Added Elementor widget primitive — create custom Elementor widgets from blueprints with full controls and template rendering.
Added WordPress widget primitive — create classic sidebar widgets from blueprints with text, textarea, select, number, URL, and checkbox controls.
Fixed missing nonce on the New Widget link in the Widgets admin page.
Updated admin menu icon to a custom SVG logo.
1.0.9
Hardened write_option primitive: added comprehensive denylist blocking WordPress core options and any option name containing sensitive substrings (password, secret, api_key, token, salt, private_key).
Hardened read_option primitive: added denylist blocking reads of auth keys, salts, passwords, and API credential options to prevent exposure of sensitive data.
1.0.8
Migrated AI integration to WordPress AI Client (WordPress 7.0+) — removed direct Anthropic, OpenAI, Grok, and Ollama provider integrations.
Added missing nonce checks to handle_delete_blueprint, handle_rollback_version, handle_get_blueprint_preview AJAX handlers.
Added nonce to admin list table filter (primitive-ui) and verified on parse_query.
Fixed unsafe SQL in DB uninstall and migration: DROP TABLE, SHOW COLUMNS, ALTER TABLE now use wpdb::prepare() with %i placeholder.
Updated minimum WordPress requirement to 7.0.
1.0.7
Fixed SQL query builders: replaced dynamic WHERE/ORDER concatenation with fully literal SQL strings and bypass conditions to satisfy WordPress.DB.PreparedSQL.NotPrepared.
Moved tests/ directory outside the plugin folder (development-only, not distributed).
Removed stray .DS_Store file.
1.0.6
Fixed EscapeOutput: use JSON_HEX_TAG instead of str_replace for JSON-LD script output.
Fixed SQL preparation: refactored query/aggregate builders to use %i table placeholder and single prepare() call with explicit placeholders.
Fixed input handling: replaced direct $_GET/$_POST access with filter_input() throughout.
Renamed non-prefixed page-scope variables to use clautron_ prefix.
1.0.4
Replaced all external policy deep-links with root domain URLs to avoid Cloudflare-blocked automated checks.
1.0.3
Updated external service URLs in readme (OpenAI policy links).
Confirmed compatibility with WordPress 7.0.
1.0.2
Security: added explicit nonce checks in all AJAX handlers.
Security: added capability checks in admin page callbacks.
Removed create_user primitive per wp.org review guidelines.
