chore: release v13.39.1

.github/dependabot.yml

@@ -20,3 +20,23 @@ updates:
     labels:
       - "dependencies"
       - "automerge"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    target-branch: "develop"
+    labels:
+      - "dependencies"
+      - "automerge"
+
+  - package-ecosystem: "npm"
+    directory: "/tests/e2e"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    target-branch: "develop"
+    labels:
+      - "dependencies"
+      - "automerge"

.harness.json

@@ -3,6 +3,6 @@
     "mode": "enforce",
     "ratchet": {
         "phpstan_level": 5,
-        "phpstan_baseline": 66
+        "phpstan_baseline": 58
     }
 }

CHANGELOG.md

@@ -5,7 +5,21 @@ All notable changes to the Pollora framework will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased](https://github.com/Pollora/framework/compare/v13.39.0...develop)
+## [Unreleased](https://github.com/Pollora/framework/compare/v13.39.1...develop)
+
+## [v13.39.1](https://github.com/Pollora/framework/compare/v13.39.0...v13.39.1) - 2026-10-28
+
+### Changed
+- **WP Rocket moved to its own package, `pollora/wp-rocket`. Install it if the project runs WP Rocket: `composer require pollora/wp-rocket`.** The framework no longer registers `WpRocketServiceProvider`, which kept WP Rocket from writing its rules into `.htaccess` and from setting `WP_CACHE` (both off unless `wordpress.wprocket.generate_htaccess` / `set_cache_constant` say otherwise). Without the package, an active WP Rocket does both on its own. The old class name `Pollora\ThirdParty\WpRocket\WpRocketServiceProvider` still resolves once the package is installed, and `wordpress.wprocket` is unchanged
+- `pollora:doctor` and Site Health check that WP Rocket, when active, has its Pollora integration installed; `pollora/wp-rocket` is suggested in `composer.json`
+- **`pollora/colt` `^11.0`** (it was `^10.0.1`): Colt 11 requires PHP 8.3, declares strict types and adds return types to its public methods, so a model that extends one of Colt's and overrides a method must be compatible. `pollora/block-bindings` is required as `^0.2` (it needs Colt 11) and `pollora/query` as `^2.0 || ^3.0` (3.0 only raises its PHP requirement to 8.3)
+- `laravel/prompts` is updated to `^0.3.26`
+- Dependabot watches the npm lock files (`/` and `tests/e2e`) and opens its pull requests, security updates included, against `develop`: a security update used to target `main`, which broke the Gitflow
+
+### Fixed
+- The end-to-end test of the module list no longer fails when WordPress shows its own warning notice, as it does while a core update is available
+- `tests/e2e/package-lock.json` is refreshed with `npm audit fix` (`zod` 4.6.7, `puppeteer-core` 25.16.0 and their dependencies) to fix known vulnerabilities in these development dependencies
+- `fast-uri` is updated to 3.1.9 in `package-lock.json` and `tests/e2e/package-lock.json` to fix known vulnerabilities in these development dependencies
 
 ## [v13.39.0](https://github.com/Pollora/framework/compare/v13.38.1...v13.39.0) - 2026-10-27
 

composer.json

@@ -33,7 +33,7 @@
         "pollora/ajax": "^1.1",
         "pollora/assets": "^0.1",
         "pollora/attributes": "^0.1.1 || ^1.0",
-        "pollora/block-bindings": "^0.1",
+        "pollora/block-bindings": "^0.2",
         "pollora/discovery": "^0.1 || ^1.0",
         "pollora/entity": "^1.2",
         "pollora/media": "^0.8",
@@ -46,16 +46,16 @@
         "pollora/wp-rest": "^0.1 || ^0.2 || ^1.0",
         "watson/rememberable": "^7.1",
         "cweagans/composer-patches": "^2.0",
-        "pollora/colt": "^10.0.1",
+        "pollora/colt": "^11.0",
         "log1x/sage-directives": "^2.0",
         "roots/bedrock-autoloader": "^1.1",
-        "pollora/query": "^1.0 || ^2.0",
+        "pollora/query": "^2.0 || ^3.0",
         "spatie/php-structure-discoverer": "^2.4",
         "coduo/php-humanizer": "5.0.3",
         "nwidart/laravel-modules": "^13.0",
         "symfony/process": "^7.4 || ^8.0",
         "illuminate/config": "^13.39",
-        "laravel/prompts": "^0.3.25"
+        "laravel/prompts": "^0.3.26"
     },
     "autoload": {
         "psr-4": {
@@ -107,7 +107,8 @@
         }
     },
     "suggest": {
-        "pollora/woocommerce": "WooCommerce's Blade templates, Route::wp() conditions, Coming Soon page and events"
+        "pollora/woocommerce": "WooCommerce's Blade templates, Route::wp() conditions, Coming Soon page and events",
+        "pollora/wp-rocket": "Keeps WP Rocket from writing .htaccess and setting WP_CACHE unless the project asks for it"
     },
     "require-dev": {
         "driftingly/rector-laravel": "^2.6",

