This is a security release addressing two issues in specific configurations:

• Protected Content: If the feature is active, Authors filtering the admin list by private status could see other authors' private posts.
• Comments: If the feature is active and the site has password-protected posts, anonymous comment search could return those comments.

Fixed

• Prevent an array-to-string conversion warning in Custom Search Results when post terms are not a string. Props @burhandodhy and @leedxw via #4364.

Security

• Prevent an explicit private-status filter in the admin post list from exposing other authors' private posts, including custom private statuses, to users without read_private_posts. Props @Zyy0530, @lzhou1110, @Str1ckl4nd, @mauriceng98, @7thParkk, @felipeelia, and @jeffpaul via #4366.
• Prevent the Comments REST search from disclosing approved comments on password-protected posts to unauthenticated visitors. Props @mrglwglwgl and @felipeelia via #4366.
• Bumped postcss-selector-parser from 7.1.0 to 7.1.5. Props @dependabot via #4363.
• Bumped fast-uri from 3.1.5 to 3.1.7. Props @dependabot via #4363.

Developer

• Update @wordpress/env from 11.13.0 to 11.15.0. Props @felipeelia via #4367.

See: https://github.com/10up/ElasticPress/milestone/96?closed=1

Added

• ep_instant_results_excluded_post_types filter to exclude post types from Instant Results facets and search results. Props @Sidsector9 and @feliciaoctocog via #4290.
• ep_instant_results_excluded_term_ids filter to exclude taxonomy terms from Instant Results facets. Props @Sidsector9 and @feliciaoctocog via #4290.

Changed

• Hide the Subscription Token value in the Settings page. Props @faisalahammad and @felipeelia via #4324 and #4361.

Fixed

• Correct WooCommerce Filter by Price results when the shop displays prices including tax. Props @faisalahammad, @stefanmm, and @burhandodhy via #4338 and #4347.
• Prevent TypeError in Elementor template parsing when _elementor_data is an array. Props @muhitasraf via #4341.
• Prevent ElasticPress from corrupting cached WP_Post objects by encoding meta and taxonomy values as JSON. Props @burhandodhy and @marc-kohde via #4342.
• Resolve translation warnings when generating the POT file. Props @faisalahammad via #4323.
• Respect ep_is_facetable false to disable faceting on queries. Props @burhandodhy and @dmitrijCraq via #4337.
• Prevent max_num_pages from becoming negative when posts_per_page is -1. Props @burhandodhy and @dmitrijCraq via #4336.
• Guard Utils\get_site() and is_site_indexable() against non-existent site IDs. Props @thisismyurl via #4319.
• Prevent WooCommerce product_visibility tax queries from forcing product-only site search results. Props @ZacharyRener via #4321.
• Disable cache_results for cross-site queries (site__in, site__not_in, or ep_search_scope set to all) and when a persistent object cache is in use. The posts cache is per-blog and keyed by post ID only, so a later get_post() for a local ID could return another site's content. Props @burhandodhy and @dannyreaktiv via #4353 and #4355.
• Guard the post_author read in format_hits_as_posts(), preventing PHP warnings and a fatal error when the field is missing or malformed in an Elasticsearch hit. Props @freibergergarcia via #4354.
• Load React admin screens and Instant Results on WordPress 6.2 by registering the react-jsx-runtime script handle that 10up-toolkit requires and WordPress only ships from 6.6. Props @felipeelia via #4356.
• Prevent a WordPress 7.1 deprecation warning by using the help prop instead of __experimentalShowHowTo on FormTokenField. Props @burhandodhy via #4358.
• Fix the Features page notice layout on WordPress 7.1. Props @burhandodhy via #4359.
• Update ElasticPress.io article URLs to the /resources/articles/ path. Props @burhandodhy via #4360.

