Skip to content

v0.5.1 — Foundation: PHPStan + security hardening

Choose a tag to compare

View all tags
@oxyc oxyc released this 29 May 14:54
· 12 commits to master since this release
v0.5.1
305e351
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

No-behaviour-change maintenance release. Defensive cleanup that pairs with gds-assistant v0.4.3.

Foundation (CI)

  • PHPStan level 5 added to the lint job. 97 pre-existing errors fixed: RestDelegation namespace fallback (rest_namespace is typed bool|string, never null — the ?? defaulted to the wrong branch), dropped two unused constructor args from PostTypeAbility/TaxonomyAbility, tightened return types on RestoreSnapshot::deleteTerm + ::bulk (they can't return WP_Error), removed ?? [] on always-array fields and a redundant count > 0 guard. New static-analysis regressions now fail the lint job.

Security hardening

  • XPath DoS guards on gds/web-fetch. Expressions over 1000 chars are rejected with a clear error, and the pathological //.//.//.// recursive-descent pattern is short-circuited before libxml gets a chance to OOM. Stops a class of input-driven worst-case parsing.
  • Try/finally on media temp files in MediaUploadAbility::sideloadAndRespond — orphans no longer leak when the sideload fails partway through.

Misc

  • Dynamic-block guard in PatchBlockAbility simplified to a single is_callable check (the prior chain confused PHPStan into emitting unreachable-branch warnings).
  • Test fixture: PostTypeAbilityTest / DeleteAbilitiesTest / AcfIntegrationTest updated to the 3-arg constructor signature (extras were being silently dropped, masking the test fixture drift in CI).

Full changelog: v0.5.0...v0.5.1

Assets 2
Loading