phpstan-baseline.neon

@@ -54,12 +54,6 @@ parameters:
 			count: 3
 			path: src/Events/WordPress/Plugins/GravityForms/GravityFormsEventDispatcher.php
 
-		-
-			message: '#^Access to an undefined property Illuminate\\Database\\Eloquent\\Model\:\:\$meta_value\.$#'
-			identifier: property.notFound
-			count: 1
-			path: src/Models/Attachment.php
-
 		-
 			message: '#^Call to an undefined method Illuminate\\Container\\Container\:\:getCachedConfigPath\(\)\.$#'
 			identifier: method.notFound

src/Doctor/Infrastructure/Checks/WpRocketPackageCheck.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Pollora\Doctor\Infrastructure\Checks;
+
+use Closure;
+use Composer\InstalledVersions;
+use Pollora\Doctor\Domain\Contracts\CheckInterface;
+use Pollora\Doctor\Domain\Enums\RunContext;
+use Pollora\Doctor\Domain\Models\CheckResult;
+
+/**
+ * An active WP Rocket has its Pollora integration installed.
+ *
+ * The framework used to keep WP Rocket from writing `.htaccess` and from setting `WP_CACHE`.
+ * That lives in pollora/wp-rocket now, and a project that updated the framework without the
+ * package gets, without an error, a WP Rocket that does both on its own.
+ */
+final readonly class WpRocketPackageCheck implements CheckInterface
+{
+    private const string PACKAGE = 'pollora/wp-rocket';
+
+    /**
+     * @param  (Closure(): bool)|null  $packageInstalled  Tells whether the package is installed; Composer answers by default
+     */
+    public function __construct(private ?Closure $packageInstalled = null) {}
+
+    public function id(): string
+    {
+        return 'wp-rocket-package';
+    }
+
+    public function label(): string
+    {
+        return 'WP Rocket integration';
+    }
+
+    public function runsIn(): array
+    {
+        return [RunContext::Console, RunContext::Http];
+    }
+
+    public function run(RunContext $context): CheckResult
+    {
+        if (! function_exists('did_action') || \did_action('plugins_loaded') === 0) {
+            return CheckResult::skipped('WordPress is not loaded.');
+        }
+
+        if (! defined('WP_ROCKET_VERSION')) {
+            return CheckResult::skipped('WP Rocket is not active.');
+        }
+
+        $installed = $this->packageInstalled instanceof Closure
+            ? ($this->packageInstalled)()
+            : InstalledVersions::isInstalled(self::PACKAGE);
+
+        if ($installed) {
+            return CheckResult::ok(self::PACKAGE.' is installed.');
+        }
+
+        return CheckResult::warning(
+            'WP Rocket is active, but its Pollora integration is not installed.',
+            [
+                'The framework no longer ships it: without '.self::PACKAGE.', WP Rocket writes its rules into .htaccess and sets WP_CACHE on its own.',
+            ],
+            'composer require '.self::PACKAGE,
+        );
+    }
+}

