FeedbackPilot

1.1.6

• Prevents dialog boxes from piling up and duplicate screenshots from being taken after rapid clicks.
• Announces that a screenshot is being taken and reverts after 7.5 seconds.
• Clears dialog listeners, timers, and spam checks on every close path.
• Keeps the console catcher synchronous without using an invalid WordPress script strategy.

1.1.5

• Keeps the cloned viewport at the scroll position at the time of the click when "clone-only" layout repairs would otherwise trigger browser scroll anchoring.
• Strengthens the cross-browser screenshot validation process with a visible downstream anchor and an exact vertical landmark comparison.
• Prevents text in tightly spaced, fixed-height input fields from being vertically cropped in screenshots.
• Builds the release ZIP from a verified allowlist and verifies the provenance and checksums of the bundled browser assets before publication.

1.1.4

• Keeps scrolled screenshots aligned on pages that combine smooth scrolling with dynamic float/clearfix layouts.
• Preserves fixed elements, the live scroll position, and the page's original inline scroll styles during cloning.
• Runs the actual FeedbackPilot screenshot path in Chromium, Firefox, and WebKit before merging and releasing.
• Updates vulnerable lint dependencies intended for development only and aligns optimized Composer autoloading with the plugin's WordPress-style filenames; development tools are not included in the plugin ZIP file.

1.1.3

• Captures the viewport that the visitor is actually viewing after scrolling, including themes whose document uses visible overflow.
• Let site owners hide the guidance next to the "Public" button while keeping it visible within the report form.
• Ships provides complete German translations for both de_DE and de_DE_formal.
• Verifies new turnstile credentials before saving and distinguishes between visitor authentication failures and configuration or temporary provider failures.

1.1.2

• Allows site owners to customize the public widget button and a clearly visible guidance notice from Settings -> FeedbackPilot.
• Uses translated privacy-safe defaults when either field is missing, empty, or contains only whitespace, with no migration required for existing installations.
• Sanitizes both settings as plain text, repeats the notice within the form, and adds automated regression coverage.

1.1.1

• Includes html2canvas-pro and the native Altcha fallback in the plugin ZIP file, so FeedbackPilot no longer requires visitor-browser requests to jsDelivr.
• Keeps Cloudflare Turnstile as an optional, admin-enabled spam protection integration.
• Update the privacy/GDPR documentation to reflect the local asset delivery model.

1.1.0

• Adds FeedbackPilot support for WordPress login, lost-password, retrieve-password, and reset-password screens.
• Adds sanitized auth-screen context to generated issues so that reports from login and password reset pages are easy to triage.
• Redacts reset keys, login identifiers, nonces, tokens, and password-like values from auth-screen URLs, console logs, and issue bodies.
• Clears sensitive login/reset form fields from the cloned screenshot document before rendering, without changing the live page.

1.0.5

• Adds a trusted triage filter to generated GitHub issues so that maintainers and LLM agents can validate visitor reports before turning them into code changes.
• Requires that non-implementation outcomes—such as "already shipped," "duplicate," "needs more information," "not planned," "irrelevant," or "spam"—remain explicit options during triage.
• Update the LLM agent guidance and smoke checks for this prompt-injection defense-in-depth layer.

1.0.4

• Makes the visitor-facing widget and modal copy easier to understand for non-technical users; GitHub and issue-tracker terminology is kept out of the front end.
• Localizes the native Altcha fallback challenge UI when the standalone Altcha WordPress plugin is not installed.
• Prevents the browser or password manager's autofill feature from interfering with the Turnstile credential fields on the settings page.

1.0.3

• Displays user-friendly, localized error messages instead of internal REST error codes such as rate_limited.

1.0.2

• Fixes an issue where CAPTCHA-protected submissions were incorrectly triggering the unauthenticated 60-second burst limiter after a solved Altcha or Turnstile challenge.
• Failed or missing CAPTCHA submissions no longer use up a report rate-limit slot; the hourly per-IP limit still applies to successful reports.

1.0.1

• Fixes screenshot capture on pages where CSS `text-transform` changes the text length, preventing an upstream `html2canvas-pro` `Range.setEnd` `IndexSizeError`.
• Documents on Cloudflare Turnstile CSP requirements for sites with strict Content Security Policy headers.
• Adds a simplified browser fixture for the html2canvas text-transform regression.

1.0.0

• First stable release for production use.
• Adds improvements to ensure GDPR compliance: a privacy notice for visitors, admin controls to disable screenshot capture and console log inclusion, and server-side enforcement of those minimization settings.
• Harden Cloudflare Turnstile validation by linking tokens to the expected action and hostname.
• Retains the v0.1.16 security enhancements: native Altcha replay protection, prompt-injection boundaries, proxy-aware rate limiting, AES-256-GCM token storage, and validated screenshot storage.
• Updates to the README, the German README, readme.txt, the wiki privacy guidance, translations, and smoke tests for the v1.0 release.

0.1.16

• Security hardening release: The native Altcha fallback now uses delimited salts, strict validation, expiration checks, and replay protection.
• Prompt injection follow-up: Metadata provided by visitors and console logs are isolated and normalized as untrusted content, with a suspected-injection hook designed to minimize PII for integrations.
• Rate limits now rely solely on REMOTE_ADDR by default, with explicit Cloudflare and generic reverse-proxy modes.
• Token storage now uses a versioned AES-256-GCM envelope where available, with support for legacy AES-256-CBC read and migration operations.
• Screenshot storage now enforces PNG size and pixel limits and re-encodes PNGs using GD when available.
• Turnstile secret placeholders no longer risk overwriting stored secrets; cache flushing now targets only FeedbackPilot's EDD-SL cache key.

0.1.0

• Initial release. Console catcher, annotated screenshot, GitHub-Issue submission via OAuth-connected user token (or manual fine-grained PAT).