v0.2.3 — the change hook reports scope, and src/ passes no text domain

Released 2026-10-07. More from review on the core patch,
#66187. The public functions have the same
signatures as 0.2.2. The wp_secret_changed action gains an argument, which matters to
anyone who has written a provider.

Changed

• wp_secret_changed passes $network as a seventh argument. It is true for a network-scope
  secret and false for a site-scope one. Before this, a listener could not tell a network secret
  from a site secret of the same name. A listener registered for six arguments or fewer is
  unaffected. See ADR 0012.
• A provider is now tested for firing the hook. The API does not fire wp_secret_changed on a
  provider's behalf, so a drop-in that left it out silenced a site's audit log without anything
  noticing. WP_Secrets_Provider_Conformance now checks a write, an overridden action, a delete,
  a retired version, a network-scope change, and a refused write. The interface states the
  requirement on delete() and retire_previous() as well as set().
• src/ passes no text domain to translation functions. Core leaves the argument off for its
  own strings instead of naming 'default'. The strings are unchanged.

Fixed

• The AWS Secrets Manager example did not fire wp_secret_changed on delete. The new
  conformance tests found it.

If you have written a provider

Add (bool) $network as the last argument of each do_action( 'wp_secret_changed', ... ) call,
and run the conformance suite. Both example providers show the change.

Examples

• The one translated string in the examples uses the secrets-api text domain. The examples are
  not part of the core patch, so they do not share core's.

Changelog: https://secretsapi.dev/changelog/0-2-3/