{"slug":"tapp-network","new_version":"1.4.1","url":"https://github.com/TappNetwork/tapp-network/releases/tag/1.4.1","package":"https://tapp-plugin-updates.tapphosting.com/download.zip","tested":"6.8","requires":"6.0","requires_php":"7.4","sections":{"description":"<h1>TAPP Network</h1><p></p>This plugin has code to improve the TAPP Network experience in WordPress.<p></p><h1>Features</h1><p></p><ul><li>Adds a TAPP Network widget to the WordPress dashboard.</li></ul><br><ul><li>Adds a Tapp Network menu to the adminbar</li></ul><br><ul><li>Adds a Cache Clearing Tool</li></ul><br><ul><li>Adds a Site URL Audit Tool</li></ul><br><ul><li>Adds TAPP Dev Tools</li></ul><br><ul><li>Adds tools to manage tapp users</li></ul><br><ul><li>Adds external logging for WP-Stream</li></ul><br><ul><li>Adds various Security Features</li></ul><br><ul><li>Adds support to register TAPP Software Licenses</li></ul><p></p><h1>Developers</h1><p></p><ul><li>Use PHPCS, run composer install</li></ul><br><ul><li>vendor/bin/phpcbf --standard=WordPress FILENAME</li></ul><br><ul><li>vendor/bin/phpcs --standard=WordPress FILENAME</li></ul><br>","changelog":"<h1>Changelog</h1><p></p>All notable changes to this project will be documented in this file.<p></p>The format is based on <a href=\"https://keepachangelog.com/en/1.1.0/\" target=\"_blank\">Keep a Changelog</a>,<br>and this project adheres to <a href=\"https://semver.org/spec/v2.0.0.html\" target=\"_blank\">Semantic Versioning</a>.<p></p><h2>[1.4.1] - 2026-09-16</h2><p></p><h3>Changed</h3><br><ul><li>npm security updates (`@wordpress/scripts` 35 and overrides); admin assets rebuilt.</li></ul><p></p><h3>Fixed</h3><br><ul><li>Admin-bar TAPP logo used a broken relative `plugins<em>url()` path; now uses `TAPP_PLUGIN</em>URL`, with menu id `tapp-network` and TAPP-user gating.</li></ul><br><ul><li>CI: wipe committed `vendor/` before Composer install and commit a clean `--no-dev` autoload so PHPCS is not blocked by missing phpstan/phpunit paths.</li></ul><p></p><h2>[1.4.0] - 2026-09-09</h2><p></p><h3>Removed</h3><br><ul><li>Honeybadger module. It was the only production Composer dependency and pulled in Guzzle, Symfony and Monolog: roughly 3MB of vendor code autoloaded on every request. It installed global error, exception and shutdown handlers before other plugins loaded, and tagged every PHP error `production` regardless of environment because it read `WP<em>ENVIRONMENT</em>TYPE` before the plugin defined it. `vendor/` is now dev-only.</li></ul><br><ul><li>Bundled wp-queue library, plus the Media Import and Alt AI modules. The queue scheduled a recurring five-minute cron event on every site whether or not anything was queued, and its tables were only created by the activation hook, which does not run when a plugin updates in place. Most sites logged a `Table 'wp<em>queue</em>jobs' doesn't exist` error every five minutes as a result.</li></ul><br><ul><li>Media tab in the settings screen. Its status endpoints were polled every three seconds indefinitely because `useEffect` captured `statusData` from the first render.</li></ul><br><ul><li>`WP<em>CACHE`, `WP_DEBUG`, `WP_DEBUG_DISPLAY`, `WP_DEBUG_LOG` and `SCRIPT_DEBUG` defines. Core sets all five in `wp_initial</em>constants()` before plugins load, so none could ever take effect. `SAVEQUERIES` was the only working one and it made `$wpdb` retain a backtrace per query, so dev mode slowed sites down while producing no extra debug output.</li></ul><br><ul><li>Beta mode toggle from the Dev tab. Alt AI was its only consumer, so it no longer changed anything. The option key is retained in the settings schema so no stored value is lost.</li></ul><p></p><h3>Added</h3><br><ul><li>Migration runner (`TAPP<em>Migrations`). Activation hooks do not fire on update, so one-time cleanup now runs from a version check. Migration 1 unschedules the orphaned queue cron event, deletes the removed features' options, drops the queue tables, strips the Honeybadger settings keys, and stops autoloading `tappnetwork_api</em>key`.</li></ul><br><ul><li>Update checks send the site UUID, installed version and environment, so the update worker can hold a release to a set of canary sites rather than serving one version to the whole fleet.</li></ul><br><ul><li>Object cache flushing and page cache purging for WP Rocket, LiteSpeed, W3 Total Cache, WP Super Cache, Autoptimize, Nginx Helper, SiteGround and WordPress.com edge, plus a `tapp<em>purge_page</em>caches` action.</li></ul><br><ul><li>`--checks=` flag on `wp tapp url-audit` to run only selected checks.</li></ul><p></p><h3>Fixed</h3><br><ul><li>Cloudflare purging read only PHP constants, so it silently did nothing on any site configured through the settings screen. It now reads the settings with constants as a fallback.</li></ul><br><ul><li>`tapp<em>alt_ai_results` and `tapp_media_import</em>results` were autoloaded and grew by one line per processed item, adding up to 150KB to every request. Each write also forced a full `alloptions` reload. Both options are removed.