Security

• Bumped react-router from 7.14.1 to 7.18.2. Props @dependabot via #4351.
• Bumped uuid from 11.0.5 to 14.0.0. Props @dependabot via #4314.
• Bumped @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.4. Props @dependabot via #4314.
• Bumped fast-uri from 3.0.3 to 3.1.5. Props @dependabot via #4314 and #4343.
• Bumped postcss from 8.4.49 to 8.5.25. Props @dependabot via #4314 and #4343.
• Bumped webpack-dev-server from 5.2.3 to 5.2.6. Props @dependabot via #4314 and #4343.
• Bumped esbuild from 0.28.0 to 0.28.1. Props @dependabot via #4343.
• Bumped immutable from 5.1.5 to 5.1.9. Props @dependabot via #4343.
• Bumped launch-editor from 2.13.2 to 2.14.1. Props @dependabot via #4343.
• Bumped linkify-it from 5.0.0 to 5.0.2. Props @dependabot via #4343.
• Bumped markdown-it from 14.1.1 to 14.3.0. Props @dependabot via #4343.
• Bumped qs from 6.14.2 to 6.15.3. Props @dependabot via #4343.
• Bumped svgo from 3.3.3 to 3.3.4. Props @dependabot via #4343.
• Bumped ws from 8.20.0 to 8.21.2 and from 7.5.10 to 7.5.13. Props @dependabot via #4343.
• Bumped websocket-driver from 0.7.4 to 0.7.5. Props @dependabot via #4343.

See: https://github.com/10up/ElasticPress/milestone/95?closed=1

Added

• Numbered pagination option for Instant Results. Props @ZacharyRener via #4274.
• New elasticpress_general_ep_screens filter. Props @felipeelia via #4256.
• New ep_feature_requirements_status_* filters and a new "Temporarily disabled" feature status (in code). Props @felipeelia via #4265.

Changed

• Optimize mb_strlen calls during sync process. Props @kasparsd via #4304.
• Saving feature settings now reflects feature dependencies without refreshing the page. Props @ZacharyRener via #4275.

Fixed

• Keep the sync running when code outputs directly in the post content. Props @burhandodhy, @tomjn, and @felipeelia via #4266.
• Prevent saving Custom Results while posts are loading. Props @burhandodhy via #4260.
• Update label for bulk request timeout in ElasticPress status report. Props @burhandodhy via #4259.
• Undefined array key warnings in Weighting.php. Props @burhandodhy and @BWBama85 via #4270.
• Ensure the Sync creates the Instant Results templates for all the sites. Props @burhandodhy and @anjulahettige via #4258.
• Ensure that WordPress caches the meta and term queries. Props @burhandodhy and @maciejmackowiak via #4268.
• An issue where posts were not returned correctly when the search term contained accented characters. Props @burhandodhy via #4263.
• Prevent fatal error in Instant Results facets when ep_facet_include_taxonomies returns non-WP_Taxonomy values. Props @laraib15 via #4255.
• Instant Results displayed special characters as HTML encoded text. Props @burhandodhy and @wparslans via #4276.
• Error when trying to use queried object that doesn't exist. Props @tomjn and @ZacharyRener via #4285.
• Only consider a feature active if not disabled by code. Props @felipeelia via #4272.
• Several typos. Props @szepeviktor and @felipeelia via #4248.
• Query count in the basic status admin bar. Props @Sidsector9 via #4309.
• Settings notice layout on the settings page during sync in WordPress 7.0. Props @burhandodhy via #4310.

Security

• Updated Node.js dependencies (including a webpack override) to address npm audit findings. Props @felipeelia via #4307.

Developer

• Ensure ep_{$indexable->slug}_sync_kill properly prevents object indexing during sync and post updates. Props @burhandodhy, @felipeelia, and @matthijsch via #4282.
• Gracefully handle incorrect return types from ep_admin_notices filter callbacks. Props @qudwill, @felipeelia, and @Sidsector9 via #4281.
• Webpack configuration option for JavaScript and CSS source maps (editor debugging). Props @fiftin and @ZacharyRener via #4247 and #4288.
• Fix e2e tests. Props @felipeelia via #4262.

See: https://github.com/10up/ElasticPress/milestone/92?closed=1

Fixed

• Deployment to WordPress.org. Props @felipeelia via #4301.

See: https://github.com/10up/ElasticPress/milestone/94?closed=1

Changed

• Method of verifying ElasticPress.io environments. Props @felipeelia via #4300.

See: https://github.com/10up/ElasticPress/milestone/93?closed=1

Added

• Notice about keeping the sync page open during the sync process. Props @felipeelia and @tott via #4240.

Fixed

• Media search not working in the admin dashboard. Props @burhandodhy, @ognjanovic, and @maciejmackowiak via #4239.
• [Autosuggest] Setting allowed values. Props @felipeelia via #4238.

See: https://github.com/10up/ElasticPress/milestone/91?closed=1

Fixed

• Compatibility with PHP 7.4. Props @realrellek and @felipeelia via #4232.

