chore: upgrade SLASHED framework to v0.7.7 - #180
Merged
jackgranatowski merged 4 commits intoJul 8, 2026
Merged
Conversation
… jsDelivr resolveLatestTag() trusted jsDelivr's metadata CDN as the sole source of truth for the newest framework release. That CDN is eventually-consistent: a freshly published release can take minutes to appear, so a plugin release cut immediately after a framework release could silently vendor the previous version (the button-component changes in v0.7.7 shipped against v0.7.6 this way). Query GitHub's Releases API (/releases/latest — authoritative, updates on publish, excludes drafts/prereleases) as the primary source, keep jsDelivr as a fallback, and take whichever reports the newer version so we never regress to an older release when one source lags. Authenticates with GITHUB_TOKEN/ GH_TOKEN when present. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZN7sLeiRUkfK7nU6L8DNi
Vendor the framework configurator + bundled CSS from v0.7.7, which the
0.5.4 plugin release missed: the release ran update-framework right after
the framework 0.7.7 release, and "latest" (resolved via the lagging
jsDelivr CDN) still pointed at v0.7.6, so the .sf-btn rework, ghost→tint
token rename, and gradient buttons never reached the plugin.
- SLASHED_*_CSS_REF: v0.7.6 → v0.7.7
- re-vendored admin-app configurator core (ComponentsPanel button UI)
- regenerated inventory/class-hints/variables-hints
- rebuilt admin-app SPA (assets/admin-app/app.{js,css}) so the shipped
configurator carries the new button variants
Plugin release version stays 0.5.4 (no version bump).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZN7sLeiRUkfK7nU6L8DNi
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
📝 WalkthroughWalkthroughThis PR renames ChangesDesign tokens, button gradient/tint styling, and admin-app UI
CSS_REF version bump and update-framework.js resolver
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if (/^\d+\.\d+\.\d+$/.test(ver)) return `v${ver}`; // newest-first; first stable wins | ||
| const ver = bareVer(typeof entry === 'string' ? entry : entry?.version); | ||
| if (STABLE_RE.test(ver)) return `v${ver}`; // newest-first; first stable wins | ||
| } |
CodeQL flagged the network-sourced version tag flowing into the release
download URL / git ref ("network data written to file system"). The tag was
already regex-validated, but .test() isn't recognized as a taint barrier and
the returned value was still a substring of the network response.
Add toStableTag(): validate against ^(\d+)\.(\d+)\.(\d+)$ and rebuild the
tag from the NUMERIC capture groups, so the result is provably v<int>.<int>.<int>
and carries no taint downstream. Both resolvers (GitHub + jsDelivr) now route
through it. Behaviour is unchanged for valid releases; malformed/path-like tags
are rejected as before.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZN7sLeiRUkfK7nU6L8DNi
PR Summary by QodoUpgrade bundled SLASHED framework assets to v0.7.7 (buttons, tint tokens)
AI Description
Diagram
High-Level Assessment
Files changed (24)
|
Code Review by Qodo
Context used✅ Compliance rules (platform):
8 rules 1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
117
to
+127
| "--sf-color-action-a50", | ||
| "--sf-color-action-a80", | ||
| "--sf-color-action-darker", | ||
| "--sf-color-action-ghost", | ||
| "--sf-color-action-lighter", | ||
| "--sf-color-action-muted", | ||
| "--sf-color-action-source-dark", | ||
| "--sf-color-action-source-light", | ||
| "--sf-color-action-subtle", | ||
| "--sf-color-action-superdark", | ||
| "--sf-color-action-superlight", | ||
| "--sf-color-action-tint", |
There was a problem hiding this comment.
3. Tint alias misclassified 🐞 Bug ⚙ Maintainability
Bricks/Gutenberg palette logic still special-cases the ghost alias for ordering/translucency, so *-tint tokens won’t be treated like the prior 5% alpha alias (e.g., checkerboard underlay and curated alias ordering). This makes tint tokens less discoverable and visually misleading once preview values exist.
Agent Prompt
## Issue description
After the framework rename from `ghost` to `tint`, UI code that hardcodes `ghost` as the translucent 5% alias no longer recognizes `tint`, affecting ordering and translucency heuristics.
## Issue Context
- Bricks’ color model uses `ALIAS_ORDER` containing `ghost` and a translucency regex that matches `ghost` but not `tint`.
- Gutenberg presets also include `ghost` in `ALIAS_ORDER`, which affects alias sorting.
## Fix Focus Areas
- SLASHED-for-WP/integrations/bricks/editor-app/src/lib/color-model.js[41-48]
- SLASHED-for-WP/integrations/bricks/editor-app/src/lib/color-model.js[158-163]
- SLASHED-for-WP/integrations/gutenberg/includes/class-presets.php[64-77]
### Concrete fix
1. Replace or augment `ghost` with `tint` in alias ordering lists.
2. Update translucency detection to treat `tint` as translucent.
3. Rebuild any compiled editor assets that vendor these sources.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
The v0.7.7 sync renames the framework's 5%-alpha color alias --sf-color-*-ghost → --sf-color-*-tint, but the plugin's WordPress-side color integration still hardcoded 'ghost'. Effects with the new token set: - Slashed_Color_Resolver emitted hex previews for the now-nonexistent -ghost keys and none for -tint, so Bricks/Gutenberg dropped the swatches for the new tint tokens (swatch builder skips tokens with no preview hex); - alias ordering + translucency/alpha classification keyed off 'ghost', so -tint tokens lost their curated position and checkerboard underlay. Replace 'ghost' with 'tint' in: - includes/class-color-resolver.php (: tint => a5) - bricks/editor-app color-model.js (ALIAS_ORDER, isTranslucent, alpha regex) - gutenberg editor color-model.js (mirrored copy, kept byte-identical) - gutenberg/includes/class-presets.php (ALIAS_ORDER) - tests-php/ColorResolverTest.php (alias expectation) Rebuilt the Bricks editor-app bundle. Full node --test suite + drift/verify gates pass. Reported by Qodo review on PR #180. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZN7sLeiRUkfK7nU6L8DNi
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates the bundled SLASHED framework CSS and vendored configurator from v0.7.6 to v0.7.7. This release introduces:
--sf-card-avatar-size(2.5rem diameter for card avatars)--*-ghostaliases with--*-tintacross all 10 colour families (primary, secondary, tertiary, action, base, neutral, success, warning, info, danger) to better reflect their 5% alpha transparency use case--sf-gradient-actionfor the action colour family (matching primary/secondary/tertiary)--actionmodifier-tintvariants (5% alpha) for success, warning, info, and danger familiesToken count increases from 729 to 735 (6 new tokens: 1 component + 4 status tints + 1 gradient).
Type
Checklist
feat:,fix:,docs:, …)npm testpassesnpm run lintpasses (stylelint +php -l)npm run verifypasses (version metadata in sync)dist/,data/inventory.json,data/variables-hints.jsoncome fromupdate-framework)CHANGELOG.mdupdated under## [Unreleased](framework upgrade, user-facing token additions)Notes
This is a framework upgrade via
npm run update-framework. All changes are generated:dist/andadmin-app/framework-css/regenerated from framework releaseThe
--*-ghost→--*-tintrename is a breaking change for any custom CSS using those tokens, but the framework's own components (.sf-btn,.sf-card) have been updated to use the new names.https://claude.ai/code/session_01QZN7sLeiRUkfK7nU6L8DNi
Summary by CodeRabbit
New Features
Bug Fixes