Update signed manifest to 7.40.0

manifest.json

@@ -1,11 +1,11 @@
 {
-    "version": "7.29.2",
-    "released_at": "2026-09-14T09:33:45+00:00",
-    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.29.2/argus-wordpress-defence-7.29.2.zip",
-    "sha256": "1d5298ce27eaf2ed6f0290a708e652abbd28e5e4d474f196e1ecb4ea8ff6ae1b",
+    "version": "7.40.0",
+    "released_at": "2026-09-17T10:42:49+00:00",
+    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.40.0/argus-wordpress-defence-7.40.0.zip",
+    "sha256": "9fc415ef804bfd2f584fbaeb69660a0ef963e52773d0c8913cd40d56a78ccd29",
     "min_php": "7.4",
     "min_wp": "6.0",
     "critical": false,
-    "summary": "* Fixed a bug where the Scanner's very first check of your site (or one run after resetting it)\n  could flag every core WordPress file as suspicious at once, dropping your Security Score to 0\n  for no real reason. A first-time check now quietly learns what your site looks like, exactly\n  like every check after it, and only flags files that are genuinely new or changed.",
-    "signature": "gkSLRMxz9Gzzq5Aon9HLOvrf12jLkJ/ygWvG8ud+BSBgsA6DImiVbvTeZtnXd1jM4EJBvuLE9s9006rxy89zBA=="
+    "summary": "* Security hardening: this site's IP-based protections (firewall, brute-force login protection,\n  REST/API abuse protection, WooCommerce checkout guard, two-factor) now correctly recognise real\n  visitor IP addresses when this site runs behind a reverse proxy, load balancer, or CDN, using the\n  same trusted-proxy configuration already available under Form Protection. Previously, sites in\n  that setup could see every visitor as the same address, weakening these protections.\n* Hardened the replay protection added in 7.39.0 further: it now remembers a short history of\n  recently-applied WAD actions instead of only the single most recent one.",
+    "signature": "n97VtOxZFjpDmUbFgbzjnf34nCcGUtGthdhs/oypEyEkidWgY6OiTt4WXUkz3ICEh5RJef9nfYxkyJeNaw1gBQ=="
 }