GitShow/facebook/facebook-for-woocommerce
facebook

facebook-for-woocommerce

The official plugin from Meta. This repository is now officially owned by Meta's Partner Engineering team. We welcome and encourage contributions from the community.

by facebook
Star on GitHubForkWebsite

PHP

260 stars192 forks139 contributorsActive · 7h agoSince 2017v3.7.6GPL-2.0

Meet the team

See all 139 on GitHub →
rawdreeg
rawdreeg365 contributions
budzanowski
budzanowski275 contributions
ibndawood
ibndawood199 contributions
message-dimke
message-dimke170 contributions
danbitzer
danbitzer163 contributions
layoutd
layoutd130 contributions
vink28
vink2889 contributions
vahidkay-meta
vahidkay-meta88 contributions

Languages

View on GitHub →
PHP85.3%
JavaScript13.4%
CSS0.7%
Shell0.6%

Commit activity

Last 12 weeks · 36 commits

Full graph →

Community health

5 of 6 standards met

Community profile →
87
✓README✓License✓Contributing✓Code of Conduct○Issue Template✓PR Template

Recent PRs & issues

Active · Last activity 7h ago
See all on GitHub →
jczhuoMeta
Remove the retired WooCommerce connection bridgeOpenPR

Description Removes the retired WooCommerce-hosted OAuth and token-exchange path that is no longer used by the current embedded onboarding and reconnect flows. This change: removes the legacy callback, token-exchange handler, URL and parameter builders, related constants, exception, and duplicate exception tests; removes the obsolete connection-failure retry notice; sends the Product Sync disconnected CTA to the plugin settings page; keeps the current embedded onboarding, app-store login, REST extras, webhook, and disconnect paths unchanged. This supersedes #4011 and #4012. Compatibility note This is a breaking developer-facing cleanup. The removed methods and filters have no callers in this repository, but third-party extensions may call them. Removed methods: , , , , , , , , and . Removed filters: , , , , , and . Type of change Break (change that can affect existing public API consumers) Checklist [x] I have commented my code, particularly in hard-to-understand areas, if any. [x] I have confirmed that my changes do not introduce any new PHPCS warnings or errors. [ ] I have checked plugin debug logs for new PHP warnings or fatal errors. [x] I followed general pull request best practices. [x] I have updated focused tests and all PHP and JavaScript unit tests pass locally. [x] I conducted repository-wide due diligence to ensure that this does not break existing plugin functionality. [x] Documentation changes are not required beyond the compatibility note above. Changelog entry Remove the retired WooCommerce-hosted connection bridge. Test Plan Completed locally [x] PHP unit suite on PHP 8.2, WordPress 7.1, and WooCommerce 11.0.1 — 1,995 tests and 143,294 assertions passed. [x] — 104 tests passed. [x] PHPCS on every modified production file — 0 errors and 0 warnings. [x] on every changed PHP file. [x] . [x] Repository-wide searches found no remaining references to the removed methods, class, callback, transient, or filters. cannot process deleted files and exits with ; PHPCS was therefore run directly on every modified production file. Manual verification Manual dogfooding remains to be completed: 1. Install the PR build on a non-production WooCommerce site. 2. Complete the standard embedded onboarding flow and confirm the connection succeeds and settings persist. 3. Invalidate the stored token and confirm reconnect routes through the current settings/onboarding flow. 4. Visit Product Sync while disconnected and confirm the CTA opens plugin settings rather than a WooCommerce-hosted OAuth URL. 5. Confirm the plugin debug log contains no new warnings or fatal errors. Screenshots Not applicable; this removes an obsolete notice and retargets an existing link.

jczhuoMeta · 6h ago
bmzero
Existing promotions feed schedule is not migrated from hourly to two-hour intervalOpenIssue

