v0.3.7

What's Changed

Security

• Skip files containing .. in their filename during zip export to prevent path traversal entries (e.g., filenames like photo..jpg)
• Logs a WP-CLI warning for each skipped file so operators know what was excluded

Full Changelog: v0.3.6...v0.3.7

v0.3.6

What's Changed

Features

• Add GitHub URI header to plugin file, enabling automatic updates via wp-git-updater from GitHub Releases

Improvements

• Add Requires at least and Requires PHP headers for WordPress compatibility metadata
• Align plugin header formatting

Full Changelog: v0.3.5...v0.3.6

v0.3.5

What's Changed

Bug Fixes

• Fix serialized objects nested inside arrays crashing the user import. The v0.3.4 fix only caught top-level serialized objects with is_object(). Objects nested inside serialized arrays (e.g. Yoast SEO Indexing_Notification_Presenter) still triggered the map_deep() / __PHP_Incomplete_Class fatal error. The fix now inspects the raw serialized string for PHP object signatures (O:\d+:") at any nesting depth before attempting deserialization.

Full Changelog: v0.3.4...v0.3.5

v0.3.4

What's Changed

Bug Fixes

• Fix fatal error when importing user meta that contains serialized PHP objects (e.g. WP_User). Previously, unserialize() with allowed_classes => false produced __PHP_Incomplete_Class objects that crashed map_deep() inside update_user_meta(). The importer now skips object meta values with a warning and continues the import.

Internal

• Version bump to 0.3.4

Full Changelog: v0.3.3...v0.3.4

v0.3.3 — Security & Modernization Audit

Summary

Complete security and modernization audit of MU-Migration. 32 defects identified and fixed.

Highlights

• Dependency removal: Replaced abandoned alchemy/zippy with native PHP ZipArchive
• PHP 8.0+ required: Updated minimum version, uses str_contains(), random_bytes(), named constants
• Deprecated API cleanup: Replaced insert_blog(), get_blog_details(), $GLOBALS['current_site']
• Defense-in-depth hardening: Input validation, path traversal guards, atomic file writes, argument sanitization
• CI modernization: Replaced .travis.yml with GitHub Actions

Fixed Defects

ID	Description
DEF-001	DB prefix format validation
DEF-003	Replace deprecated insert_blog() with wp_insert_site()
DEF-006	Replace deprecated get_blog_details() with get_site()
DEF-008	Zip path traversal protection
DEF-010	Atomic map file writes
DEF-011	Cross-filesystem rename fallback
DEF-012	Idempotent site creation
DEF-013	Plugin destination path validation
DEF-017	Role validation before set_role()
DEF-018	Password hash format validation
DEF-019	Replace deprecated $GLOBALS['current_site']
DEF-020	Stop resetting $wp_actions
DEF-021	Include all tables with prefix in search-replace
DEF-022	Warn on multiple user matches
DEF-025	Sanitize runcommand() argument keys
DEF-026	Table name validation
DEF-027	Remove error suppression in delete_folder()
DEF-028	Guard fgets() false return
DEF-029	i18n — accepted as-is (CLI tool, no translations)
DEF-030	Atomic rename in addTransaction()
DEF-031	Validate blog_id before switch_to_blog()

Breaking Changes

• PHP 8.0+ required (was 7.1)
• ext-zip required (replaces alchemy/zippy)
• helpers.php function extract() renamed to extract_zip()

🤖 Generated with Claude Code