sort parity with style-family dispatch, author-date tie-breakers, and JS/PHP coordination fixtures.
• Improve accessibility names for saved citation URL links and block toolbar controls.
• Harden Playwright accessibility and Playground smoke tests for shared WordPress Playground servers.
• Add compact matrix coverage for all nine styles, formatter output, export ordering, and PMID REST proxy regression before tagging 1.2.0.

1.1.1

• Fix Block Accessibility Checks (BAC) integration shipped in 1.1.0: register against the current BAC API, harden the soft opt-in, and load validation checks reliably so the empty_bibliography error and heading_missing warning fire as documented when the BAC plugin is active.
• Fix editor focus-ring regression so keyboard focus on entry actions remains visible.
• Fix Playground demo blueprint to install from the latest release zip rather than a stale path.

1.1.0

• Add optional Block Accessibility Checks (BAC) integration: when Troy Chaplin’s Block Accessibility Checks plugin is active, the bibliography block registers two authoring-time checks — an error if no citations have been added, and a warning if no heading is set so screen reader users navigating by heading can find the section.
• No functional change when BAC is not installed.

1.0.2

• Fix browser-based WordPress Playground demos by explicitly enabling the Playground Intl feature in addition to the kitchen-sink PHP extension bundle.
• Keep the GitHub demo blueprint and WordPress.org Preview blueprint aligned for Intl-enabled citation formatting, with regression coverage.
• Clarify translation wording so the readme distinguishes bundled seed PO/MO files from official WordPress.org language packs.

1.0.1

• Fix Playground/editor bibliography formatting by using the WordPress REST API fetch helper for formatter requests.
• Add the WordPress.org Preview blueprint at the documented assets path with the required PHP extension bundle for citation formatting.

1.0.0

• Initial public release as Borges Bibliography Builder.
• Add references from DOIs, DOI URLs, BibTeX entries, supported formatted citations, or manual entry.
• Format bibliographies in Chicago Notes-Bibliography, Chicago Author-Date, APA 7, MLA 9, Harvard, Vancouver, IEEE, OSCOLA, and ABNT (Associação Brasileira de Normas Técnicas / NBR 6023:2018).
• Automatically sort entries per style rules and skip duplicate manual or pasted entries.
• Save static HTML output so bibliographies remain readable after plugin deactivation.
• Output Schema.org JSON-LD by default, with optional COinS and CSL-JSON metadata layers.
• Export CSL-JSON, UTF-8 BibTeX, and RIS; copy individual citations or the full bibliography as plain text.
• Preserve Unicode quotation marks in BibTeX exports for Zotero, Mendeley, and other citation-manager imports.
• Provide reference-manager-friendly metadata and exports for Zotero, Mendeley, EndNote, JabRef, BibDesk, LaTeX, and CSL/citeproc workflows.
• Improve accessibility with keyboard navigation, visible focus, block-local notices, semantic bibliography markup, and no deprecated bibliography-entry ARIA role in newly saved output.
• Provide read-only REST API endpoints for programmatic bibliography access.
• Bundle seed interface locale files for translator review/import while using WordPress.org language packs as the canonical availability signal.
• Harden the WordPress.org release package with third-party notices and Plugin Check cleanup.
• Standardize GitHub, Playground, and release-download links on the approved borges-bibliography-builder slug and zip name.
• Add CI/runtime coverage for Multisite network activation and expanded PHP utility behavior.
• Confirm compatibility wording through WordPress 7.0 testing.