### 2.6.9
* Removed five development dotfiles from the distributed package -- .jscsrc, .jshintrc, .jshintignore, .standard.json and .travis.yml. WordPress.org rejects an upload containing files its automated review cannot read. They stay in the repository, where they belong; grunt's own copy task never shipped them, and they are now export-ignored so GitHub's "Download ZIP" does not either.

### 2.6.8
* Corrected the capitalisation of "WordPress" in 5 obsolete translation strings. WordPress.org's automated theme scan reports any spelling of WordPress other than that exact form as a required fix, and it reads .po files.

### 2.6.7
* Fixed the Font Awesome webfonts returning 404. The stylesheets reference url(../webfonts/...), which resolves next to the stylesheet, and the fonts had been placed a directory too high -- so no icon rendered at all.
* The bundled Font Awesome is now subsetted to the glyphs the theme renders, loaded by default, with the complete build still shipped for sites that need it: add_filter( 'sparkling_full_fontawesome', '__return_true' ). Measured on WordPress 7.1 and PHP 8.5, median of three Lighthouse runs: performance 86 to 93, First Contentful Paint 1.05s faster, font payload 210 KB to 97 KB.

### 2.6.6
* Replaced the bundled Font Awesome 5.0.11 -- not the 5.1.1 the enqueue declared -- with a self-hosted Font Awesome 7.3.1. Only woff2 is shipped: the eot, svg, ttf and woff copies could never be downloaded, because a browser takes the first format it supports from the @font-face src list. The svg copies alone were 1,056 KB. Bundled icon fonts drop from 1,828 KB to 332 KB.
* No v4 or v5 compatibility shim is loaded. Every icon class the templates render is a native Font Awesome 7 name, verified against the bundled name map. The stylesheets load split by style -- the core name map, solid and brands -- rather than all.min.css, which also carries v4 and v5 @font-face blocks the theme has no use for. The theme renders no outline icons, so the regular face is not bundled.
* The social menu sets codepoints directly and named the Font Awesome 5 families, which the 7 stylesheets do not declare, so every one of those icons would have vanished. All 23 brand rules and 3 solid rules now name the Font Awesome 7 families, with the brand rules stating weight 400 rather than inheriting it. Every codepoint was checked against the family its rule names.
* The search button used a Bootstrap glyphicon, which pulled Bootstrap's icon font on every page carrying a search form. It uses Font Awesome, which is already loaded.

### 2.6.5
Security release. Two bundled libraries were older than the versions the theme declared, and both of the missing releases were the ones that fixed a cross-site scripting defect.

* Bootstrap's JavaScript was 3.3.7, not the 3.4.1 the enqueue and this changelog both claimed. 2.5.0 replaced the stylesheet and left assets/js/vendor/bootstrap.min.js untouched, so the theme still carried CVE-2019-8331: tooltips and popovers rendered the data-template attribute without sanitising it. 3.4.1 is the release that added the element and attribute allow-list, and because the defect is in the JavaScript, upgrading the stylesheet alone never addressed it. Both the minified and unminified files are now stock 3.4.1 and contain the sanitiser.
* FlexSlider moves from 2.7.0 to 2.7.2. 2.7.0 assembled the thumbnail control-nav by concatenating data-thumb, data-thumb-alt and data-thumb-captions into an HTML string, so those attribute values were parsed as markup; data-thumb-alt is populated from the attachment's alt text, which is not under the theme's control. 2.7.2 builds the same nodes with jQuery attribute setters.
* Both replacements were checked against the upstream releases first and were stock, so no theme-specific changes were lost. The readme's third-party table now lists the versions actually bundled.

### 2.6.4
* Fixed the featured image failing with a 403 Forbidden on the post edit screen (issue #272). The Popular Posts widget enqueued its media picker on admin_init, which fires on every admin screen. wp_enqueue_media() only runs once per request -- core guards it with did_action() -- so that call won the race against the post editor's own wp_enqueue_media( array( 'post' => $post->ID ) ), leaving wp.media with no post context and therefore no update-post_{id} nonce. The enqueue now runs on admin_enqueue_scripts, scoped to the widgets screen and the Customizer, which are the only places this widget's form is rendered.

