Skip to content

Remove hashids/hashids dependency (BC Math/GMP)#358

Merged
superdav42 merged 1 commit intomainfrom
fix/remove-hashids-dependency
Mar 6, 2026
Merged

Remove hashids/hashids dependency (BC Math/GMP)#358
superdav42 merged 1 commit intomainfrom
fix/remove-hashids-dependency

Conversation

@superdav42
Copy link
Collaborator

Summary

  • Replaces the hashids/hashids library with a pure PHP implementation in Hash class
  • Removes the composer dependency that required BC Math or GMP PHP extensions
  • Fixes RuntimeException: Missing BC Math or GMP extension on hosts without these extensions

Implementation

The new implementation uses:

  • XOR obfuscation with a group-derived seed (crc32)
  • Deterministic alphabet shuffling via md5
  • Manual base-36 conversion with fixed-width padding

Same public API, same character set (uppercase alphanumeric, 10 chars), zero extension requirements.

Test plan

  • All 17 Hash_Test cases pass
  • SSO encode/decode roundtrip test passes
  • Full test suite (2899 tests) — no new failures
  • PHPCS clean
  • PHPStan clean

Note: Existing hashes (e.g. bookmarked URLs, stored verification keys) will not decode with the new implementation. Verification keys are short-lived and management URLs are generated on-the-fly, so impact is minimal.

🤖 Generated with Claude Code

…sions

Replace the Hashids library with a pure PHP implementation that uses
XOR obfuscation and deterministic alphabet shuffling. This eliminates
the RuntimeException when neither BC Math nor GMP extensions are installed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@github-actions
Copy link

github-actions bot commented Mar 5, 2026

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password

@superdav42 superdav42 merged commit 18c9c97 into main Mar 6, 2026
11 of 12 checks passed
@superdav42 superdav42 deleted the fix/remove-hashids-dependency branch March 6, 2026 20:31
superdav42 added a commit that referenced this pull request Mar 7, 2026
Merge changes from main (PRs #352 mpdf PHP8.5 compat, #355 lazy settings,
#358 remove hashids dependency) and apply follow-up improvements:

- Use main's mpdf-psr-http-message-shim-php8-compat.patch (proper PHP 8.5 type
  declarations for Request.php methods)
- Fix TTL=0 handling: non-null TTL <= 0 now stores with 1s expiry (PSR-16)
- Add PSR-16 key validation via validate_key() and validate_iterable()
- Fix PHPStan: toggle_maintenance_mode() return type void

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant