Update Jetpack plugin from 16.1 to 16.1.1

Author: bitpoke-bot

wp-content/plugins/jetpack/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ### This is a list detailing changes for all Jetpack releases.
 
+## 16.1.1 - 2026-08-11
+### Bug fixes
+- Error Handler: Prevent a fatal error when a request runs during a plugin update and an older version of the Error_Handler class is already loaded.
+
+### Other changes <!-- Non-user-facing changes go here. This section will not be copied to readme.txt. -->
+- Remove Reprint full-site export support and its `jetpack/v4` REST routes. [#51179]
+
 ## 16.1 - 2026-08-10
 ### Enhancements
 - Account Protection: Add additional context to Verify your identity page to reduce user confusion. [#50338]

wp-content/plugins/jetpack/class.jetpack.php

@@ -796,13 +796,6 @@ function () {
 		// Jetpack plugin for now: the Connection package no longer auto-wires these, so
 		// connection-only consumers (Boost, Protect, Search, etc.) do not register them yet.
 		\Automattic\Jetpack\Connection\Abilities\Connection_Abilities::init();
-
-		// Register Reprint export support on Pressable and WordPress.com (Atomic)
-		// hosts (overridable via the `jetpack_reprint_export_available` filter), so
-		// generic self-hosted Jetpack sites never expose the export endpoint.
-		if ( \Automattic\Jetpack\Reprint_Export\Reprint_Exporter::is_available() ) {
-			\Automattic\Jetpack\Reprint_Export\Reprint_Exporter::init();
-		}
 	}
 
 	/**

wp-content/plugins/jetpack/composer.json

@@ -27,7 +27,7 @@
 		"automattic/jetpack-compat": "^4.0.4",
 		"automattic/jetpack-composer-plugin": "^4.0.9",
 		"automattic/jetpack-config": "^3.1.3",
-		"automattic/jetpack-connection": "^8.8.2",
+		"automattic/jetpack-connection": "^8.9.0.1",
 		"automattic/jetpack-constants": "^3.0.12",
 		"automattic/jetpack-device-detection": "^3.4.5",
 		"automattic/jetpack-error": "^3.0.10",
@@ -63,8 +63,7 @@
 		"automattic/jetpack-videopress": "^0.45.0",
 		"automattic/jetpack-waf": "^0.28.11",
 		"automattic/jetpack-wp-abilities": "^0.1.5",
-		"automattic/woocommerce-analytics": "^0.16",
-		"wp-php-toolkit/reprint-exporter": "^0.9.1"
+		"automattic/woocommerce-analytics": "^0.16"
 	},
 	"require-dev": {
 		"antecedent/patchwork": "^2.2",
@@ -100,11 +99,6 @@
 	"autoload": {
 		"classmap": [
 			"src"
-		],
-		"exclude-from-classmap": [
-			"vendor/wp-php-toolkit/data-liberation/vendor-patched/psr/log/",
-			"vendor/wp-php-toolkit/data-liberation/vendor-patched/rowbot/",
-			"vendor/wp-php-toolkit/data-liberation/vendor-patched/brick/"
 		]
 	},
 	"minimum-stability": "dev",
@@ -114,7 +108,7 @@
 		"platform": {
 			"ext-intl": "0.0.0"
 		},
-		"autoloader-suffix": "f11009ded9fc4592b6a05b61ce272b3c_jetpackⓥ16_1",
+		"autoloader-suffix": "f11009ded9fc4592b6a05b61ce272b3c_jetpackⓥ16_1_1",
 		"allow-plugins": {
 			"automattic/jetpack-autoloader": true,
 			"automattic/jetpack-composer-plugin": true

wp-content/plugins/jetpack/jetpack.php

@@ -4,7 +4,7 @@
  * Plugin URI: https://jetpack.com
  * Description: Security, performance, and marketing tools made by WordPress experts. Jetpack keeps your site protected so you can focus on more important things.
  * Author: Automattic
- * Version: 16.1
+ * Version: 16.1.1
  * Author URI: https://jetpack.com
  * License: GPL2+
  * Text Domain: jetpack
@@ -37,7 +37,7 @@
 