* Fixed the sidebar dropping below the content at exactly 992px, and the slider caption disappearing at exactly 768px (issue #267). Three media queries used Bootstrap 3's breakpoint values as max-width instead of one pixel below them, so at exactly 768px and 992px both the mobile rule and Bootstrap's grid rule applied. The theme's rule won on specificity and unfloated the content, dropping the sidebar. Boundaries are now 767/768 and 991/992 with no overlap and no gap, in both style.css and assets/css/flexslider.css.

### 2.6.3
* Welcome screen: fixed the Recommended Plugins tab, which 2.6.2 broke. Core styles .plugin-card for a plain .wrap page, but the tab rendered inside .about-wrap, and about.css restyles p, h3 and img for everything inside it and loads after list-tables.css. Core's flex layout for the card grid is also scoped to the .plugin-install-php body class, which only exists on plugin-install.php. Together those collapsed #the-list to zero height and inflated cards to ~1950px tall. The plugin tabs now close .about-wrap after the tab navigation and render in a plain .wrap, and the page borrows core's plugin-install-php body class, so the card grid, equal-height cards and responsive columns all come from core. Verified at 900-1920px: 2 columns up to 1440, 3 columns from 1680, no overlap, no ragged rows, card heights 294-387px. Still no theme CSS for this tab.

### 2.6.2
Welcome screen: rebuilt the Recommended Plugins tab on core's own markup.

* The plugin cards were hand-rolled with ~80 lines of custom CSS: a fixed 315px height, absolutely positioned bars, a padding-right hack to clear the button, and text-overflow:ellipsis. Plugin names were truncated, the dark "Active:" bar overflowed the card, and the action button sat on top of it.
* The tab now renders core's plugin-card markup -- the same structure wp-admin uses on Plugins > Add New -- so the grid, buttons, icon placement and responsive behaviour all come from core's plugin-install stylesheet. Active plugins use core's disabled "Active" button instead of a custom dark bar, and each card gains a description, author, "More Details" link and a version/status footer.
* Deleted the 80 lines of CSS this replaced (welcome.css: 206 -> 124 lines). The tab now ships no theme CSS at all.
* Core's plugin-install assets are enqueued on admin_enqueue_scripts instead of inside the section template, which ran after the head was printed and only landed via late styles.
* welcome.css was loading on every admin screen; it is now scoped to the welcome page.
* The tab no longer breaks when wordpress.org is unreachable: plugins_api() returning WP_Error was previously dereferenced directly.

### 2.6.1
Fixes found by testing against a real site (30 posts, 19 pages, Jetpack and five other plugins) on nginx + MySQL + PHP 8.5.3.

* Front page slider: fixed a regression introduced in 2.5.0. Swapping the slider's image size to the fixed 1140px 'sparkling-featured-fullwidth' made slides narrower than the viewport on wide screens, and flexslider.css renders slide images at their natural width, so they were centred with blank gaps either side. The slider now requests 'full' (which is what 2.4.11 effectively served) and style.css restores the width:100% fill that flexslider.css declares and then overrides with width:auto further down. Slides now fill the slider from 375px to 1920px, and srcset still serves an appropriately sized candidate.
* Front page slider: with the slider enabled but no post in the chosen category carrying a featured image, the theme printed an empty <div class="flexslider"><ul class="slides"></ul></div> that FlexSlider could not initialise. The markup is now only emitted when there is at least one slide.

