Changelog

They're offered when you create a new page. Your site's header and footer wrap them, the post lists pull in your own posts, and every word is translatable.

Covers that ship with the theme. Ten book covers, three magazine covers, and two bookshop shelf images, 210 KB in all as WebP. The books, people, and publishers on them are made up, ready for you to swap in your own.

The Theme URI points to the theme's page. It now goes to https://gauravtiwari.org/product/osmium/ instead of the GitHub repository.

• Install: Download osmium-0.4.0.zip below, then go to Appearance → Themes → Add New → Upload Theme. Upgrading from 0.3.x is a straight replace: upload the zip and confirm the replace when WordPress asks.
• New in this release: Full Pages, a new pattern group. It has six complete pages, the same ones that run the sample sites on the demo:
• Author site: home. The new book, praise, the backlist, an about section, events, and a newsletter signup.
• Author site: book page. The details in a table, the opening page, praise, and notes for reading groups.
• Book review blog: home. Your latest reviews, a best-of list, genres to browse, and how the ratings work.
• Bookshop: home. Staff picks, a book club on three plans, events, and opening hours.
• Bookshop: staff picks. Recommendations grouped by bookseller.
• Literary magazine: home. The current issue, past issues, a submissions call, the masthead, and subscriptions.
• The theme now ships: | | | |---|---| | Templates | 22 | | Template parts | 11 | | Patterns | 128, in eleven groups | | Designs | 6, plus 5 palettes and 4 type presets | | Pattern images | 27, all generated for Osmium | | Theme JavaScript | none |
• Checked, not assumed: All 637 blocks in the new patterns validate in the WordPress 7.1 block editor, and PHPCS is clean. axe-core reports zero WCAG 2.2 AA violations on each new pattern at desktop and mobile, and every image loads. The zip was installed over 0.3.0 on a clean site, and every pattern registered.
• Known limits
• The post lists on the review blog and magazine pages show your latest posts from every category. To narrow one, set a category in its Query Loop settings.
• Links in the new pages point to #, and the email links use made-up .example addresses. Change both after you insert a page.
• Each full page opens with its own main heading. Use the "Page, no title" template for these pages, so the page title isn't printed twice.

In 0.3.0 their rows sat at the reading width, 42rem, while wide sections, featured images, and the front page ran at 72rem. On a large screen the logo and menu sat well inside the edges of everything below them. Now they span the wide width too.

• Install: Download osmium-0.3.1.zip below, then Appearance → Themes → Add New → Upload Theme. Upgrading from 0.3.0 is a straight replace: upload the zip and confirm the replace when WordPress asks.
• Changed
• All nine headers and all nine footers span the wide width, so logos, menus, and footer columns line up with the edges of wide content.
• Footer text keeps its readable line length. A heading, a short paragraph, and buttons in a footer band start at the wide edge but don't stretch across it.
• Breadcrumbs at the foot of posts, pages, and archives span the wide width, so they line up with the footer beneath them.
• Checked: Every changed pattern and template validates in the WordPress 7.1 block editor, and PHPCS is clean. axe-core reports zero WCAG 2.2 AA violations on the front page, the four post templates, a page, a category archive, and search results, at desktop and mobile. At a 1280px window, the header, footer, and breadcrumbs now run from 64px to 1216px, the same edges as wide content.
• Known limits
• If you edited your header or footer in the Site Editor, your saved copy wins and keeps the old width. Reset the template part to get the new one, or set its rows to wide width yourself.
• A header or footer pattern you inserted by hand keeps the width it had when you inserted it.

Validated with 385 PHP tests, 14 JavaScript regression tests, static analysis, and live audit forms on gauravtiwari.org.

• Code and Visual mode preserve radio and checkbox groups, selected values, empty placeholders, option groups, nested layouts, helper HTML, descriptions, and custom attributes through repeated edits and saves.
• Saving immediately after editing HTML keeps the latest fields. Duplicating or renaming nested fields updates their internal references and avoids duplicate choice values.
• Name, Address, Rating, submit, and reset fields render usable controls. Named submit buttons retain their values in AJAX submissions.
• Conditional fields support both colon and equals rules, checkbox dependencies, multiple conditions, and hidden required controls.
• Required checkbox groups validate correctly when advancing multi-step forms. Inline validation preserves help text and recognizes selected radio groups.
• Server validation checks field types, allowed choices, numeric and date limits, step values, and multiple email addresses while accepting zero as a valid value.
• Calculated fields recognize both supported calculation attributes, and character counters load when their attribute is present.
• Field and option settings have associated labels and retain explicit checked and selected defaults.