See: https://github.com/10up/ElasticPress/milestone/90?closed=1

Highlights of this version:

• Improved compatibility with Elementor
• Better UX/UI in the Features Screen: Grouped features and conditional display of fields
• New indicator in the WordPress Admin Bar: See if your content is powered by Elasticsearch and how many queries were fired and failed in the current page.

Added

• Grouped features. Props @ZacharyRener and @felipeelia via #4137, #4154, and #4207.
• Selected features and groups now persist across reload. Props @ZacharyRener, @burhandodhy, and @felipeelia via #4138.
• Feature fields can be dependent on other fields. Props @ZacharyRener and @felipeelia via #4141 and #4215.
• Ability to create groups of fields. Props @ZacharyRener and @felipeelia via #4142, #4171, and #4172.
• Ability for a feature to require multiple other features, instead of just one. Props @ZacharyRener and @felipeelia via #4143 and #4229.
• Add new widgets for Date, Meta, and Meta Range Filters. Props @burhandodhy via #4156.
• Status indicator in the WordPress Admin Bar. Props @felipeelia, @burhandodhy, and @tott via #4199 and #4219.
• Add Elasticsearch 9 support. Props @burhandodhy via #4194.
• Support for rand with a seed in the orderby clause. Props @asharirfan, @asharirfan, @burhandodhy, @felipeelia, @tlovett1, @mustafauysal, and @jgmedialtd via #1639.
• Implement "OR" filter relationship in DateQuery. Props @burhandodhy and @eartahhj via #4165.
• Add support for new WP_Query argument ep_intercept_request. Props @burhandodhy via #4185.
• New ElasticPressIoTemplateManager class. Props @burhandodhy and @JakePT via #4189.
• Support for painless scripts in the ES queries. Props @burhandodhy and @scottbuckel via #4181.
• Support to set an array value in the orderby_meta_mapping filters. Props @burhandodhy and @jzzaj via #4188.
• New ep_skip_search_exclusions WP_Query argument. Props @burhandodhy and @JakePT via #4184.
• [Autosuggest] Added link in Status Report to send allowed parameters directly. Props @felipeelia, @burhandodhy, and @tott via #4199.
• New ep_get_query_log filter. Props @felipeelia via #4209.

Changed

• Index srcset for post thumbnails. Props @burhandodhy and @JakePT via #3693.
• Menu SVG icon with default WP color. Props @LenVan via #4167.
• Aggregation data stored at query level instead of a global variable. Props @burhandodhy and @JakePT via #4182.
• Text explaining when a manual sync may be required. Props @felipeelia and @anjulahettige via #4203.
• ElasticPress.io endpoint to fetch messages and available services. Props @felipeelia via #4124.
• [Autosuggest] WP_Query arguments are now passed to Elasticsearch->query() when setting allowed parameters. Props @felipeelia via #4204.
• Exceptions thrown during a post sync will now become error messages in sync processes. Props @felipeelia via #4210.
• Points the taxonomy filter URL to the facet section. Props @burhandodhy via #4217.
• Bumped react-router-dom from 6.14.3 to 7.9.4. Props @burhandodhy via #4214.

Deprecated

• Remove deprecated side param from edge_ngram filter for ES 8.16.x compatibility. Props @rebeccahum via #4155 and #4173.
• The ep_bypass_exclusion_from_search filter (replaced by the new ep_skip_search_exclusions WP_Query argument). Props @burhandodhy and @JakePT via #4184.

Removed

• Old feature settings code. Props @burhandodhy and @JakePT via #4187.

Fixed

• Autosuggest doesn't work if the placeholder is changed via a ep_autosuggest_query_placeholder filter. Props @fabianmarz and @burhandodhy via #1619.
• Link to compatibility documentation in admin notices. Props @dilipbheda via #4126.
• [Metadata Range filter] Warning Undefined array key "is_preview". Props @burhandodhy via #4157.
• 'Filter by Taxonomy' widget does not appear in Elementor. Props @burhandodhy via #4152.
• Add support to handle values in array format when the comparison operator was 'IN' or 'NOT IN'. Props @burhandodhy via #4168.
• Users could see other authors' private posts. Props @burhandodhy via #4169.
• Undefined array key warning related to media mime types. Props @burhandodhy and @DarioBF via #4208.
• Warning: value prop on "input" should not be null. Props @burhandodhy via #4216 and #4221.
• Comment query when orderby set to none. Props @burhandodhy via #4220.
• JS warnings on Status Report page. Props @burhandodhy via #4218.

