Skip to content

BOGO Select for WooCommerce 2.3.8

Choose a tag to compare

@johnjanney johnjanney released this 02 Aug 05:17
· 24 commits to main since this release

Install: download bogo-select-2.3.8.zip below, then WordPress → Plugins → Add New → Upload Plugin.

[2.3.8] — 2026-08-02

Level 9, and a correction to why 2.3.7 said it was out of reach.

The analyser now runs at its maximum with no baseline and nothing suppressed.
Getting there was mostly declaring shapes that were already true rather than
guarding against values that could not occur. The runtime change is that a cart
line's numbers are read through the same normaliser as request input instead of
cast, so an array refuses where it used to become 1 — behaviour changes only for
input that was never valid, which makes this a PATCH.

Changed

  • Static analysis raised to level 9, and the reason 2.3.7 gave for stopping
    was wrong.
    That entry said the level was not worth taking, on two
    conclusions that do not survive checking. Both are corrected here rather than
    in place, since 2.3.7 shipped with them.

    It said threading the settings shape through the admin sanitizer made things
    worse
    , 41 findings becoming 80. It did not. The @phpstan-import-type line
    had never reached the file — the script meant to add it aborted before
    writing — so BogoSettings resolved to nothing and every read of it became
    "access to an offset on an unknown class". With the import actually present,
    the same change removes 21 findings.

    It said the cart-item casts needed eighteen is_scalar() branches no cart
    WooCommerce builds could reach. Most of them wanted a shape declared instead:
    state() and variation_options() both build arrays with known keys and now
    say so. The reads that genuinely come from a cart line — which any extension
    may add to — go through the same to_id() helper as any other untrusted
    value, which is shorter than the cast it replaced and refuses an array where
    the cast would have produced 1.

    Nothing was suppressed and there is still no baseline. What changed is that a
    tool reporting more errors after a change is evidence about the change, and
    it had been read as a verdict on it.