🔎 Isolate the bug [ ] I have confirmed this occurs in the most recent version of WordPress, WooCommerce, and Meta for WooCommerce. [ ] I have confirmed this occurs when only WooCommerce and Meta for WooCommerce are active and when using a default WordPress or WooCommerce theme. This was observed and corrected on a production store running WordPress 7.0.4, WooCommerce 11.0.0, and Meta for WooCommerce 3.7.6. I have not reproduced it on a minimal installation, but the stale recurrence is directly visible in Action Scheduler and follows from the scheduling logic described below. ✍️ Describe the bug Meta for WooCommerce 3.7.6 defines the promotions feed generation interval as two hours: However, an existing recurring Action Scheduler record retained its older 3,600-second interval after the plugin was upgraded. only creates the recurring action when none exists: It does not compare the existing action's recurrence with . Consequently, stores upgrading from a version that scheduled this feed hourly can continue regenerating it hourly indefinitely, even though the installed code expects a two-hour cadence. On a store with a large coupon catalog, each hourly launch produced approximately 149 actions. WordPress then made repeated loopback requests to: Many queue-runner callbacks took several seconds, one exceeded twenty seconds, and the bursts correlated with origin-health latency alerts. There was no PHP-FPM worker-limit event during the examined incident. This appears related to the Action Scheduler volume and loopback behavior reported in #3874, but the specific defect here is that an existing recurring schedule is not migrated when the plugin's intended interval changes. 🚶‍♀️ Steps to reproduce 1. Install a Meta for WooCommerce version that creates with a 3,600-second recurring interval, or create an equivalent recurring Action Scheduler action. 2. Upgrade to Meta for WooCommerce 3.7.6, where returns . 3. Allow the plugin and Action Scheduler to initialize normally. 4. Inspect the pending recurring action using Action Scheduler or the table. 5. Observe that its serialized recurrence remains 3,600 seconds rather than changing to 7,200 seconds. 6. Allow the schedule to run and observe that promotions-feed generation still launches hourly. As a production correction, I canceled only the stale recurring action and recreated it in the same group with the same next-run timestamp and a 7,200-second interval. Readback confirmed the old action was canceled, the replacement was pending with the correct recurrence, and catalog synchronization remained enabled. ✔️ Expected behavior When the plugin's intended feed-generation interval changes, existing recurring actions should be migrated to the current interval without requiring administrators to discover and replace stale Action Scheduler records manually. A narrow fix could inspect the existing recurring action's schedule during plugin upgrade or feed initialization. If its recurrence differs from , replace only that recurring action while preserving the next-run timestamp, arguments, and group. 🗃 Logs Sanitized Action Scheduler evidence Environment: Before correction: Observed workload from one launch: After replacing only the stale recurring action: No credentials, customer data, request addresses, or private infrastructure details are included. Related reports: #3874 https://wordpress.org/support/topic/performance-issue-with-promotions-feed-generator-on-large-woocommerce-store/

bmzero · 3d ago
betayazilim
prepare_product() clears the WordPress page cache on every feed sync, even when nothing changedOpenIssue

🔎 Isolate the bug [X] I have confirmed this occurs in the most recent version of WordPress, WooCommerce, and Meta for WooCommerce. [X] I have confirmed this occurs when only WooCommerce and Meta for WooCommerce are active and when using a default WordPress or WooCommerce theme. ✍️ Describe the bug — the function that builds the feed payload, i.e. a read path — invalidates the store's full-page cache as a side effect, unconditionally, on every call. 3. Pick a product and run the feed preparation twice in a row, changing nothing in between: 4. Both calls log a purge, although the second wrote no meta at all. Without WP Rocket the same effect is visible by hooking directly. ✔️ Expected behavior Building the feed payload should not invalidate the storefront page cache. Concretely, either of these would resolve it: Preferred — drop from this path. on line 822 already satisfies the stated intent ("ensure fresh values are read") without touching any page cache. Otherwise — make it conditional. Collect the return values of and clear only when at least one write actually happened: It would also help integrators if the mapped-attribute write were separated from altogether — a function named "prepare" that persists meta and invalidates caches is surprising, and it is what makes the cost hard to find. 🗃 Logs Environment WordPress: 6.9 WooCommerce: 10.9.4 Meta for WooCommerce: 3.7.6 PHP: 8.4 Page cache: WP Rocket 3.23 + Cloudflare Object cache: Object Cache Pro (Redis) HPOS: enabled Related: #3900 (earlier code-review findings against 3.6.0 — this defect is not among them).

betayazilim · 2w ago

Recent fixes

View closed PRs →
jczhuoMeta
Remove dead Woo Connection Bridge OAuth surface (#4011)MergedPR

