elementor
diff --git a/‎.github/workflows/update-wp-one-package.yml‎
Lines changed: 50 additions & 0 deletions b/‎.github/workflows/update-wp-one-package.yml‎
Lines changed: 50 additions & 0 deletions
diff --git a/‎.husky/pre-commit‎
Lines changed: 19 additions & 1 deletion b/‎.husky/pre-commit‎
Lines changed: 19 additions & 1 deletion
diff --git a/‎.npmrc‎
Lines changed: 0 additions & 2 deletions b/‎.npmrc‎
Lines changed: 0 additions & 2 deletions
diff --git a/‎README.md‎
Lines changed: 21 additions & 1 deletion b/‎README.md‎
Lines changed: 21 additions & 1 deletion
diff --git a/‎assets/dev/js/api/exceptions/APIError.js‎
Lines changed: 3 additions & 1 deletion b/‎assets/dev/js/api/exceptions/APIError.js‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎assets/dev/js/api/index.js‎
Lines changed: 10 additions & 3 deletions b/‎assets/dev/js/api/index.js‎
Lines changed: 10 additions & 3 deletions
diff --git a/‎assets/dev/js/services/mixpanel/mixpanel-events.js‎
Lines changed: 4 additions & 0 deletions b/‎assets/dev/js/services/mixpanel/mixpanel-events.js‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎assets/dev/js/services/mixpanel/mixpanel-service.js‎
Lines changed: 13 additions & 3 deletions b/‎assets/dev/js/services/mixpanel/mixpanel-service.js‎
Lines changed: 13 additions & 3 deletions
diff --git a/‎classes/client/client-response.php‎
Lines changed: 45 additions & 0 deletions b/‎classes/client/client-response.php‎
Lines changed: 45 additions & 0 deletions
diff --git a/‎classes/exceptions/quota-api-error.php‎
Lines changed: 13 additions & 0 deletions b/‎classes/exceptions/quota-api-error.php‎
Lines changed: 13 additions & 0 deletions
@@ -0,0 +1,50 @@
+name: Update wp-one-package
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'New version of elementor/wp-one-package (e.g. 1.0.51)'
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-package:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source branch
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.CLOUD_DEVOPS_TOKEN }}
+
+      - name: Create branch
+        run: |
+          BRANCH_NAME="update/wp-one-package-${{ inputs.version }}"
+          git checkout -b "${BRANCH_NAME}"
+          echo "BRANCH_NAME=${BRANCH_NAME}" >> $GITHUB_ENV
+
+      - name: Update wp-one-package version in composer.json
+        run: |
+          jq '.require["elementor/wp-one-package"] = "${{ inputs.version }}"' composer.json > composer.tmp && mv composer.tmp composer.json
+
+      - name: Commit and push changes
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add composer.json
+          git commit -m "Update elementor/wp-one-package to ${{ inputs.version }}"
+          git push origin "${BRANCH_NAME}"
+
+      - name: Create Pull Request
+        env:
+          GH_TOKEN: ${{ secrets.CLOUD_DEVOPS_TOKEN }}
+        run: |
+          gh pr create \
+            --base "${{ github.ref_name }}" \
+            --head "${BRANCH_NAME}" \
+            --title "Update elementor/wp-one-package to ${{ inputs.version }}" \
+            --body "Updates \`elementor/wp-one-package\` composer package to version \`${{ inputs.version }}\`."
@@ -1 +1,19 @@
-npm run lint
+# Get list of staged files
+STAGED_JS_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(js|jsx|ts|tsx)$' || true)
+STAGED_PHP_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.php$' || true)
+STAGED_CSS_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(css|scss)' || true)
+
+# Run JS linting if there are staged JS files
+if [ -n "$STAGED_JS_FILES" ]; then
+  npm run lint:js || exit 1
+fi
+
+# Run PHP linting if there are staged PHP files
+if [ -n "$STAGED_PHP_FILES" ]; then
+  npm run lint:php:report || exit 1
+fi
+
+# Run CSS linting if there are staged CSS files
+if [ -n "$STAGED_CSS_FILES" ]; then
+  npm run lint:css || exit 1
+fi
@@ -5,7 +5,7 @@
 **Requires at least:** 6.6 \
 **Tested up to:** 6.9 \
 **Requires PHP:** 7.4 \
-**Stable tag:** 4.0.1 \
+**Stable tag:** 4.1.0 \
 **License:** GPLv2 or later
 
