Update signed manifest to 7.23.49

manifest.json

@@ -1,11 +1,11 @@
 {
-    "version": "7.23.32",
-    "released_at": "2026-08-12T15:26:37+00:00",
-    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.23.32/argus-wordpress-defence-7.23.32.zip",
-    "sha256": "6439eb8b52c3ffec514d73705ea57aa461fcfe2e781bd0c298688697ed0ee2ea",
+    "version": "7.23.49",
+    "released_at": "2026-08-13T10:53:46+00:00",
+    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.23.49/argus-wordpress-defence-7.23.49.zip",
+    "sha256": "15f149922645b12665d6ff0261bf4ea0432f26bffb735220957cf5794d06e63c",
     "min_php": "7.4",
     "min_wp": "6.0",
     "critical": false,
-    "summary": "* Fixed a real bug found on a live production site right after 7.23.31 shipped: the new\n  self-health-check for the scanner and the update mechanism compared timestamps in the wrong\n  format, so it could report \"hasn't run in hours\" / \"hasn't checked in 2 days\" even seconds after\n  they genuinely had. Both are now correctly recognized as healthy when they actually are.",
-    "signature": "XnGoKDoybXWln+XMgRVSYJM+0VMsvXRvJfnoDTf0bCvkLdX5a+Enq2jIMrMouDCrHmp7qp76/0P2tRmA0PidDA=="
+    "summary": "* Closed a way an unauthenticated visitor could still probe usernames through the site's REST API,\n  even with the login page already hardened against this.",
+    "signature": "wX0aZAPFwvx4nnzAykVrqVNvGZcBN8gZUuuZkNtSqssYUaJm58jNmRGiYCK7TK0DyqYfuo64CbWVlefh458wDg=="
 }