The deckerweb Updater connects GitHub releases to the normal WordPress plugin update workflow. Plugin authors embed it in their plugins; users keep the familiar update screen. Public and private repositories share the same engine.
This repository contains the reusable PHP component, tests, integration examples and documentation. If you find it inside a plugin, you do not need to install an additional updater plugin.
Version: 2.1.0 · PHP ≥ 8.1 · WordPress requirements follow the host; tested on 6.7 and 7.1.2.
Documentation · FAQ · Security
- At a Glance
- Installation and first steps
- Main features
- Found the updater in your plugin?
- For developers
- FAQ
- Changelog
- Author and scope
- Questions and support
- GitHub releases in the native WordPress update workflow.
- Public repositories without credentials; optional private repositories with a provider.
- Release ZIP assets and source-archive fallback.
- Host-provided icons, banners and plugin information.
- All interface strings in the host plugin’s existing textdomain.
For plugin users: update the embedding plugin as usual under Dashboard → Updates or Plugins. Your plugin author decides whether and how this component is included.
For developers: copy a pinned runtime version into the host, register it after translations initialize and preserve the host’s full package validation. The repository ZIP is a component source package. See integration and the adapter template.
Published stable releases become update offers for the matching plugin. Drafts, prereleases and older versions are not offered. The component does not turn on automatic updates.
Public repositories use the existing unauthenticated flow. Private repositories obtain credentials from a repository-bound provider. Private API downloads resolve temporary URLs at download time and do not forward the token to the download host.
Icons, banners, names and descriptions come from the host. Release notes appear as escaped text in the plugin details dialog. Structured footer changelogs and localized wiki links remain host features.
The host owns translation catalogs. A per-instance callback translates updater messages when they are displayed; no extra updater textdomain is loaded.
You do not need a GitHub account or token for public plugin updates. Private updates need installation-managed credentials; follow your plugin maintainer’s setup instructions. No token is shipped inside the plugin.
GitHub update checks and package downloads contact external servers, which can see the requesting IP address. This component adds no analytics. Core WordPress and the host may make other requests under their own policies.
Use the host plugin’s documentation for its requirements, activation behavior and uninstall cleanup. See data and requests.
The updater is GPL-2.0-or-later. Explore or reuse it with its origin and license intact. Start with integration, authentication, tests and release conventions.
Before replacing an installed plugin, the host must verify the actual candidate identity, Update URI, offered version and WordPress/PHP requirements. Keep this check active in both single and bulk updates. Check capabilities before using new options beside older loaded V2 copies.
No. The host embeds a pinned version. Use the host plugin’s normal installation and update steps.
No. Public repositories remain unauthenticated. Only configured private repositories need credentials.
Yes. The host must enable private mode and provision a repository-bound provider. A fine-grained PAT with Contents read and Metadata read supports the tested release and archive endpoints.
No. It supports the normal WordPress update engine. Automatic-update preferences remain with WordPress and the host.
Yes, with guarded loading. The first loaded class wins; check the private/translation capabilities and coordinate deployed versions.
No. Updater strings are merged into the host’s catalogs and translated through a host callback.
Private downloads are rejected even if metadata is still cached. A rejected download does not replace the installed plugin; activation behavior remains the responsibility of the calling host workflow.
-
New: Private GitHub updates through a repository-bound authentication provider.
-
New: Updater messages use the host plugin’s existing textdomain, including German Du/Sie catalogs.
-
Improved: Authenticated release assets and source archives share the native WordPress update workflow.
-
Improved: Token rotation supports explicit metadata-cache invalidation.
-
Fixed: Private downloads and archive normalization handle Core’s per-package bulk context.
-
Misc: Existing public calls, local artwork and release information remain supported.
Developed and maintained by David Decker — DECKERWEB. A shared embedded component for GitHub-distributed WordPress plugins.
Use issues for component questions and reproducible bugs without sensitive details. For plugin-specific integration issues, contact the host maintainer. Read security reporting before sharing a suspected vulnerability.
Ko-fi · Buy Me a Coffee · PayPal
Copyright © 2026 David Decker — DECKERWEB. GPL-2.0-or-later. LICENSE · Assets.