Plugin dependencies: Dependent of an inactive plugin can be deleted via bulk actions

[johnbillion]

With plugin-b that depends on plugin-a via its Requires Plugins: header and neither plugin active on the site, it should not be possible to delete plugin-a, however this can be done via the Bulk Actions menu.

To reproduce:

• Have plugin-b that depends on plugin-a
• Neither plugin is active
• Observe the message on the Plugins admin screen for plugin-a: Note: this plugin cannot be deactivated or deleted until the plugins that require it are deactivated or deleted
• Check the checkbox next to plugin-a
• In the Bulk Actions dropdown select Delete
• Press Apply
• Observe that plugin-a gets deleted

[afragen]

This is actually functioning as designed. The error is in the explainer text showing up when it shouldn’t.

[knutsp]

Replying to johnbillion:

With plugin-b that depends on plugin-a via its Requires Plugins: header and neither plugin active on the site, it should not be possible to delete plugin-a, however this can be done via the Bulk Actions menu.

No need to disallow deleting (an inactive) plugin no matter how many other (inactive) plugins that (potentially) depend on it. Dependency means to disallow activating depending plugins when depends on plugin is not active (inactive or missing), and disallow deactivating a plugin that other active plugin depends on.

Replying to afragen:

The error is in the explainer text showing up when it shouldn’t.

Yes, but why does this text mention deleting at all? Active plugins cannot be deleted through WordPress Admin. When not able to deactivate, not being able to delete is implicit.

I look forward to see how gracefully WordPress will handle the situation where a plugin that other active plugins depends on is suddenly deleted externally (from the file system), or deactivated by foreign manipulation of the active plugins option.

[johnbillion]

Clarification: I don't think the Plugin Dependencies feature should be blocking the deletion of inactive dependent plugins, but whatever it does it needs to be consistent.

The intended behaviour of Plugin Dependencies is that dependencies cannot be deleted until their dependents are deleted.

While the 'Delete' link was removed from the plugin row, the bulk actions checkbox remained enabled, allowing for deletion of dependencies through bulk actions.

This was unintended behaviour and the bulk actions checkbox is now disabled as intended.

### Before

### After

[costdev]

Thanks for opening this ticket @johnbillion!

Reading the ticket and @afragen's response, in this case the bug is indeed that the bulk actions checkbox is enabled.

The feature as it currently stands prevents the deletion of a dependency until its dependents are deleted. That is, Addon for Foo must be deleted before Foo can be deleted.

I'd like to separate the handling of this bug from the determination about whether this aspect of the feature stays in Core. A decision on that is likely to be part of an upcoming Core discussion on the feature, and I think it may be best to have the intended behaviour working as expected so that the discussion has accurate data to consider.

​PR 6073 should ensure - for now at least - the intended behaviour. Please test.

[costdev]

Nudging this into the Plugins component as it deals more with their display and handling once installed than the Upgrade/Install aspect.

[huzaifaalmesbah]

Test Report

Patch tested: ​https://github.com/WordPress/wordpress-develop/pull/6073

Environment

• WordPress: 6.5-alpha-56966-src
• PHP: 8.2.15
• Server: nginx/1.25.3
• Database: mysqli (Server: 8.0.36 / Client: mysqlnd 8.2.15)
• Browser: Chrome 121.0.0.0
• OS: macOS
• Theme: Twenty Twenty-Four 1.0
• MU Plugins: None activated
• Plugins:
  • Test Reports 1.0.1

Screenshots

Before Apply Patch	After Apply Patch ✅

I tested this patch it's works perfectly. Thanks.

Tested, works. ✅

Nice work ✅

[costdev]

In 57620:

Plugins: Disable bulk actions for dependencies.

The intended behaviour of Plugin Dependencies is that dependencies cannot be deleted until their dependents are deleted.

While the 'Delete' link was removed from the plugin row, the bulk actions checkbox remained enabled, allowing for deletion of dependencies through bulk actions.

This was unintended behaviour and the bulk actions checkbox is now disabled as intended.

Follow-up to [57545].

Props johnbillion, afragen, knutsp, huzaifaalmesbah, mukesh27, costdev.
Fixes #60471.

Committed in 57620.