deckerweb Updater

About

The deckerweb Updater connects GitHub releases to the normal WordPress plugin update workflow. Plugin authors embed it in their plugins; users keep the familiar update screen. Public and private repositories share the same engine.

This repository contains the reusable PHP component, tests, integration examples and documentation. If you find it inside a plugin, you do not need to install an additional updater plugin.

Version: 2.2.1 · PHP ≥ 8.1 · WordPress requirements follow the host; tested on 6.7 and 7.1.2.

Documentation · FAQ · Security

At a Glance
Installation and first steps
Main features
Found the updater in your plugin?
For developers
FAQ
Changelog
Author and scope
Questions and support

At a Glance

GitHub releases in the native WordPress update workflow.
Public repositories without credentials; optional private repositories with a provider.
Release ZIP assets and source-archive fallback.
Host-provided icons, banners and plugin information.
All interface strings in the host plugin’s existing textdomain.

Installation and first steps

For plugin users: update the embedding plugin as usual under Dashboard → Updates or Plugins. Your plugin author decides whether and how this component is included.

For developers: copy a pinned runtime version into the host, register it after translations initialize and preserve the host’s full package validation. The repository ZIP is a component source package. See integration and the adapter template.

Main features

One workflow for GitHub updates

Published stable releases become update offers for the matching plugin. Drafts, prereleases and older versions are not offered. The component does not turn on automatic updates.

Public and private repositories

Public repositories use the existing unauthenticated flow. Private repositories obtain credentials from a repository-bound provider. Private API downloads resolve temporary URLs at download time and do not forward the token to the download host.

Keep the host’s identity

Icons, banners, names and descriptions come from the host. Release notes appear as escaped text in the plugin details dialog. Structured footer changelogs and localized wiki links remain host features.

One textdomain per plugin

The host owns translation catalogs. A per-instance callback translates updater messages when they are displayed; no extra updater textdomain is loaded.

Found the updater in your plugin?

You do not need a GitHub account or token for public plugin updates. Private updates need installation-managed credentials; follow your plugin maintainer’s setup instructions. No token is shipped inside the plugin.

GitHub update checks and package downloads contact external servers, which can see the requesting IP address. This component adds no analytics. Core WordPress and the host may make other requests under their own policies.

Use the host plugin’s documentation for its requirements, activation behavior and uninstall cleanup. See data and requests.

For developers

The updater is GPL-2.0-or-later. Explore or reuse it with its origin and license intact. Start with integration, authentication, tests and release conventions.

Before replacing an installed plugin, the host must verify the actual candidate identity, Update URI, offered version and WordPress/PHP requirements. Keep this check active in both single and bulk updates. Use the returned implementation class and check its capabilities; see the 2.2.1 adapter template.

FAQ

Do I install a separate updater plugin?

No. The host embeds a pinned version. Use the host plugin’s normal installation and update steps.

Do public updates need a GitHub token?

No. Public repositories remain unauthenticated. Only configured private repositories need credentials.

Can I update from a private repository?

Yes. The host must enable private mode and provision a repository-bound provider. A fine-grained PAT with Contents read and Metadata read supports the tested release and archive endpoints.

Does the updater enable automatic updates?

No. It supports the normal WordPress update engine. Automatic-update preferences remain with WordPress and the host.

Can several plugins embed V2?

Yes. From 2.2.1, updated adapters use the class returned by their pinned runtime include. They work even when a different plugin loaded an older V2 class first. Old adapters need migration to this include contract; replacing the PHP file alone is insufficient. See integration for the exact steps.

Is there an extra textdomain?

No. Updater strings are merged into the host’s catalogs and translated through a host callback.

What happens when a token is revoked?

Private downloads are rejected even if metadata is still cached. A rejected download does not replace the installed plugin; activation behavior remains the responsibility of the calling host workflow.

All questions by topic.

Changelog

2.2.1 · 2026-10-21

Fixed: Updated host integrations use their pinned updater even when another plugin has already loaded an older V2 implementation.
Improved: Release metadata caches are separated by implementation version, repository and public/private mode.

2.2.0 · 2026-10-21

New: Optional public catalog providers verify fresh release approval and the downloaded package checksum.
Improved: A shared, dismissible administrator notice helps identify possible conflicts with active Git Updater installations.
Fixed: Configuration error messages are escaped, malformed update contexts are ignored, and public package URLs are validated more strictly.
Misc: Expanded inline API documentation and host translation templates.

2.1.0 · 2026-10-06

New: Private GitHub updates through a repository-bound authentication provider.
New: Updater messages use the host plugin’s existing textdomain, including German Du/Sie catalogs.
Improved: Authenticated release assets and source archives share the native WordPress update workflow.
Improved: Token rotation supports explicit metadata-cache invalidation.
Fixed: Private downloads and archive normalization handle Core’s per-package bulk context.
Misc: Existing public calls, local artwork and release information remain supported.

Author and scope

Developed and maintained by David Decker — DECKERWEB. A shared embedded component for GitHub-distributed WordPress plugins.

Questions and support

Use issues for component questions and reproducible bugs without sensitive details. For plugin-specific integration issues, contact the host maintainer. Read security reporting before sharing a suspected vulnerability.

Ko-fi · Buy Me a Coffee · PayPal

Copyright and license

Imported from the published component 2.2.1. Original source · Deutsch