25 releases 25 tags

RSS feed

• 1.8.1 27ce69c2d2

  Compare

  v1.8.1 Stable

  javier released this 2026-09-23 06:10:24 +00:00 | 1 commits to main since this release

  1.8.1

  Release date: 2026-09-22

  Fixed

  • Pending updates now appear on sites where the WordPress.org update check never completes (api.wordpress.org unreachable, blocked, or firewalled hosts — common on a lot of servers). Robotstxt_Manager_Updater moved from the write-side hook (pre_set_site_transient_update_plugins, which only fires when a full wp_update_plugins() cycle finishes) to the read-side filter (site_transient_update_plugins, which fires every time anything reads the update data: Plugins screen, Updates page, WP-CLI, auto-updates). Local versions are resolved from get_plugins() instead of the transient's checked list, which never exists in those environments. Diagnosed and verified end-to-end against the live store: update detection, listing (wp plugin list), dry-run, and the actual update run all work now even with api.wordpress.org blocked.
  • Stale Manager-owned update entries no longer mask newer versions: WordPress persists the filtered read during a (failed) update check, so a previously injected entry can sit in the stored transient forever. The updater now recognizes its own entries (package URL host matches the store) and replaces or removes them with fresh catalog data — killing stale-version masking, phantom "update available" badges after updating, and expired download tokens in one guard. Entries from other update servers (bundled SDKs pointing elsewhere, WordPress.org) are never touched.
  • Premium download-token exchanges are now cached (5-minute site transient, failures negatively cached for 1 minute): without the cache, every read of the update data while a premium update is pending triggered a blocking HTTP call to the store — several per admin page load.
  • Opt-in data deletion on uninstall now also removes the cached subscriptions site transient (robotstxt_manager_subscriptions) — previously only the catalog transient was deleted, so subscription data could outlive the plugin when "Delete all plugin data" was enabled.
  • A hardcoded "Subscribed" fallback label in the multi-license catalog pill (unknown subscription status with more than one license) is now translatable like every other pill label.

  Changed

  • PHPStan raised from level 9 to max (level 10); the two mixed-strictness findings it surfaced were fixed with real narrowing (AUTH_KEY/AUTH_SALT string checks in the encryption key derivation, the plugins_api slug check).

  • Robotstxt_Manager_Core_Client::get_subscriptions() normalizes rows restored from the transient cache the same way get_catalog() does (string keys enforced) — resolves the single level-9 error surfaced by PHPStan 2.2.14; no behavior change.

  • Development tooling updated via composer update: phpstan 2.2.8 → 2.2.14, phpstan-wordpress 2.0.3 → 2.0.4, wordpress-stubs 6.9.4 → 7.1.0, wp-hooks/wordpress-core 1.12.0 → 1.13.0, nikic/php-parser 5.8.0 → 5.9.0.

  • Tests: dropped ReflectionMethod::setAccessible() calls (no-op since PHP 8.1, deprecated on PHP 8.5) so the suite runs notice-free on the maximum supported PHP version. Regression tests cover the "WordPress.org check never completed" transient shape, the false transient, stale own-entry replacement/removal, and download-token caching.

  Compatibility

  • WordPress: 4.4 - 7.1 (scan-verified 2026-09-22: wp-compat ladder clean from 4.4; verified across 4.4-7.1 with WordPress stubs 7.1.0 — no API newer than 4.4 in use, so 7.1 GA remains covered; 7.2 is not GA)
  • PHP: 8.0 - 8.5 (scan-verified 2026-09-22: PHPCompatibility ladder 5.6-8.5 + manual audit — str_contains(), str_starts_with(), and mixed type hints keep the real floor at 8.0)

  Tests

  • PHPCS (WordPress-Core, WordPress-Docs, WordPress-Extra): pass
  • PHPStan max (level 10) + wp-compat: pass
  • PHPUnit: 152 tests, 401 assertions
  • composer audit: no known CVEs

  Downloads

  • robotstxt-manager-1.8.1.zip
    2 downloads · 2026-09-23 06:10:02 +00:00 · 100 KiB