Skip to content

v0.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jul 22:49
v0.3.1
4aaf51c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Square Terminal for WooCommerce 0.3.1

Critical fix. Required for every install. Prior distributed builds could not make any Square API request.

Fixed

  • Square API requests never left the server. The Square SDK resolves an HTTP client at runtime through php-http/discovery, which searches for well-known class names. Two things defeated it: no concrete PSR-18 client was ever a dependency of this plugin, and php-scoper rewrites the class names discovery looks for. Every Square call therefore threw NotFoundException before sending, which the error mapper reported to operators as the misleading "Unable to reach Square. Please try again."

    This affected everything that talks to Square — Terminal checkouts, device discovery, and settings validation. A PSR-18 client is now a runtime dependency and is handed to the SDK explicitly, so discovery is never consulted.

  • The build could ship an autoloader that could not load its own dependencies. The scoped-vendor autoloader was generated from a hand-maintained namespace map; anything not in that list was unreachable in the built plugin. The map is now derived from Composer's generated autoload data, and the build fails if the SDK and its HTTP client cannot be loaded from the result.

  • Failures were undiagnosable. The log redactor treated any context key containing code as a secret, so error_code and status_code were written as [redacted]. Diagnostic fields are now logged; Terminal pairing codes remain redacted.

  • Removed the duplicate webhook URL input from the Terminal pairing row — it repeated the Webhook Notification URL setting shown immediately above it.

  • Square requests now use a bounded 10-second timeout so a slow response cannot hold a checkout render open.

  • Updated symfony/http-foundation to clear CVE-2026-48736.

Upgrade notes

  • No settings changes required.
  • The plugin bundle is larger: it now contains a scoped HTTP client.
  • Requires PHP 8.1+, WordPress 6.5+, and WooCommerce 8.0+.

Verification status

  • Observed: a scoped build now completes a real HTTPS request to Square. With an invalid token the SDK returns AUTHENTICATION_ERROR / UNAUTHORIZED from Square's servers rather than failing locally, which proves the transport works end to end. This is asserted by the build gate and by ScopedDependencyTest.
  • Not verified: a successful payment, device discovery, or pairing against a real Square account and physical Terminal hardware.
Assets 3
Loading