Justified Image Grid - Premium WordPress Gallery 5.2

• PhotoSwipe 5 is now available. It is deliberately minimal: the caption sits below or beside the photo rather than over it, and YouTube, Vimeo and self-hosted videos play inside it. PhotoSwipe 4 stays the default, so nothing changes on your site unless you pick the new one.
• Visitors can now download a whole gallery as one zip file from a single link, created in the browser using a service worker, so nothing is ever stored on your server. Switch it on under General settings, where you can also reword the link, or turn it on for one gallery only. The link sits below the grid but is movable anywhere else with a satellite shortcode. There is also a toast with the status of the download. The zip holds what the active filter is showing, plus the photos hidden behind album or cover tiles, which arrive as folders in the zip. Video clips are excluded, and so is any tile that opens a link instead of a photo, i.e. a recent posts grid will skip this feature. A very large gallery may arrive in a few parts to avoid running out of memory.

• The plugin’s settings screen now appears the moment the page arrives, instead of staying blank while every other script on your dashboard finishes loading. It also stays readable and its tabs stay clickable if JavaScript is blocked or fails.
• JIG’s PhotoSwipe styling now reaches only the lightbox JIG itself opens, so it can no longer restyle a PhotoSwipe that another plugin put on the same page. If you have custom CSS aimed at JIG’s PhotoSwipe, put the plugin’s own class in front of it: .pswp.jig-pswp for PS4, .pswp.jig-pswp5 for PS5.
• Downloads now begin the moment you click and pass through the server as the bytes arrive, so even a very large image no longer risks exhausting your server’s memory. Images hosted on your own site skip the plugin’s download handler entirely: the link points straight at the image and carries the HTML download attribute, which is all the browser needs to save it rather than open it.
• Large galleries are now built up to 60% faster, and redrawn faster still when the window is resized. The whole grid is added to the DOM in a single write instead of one picture at a time, and the caption work now measures every picture before it restyles any of them. Captions below the thumbnails improved further: they are shortened to fit whenever the grid is redrawn, instead of being checked over and over for as long as the page stays open.

• Fixed galleries vanishing from Elementor pages after the first view. Elementor 3.26 and newer freezes a copy of certain elements, and a grid inside one stopped working for everyone after the first visitor. It affected Elementor’s own Image Gallery widget, which JIG picks up because that widget builds an ordinary WordPress gallery under the hood, and grid shortcodes placed in Tabs, Accordion or Toggle widgets. Grids are now kept out of the frozen copy, and any copy already saved is cleared once, when you update.
• Fixed prettyPhoto refusing to open at all on certain Vimeo links, which left the visitor with no lightbox. Unlisted Vimeo videos now play, and so do YouTube Shorts links copied straight from the share dialog.
• Hover captions no longer flash at full strength for an instant before fading in. It was visible in Firefox, most noticeably right after closing the lightbox with the mouse resting on a thumbnail.
• Videos no longer offer a download link. The link on an Instagram video always failed, and on Facebook or YouTube it quietly handed over the cover image instead of the clip people were watching.
• Download links now work on photos whose web address does not end in a familiar image extension such as .jpg or .png. Some image hosts serve photos that way, and the plugin used to refuse them, so the download link failed on every click.
• Fixed a grid rebuilding itself endlessly when its thumbnails would not load, which left the page flickering and never showed the message explaining what to fix. A picture that will not load is now dropped from the grid, whatever is serving it, including Jetpack Site Accelerator, and the message appears only when nothing is left to show.
• On sites using Jetpack Site Accelerator, JIG had gone back to generating gallery thumbnails on your own server instead of letting Site Accelerator size them. Site Accelerator sizes them again, so that work stays off your server.
• On sites using Jetpack Site Accelerator, JIG stopped sizing gallery images altogether whenever its own thumbnail engine could not run on the server, so visitors downloaded full-size pictures for small thumbnails. Site Accelerator now keeps sizing the images it handles, and the Thumbnails screen says which sources are affected while the engine is unavailable.
• When using the “Replace site’s hostname with” (CDN Host) setting with dynamic thumbnail generation on, JIG fetched each original through your CDN before resizing it, wasting a round trip. Originals are now read from your own server, and the resized thumbnail gets served from your CDN.
• Your CDN hostname is now used wherever your site’s own address appears, instead of being skipped for certain gallery types. RSS grids reading your own feed, and the featured images in recent posts grids, go through your CDN now.
• Filling in a CDN hostname under “Replace site’s hostname with” now takes your grids off Site Accelerator altogether. Previously, on a site running both, Jetpack Site Accelerator took precedence over your CDN host, and pictures it refused were handled by neither.
• Images on your own site whose address carries a query string, such as photo.jpg?ver=2, now get thumbnails too. JIG’s thumbnail engine used to refuse them, so those thumbnails failed to load.
• Fixed photos spilling past their border frame when Middle border width was set and captions sat below the photo. It showed up after the page resized, a filter was applied, or more photos loaded.
• Facebook connections that never expire no longer ask to be renewed. A Login for Business (Pages) app gets no expiry date from Facebook, yet JIG announced that such a connection had expired while the galleries kept working. JIG now tells you when a connection has actually stopped working instead of guessing from a date, and clears the notice once it works again.