Summary: Description Removes the Woo-hosted OAuth / token-exchange entrypoint (the "Woo Connection Bridge") and the helpers, exception, and UI that existed only to serve it. The bridge is dead. Commerce Partner Hub (CPH) onboarding and invalid-token reconnects do not route through it: Meta supplies the BISU through the Commerce Extension iframe and the plugin persists it over local REST. Retaining these paths advertises a fallback that cannot work. Removed : Constants , , , , , , and the property. The callback and its display formatter . The URL/parameter builders , , , , and the connect-parameter builder. Elsewhere: and its two duplicate test files. The retry notice in ( and its registration); its only "try again" target was the dead bridge. Changed The Product Sync disconnected CTA now points at the plugin settings/CPH page instead of . Preserved Deliberately out of scope for this checkpoint: App Store redirect/authentication, , the Woo webhook and system-user handling, local disconnect, active CPH tokens/assets/CPI/CMS state, and the current Commerce Extension iframe/postMessage flow. Notes for reviewers This removes public API without a deprecation cycle. The seven deleted methods are public and have no remaining in-repository callers, but third-party plugin or theme callers cannot be ruled out from in-repo analysis. Preserving their behavior is not an option worth taking — every one of them routes into a dead service. Three public filters go with them: , , and . Product Sync CTA reachability. Product Sync is a local WooCommerce settings tab, not part of the CPH iframe, and is not bridge-dependent. It renders only for connected CPH merchants with off; disconnected merchants do not receive the tab. The disconnected CTA is therefore effectively unreachable under normal CPH routing — this change is defensive, so that if it is ever reached it opens settings/CPH rather than a dead endpoint. Overlap watch:** https://github.com/facebook/facebook-for-woocommerce/issues/3991 separately proposes removing category/tag exclusions. No overlap intended here. Type of change Tweak (non-breaking change which fixes code modularity, linting or phpcs issues) Checklist [x] I have confirmed that my changes do not introduce any new PHPCS warnings or errors. [x] I followed general Pull Request best practices. [x] I have conducted due diligence to ensure that this does not break existing functionality. [x] I have called out the public-API removal boundary explicitly above. [ ] Manual dogfooding on a live CPH-connected store remains to be completed. Changelog entry Remove the retired Woo-hosted connection bridge OAuth and token-exchange code. Test Plan: Completed locally [x] — 104 tests passed [x] on every modified production file — 0 errors, 0 warnings [x] on every changed PHP file [x] [x] Repository-wide search confirms no remaining references to , , , or cannot run on this change: errors on the deleted files (). PHPCS was run directly on the modified files instead. Not run locally WordPress PHPUnit is unavailable in this environment ( not installed) and Playwright E2E needs credentials that are not configured locally, so both rely on CI. Manual verification 1. Install the PR build on a non-production WooCommerce site. 2. Complete onboarding through the Commerce Extension iframe and confirm the connection succeeds and settings persist. 3. Invalidate the stored token and confirm the reconnect flow still routes through CPH. 4. Visit the Product Sync tab while disconnected and confirm the CTA opens plugin settings, not a WooCommerce-hosted OAuth URL. 5. Confirm no PHP warnings or fatals appear in the plugin debug log. Screenshots Not applicable; no UI changes beyond the removed retry notice and the retargeted CTA link. Differential Revision: D115897493 Pulled By: jczhuoMeta

jczhuoMeta · 6h ago
jczhuoMeta
Remove the dead Commerce connect URL builder (#4012)MergedPR

Summary: Second checkpoint of the Woo Connection Bridge removal, stacked on D115897493 (#4011). built a Facebook Commerce Manager onboarding URL whose pointed at the WooCommerce-hosted proxy (), which redirected back to a callback on the store. That callback has no registered handler anywhere in the plugin, so the round trip could not complete even while the bridge was alive. Its only caller was the redirect inside , which the parent diff deletes. With the parent applied the whole cluster is unreachable. Removed from : and its only callee . The constants and . The public filters and , which went with those methods. / are deliberately kept: still reads on the live Commerce Extension iframe path. This removes public API without a deprecation cycle, on the same basis as the parent diff: the two methods and two filters are public, but both methods route into a dead WooCommerce-hosted service, so preserving their behavior has no value. Still deferred to a later checkpoint, and unchanged here: the App Store redirect, , the Woo webhook route and handler, and the residual . Those are reached dynamically through WordPress action and REST hooks and warrant their own review. Differential Revision: D115937285

jczhuoMeta · 1w ago
arpitjain099
ci: declare workflow-level `contents: read` on 4 workflowsMergedPR

Pins the default to on 4 workflows in that don't call a GitHub API beyond the initial checkout. Why CVE-2025-30066 (March 2025 supply-chain compromise) exfiltrated from workflow logs. Pinning per workflow caps runtime authority irrespective of the repo or org default, gives drift protection if the default ever widens, and is credited per-file by the OpenSSF Scorecard check. YAML validated locally with on each touched file.

arpitjain099 · 1w ago
Structured data for AI agents

Repository: facebook/facebook-for-woocommerce. Description: The official plugin from Meta. This repository is now officially owned by Meta's Partner Engineering team. We welcome and encourage contributions from the community. Stars: 260, Forks: 192. Primary language: PHP. Languages: PHP (85.3%), JavaScript (13.4%), CSS (0.7%), Shell (0.6%). License: GPL-2.0. Homepage: https://wordpress.org/plugins/facebook-for-woocommerce/ Latest release: v3.7.6 (4w ago). Open PRs: 100, open issues: 127. Last activity: 7h ago. Community health: 87%. Top contributors: rawdreeg, budzanowski, ibndawood, message-dimke, danbitzer, layoutd, vink28, vahidkay-meta, mengyingdu, sol-loup and others.

·@ofershap

Replace github.com with gitshow.dev