Changeset 3789662

Timestamp:

11/07/2026 01:22:55 PM (less than one hour ago)

Author:

fernandot

Message:

Competitors Search improved

Location:

contributor-resume

Files:

• tags/1.6.0/assets/css/stats.css (modified) (1 diff)
• tags/1.6.0/assets/js/stats.js (modified) (3 diffs)
• tags/1.6.0/changelog.txt (modified) (2 diffs)
• tags/1.6.0/includes/stats/class-cresume-stats-admin.php (modified) (7 diffs)
• tags/1.6.0/includes/stats/class-cresume-stats-cli.php (modified) (3 diffs)
• tags/1.6.0/includes/stats/class-cresume-stats-fetcher.php (modified) (4 diffs)
• tags/1.6.0/includes/stats/class-cresume-stats-lock.php (modified) (1 diff)
• tags/1.6.0/includes/stats/class-cresume-stats-rivals.php (modified) (12 diffs)
• tags/1.6.0/includes/stats/class-cresume-stats-view.php (modified) (6 diffs)
• tags/1.6.0/includes/stats/class-cresume-stats-widget.php (modified) (3 diffs)
• tags/1.6.0/readme.txt (modified) (3 diffs)
• tags/1.6.0/uninstall.php (modified) (1 diff)
• trunk/assets/css/stats.css (modified) (1 diff)
• trunk/assets/js/stats.js (modified) (3 diffs)
• trunk/changelog.txt (modified) (2 diffs)
• trunk/includes/stats/class-cresume-stats-admin.php (modified) (7 diffs)
• trunk/includes/stats/class-cresume-stats-cli.php (modified) (3 diffs)
• trunk/includes/stats/class-cresume-stats-fetcher.php (modified) (4 diffs)
• trunk/includes/stats/class-cresume-stats-lock.php (modified) (1 diff)
• trunk/includes/stats/class-cresume-stats-rivals.php (modified) (12 diffs)
• trunk/includes/stats/class-cresume-stats-view.php (modified) (6 diffs)
• trunk/includes/stats/class-cresume-stats-widget.php (modified) (3 diffs)
• trunk/readme.txt (modified) (3 diffs)
• trunk/uninstall.php (modified) (1 diff)

contributor-resume/tags/1.6.0/assets/css/stats.css

@@ -1555 +1555 @@
 }
 
+/* The search to add a competitor (1.6.0) and the notice when the list is full. */
+
 .cresume-stats-rival-add {
+        margin-top: 16px;
+        padding-top: 16px;
+        border-top: 1px solid #f0f0f1;
+}
+
+.cresume-stats-rival-add h3 {
+        margin: 0 0 8px;
+}
+
+.cresume-stats-rival-search {
         display: flex;
         flex-wrap: wrap;
         align-items: center;
         gap: 8px 12px;
-        margin-top: 16px;
-        padding-top: 16px;
-        border-top: 1px solid #f0f0f1;
-}
-
-.cresume-stats-rival-add label[for] {
-        font-weight: 600;
-}
-
-.cresume-stats-rival-add .description {
+}
+
+.cresume-stats-rival-search label[for] {
+        font-weight: 600;
+}
+
+.cresume-stats-rival-search .description {
         flex-basis: 100%;
         margin: 0;
+}
+
+.cresume-stats-search-results[aria-busy="true"] {
+        opacity: 0.6;
+}
+
+.cresume-stats-search-none {
+        margin: 12px 0 0;
+}
+
+.cresume-stats-suggest-card img.cresume-stats-rival-icon {
+        object-fit: cover;
+}
+
+.cresume-stats-rivals h2 .cresume-stats-chip {
+        margin-left: 6px;
+        vertical-align: middle;
+}
+
+.cresume-stats-rival-full.notice {
+        margin: 16px 0 0;
+}
+
+.cresume-stats-rival-full-note {
+        margin: 8px 0 0;
 }
 

contributor-resume/tags/1.6.0/assets/js/stats.js

@@ -12 +12 @@
  * value/max of the <progress> element and in numeric SVG attributes. The
  * keyword chips are drawn by core's tags box (wp-admin/js/tags-box.js), which
- * uses .text() for them.
+ * uses .text() for them. The one exception is the search of competitors
+ * (1.6.0): it inserts the results as the server drew and escaped them
+ * (Cresume_Stats_View::search_results()), the same HTML the page prints
+ * without JavaScript, and adds nothing of its own to it.
  */
 ( function () {
@@ -499 +502 @@
         }
 
+        /**
+         * Search WordPress.org while a competitor is typed (1.6.0). Without
+         * JavaScript the form is a GET of the same view and Enter shows the
+         * results; here the text is sent after a pause, an older request is
+         * cancelled, and Enter searches at once without leaving the page.
+         */
+        function initRivalSearch() {
+                var form = document.querySelector( '.cresume-stats-rival-search' );
+                var input = form ? form.querySelector( 'input[name="rq"]' ) : null;
+                var results = document.getElementById( 'cresume-stats-rival-results' );
+                var status = document.getElementById( 'cresume-stats-rival-status' );
+                var min;
+                var timer = null;
+                var controller = null;
+                var last;
+
+                if ( ! form || ! input || ! results || ! status || ! cfg.rivalNonce || ! window.fetch ) {
+                        return;
+                }
+
+                min = parseInt( form.getAttribute( 'data-min' ), 10 ) || 2;
+                last = input.value.trim();
+
+                function clear() {
+                        while ( results.firstChild ) {
+                                results.removeChild( results.firstChild );
+                        }
+                }
+
+                function run( text ) {
+                        var body;
+
+                        if ( controller ) {
+                                controller.abort();
+                                controller = null;
+                        }
+
+                        if ( text.length < min ) {
+                                clear();
+                                status.textContent = '';
+
+                                return;
+                        }
+
+                        body = new window.FormData();
+                        body.append( 'action', 'cresume_stats_rival_search' );
+                        body.append( 'nonce', cfg.rivalNonce );
+                        body.append( 'item', form.getAttribute( 'data-item' ) || '' );
+                        body.append( 'rq', text );
+
+                        controller = window.AbortController ? new window.AbortController() : null;
+                        status.textContent = i18n.searching || '';
+                        results.setAttribute( 'aria-busy', 'true' );
+
+                        window
+                                .fetch( cfg.ajaxUrl, {
+                                        method: 'POST',
+                                        credentials: 'same-origin',
+                                        body: body,
+                                        signal: controller ? controller.signal : undefined,
+                                } )
+                                .then( function ( response ) {
+                                        return response.json();
+                                } )
+                                .then( function ( data ) {
+                                        results.removeAttribute( 'aria-busy' );
+
+                                        if ( ! data || ! data.success || ! data.data ) {
+                                                status.textContent = data && data.data && data.data.message ? String( data.data.message ) : i18n.failed || '';
+
+                                                return;
+                                        }
+
+                                        // HTML drawn and escaped by Cresume_Stats_View::search_results().
+                                        results.innerHTML = String( data.data.html || '' );
+                                        status.textContent = String( data.data.status || '' );
+                                } )
+                                .catch( function ( error ) {
+                                        if ( error && 'AbortError' === error.name ) {
+                                                return;
+                                        }
+
+                                        results.removeAttribute( 'aria-busy' );
+                                        status.textContent = i18n.failed || '';
+                                } );
+                }
+
+                input.addEventListener( 'input', function () {
+                        var text = input.value.trim();
+
+                        window.clearTimeout( timer );
+
+                        if ( text === last ) {
+                                return;
+                        }
+
+                        last = text;
+                        timer = window.setTimeout( function () {
+                                run( text );
+                        }, 350 );
+                } );
+
+                form.addEventListener( 'submit', function ( event ) {
+                        event.preventDefault();
+                        window.clearTimeout( timer );
+                        last = input.value.trim();
+                        run( last );
+                } );
+        }
+
         initPrefs();
         initKeywordBox();
@@ -506 +619 @@
         initSwitcher();
         initScale();
+        initRivalSearch();
 }() );

contributor-resume/tags/1.6.0/changelog.txt

@@ -5 +5 @@
 
 = 1.6.0 =
-* New: Competitor tracking. Choose up to 10 competitors for each plugin or theme, by slug or WordPress.org address, or from suggestions taken from your own keywords, each with the reason it is there. They are read every day like your own, with two years of download history from the first day. Market leaders are suggested apart: a leader is followed like the rest but not counted when comparing who ranks better.
+* New: Competitor tracking. Choose up to 10 competitors for each plugin or theme with a search of the directory by name or slug, with results as you type, or from suggestions taken from your own keywords, each with the reason it is there. They are read every day like your own, with two years of download history from the first day. Market leaders are suggested apart: a leader is followed like the rest but not counted when comparing who ranks better. When a plugin or theme has its 10, the screen says so and explains how to make room.
 * New: Competitors view in Stats. Five figures, a sortable head-to-head table, a keyword-by-keyword table that shows where you rank better, one downloads chart for all of them (on a logarithmic scale or as an index that starts everyone at 100), your share of the top 10 of your keywords and the opportunities it shows.
 * New: Competitor alerts, in the Alerts view and in the emails. A competitor passes you or falls behind, enters or leaves the top 10, ranks for one of your keywords for the first time, releases a version, says it is tested with a newer WordPress than yours, changes its installs range or rating, gets a spike in downloads without a release, goes 6 or 12 months without an update or is closed on WordPress.org.
@@ -16 +16 @@
 * Improved: On the page of each plugin or theme, the downloads chart is a box you can move, fold or hide like the others, next to active installs and at the same height. Translations and version adoption line up as well.
 * Improved: The stats tables are updated automatically to keep the competitors and their positions.
+* Improved: The dashboard widget settings ignore unexpected values without a PHP notice, and the rating bars are drawn empty when WordPress.org gives no breakdown of the ratings.
 
 = 1.5.4 =

contributor-resume/tags/1.6.0/includes/stats/class-cresume-stats-admin.php

@@ -78 +78 @@
          * @var string[]
          */
-        const RIVAL_ERRORS = array( 'invalid', 'not_tracked', 'type', 'self', 'exists', 'full', 'missing', 'closed', 'unknown' );
+        const RIVAL_ERRORS = array( 'not_tracked', 'self', 'exists', 'full', 'missing', 'closed', 'unknown', 'not_suggested', 'busy' );
 
         /**
@@ -119 +119 @@
                 add_action( 'wp_ajax_cresume_stats_collect', array( $this, 'ajax_collect' ) );
                 add_action( 'wp_ajax_cresume_stats_status', array( $this, 'ajax_status' ) );
+                add_action( 'wp_ajax_cresume_stats_rival_search', array( $this, 'ajax_rival_search' ) );
                 add_filter( 'nonce_life', array( $this, 'view_nonce_life' ), 10, 2 );
         }
@@ -284 +285 @@
                         'paged'   => 1,
                         'ov'      => 'rivals',
+                        'rq'      => '',
                 );
         }
@@ -360 +362 @@
                 }
 
