IndexLane Safe WebP & AVIF Queue

• Keep saved API keys with their original provider and hide credentials echoed by provider errors.
• Remove metadata from small Imagick previews, orient previews correctly, and clean up temporary files when a review fails.
• Preserve alternative text exactly through proposal storage, apply, and restore; reject stale proposals after image or text changes.
• Reject malformed or incomplete AI results, and allow room for reasoning tokens in Responses API requests.
• Refresh saved-key controls and replace superseded proposal cards correctly; fix proposal ordering and show server error messages instead of [object Object].
• Resolve Plugin Check escaping errors and verify AJAX input sanitization and nonce checks.
• Expand the readme with real AI capabilities, practical uses, and clear conversion and review boundaries.

• Added optional Media Review with bring-your-own API keys for OpenAI, Claude, and Grok. Conversion remains account-free and works without any AI provider.
• Added a human-review proposal queue for page-context mismatches, clearly visible privacy exposure, decorative-image classification, and alternative text. AI suggestions never change attachment metadata until an administrator applies them.
• Added reversible alternative-text application. A proposal is bound to the current value, and a later edit blocks both apply and restore instead of overwriting newer work.
• Added encrypted server-side key storage with a WordPress-salt-derived AES-256-GCM key, an ILSWQ_AI_API_KEY constant override, masked settings, and no key in browser configuration or downloadable reports.
• Added bounded review requests: plugin-generated previews are capped at 1600 pixels and 4 MiB, source metadata is not forwarded with the preview, and parent title/excerpt context is optional.
• Added provider-specific structured contracts for OpenAI and Grok Responses APIs and Claude tool use, plus strict validation of every returned field.
• Added Media Review status to scanned rows, report-scoped review controls, proposal cards, privacy and context evidence, explicit apply/dismiss actions, and restore controls for applied text.
• Added mocked WordPress integration coverage for all three provider request shapes, encryption, proposal persistence, apply, undo, dismissal, and decorative-image handling.

• Preserve ownership when generated files are stale, missing, or damaged, so quality changes and repairs can regenerate them.
• Allow WebP and AVIF conversions independently, including adding WebP through the server queue after AVIF conversion.
• Preserve current AVIF copies during attachment metadata updates and clean obsolete sizes in both formats.
• Match AVIF responsive candidates to exact source files, preserve crops, and retain the existing image fallback when AVIF coverage is incomplete.
• Validate stored AVIF containers and compatible brands, including truncated files, animation brands, and malformed box boundaries.
• Include both formats in report sizes, encoder labels, validation counts, and cleanup wording. Clarify that AVIF uses the browser and server jobs produce WebP.
• Correct the browser encoder's AVIF lossless quality and chroma options.

1.2.0 - 2026-10-12

• Added in-browser AVIF conversion. The bundled WebAssembly worker now encodes AVIF as well as WebP, and Browser conversion format in Queue Settings selects which one a run produces. AVIF is typically 20-50% smaller than the equivalent WebP.
• Added an AVIF quality setting (default 60 on libavif's scale) alongside the JPEG and PNG quality controls, plus a WP-CLI status row for the browser output format.
• Made generated files format-aware: a size can hold a WebP copy, an AVIF copy, or both, keyed {size} and {size}__avif. Legacy WebP metadata is read unchanged, and existing installs keep their generated-map entries.
• Served AVIF through a <picture> element with WebP and the untouched original as fallbacks. The _src and srcset filters still swap URLs to WebP only, because a bare URL swap has no fallback.
• Added a bounded ISO-BMFF box walk on the server for uploaded AVIF bytes. It requires a still AVIF brand and an ispe spatial-extents box, and refuses animated sequences, non-AVIF HEIF brands, 64-bit box sizes, and boxes that overrun their parent.
• Validated generated AVIF files locally by header brand instead of getimagesize(), so a host that cannot decode AVIF does not report its own generated files as invalid.
• Kept AVIF in the browser backend. GD and Imagick cannot be relied on to encode AVIF on shared hosting, so the server queue, automatic uploads and WP-CLI continue to produce WebP.
• Bundled @jsquash/avif 2.1.1 with the single-threaded libavif/libaom codec, so the AVIF path needs no SharedArrayBuffer or COOP/COEP headers. Only the codec for the configured format is loaded.
• Added libavif and libaom licence notices to the release package and the CI licence check, and compared the rebuilt AVIF/SIMD WebP bundle with the shipped files.
• Added tests/avif-container.php, a WordPress-free regression suite for the AVIF container validators and the format helpers, and wired it into CI.
• Renamed the plugin to IndexLane Safe WebP & AVIF Queue and refreshed the WordPress.org title, tags, description, FAQ, CLI labels and report copy for the new format.