• Fixed a disclosure of your Facebook access tokens (CWE-200) to logged-in users who should not have been able to open the shortcode editor at all (CWE-862). The editor now requires the ability to write posts as well as the minimum user role you set, and no admin screen puts a Facebook token in the page anymore, neither the editor nor the plugin’s settings; it is looked up on the server when it is needed. Only the admin area was ever involved, never your public pages.
• The download link now carries an address signed by your own site, and the plugin refuses to fetch anything else. Previously anyone could point that address at any image on the web and have your server fetch it on their behalf, on your bandwidth. If a caching plugin is still serving pages saved from before this update, the download links on them stop working until that cache refreshes.

Added / New features​

• Instagram source is resurrected. Connect your own Instagram account and show your photos, videos and carousel posts in a gallery, set up entirely by yourself with no approval process and no third-party service in between. Your access token is refreshed automatically, so there is no 60-day re-authorization, and caption hashtags become gallery filters. It covers your own media only and needs a Professional (Business or Creator) account, which is a simple toggle on Instagram, though it makes your account public.

Changed / Improved​

• PHP 7.2.24 or newer is required, which covers 99% of WP sites, and matches the minimum that WordPress's own security-supported branch needs, so JIG can use safer, more modern PHP internally. On the rare site still on an older PHP version, the plugin stays inactive and shows a notice explaining how to upgrade, instead of loading and risking errors.
• JIG Thumbs no longer lets its optional debug log grow without limit. If you switch debug logging on to diagnose an issue and leave it on, the log now keeps only its most recent entries.
• JIG Thumbs now accepts larger source images, with the download limit for a fetched image raised from 10 MB to 24 MB and more memory available while resizing. It also skips sources above about 16 megapixels (comfortably beyond 4K resolution), so a single oversized image cannot exhaust your server's memory. That is rarely reached in practice, as WP already scales large uploads down and JIG picks the closest pre-sized variant Flickr and Facebook publish. If you ever need to work from a very large original, you can base the thumbnail on a smaller registered image size instead, using the "Base thumbnail on an image size" option.
• Facebook galleries now load with far fewer requests to Facebook: an album overview that used to make one request per album makes a single request, and feed galleries fetch all their photos together.
• The Facebook overview caching time setting has been removed, because the requests it existed to save no longer happen.
• The User Agent JIG reports when it fetches feeds and external images is now current Chrome, instead of a browser version from 2016 that some sites had started turning away.
• The Instagram icon on the settings and Shortcode Editor screens is now Instagram's current logo instead of the long-retired camera design.

