Update signed manifest to 7.41.0

manifest.json

@@ -1,11 +1,11 @@
 {
-    "version": "7.23.14",
-    "released_at": "2026-08-10T10:42:30+00:00",
-    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.23.14/argus-wordpress-defence-7.23.14.zip",
-    "sha256": "6b2365b173bd8e583a5d04021d205c773f927217b4870fc3ebff8c298c53367b",
+    "version": "7.41.0",
+    "released_at": "2026-09-17T11:36:03+00:00",
+    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.41.0/argus-wordpress-defence-7.41.0.zip",
+    "sha256": "311dacbd64a9604dba16de4329203899dd5a85aac0f0e78ea5670e2123069958",
     "min_php": "7.4",
     "min_wp": "6.0",
-    "critical": true,
-    "summary": "* Fixed a serious bug: the Firewall could block ordinary visitors just for arriving from an\n  everyday link -- for example, a link shared on Facebook, whose own redirect URL happened to\n  match a pattern the Firewall treated as suspicious. The underlying cause was broader than that\n  one case: 132 of the Firewall's 137 protection rules were checking a visitor's Referer,\n  User-Agent, and X-Forwarded-For information -- values a visitor doesn't control -- when they\n  should only ever have been checking what a visitor actually submits (search terms, form fields,\n  comments, and similar). Those three values are now excluded everywhere except the handful of\n  rules that specifically need them (Log4Shell-style attacks are delivered through exactly those\n  values, so detection there is unchanged). No settings change needed; this takes effect\n  automatically.",
-    "signature": "l3gHdqDlNbkuk88XuJpVOMiAbAMNVoht7lVJ0UgkgvcLgDUTmcnaYS9g6XoHqH6sPTkmLA6TL2SYe3d2d1NOCA=="
+    "critical": false,
+    "summary": "* Findings now have a complete lifecycle: Resolve, Reopen, Accept Risk, False Positive/Suppress,\n  Archive and Restore are all real, tracked actions (who did it, when, and why), available here in\n  wp-admin and, if this site is connected to a WAD account, from there too -- WAD is never a\n  separate copy of this data, every action there is carried out on this site the same way.\n* Contact Form 7's public feedback submission endpoint is now correctly recognised as an\n  intentional, documented part of that plugin's own public API, the same way WooCommerce's Store\n  API and Jetpack's public endpoints already were -- it no longer creates an unnecessary finding.",
+    "signature": "ebCSGFVp8NzohM7F8+os2MaNT67iyaYxNaxeKSrj+utKUL3qF30VF7qy69wvyBicttrKvtlqcbzhl53QBlMRCQ=="
 }