Skip to content

v0.5.1 — dual-license + WP-org Plugin Check pre-submission pass

Choose a tag to compare

View all tags
@ejosterberg ejosterberg released this 16 May 00:56
· 11 commits to main since this release
v0.5.1
fc13403

Highlights

Two related changes shipped together to make v0.5.1 ready for WordPress.org plugin-directory submission.

1. Dual-license: Apache-2.0 OR GPL-2.0-or-later

Previously Apache-2.0 only. Recipient now picks:

Mirrors the Odoo connector's LGPL/AGPL pattern. Pre-empts the WP-org reviewer's "GPL compatible?" challenge.

2. WordPress.org Plugin Check pre-submission pass

From 4 ERRORS + 27 WARNINGS down to 0 ERRORS + 1 WARNING (see Known caveat below). Full Plugin Check output: specs/plugin-check/v0.5.1-final.csv.

Per-fix categories:

  • Escaping — composed-HTML output (DashboardWidget::render, OrderTaxBreakdown::renderOrderDetails) now passes through wp_kses_post(); settings table-cell renders esc_attr() every attribute; CLI fallback terminal output is esc_html'd.
  • Input sanitization — Settings::saveTaxClassMap and ConnectionTester::handle now verify nonces defensively and unslash + sanitize_text_field() every $_REQUEST / $_POST value. New unit test for the bad-nonce path.
  • Logging — every error_log() replaced with wc_get_logger()->warning(...) via a logWarning() helper; falls back to error_log only when WC isn't loaded (unit tests).
  • URL parsing — UrlValidator uses wp_parse_url() instead of bare parse_url().
  • SQL annotations — direct $wpdb calls (placeholder-rate management, cache flush, dashboard widget aggregate) carry inline phpcs:ignore comments explaining the controlled-input table-name interpolation pattern. All user-supplied values bind through prepare().
  • Bootstrap hygiene — main plugin file wraps autoload in an IIFE; WC tested up to bumped 10.5 → 10.7; readme.txt Tags trimmed to the WP-org-allowed five; heredoc JS rewritten as string-concat.

Tests

  • 115 unit tests (+1 vs. v0.5.0); PHPStan max + PHP-CS-Fixer + composer audit all clean.
  • Plugin Check verified on VM 907 (WP 6.9.4 + WC 10.7 + PHP 8.4).

Known caveat — blocks WP-org submission until addressed in v0.6

The trademarked_term WARNING: WP-org's trademark policy restricts the bare "woocommerce" term in a plugin slug unless paired with one of the allowed prefixes (for woocommerce, with woocommerce, using woocommerce, and woocommerce). The WP-org reviewer will treat this as a hard reject.

The rename opensalestax-woocommerce → opensalestax-for-woocommerce touches the repository name, deployment paths, text-domain string, and every __() call — deferred from v0.5.1 to its own dedicated minor.

Upgrade notes

Pure source-level cleanup + license clarification. No DB schema changes, no settings changes, no behavior changes. Drop-in upgrade.

See CHANGELOG.md for the per-fix details.

Assets 2
Loading