Changelog

> Scope: this covers the Olympus theme **and** the bundled Crumina/Unyson framework
> extensions that ship with it (sign-form, post-reaction, ajax-blog, extended-search,
> post-share, stunning-header, contact-form). Items marked _(framework)_ live in the
> bundled Unyson extensions.

## [4.8.0] — 2026-06-03

A large security, performance, and modernization release. The theme now targets modern
PHP/WordPress, moves its AJAX surface to a namespaced REST API, migrates key UI to the
WordPress Interactivity API, and trims hundreds of KB of JavaScript from every page.

### ⚠️ Requirements / breaking changes
- **Minimum platform raised to PHP 8.1+ and WordPress 6.9+** (previously PHP 5.6 / WP 5.7).
  Verified compatible across PHP 8.1–8.4. Sites on older PHP/WordPress must update first.
- Legacy IE11 polyfills and other dead browser shims have been removed.

###  Security
- **Notifications — fixed an IDOR/CSRF.** Notification actions (mark read/unread/delete,
  mark-all) are now served by an authenticated REST endpoint with per-user ownership checks,
  so one user can no longer act on another user's notifications.
- **Sign-in / Registration _(framework)_ — multiple fixes:**
  - Restored CSRF protection in a **cache-safe** way: forms carry no stale nonce; a fresh
    nonce is fetched from an uncached REST endpoint at submit time and enforced server-side
    (fails closed with a friendly "session expired" message). Works behind full-page caches.
  - Fixed a **reflected XSS** in the Youzer registration prefill (`$_GET` values were echoed
    into an inline script) — now `esc_js()`-escaped.
  - Fixed an **SQL injection** in the activation lookup (prepared statement).
  - reCAPTCHA verification now uses the WordPress HTTP API (`wp_remote_post`) with timeouts
    and error handling instead of `file_get_contents()` — no `allow_url_fopen` dependency,
    fails closed.
  - Sanitized all login/registration inputs; added a **same-origin guard**, **per-IP rate
    limiting**, an **open-redirect fix** (redirect targets validated against the site host),
    and a **URL-parameter-injection fix** in the registration prefill.
- **Post reactions _(framework)_ — fixed an SQL injection.** The guest identity was taken
  from a spoofable `X-Forwarded-For`/`Client-IP` header and reached SQL unescaped. IPs are
  now validated and all reaction queries use prepared statements. Reaction `type` is
  whitelisted, preventing writes to arbitrary post-meta keys. The action nonce is now
  cache-safe.
- **AJAX blog _(framework)_ — fixed a path traversal / local file inclusion.** The pagination
  view name came from the request and was concatenated into an include path; it is now
  whitelisted, and the template slug is sanitized against traversal.
- **Extended search _(framework)_ — fixed a regex injection / ReDoS.** The raw search query
  was used as a regular expression; replaced with safe case-insensitive substring matching.
- **SVG uploads — hardened against XXE/SSRF** in metadata parsing (network access disabled,
  DOCTYPE rejected).
- **General hardening:** prepared statements for custom SQL, escaped output, HTTPS for remote
  downloads, and demo-import URL hardening.

### ⚡ Performance
- **~385 KB of JavaScript removed from typical page loads:**
  - **sweetalert2 (105 KB)** is no longer enqueued globally — it lazy-loads only when an error
    notice actually needs to be shown.
  - **Lottie player** swapped for a lighter build (**280 KB → 168 KB**) and **deferred** — it
    now loads only when a visitor starts filling the registration form, instead of on every page.
- **Replaced the SmoothScroll JS library with native CSS** smooth scrolling, with full
  `prefers-reduced-motion` support (no animation for users who request reduced motion).
- Deferred non-critical JavaScript; removed dead IE11 and unused Font Awesome assets.

### ✨ Modernization
- **REST API (`olympus/v1`).** AJAX handlers moved to a namespaced REST API with proper
  permission callbacks and schemas: instant search, notifications, friend requests (via
  BuddyPress core REST), demo tools, admin notices, sign-form nonce, **post-reaction toggle**,
  and the **AJAX blog listing**. Frontends prefer REST and fall back to admin-ajax, so there is
  no hard cutover.
- **Interactivity API.** Migrated from jQuery to the WordPress Interactivity API: sidebar
  toggle, header instant search, friend-request accept/reject, and the notifications dropdown.
- **Blocks & `theme.json`.** Added a settings-only `theme.json` (brand color palette,
  typography, layout) and replaced the deprecated `block_categories` filter with
  `block_categories_all`. Added a `@wordpress/scripts` build pipeline for blocks.

###  Styling
- Body/canvas and unread-notification backgrounds now use the `--ol-main-bg-color` token
  (correct light/dark theming); dropdown triangle colors aligned to the same token.

###  Developer / tooling
- Added quality gates: **PHPCS (WordPress Coding Standards)**, **PHPCompatibilityWP** (8.1+),
  and **PHPStan**. New `composer compat:ext` script runs the PHP 8.1 compatibility check across
  the bundled Crumina extensions (currently clean).
- Added a runtime verification checklist (`docs/verification-checklist.md`) and an ADR recording
  the PHP 8.1+ / WP 6.9+ support matrix.

###  Maintenance
- **WooCommerce:** replaced template-file overrides with hooks/CSS, reducing the number of
  override files that must be kept in sync across WooCommerce updates.
- Removed a duplicated `stunning-header` directory _(framework)_ that previously required
  patching the same file twice.
- Fixed deprecated `FILTER_SANITIZE_STRING` usage and other PHP 8.1 runtime-deprecation
  hotspots across the bundled extensions.