Skip to content

Release - #1364

Merged
kushh23 merged 19 commits into
masterfrom
development
Sep 11, 2026
Merged

Release#1364
kushh23 merged 19 commits into
masterfrom
development

Conversation

@selul

@selul selul commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Linked issues

This release will close the following issues once merged:

Public changelog

  • Fixed an error usage of a chart's settings were stored as a string instead of an array.
  • Update dependencies
  • Fixed frontend chart failures when saved series settings are invalid.
  • Fixed script execution from saved JSON chart credentials. Thanks Yaswanth Reddy Sunkara for the report.
  • Updated dependencies

pirate-bot and others added 7 commits July 30, 2026 13:05
A published chart whose visualizer-settings meta resolves to a string
crashed Visualizer_Module_Setup::getUsage() with a PHP 8 TypeError at
the unchecked array_key_exists() call, aborting the whole Themeisle SDK
usage collection request. Guard the settings read, harden the sibling
pro-permissions meta read the same way, and drop the dangling
visualizer_logger_data registration in Visualizer_Module_Admin, which
points to a method that class never had and fatals the same filter once
the first crash is fixed.

Fixes #1359

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Copilot review follow-ups: a string where an array-valued permission is
expected (e.g. permissions.edit-specific) still crashed the usage
logger via count() on PHP 8 — guard it and cover the pro branch through
the visualizer_is_pro filter with a stubbed Visualizer_Pro. Also clear
leftover charts before the e2e usage assertions, matching the other
chart-counting specs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
An object stored in permissions['permissions'] passed the array guard and
then fatalled on the array offset read, aborting usage collection.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps [codeinwp/themeisle-sdk](https://github.com/Codeinwp/themeisle-sdk) from 3.3.57 to 3.3.58.
- [Release notes](https://github.com/Codeinwp/themeisle-sdk/releases)
- [Changelog](https://github.com/Codeinwp/themeisle-sdk/blob/v3.3.58/CHANGELOG.md)
- [Commits](Codeinwp/themeisle-sdk@v3.3.57...v3.3.58)

---
updated-dependencies:
- dependency-name: codeinwp/themeisle-sdk
  dependency-version: 3.3.58
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ettings

fix: keep usage logger alive when chart settings meta is not an array
@pirate-bot

pirate-bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Plugin build for f54c21c is ready 🛎️!

selul and others added 9 commits August 4, 2026 10:33
…t/codeinwp/themeisle-sdk-3.3.58

chore(deps): bump codeinwp/themeisle-sdk from 3.3.57 to 3.3.58
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…overs this repo) [skip ci]

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…WP 7.1+

wp_http_validate_url() now rejects link-local/private IP literals itself, which
collapsed the visualizer_unsafe_remote_url error into visualizer_invalid_remote_url
and broke test_blocks_redirect_to_link_local_destination.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
WordPress 7.1 always renders the post editor in an iframe, and styles enqueued
via enqueue_block_editor_assets only reach the parent document, leaving the
visualizer/chart placeholder unstyled and breaking its e2e specs. Registering
the stylesheet as the block type's editor_style gets it injected into the
canvas on every core version.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
WordPress 7.1 always renders the canvas in an iframe, so page.* locators no
longer reach block content; editor.canvas works on both old and new cores.
The create-chart popup frame is now selected by its admin-ajax src because
the canvas iframe would otherwise match first, and Edit Chart is asserted in
the parent document where BlockControls render.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bumps [codeinwp/themeisle-sdk](https://github.com/Codeinwp/themeisle-sdk) from 3.3.58 to 3.3.61.
- [Release notes](https://github.com/Codeinwp/themeisle-sdk/releases)
- [Changelog](https://github.com/Codeinwp/themeisle-sdk/blob/v3.3.61/CHANGELOG.md)
- [Commits](Codeinwp/themeisle-sdk@v3.3.58...v3.3.61)

---
updated-dependencies:
- dependency-name: codeinwp/themeisle-sdk
  dependency-version: 3.3.61
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
selul and others added 3 commits September 10, 2026 18:01
* fix: validate chart series before counting

* ci: use PHP 8.2 for browser test environments

* fix: initialize missing settings in chart REST responses

* test: exercise boolean and empty series metadata on both sides

WordPress stores a scalar false meta value as an empty string, so the boolean series case is injected through the get_post_metadata filter.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) from 2.2.6 to 2.2.13.
- [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits)

---
updated-dependencies:
- dependency-name: phpstan/phpstan
  dependency-version: 2.2.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
)

* fix: sanitize JSON data source headers to prevent XSS vulnerabilities

* fix: update PHP version to environment configuration

* fix: ensure visualizer settings is an array to prevent errors

* fix: add tests to sanitize JSON data source credentials

* fix: preserve credential bytes
@kushh23
kushh23 merged commit d3c57da into master Sep 11, 2026
10 checks passed
@pirate-bot

Copy link
Copy Markdown
Contributor

🎉 This PR is included in version 4.0.8 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@pirate-bot pirate-bot added the released Indicate that an issue has been resolved and released in a particular version of the product. label Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

compatibility-reviewed released Indicate that an issue has been resolved and released in a particular version of the product.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Frontend chart rendering fatals when settings series is false Usage logger crashes when chart settings meta is a string

5 participants