• Added a third conversion backend: the bundled nikocodes/picowebp pure-PHP encoder. A host whose image editor cannot write WebP can now convert on the server itself, through the normal queue, whole-library jobs, automatic uploads and WP-CLI, with no GD, Imagick, cwebp or browser involved.
• Kept the plugin compatible with PHP 7.4+. picowebp is optional: its PHP 8.1+ and zlib requirements are detected automatically, and its library is never loaded on PHP 7.4 or 8.0. Its setting is disabled on incompatible hosts and stays off by default on compatible ones. GD/Imagick and browser conversion remain available independently.
• Limited PHP encoding to two million pixels per source by default, bounded VP8 dimensions, and checked the actual file dimensions before decoding so stale attachment metadata cannot bypass the cap. A site's own max-pixels setting can lower the ceiling.
• Routed the pure-PHP path through the same staging, validation, ownership, conflict, totals and generated-map code as the other backends, so a pure-PHP conversion is indistinguishable from a GD, Imagick or browser conversion afterwards. The stored editor label is PHP (picowebp).
• Kept browser conversion as the fallback for unsupported inputs or files above the PHP cap. Both manual and automatic PHP queue work process one attachment per request. Preserved useful refusal reasons and corrected report labels for browser-only sources.
• Refused JPEGs that still need EXIF rotation or mirroring instead of producing incorrectly oriented copies. Rechecked source dimensions, size and modification time before installing PHP output.
• Added a server check, a Queue Settings toggle, a report editor label, a WP-CLI status row, and queue messages for the new backend. Saving the PHP toggle refreshes the admin's backend controls automatically, and unavailable-encoder explanations remain readable beside the settings.
• Added an optional Composer package suggestion and a scripts/sync-picowebp.sh script for refreshing the bundled library. Composer installation does not raise the plugin's PHP requirement.
• Added encoder checks on PHP 7.4, 8.0, 8.1 and 8.4, including automatic disabling on older runtimes, pure-PHP PNG/JPEG reading, pixel limits, ICC profiles and EXIF protection. Expanded WordPress queue and admin JavaScript regressions, corrected the smoke test's release version, and kept the bundled library outside the plugin's PHP 7.4 lint and translation baseline.
• Refreshed the WordPress.org description and FAQs with clearer conversion choices, original-image protection, and PHP 7.4 compatibility details.

• Detected ImageMagick builds that silently ignore WebP quality and routed conversion to GD or the browser instead. Added a small, request-cached encoder probe and regression coverage for the Linux fallback.
• Corrected the WordPress.org Tested up to header to 7.1; compatibility testing still uses WordPress 7.1.1.
• Explicitly sanitized Media Library row-action IDs before normalizing them, resolving the Plugin Check input warning.
• Updated release metadata and packaging checks for 1.0.1, and ignored the local codec/ directory.

1.0.0 - 2026-09-19

• Added browser (WebAssembly) conversion. A WebP encoder compiled to WebAssembly ships with the plugin and runs in the administrator's browser, so images on hosts whose image editor cannot write WebP are still convertible. Nothing is installed on the machine and no service is contacted; only the finished WebP file returns to the site.

• Added a browser conversion panel to the plugin page: capability detection that names the missing browser feature, HTTPS and Content Security Policy checks, a per-file progress bar, a running result log, a stop control, and a report refresh when the run ends.

• Added the "Convert images in the browser" setting, off by default, plus a browser conversion row in the server checks and a report reason and editor label for files that only the browser can convert.

• Routed browser output through the same staging, ownership, conflict, totals and generated-map code as the local image editor backends, so a browser conversion is indistinguishable from a server conversion afterwards, including frontend serving.

• Kept the persistent queue honest on hosts without a WebP writer: conversion jobs, whole-library jobs and automatic new-upload conversion are refused with a clear message instead of failing attachment by attachment, and browser-only files are reported as skipped rather than failed.

• Blocked a browser run while a server conversion job holds the queue, and suspended the page's queue worker while a browser run is in progress, so the two backends never write the same attachment at the same time.

• Added tests/browser-wordpress.php: integration coverage for capability routing, the REST prepare/finish handshake, container validation, replay, changed sources, foreign sibling files, cross-user tokens, WebP validation, stored metadata, totals and cleanup.

• Added a CI job that type checks the WebAssembly module, rebuilds the committed bundle, compares it with the shipped files and confirms the bundled codec licences.

