Skip to content

chore(deps): pin rtcamp/wp-framework to ^1.0 - #747

Merged
aryanjasala merged 3 commits into
theme-elementary-v2from
chore/pin-wp-framework-1.0
Jul 29, 2026
Merged

chore(deps): pin rtcamp/wp-framework to ^1.0#747
aryanjasala merged 3 commits into
theme-elementary-v2from
chore/pin-wp-framework-1.0

Conversation

@aryanjasala

@aryanjasala aryanjasala commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What

Pins rtcamp/wp-framework to ^1.0 instead of dev-main, resolving to the tagged v1.0.1 release.

-"rtcamp/wp-framework": "dev-main"
+"rtcamp/wp-framework": "^1.0"

Why

dev-main is a moving target. Every composer install resolved to whatever the framework's main branch was at that moment — builds weren't reproducible, and nothing protected the theme from a breaking change landing upstream.

That's not hypothetical: this PR originally locked to v1.0.0 and the whole PHP matrix fataled on boot —

Access to undeclared static property rtCamp\Theme\Elementary\Main::$instance
#0 .../wp-framework/inc/Contracts/Traits/Singleton.php(48): Main->__construct()
#1 .../theme-elementary/functions.php(52): Main::get_instance()

v1.0.0 had changed the Singleton trait's storage, removing the protected static $instance property this theme assigns in its constructor (inc/Main.php:47). That assignment is the re-entrancy guard for our constructor-driven Loader, so it wasn't safe to just delete. wp-framework v1.0.1 (rtCamp/wp-framework#82) restores the property and documents that exact pattern as the supported contract — so no theme code changes are needed here, only the pin and lock.

The lock matters

composer.lock is committed and pinned dev-main@e30352c, so changing composer.json alone would break composer install in CI. Regenerated:

- Upgrading rtcamp/wp-framework (dev-main e30352c => v1.0.0)
- Upgrading rtcamp/wp-framework (v1.0.0 => v1.0.1)

Only that package moves.

Deliberately unchanged

  • minimum-stability: dev stays — other deps may rely on it; tightening it is a separate change.
  • The repositories VCS block stays — wp-framework isn't on Packagist, so composer still needs the source even though the repo is public now.

Note on the code delta

dev-main@e30352c predates the framework's audit fixes, so this pin also pulls in the crypto key derivation, asset path-traversal guards and feature-flag save fixes, and drops XHProf_Profiler (removed upstream — this theme doesn't reference it, checked).

Also in here: a PHPStan config fix

Lint PHP was failing before this PR's own changes could be judged:

Invalid entry in excludePaths:
Path ".../node_modules" is neither a directory, nor a file path, nor a fnmatch pattern.

That job installs composer only — never npm — so node_modules doesn't exist and PHPStan treats the missing excludePath as a config error and refuses to run. Appending (?) marks it optional, which is what PHPStan's own error message recommends.

Unrelated to the dependency pin, and pre-existing on theme-elementary-v2 as well — it surfaces now because the PHPStan job itself is new. Bundled here rather than split out so this PR can actually go green; merging it fixes the base branch too.

Verified locally both ways: 16 files at level 8, [OK] No errors with node_modules absent (CI) and present (dev).

@aryanjasala
chore(deps): pin rtcamp/wp-framework to ^1.0
389c86c 
The theme tracked `dev-main`, so every build silently picked up whatever the
framework's main branch happened to be at install time — unreproducible, and
with no protection against a breaking change landing upstream.

wp-framework now has a tagged v1.0.0 release, so pin to the constraint and let
composer resolve it. The lock moves from dev-main@e30352c to v1.0.0 and the
dev stability flag for the package drops out.

minimum-stability stays `dev` — other dependencies may still rely on it, and
narrowing it is a separate change.
@aryanjasala aryanjasala mentioned this pull request Jul 29, 2026
Merged
@aryanjasala
chore(deps): bump rtcamp/wp-framework lock to v1.0.1
ca88e3f 
v1.0.0's Singleton storage change fataled this theme on boot (Access to
undeclared static property Main::$instance — inc/Main.php:47 assigns it as the
constructor's re-entrancy guard). v1.0.1 restores the protected $instance
contract and documents that guard as the supported pattern, so no theme change
is needed.
@aryanjasala
ci(phpstan): mark node_modules as an optional excludePath
b5a8a4c 
The Lint PHP job installs composer only, never npm, so node_modules does not
exist there. PHPStan treats a missing excludePath as a configuration error and
refuses to run:

  Invalid entry in excludePaths:
  Path ".../node_modules" is neither a directory, nor a file path, nor a
  fnmatch pattern.

Appending `(?)` marks it optional, which is what PHPStan's own message
recommends. Verified both ways locally: analysis passes with node_modules
absent (CI) and present (dev), 16 files at level 8, no errors.

Pre-existing on feature branches and on theme-elementary-v2 itself, not caused
by the dependency pin in this PR — it surfaces here because the PHPStan job is
new. Merging this carries the fix to the base branch too.
@aryanjasala
aryanjasala merged commit f65b524 into theme-elementary-v2 Jul 29, 2026
23 checks passed
@aryanjasala
aryanjasala deleted the chore/pin-wp-framework-1.0 branch July 29, 2026 12:02
aryanjasala added a commit that referenced this pull request Jul 29, 2026
@aryanjasala
Merge theme-elementary-v2 into feat/scaffold-engine
191fc12 
Brings the branch up to date with the six commits merged since 2026-06-24
(#737, #746, #747, #748 and follow-ups) and fixes what that surfaced.

Conflicts:
  .gitignore   kept this branch's graphify-out rules; the base added nothing.
  README.md    took the base's rewritten README and re-applied this branch's
               one addition, the "AI tooling" section.
  package.json union of both sides: the base's @rtcamp/eslint-config and
               @rtcamp/stylelint-config, plus this branch's script changes.

Also:

- @rtcamp/wp-tooling was pinned to "^0.1.0", a registry range for a package
  that is not published (npm 404s it), so `npm install` could not succeed.
  Point it at the branch split, as features-plugin-skeleton does.

- Drop the GitHub Packages registry lines from .npmrc. All three @rtCamp
  dependencies now resolve from git branch refs, so no scope registry and no
  read:packages token is needed. The file's own TODO asked for this.

- Regenerate package-lock.json. Git text-merged the two lock files, which
  left it internally inconsistent (@emnapi entries missing), and `npm ci
  --ignore-scripts` -- what the setup-node-with-cache action runs -- failed
  on it. Rebuilt from scratch; `npm ci` now succeeds.

- phpcbf the PHP added on this branch: it predates the rtCampWP standard
  adopted in #748, which found 8 fixable violations across 5 files
  (import ordering, useless return annotations, class-brace and parent-call
  spacing).

- Scope WordPressVIPMinimum.Performance.FetchingRemoteData off tests/*. The
  new LoggerTest reads a local fixture with file_get_contents; the caching
  advice is about remote URLs. Mirrors the exclusion #748 added for
  WordPressVIPMinimum.Functions.RestrictedFunctions.

Verified: npm ci, npm run init -- --help, lint:js, lint:css, phpcs (0/0),
phpstan (no errors), and a non-interactive scaffold via
`node bin/init.js --name="Acme Portfolio" --yes`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pratik-londhe4 pratik-londhe4 pratik-londhe4 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@aryanjasala @pratik-londhe4