Borges Bibliography Builder

1.7.0

• Better formatting in every citation style. All nine styles are rewritten in full from their style manuals: Chicago (notes-bibliography and author-date), APA 7, MLA 9, Harvard, IEEE, Vancouver, OSCOLA, and ABNT. Entries now keep full given names, volume, issue, and pages, editors, translators, editions, and access dates, and follow each manual’s author-list and “et al.” rules. ABNT now prints in Portuguese, and Harvard uses British conventions. Existing bibliographies keep their saved text until an entry is added or edited or the style is changed.
• Fixed: organization authors (such as “Open Research Alliance”) no longer vanish from formatted entries, and an entry after one shortened to “et al.” keeps the “and” before its last author.
• Fixed: “Attempt Block Recovery” in other languages. A bibliography no longer opens as invalid when an editor using a different language from the one who saved it opens the post. Cite / Export labels are now translated for visitors as the page renders.
• Fixed: wrong translations. In all 19 bundled translations, seven strings such as “Copy citation” showed as “Add citations”. They now fall back to English until corrected.
• Fixed: whole .bib exports from reference managers. Zotero abstracts with blank lines, JabRef comments and @string macros, and EndNote reference-type names no longer lose or garble records.
• Fixed: duplicated blocks no longer share IDs with the original, and pasting CSL-JSON is rejected instead of producing a nonsense citation.
• New for developers: review and write routes. Users who can edit a post can validate a bibliography, list likely duplicates, and preview it in another style over REST or as WordPress 6.9 abilities, without saving anything. Sites can also opt in to write routes that change citations, block settings, and the citation style over REST. They are off by default, preview every change first, and save through normal post revisions.
• Playground demo: the live demos open on a page with copy-ready samples of every input format and three example bibliographies.

1.6.0

• New: PubMed Central import. Paste a PMCID (PMC3531190) and it is looked up through the same NCBI service as PubMed IDs.
• New: arXiv import. Paste an arXiv ID, an arxiv.org link, or an arXiv DOI (arXiv:1706.03762, 10.48550/arXiv.1706.03762) and it is looked up through the arXiv API. arXiv DOIs used to fail because Crossref doesn’t hold them.
• New: ISBN import. Paste ISBN 978-0-14-032872-1 or a labeled ISBN-10 and the book is looked up through Open Library, with Google Books as a fallback. Checksums are verified before any lookup, and a Google result is used only if it carries the exact ISBN you pasted.
• New: BibLaTeX import (date, journaltitle, @online, and similar) is now covered by tests. Formatted citations that contain a PMCID, arXiv ID, or labeled ISBN are looked up the same way as the bare identifier.
• New: WordPress Abilities (WordPress 6.9 and later). Three read-only abilities let AI assistants and automation tools list a post’s bibliographies, export one as CSL-JSON or plain text, and check citation records, with the same permissions as the existing REST routes. Nothing can be changed through them.
• Fixed: invalid language tags on imported entries. BibTeX language and BibLaTeX langid values such as ngerman were saved verbatim into the entry’s HTML lang attribute, which assistive technology cannot use. They now map to standard tags (ngerman → de); unknown values are left out. Already-saved entries are unchanged.
• Fixed: arXiv links from BibTeX. arXiv preprints pasted as BibTeX or BibLaTeX now keep a link to the abstract page instead of dropping the eprint.
• Translations: the translation template is back in sync with the plugin. A few help strings changed to name the new identifier types.
• Privacy: the External Services section now also lists arXiv, Open Library, and Google Books. Each is contacted only from the editor, only when you paste that kind of identifier, and receives only the identifier.

1.5.1

• WordPress 7.1 support. Verified against a 7.1 release candidate: the block registers and renders in the editor, which 7.1 now always runs inside an iframe, and bibliographies still format correctly in every citation style tested.
• Fixed: copying could report failure when copying was still possible. Both Copy citation and Copy bibliography had a fallback for browsers without clipboard access, but only used it when that access was missing entirely — not when the browser offered it and then refused. A refusal now falls through to the fallback instead of reporting failure.

1.5.0

Security release. Updating is recommended for all sites.

• Security: Fixed a denial-of-service weakness in the public bibliography REST route, present in 1.4.2 and earlier. Reading a bibliography ran its stored citation text through WordPress tag stripping with no length limit, and past roughly 600 KB that operation degrades badly — a single oversized value saved into a published post cost about 12 seconds of pinned CPU on every read, on a route that requires no login and can be requested repeatedly at no cost to the caller. Stored text is now truncated to 64 KB before stripping, so existing bibliographies still render. This is the change that makes updating worthwhile.
• Security: Applied the same 64 KB limit to citation text sent to the formatter endpoint, where any user who can reach the block editor could otherwise tie up a CPU core per request.

The three changes below are hardening. None of them was exploitable; each was a case where the plugin happened to be safe because of how some unrelated code was written, which is a property that quietly stops holding when that code changes.

• Hardening: Bibliography data in a post type registered as non-public is no longer readable without authentication. Published status alone previously satisfied the check. Anyone able to edit the post still has access.
• Hardening: Links generated from citation text are now restricted to http and https, and any other scheme renders as plain text. Nothing downstream would have caught a javascript: link; the only thing preventing one was the URL-detection pattern requiring a literal http(s):// prefix, which a later improvement to that pattern could have removed.
• Hardening: PubMed/PMID lookups now use WordPress’s safe HTTP client, so every redirect in the chain is validated against the site’s own network.
• Escape two Unicode line-separator characters in the JSON-LD and CSL-JSON output blocks. Not a security issue — these blocks are never executed — but the characters terminate a line for a JavaScript parser and would break a consumer that evaluates a block instead of parsing it.
• Update the Block Accessibility Checks (BAC) integration for BAC 4.0, which replaced the registration API and renamed its editor filter hooks. All four bibliography checks — empty bibliography, missing heading, raw URL link text, and all metadata outputs disabled — are now admin-configurable from BAC’s unified settings screen.
• The BAC integration now requires Block Accessibility Checks 4.0 or later. On BAC 3.x the integration stays dormant and no bibliography checks appear; Borges itself works normally whether BAC is outdated or not installed at all.
• Add a regression test that validates every shipped bibliography markup format against the block’s own deprecation chain, guarding existing posts against “Attempt Block Recovery” prompts after an upgrade.
• Fix the end-to-end test covering the Block Accessibility Checks integration, which silently skipped itself and left the integration without real coverage.
• Add a second WordPress Playground demo that boots the current development build alongside the released-version demo.
• Add a scheduled monitor that verifies each Playground demo link stays reachable.
• Publish hand-verified size, footprint, and runtime-overhead metrics, each paired with the command used to re-derive it, and add a continuous-integration check that fails when the recorded lines-of-code figures or the no-persistent-storage audit drift.

1.4.2

• Resolve DOI and labeled PMID identifiers embedded in free-text citation pastes through the existing CrossRef and PubMed resolver paths.
• Fall back from embedded-identifier resolution to the heuristic free-text parser before showing unsupported-input guidance.
• Add free-text sample documentation for supported embedded DOI/PMID citation inputs.
• Stabilize numeric citation reorder E2E coverage against editor readiness races.
• Clarify that RIS is supported for export, not import.

1.4.1

• Clean up after the plugin when it is deleted: uninstalling now removes the plugin’s cached data — the formatter and PubMed/PMID transients (across all sites on multisite) and its object-cache groups where the host supports it. Bibliography blocks already saved in your posts are left untouched.