Conversation
Reported by QA in the release thread. Each was reproduced before being touched, and one turned out not to be a bug. * Fix - the FAQ tab never expanded or collapsed. Its accordion markup and toggle script both shipped, but the stylesheet had no rule for any of the accordion classes, so every answer was permanently open and the questions rendered as plain text with nothing to suggest they were clickable. The closed state has to come from CSS: the script opens a panel by setting an inline max-height and closes it by clearing that value, so with no max-height: 0 to fall back to there was no closed state at all. Verified: panel measures 0px closed, opens on click, closes again. * Fix - settings tabs rendered an empty Products Per Page box on a site whose options had never been saved. All four partials read their option with no default, and that field had no fallback of its own. Reproduced by deleting the options; verified fixed in the same state. * Improve - multisite uninstall now uses get_sites() instead of querying $wpdb->blogs directly. The old line also carried a phpcs:ignore that silenced the prepared-SQL sniff rather than resolving it. * Dev - the user guide no longer ships in the release zip. * Dev - settings registrations name their sanitize callback explicitly. REFUTED, with evidence: the report that four register_setting() calls lack a sanitize_callback and therefore "store raw unsanitized input" is not correct. WordPress core back-compats a bare callable third argument - option.php wraps it as sanitize_callback when is_callable( $args ) - so the validators were running the whole time. Proven behaviourally rather than by reading core: submitting a Products Per Page of 999 stored 100, which is the clamp inside validate_general_settings(). The key is now spelled out anyway, because the old form reads like the callback is ignored and is one deprecation away from that being true - and re-running the same 999 test after the change still stores 100.
1.3.0 was announced for verification and has not gone out to customers yet, so the five fixes QA raised against it belong in that release rather than in a patch version that exists only because the findings arrived the same day. Version returns to 1.3.0 across header, constant, readme and package.json, and the changelog bullets join the matching Fix / Improve / Dev runs in the 1.3.0 entry instead of standing as their own section. Anyone who already pulled the earlier v1.3.0 asset needs to pull it again - the tag now points at different code.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Five findings QA raised against the 1.3.0 release. Four were real and are fixed; one is refuted with runtime evidence.
max-heightand closes it by clearing that value, so with nomax-height: 0there was no closed state and every answer was permanently open.get_sites()instead of querying$wpdb->blogsdirectly, removing the sniff suppression rather than adding another.user-guide.mdno longer ships in the zip.register_setting()calls store raw unsanitized input. Core back-compats a callable third argument, so the validators were always running - proven by submitting 999 for Products Per Page and getting the validator's clamp of 100. The key is spelled out anyway for readability.Folded into 1.3.0 rather than a 1.3.1: that release is still with QA and has not reached customers.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Lbi1bWYKU6PEMGcm2fx7VF