Re-audit follow-ups: PHP 8.2 floor, v3.0.0, gate Schema::maybe_upgrade() - #12
Merged
Conversation
…udit) - MIN_PHP 8.3 -> 8.2: 8.1 is the newest syntax the templates use; 8.2 is the oldest line still getting security fixes and covers the widest install base. CI matrix + phpcs testVersion + own CI jobs + README follow. - package.json 2.0.0 -> 3.0.0: the merged PHP pin and the static-bootloader rewrite are both breaking, and the published version was still 2.0.0. - Schema::maybe_upgrade() (#13): bail unless is_admin() || wp_doing_cron() || WP_CLI, so dbDelta() never runs on a cached front-end request. New Schema_Test case covers the front-end skip. Verified: 67 generator + 13 engine tests; 8.2 scaffold php -l clean, version tokens all 8.2.
akshat009
changed the base branch from
feat/static-bootloader-services
to
main
August 29, 2026 15:13
…ing from Commands_Test
Owner
Author
|
reopening to re-run CI |
akshat009
added a commit
that referenced
this pull request
Aug 29, 2026
…repare-dist (#11, #12 revised) Re-audit #2 retracted "drop the */templates/* exclude" — the WC email/My-Account overrides genuinely fail three sniffs (PrefixAllGlobals on core WC hook names + loosely-named locals; EscapeOutput on plain-text bodies that use wp_strip_all_tags). But the blanket path exclude also silenced EscapeOutput on the HTML email template, where escaping does matter. Now: when a woo:email / woo:my-account module ships a templates/ dir, phpcs.xml adds `<file>./templates</file>` and excludes only: - WordPress.NamingConventions.PrefixAllGlobals for */templates/* - WordPress.Security.EscapeOutput for */templates/emails/plain/* only Everything else in templates/ (docblocks, spacing, i18n, the HTML email's escaping) is linted. Gated on a new has_wc_template_overrides flag; a scaffold without those modules has no templates/ reference at all. Also: `composer prepare-dist` = `composer install --no-dev --optimize-autoloader`, so `npm run plugin-zip` doesn't depend on the user reading the release docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #11. Addresses the re-audit's ranked items.
3.0.0before publishingpackage.json2.0.0 → 3.0.0 (the PHP pin and the bootloader rewrite are both breaking; published was still 2.0.0)MIN_PHP, CI matrix (['8.2','8.3','8.4']), phpcstestVersion 8.2-, the CLI's own PHP jobs, and the README all follow.Schema::maybe_upgrade()(#13)Deliberately not done
*/templates/*PHPCS exclude (Static bootloader + Services locator (drop the DI container) #11): PR Generated-plugin hygiene + module-system expansion (Phases 1–6) #9's CI showed the WC email / My-Account override templates genuinely failwp-orgWPCS (NonPrefixedHooknameFoundon core WC hook names). The audit lints them with a default ruleset, not the generatedphpcs.xml. The exclude is load-bearing.vendorfrompackage.jsonfiles(Re-audit follow-ups: PHP 8.2 floor, v3.0.0, gate Schema::maybe_upgrade() #12): the documented release flow iscomposer install --no-dev --optimize-autoloader→plugin-zip; that only works ifvendoris infiles. Removing it breaks the zip.{{AUTHOR}}in the header goes throughcommentSafe()which doesn't touch backslashes, so--author 'Dev\'yields a single (harmless) backslash.composer.jsoncorrectly JSON-escapes it to\.Verified: 67 generator + 13 engine tests; 8.2 scaffold
php -lclean.