 if ( ! defined( 'JETPACK__VERSION' ) ) {
 	// This breaks the project version checks when a one-liner.
-	define( 'JETPACK__VERSION', '16.1' );
+	define( 'JETPACK__VERSION', '16.1.1' );
 }
 defined( 'JETPACK__MINIMUM_WP_VERSION' ) || define( 'JETPACK__MINIMUM_WP_VERSION', '6.9' );
 defined( 'JETPACK__MINIMUM_PHP_VERSION' ) || define( 'JETPACK__MINIMUM_PHP_VERSION', '7.2' );

wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-connection/CHANGELOG.md

@@ -5,9 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.9.0.1] - 2026-08-11
+### Fixed
+- Error Handler: Prevent a fatal error when a request runs during a plugin update and an older version of the Error_Handler class is already loaded. [#51173]
+
 ## [8.9.0] - 2026-08-06
 ### Changed
-- Error Handler: Standardize the stored connection error structure with explicit error type and direction fields, store local connection-state errors as 'local_state' instead of 'connection', and store previously dropped signature verification errors, which can now surface connection error notices. [#50992]
+- Error Handler: Standardize the stored connection error structure with explicit error type and direction fields. [#50992]
 
 ## [8.8.2] - 2026-08-03
 ### Changed
@@ -1978,6 +1982,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Separate the connection library into its own package.
 
+[8.9.0.1]: https://github.com/Automattic/jetpack-connection/compare/v8.9.0...v8.9.0.1
 [8.9.0]: https://github.com/Automattic/jetpack-connection/compare/v8.8.2...v8.9.0
 [8.8.2]: https://github.com/Automattic/jetpack-connection/compare/v8.8.1...v8.8.2
 [8.8.1]: https://github.com/Automattic/jetpack-connection/compare/v8.8.0...v8.8.1

wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-connection/src/class-client.php

@@ -51,10 +51,12 @@ public static function remote_request( $args, $body = null ) {
 		// class docblock for the full picture of both error-handling flows.
 		// Outgoing XML-RPC calls (Jetpack_IXR_Client) are funneled through this method too;
 		// tell the transports apart by the endpoint the request targets.
+		// The literals match Error_Handler::ERROR_TYPE_XMLRPC / ERROR_TYPE_REST. The constants
+		// themselves must not be referenced from this class: during a plugin update, a stale
+		// Error_Handler that predates them can already be loaded, and resolving them against
+		// it would fatal the request.
 		$request_path = (string) wp_parse_url( empty( $args['url'] ) ? '' : $args['url'], PHP_URL_PATH );
-		$error_type   = '/xmlrpc.php' === substr( $request_path, -strlen( '/xmlrpc.php' ) )
-			? Error_Handler::ERROR_TYPE_XMLRPC
-			: Error_Handler::ERROR_TYPE_REST;
+		$error_type   = '/xmlrpc.php' === substr( $request_path, -strlen( '/xmlrpc.php' ) ) ? 'xmlrpc' : 'rest';
 
 		Error_Handler::get_instance()->check_api_response_for_errors(
 			$response,

wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-connection/src/class-manager.php

@@ -482,7 +482,7 @@ private function internal_verify_xml_rpc_signature() {
 		// REST authentication into verify_xml_rpc_signature()), so the stored error type is
 		// derived from the actual request context rather than hardcoded.
 		$error_type      = $this->get_current_request_transport();
-		$error_direction = Error_Handler::DIRECTION_INCOMING;
+		$error_direction = 'incoming'; // Matches Error_Handler::DIRECTION_INCOMING — see build_connection_error_data() for why the constant is not referenced.
 
