Bug fix: Image captions (figcaption, wp-caption, shortcode) are now stripped
from post content when sharing with the “Full content” option. Captions read as
disconnected text in social posts because the image they describe is not included.
1.1.0
Security: Apple Sign In now performs full RS256 cryptographic signature verification
against Apple’s public JWKs (cached 24 h). Handles key rotation with automatic retry.
Security: Social login email matching is now gated on provider email verification flags
(Google email_verified, Discord verified, Apple email_verified JWT claim). Unverified
emails are cleared before account lookup to prevent account takeover.
Security: New accounts created via social login are always assigned the Subscriber role.
The configurable role selector has been removed.
Security: Social login respects the site’s “Anyone can register” setting.
Bug fix: Instagram publishing now stores the media container_id in post_meta after
Step 1 succeeds. Scheduler retries reuse the existing container instead of creating
a new one, preventing orphaned containers and intermittent publish failures.
Bug fix: Instagram container polling extended to 6 polls × 5 s (30 s total) to handle
slower Meta image processing. Timeout failures are now retryable without losing the
container reference.
Bug fix: Duplicate auto-shares on scheduled posts fixed. The premium scheduler’s
publish_future_post hook (which re-queued every scheduled post regardless of whether
on_publish had already handled it) has been removed. wp_scheduled_missed is retained
for genuinely missed schedules only.
Bug fix: X (Twitter) token refresh now correctly preserves the stored username label
(_label key) when saving the refreshed token. Label was previously lost on every
2-hour refresh cycle, causing the account card to show a numeric ID.
Bug fix: X token get() no longer filters expired tokens when queried by account_id.
The caller needs the refresh_token even after the access_token has expired.
Bug fix: X token is now saved with expires_in at initial connection, enabling proactive
refresh before the API call instead of reactive refresh after a 401.
Bug fix: X publish() now performs a proactive token refresh if the access_token expires
within 5 minutes, eliminating the 401 → refresh → retry round trip in normal operation.
Bug fix: X has_valid() now considers any stored row as connected (expired or not),
preventing false “Conectar” state when the token is merely stale but refreshable.
Bug fix: X refresh failure on HTTP 400/401/403 or invalid_grant now deletes the stored
token so the card correctly shows “Conectar” instead of a broken connected state.
Bug fix: Facebook profile picture URLs are now stored as stable Graph API redirect URLs
(graph.facebook.com/{id}/picture?type=large) instead of expiring CDN URLs.
Bug fix: Instagram profile picture is now fetched and stored at connect time.
Bug fix: wp_localize_script for the post editor metabox now includes refresh_nonce,
fixing the auto-refresh after publish (the AJAX call was silently rejected because
the nonce was undefined).
Bug fix: Metabox auto-refresh after publish no longer checks isDirty, which was always
true during a first-time Publish and prevented the refresh from ever firing.
Bug fix: Delete queue item handler replaced sanitize_key() with sanitize_text_field()
regex validation to preserve dots in uniqid() keys (sanitize_key was stripping dots,
making the key not match the stored queue entry).
Bug fix: Instagram OAuth state now uses zasp_create_oauth_state() (HMAC-signed) instead
of a random UUID transient, fixing a state mismatch that made Instagram callbacks fail.
Bug fix: Token Store get() no longer excludes expired tokens when queried by specific
account_id; the ORDER BY in the no-account_id path now prefers non-expired rows but
falls back to the most recently updated row.
Improvement: Weekday selector added to Evergreen Republish settings (Programador tab).
The reshare cron runs daily but only queues posts on selected days.
Improvement: Social login page now shows the exact Social Login buttons rendered by ZASP.
1.0.0
Initial release.
Free: Social Login with Facebook, Google, Apple, X, Twitch, Discord.
Free: Auto-post to Facebook, Instagram (with smart crop), X, Threads, Bluesky, Mastodon, Truth Social.
Free: Per-post instant share and per-network share controls from the post editor.
