Simple Local Avatars

2.8.6 – 2026-02-17

• Changed: Bump WordPress “tested up to” version 6.9 (props @peterwilsoncc, @dkotter via #352).
• Changed: Consider get_avatar() wrapper function get_simple_local_avatar() escaped (props @peterwilsoncc, @dkotter via #358).
• Changed: Consider wp_verify_nonce() as auto-sanitized (props @peterwilsoncc, @dkotter via #358).
• Fixed: Ensure form data is unslashed as required (props @peterwilsoncc, @dkotter via #358).
• Security: (Hardening) Ensure user has manage_option cap before saving default avatar (props @peterwilsoncc, @dkotter via #358).

2.8.5 – 2025-08-06

• Security: Run a user capability check before migrating WP User Avatars. Thank you Håkon Harnes at Wordfence for responsibly disclosing this issue. (props @jeffpaul, @peterwilsoncc, @faisal-alvi via GHSA-fmhf-27jv-qf37)

2.8.4 – 2025-07-14

• Changed: Don’t resize image if the full version already has the expected height/width (props @ocean90, @jeffpaul, @faisal-alvi via #324).
• Changed: Bump WordPress “tested up to” version 6.8 (props @qasumitbagthariya, @dkotter, @jeffpaul via #332, #334).
• Changed: Bump WordPress minimum from 6.5 to 6.6 (props @qasumitbagthariya, @dkotter, @jeffpaul via #332, #334).
• Security: Bump @sentry/node from 8.38.0 to 8.52.0 (props @dependabot, @faisal-alvi via #325).
• Security: Bump axios from 1.7.7 to 1.8.4 (props @dependabot, @faisal-alvi via #330).
• Security: Bump tar-fs from 3.0.6 to 3.0.9 (props @dependabot, @faisal-alvi via #331, #336).
• Security: Bump http-proxy-middleware from 2.0.7 to 2.0.9 (props @dependabot, @peterwilsoncc via #335).

View historical changelog details here.