WordPress.org

Resolved Anthony Hortin
(@ahortin)

1 year, 2 months ago

I received an email from one of my sites this morning advising that WooCommerce Stripe Gateway automatically updated from v7.4.0 to 7.4.1.

Auto-Updates aren’t enabled for this plugin, in the Dashboard, and there’s no setting in the plugin settings to enable/disable auto-updates.

screenshot: https://share.getcloudapp.com/4guXYAYx

I presume this functionality is built into the plugin, as there’s no other plugins on my site that auto-update, as I’ve specifically not enabled auto-updates on plugins. Why did this this plugin auto-update? If this is built into the plugin then you either need to remove the functionality, or provide us with an option to disable auto-updates. At the moment, you’re overriding core WordPress functionality by not obeying the auto-update setting for that plugin, that is built into core.

There’s nothing in the plugin changelog to indicate that this was just a “once off” plugin update to fix a security issue, so I assume this is functionality that you’ve now built into the plugin. Please obey core WP settings. I don’t want my plugins auto-updating.

Thanks.

Viewing 6 replies - 1 through 6 (of 6 total)

Česlav Przywara
(@chesio)

1 year, 2 months ago
Happened to one of my websites too. I assume it’s a forced update from WordPress.org (again)… See also:
- This reply was modified 1 year, 2 months ago by Česlav Przywara.
Thread Starter Anthony Hortin
(@ahortin)

1 year, 2 months ago

Thanks for that. It would have been nice if they mentioned this in their changelog, if that is what happened.

Plugin Support dougaitken
(@dougaitken)

Automattic Happiness Engineer

1 year, 2 months ago

Hey @ahortin!

Thanks for reaching out, I can appreciate the surprise seeing that the WooCommerce Stripe Payment Gateway had updated when auto updates were disabled.

There are occasions for updates where plugins have the option to override the default setting, but this is not something the Woo team can do ourselves and this must be authorized and handled by the Plugin Review team.

There will be an email sent to the Stripe account holder with more details – we wanted to ensure sites were updated before sharing more information about this.

Please know this wasn’t an update taken lightly. This was a required release that needed to be updated on all sites.

Thanks,

Thread Starter Anthony Hortin
(@ahortin)

1 year, 2 months ago

Hi Doug,

Thanks for the update. I’ve got no issue with the plugin being updated when it’s a high security issue being fixed. It’s good to know this isn’t some feature that’s been added to the plugin with no control over it. It would’ve been good to see some details in the changelog though, as to what the update was for, even if it just said something like “Security fix”.

Thanks.

Plugin Support abwaita a11n
(@abwaita)

1 year, 2 months ago

Hi @ahortin ,

It would’ve been good to see some details in the changelog though, as to what the update was for, even if it just said something like “Security fix”.

I hear you! The changelog captures the fixes added, though the issue itself may not be too obvious/pronounced in the logs.

Thread Starter Anthony Hortin
(@ahortin)

1 year, 2 months ago

@abwaita Thanks for those details.

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Plugin updated automatically when it shouldn’t’ is closed to new replies.