Security

• Bumped http-proxy-middleware from 2.0.7 to 2.0.9. Props @dependabot via #4135.
• Bumped tar-fs from 3.0.8 to 3.1.1. Props @dependabot via #4160 and #4225.
• Bumped compression from 1.7.5 to 1.8.1. Props @dependabot via #4175.
• Bumped form-data from 4.0.1 to 4.0.4. Props @dependabot via #4178.
• Overwrite package @babel/runtime coming from core packages due to a vulnerability. Props @hugosolar via #4177.

Developer

• Fixed e2e tests on WP 6.8. Props @felipeelia via [#41...

This version bumps the minimum WordPress version to 6.2+.

Added

• New ACF Repeater Field Compatibility feature. Props @felipeelia via #4075.
• Add new filter ep.InstantResults.filter.taxonomy.terms. Props @burhandodhy and @syedc via #4067.
• Support to "number" fields in the Features Settings API. Props @felipeelia via #4072.
• Add include, exclude, upper-limit-object-id, and lower-limit-object-id support for the term and comment indexable. Props @burhandodhy via #4074, #4102, and #4099.
• Ability to display results on focus back + cached autosuggest results on same query. Props @oscarssanchezz, @JakePT, and @felipeelia via #4064.
• Document status displayed in the admin bar. Props @felipeelia, @tott, and @burhandodhy via #4096 and #4100.

Changed

• Minimum required version of WordPress (from 6.0 to 6.2). Props @felipeelia via #4082.
• ElasticPress\Feature\RelatedPosts::get_related_query(), ElasticPress\Feature\RelatedPosts::find_related() parameter name change to $post_return. Props @oscarssanchez and @felipeelia via #4061.
• The ep_remote_request action to also run on non-blocking requests. Props @felipeelia via #4093.
• Potentially resource intensive status reports are loaded on demand with AJAX. Props @oscarssanchezz, @felipeelia, and @archon810 via #4095.
• If a feature doesn't have all its requirements fulfilled, prevent it to run its setup method. Props @felipeelia via #4107.

Fixed

• PHP warning: Attempt to read property "base" on null. Props @burhandodhy and @yarovikov via #4060.
• Notice not displayed while updating a term. Props @burhandodhy and @MARQAS via #4070.
• PHP Notice: Function _load_textdomain_just_in_time was called incorrectly. Props @burhandodhy via #4065.
• PHP 8.4: Implicitly marking parameter $woocommerce as nullable is deprecated. Props @BrookeDot via #4087.
• WP-CLI sync timer resetting after 16 minutes. Props @felipeelia and @columbian-chris via #4094.
• Cannot get outside of autosuggest list pressing up on first item. Props @oscarssanchezz, @JakePT, and @felipeelia via #4064.
• Prevent other code from modifying the ORDERBY clause in Post and Term indexable queries. Props @burhandodhy and @felipeelia via #4101.
• Date Query returns no result when the before and after range is the same and inclusive is set to true. Props @burhandodhy and @ErikBrendel via #4103.
• Warning for undefined "post_type" array key. Props @econscript via #4106.
• Delete a post from the index if it had a password added. Props @felipeelia and @dtakken via #4108.
• [Synonyms] Linebreaks being wrongly replaced in Windows Systems. Props @nymwo via #4056.
• Deprecated 36px default size is deprecated warnings. Props @burhandodhy via #4109.
• The Sync Complete message being displayed when the log is cleared. Props @felipeelia and @burhandodhy via #4114.
• Selecting a value in the date filter not redirecting users back to page 1. Props @felipeelia and @burhandodhy via #4119.
• Discard Changes button coming back when saving the feature twice. Props @felipeelia and @burhandodhy via #4120.
• WooCommerce Orders Incompatibility not appearing when plugin is activated network wide. Props @burhandodhy via #4121.

Security

• Bumped serialize-javascript from 6.0.1 to 6.0.2, jsdoc from 3.6.11 to 4.0.4, and taffydb. Props @dependabot via #4078.
• Bumped tar-fs from from 3.0.6 to 3.0.8. Props @dependabot via #4117.