### 2.6.0
Removes the bundled Epsilon framework in favour of WordPress-native Customizer APIs.

* Deleted inc/libraries/epsilon-framework (38 files, 436K). The theme used exactly one thing from it: a checkbox control, seven times. The "recommended actions" and "pro" sections it also loaded were registered but never instantiated.
* Its AJAX layer registered handlers with no nonce and no capability check, including a dispatcher that invoked static methods named in $_POST. Practical impact was limited (narrow class allowlist, return value discarded), but any logged-in user could reach it, and count() on a non-array $_POST value was a PHP 8 fatal. That surface is now gone entirely.
* Replaced Epsilon_Control_Toggle with Sparkling_Customize_Toggle_Control, a self-contained WP_Customize_Control. The control is presentation only -- values are stored and sanitised by the WP_Customize_Setting it attaches to -- so no saved setting changes. Verified: the Customizer renders pixel-identically, and toggling a setting round-trips to the same stored values as before (1 / '').
* Epsilon_Control_Toggle remains as a deprecated alias so child themes that registered their own controls with it keep working. Verified against a simulated child theme.
* Ported the on/off switch and tooltip styles into assets/css/customizer.css, loaded only on the Customizer controls screen, and added a visible keyboard focus state the original switch lacked.
* Fixed a latent fatal in sparkling_customize_register(): get_setting() returns null for an unregistered setting, and assigning ->transport on null is fatal on PHP 8. Each setting is now checked first.

### 2.5.0
Compatibility, security and maintenance release. Verified against WordPress 7.0.2 on PHP 8.5.

Security
* Fixed an unauthenticated site configuration change. sparkling_set_pages() was hooked to admin_init with no capability or nonce check. admin-ajax.php fires admin_init before its authentication branch, so any anonymous request to admin-ajax.php?action=sparkling_set_frontpage could switch show_on_front. It is now an authenticated wp_ajax_ handler requiring manage_options and a nonce.
* Removed sparkling_activate_plugin() and sparkling_deactivate_plugin(). Both acted on query parameters without verifying a nonce, making them CSRF-exploitable against an administrator. Nothing in the theme linked to them; the recommended-plugins tab uses core's own nonced URLs.
* Added nonce and capability checks to the welcome screen's AJAX dismiss handlers, which also echoed $_GET['id'] unescaped (reflected XSS).
* Added a nonce and capability check to the sparkling_get_attachment_media AJAX endpoint.
* sparkling_sanitize_hexcolor() returned its raw input when validation failed, so arbitrary text could be stored and printed into the theme's inline <style> block. Invalid values are now rejected, and every colour is re-validated at output time.
* Removed html_entity_decode() from the legacy custom CSS output, which could turn escaped markup back into a live </style><script> break-out.
* Escaped tag names, author display names, author bios and post titles in the single post and comment templates. These render user-supplied data, so a contributor could previously store markup that executed for every visitor.
* Escaped plugin API fields, action labels and admin URLs throughout the welcome screen; sanitized and whitelisted the welcome screen's tab parameter.
* The post layout metabox now validates the submitted layout against the theme's own list before saving, and guards its $_POST reads.
* Widgets now sanitize their settings on save via update() methods.

PHP 8.5
* Replaced four "case 'x';" statements, which PHP 8.5 deprecates in favour of "case 'x':".
* Replaced the deprecated get_page_by_title() with WP_Query and guarded the null dereferences that followed it.
* Fixed undefined array key reads on $_POST, $_GET and widget instances.
* Guarded wp_get_attachment_image_src() returning false before indexing it.
* Replaced wp_reset_query() with wp_reset_postdata() in the Popular Posts widget.
* PHPCompatibilityWP at testVersion 8.5 reports 0 errors and 0 warnings.

WordPress 7.0
* Fixed the "_load_textdomain_just_in_time was called incorrectly" notice that fired on every request. Translated globals are now populated on init instead of while functions.php is parsed.
* Removed a get_categories() call that ran at file-parse time, adding a term query to every request including REST, cron and AJAX. It now runs only in the admin and Customizer, where it is actually read.
* Added support for customize-selective-refresh-widgets, responsive-embeds, wp-block-styles, align-wide, and the html5 style, script and navigation-widgets features.
* Added an editor stylesheet so the block editor matches the front end.