 		// phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
 		@list( $token_key, $version, $user_id ) = explode( ':', wp_unslash( $_GET['token'] ) );
@@ -495,7 +495,7 @@ private function internal_verify_xml_rpc_signature() {
 				|| empty( $version )
 				|| (string) $jetpack_api_version !== $version
 		) {
-			return new \WP_Error( 'malformed_token', 'Malformed token in request', Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction ) );
+			return new \WP_Error( 'malformed_token', 'Malformed token in request', $this->build_connection_error_data( $signature_details, $error_type, $error_direction ) );
 		}
 
 		if ( '0' === $user_id ) {
@@ -507,7 +507,7 @@ private function internal_verify_xml_rpc_signature() {
 				return new \WP_Error(
 					'malformed_user_id',
 					'Malformed user_id in request',
-					Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction )
+					$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
 				);
 			}
 			$user_id = (int) $user_id;
@@ -517,20 +517,20 @@ private function internal_verify_xml_rpc_signature() {
 				return new \WP_Error(
 					'unknown_user',
 					sprintf( 'User %d does not exist', $user_id ),
-					Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction )
+					$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
 				);
 			}
 		}
 
 		$token = $this->get_tokens()->get_access_token( $user_id, $token_key, false );
 		if ( is_wp_error( $token ) ) {
-			$token->add_data( Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction ) );
+			$token->add_data( $this->build_connection_error_data( $signature_details, $error_type, $error_direction ) );
 			return $token;
 		} elseif ( ! $token ) {
 			return new \WP_Error(
 				'unknown_token',
 				sprintf( 'Token %s:%s:%d does not exist', $token_key, $version, $user_id ),
-				Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction )
+				$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
 			);
 		}
 
@@ -572,7 +572,7 @@ private function internal_verify_xml_rpc_signature() {
 			return new \WP_Error(
 				'could_not_sign',
 				'Unknown signature error',
-				Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction )
+				$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
 			);
 		} elseif ( is_wp_error( $signature ) ) {
 			// Jetpack_Signature errors carry their own signature_details (or, for some codes,
@@ -582,7 +582,7 @@ private function internal_verify_xml_rpc_signature() {
 			if ( isset( $signature_error_data['signature_details'] ) && is_array( $signature_error_data['signature_details'] ) ) {
 				$signature_details = array_merge( $signature_details, $signature_error_data['signature_details'] );
 			}
-			$signature->add_data( Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction ) );
+			$signature->add_data( $this->build_connection_error_data( $signature_details, $error_type, $error_direction ) );
 			return $signature;
 		}
 
@@ -596,7 +596,7 @@ private function internal_verify_xml_rpc_signature() {
 			return new \WP_Error(
 				'invalid_nonce',
 				'Could not add nonce',
-				Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction )
+				$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
 			);
 		}
 
@@ -610,7 +610,7 @@ private function internal_verify_xml_rpc_signature() {
 			return new \WP_Error(
 				'signature_mismatch',
 				'Signature mismatch',
-				Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction )
+				$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
 			);
 		}
 
@@ -664,7 +664,33 @@ private function get_current_request_transport() {
 			$is_rest            = $has_rest_route_arg || false !== strpos( $request_path, '/' . rest_get_url_prefix() . '/' );
 		}
 
-		return $is_rest ? Error_Handler::ERROR_TYPE_REST : Error_Handler::ERROR_TYPE_XMLRPC;
+		// The literals match Error_Handler::ERROR_TYPE_REST / ERROR_TYPE_XMLRPC — see
+		// build_connection_error_data() for why the constants are not referenced.
+		return $is_rest ? 'rest' : 'xmlrpc';
+	}
+
+	/**
+	 * Builds the standardized connection error data attached to signature-verification errors.
+	 *
+	 * Wraps `Error_Handler::build_connection_error_data()`, falling back to the legacy
+	 * error-data shape when the loaded Error_Handler predates that method: during a plugin
+	 * update, an older version of the class can already be in memory while this file is the
+	 * new one, and a mid-update request must never fatal. For the same reason, code in this
+	 * class must not reference Error_Handler constants introduced along with that method
+	 * ('xmlrpc', 'rest', 'local_state', 'incoming', 'outgoing') — use the literal values.
+	 *
+	 * @since 8.9.0.1
+	 *
+	 * @param array  $signature_details Details of the request signature being verified.
+	 * @param string $error_type        The transport of the request: 'xmlrpc' or 'rest'.
+	 * @param string $error_direction   The direction of the request: 'incoming' or 'outgoing'.
+	 * @return array Error data for `WP_Error`.
+	 */
+	private function build_connection_error_data( $signature_details, $error_type, $error_direction ) {
+		if ( ! method_exists( Error_Handler::class, 'build_connection_error_data' ) ) {
+			return compact( 'signature_details', 'error_type' );
+		}
+		return Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction );
 	}
 
