AdminConfig 0.7.0

This release closes out the 2026-08-14 code quality audit (HIGH fixes, dead code, duplication, correctness boundaries, contract drift, test quality, and low-severity findings).

Added

• EntityContainerSupport trait: shared schema state, flash consumption, and nonce output for the metabox, taxonomy, profile, and comment containers.
• ValidationTargetResolver: single implementation of tab/subsection routing for admin redirects and REST responses.
• RuntimeBootstrapper: unified plugin/embedded boot scheduling (both now boot with a null registrar).
• WpDebug::enabled(): shared WP_DEBUG check.
• FieldValueHelper::sanitize_media_value(): unified media payload sanitization (attachments and url-only values).
• E2E coverage for the non-JS options page form (classic-form-submit.spec.js, JavaScript disabled).
• Unit coverage for OptionsPage::handle_save()/render_page(), the FieldDependencyEvaluator operator matrix, ValidationFlash, register_menu(), and lifecycle hook ordering.

Changed

• typography/fieldset/group nested inside a group/repeater now render an explicit "cannot be nested" warning instead of a silently cleared text input.
• color/palette/icon sanitizers store explicit empty submissions and only fall back to schema defaults for missing keys.
• Framework::render_options_page() parameter renamed $network → $register_hooks to match its actual meaning.
• MetaBackend::write() distinguishes no-change updates from real failures (mirrors OptionBackend).
• MetaboxContainer renders every schema section instead of silently dropping all but the first.
• REST protocol: removed the always-true supported field; editable/read-only/unsupported classification is a local client decision.
• Renamed I18nStrings to AdminPageConfig (runtime config, not translations).
• Test stubs now honor action priority and accepted argument counts; add_submenu_page stub added.
• php_codesniffer bumped to 3.13.6 (CVE-2026-67434).

Fixed

• Data-source responses no longer treat plain lists as key/value maps (values were becoming '0'/'1').
• MetaBackend::write() returns bool instead of the raw meta id (fixed a fatal on every container save against real WordPress).
• Tabbed fields fall back to the first panel when default_tab names an unknown panel.
• image_select no longer rewrites valid choice keys through sanitize_key().
• Media fields preserve url-only payloads instead of dropping them.
• Container registry keys are sanitized on registration, matching the sanitized lookups.

Removed

• Dead code: the unused wp.data store (resources/store/), SchemaController::schema()/schemas(), legacy_client_config(), registry all()/enable_all()/is_builtin(), the replace/override_builtin registration flags, and unused JS exports.

AdminConfig 0.6.0

What's Changed in 0.6.0

Added

• SECURITY.md with private vulnerability disclosure via GitHub Security Advisories
• Tag-triggered release workflow with SHA256 checksums
• composer audit and npm audit --audit-level=critical CI gates
• PHP 8.4 in the CI quality matrix
• Public OptionsPage::lifecycle() and field_control_renderer() accessors

Changed

• PHPStan upgraded from level 5 to level 7
• Containers migrated to call ContainerFieldRenderer / OptionsPageLifecycle directly
• add_meta_box context parameter validated (normal/side/advanced)
• pages.yml actions pinned to commit SHAs
• wp-coding-standards/wpcs updated to 3.4.1 (CVE-2026-45293)

Removed

• 17 redundant phpcs:disable WordPress.Files.FileName comments
• Three .patch development artifacts

Full Changelog: 0.5.1...0.6.0

AdminConfig 0.5.1

Changed

• Framework gained render_options_page( $definition, OptionStore $store, bool $network = false ), a factory that builds an OptionsPage against an already-resolved store. mount_options_page() now delegates to it internally.
• CommentContainer, ProfileContainer, TaxonomyContainer, and MetaboxContainer no longer each hand-construct OptionsPage with the same six constructor arguments — they call Framework::render_options_page() instead. OptionsPage's constructor now has a single call site outside Framework itself, so future signature changes touch one file instead of five.

What's Changed

• Render options page factory by @lermnote in #2

Full Changelog: 0.5.0...0.5.1

AdminConfig 0.5.0

What's Changed in 0.5.0

Changed

• Decomposed OptionsPage (~1500 lines, ~55 methods) into six focused classes under src/Framework/Admin/:
  • OptionsPage — core orchestrator (659 lines, 23 methods; -58%)
  • ContainerFieldRenderer — nested containers + flat field rows
  • FieldDependencyEvaluator — pure dependency-matching logic (no WP globals)
  • SubmissionStateResolver — flash/validation/tab routing
  • SchemaDebugPanel — runtime debug introspection panel
  • OptionsPageLifecycle — menu registration + asset enqueueing
• Extracted FieldAttributeHelpers trait to deduplicate field attribute escaping, boolean flag reading, nested warning rendering, and number input action buttons across six field type classes

Full Changelog: 0.4.2...0.5.0

AdminConfig 0.4.2

What's New

Added

• docs/field-types/ — usage examples for every built-in field type, grouped by category.
• .gitattributes with export-ignore rules so docs/, examples/, tests/, tools/, and dev tooling files are excluded from the Composer distribution archive.
• MAINTAINING.md consolidating the manual smoke checklist and release checklist for maintainers.

Changed

• Moved the manual smoke checklist and release checklist out of the public documentation site into MAINTAINING.md.
• Updated documentation and code examples; removed translation functions for labels.

Full Changelog: v0.4.1...v0.4.2

AdminConfig 0.4.1

Full Changelog: 0.4.0...0.4.1

AdminConfig 0.4.0-alpha

Changelog

CI

• fix: Use system Chrome (PLAYWRIGHT_CHANNEL=chrome) instead of downloading Playwright Chromium — fixes hanging CI jobs
• fix: Use lowercase admin-config in wp-env container paths for Docker compatibility
• perf: Cache Playwright browsers in CI

Code Review Fixes

• fix: Extract ContextResolver::from_request() outside nested loop in RestEndpoints
• fix: Remove inconsistent function_exists('use_block_editor_for_post_type') guard in MetaboxContainer
• fix: Use self::MAX_IMPORT_SIZE constant for import size check, narrow try/catch scope in SchemaController
• fix: Delegate capability check in debug_panel_enabled() to $this->capability() in OptionsPage
• fix: Extract shared ContainerSaveSupport::capability_for_schema() helper for container capability logic

Extraction

• Extracted from monorepo lermnote/lerm with full 345-commit history via git subtree split
• Standalone package installable via Composer (lerm/admin-config)

---

🤖 Generated with Claude Code