> For the complete documentation index, see [llms.txt](https://whoisandywhite.gitbook.io/porterwp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whoisandywhite.gitbook.io/porterwp/release-notes.md).

# PorterWP 1.4.95

PorterWP 1.4.95 is a security, compatibility and performance release. It supports WordPress 6.4 or newer, is tested through WordPress 7.0.3, and requires PHP 8.2 or newer.

## Upgrade summary

The release keeps the existing JSON configuration format, filter form parameter names, theme-template entry points, `Porter_QueryFilter_Base` subclass API and `Porter_PastStatusUpdater` subclass API. Existing sites can update without rebuilding their Porter configuration.

There are three intentional security-related changes to check on bespoke integrations:

1. Filter forms now emit signed request-schema fields. Theme templates that call `generate_filters()` receive them automatically. Hard-coded unsigned links continue to support bounded public taxonomy, post-type, search, archive-month, author and sorting filters; sensitive meta and event-date dimensions need a rendered or registered schema. Legacy geolocation remains available only through its strict marker, distance and callback checks.
2. Manual past-status maintenance is POST-only and requires both a nonce and the configured capability. Old `?updateEvent=1` or `?migrateEvent=1` links no longer run an operation.
3. `Porter_QueryFilter_Base` now matches its target class as an exact CSS token. Ensure the Query Loop contains the complete value assigned to `$className`.

## Security

* Premium filter requests are checked against signed, route-bound schemas and bounded server-side legacy registrations.
* Query inputs are depth-, length- and clause-limited, and only viewable post types and taxonomies are accepted.
* Configured meta keys are allowlisted. Meta and event-date filters cannot be introduced by an arbitrary query string.
* Filter copy and control output is escaped for its HTML context.
* UK postcode lookups use safe, bounded remote requests, positive and negative caching, and miss-rate limiting.
* Past-status manual actions require `manage_options` by default and a valid action nonce.

See [Filter request security](/porterwp/features/premium-filters-block/premium-filter-security.md) for the complete compatibility model.

## Correctness and compatibility

* Boolean theme-support entries now register their named feature correctly.
* Inherited query filtering runs early enough to affect the main query, while non-inherited Query Loops remain scoped by query ID.
* Sorting-only filter submissions, post-type controls, taxonomy controls and existing `theme.json` block CSS now apply correctly.
* Past-status decisions run after core meta and ACF fields are saved, use the WordPress site timezone, and only transition published or already-past content.
* ACF-backed integrations now check their required API and degrade gracefully. Local field groups can still register when `acf_add_local_field_group()` is available, while missing PRO APIs disable only dependent option-page and custom-block features and produce an admin notice.
* Bundled translations load from the plugin text domain using WordPress locale filenames.

## Performance and lifecycle

* Configuration, block, style and include caches are scoped to the active site/theme and accept valid empty results.
* Cache signatures track relevant config and source metadata; the settings object-cache entry expires after one day by default.
* Theme PHP discovery validates cached paths and loads only readable `.php` files inside the configured include root.
* Past-status cron work is batched and avoids rewriting unchanged posts.
* Site Editor collection previews use short-lived, permission-checked response caches and lightweight ACF placeholders.
* Post-type, taxonomy and past-status rewrite changes contribute to one coordinated soft flush. Deactivation removes scheduled status hooks and invalidates Porter rewrite rules.

## Packaging

PorterWP 1.4.95 is licensed under GPLv3 or later, includes Freemius SDK 2.13.4, and adds a deterministic release builder. See [Release builds](/porterwp/tooling/release-process.md).

## Recommended post-update checks

* Submit each bespoke filter template once and confirm its complete `FormData` is preserved by custom JavaScript.
* Exercise any theme-owned AJAX filter handler with its nonce, successful response and empty-results response.
* If a `Porter_QueryFilter_Base` subclass previously relied on a partial class-name match, add the exact class token to its Query Loop.
* Replace bookmarks or admin buttons that invoke past-status maintenance through GET with the documented nonce-backed POST form.

No manual permalink flush is normally required.