| @@ -1,9 +1,9 @@ | ||
| 1 | 1 | === ElasticPress === |
| 2 | 2 | Contributors: 10up, tlovett1, vhauri, tott, felipeelia, oscarssanchez, cmmarslender |
| 3 | 3 | Tags: performance, search, elasticsearch, fuzzy, related posts |
| 4 | 4 | Tested up to: 7.1 |
| 5 | -Stable tag: 5.3.4 | |
| 5 | +Stable tag: 5.3.5 | |
| 6 | 6 | License: GPLv2 or later |
| 7 | 7 | License URI: https://www.gnu.org/licenses/gpl-2.0.html |
| 8 | 8 | |
| 9 | 9 | A fast and flexible search and query engine for WordPress. |
| @@ -77,8 +77,30 @@ | ||
| 77 | 77 | 4. Synonyms Dashboard |
| 78 | 78 | 5. Instant Results modal |
| 79 | 79 | |
| 80 | 80 | == Changelog == |
| 81 | + | |
| 82 | += 5.3.5 - 2026-09-10 = | |
| 83 | + | |
| 84 | +**This is a security release** addressing two issues in specific configurations: | |
| 85 | + | |
| 86 | +* **Protected Content:** If the feature is active, Authors filtering the admin list by private status could see other authors' private posts. | |
| 87 | +* **Comments:** If the feature is active and the site has password-protected posts, anonymous comment search could return those comments. | |
| 88 | + | |
| 89 | +__Fixed:__ | |
| 90 | + | |
| 91 | +* Prevent an array-to-string conversion warning in Custom Search Results when post terms are not a string. Props [@burhandodhy](https://github.com/burhandodhy) and [@leedxw](https://github.com/leedxw). | |
| 92 | + | |
| 93 | +__Security:__ | |
| 94 | + | |
| 95 | +* Prevent an explicit private-status filter in the admin post list from exposing other authors' private posts, including custom private statuses, to users without `read_private_posts`. Props [@Zyy0530](https://github.com/Zyy0530), [@lzhou1110](https://github.com/lzhou1110), [@Str1ckl4nd](https://github.com/Str1ckl4nd), [@mauriceng98](https://github.com/mauriceng98), [@7thParkk](https://github.com/7thParkk), [@felipeelia](https://github.com/felipeelia), and [@jeffpaul](https://github.com/jeffpaul). | |
| 96 | +* Prevent the Comments REST search from disclosing approved comments on password-protected posts to unauthenticated visitors. Props [@mrglwglwgl](https://github.com/mrglwglwgl) and [@felipeelia](https://github.com/felipeelia). | |
| 97 | +* Bumped `postcss-selector-parser` from 7.1.0 to 7.1.5. Props [@dependabot](https://github.com/dependabot). | |
| 98 | +* Bumped `fast-uri` from 3.1.5 to 3.1.7. Props [@dependabot](https://github.com/dependabot). | |
| 99 | + | |
| 100 | +__Developer:__ | |
| 101 | + | |
| 102 | +* Update `@wordpress/env` from 11.13.0 to 11.15.0. Props [@felipeelia](https://github.com/felipeelia). | |
| 81 | 103 | |
| 82 | 104 | = 5.3.4 - 2026-08-27 = |
| 83 | 105 | |
| 84 | 106 | __Added:__ |