The stray settings badge has been removed from License & Updates.

Quoted attribute values are escaped correctly in generated markup.

Requires WordPress 6.4 or later and PHP 8.1 or later.

• The p/div/span wrapper setting now applies to schema-backed forms and generated HTML.
• Consent fields render as working checkboxes and keep their type when switching editor modes.
• HTML imports retain autocomplete, inputmode, ARIA, data attributes, and other supported control attributes through saving and rendering.

• Changed generated CSS and frontend loaders to use WordPress asset registration, enqueue, and printing functions.
• Bundled the interaction-delay and YouTube loaders as static plugin assets.
• Fixed nested output-buffer handling so WordPress asset printers can run during final HTML optimization.
• Restricted early cache reads to validated local files and rejected paths outside the page-cache directory.
• Kept opt-in JavaScript minification using in-memory processing, WordPress transient storage, and signed external delivery instead of generated JavaScript files. Defer, delay, saved settings, and exclusions remain supported.
• Added safe original-script fallback when cached minified results expire, versioned URLs for source changes, browser caching, and ETag revalidation.
• Audited similar patterns across the plugin: hardened both early drop-in configuration readers and restricted downloaded font output to recognized binary font types with atomic publication.

Posts end properly. An author box and related posts sit under every article. Breadcrumbs sit at the foot of posts, pages, and archives rather than above the title.

Four new pattern groups. Post lists: grids, lists, a magazine front, cover cards, and a timeline. An Article kit: key takeaways, contents, notes, warnings, numbered steps, definitions, code samples, and before-and-after images. Sidebar blocks. And Post layouts, which give a new post a starting structure for a review, a roundup, a how-to guide, a comparison, an interview, a news post, or an essay.

A bigger review kit. Eighteen patterns: scores, an at-a-glance box, roundup picks, top picks, alternatives, plan comparisons, a buyer's checklist, a disclosure note, a final verdict band, and tabbed details on the core Tabs block.

More openers, sections, and pages. Thirteen openers, twenty-eight sections including pricing, services, team, timeline, gallery, and events, and twelve full pages including contact, work with me, portfolio, advertise, link in bio, coming soon, and an affiliate disclosure. Every pattern image ships with the theme.

Designs. Graphite and Espresso join Midnight as dark designs that keep dark sections dark. Five palettes (Ink, Moss, Plum, Harbor, Rose) and four type presets use the same two fonts and the same spacing, so switching never breaks a layout.

Headings open every section. Small labels above headings are gone throughout, and a post's category now sits in the meta line under its title.

• Install: Download osmium-0.3.0.zip below, then Appearance → Themes → Add New → Upload Theme. Requires WordPress 7.0 and PHP 7.4. Upgrading from 0.2.0 is a straight replace. Templates you customised in the Site Editor keep your version.
• New in this release: Templates, now 22. Category, tag, date, privacy policy, and attachment templates join the hierarchy. Six more can be picked per post or page: a cover header, a split header, a sidebar, a wide page, a landing page with a minimal header and footer, and a blank canvas.
• Fixed
• Category lists built on the Terms Query block pass their settings the way WordPress 7.1 reads them.
• The feed link follows the site address, so it works on a subdirectory install.
• Striped tables follow the palette instead of a fixed light grey, so they stay readable in the dark designs.
• Header, footer, and sidebar text is translatable.
• The theme now ships: | | | |---|---| | Templates | 22 | | Template parts | 11 | | Patterns | 122, in ten groups | | Designs | 6, plus 5 palettes and 4 type presets | | Section and block styles | 6 of each | | Theme CSS | 8.2 KB | | Theme JavaScript | none |
• Checked, not assumed: Every pattern, template, and part validates in the WordPress 7.1 block editor. PHPCS is clean, and Theme Check raises nothing beyond an informational note. Color contrast passes in all eleven palettes, measured by script. axe-core reports zero WCAG 2.2 AA violations on every template, at desktop and mobile, in the default design and in Graphite.
• Known limits
• Patterns are copied into a post when you insert them, so anything you built from 0.2.0 patterns keeps its old layout until you insert the pattern again.
• First-paint CSS on a post is about 84 KB, most of it core's Navigation block and global styles. It gets a closer look before 1.0.
• Built and tested on WordPress 7.1. The 7.2 beta opens on 20 October and this will be retested then.
• The Front Page template takes precedence over a static front page you set yourself. To use your own page, edit or delete that template in Appearance → Editor → Templates.
• Not submitted to the WordPress.org theme directory yet.

