Olympus - Social Networking WordPress Theme

Changelog

 > Scope: this covers the Olympus theme **and** the bundled Crumina/Unyson framework > extensions that ship with it (sign-form, post-reaction, ajax-blog, extended-search, > post-share, stunning-header, contact-form). Items marked _(framework)_ live in the > bundled Unyson extensions.  ## [4.8.0] — 2026-06-03  A large security, performance, and modernization release. The theme now targets modern PHP/WordPress, moves its AJAX surface to a namespaced REST API, migrates key UI to the WordPress Interactivity API, and trims hundreds of KB of JavaScript from every page.  ### ⚠️ Requirements / breaking changes - **Minimum platform raised to PHP 8.1+ and WordPress 6.9+** (previously PHP 5.6 / WP 5.7).   Verified compatible across PHP 8.1–8.4. Sites on older PHP/WordPress must update first. - Legacy IE11 polyfills and other dead browser shims have been removed.  ###  Security - **Notifications — fixed an IDOR/CSRF.** Notification actions (mark read/unread/delete,   mark-all) are now served by an authenticated REST endpoint with per-user ownership checks,   so one user can no longer act on another user's notifications. - **Sign-in / Registration _(framework)_ — multiple fixes:**   - Restored CSRF protection in a **cache-safe** way: forms carry no stale nonce; a fresh     nonce is fetched from an uncached REST endpoint at submit time and enforced server-side     (fails closed with a friendly "session expired" message). Works behind full-page caches.   - Fixed a **reflected XSS** in the Youzer registration prefill (`$_GET` values were echoed     into an inline script) — now `esc_js()`-escaped.   - Fixed an **SQL injection** in the activation lookup (prepared statement).   - reCAPTCHA verification now uses the WordPress HTTP API (`wp_remote_post`) with timeouts     and error handling instead of `file_get_contents()` — no `allow_url_fopen` dependency,     fails closed.   - Sanitized all login/registration inputs; added a **same-origin guard**, **per-IP rate     limiting**, an **open-redirect fix** (redirect targets validated against the site host),     and a **URL-parameter-injection fix** in the registration prefill. - **Post reactions _(framework)_ — fixed an SQL injection.** The guest identity was taken   from a spoofable `X-Forwarded-For`/`Client-IP` header and reached SQL unescaped. IPs are   now validated and all reaction queries use prepared statements. Reaction `type` is   whitelisted, preventing writes to arbitrary post-meta keys. The action nonce is now   cache-safe. - **AJAX blog _(framework)_ — fixed a path traversal / local file inclusion.** The pagination   view name came from the request and was concatenated into an include path; it is now   whitelisted, and the template slug is sanitized against traversal. - **Extended search _(framework)_ — fixed a regex injection / ReDoS.** The raw search query   was used as a regular expression; replaced with safe case-insensitive substring matching. - **SVG uploads — hardened against XXE/SSRF** in metadata parsing (network access disabled,   DOCTYPE rejected). - **General hardening:** prepared statements for custom SQL, escaped output, HTTPS for remote   downloads, and demo-import URL hardening.  ### ⚡ Performance - **~385 KB of JavaScript removed from typical page loads:**   - **sweetalert2 (105 KB)** is no longer enqueued globally — it lazy-loads only when an error     notice actually needs to be shown.   - **Lottie player** swapped for a lighter build (**280 KB → 168 KB**) and **deferred** — it     now loads only when a visitor starts filling the registration form, instead of on every page. - **Replaced the SmoothScroll JS library with native CSS** smooth scrolling, with full   `prefers-reduced-motion` support (no animation for users who request reduced motion). - Deferred non-critical JavaScript; removed dead IE11 and unused Font Awesome assets.  ### ✨ Modernization - **REST API (`olympus/v1`).** AJAX handlers moved to a namespaced REST API with proper   permission callbacks and schemas: instant search, notifications, friend requests (via   BuddyPress core REST), demo tools, admin notices, sign-form nonce, **post-reaction toggle**,   and the **AJAX blog listing**. Frontends prefer REST and fall back to admin-ajax, so there is   no hard cutover. - **Interactivity API.** Migrated from jQuery to the WordPress Interactivity API: sidebar   toggle, header instant search, friend-request accept/reject, and the notifications dropdown. - **Blocks & `theme.json`.** Added a settings-only `theme.json` (brand color palette,   typography, layout) and replaced the deprecated `block_categories` filter with   `block_categories_all`. Added a `@wordpress/scripts` build pipeline for blocks.  ###  Styling - Body/canvas and unread-notification backgrounds now use the `--ol-main-bg-color` token   (correct light/dark theming); dropdown triangle colors aligned to the same token.  ###  Developer / tooling - Added quality gates: **PHPCS (WordPress Coding Standards)**, **PHPCompatibilityWP** (8.1+),   and **PHPStan**. New `composer compat:ext` script runs the PHP 8.1 compatibility check across   the bundled Crumina extensions (currently clean). - Added a runtime verification checklist (`docs/verification-checklist.md`) and an ADR recording   the PHP 8.1+ / WP 6.9+ support matrix.  ###  Maintenance - **WooCommerce:** replaced template-file overrides with hooks/CSS, reducing the number of   override files that must be kept in sync across WooCommerce updates. - Removed a duplicated `stunning-header` directory _(framework)_ that previously required   patching the same file twice. - Fixed deprecated `FILTER_SANITIZE_STRING` usage and other PHP 8.1 runtime-deprecation   hotspots across the bundled extensions.