BOGO Select for WooCommerce 2.3.8
Install: download bogo-select-2.3.8.zip below, then WordPress → Plugins → Add New → Upload Plugin.
[2.3.8] — 2026-08-02
Level 9, and a correction to why 2.3.7 said it was out of reach.
The analyser now runs at its maximum with no baseline and nothing suppressed.
Getting there was mostly declaring shapes that were already true rather than
guarding against values that could not occur. The runtime change is that a cart
line's numbers are read through the same normaliser as request input instead of
cast, so an array refuses where it used to become 1 — behaviour changes only for
input that was never valid, which makes this a PATCH.
Changed
-
Static analysis raised to level 9, and the reason 2.3.7 gave for stopping
was wrong. That entry said the level was not worth taking, on two
conclusions that do not survive checking. Both are corrected here rather than
in place, since 2.3.7 shipped with them.It said threading the settings shape through the admin sanitizer made things
worse, 41 findings becoming 80. It did not. The@phpstan-import-typeline
had never reached the file — the script meant to add it aborted before
writing — soBogoSettingsresolved to nothing and every read of it became
"access to an offset on an unknown class". With the import actually present,
the same change removes 21 findings.It said the cart-item casts needed eighteen
is_scalar()branches no cart
WooCommerce builds could reach. Most of them wanted a shape declared instead:
state()andvariation_options()both build arrays with known keys and now
say so. The reads that genuinely come from a cart line — which any extension
may add to — go through the sameto_id()helper as any other untrusted
value, which is shorter than the cast it replaced and refuses an array where
the cast would have produced 1.Nothing was suppressed and there is still no baseline. What changed is that a
tool reporting more errors after a change is evidence about the change, and
it had been read as a verdict on it.