1.0.0-rc.5

[sean-e-dietrich]

Summary

Prepares 1.0.0-rc.5, published as a GitHub pre-release once this merges and the tag is pushed.

• Version: header, BASIC_FIREWALL_VERSION and readme.txt Stable tag: → 1.0.0-rc.5
• CHANGELOG.md: ## [Unreleased] → ## [1.0.0-rc.5] with a release-candidate lead, and a fresh empty ## [Unreleased] above it. Everything merged since rc.4:
  • Early-path diagnostics, and log every fail-open (#34) #39: early-path diagnostics for mode: exception does not answer challenge verdicts on the wp-config.php path; the page is served and cached (fails open) #34. The last web request's report and the last anomaly, wp basic-firewall early-report, Site Health, every fail-open logged, and the BASIC_FIREWALL_DEBUG header.
  • Diagnostics: failed rules, mismatch anomalies, rate-limited fail-open logging; autoloader order (#41, #44) #55 (Diagnostics: failed rules per path, mismatch anomalies, and rate-limited fail-open logging #41, Early path loads a second autoloader from the fixed locations when the library is already loaded #44): failed rules per path (sampled), a mismatch anomaly, rate-limited fail-open logging, and an early path that no longer loads a second autoloader.
  • Keep secrets out of the Advanced YAML box and the compiled file (#47, #48) #56 (The Advanced settings YAML box shows and exports any credential typed into it #47, Keep the Redis password out of the compiled file #48): Advanced YAML credentials redacted on screen and in exports, and the Redis password kept out of the compiled file via BASIC_FIREWALL_REDIS_PASSWORD.
  • Automated coverage for multisite, the runner's unanswered-verdict refusal, live Redis and APCu (#43) #57 (Automated coverage for multisite, the runner's unanswered-verdict refusal, live Redis and APCu #43): uninstall removes runtime.json. It also adds CI coverage (multisite job, live Redis, APCu), which needs no changelog entry.
  • Bundle kanopi/firewall 2.35.1: ASN, path normalisation, presets at any depth, block-mode notice (#45, #46, #49, #50, #51) #58 (WordPress in its own directory: presets and /wp-login.php limits don't fire on core files #45, Show the pass-cookie-didn't-come-back notice in block mode too #46, ASN list entries written AS16509 are skipped; latitude/longitude equals never matches a database #49, /WP-LOGIN.PHP on a case-insensitive filesystem misses a rule on /wp-login.php #50, Paths routed through index.php can be spelled around a rule (/./wp-json) #51): bundles kanopi/firewall 2.35.1, which changes what some existing rules do (see What changes on upgrade): ASN equality, path normalisation, presets at any depth, rate-limit case. Also the block-mode "cookie didn't come back" notice, and a rate-limit pairing check that follows the library's lint.
• readme.txt changelog: a = 1.0.0-rc.5 = entry

After merge

git tag -a 1.0.0-rc.5 -m 1.0.0-rc.5 <merge-commit> && git push origin 1.0.0-rc.5

Testing

• build/check-versions.sh --release 1.0.0-rc.5: all agree

• build/release-notes.sh 1.0.0-rc.5: extracts the section

• Unit tests (267)

• build/build-zip.sh: produces basic-firewall-1.0.0-rc.5.zip, scope check OK

• Was AI used in this pull request?