# Changelog

All notable changes to WooCommerce Post-Labelcenter are documented here.

## [2.1.2] — 2026-05-13

### Fixed

- Deleting a shipment created with "Nur Datenimport" no longer shows "Label konnte nicht gelöscht werden" — the PLC cancel API call is skipped when no `documentId` exists (the API returns `null` for data-import-only shipments)

### Added

- Warning dialog before deleting a "Nur Datenimport" shipment, informing the user that the label must be cancelled manually in the PLC tool

## [2.1.1] — 2026-05-07

### Added

- BMI/BMIS-specific shipment options: "Einschreiben Einfach" (152), "Format P" (153), "Format B" (154), "Eco" (202) — checkboxes visible in order metabox only when selected product name contains "BMI"; features included in API payload conditionally

## [2.1.0] — 2026-05-05

### Added

- Root `composer.json` — dev-tool dependencies only (phpcs, phpstan, stubs); production SDK remains in committed `includes/vendor/`
- GitLab CI: `quality:static` (phpstan + optional i18n helpers) required; `quality:phpcs` is `allow_failure` until remaining WPCS issues are cleared
- `phpstan-baseline.neon` — existing level-5 findings recorded for incremental cleanup
- PHPCBF auto-fixes applied across the plugin (`WordPress` ruleset formatting)
- `wc_get_logger()` integration — debug output now visible in WooCommerce → Status → Logs
- `admin/class-wc-plc-ajax.php` (`Wc_Plc_Ajax`) — all AJAX handlers extracted from main admin class
- `admin/class-wc-plc-emails.php` (`Wc_Plc_Emails`) — email/placeholder methods extracted

### Changed

- Root-level `vendor/` (gitignored) holds Composer dev tools; `includes/vendor/` stays versioned for the Greenfield SDK (CI cannot install it from the private registry)
- Plugin header: added `Requires at least: 6.3`, `Requires PHP: 8.1`, `WC requires at least: 8.2`
- Version bumped to 2.1.0

## [2.0.5] — 2026-05-04

### Security

- ABSPATH guard added to every PHP file
- All `$wpdb` queries converted to prepared statements
- Nonce action renamed from `secure_nonce_name` to `wc_plc_admin` / `wc_plc_public`
- `wp_ajax_nopriv_*` registrations removed for all admin-only actions
- `unserialize()` replaced with JSON decode shim (`plc_decode_stored_assoc`)
- XSS: `esc_html()` applied to API data echoed in selected templates
- `$_POST` inputs sanitised (`absint`, `sanitize_text_field`, `wc_clean`) in handlers
- Screen-options handler: `check_admin_referer` and sanitised option values

### Added

- HPOS `declare_compatibility('custom_order_tables')` in `before_woocommerce_init`
- Guzzle timeouts (60s request, 5s connect)
- Transient cache (1h) for branch-search results
- Idempotency check: prevents duplicate shipment creation on repeated status changes
- Branch session AJAX endpoints for checkout plugin compatibility

### Fixed

- Various admin AJAX and checkout edge cases hardened