+                // The search of competitors without JavaScript (1.6.0): what was typed,
+                // shown back in the field and sent to WordPress.org. Never in a link or
+                // in the cookie: view_args() leaves it out.
+                if ( 'rivals' === $state['view'] && isset( $_GET['rq'] ) && is_string( $_GET['rq'] ) ) {
+                        $state['rq'] = self::search_text( sanitize_text_field( wp_unslash( $_GET['rq'] ) ) );
+                }
+
                 // The list of alerts: a topic of the closed list (anything else is all of
                 // them) and a page of 1 or more. Neither is remembered in the cookie.
@@ -716 +725 @@
                         'cresumeStats',
                         array(
-                                'ajaxUrl' => admin_url( 'admin-ajax.php' ),
-                                'nonce'   => wp_create_nonce( 'cresume_admin' ),
-                                'running' => Cresume_Stats_Collector::is_running() || Cresume_Stats_Peek::is_running(),
-                                'cookie'  => array(
+                                'ajaxUrl'    => admin_url( 'admin-ajax.php' ),
+                                'nonce'      => wp_create_nonce( 'cresume_admin' ),
+                                'running'    => Cresume_Stats_Collector::is_running() || Cresume_Stats_Peek::is_running(),
+                                'cookie'     => array(
                                         'name' => self::COOKIE,
                                         'path' => (string) wp_parse_url( admin_url(), PHP_URL_PATH ),
                                 ),
-                                'i18n'    => array(
-                                        'starting' => __( 'Starting…', 'contributor-resume' ),
-                                        'failed'   => __( 'Something went wrong. Try again.', 'contributor-resume' ),
-                                        'done'     => __( 'Collection finished.', 'contributor-resume' ),
+                                'rivalNonce' => 'rivals' === $state['view'] ? wp_create_nonce( 'cresume_stats_rival_search' ) : '',
+                                'i18n'       => array(
+                                        'starting'  => __( 'Starting…', 'contributor-resume' ),
+                                        'failed'    => __( 'Something went wrong. Try again.', 'contributor-resume' ),
+                                        'done'      => __( 'Collection finished.', 'contributor-resume' ),
+                                        'searching' => __( 'Searching WordPress.org…', 'contributor-resume' ),
                                 ),
                         )
                 );
+        }
+
+        /**
+         * Text of a search of competitors: trimmed, with its spaces collapsed and
+         * cut to Cresume_Stats_Fetcher::SEARCH_MAX characters.
+         *
+         * @param string $text Sanitized text.
+         * @return string
+         */
+        public static function search_text( $text ) {
+                $text = trim( preg_replace( '/\s+/u', ' ', (string) $text ) );
+
+                return mb_substr( $text, 0, Cresume_Stats_Fetcher::SEARCH_MAX, 'UTF-8' );
         }
 
@@ -1828 +1852 @@
                 $item = self::rival_item( isset( $_POST['item'] ) ? absint( $_POST['item'] ) : 0 );
 
-                // A slug or an address: wp_strip_all_tags() keeps the %XX octets that
-                // sanitize_text_field() would delete; parse_input() checks the rest.
-                $raw    = isset( $_POST['competitor'] ) && is_string( $_POST['competitor'] ) ? wp_strip_all_tags( wp_unslash( $_POST['competitor'] ) ) : '';
+                // The slug of a search result or a suggestion (1.6.0: nobody types it);
+                // add() checks it against Cresume_Stats_Rivals::SLUG_PATTERN.
+                $slug   = isset( $_POST['competitor'] ) && is_string( $_POST['competitor'] ) ? sanitize_text_field( wp_unslash( $_POST['competitor'] ) ) : '';
                 $leader = isset( $_POST['leader'] ) && '1' === sanitize_key( wp_unslash( $_POST['leader'] ) );
-                $result = Cresume_Stats_Rivals::add( (int) $item->type, (string) $item->slug, $raw, $leader );
+                $result = Cresume_Stats_Rivals::add( (int) $item->type, (string) $item->slug, $slug, $leader );
 