• Fixed server conversion ignoring the selected quality when WordPress changes the output format to WebP.

• Fixed stale browser results after quality changes, damaged outputs, or a replaced attachment source; browser saves recheck the current source and settings.

• Serialized cleanup, totals recalculation, and browser saves with the server queue, kept conflicting controls disabled during a browser run, and allowed conversion after a server job is paused.

• Added a real worker/codec capability probe, useful server error messages, bounded uploads, and EXIF rotation/mirror rejection before decoding.

• Corrected encoder labels and savings for partially converted attachments, and applied memory limits to regeneration too.

• Stopped automatic uploads from retrying browser-only images.

• Verified WordPress 7.1.1 with GD, Imagick, WP-CLI, and the browser backend regressions; updated the CI matrix.

• Added measured size and speed comparisons for large/small JPEG and PNG files using Chrome, GD, and Imagick at quality 80.

• Rewrote the description for shared-hosting users and refreshed six screenshots, including a live WebAssembly conversion.

• Tested browser WebAssembly conversion in Google Chrome 153.0.8010.52 on WordPress 7.1.1 and real Safari 26.6.2 on WordPress 7.1 (macOS), covering JPEGs, transparent PNGs, generated sizes, saved results, and larger-output skips.

• Added whole-library background conversion with bounded batches, attachment ID cursors, pause/resume/cancel, and retries that remain available after large failure counts.
• Added Media Library WebP status and savings, row and bulk conversion actions, and per-image exclusions from conversion and frontend serving.
• Added incremental savings totals and bounded recalculation for earlier conversions, partial cleanup, and attachment-deletion retries.
• Added WP-CLI status, scan, convert, totals, queue, and cleanup commands with dry runs and whole-library conversion.
• Fixed exclusions changed after queuing, CLI output formatting and command registration, automatic queue draining, and cleanup/recalculation conflicts with queued conversion.
• Expanded WordPress and CLI regression coverage for library changes between batches and consistent savings after cleanup retries.

• Added report search by filename, attachment title, and ID with matching result counts.
• Made CSV exports and conversion selection respect the active search and status filter, including selecting only visible eligible images.
• Added a clear-search control, a no-results message, and accessible status-filter states.
• Included existing WebP results in the Skipped filter and convertible review items in the Eligible filter to match their counters.

• Added a persistent, resumable conversion queue with bounded batches, duplicate-worker locking, progress reporting, pause, resume, cancel, and failed-item retry controls.
• Moved automatic new-upload conversion out of the upload request and into retryable WP-Cron work.
• Added generation fingerprints so source-file or quality-setting changes are detected before plugin-owned WebP files are safely regenerated.
• Reconciled plugin-owned WebP files when attachment sizes change and cleaned them up when attachments are deleted.
• Retained failed attachment cleanup as background orphan work so temporary deletion failures can be retried safely.
• Expanded browser and WordPress smoke coverage for persistent jobs, retries, asynchronous uploads, fingerprints, and attachment lifecycle cleanup.

• Renamed the displayed plugin to IndexLane Safe WebP Queue and removed the third-party update URI.
• Changed the WordPress.org contributor to wpfixpath and declared testing through WordPress 7.1.
• Treated unrelated sibling WebP files as conflicts and prevented them from being overwritten or deleted.
• Staged and validated generated WebP files before replacing plugin-owned output.
• Made PHP statuses, JavaScript request errors, CSV headers, selection labels, and result summaries translation-ready.
• Added the root GPL license and repeatable WordPress.org release packaging with top-level SVN assets.
• Changed CI to test the unmodified release package with WordPress 7.1 using GD and Imagick and to run Plugin Check against that same package.

• fix cleanup pagination and preserve ownership after deletion failures
• harden CSV export and validate every generated WebP in the report
• cache frontend generated-file inspection and add regression coverage

• bump plugin and readme metadata to 0.1.3
• add changelog notes for WebP validation copy and refreshed screenshots

Prepare 0.1.2 CI and repo hardening release

• bump plugin and readme release metadata to 0.1.2
• update README positioning copy
• ignore IDE/build artifacts and remove tracked .idea/dist files
• run Plugin Check against a clean WordPress.org build directory
• harden uploads-path validation before scan/conversion
• replace direct filesystem calls flagged by Plugin Check

• Added server capability checks and a Media Library dry-run scan.
• Added selected, small-batch sibling WebP conversion while preserving original images.
• Added skip reasons, CSV export, and explicit cleanup for plugin-generated WebP files.