Release 1.2.1 (back to develop)

.plugin-data

@@ -1,4 +1,4 @@
 {
-	"version": "1.2.0",
+	"version": "1.2.1",
 	"slug": "blockparty-iframe"
 }

.wordpress-org/blueprints/blueprint.json

@@ -11,7 +11,7 @@
 			"pluginData": {
 				"resource": "git:directory",
 				"url": "https://github.com/BeAPI/blockparty-iframe",
-				"ref": "1.2.0",
+				"ref": "1.2.1",
 				"refType": "tag"
 			},
 			"options": {

CHANGELOG.md

@@ -7,13 +7,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [Unreleased]
+## [1.2.1] - 2026-11-05
 
 ### Security
 
 - **Iframe attributes allowlist**: Only `allow`, `allowfullscreen`, `allowpaymentrequest`, `id`, `referrerpolicy`, `sandbox`, `aria-*` and `data-*` attributes are rendered, in the editor and on the front end. Event handlers (`onload`…), `srcdoc` and malformed attribute names are dropped, closing a stored XSS reachable by contributors.
 - **Iframe source protocols**: The iframe source must be an `http` or `https` URL, in the editor and on the front end (blocks `javascript:` URLs in the editor).
 
+### Fixed
+
+- **Translations**: Add missing French translations.
+- **Developer dependencies**: Bump `wp-coding-standards/wpcs` to 3.4.1 (security advisory on earlier versions) and `config.platform.php` to 8.3.36 so Composer can resolve dev dependencies in CI.
+
 ## [1.2.0] - 2026-04-22
 
 ### Changed

blockparty-iframe.php

@@ -2,7 +2,7 @@
 /**
  * Plugin Name:       Blockparty Iframe
  * Description:       Add a block to display an embedded frame in the WordPress editor.
- * Version:           1.2.0
+ * Version:           1.2.1
  * Requires at least: 6.7
  * Requires PHP:      8.1
  * Author:            Be API Technical team
@@ -23,7 +23,7 @@
 	include_once __DIR__ . '/vendor/autoload.php';
 }
 
-define( 'BLOCKPARTY_IFRAME_VERSION', '1.2.0' );
+define( 'BLOCKPARTY_IFRAME_VERSION', '1.2.1' );
 define( 'BLOCKPARTY_IFRAME_URL', plugin_dir_url( __FILE__ ) );
 define( 'BLOCKPARTY_IFRAME_DIR', plugin_dir_path( __FILE__ ) );
 define( 'BLOCKPARTY_IFRAME_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );

languages/blockparty-iframe.pot

@@ -2,7 +2,7 @@
 # This file is distributed under the GPL-2.0-or-later.
 msgid ""
 msgstr ""
-"Project-Id-Version: Blockparty Iframe 1.2.0\n"
+"Project-Id-Version: Blockparty Iframe 1.2.1\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/blockparty-iframe\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "blockparty-iframe",
-	"version": "1.2.0",
+	"version": "1.2.1",
 	"description": "Add a block to display an embedded frame in the WordPress editor.",
 	"author": "Be API Technical team",
 	"license": "GPL-2.0-or-later",

readme.txt

@@ -2,7 +2,7 @@
 Contributors:      Be API Technical team
 Tags:              block, iframe, editor
 Tested up to:      6.7
-Stable tag:        1.2.0
+Stable tag:        1.2.1
 License:           GPL-2.0-or-later
 License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -45,6 +45,11 @@ directory take precedence. For example, `/assets/screenshot-1.png` would win ove
 
 == Changelog ==
 
+= 1.2.1 =
+* Security: only allowlisted iframe attributes are rendered (allow, allowfullscreen, allowpaymentrequest, id, referrerpolicy, sandbox, aria-*, data-*). Event handlers, srcdoc and malformed attribute names are dropped, fixing a stored XSS reachable by contributors.
+* Security: the iframe source must be an http or https URL, in the editor and on the front end.
+* Translations: add missing French translations.
+
 = 1.2.0 =
 * Dynamic block: iframe markup is rendered in PHP on the front end (block attributes are stored in post content). Existing posts with the previous static HTML remain supported in the editor.
 

src/blockparty-iframe/block.json

@@ -2,7 +2,7 @@
 	"$schema": "https://schemas.wp.org/trunk/block.json",
 	"apiVersion": 3,
 	"name": "blockparty/iframe",
-	"version": "1.2.0",
+	"version": "1.2.1",
 	"title": "Iframe",
 	"category": "widgets",
 	"description": "Display an embedded frame.",