 	/**
@@ -982,13 +1008,15 @@ public function get_connection_owner() {
 			$connection_owner = get_userdata( $user_token->external_user_id );
 		}
 
-		if ( $connection_owner === false ) {
+		// Reporting is best-effort and must never fatal a request running mid-plugin-update:
+		// skip it when the already-loaded Error_Handler is a stale version predating the factory.
+		if ( $connection_owner === false && method_exists( Error_Handler::class, 'build_connection_wp_error' ) ) {
 			Error_Handler::get_instance()->report_error(
 				Error_Handler::build_connection_wp_error(
 					'invalid_connection_owner',
 					'Invalid connection owner',
 					array( 'token' => '' ),
-					Error_Handler::ERROR_TYPE_LOCAL_STATE,
+					'local_state', // Error_Handler::ERROR_TYPE_LOCAL_STATE.
 					'', // Local-state errors describe the site's database, not a request, so they have no direction.
 					array(
 						'user_id'        => $user_id,

wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-connection/src/class-package-version.php

@@ -12,7 +12,7 @@
  */
 class Package_Version {
 
-	const PACKAGE_VERSION = '8.9.0';
+	const PACKAGE_VERSION = '8.9.0.1';
 
 	const PACKAGE_SLUG = 'connection';
 

wp-content/plugins/jetpack/readme.txt

@@ -1,7 +1,7 @@
 === Jetpack - WP Security, Backup, Speed, & Growth ===
 Contributors: automattic, adamkheckler, adrianmoldovanwp, aduth, akirk, allendav, alternatekev, andy, annamcphee, annezazu, apeatling, arcangelini, arsihasi, azaozz, barry, batmoo, beaulebens, bindlegirl, biskobe, bjorsch, blobaugh, brbrr, brileyhooper, cainm, cena, cfinke, cgastrell, chaselivingston, chellycat, clickysteve, csonnek, danielbachhuber, daniloercoli, davoraltman, delawski, designsimply, dkmyta, dllh, dlocc, drawmyface, dsmart, dun2mis, dzver, ebinnion, egregor, eliorivero, enej, eoigal, erania-pinnera, ethitter, fgiannar, gcorne, georgestephanis, gibrown, goldsounds, hew, hugobaeta, hypertextranch, iammattthomas, iandunn, joen, jblz, jeffgolenski, jeherve, jennywp, jenia, jessefriedman, jgs, jkudish, jmdodd, joanrho, johnjamesjacoby, jshreve, kbrownkd, keoshi, koke, kraftbj, lancewillett, leogermani, lhkowalski, lschuyler, macmanx, martinremy, matt, mattwiebe, matveb, maverick3x6, mcsf, mdawaffe, mdbitz, MichaelArestad, migueluy, miguelxavierpenha, mikeyarce, mkaz, nancythanki, nickmomrik, njweller, nunyvega, obenland, oskosk, pento, professor44, rachelsquirrel, rdcoll, renatoagds, retrofox, richardmtl, richardmuscat, robertbpugh, roccotripaldi, ryanc413, samhotchkiss, samiff, scarstocea, scottsweb, sdixon194, sdquirk, sermitr, simison, stephdau, thehenridev, tmoorewp, tyxla, Viper007Bond, westi, williamvianas, wpkaren, yoavf, zinigor
 Tags: Security, backup, malware, scan, performance
-Stable tag: 16.1
+Stable tag: 16.1.1
 Requires at least: 6.9
 Requires PHP: 7.2
 Tested up to: 7.0
@@ -326,6 +326,10 @@ Jetpack Backup can do a full website migration to a new host, migrate theme file
 
 
 == Changelog ==
+### 16.1.1 - 2026-08-11
+#### Bug fixes
+- Error Handler: Prevent a fatal error when a request runs during a plugin update and an older version of the Error_Handler class is already loaded.
+
 ### 16.1 - 2026-08-10
 #### Enhancements
 - Account Protection: Add additional context to Verify your identity page to reduce user confusion.