Changelog — JPKCom Bootstrap 5 Dark Mode Switch

Version history of jpkcom-bs-dark-mode (opens in a new tab). Entries are taken verbatim from the project's README. A hands-on guide with tips is available in the project guide.

2.0.11

Added: updates for inactive JPKCom plugins. WordPress never runs the code of a deactivated plugin, so its own updater never ran and it was never offered an update. Every JPKCom plugin now ships updater 1.5.0; one copy answers for all installed JPKCom plugins, active or not, with the update row, the icon and "View details". The SHA-256 check applies to an inactive plugin exactly as to an active one. On multisite, at least one JPKCom plugin must be network-active or active on the main site
Security: the stored list of plugin updates no longer contains JPKCom download URLs; they are added back only while a JPKCom updater is loaded, so a request without one cannot install an unverified package. The checksum check now also verifies a package another plugin supplied instead of accepting it, and recognises every GitHub address of a release file
Changed: plugins installed as a Git (or other version-control) checkout or in a renamed folder are told about a new release but never updated automatically, because an update would delete the checkout or the renamed folder. Update information is fetched only for users who can update plugins, in WordPress's update cron and in WP-CLI, never for anonymous visitors

Added: a plugin icon. The update manifest now points WordPress to the JPKCom logo, so the Updates screen (Dashboard → Updates) shows it next to this plugin instead of the generic pattern wordpress.org generates from the slug

Security: the plugin header now carries Update URI: https://github.com/JPKCom/jpkcom-bs-dark-mode. Without it, WordPress also asks wordpress.org for updates under this plugin's slug, so a same-named plugin published there with a higher version would be offered as an update of this one. With the header, wordpress.org answers nothing for this plugin and updates come only from this repository
Changed: the updater keeps its manifest cache, its failure marker and its fetch lock in site transients. On multisite the network now fetches the manifest once instead of once per site; on a single site nothing changes. The old per-site entries expire on their own within a day
Changed: the release workflow downloads phpDocumentor from a fixed GitHub release and verifies its SHA-256 before running it, instead of executing whatever phpdoc.org serves that day. No effect on the shipped plugin
CI: shivammathur/setup-php pinned to 2.40.0

Fixed: the update manifest no longer reports network: true for this plugin. The generator defaulted a missing Network: header to true, while WordPress' own default for a missing header is "not network-only". Metadata only — WordPress derives network-only from the plugin header via is_network_only_plugin(), not from the update manifest
CI: the lint and guard workflow now also runs on pushes to main. It only covered pull requests, so a direct push with bypass rights skipped every check
Changed: comments, workflow step names and CI output across the repository are now English throughout, and the developer notes in CLAUDE.md were translated and trimmed. No effect on the shipped plugin

Changed: Tested up to raised to WordPress 7.1
Changed: the bundled updater's runtime floor now matches the plugin's own minimum. It bailed out below WordPress 6.8 while the plugin header has required 6.9 for several releases, so the check could never fire on a supported installation
CI: the release manifest's fallback values for requires and tested now say 6.9 and 7.1. They only apply when the README metadata cannot be read, but a stale fallback would have published a minimum the plugin no longer supports

Added: plugin banners (assets/banner-1544x500.avif, assets/banner-772x250.avif) — a plain #3c4955 surface with no lettering. The update manifest already advertised these two URLs, but nothing was published under them, so the plugin card in wp-admin had a broken banner

CI: the release step no longer copies the staging directory into itself, so the ZIP has no empty jpkcom-bs-dark-mode/jpkcom-bs-dark-mode/ folder
CI: bumped the pinned GitHub Actions (checkout v7.0.1, setup-python v7.0.0, action-gh-release v3.0.2, fetch-metadata v3.1.0), still pinned to full commit SHAs
CI: the release ZIP now excludes the development-only tests/ and tools/ directories
CI: security and regression tests now run on every pull request, where a plugin has them

Security: update packages are now verified before installation — the verified file is handed to WordPress instead of being downloaded a second time, so the bytes that were checked are the bytes that get installed
Security: a missing or unfetchable SHA-256 checksum now aborts the update instead of installing unverified code (previously it silently skipped verification)
Security: pinned every GitHub Action to a full commit SHA and added Dependabot with a 7-day cooldown, so a moved tag can no longer change the release build
Security: tightened which download the updater claims, so sibling plugins cannot match each other's package
Fixed: sprintf() calls in the updater bound named arguments to a variadic parameter, which raises ArgumentCountError on PHP 8.3
Fixed: the "View Details" modal could fail with a TypeError when the manifest omitted requires_plugins
Performance: a failed manifest fetch is now cached for an hour instead of being retried on every admin request
Added: CI workflow on every pull request (PHP lint, named-argument check, YAML validation, action-pinning guard)

Added secure self-hosted plugin updates via GitHub with SHA256 checksum verification
Added an automated release workflow (builds the ZIP, generates the manifest and deploys to gh-pages on tag push)
Raised the minimum WordPress version to 6.9 and "Tested up to" to WordPress 7.0
Switched license metadata to the SPDX identifier GPL-2.0-or-later with the HTTPS license URI
Added PHPDoc-generated API documentation, built and deployed to gh-pages on release
Hardening: enabled declare(strict_types=1) and documented the shortcode callback