Unreleased version (v10) of WooCommerce on wpackagist?

[kimhf]

The latest version of WooCommerce on wordpress.org is v9.9.5, but v10.0.0 on wpackagist.org. Is it a mistake that v10 is already listed on wpackagist.org?

[retlehs]

FWIW this has happened in the past with WooCommerce specifically, and I've also seen it with other plugins

WooCommerce dropped a new version, then they decided they were going to delay it... but the SVN tag was already published, so Composer ends up grabbing the latest version.

I'm guessing wp.org has something for plugin authors to set the latest version because https://wordpress.org/plugins/woocommerce/ shows that 9.9.5 is the latest version

I'm not sure there's anything that wpackagist could do here. Plugin authors shouldn't do this and wp.org shouldn't allow it, IMO.

Ref #517 (comment)

[kimhf]

A problem here is there is usually a reason why a plugin version get pulled back, and then we end up with a new v10.0.0 in a few days or weeks. Will wpackagist replace the old v10 with the new v10 in that case? Personally I would probably prefer if the version was removed from wpackagist too in this case but I can see that causing problems too.

[retlehs]

They just end up tagging a new point release

Heads up, they did this again. 10.2.0 is the latest tag, but 10.1.2 is the last stable version

[nerrad]

A problem here is there is usually a reason why a plugin version get pulled back, and then we end up with a new v10.0.0 in a few days or weeks

Just wanted to correct this point here. WooCommerce doesn't replace an already released tag on SVN. In the case of your example, there would be a 10.0.1 marked as the new stable when a patch is released.

About the rollback on WordPress.org. We don't like doing this either, but we do monitor releases, and if there are indications that there's something breaking stores - we'd rather prevent that from having a wider impact, and so we update the stable tag to the previous stable release (while working on appropriate fixes).

You can read more about our release process here.

[retlehs]

@nerrad I tried posting this feedback on the blog post but it didn't appear. Wanted to make sure you saw this perspective on the release process challenges:

I've noticed this is the second or third time this year that a release has been tagged "stable" and then later walked back due to instability. This creates real challenges for folks using Composer + WPackagist, since WPackagist will always fetch the latest tag available from WordPress.org.

I know WooCommerce generally has a release candidate process, but from a release-management perspective, tagging something as stable and then pulling it back is unusual and risky for downstream builds.

Related issue: #547 shows how this plays out in practice.

Thanks for all the work y'all do. WooCommerce should be stable and reliable for everyone, and I believe tightening the release/tagging process would make a big difference.

[retlehs]

For anyone coming across this issue, take a look at roots/wpackagist-changelog-action if you want PR comments that will warn you if a plugin version you're installing doesn't match the stable tag on WP.org: