[cs1m0n]

Problem

bcc-login's package.json says it needs WordPress 3.0 and PHP 5.3. The plugin's updater reads these values from master and offers new versions to every site above them, including sites the new versions break:

• The settings page and the editor's visibility panel depend on react-jsx-runtime, which WordPress added in 6.6. On older versions WordPress doesn't load them.
• The PHP code uses typed properties (PHP 7.4) and functions from WordPress 5.4+ (is_favicon(), which runs on every front-end request).

The updater also compared with <, so a site running exactly the required WordPress version (WordPress reports 6.6.0 as 6.6) never got updates.

Changes

• package.json: requires 6.6, requires_php 7.4, and tested 7.0 (it said 5.8, below the new minimum).
• The updater offers an update when the site runs at least these versions (<=).
• bcc-login.php: Requires at least: 6.6 and Requires PHP: 7.4 headers, so WordPress itself won't activate the plugin on older versions.

The updater reads package.json from master, so once this is merged, sites below WordPress 6.6 or PHP 7.4 stop being offered updates. They keep the version they have.

Merging

• Merge this after Report each site's versions and user counts to the widgets API #228 (the site report) has been released, and leave a day between them. Report each site's versions and user counts to the widgets API #228 was released as v1.2.14 on 14 October at 09:11 UTC, so merge this on 15 October or later. Once this is on master, sites below WordPress 6.6 or PHP 7.4 stop getting updates, including the release that makes them report. With a day in between, they still pick up the report first, so the inventory shows exactly those sites.
• The release bot rewrites last_updated, the line after requires_php, on every release. After another bcc-login release this branch needs a rebase: keep both changes in package.json.
• Installed sites still run the old < check until they update. So a site on exactly WordPress 6.6.0 gets this release only once it's on 6.6.1 or later. The <= change helps from the next release on.

Testing

• All 23 PHP files pass php -l on PHP 7.4. The only PHP 8 function in use, str_contains, is provided by WordPress 5.9+.
• The built settings.asset.php and visibility.asset.php list react-jsx-runtime as a dependency.
• The new comparison offers updates for WordPress 6.6, 6.6.1 and 7.0.2, and not for 6.5.5 or 6.6-RC1. It offers them for PHP 7.4.0 and 8.4, and not for 7.3.
• PHPStan with the CI config passes.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Compatibility metadata remains contradictory, and prerequisite PR #228 has not yet been released.

2 open findings

• Delay requirement change until release #228 is published · New
• Update tested version to match the raised minimum requirement · New

What changed in this PR

Declares BCC Login’s runtime requirements and aligns update eligibility checks.

Changes:

• Requires WordPress 6.6 and PHP 7.4.
• Allows updates when versions exactly meet minimums.
• Adds matching WordPress plugin headers.

File	Description
plugins/​bcc-login/​package.json	Updates minimum versions.
plugins/​bcc-login/​includes/​class-bcc-login-updater.php	Makes minimum comparisons inclusive.
plugins/​bcc-login/​bcc-login.php	Adds activation requirement headers.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.