Update signed manifest to 7.40.0

manifest.json

@@ -1,11 +1,11 @@
 {
-    "version": "7.28.4",
+    "version": "7.40.0",
-    "released_at": "2026-09-02T15:15:16+00:00",
+    "released_at": "2026-09-17T10:42:49+00:00",
-    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.28.4/argus-wordpress-defence-7.28.4.zip",
+    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.40.0/argus-wordpress-defence-7.40.0.zip",
-    "sha256": "cf52ee57ad4a7b8bacebf65311e4aafbcf7ec01b43ce195a88219acf3a05b316",
+    "sha256": "9fc415ef804bfd2f584fbaeb69660a0ef963e52773d0c8913cd40d56a78ccd29",
     "min_php": "7.4",
     "min_wp": "6.0",
     "critical": false,
-    "summary": "* Fixed a bug where a brute-force login attack that ARGUS had already blocked could keep showing\n  as an active finding and unnecessarily lower your Security Score, even though the attack was\n  already stopped. Blocked attacks are now correctly marked as automatically handled.",
+    "summary": "* Security hardening: this site's IP-based protections (firewall, brute-force login protection,\n  REST/API abuse protection, WooCommerce checkout guard, two-factor) now correctly recognise real\n  visitor IP addresses when this site runs behind a reverse proxy, load balancer, or CDN, using the\n  same trusted-proxy configuration already available under Form Protection. Previously, sites in\n  that setup could see every visitor as the same address, weakening these protections.\n* Hardened the replay protection added in 7.39.0 further: it now remembers a short history of\n  recently-applied WAD actions instead of only the single most recent one.",
-    "signature": "Se38Rj8baM5nPoudeBAwd890pxtMp4i4RRb16r4j5Hi0hfLrJM7EaOy0kcayrSIUKeNaQl1lkrhToHS6/vjkDA=="
+    "signature": "n97VtOxZFjpDmUbFgbzjnf34nCcGUtGthdhs/oypEyEkidWgY6OiTt4WXUkz3ICEh5RJef9nfYxkyJeNaw1gBQ=="
 }