Footers, now five. A signup band, a centered stack for a personal site, and a dark closing band that follows whichever palette is active rather than turning white.

Openers, a new group of five. The newsletter band moves here, joined by a text and image split, a centered statement with one clear next step, a single sentence for an essayist, and one that leads with whatever you published last so the top of the page changes on its own.

Five more sections. A numbers row, a three-step explainer, a section with the heading beside the text so a long passage keeps its measure, a callout note for inside an article, and a keep-reading block for the end of one.

Every pattern that pulls posts carries an empty state, so a new site never renders a heading with nothing under it.

• Install: Download osmium-0.2.0.zip below, then Appearance → Themes → Add New → Upload Theme. Requires WordPress 7.0 and PHP 7.4. Upgrading from 0.1.0 is a straight replace; nothing you have built changes.
• New in this release: Headers, now five. Alongside centered and minimal: one with a call to action for a site that sells, one with a notice strip for an announcement, and one with search in the open for a site with a deep archive.
• The theme now ships: | | | |---|---| | Templates | 11 | | Patterns | 42, in six groups | | Style variations | 4, plus 3 section styles | | Theme CSS | 8.0 KB | | Theme JavaScript | none |
• Checked, not assumed: Every pattern and template validates in the block editor. PHPCS is clean. Colour contrast passes in all four palettes, measured by script. axe-core reports zero WCAG 2.2 AA violations across every template and every new pattern, at desktop and mobile, on a fresh install and a populated one.
• Known limits
• Tested on WordPress 7.0 and 7.1. The 7.2 beta opens on 20 October and this will be retested then.
• The Front Page template takes precedence over a static front page you set yourself. To use your own page, edit or delete that template in Appearance → Editor → Templates.
• Not submitted to the WordPress.org theme directory yet.

On activation you get a designed front page straight away, filled with your own posts. Nothing is created in your database and no settings are changed.

No JavaScript ships with the theme. No post types, no blocks, no shortcodes, no settings page. Everything you build keeps working if you switch themes.

Feedback and bug reports are welcome in the issues.

• Install: Download osmium-0.1.0.zip below, then in your WordPress admin go to Appearance → Themes → Add New → Upload Theme. Requires WordPress 7.0 and PHP 7.4.
• What is in it
• 11 templates: front page, blog home, index, single, single with sidebar, page, page without a title, archive, author, search, and 404
• 27 patterns, including a review kit of seven: verdict, pros and cons, spec table, comparison table, best-for cards, product call to action, and a deal strip
• Four page-creation patterns: homepage, about, newsletter landing, and tools
• Four style variations: Editorial by default, plus Paper, Signal, and Midnight for dark
• Three section styles for tinted, dark, and card sections, so patterns stay core blocks
• Two bundled fonts, Valley Sans and Hedvig Letters Serif, self-hosted and served from your own domain under the SIL Open Font License
• Checked, not assumed: | | | |---|---| | Theme Check | 0 required, warning, or recommended issues | | PHPCS, WordPress standards | clean across 27 files | | axe-core, WCAG 2.2 AA | 0 violations on every template, desktop and mobile, on a fresh install and a populated one | | Colour contrast | every pair in all four palettes measured by script | | Theme CSS | 8.0 KB |
• Known limits
• Tested on WordPress 7.0 and 7.1. WordPress 7.2 beta opens on 20 October and this will be retested then.
• The Front Page template takes precedence over a static front page you set yourself. To use your own page, edit or delete that template in Appearance → Editor → Templates.
• Not submitted to the WordPress.org theme directory yet.