Bootstrap
* The theme shipped Bootstrap 3.3.7 CSS alongside Bootstrap 4.0.0 JavaScript while every template emits Bootstrap 3 markup. Both are now stock Bootstrap 3.4.1. Bootstrap 4.0.0 was also affected by CVE-2019-8331 (XSS via tooltip and popover data-template), fixed in 3.4.1.
* The mobile menu previously opened only by coincidence: Bootstrap 4's JavaScript adds a .show class, and Bootstrap 3's unrelated .show utility (display:block !important) happened to reveal it, so the collapse animation never ran. It now uses the correct .collapse.in mechanism.

Fixes
* The front page slider printed a stray </a> for every slide when slide links were disabled, producing invalid markup.
* The slider requested the image size 'activello-slider', which belongs to a different theme and was never registered here, so it silently served full-size originals. It now uses sparkling-featured-fullwidth.
* Widget form fields printed no id attribute because the get_field_id() calls were missing echo, breaking every <label for> association.
* The Popular Posts widget overwrote its stored attachment ID with an attachment URL when rendering its form, so the saved fallback image stopped resolving after the first save.
* The welcome screen's changelog tab read a changelog.txt that was missing from the package and printed its contents unescaped.

Performance
* Bootstrap's JavaScript and the theme's own script moved to the footer; nothing theme-owned blocks rendering any more.
* assets/js/functions.js was rewritten without jQuery and no longer declares a jQuery dependency. Behaviour is unchanged, including the scroll-to-top easing, and it now honours prefers-reduced-motion.
* Every asset is versioned from the theme version. bootstrap.min.css and bootstrap.min.js previously had no version at all, so WordPress stamped its own version, leaking it and defeating cache busting; style.css was pinned to a stale hardcoded 2.4.2.
* Google Fonts now load over https with display=swap and preconnect hints.
* The slider and Popular Posts queries skip found-rows counting.

Housekeeping
* Removed Internet Explorer conditional comments and the X-UA-Compatible header.

### 2.4.11
* Tested up to WordPress 6.8.

### 3.0 (never released)
These notes were labelled 3.0 in readme.md but no 3.0 was ever published;
WordPress.org went 2.4.9 -> 2.4.10 -> 2.4.11. Preserved verbatim.

- Added PHP 8 support
- Merge WpChill fork
- Fixed some bugs

### 2.4.8

- Compatibility with jQuery 3.0

### 2.4.6

- Improved accesibility with keyboard navigation

### 2.4.5

- Added 2 more recommended plugins

### 2.4.4

- Removed subject tags, can't keep more than 3 as per w.org rules

### 2.4.3

- Fixed a few more bugs with FA5 & missing icons

### 2.4.1

- Fixed a bug with FontAwesome 5 & RSS feed icon

### 2.4.0

- Added Colorlib Login Customizer as recommended plugin
- Updated FontAwesome to v5.1.1
- Updated FlexSlider to 2.7.0
- Added Academicons ( https://jpswalsh.github.io/academicons/ )
- Removed Modernizr.js from distribution
- Full changelog can be seen here: https://github.com/puikinsh/Sparkling/milestone/1?closed=1

### 2.3.4

- Updated font awesome
- Fixed custom menu styling in the footer
- Improved widgets' styling
- Fixed Sparkling popular posts widget clear bug
- Fixed custom color for the footer text
- Added defaults for color controls in Customizer
- Fixed custom typography bug
- Improved custom colors
- Fixed the menu on mobile devices
- Added a 'read more' button when the read more tag is used
- Added Epsilon Framework
- Added Welcome Screen

### 2.3.3 - 09.06.2017

- Improved Dutch translation by Thom de Jonge

### 2.3.2 - 11.10.2016

- Removed redundant functions and replaced with ones from WP core.

