Release/v4.1.3

[DinetsV]

✨ PR Description

1. Problem & Context

Release v4.1.3 consolidates branding (Ally → Web Accessibility), adds Elementor One integration with migration popup, and improves remediation robustness. Version bump from 4.1.2.

2. What Changed (Where)

Category	Changes
Branding	UI strings, help text, modal titles across 20+ files (Ally → Web Accessibility)
One Integration	New MigrationModal, migration API endpoint, tracking infrastructure, popup dismissal state
Remediation	Removed global flag; unified element lookup via get_element_by_xpath_with_snippet_fallback; added frontend fallback logic
Review Flow	New ThanksForm page, call scheduling, multistate popup (ratings→feedback→thanks) with PAGE_IDS constants
Deactivation	Fixed field ID mappings (ea11y_ prefix), added event delegation for option clicks, resetModal on open
Dashboard	Fixed stats calculation (issues_total → issues_opened), progress SVG rendering
Dependencies	Updated wp-one-package (1.0.62→1.0.66), elementor-one-assets (0.4.35→0.4.38), mixpanel-browser (2.58.0→2.80.0)
Scanner	Added public DOM normalization (fetch anonymous page, remove admin-only markup before scanning), re-run remediations post-normalization

3. How It Works

Migration Flow: Settings context checks hasElementorOneSubscription && !isElementorOne && !isMigrationPopupDismissed → triggers MigrationModal. User clicks "Move to One" → calls migrateToOne() API endpoint (/elementor-one/v1/plugins/pojo-accessibility/migration/run), tracks event via mixpanel, reloads on success.

Remediation Simplification: Removed conditional isGlobal ? snippet_fallback : xpath_only. Now always attempts XPath first, validates snippet match if provided, falls back to snippet search. Constructor uses exists_with_fallback() to mark non-STYLES failures as frontend-deferred.

Scanner DOM Normalization: On load, fetches public page (credentials: omit), builds stable element signatures (tag + id + stable classes + data attrs), removes orphaned admin-markup from live DOM, stores removed nodes, re-runs remediations against normalized tree. On widget close, restores original markup.

Review Multistate: Rating triggers submit or feedback flow (rating < 4 → feedback page, rating ≥ 4 → thanks). Thanks page shows call scheduling buttons. Feedback submit also lands on thanks. Dismissal/submit logic checks avoidClosing flag for success toast timing.

4. Risks

• One Integration Untested: New migration endpoint unvalidated; assumes Elementor One facade API stable. User reload mid-migration unhandled.
• DOM Normalization Fragile: Signature matching relies on stable class detection (regex hardcoded); plugins adding dynamic classes break matching. Removed nodes cached indefinitely if widget never closes.
• Deactivation Event Delegation: Added global click handler on document; clicks inside text fields now trigger option handlers (guarded by e.target.closest('.ea11y-feedback-option')), but nested elements risk misfires.
• Branding Strings Incomplete: @ea11y-apps scope strings unchanged; scattered "Ally" references may remain in untouched modules or translations.
• Dashboard Stats Logic Change: issues_total → issues_opened calculation differs; if issues_total summed across scans differently, rendering could misreport progress.

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}

[wiz-9a149474ff]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1
SAST Findings	-
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[matviy-yermakov]

Changelog items for the release are missing.

[nirbhayel]

Not updating mixpanel here?

[DinetsV]

will do