• Added
• Unused CSS status on the Optimization tab: queued, processing, ready, stale, failed, and skipped results; original and generated sizes; reduction percentage; build duration; and failure details.
• Manual status refresh, per-URL and per-result force regeneration, and full regeneration in bounded background batches. Known eligible URLs and the homepage are queued; other pages rebuild when visited.
• Counts across all stored reports, with the latest 50 results shown in the table. Current savings exclude stale results and missing generated files.
• Fixed
• Signed CSS generator requests were blocked by page-cache and commerce query rules. The authenticated build parameter is now excluded from the policy context while other request protections remain intact. Build responses remain private and are never cached.
• Generator tokens no longer become part of report URLs or CSS reuse keys.
• HTTP errors and responses without completed CSS reports now fail the background job so its retry policy applies. Successful generation purges the public page cache so visitors receive the new CSS.
• CSS reuse now accounts for the URL, full markup, and CSS revisions, preventing mismatches involving IDs, attribute values, and DOM relationships. Forced builds bypass existing results.
• Regeneration controls check saved rollout, exclusions, safe mode, and optimization ownership, and avoid duplicating active jobs. Disabled or newly excluded jobs record a skipped result.
• Consistent padding and spacing across status cards, statistics, reports, and regeneration controls.
• Clearer help text across optimization and cache settings.
• WordPress.org builds omit the self-hosted Update URI header. FluentCart URL handling uses WordPress parsing helpers, and the early Redis drop-in documents its filesystem fallback.

A block_type_metadata filter now sets version to ACF_BLOCKS_VERSION for blocks whose block.json lives inside this plugin, matching what the plugin's direct wp_enqueue_style() calls have always passed. Blocks that other plugins register under the acf/ namespace are left alone. Asset URLs now carry the plugin version and change with every release.

Sites running GT Performance saw this compounded: its assetVersion filter rewrites ver when it equals the core version, turning ?ver=7.1 into a stable hash. It was doing its job — hiding the core version — but the versioning underneath was already wrong, and the hash made the staleness harder to spot.

• What's Changed
• Fixed
• Block stylesheets were never cache-busted by a plugin release. Core's register_block_style_handle() reads $metadata['version'] from block.json and falls back to false, which makes wp_register_style() stamp the WordPress version onto the URL. Every one of this plugin's block.json-registered handles was therefore versioned by core, not by the plugin: on this site url-preview.min.css shipped as ?ver=7.1 for WordPress 7.1, and the files are served public, max-age=31536000. The query string is the only thing that can retire a year-long cached copy, so a CSS fix in a plugin release stayed invisible to every reader who had already loaded the page until WordPress itself updated. The 2.11.2 contrast fix was landing this way — correct on disk and at the CDN, still broken in the browser of anyone who had visited before.
• Commits
• 2.11.3: version block.json assets with the plugin, not with WP core (a91797b)
• 2.11.2: fix white-on-white URL Preview button in dark mode (e40be8e)
• Stats
• Commits: 2
• Changes 11 files changed, 82 insertions(+), 10 deletions(-)
• Plugin Info
• Blocks included: 29
• Requires WordPress: 6.0+
• Requires PHP: 7.4+
• Requires: ACF Pro 6.0+ or Secure Custom Fields
• Installation
• Download acf-blocks-plugin-*.zip from the assets below
• Go to Plugins → Add New → Upload Plugin in WordPress admin
• Upload the zip file and activate

= 1.6.0 = = 1.6.1 = Interface fixes. The WordPress 7 data panel no longer appears for modules you have switched off, where it offered a create form that could not work. Several admin headings now match the module names they belong to. No settings, data, or hooks change.

• What's Changed
• Fixed The WordPress 7 data panel no longer appears for a module that is switched off. On a site with Redirect Manager disabled, its page still rendered two empty tables and a working "Add redirect" form, even though the module refuses every write while disabled, so the form could only produce an error.
• Changed The panel's "WordPress 7 workspace" heading is gone. Its tables already carry their own headings, and naming a section after the WordPress version labelled the implementation rather than what you are looking at.
• Fixed The Performance & Cleanup settings page was headed "Miscellaneous (Bloat Control)", which matched neither the module card you clicked nor any other name in the interface.
• Changed The dashboard box holding the AI opt-in is now called "AI explanations", after the single setting it contains, instead of advertising four platform features that are not configurable there.
• Fixed Link Management's JSON preset filter note now matches the format used by every other filter note in the plugin.
• Commits
• Ship 1.6.1 (933f1be)
• Stop the WordPress 7 panel labelling itself, and hide it when the module is off (b063842)

= 1.5.0 = = 1.6.0 = Security release. Fixes an Abilities API permission flaw that let any user who could edit a post reach administrator-only operations, moves redirect and task data into a private folder, and stops header/footer snippets being mangled for logged-out visitors. Also replaces DOMDocument with the WordPress HTML API in three content filters, so pages using Vue or Alpine are processed correctly instead of skipped. Existing settings, hooks, admin URLs, and data files are migrated automatically.