Fixed​

• Fixed a critical error that could appear after updating to v5 on sites using Jetpack's Site Accelerator and PHP 8 or newer. Those pages load normally again, no longer needing a rollback.
• Fixed a misspelled internal keyword behind the doublecolon breadcrumb separator option. Existing shortcodes that use it keep working unchanged.
• PHP notices no longer fill your error log, or show on the page on servers that display warnings. On PHP 8.1 and newer they came from gallery items with no title, caption or description, now handled across NextGen Gallery albums, RSS and feed galleries, Facebook albums and Flickr photosets, and from a video opened in the prettyPhoto lightbox with no poster image. On PHP 8.5, they came from a few calls that version newly deprecated, which the plugin no longer makes.
• Every setting that takes a size now accepts the number with or without px. Sixteen fields carry a length and they used to follow two opposite conventions, most of them wanting a bare 12 and two wanting 12px, with only the help text to tell them apart. Guessing wrong silently did nothing, or reset the field to its default. All of them now take either spelling, and the help text says so in the same words on the settings page and in the Shortcode Editor.
• Guarded against more preventable critical errors on the front end: servers without the GD image library, a Facebook or Flickr feed returning a malformed date, and a plugin folder renamed or only partly uploaded.
• Hardened Justified Image Grid against other plugins that hand an unexpected kind of value to the WordPress hooks it connects to. If a plugin on the same filter returns the wrong type of data, JIG now passes it along untouched instead of risking a critical error on PHP 8 or newer.
• After a successful update, the new version could keep being offered for hours even though it was already operational. That is now cleared as soon as the updated plugin loads.
• Justified Image Grid no longer alarms you about its own thumbnail engine when that is not the one sizing your images. Sites that use Jetpack Site Accelerator, or that have turned dynamic thumbnail generation off, used to get worrying engine-failure notices about a feature they were not using, sometimes two at once. JIG now only tests and reports on its own engine when it is actually in use, and the Thumbnails settings page shows clearly which method is in charge.
• The last-check times on the Thumbnails settings page now show in your site's timezone instead of UTC.
• To avoid sharing a link with a missing or broken image, JIG no longer sets og:image when sharing an image from a Facebook-sourced gallery if the dynamic thumbnail engine is off or unusable. Facebook's CDN turns away many link preview crawlers, its own included, so no social network is allowed to fetch those images, and Jetpack Site Accelerator will not proxy them either.
• Facebook album covers and feed photos could stop loading a few days after a gallery was first shown, because the image URLs Facebook hands out are short-lived. A temporary Facebook error could also stay on screen long after its cause was gone, in some cases for weeks. Both are fixed, and a gallery now recovers by itself on the next page view.
• Facebook connections now count down to the real renewal date that Facebook reports, instead of always assuming two months. Depending on how your Facebook app is set up that is often about three months, so the reminder to re-authorize arrives when renewal is genuinely due rather than up to a month early. Pages now report their own expiry date rather than borrowing the profile's.
• Connecting a Facebook account that manages several Pages now adds every one of them. A brief hiccup at Facebook's end could leave one Page out of the list with nothing on screen to say so, and a real problem behind it, such as a certificate issue on your server, went unreported too. Facebook is now asked again when it answers oddly, and anything still wrong is spelled out in the message log.
• A Facebook gallery, or the album list in the Shortcode Editor, could announce that the content cannot be displayed and suggest reconnecting the account when there was nothing wrong with the connection at all. Facebook occasionally answers a request by leaving out the very content it was asked for, reporting no error of any kind, and the identical request moments later returns everything. Galleries and the editor now ask again before giving up, which the settings page already did when you added a connection.
• Fixed galleries that could fail to appear at all, leaving nothing but the surrounding page, when one of the optional scripts they rely on was not loaded. This could happen with unconditional script loading turned on and a script unticked in the manual "Scripts to load when using unconditional loading" list that a grid actually needed, most often because a preset asked for a different lightbox than your own settings did. The gallery now renders normally and only the affected extra is degraded, whether that is the lightbox, the shortening of captions below thumbnails, or a hover effect.
• Fixed the PhotoSwipe lightbox opening invisibly on sites where another WP plugin loads its own, newer PhotoSwipe. It now shows normally.
• In the Shortcode Editor, clicking the Facebook profile or Page you had already selected no longer clears the album you chose under it. This happened when the click landed on the account's small avatar rather than on its name.
• Names and titles containing a quote, an ampersand or an angle bracket now read as written wherever JIG lists them, instead of coming out mangled or as a broken tile you cannot pick. That covers Facebook, Flickr and Instagram connections on the settings page, where such a name is now saved intact too, and in the Shortcode Editor the account buttons, Facebook albums, and Flickr groups, albums, galleries and collections. Messages that quote Facebook's or Flickr's own wording are shown as plain text as well.
• Facebook videos that have no thumbnail on Facebook are no longer stretched and blurred across a full size tile, they now appear at the shape and size of the placeholder image Facebook returns for them. In the Shortcode Editor, an album that Facebook returns no photos for no longer shows the previous album's cover.
• When your server has a certificate problem, the guide JIG points you to is a working link again in the settings message log and in the Shortcode Editor, instead of the markup around it showing as text.
• In the Shortcode Editor's live preview, clicking a Flickr collection or a Facebook album now opens it, on sites that do not use pretty permalinks. Before, the preview reloaded the same top level each time, with no breadcrumb and a fresh set of cover images, so there was no way to look inside.
• The links that take you to the plugin's settings now open JIG's own entry in the admin menu, at the tab they point to. Several of them used to open under the WordPress Settings menu, on the General tab.
• A filter label you have set now appears in WPML String Translation, so it can be translated like the rest of JIG's text.
• Reconnecting or renewing a Facebook, Instagram or Flickr connection no longer leaves unused cache entries behind in your database.
• The Facebook, X and Pinterest share buttons in the prettyPhoto lightbox no longer stick out past its frame when a tall photo makes the lightbox narrow, they now wrap onto another line inside it.

Security​

• Security scanners should no longer falsely flag JIG's thumbnail engine over branding it had inherited from the older TimThumb script it grew out of.
• JIG Thumbs now verifies each remote site's security certificate when fetching external images, so those images cannot be swapped out or tampered with on their way to your server.
• On servers without cURL, JIG Thumbs now caps the download size and applies a timeout when fetching an external image, the same limits cURL-based servers already had, so an oversized or unresponsive remote image can't exhaust memory or hang the request.
• Hardened JIG Thumbs against several potential abuse vectors involving specially crafted image requests.

Updated​

• Facebook Graph API to v25.0, up from v20.0.
• Documentation, covering the Instagram source and chapter, the thumbnail engine status rows and which method sizes your thumbnails, the source size limits, and the px rule on every length field.
• The Spanish translation now covers this release, including the new Instagram source and the rewritten thumbnail engine and direct-serve status screens.