Conversation
Contributor
|
Test merged PR on Playground |
Contributor
Composer package changes
|
Contributor
✅ Code Coverage Report
🎉 Great job maintaining/improving code coverage! ℹ️ About this report
|
The site icon and Yoast organization logo pickers assembled their preview <img> by concatenating attachment metadata into an HTML string and assigning it to innerHTML. Both now build the node with createElement and property assignment, so no HTML string is parsed and attachment metadata is always handled as an attribute value rather than as markup. This follows the same reasoning as the existing textContent usage in updateTaskTitle(). Verified with jsdom that metadata containing quote characters round-trips as a value and does not become markup. Note: the Yoast logo picker's alt fallback still reads "Site icon preview", which looks like a copy-paste artifact. Left as-is to avoid mixing a user-visible string change into this commit. Verified: JS lint clean, PHPCS clean, PHPUnit 404 tests / 1216 assertions passing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…in-check Fix Plugin Check CI: remove stored Composer credential, bump plugin-check-action
Add year-specific monthly badge names with 2026 names
Two copies of get_post_types_names() existed: Settings::get_post_types_names() and Content_Helpers::get_post_types_names(). The Settings version has become the canonical one -- it is what the newer suggested-task and data-collector classes call, it carries the init-timing guard, and it is where the exclusion list is maintained. The Content_Helpers copy had drifted behind, and its filtering logic differs in three ways: - It does not exclude elementor_library, which Elementor registers as public + viewable, so it passes the viewability check. - It does not honour the progress_planner_public_post_types filter. - Its empty-case fallback returns a raw [ 'post', 'page' ] without checking those post types are still registered and public. Each copy holds its own static cache, warmed independently on first call. In a normal request both warm after init and agree, so the drift is latent rather than actively breaking sites -- but two functions answering the same question no longer share filtering rules, and any future change to the exclusion list or the filter lands in only one. Point the six remaining Content_Helpers call sites at Settings and reduce Content_Helpers::get_post_types_names() to a deprecated shim so external callers keep working. All six run well after init (shutdown, wp_insert_post, admin widget rendering), so no call site is moved earlier by this change. The null guards in Content_Scan and Content are left in place: they still protect the get_activity_from_post() calls in those methods, and in Content_Scan::get_total_pages() the guard doubles as a deliberate circuit-breaker that halts the scan during plugin updates. Implements #433.
…ypes-names Consolidate get_post_types_names() into Settings
test_delete_rejects_suggested_term_that_gained_posts created the task row before attaching posts to the term. By the time the handler ran, no matching task existed, so the request was rejected by the task-binding check and never reached the post-count re-check the test is named for. Removing the count guard entirely left all six tests passing. Attach the posts first, then record the task, and assert on the specific rejection message so the test cannot silently drift to a different guard again. Verified by mutation: removing any one of the four guards (count re-check, delete binding, update binding, public-taxonomy) now fails at least one test.
…-task-handlers Harden interactive task handlers
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
The suggested-tasks list is already filtered per-user by each provider's capability, and many tasks are actionable at editor level, so gate the widget on edit_others_posts. Admin-only tasks and actions stay gated by their own capabilities. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
Harden plugin install
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
Merged
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
The redirect-on-login setting was removed when the Settings page was converted to interactive tasks, and its user meta is cleaned up by the 1.10.0 update migration. The handler, its wp_login hook, and the unused setter were left behind and could no longer be reached, so remove them. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
get_task_id_from_slug() could receive a null post_name/task_id, which triggers a deprecation notice from explode() on PHP 8.1+. Cast to string. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
Plugin Check flagged autoload.php and the two dashboard-widget views as missing the ABSPATH direct-access guard the other views already have. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
Keep the use declaration as the first statement so the file lints cleanly across PHP versions; the direct-access guard still runs before any code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
The guard broke the parallel-lint checkstyle CI step; autoload.php is not web-reachable in practice, so drop the guard rather than fight the linter. The dashboard-widget view guards are kept. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
Prepare 1.10.0 release
…flicts # Conflicts: # classes/admin/class-page-settings.php # classes/class-suggested-tasks.php # classes/utils/class-color-customizer.php # composer.lock # progress-planner.php # readme.txt # tests/phpunit/test-class-rest-recommendations-xss.php
Resolve 1.10.0 release conflicts (merge main into develop)
CHANGELOG.md had only a one-line 1.10.0 stub and was missing the 1.9.1 entry entirely. Bring it in line with readme.txt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MyrQ9chLywiezXaY9MZz8t
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.