src/Doctor/Infrastructure/Providers/DoctorServiceProvider.php

@@ -22,6 +22,7 @@
 use Pollora\Doctor\Infrastructure\Checks\TemplatePlaceholdersCheck;
 use Pollora\Doctor\Infrastructure\Checks\WooCommercePackageCheck;
 use Pollora\Doctor\Infrastructure\Checks\WordPressCorePatchCheck;
+use Pollora\Doctor\Infrastructure\Checks\WpRocketPackageCheck;
 use Pollora\Doctor\UI\Console\DoctorCommand;
 use Pollora\Doctor\UI\Http\SiteHealthTests;
 use Pollora\Hook\Domain\Contract\Filter;
@@ -55,6 +56,7 @@ class DoctorServiceProvider extends ServiceProvider
         BlockRegistrationCheck::class,
         PublicRootCheck::class,
         WooCommercePackageCheck::class,
+        WpRocketPackageCheck::class,
     ];
 
     public function register(): void

src/Providers/PolloraServiceProvider.php

@@ -39,7 +39,6 @@
 use Pollora\Schedule\SchedulerServiceProvider;
 use Pollora\Taxonomy\Infrastructure\Providers\TaxonomyServiceProvider;
 use Pollora\Theme\Infrastructure\Providers\ThemeServiceProvider;
-use Pollora\ThirdParty\WpRocket\WpRocketServiceProvider;
 use Pollora\VersionCheck\Infrastructure\Providers\VersionCheckServiceProvider;
 use Pollora\View\Infrastructure\Providers\TemplateHierarchyServiceProvider;
 use Pollora\View\ViewServiceProvider;
@@ -117,7 +116,6 @@ public function register(): void
         $this->app->register(ConfigServiceProvider::class);
         $this->app->register(QueryServiceProvider::class);
         $this->app->register(SageDirectivesServiceProvider::class);
-        $this->app->register(WpRocketServiceProvider::class);
         $this->app->register(WordPressEventServiceProvider::class);
         $this->app->register(TemplateHierarchyServiceProvider::class);
         $this->app->register(RouteServiceProvider::class);

tests/Feature/Doctor/WpRocketPackageCheckTest.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+use Brain\Monkey\Functions;
+use Pollora\Doctor\Domain\Enums\CheckStatus;
+use Pollora\Doctor\Domain\Enums\RunContext;
+use Pollora\Doctor\Infrastructure\Checks\WpRocketPackageCheck;
+
+// Declared once, last: a constant stays defined for the rest of the process.
+function declareWpRocket(): void
+{
+    if (! defined('WP_ROCKET_VERSION')) {
+        define('WP_ROCKET_VERSION', '3.17');
+    }
+}
+
+describe('WP Rocket integration check', function (): void {
+    test('is skipped when WordPress is not loaded', function (): void {
+        Functions\when('did_action')->justReturn(0);
+
+        $result = (new WpRocketPackageCheck)->run(RunContext::Console);
+
+        expect($result->status)->toBe(CheckStatus::Skipped);
+    });
+
+    test('is skipped when WP Rocket is not active', function (): void {
+        Functions\when('did_action')->justReturn(1);
+
+        $result = (new WpRocketPackageCheck(fn (): bool => false))->run(RunContext::Console);
+
+        expect($result->status)->toBe(CheckStatus::Skipped)
+            ->and($result->summary)->toContain('not active');
+    });
+
+    test('warns, and says what to install, when the package is missing', function (): void {
+        Functions\when('did_action')->justReturn(1);
+        declareWpRocket();
+
+        $result = (new WpRocketPackageCheck(fn (): bool => false))->run(RunContext::Console);
+
+        expect($result->status)->toBe(CheckStatus::Warning)
+            ->and($result->fix)->toBe('composer require pollora/wp-rocket');
+    });
+
+    test('is ok when the package is installed', function (): void {
+        Functions\when('did_action')->justReturn(1);
+        declareWpRocket();
+
+        $result = (new WpRocketPackageCheck(fn (): bool => true))->run(RunContext::Console);
+
+        expect($result->status)->toBe(CheckStatus::Ok);
+    });
+
+    test('runs in the console and in Site Health', function (): void {
+        expect((new WpRocketPackageCheck)->runsIn())->toBe([RunContext::Console, RunContext::Http]);
+    });
+});