2.3.0 - automatic updates, e-mail reports, GitHub webhook

Scheduled automatic updates

• New Automatic updates panel on the Settings tab: a checkbox, a preferred hour (site time zone) and a list of e-mail addresses.
• Once a day the plugin checks GitHub and installs the newest release when it is newer than the installed one, through the same sequence as the Update button: lock, backup, verification, copy, automatic rollback on failure, entry in the operation log. Nothing newer means nothing happens.
• Releases mode only; a branch has no version number to compare.
• The panel, the Instructions tab and the README FAQ explain why the run can be later than the chosen hour (WP-Cron needs a request, page caches, DISABLE_WP_CRON, a held lock, time zone and DST changes, a busy server) and how a system cron makes the time exact.
• Run now and Send a test e-mail buttons to try the whole chain while watching.

E-mail reports

• Every automatic update, successful or failed, sends a plain text report: previous and new version, trigger, backup name, number of files, protected paths, link to the plugin screen and the release notes written on GitHub.
• A failed GitHub check is reported once per distinct error. Manual updates from the Update tab are not e-mailed.
• Filters gthu_notification_recipients and gthu_notification_message.

GitHub webhook

• Optional endpoint POST /wp-json/gthu/v1/release, registered only while the feature is on, so the site updates the moment a release is published.
• Every delivery must carry GitHub's X-Hub-Signature-256 (HMAC-SHA256 under a 64-character secret generated by the plugin, stored encrypted, shown once; GTHU_WEBHOOK_SECRET constant supported), compared in constant time.
• Only "release published" events for the configured repository are accepted; drafts and (unless enabled) pre-releases are ignored, delivery IDs are remembered, oversized bodies are refused.
• The payload never decides what is installed: a verified delivery only queues a normal automatic run, which fetches the release list with the site's own token.

Also

• The operation log names automatic entries: "Automatic (schedule)" and "Automatic (GitHub webhook)".
• New action gthu_auto_update_finished after every automatic run.
• Polish translation updated for every new string; new unit tests for the schedule helpers, recipient parsing and webhook verification.
• README, README.pl and CHANGELOG describe the features, with new FAQ entries.

Full details: CHANGELOG.md

GitHub Theme Updater 2.2.0

First public release of GitHub Theme Updater - a WordPress plugin that updates a theme straight from a GitHub repository, private ones included, with backups, one-click rollback, protected paths and live progress.

Highlights in 2.2.0

• Live update progress - the Update tab lists every step (release lookup, download, unpack, deletability check, backup, cleanup, copy, finish), a running file count and the elapsed time. Opening the tab while an update runs elsewhere picks the progress up. Works without JavaScript too.
• Ignored paths (.git and node_modules by default) - left out of backups, never installed from the archive and never touched on disk. Keeps a backup of a theme full of dev leftovers from hitting the PHP time limit.
• Operation log - the last 5 updates and restores, failed ones included, with version, result, file count, author and duration.

Fixed

• Path traversal in the backup identifier (.. is rejected).
• Lock race between two clicks in the same second - the lock is now a single INSERT IGNORE on wp_options; manual backups take the same lock.
• Double token encryption when saving an already encrypted value.
• Implicitly nullable parameters deprecated in PHP 8.4 (8.4 added to CI).
• An undeletable file halfway through cleanup could leave the site without a theme.

Requirements

WordPress 5.8+, PHP 7.4+. Licence: GPL-2.0-or-later.

Install

Download the ZIP below, then Plugins → Add New → Upload Plugin. Full documentation in the README.