### 2.3.1 - 08.07.2016

- Hungarian translation thanks to Varga Szabolcs

### 2.3.0 - 30.06.2016

- Added TGMPA & Kiwi Social Share Plugin
- Updated theme tags
- Fixed deprecated constructor notice for widgets
- Updated language files thanks to Vaidas Elksnys
- Other fixes and improvements.

### 2.2.3 - 18.03.2016

- Fixed problem when top menu items set to open on new tab.
- Fixed problems with font reset
- Fixed problem with one extra post for recent post widget
- Added missing border for posts when no featured image is used.
- Added new social media icons.

### 2.2.2 - 18.01.2016

- Updated Spanish translation
- Fixed problems with excerpts
- Fixed dribbble icon
- Updated FontAwesome icons

### 2.2.1 - 11.12.2015

- Fixed error with WooCommerce

### 2.2.0 - 09.12.2015

- Added WooCommerce support
- Removed legacy code
- Improved layout manager
- Added options for sticky/fixed navigation.

### 2.1.1 - 17.11.2015

- Removed redundant function

### 2.1.0 - 27.10.2015

- Added WP-PageNavi support
- Fixed option for comment section on static pages
- Fixed problem with French translation

### 2.0.1 - 27.10.2015

- Added callback function for old Social Icons.
- Removed wp_title callback
- Updated Font Awesome icon library
- Simplified social icons
- Added support for "mailto". Email icon.

### 2.0 - 16.10.2015

- Removed Options Frameowrk in favor to WordPress Theme Customizer. Be careful with this update as it might break things.
- Added layout selecotr for individual posts/pages.
- Other code cleanups and improvements.

### 1.9.4 - 29.07.2015

- Added Estonian translation thanks to Kristjan Variksoo

### 1.9.3 - 14.07.2015

- Improved menu color customization options
- Prepared theme for WordPress 4.3 update.

### 1.9.2 - 15.06.2015

- Fixed minor bug with attachment pages.
- Fixed minor bug with navigation submenu color on mobile devices.
- Other menu styling improvements
- Added Simplified Chinese thanks to KagurazakaKotori

### 1.9.1 - 05.06.2015

- Fixed two minor bugs in custom theme widgets

### 1.9.0 - 21.05.2015

- Introduced option to change full content vs excerpt for blog page.
- New option to disable comments on static pages via Customizer
- Removed redundant search form override
- Added Spotify icon
- Updated FontAwesome library to 4.3
- Added Indonesian translation

### 1.8.5 - 21.05.2015

- Properly escaped all translation strings
- Updated translation files

### 1.8.3 - 04.05.2015

- Added Czech translation
- Added Ukrainian translation thanks to Vladyslav
- Added Traditional Chinese thanks to ShuChun

### 1.8.2 - 23.04.2015

- Fixed overlapping CSS selectors when using tag called "navigation".
- Improved coding for author box below post content
- Author box is now visible only if there is a author bio/description to show.

### 1.8.1 - 16.04.2015

- Removed accidentally added string from header.php

### 1.8.0 - 04.04.2015

- Updated Options Framework
- Improved theme translation support
- Added support for WPML multilingual plugin
- Other code tweaks and cleanups
- Added Lithuanian translation

### 1.7.12 - 23.03.2015

- Updated Bootstrap framework to 3.3.4
- Fixed comment layout on mobile when multiple levels of comments are present

### 1.7.11 - 20.03.2015

- Added Japanese translation

### 1.7.10 - 16.03.2015

- Added Bulgarian translation thanks to @pbosakov

### 1.7.9 - 02.03.2015

- Added Turkish translation thanks to Ender İskender

### 1.7.8 - 11.02.2015

- Improved favicon functionality. Now loaded in WordPress dashboard and frontend.