                 if ( is_wp_error( $result ) ) {
@@ -2040 +2064 @@
 
         /**
+         * The search of competitors as you type (1.6.0): the results for one own
+         * item, as HTML drawn and escaped by Cresume_Stats_View::search_results(),
+         * the same function that draws them without JavaScript. Nonce, capability,
+         * an own item the stats follow and a text of 2 to SEARCH_MAX characters;
+         * only the text travels to WordPress.org, encoded (query_url()).
+         */
+        public function ajax_rival_search() {
+                check_ajax_referer( 'cresume_stats_rival_search', 'nonce' );
+                $this->authorize();
+
+                if ( ! Cresume_Stats::enabled() || ! Cresume_Stats_Schema::is_current() ) {
+                        wp_send_json_error( array( 'message' => __( 'Stats are off or their tables are not ready.', 'contributor-resume' ) ), 400 );
+                }
+
+                $item_id = isset( $_POST['item'] ) ? absint( $_POST['item'] ) : 0;
+                $item    = $item_id ? Cresume_Stats_Store::item( $item_id ) : null;
+
+                if ( ! $item || 1 !== (int) $item->role ) {
+                        wp_send_json_error( array( 'message' => Cresume_Stats_Rivals::error( 'cresume_rival_not_tracked' )->get_error_message() ), 400 );
+                }
+
+                $text = isset( $_POST['rq'] ) && is_string( $_POST['rq'] ) ? self::search_text( sanitize_text_field( wp_unslash( $_POST['rq'] ) ) ) : '';
+
+                ob_start();
+                $status = Cresume_Stats_View::search_results( $item, $text );
+                $html   = ob_get_clean();
+
+                wp_send_json_success(
+                        array(
+                                'html'   => (string) $html,
+                                'status' => $status,
+                        )
+                );
+        }
+
+        /**
          * Stop unless the user may manage the site.
          */

contributor-resume/tags/1.6.0/includes/stats/class-cresume-stats-cli.php

@@ -377 +377 @@
          *
          * <competitor>
-         * : Slug of the competitor, or its address on WordPress.org.
+         * : Slug of the competitor on WordPress.org.
          *
          * [--type=<type>]
@@ -391 +391 @@
          *
          *     wp cresume stats competitors add vigilante ninjafirewall
-         *     wp cresume stats competitors add vigilante https://wordpress.org/plugins/wordfence/ --leader
+         *     wp cresume stats competitors add vigilante wordfence --leader
          *
          * @param array $args       Positional args.
@@ -400 +400 @@
 
                 $type   = $this->type( $assoc_args );
-                $result = Cresume_Stats_Rivals::add( $type, sanitize_key( $args[0] ), $args[1], ! empty( $assoc_args['leader'] ) );
+                // A slug as typed in the terminal: trimmed and in lowercase, then checked by add().
+                $result = Cresume_Stats_Rivals::add( $type, sanitize_key( $args[0] ), strtolower( trim( (string) $args[1] ) ), ! empty( $assoc_args['leader'] ) );
 
                 if ( is_wp_error( $result ) ) {

contributor-resume/tags/1.6.0/includes/stats/class-cresume-stats-fetcher.php

@@ -57 +57 @@
          */
         const INFO_MAX = 100;
+
+        /**
+         * Results of the search of competitors (1.6.0).
+         *
+         * @var int
+         */
+        const SEARCH_RESULTS = 10;
+
+        /**
+         * Characters a search of competitors needs before it asks WordPress.org.
+         *
+         * @var int
+         */
+        const SEARCH_MIN = 2;
+
+        /**
+         * Characters of a search of competitors, at most.
+         *
+         * @var int
+         */
+        const SEARCH_MAX = 100;
+
+        /**
+         * Seconds a search of competitors is kept.
+         *
+         * @var int
+         */
+        const SEARCH_CACHE = 900;
+
+        /**
+         * Prefix of the transients of the search of competitors. uninstall.php
+         * deletes them by this prefix, even when the data is kept.
+         *
+         * @var string
+         */
+        const SEARCH_PREFIX = 'cresume_srch_';
 
