Update signed manifest to 7.40.0

manifest.json

@@ -1,11 +1,11 @@
 {
-    "version": "7.39.1",
+    "version": "7.40.0",
-    "released_at": "2026-09-16T13:42:29+00:00",
+    "released_at": "2026-09-17T10:42:49+00:00",
-    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.39.1/argus-wordpress-defence-7.39.1.zip",
+    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.40.0/argus-wordpress-defence-7.40.0.zip",
-    "sha256": "87edc46b0f77e6b158c330183fbef6cb396bd24461ffeb1c88aa627698d5771e",
+    "sha256": "9fc415ef804bfd2f584fbaeb69660a0ef963e52773d0c8913cd40d56a78ccd29",
     "min_php": "7.4",
     "min_wp": "6.0",
     "critical": false,
-    "summary": "* Comments that Form Protection identifies as automated spam are now sent straight to your\n  Spam folder instead of sitting in Pending Review, so fewer spam comments need manual cleanup.\n  Comments that only look unusual, rather than clearly automated, still go to Pending Review as\n  before.",
+    "summary": "* Security hardening: this site's IP-based protections (firewall, brute-force login protection,\n  REST/API abuse protection, WooCommerce checkout guard, two-factor) now correctly recognise real\n  visitor IP addresses when this site runs behind a reverse proxy, load balancer, or CDN, using the\n  same trusted-proxy configuration already available under Form Protection. Previously, sites in\n  that setup could see every visitor as the same address, weakening these protections.\n* Hardened the replay protection added in 7.39.0 further: it now remembers a short history of\n  recently-applied WAD actions instead of only the single most recent one.",
-    "signature": "zB0R3c/+pAGiOPb4MQm7MjOFogU+Sic/UXU+mc8MSnGLROu7bO+/BQtPfnmsY/sWOAoZEnzwra93iWMjsX3PAw=="
+    "signature": "n97VtOxZFjpDmUbFgbzjnf34nCcGUtGthdhs/oypEyEkidWgY6OiTt4WXUkz3ICEh5RJef9nfYxkyJeNaw1gBQ=="
 }