• What's Changed
• Security Abilities API operations now use a permission callback per ability and reject undeclared input properties. A shared callback previously widened to edit_post whenever the request carried a post_id, so any user who could edit one post could toggle modules, create redirects, create tasks, and trigger scans.
• Security Redirects, the bounded 404 log, and Task Manager projects moved to a private folder with a random name under wp-content/functionalities/. Existing files are migrated automatically. Apache, IIS, and directory-listing rules are written alongside them, and a new Site Health check confirms over HTTP that the folder really is unreachable.
• Fixed Header and footer snippets are no longer re-filtered against the visitor's capability at output time. Anonymous visitors were receiving mangled code — && became && and comparison operators were eaten as tags — while the logged-in administrator saw the snippet work. Filtering now happens once, at save time, against the author's capability.
• Fixed A JSON exception preset served from a URL is fetched at most once per cache window instead of on every page load. The cache clears whenever the module settings change, a post or page is edited, or the theme changes, and the last good list is kept when a fetch fails.
• Fixed The bulk nofollow tool pages through posts with an ID cursor and now finishes on sites with more than 100 matches. It previously returned the same first batch on every run.
• Improved Link Management, Block Cleanup, and Schema use the WordPress HTML API instead of DOMDocument. Attributes are edited in place, so Vue, Alpine, and mustache syntax survive untouched and the JS-framework skip guard added in 1.4.3 and 1.4.4 is gone. Content that used to be skipped is now processed correctly.
• Improved Redirect hits and 404 aggregates are buffered and written in batches rather than rewriting the whole JSON file under an exclusive lock on every request.
• Improved Redirects run at parse_request, before WordPress queries the database for a page it is about to discard. WordPress's own entry points are never redirected.
• Improved The Content Integrity column on the posts list reads a result cached at save time instead of rendering and parsing every row on every page load.
• Improved The SVG icon library is stored without autoloading, so full SVG markup no longer loads on every request.
• Improved The service worker skips wp-admin, the login page, REST responses, cross-origin requests, and anything marked no-store or private; caps the runtime cache; and precaches URLs individually so one stale entry cannot stop it installing. The manifest now includes an id.
• Improved Login Security adds per-username throttling, an IP allowlist, an unlock button on the lockout log, and a warning when every recent lockout shares one address, which is the signature of a site behind a CDN.
• Improved Prism.js is bundled with the plugin instead of being loaded from a third-party CDN.
• Improved Performance & Cleanup makes the revision limit configurable, and disabling Heartbeat now applies to the frontend only unless the new admin option is also enabled, so autosave and post locking keep working.
• Improved Content Integrity and Assumption Detection gained the filters their documentation promised, and the module documentation now lists hook names that exist. Nineteen documented hooks were never fired.
• Fixed Settings export no longer redacts the GA4 measurement ID as if it were custom code.
• Fixed Core icons get the same definition-ID prefixing as custom icons, so two gradient icons on one page no longer collide.
• Fixed Saving PWA settings flushes rewrite rules once instead of twice.
• Fixed Disabling feeds falls back to a message only when a redirect is genuinely impossible, making the documented message filter reachable.
• Changed The translation template is generated from the source. It was a one-string placeholder.
• Changed src/ and docs/ are excluded from the distribution, and build.sh now uses the same exclude list as the release workflow so a local build and a tagged release cannot drift.
• Changed Tested up to WordPress 7.1.
• Commits
• Readme: test against WordPress 7.1, correct stale claims, link the docs site (bbcd38d)
• Fix CI: ship the Prism assets and make the POT check reproducible (c199bbd)
• Migrate legacy data even when the file modules are disabled (e1c467d)
• Ship 1.6.0: Abilities permission fix, private data storage, HTML API filters (c5cdccd)