         /**
@@ -308 +344 @@
                 }
 
-                $icon = '';
-
-                if ( $is_theme ) {
-                        $icon = isset( $raw['screenshot_url'] ) ? (string) $raw['screenshot_url'] : '';
-
-                        // The Themes API returns protocol-relative screenshot URLs.
-                        if ( 0 === strpos( $icon, '//' ) ) {
-                                $icon = 'https:' . $icon;
-                        }
-                } elseif ( isset( $raw['icons'] ) && is_array( $raw['icons'] ) ) {
-                        foreach ( array( '2x', '1x', 'svg', 'default' ) as $size ) {
-                                if ( ! empty( $raw['icons'][ $size ] ) ) {
-                                        $icon = (string) $raw['icons'][ $size ];
-                                        break;
-                                }
-                        }
-                }
-
-                $icon = esc_url_raw( $icon, array( 'https' ) );
+                $icon = self::icon_of( $is_theme, $raw );
 
                 $updated = '';
@@ -338 +356 @@
                         'slug'    => $slug,
                         'name'    => self::clean_text( isset( $raw['name'] ) ? $raw['name'] : $slug, 255 ),
-                        'icon'    => strlen( $icon ) <= 255 ? $icon : '',
+                        'icon'    => $icon,
                         'added'   => self::clean_date( isset( $raw['added'] ) ? $raw['added'] : '' ),
                         'tags'    => $is_theme ? array() : self::clean_tags( isset( $raw['tags'] ) ? $raw['tags'] : array() ),
@@ -358 +376 @@
 
