WP Bones is back on Product Hunt: 33 releases since the first launch

On August 5, 2024 WP Bones launched here at 1.5.5: a framework that brings Laravel's habits to WordPress plugins. Two years and 33 releases later (1.6.0 3.0.0), here's what's new

Secure by default (3.0)

WP Bones 2.1.0 is out the bones CLI that ships inside every plugin gets sturdier

Runs from any folder. php my-plugin/bones used to stop with a TypeError anywhere but the plugin root. Now it works, custom commands included.

WP Bones 3.1 is out your generators, your templates

Your stubs come first. Every make:* command reads the stubs/ folder of your plugin before the framework's, and tells you when it does.

WP Bones 2.1.1 is out a small patch, two fixes

Activation sees its own plugin. Since 1.8.0 the activation hook ran with an empty slug and no version, so the options it aligned were saved to a row with no name. Fixed.

WP Bones 2.1.2 is out a security patch

Admin pages check who you are. Pages from config/routes.php and pages/ have no menu entry, so WordPress let any logged-in user open them: the capability key was never read. Now a user without it gets a 403.

WP Bones 2.0.10 is out a safety release for bones, the CLI every WP Bones plugin carries, after I audited it line by line

deploy checks where it deploys. php bones deploy .. used to delete every plugin beside yours, and then yours. Now the plugin, its parents and anything inside it are refused, and an unrelated folder needs --force.

WP Bones 2.0.9 is out a small one, about numbers that had quietly stopped agreeing

bones version keeps its hands off your dependencies. On an npm 6 lockfile (lockfileVersion: 1) it bumped your plugin and the first package in the tree. Now only your plugin's own entry moves.

WP Bones 2.0.8 is out and it started as a community pull request

$this->plugin in your commands. Custom php bones commands that call $this->loadWordPress() now get your plugin instance: its config, its services, everything it registers. Before, the loader looked in the framework's own folder and your plugin never booted.

WP Bones 2.0.7 is out and it's a quiet one that makes every release you ship lighter.

Dev packages stay home. bones deploy used to copy vendor/ exactly as it was on disk so PHPUnit, Brain Monkey and everything a test suite pulls in went into your plugin package. On one of my own plugins that was 31 packages. Now the deploy prunes them in the copy, against your composer.lock, and never touches your working tree. Want them anyway? --keep-dev.