 Ally: Make your site more inclusive by scanning for accessibility violations, fixing them easily, and adding a usability widget and accessibility statement.
@@ -227,6 +227,26 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro
 
 ## Changelog
 
+### 4.1.0 – 2026-02-23
+
+* New: Added bulk remediation flow to generate AI alt text or mark multiple images as decorative
+* Tweak: Added the ability to disable the accessibility widget to prevent it from loading on your site
+* Tweak: Security enhancement to prevent potential SQL injection
+* Tweak: Security enhancement to remove unsecure composer package
+* Fix: Display WordPress admin notices inside the settings page
+* Fix: Resolved conflict in Beaver Builder by preventing remediation runner from executing during page builder sessions
+
+### 4.0.3 – 2026-01-28
+
+* Tweak: Security enhancements for access control
+
+### 4.0.2 – 2026-01-28
+
+* Tweak: Added a dashboard widget to trigger scans and view results
+* Fix: Resolved layout issues on the settings page for RTL websites
+* Fix: Resolved widget trigger functionality when users are logged out
+* Fix: Missing styles warning when reviews popup is displayed
+
 ### 4.0.1 – 2026-01-20
 
 * Fix: Fix ally widget action to toggle open/close state.
 
@@ -1,8 +1,10 @@
 class APIError extends Error {
-	constructor(message) {
+	constructor(message, code = null, data = null) {
 		super(message);
 
 		this.name = 'APIError';
+		this.code = code;
+		this.data = data;
 	}
 }
 
 
@@ -24,16 +24,23 @@ class API {
 			}
 
 			if (!response.success) {
-				throw new APIError(response.data.message);
+				throw new APIError(
+					response.data.message,
+					response.data.code,
+					response.data,
+				);
 			}
 
 			return response.data;
 		} catch (e) {
 			if (e instanceof APIError) {
 				throw e;
-			} else {
-				throw new APIError(e.message);
 			}
+
+			// apiFetch throws an error with code and message at root level
+			// when WordPress REST API returns a WP_Error
+			// WordPress REST API error structure: { code, message, data }
+			throw new APIError(e.message, e.code, e.data);
 		}
 	}
 
 
@@ -76,4 +76,8 @@ export const mixpanelEvents = {
 	// Heading Structure
 	headingClicked: 'heading_clicked',
 	headingSelected: 'heading_selected',
+
+	// Bulk Alt Text
+	stopButtonClicked: 'stop_button_clicked',
+	bulkAltTextClicked: 'bulk_alt_text_clicked',
 };
@@ -1,8 +1,8 @@
-import mixpanel from 'mixpanel-browser';
-
 const SHARE_USAGE_DATA = 'share_usage_data';
 const MIXPANEL_TOKEN = '150605b3b9f979922f2ac5a52e2dcfe9';
 
+let mixpanel = null;
+
 const init = async () => {
 	const { ea11ySettingsData, ea11yScannerData } = window;
 	const planData = ea11ySettingsData?.planData || ea11yScannerData?.planData;
@@ -16,6 +16,14 @@ const init = async () => {
 		return;
 	}
 