</li></ul><br><ul><li>Expired transient cleanup used one `delete<em>transient()` call per row, which timed out on large options tables and missed site transients on multisite. It now calls core's set-based `delete_expired</em>transients()`.</li></ul><br><ul><li>Removed an `add<em>action()` referencing `disable_comments_admin_bar_link`, a method that has never existed. It survived only because it was registered during the `init` priority already executing, and `WP</em>Hook` iterates a priority's callbacks by value. Changing that priority would have caused a fatal error on every request.</li></ul><br><ul><li>`uninstall.php` cleared `tapp<em>users_weekly</em>reset`, a hook this plugin never registers, leaving the real weekly user-reset event scheduled forever. It now also clears the queue and WP Stream events, deletes the removed options, and drops the queue tables.</li></ul><br><ul><li>`tapp<em>account_manager_email` and `clickup_org_task</em>id` were rendered by the Integrations tab but absent from the REST schema, so WordPress stripped them on every save and they could never persist.</li></ul><br><ul><li>The site heartbeat posted a freshly generated 64-character API key and the shared secret to an `http://` endpoint. It now uses `https://`. The API key and site UUID are no longer autoloaded.</li></ul><br><ul><li>`str<em>ends</em>with()` calls replaced with a portable helper. The function is PHP 8.0+ and the plugin declares PHP 7.4; it worked only because WordPress polyfills it in `compat.php`.</li></ul><p></p><h3>Changed</h3><br><ul><li>WP Stream records ship in batches from a stored high-water mark on a cron job instead of one `wp<em>remote</em>post()` per record from inside the insert hook. `'blocking' => false` never made that asynchronous, so saving a settings page that touched fifteen options paid a full TLS handshake fifteen times in series. It was also lossy: a failed dispatch had no response, no retry and no record, so a worker outage silently dropped audit entries. A failed batch now holds the watermark and retries. Batches are authenticated with the site API key.</li></ul><br><ul><li>The site URL audit is CLI-only (`wp tapp url-audit`). Its scans are unindexed LIKE queries against `wp<em>posts`, `wp_postmeta` and `wp</em>options`; they are now chunked by primary key with a 20-second budget per check, and a partial scan reports itself instead of showing zero issues. The `*.local` pattern was dropped because as `LIKE '%.local%'` it matched words like \"locale\".</li></ul><br><ul><li>The clear-cache endpoint is POST rather than GET, and an unrecognised cache name returns 400 instead of silently purging everything and starting a FacetWP reindex. The pre-1.4.0 names `sg<em>cache` and `all</em>transients` are still accepted.</li></ul><br><ul><li>`WP<em>ENVIRONMENT_TYPE` is defined in the plugin bootstrap rather than on `plugins_loaded`, because `wp_get_environment</em>type()` memoises its result on first call. `local` was added to the accepted values.</li></ul><br><ul><li>The dashboard news widget is restricted to TAPP staff. It fetches an RSS feed while the dashboard renders, so on a cache miss the page blocks until the request returns or times out.</li></ul><br><ul><li>Usersnap is not loaded at all when the integration is off.</li></ul><br><ul><li>`TAPP<em>VERSION` is a literal instead of a `get_file</em>data()` call that opened and scanned the plugin file on every request.</li></ul><br><ul><li>Diagnostics go to `debug.log` through `TAPP<em>Utils::log()` behind `WP_DEBUG`, never `trigger</em>error()` or a failing query, so Query Monitor does not show clients red error badges for expected conditions.</li></ul><p></p><h2>[1.3.6] - 2026-09-02</h2><br><h3>Fixed</h3><br><ul><li>Update checks no longer run on front-end requests. The updater loads only in wp-admin, during cron, and under WP-CLI, so a visitor page load never waits on the update server.</li></ul><br><ul><li>A failed update check is cached for 15 minutes. Previously a failure was retried on every read of the plugin update transient, which added a blocking request to each admin page load whenever the update server was slow or unreachable.</li></ul><br><ul><li>An update is only offered when the update server returns both a version and a download URL. An incomplete response no longer produces PHP warnings or an update prompt that cannot install.</li></ul><p></p><h2>[1.2.1] - 2026-01-28</h2><br><h3>Added</h3><br><ul><li>Updated changelog.md file.</li></ul><p></p><h3>Changed</h3><br><ul><li>Updated plugin update tools to use new CloudFlare Worker. This reduces file footprint and improves performance and security.</li></ul><p></p><h3>Removed</h3><br><ul><li>Removed old plugin update tools.</li></ul><br><ul><li>Removed link to old changelog html file.</li></ul><br>"}}