From 218c862a688da10dee4736a0bfaa45524f419a43 Mon Sep 17 00:00:00 2001 From: Dan Knauss <273554+dknauss@users.noreply.github.com> Date: Tue, 11 Aug 2026 19:48:26 -0600 Subject: [PATCH] =?UTF-8?q?release:=20prep=20v1.5.2=20=E2=80=94=20HOLD=20T?= =?UTF-8?q?HE=20TAG?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Version strings bumped via bin/prep-release.sh. Changelog derived from the `v1.5.1..main` DIFF, which is one shippable file: includes/class-config.php (+46/-3), the normalizing-equivalent-key dedupe from #153. ⚠️ DO NOT TAG YET. A second ultrareview is still running in another session and may confirm further bugs. If it does, they belong in THIS patch: tagging now would either ship a fix whose changelog omits its siblings, or force a v1.5.3 days later. v1.4.0's gate 8 caught a changelog overclaim by diffing the real commits — the same discipline says do not finalise the changelog until the commit set is. Two changelog entries, both from the one fix, split because they are different audiences: - The general one: an override could silently stop applying when a single save carried two spellings of the same item's address. Written to name the symptom a user would actually notice — a rename or visibility rule that stops working while still showing in settings — rather than the mechanism. - The authorization one: it also closes a way for a saver who cannot list users to undo an administrator's per-person rule. Stated plainly, with the cosmetic-only guarantee restated, because that is the claim people will check. NOT framed as a security release. Hiding is cosmetic: no capability was granted or removed and the page stayed URL-reachable throughout. Same framing as 1.4.1. Also riding along, not changelog material: the readme listing copy rewritten in #152 (D4 non-autoloaded differentiator, tags, description). It publishes with the release but is directory copy, not plugin behaviour. Upgrade Notice is 271 chars (Plugin Check limit 300). Gate (Docker-free lanes): unit 167/167 (223 assertions), WPCS clean, PHPStan 0, doc-links clean. Integration/e2e ran green on #153 and re-run here in CI. Co-Authored-By: Claude Opus 5 --- maestro-menu-editor.php | 4 ++-- package-lock.json | 4 ++-- package.json | 2 +- readme.txt | 9 ++++++++- 4 files changed, 13 insertions(+), 6 deletions(-) diff --git a/maestro-menu-editor.php b/maestro-menu-editor.php index 7164d04..01eb043 100644 --- a/maestro-menu-editor.php +++ b/maestro-menu-editor.php @@ -3,7 +3,7 @@ * Plugin Name: Maestro: The Inline Admin Menu Editor * Plugin URI: https://github.com/dknauss/Maestro/ * Description: In-place editing of the WordPress admin menu — rename items, reorder them, swap top-level icons, and hide items per role. Cosmetic only: hiding declutters, it does not lock access. - * Version: 1.5.1 + * Version: 1.5.2 * Requires at least: 6.4 * Requires PHP: 7.4 * Author: Dan Knauss @@ -20,7 +20,7 @@ defined( 'ABSPATH' ) || exit; -define( 'MAESTRO_VERSION', '1.5.1' ); +define( 'MAESTRO_VERSION', '1.5.2' ); define( 'MAESTRO_FILE', __FILE__ ); define( 'MAESTRO_DIR', plugin_dir_path( __FILE__ ) ); define( 'MAESTRO_URL', plugin_dir_url( __FILE__ ) ); diff --git a/package-lock.json b/package-lock.json index d20ac2e..d599425 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "maestro", - "version": "1.5.1", + "version": "1.5.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "maestro", - "version": "1.5.1", + "version": "1.5.2", "devDependencies": { "@axe-core/playwright": "^4.12.1", "@playwright/test": "^1.62.1", diff --git a/package.json b/package.json index 74742fb..8c977f9 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "maestro", - "version": "1.5.1", + "version": "1.5.2", "private": true, "description": "Tooling for Maestro: The Inline Admin Menu Editor: wp-env, PHP integration tests, Playwright E2E.", "scripts": { diff --git a/readme.txt b/readme.txt index d65a532..2aeba74 100644 --- a/readme.txt +++ b/readme.txt @@ -4,7 +4,7 @@ Donate link: https://github.com/sponsors/dknauss Tags: admin menu, menu editor, hide menu items, rename menu items, menu icons Requires at least: 6.4 Tested up to: 7.0 -Stable tag: 1.5.1 +Stable tag: 1.5.2 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html @@ -164,6 +164,10 @@ If Maestro saves you time or brings you or your clients the joy of a tidy admin == Changelog == += 1.5.2 = +* **Fixed: an override could silently stop applying when the same menu item was saved under two spellings of its address.** Some items can be addressed more than one way — with or without a version number or tracking parameter, for instance. If a single save carried two such spellings of the same item, Maestro stored both, then read the item as ambiguous and applied neither. A rename or a visibility rule would stop working while still appearing in your settings, which is the worst way for something to break. Maestro now keeps one entry per item, so the situation cannot arise. +* This also closes a way for someone who can edit the menu but cannot list users to undo a per-person visibility rule set by an administrator. As always, hiding is cosmetic: no capability was granted or removed, and the affected page stayed reachable by URL throughout for anyone allowed to open it. + = 1.5.1 = * **Fixed: the edit-mode toolbar no longer shifts while a change saves.** The save status now sits in a reserved slot, so the rename field stays where it is instead of sliding sideways every time a save cycles through "Saving…" and "Saved". * **Accessibility: a locked sub-item role is now reachable, and says why it is locked.** When a role is already hidden at the parent level, that role's checkbox under "Hide its sub-items from:" is shown as locked. It was previously skipped by keyboard and screen-reader navigation entirely — so the explanation was written for assistive technology but could never actually be heard. It is now reachable and announces its reason. The value still cannot be changed. @@ -237,6 +241,9 @@ If Maestro saves you time or brings you or your clients the joy of a tidy admin == Upgrade Notice == += 1.5.2 = +Fixes an override that could silently stop applying when one save carried two spellings of the same item's address, and closes a way for a delegated editor to undo an administrator's per-person visibility rule. Cosmetic only — no access changed. No configuration changes. + = 1.5.1 = Fixes a toolbar that shifted sideways while saving, and three editor accessibility gaps. Also fixes a rare case where the visibility popover could show a rule as active while the menu ignored it, and saving could then store it. No configuration changes; existing overrides are untouched.