+	// Lazy load mixpanel
+	if (!mixpanel) {
+		const mixpanelModule = await import(
+			/* webpackChunkName: "chunk-mixpanel-browser" */ 'mixpanel-browser'
+		);
+		mixpanel = mixpanelModule.default;
+	}
+
 	const pluginEnv = ea11ySettingsData?.pluginEnv || ea11yScannerData?.pluginEnv;
 	const pluginVersion =
 		ea11ySettingsData?.pluginVersion || ea11yScannerData?.pluginVersion;
@@ -24,6 +32,8 @@ const init = async () => {
 		debug: pluginEnv === 'dev',
 		track_pageview: false,
 		persistence: 'localStorage',
+		record_sessions_percent: 2,
+		record_heatmap_data: true,
 	});
 
 	mixpanel.register({
@@ -51,7 +61,7 @@ const init = async () => {
 };
 
 const sendEvent = (name, event) => {
-	if (mixpanel.__loaded) {
+	if (mixpanel?.__loaded) {
 		mixpanel.track(name, event);
 	}
 };
 
@@ -0,0 +1,45 @@
+<?php
+
+namespace EA11y\Classes\Client;
+
+use Exception;
+use EA11y\Classes\Exceptions\Quota_Exceeded_Error;
+use EA11y\Classes\Exceptions\Quota_API_Error;
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
+class Client_Response {
+	private array $known_errors;
+	/**
+	 * @var mixed
+	 */
+	private $response;
+
+	/**
+	 * @throws Quota_API_Error|Quota_Exceeded_Error|Exception
+	 */
+	public function handle() {
+		if ( ! is_wp_error( $this->response ) ) {
+			return $this->response;
+		}
+
+		$message = $this->response->get_error_message();
+
+		if ( isset( $this->known_errors[ $message ] ) ) {
+			throw $this->known_errors[ $message ];
+		}
+
+		throw new Exception( $message );
+	}
+
+	public function __construct( $response ) {
+		$this->known_errors = [
+			"Quota Status Guard Request Failed!: plan.features.ai_credits Quota exceeded" => new Quota_Exceeded_Error(),
+			"Quota Api Request Failed!: Failed checking if allowed to use quota" => new Quota_API_Error(),
+		];
+
+		$this->response = $response;
+	}
+}
@@ -0,0 +1,13 @@
+<?php
+
+namespace EA11y\Classes\Exceptions;
+
+use Exception;
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
+class Quota_API_Error extends Exception {
+	protected $message = 'Quota API error';
+}
Original file line number	Diff line number	Diff line change
`@@ -1,8 +1,10 @@`
`1`	`1`	`class APIError extends Error {`
`2`		`- constructor(message) {`
	`2`	`+ constructor(message, code = null, data = null) {`
`3`	`3`	`super(message);`
`4`	`4`
`5`	`5`	`this.name = 'APIError';`
	`6`	`+ this.code = code;`
	`7`	`+ this.data = data;`
`6`	`8`	`}`
`7`	`9`	`}`
`8`	`10`
Original file line number	Diff line number	Diff line change
`@@ -24,16 +24,23 @@ class API {`
`24`	`24`	`}`
`25`	`25`
`26`	`26`	`if (!response.success) {`
`27`		`- throw new APIError(response.data.message);`
	`27`	`+ throw new APIError(`
	`28`	`+ response.data.message,`
	`29`	`+ response.data.code,`
	`30`	`+ response.data,`
	`31`	`+ );`
`28`	`32`	`}`
`29`	`33`
`30`	`34`	`return response.data;`
`31`	`35`	`} catch (e) {`
`32`	`36`	`if (e instanceof APIError) {`
`33`	`37`	`throw e;`
`34`		`- } else {`
`35`		`- throw new APIError(e.message);`
`36`	`38`	`}`
	`39`	`+`
	`40`	`+ // apiFetch throws an error with code and message at root level`
	`41`	`+ // when WordPress REST API returns a WP_Error`
	`42`	`+ // WordPress REST API error structure: { code, message, data }`
	`43`	`+ throw new APIError(e.message, e.code, e.data);`
`37`	`44`	`}`
`38`	`45`	`}`
`39`	`46`