Core Forms 4.2.0-beta6
Pre-release. Critical fix on top of v4.2.0-beta5.
⚠️ Critical — fixes a WSOD some users hit on beta5
beta5 added a top-level `add_action()` call at the bottom of `src/functions.php` that fired during composer's files-autoload step. Inside a WordPress request that was fine — `plugin.php` (which defines `add_action`) loads before plugins. But outside WP — PHPUnit, PHPStan, custom CLI tools, or any other plugin that requires our `vendor/autoload.php` before WP's plugin loader runs — `add_action` was undefined and the plugin fataled at autoload, taking the whole site down.
The registration is now wrapped in `function_exists( 'add_action' )` so `functions.php` is safe to load standalone.
This was the root cause of the WSOD reported on test sites running beta5.
Analytics tab bugfixes
- Field-interactions table reads the `interactions` column the Dashboard actually returns (was reading `count`, so every row showed 0).
- Top-sources panel maps the Dashboard's `{utm_sources, referrers}` shape correctly (was reading the non-existent `top_sources`). Falls back to referrer-domain rows when no UTM tags are in use.
- Recommendations substitute the `value` (e.g. completion-rate %) into the printf-style `message` template instead of showing the literal `%s%%`.
Revisions tab bugfixes
- Restore redirects back to Core Forms admin (`?page=core-forms&view=edit&form_id=X&tab=revisions&restored=1`) instead of WordPress's native post.php editor, which doesn't render Core Forms' custom UI. A success flash confirms the restore.
- Meta-only saves create revisions. `wp_save_post_revision_check_for_changes` is set to `false` for `core-form`, so settings-only or messages-only saves snapshot a revision instead of being silently dropped by WP's content-diff check.
- Revision-meta filter is now version-agnostic. `wp_post_revision_meta_keys` passes the parent in WP 6.4+ but earlier patches may have passed the revision; the callback resolves a parent id defensively so the check matches on both.
Build pipeline
- Regenerated `phpstan-baseline.neon` (previous baseline was stale after the beta CSRF default flip — `enable_nonce` shape change broke ignore patterns).
- Build script now exits clean: 148 unit tests pass, PHPStan analyse clean.
- Production zip (738KB) ships without phpstan, phpunit, tests, or composer.json — all dev deps stripped via `composer install --no-dev` in the build step.
- Use `bash build.sh` for releases. Never rsync the dev vendor directly — that's how dev-only `autoload_files` entries (phpstan/bootstrap.php) ended up in the deployed autoloader earlier today.