### 1.7.7 - 23.01.2015

- Fixed minor problems with newly introduced title-tag

### 1.7.6 - 23.01.2015

- Theme now uses "title-tag" that was introduced with WordPress 4.1
- Updated Bootstrap to 3.3.2

### 1.7.5 - 14.01.2015

- Removed front-page.php template. Instead you can use full-width or regular page template on frontpage
- Small code cleanup
- Updated Bootstrap classes for full-width template
- Updated Russian translation

### 1.7.1 - 15.11.2014

- Updated Bootstrap to v3.3.1

### 1.7.0 - 30.10.2014

- Updated Bootstrap to 3.3.0
- Updated Font Awesome icons to 4.2.0

### 1.6.3 - 29.10.2014

- Improved Child Theme support
- Addded GitHub Icon

### 1.6.2 - 23.08.2014

- Added Romanian translation thanks to Bogdan Patru

### 1.6.1 - 31.07.2014

- Added Skype URI support for icons
- Added Persian language thanks to Robert Nicjoo
- Added Portuguese (Portugal) translation thanks to Vasco Cruz

### 1.6.0 - 16.07.2014

- Added Portuguese translation thanks to Lucas Mandelli
- Updated Bootstrap to 3.2
- Added more flexibility to slider functions via functions.min.js file.
- Fixed problems with IE 10 & 11
- Updated modernizer
- Added bbPress support
- Improved theme responsiveness

### 1.5.1 - 26.06.2014

- Updated German translations
- Added another German translation with more polite form thanks to Steffen Lober

### 1.5.0 - 26.05.2014

- Improved Child Theme support
- Recreated Social Icons
- Added SoundCloud and Vimeo icons
- Recreated default WordPress gallery support
- Improved code consistency in extra.php file
- Several other code improvement for main theme functions
- Recreated logic behind color in Theme Options. Now these settings provides with more flexibility.
- Added German translations thanks to Bernd Schray

### 1.4.2 - 24.05.2014

- Fixed problem with mobile navigation
- Improved customization options for Navigation bar
- Defined default social icon color.

### 1.4.1 - 19.05.2014

- Added Russian translation thanks to Evgeny Able
- Improved Child Theme support
- Updated Dutch translation

### 1.4.0 - 18.05.2014

- Fixed next/previos button placement on mobile devices.
- Improved full-width page layout.
- Added Polish translation thanks to jerry1333 (http://www.jerry1333.net/)
- Added Dutch translation thanks to Niels Hoogenhout (http://nielshoogenhout.nl/)
- Updated Options Framework to 1.8.0
- Updated FontAwesome to 4.1

### 1.3.0 - 12.05.2014

- Added foursquare icon in Sparkling social widget and footer.
- Added Italian translation thanks to Achille D'Aniello
- Added French translation thanks to Antoine Lorence
- Updated translations files
- Updated 404 error page (404.php)
- Improved WordPress default galleries
- Added different content width for full-width pages.

### 1.2.1 - 06.05.2014

- Fixed a tiny bug when comments are closed for single posts.

### 1.2.0 - 29.04.2014

- Added Spanish translation thanks to Hugo (http://hartodebuscar.blogspot.com/)
- Moved some functions from jQuery to PHP to avoid conflicts with plugins and other JavaScript based scripts.
- Improved main theme JavaScript compatibility with other plugins and scripts.
- Added Modernizr for better HTML5 and CSS3 support

### 1.1 - 25.04.2014

- Removed all traces from Underscore template that weren't replaced already. Theme is still based on Underscore but removed some strings to avoid confusion.

### 1.0.4 - 17.04.2014

- Changed Author URI.
- Added right heading tag for default widgets

### 1.0.1 - 02.04.2014

- Social network urls are now properly escaped using "esc_url"
- Added licensing information for images in theme screenshot
- Updated screenshot
- Improved wp_register_style for Google fonts to be compatible with SSL
- Removed do_shortcodes from extras.php which falls under plugin territory
- Fixed missing .js error.

### 1.0 - 01.04.2014

Initial release