-
v1.6.5 Stable
released this
2026-09-17 10:58:02 +00:00 | 2 commits to main since this release1.6.5
Release date: 2026-09-17
Fixed
- Fatal error on the login screen with newer WordPress versions: the
login_messagefilter can deliver null when no message is set (observed on WordPress 7.x with PHP 8.4, TypeError on a plain visit to wp-login.php). The message callback now acceptsstring|nulland coalesces null to an empty string. - Hardened all externally-fed filter callbacks against null payloads: the four
authenticatecallbacks now acceptstring|nullcredentials (custom REST/SSO endpoints are known to apply the filter with null), and thewp_redirectfilter callback coalesces a null location. Verified safe as-is: shortcode callback, Settings API sanitizer, activation hooks, and admin-hook parameters.
Compatibility
- WordPress: 5.6 – 7.1
- PHP: 8.0 – 8.5
Tests
- PHP Coding Standards: PHP_CodeSniffer 3.13.6 / WPCS 3.4.1 — 0 errors
- PHPStan: level 9 — 0 errors
- PHPCompatibility: 8.0–8.5 — 0 issues
- PHPUnit: 9.6.36 — 87 tests, 180 assertions
Downloads
- Fatal error on the login screen with newer WordPress versions: the