Lumioh SEO

Changelog

1.22.1

• Maintenance release: no change to features, settings or stored data, with one exception for a restore started before 1.22 (below).
• CSV imports (bulk edit, redirects, metadata) are read by one shared reader and the audit CSV is written by one shared formatter. The bytes written and the rows read are the same as in 1.22.0. The reader holds the file in memory only; it no longer uses a temporary stream that can spill to disk.
• The sitemap stylesheet, the inclusive-language word list, the audit report style and import files are read through WordPress’s own filesystem class, with a size limit checked before and after the read.
• A bundle restore that a release before 1.22 left half finished can no longer be resumed: it stops and asks you to read the bundle again. Its old scratch file is still deleted and is never read.
• The bulk CSV export reads 100 posts at a time instead of 200 and still stops at the same number of posts.
• Database statements name their tables as {$wpdb->prefix}useo_..., so WordPress coding-standard checks can read them. The SQL itself is unchanged.
• Coding-standard clean-up: fewer inline suppression comments, translators comments on strings that take placeholders, and renamed parameters that shadowed reserved words.

1.22.0

• Fixed stored cross-site scripting in the page title: custom-field values used by the %%cf_<key>%% token are treated as plain text and the title handed to WordPress is escaped.
• Fixed the audit CSV export so a value can no longer start a spreadsheet formula.
• Tightened permissions: running audits, changing finding status and refreshing the dashboard need the manager capability; redirect data over REST, abilities and activity export needs the redirect capability; configuration cards on the dashboard are shown to site managers only.
• Every admin form and Ajax action now has its own nonce and all request data is read through one verified gateway. A form left open while updating must be reloaded once.
• Redirects: destinations WordPress would refuse are rejected when you save them, a source typed the way browsers send it (for example /caf%C3%A9/) now matches because the encoded characters are no longer deleted from the request, and the host is checked again when a visitor is redirected.
• Screens no longer write data, create folders or make loopback requests while they render; checks run when you press the button.
• Redirect imports and audit snapshots scale with the data instead of the square of it, wildcard rules in robots and content sources no longer use regular expressions, and a bulk CSV import stops at 50,000 rows (filter useo_bulk_import_max_rows).
• Disabled features have no public, REST, IndexNow or scheduled effect.
• llms.txt is cached for five minutes for anonymous visitors. A $ inside a robots.txt tester rule is matched literally, as RFC 9309 defines; only a trailing $ anchors the end.
• A large redirect import holds the redirect write lock while it runs; another redirect save waits up to three seconds and then asks you to try again.
• Editor and admin scripts build DOM nodes instead of HTML strings.

1.21.1

• Hardened request handling with field-specific sanitization, validation,
  contextual output escaping and capability/nonces on state-changing actions.
• Kept bundle-restore payloads in the database instead of writing protection
  directives into uploads, and retained safe cleanup for legacy restore files.
• Fixed WordPress upload MIME validation for JSON imports and strengthened the
  exact-ZIP security and release audit gates.

1.21.0

• Activity report imports now recognize custom WordPress admin, content, core,
  REST and uploads paths when filtering asset requests.

1.20.0

• Moved Lumioh field access from core wp/v2 routes to lumioh/v1; see the
  upgrade notice for sites using REST Writes.
• Added REST access for post, term and user fields, content analysis and
  template previews against unsaved edits.
• Fixed template-variable display, keyword-field controls and admin list layout.

Earlier release history is included in CHANGELOG.md in the plugin files.