Developer

• Trufflehog GitHub Action to detect secrets leak. Props @felipeelia and @tott via #4052.
• Install Unit Tests without relying on SVN. Props @felipeelia via #4058.
• Remove the setup step from the build-with-vendor-prefixed.yml and standardize the use of Node Version. Props @burhandodhy via #4062.
• Fixed E2E tests. Props @burhandodhy via #4069.
• PHP, JS and Style lint fixes. Props @oscarssanchez and @felipeelia via #4061.
• Several node and composer packages updated. Props @felipeelia via #4079 and #4083.
• Updated the chart.js library. Props @felipeelia via #4081.

See: https://github.com/10up/ElasticPress/milestone/81?closed=1

Added

• New filter ep_facet_selected_filters. Props @burhandodhy via #3953.
• New filter ep_disable_query_logging to disable query logging. Props @davidsword and @rebeccahum via #4019.
• New setting to Protect Content to use WP default order in admin. Props @felipeelia and @realrellek via #4028.

Changed

• Apply ElasticPress filters to the requests in status and stats CLI commands. Props @edpittol via #4000.
• Autosuggest Endpoint field explanation. Props @burhandodhy and @felipeelia via #4009.
• Alignment of custom search results action icons. Props @felipeelia and @anjulahettige via #4020.
• Update all of our blocks apiVersion from 2 to 3, to indicate support for working in an iframed editor. Props @dkotter and @JakePT via #4029.
• If using the new way to index meta, avoid querying distinct meta fields in the sync page. Props @felipeelia and @majiix via #4033.
• Updated several composer and node packages. Node 20 is now the default version. Props @felipeelia via #4039 and #4043.
• Improve readability of sync output (MB/GB) and number formatting on the Health Status page. Props @columbian-chris via #4042.

Fixed

• Hardcoded tmp path replaced with a dynamic value. Props @burhandodhy via #3962.
• Variable names and descriptions in the docblocks for ep_formatted_args and ep_post_formatted_args. Props @barryceelen via #3977.
• Remove 'None' from Highlight tag list. Props @burhandodhy via #3979.
• [Facets] Incorrect link on description when not using a block theme. Props @felipeelia and @burhandodhy via #3997.
• Deprecation warning in strtotime() call. Props @felipeelia and @barryceelen via #3998.
• Special characters like \ in search terms for both Autosuggest and Instant Results. Props @felipeelia and @burhandodhy via #3999.
• [WooCommerce] Incompatibility when "Enable table usage" was enabled to filter the product catalog. Props @felipeelia and @burhandodhy via #4002.
• Deprecation warning related to PluginPostStatusInfo. Props @burhandodhy and @felipeelia via #4008.
• [Custom Results] Inconsistent Reordering Issue. Props @felipeelia, @anjulahettige, @burhandodhy via #4018 and #4045.
• Update supported document file types in Documents feature summary. Props @burhandodhy via #4024.
• "Exclude from search results" to work in AJAX contexts. Props @felipeelia and @burhandodhy via #4025.
• Retain CR & RD Labels Upon Saving Custom Search Result Posts. Props @felipeelia and @anjulahettige via #4020.
• Typo in "All filters" text domain. Props @felipeelia and @arturomonge via #4031.
• Autosuggest GA tracking to work when ad blocks are enabled. The dataLayer.push() call now pushes a custom event called ep_autosuggest_click with ep_autosuggest_search_term and ep_autosuggest_clicked_url as custom parameters. Props @felipeelia and @anjulahettige via #4032.
• Delay load_plugin_textdomain to init and set a Domain Path. Props @felipeelia via #4036.
• Only display the Exclude From Search checkbox if the post type supports custom-fields. Props @felipeelia and @maartenhunink via #4040.
• JS error when submit button is clicked without selecting a date. Props @burhandodhy via #4044.
• Deprecated warnings for margin style. Props @burhandodhy via #4046.

Security

• Bumped composer/composer from 2.7.0 to 2.7.8. Props @dependabot via #3972.
• Bumped symfony/process from 6.4.8 to 6.4.14. Props @dependabot via #3996.

Developer

• Tests use ES 8 by default. Props @felipeelia via #4017.
• Update E2E tests to work properly with the iframed block editor. Props @dkotter via #4029.
• E2e tests for WP 6.6. Props @felipeelia via #3959.
• E2e tests for WP 6.7. Props @felipeelia via #4010.
• Unit Tests: Fail faster on requests we know will fail. Props @felipeelia via #4047.
• E2e tests: Fix the debug-bar-elasticpress dependency of ElasticPress. Props @felipeelia via #4048.

See: https://github.com/10up/ElasticPress/milestone/88?closed=1