Update signed manifest to 7.40.0

manifest.json

@@ -1,11 +1,11 @@
 {
-    "version": "7.38.0",
+    "version": "7.40.0",
-    "released_at": "2026-09-15T16:58:36+00:00",
+    "released_at": "2026-09-17T10:42:49+00:00",
-    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.38.0/argus-wordpress-defence-7.38.0.zip",
+    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.40.0/argus-wordpress-defence-7.40.0.zip",
-    "sha256": "6d702695184c7c5701692d3f1a52ead4b52e07635643c33099b0f21c727f902d",
+    "sha256": "9fc415ef804bfd2f584fbaeb69660a0ef963e52773d0c8913cd40d56a78ccd29",
     "min_php": "7.4",
     "min_wp": "6.0",
     "critical": false,
-    "summary": "* If connected to WAD, you can now unban an IP, and add or remove a trusted IP from your\n  allowlist, directly from the WAD portal -- and your Firewall tab there now also shows which\n  rules have been active in the last 24 hours. Your ban list on WAD also now always reflects your\n  site's real, current bans (it previously only showed sample data).",
+    "summary": "* Security hardening: this site's IP-based protections (firewall, brute-force login protection,\n  REST/API abuse protection, WooCommerce checkout guard, two-factor) now correctly recognise real\n  visitor IP addresses when this site runs behind a reverse proxy, load balancer, or CDN, using the\n  same trusted-proxy configuration already available under Form Protection. Previously, sites in\n  that setup could see every visitor as the same address, weakening these protections.\n* Hardened the replay protection added in 7.39.0 further: it now remembers a short history of\n  recently-applied WAD actions instead of only the single most recent one.",
-    "signature": "OVYLFaaPZdwANMOGw0DbVe+WQjujPwB607yppDtF+eIp5vsn1n3MAEPikr59zNw/Wy/jLzY0LJ948o6kduQhDw=="
+    "signature": "n97VtOxZFjpDmUbFgbzjnf34nCcGUtGthdhs/oypEyEkidWgY6OiTt4WXUkz3ICEh5RJef9nfYxkyJeNaw1gBQ=="
 }