ElasticPress

Журнал изменений

5.3.5 — 2026-09-10

This is a security release addressing two issues in specific configurations:

• Protected Content: If the feature is active, Authors filtering the admin list by private status could see other authors’ private posts.
• Comments: If the feature is active and the site has password-protected posts, anonymous comment search could return those comments.

Исправлено

• Prevent an array-to-string conversion warning in Custom Search Results when post terms are not a string. Props @burhandodhy and @leedxw.

Безопасность:

• Prevent an explicit private-status filter in the admin post list from exposing other authors’ private posts, including custom private statuses, to users without read_private_posts. Props @Zyy0530, @lzhou1110, @Str1ckl4nd, @mauriceng98, @7thParkk, @felipeelia, and @jeffpaul.
• Prevent the Comments REST search from disclosing approved comments on password-protected posts to unauthenticated visitors. Props @mrglwglwgl and @felipeelia.
• Bumped postcss-selector-parser from 7.1.0 to 7.1.5. Props @dependabot.
• Bumped fast-uri from 3.1.5 to 3.1.7. Props @dependabot.

Разработчик:

• Update @wordpress/env from 11.13.0 to 11.15.0. Props @felipeelia.

5.3.4 — 2026-08-27

Добавлено

• ep_instant_results_excluded_post_types filter to exclude post types from Instant Results facets and search results. Props @Sidsector9 and @feliciaoctocog.
• ep_instant_results_excluded_term_ids filter to exclude taxonomy terms from Instant Results facets. Props @Sidsector9 and @feliciaoctocog.

Изменено

• Hide the Subscription Token value in the Settings page. Props @faisalahammad and @felipeelia.

Исправлено

• Correct WooCommerce Filter by Price results when the shop displays prices including tax. Props @faisalahammad, @stefanmm, and @burhandodhy.
• Prevent TypeError in Elementor template parsing when _elementor_data is an array. Props @muhitasraf.
• Prevent ElasticPress from corrupting cached WP_Post objects by encoding meta and taxonomy values as JSON. Props @burhandodhy and @marc-kohde.
• Resolve translation warnings when generating the POT file. Props @faisalahammad.
• Respect ep_is_facetable false to disable faceting on queries. Props @burhandodhy and @dmitrijCraq.
• Prevent max_num_pages from becoming negative when posts_per_page is -1. Props @burhandodhy and @dmitrijCraq.
• Guard Utils\get_site() and is_site_indexable() against non-existent site IDs. Props @thisismyurl.
• Prevent WooCommerce product_visibility tax queries from forcing product-only site search results. Props @ZacharyRener.
• Disable cache_results for cross-site queries (site__in, site__not_in, or ep_search_scope set to all) and when a persistent object cache is in use. The posts cache is per-blog and keyed by post ID only, so a later get_post() for a local ID could return another site’s content. Props @burhandodhy and @dannyreaktiv.
• Guard the post_author read in format_hits_as_posts(), preventing PHP warnings and a fatal error when the field is missing or malformed in an Elasticsearch hit. Props @freibergergarcia.
• Load React admin screens and Instant Results on WordPress 6.2 by registering the react-jsx-runtime script handle that 10up-toolkit requires and WordPress only ships from 6.6. Props @felipeelia.
• Prevent a WordPress 7.1 deprecation warning by using the help prop instead of __experimentalShowHowTo on FormTokenField. Props @burhandodhy.
• Fix the Features page notice layout on WordPress 7.1. Props @burhandodhy.
• Update ElasticPress.io article URLs to the /resources/articles/ path. Props @burhandodhy.

Безопасность:

• Bumped react-router from 7.14.1 to 7.18.2. Props @dependabot.
• Bumped uuid from 11.0.5 to 14.0.0. Props @dependabot.
• Bumped @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.4. Props @dependabot.
• Bumped fast-uri from 3.0.3 to 3.1.5. Props @dependabot.
• Bumped postcss from 8.4.49 to 8.5.25. Props @dependabot.
• Bumped webpack-dev-server from 5.2.3 to 5.2.6. Props @dependabot.
• Bumped esbuild from 0.28.0 to 0.28.1. Props @dependabot.
• Bumped immutable from 5.1.5 to 5.1.9. Props @dependabot.
• Bumped launch-editor from 2.13.2 to 2.14.1. Props @dependabot.
• Bumped linkify-it from 5.0.0 to 5.0.2. Props @dependabot.
• Bumped markdown-it from 14.1.1 to 14.3.0. Props @dependabot.
• Bumped qs from 6.14.2 to 6.15.3. Props @dependabot.
• Bumped svgo from 3.3.3 to 3.3.4. Props @dependabot.
• Bumped ws from 8.20.0 to 8.21.2 and from 7.5.10 to 7.5.13. Props