v0.4.9

The site tells the console what it runs.

New: software inventory (opt-in) — the CVE sensor's sending half

When enabled (Settings → ovos console → Software inventory, off by default, lockable via OVOS_CONSOLE_INVENTORY in wp-config.php), the plugin reports the installed plugin/mu-plugin/theme list with versions — plus WordPress core and PHP versions — once a day and after anything that changes it: installs, updates, (de)activations, deletions, theme switches, core updates.

The console matches the inventory nightly against the Wordfence Intelligence vulnerability feed and shows CVE findings on its SECURITY view — installed version, the version that fixes it, CVSS, and a PROBED count when the console has already seen requests naming that plugin's path. "You run X, and someone is looking for it" is the signal worth acting on first, and it is what alerts.

Exactly what each entry carries: type, directory slug, version, display name, active flag — never paths, options or user data. Double opt-in: this setting and the project's CVE switch in the console; either one off keeps the feature fully inert. The report is a single fire-and-forget request at shutdown (300 ms connect / 1 s total), never a slowdown; an unchanged report costs the console one timestamp update.

New: automation evidence in the bundled browser client

Reports now carry two zero-config signals: a webdriver admission (headless browsers and the AI agents built on them set it by default) and the external scripts the visitor never even attempted to load — the signature of bots that execute a page's inline JS without fetching its script files, which is what a "jQuery is not defined" from a plain Chrome UA usually is. The console indexes both as the flags field: bot-caused issues facet and filter apart from real-user ones. Evidence only, never suppression.

Changed: the username mask says how much it hides

Masked usernames keep every fourth character instead of collapsing to a fixed m*** (marcin → m***i*), so the mask is as long as the value it replaced — and past 24 characters it states the real length in brackets, because a login field holding thousands of characters is someone trying something. Applied identically in the PHP reporter and the bundled browser client.

---

Full Changelog: v0.4.8...v0.4.9

v0.4.8

Full Changelog: v0.4.7...v0.4.8

v0.4.7

Full Changelog: v0.4.6...v0.4.7

v0.4.6

Full Changelog: v0.4.5...v0.4.6

v0.4.5

Full Changelog: v0.4.4...v0.4.5

v0.4.4

Changelog

• Fix: on hosts whose curl lacks the threaded DNS resolver, every error report was lost. Such builds time sub-second timeouts via SIGALRM, which cannot do sub-second at all — libcurl refused the sender's 300 ms connect bound outright (remaining timeout of 300 too small to resolve via SIGALRM method) before even resolving the console's hostname, and the fire-and-forget contract swallowed the failure, so nothing ever arrived and nothing ever said why. The ingest call now sets CURLOPT_NOSIGNAL, which times the connect by polling instead; hosts with the threaded resolver behave exactly as before. Found on a shared-hosting box where the identical call succeeds in 36 ms once allowed to run.
• Bundled console-client.js: exposes a stubAware: true marker on window.ovosConsole so a loader that must keep working against older, pre-drain consoles (e.g. ovos-play) can detect stub-drain support onload and fall back to init()ing directly when it's absent.

Full Changelog: v0.4.3...v0.4.4

v0.4.3

Full Changelog: v0.4.2...v0.4.3

v0.4.2

Full Changelog: v0.4.1...v0.4.2

v0.4.1

Full Changelog: v0.4.0...v0.4.1

v0.4.0

Full Changelog: v0.3.4...v0.4.0