         /**
+         * The icon of a plugin, or the screenshot of a theme, as an https address
+         * of 255 characters at most, or ''.
+         *
+         * @param bool  $is_theme Whether it is a theme.
+         * @param array $raw      Raw API item.
+         * @return string
+         */
+        private static function icon_of( $is_theme, array $raw ) {
+                $icon = '';
+
+                if ( $is_theme ) {
+                        $icon = isset( $raw['screenshot_url'] ) && is_string( $raw['screenshot_url'] ) ? $raw['screenshot_url'] : '';
+
+                        // The Themes API returns protocol-relative screenshot URLs.
+                        if ( 0 === strpos( $icon, '//' ) ) {
+                                $icon = 'https:' . $icon;
+                        }
+                } elseif ( isset( $raw['icons'] ) && is_array( $raw['icons'] ) ) {
+                        foreach ( array( '2x', '1x', 'svg', 'default' ) as $size ) {
+                                if ( ! empty( $raw['icons'][ $size ] ) && is_string( $raw['icons'][ $size ] ) ) {
+                                        $icon = $raw['icons'][ $size ];
+                                        break;
+                                }
+                        }
+                }
+
+                $icon = esc_url_raw( $icon, array( 'https' ) );
+
+                return strlen( $icon ) <= 255 ? $icon : '';
+        }
+
+        /**
+         * Search the directory to add a competitor (1.6.0): what a person types,
+         * matched by WordPress.org against slugs and names, in the order of the web
+         * search. Measured on 7 Nov 2026: the slug comes first («wpo-tweaks» and
+         * «wpo tweaks» find WPO Tweaks, whose name is DietPress; «/vigilante/»
+         * finds Vigilant), so no lookup by slug is needed. Closed plugins never
+         * come back. About 5 KB for 10 results.
+         *
+         * The answer is kept SEARCH_CACHE seconds per type and text, so typing the
+         * same search again asks nothing.
+         *
+         * @param int    $type  Type constant.
+         * @param string $query Text typed, already trimmed and cut to SEARCH_MAX.
+         * @return array|WP_Error ['results' => int, 'list' => [['slug', 'name',
+         *                        'icon', 'installs', 'rating', 'num_ratings'], …]].
+         */
+        public function search( $type, $query ) {
+                $type  = Cresume_Stats_Store::TYPE_THEME === (int) $type ? Cresume_Stats_Store::TYPE_THEME : Cresume_Stats_Store::TYPE_PLUGIN;
+                $query = (string) $query;
+                $key   = self::SEARCH_PREFIX . md5( $type . '|' . mb_strtolower( $query, 'UTF-8' ) );
+                $kept  = get_transient( $key );
+
+                if ( is_array( $kept ) && isset( $kept['results'], $kept['list'] ) ) {
+                        return $kept;
+                }
+
+                $is_theme = Cresume_Stats_Store::TYPE_THEME === $type;
+                $args     = array(
+                        'action'            => $is_theme ? 'query_themes' : 'query_plugins',
+                        // Encoded here: add_query_arg() does not encode values (see query_url()).
+                        'request[search]'   => rawurlencode( $query ),
+                        'request[per_page]' => self::SEARCH_RESULTS,
+                        'request[page]'     => 1,
+                );
+
+                foreach ( self::search_fields( $type ) as $field => $on ) {
+                        $args[ 'request[fields][' . $field . ']' ] = $on;
+                }
+
+                $data = $this->get_json( add_query_arg( $args, $is_theme ? self::THEMES_API : self::PLUGINS_API ) );
+
+                if ( is_wp_error( $data ) ) {
+                        return $data;
+                }
+
+                $list_key = $is_theme ? 'themes' : 'plugins';
+
+                if ( ! is_array( $data ) || ! isset( $data[ $list_key ], $data['info'] ) || ! is_array( $data[ $list_key ] ) ) {
+                        return self::bad_payload();
+                }
+
+                $list = array();
+
+                foreach ( $data[ $list_key ] as $row ) {
+                        $slug = is_array( $row ) && isset( $row['slug'] ) && is_string( $row['slug'] ) ? $row['slug'] : '';
+
+                        if ( ! preg_match( '/^[a-z0-9-]{1,191}$/', $slug ) || isset( $list[ $slug ] ) ) {
+                                continue;
+                        }
+
+                        $list[ $slug ] = array(
+                                'slug'        => $slug,
+                                'name'        => self::clean_text( isset( $row['name'] ) && is_scalar( $row['name'] ) ? $row['name'] : $slug, 120 ),
+                                'icon'        => self::icon_of( $is_theme, $row ),
+                                'installs'    => isset( $row['active_installs'] ) ? absint( $row['active_installs'] ) : 0,
+                                'rating'      => isset( $row['rating'] ) ? min( 100, absint( $row['rating'] ) ) : 0,
+                                'num_ratings' => isset( $row['num_ratings'] ) ? absint( $row['num_ratings'] ) : 0,
+                        );
+
+                        if ( count( $list ) >= self::SEARCH_RESULTS ) {
+                                break;
+                        }
+                }
+
+                $out = array(
+                        'results' => isset( $data['info']['results'] ) ? absint( $data['info']['results'] ) : count( $list ),
+                        'list'    => array_values( $list ),
+                );
+
+                set_transient( $key, $out, self::SEARCH_CACHE );
+
+                return $out;
+        }
+
+        /**
+         * Fields asked for in the search of competitors: what a result shows.
+         *
+         * @param int $type Type constant.
+         * @return array
+         */
+        private static function search_fields( $type ) {
+                if ( Cresume_Stats_Store::TYPE_THEME === (int) $type ) {
+                        return array(
+                                'active_installs' => 1,
+                                'rating'          => 1,
+                                'num_ratings'     => 1,
+                                'screenshot_url'  => 1,
+                                'description'     => 0,
+                                'sections'        => 0,
+                                'ratings'         => 0,
+                                'downloaded'      => 0,
+                                'last_updated'    => 0,
+                                'homepage'        => 0,
+                                'tags'            => 0,
+                                'versions'        => 0,
+                                'theme_url'       => 0,
+                        );
+                }
+
+                return array(
+                        'active_installs'   => 1,
+                        'rating'            => 1,
+                        'num_ratings'       => 1,
+                        'icons'             => 1,
+                        'short_description' => 0,
+                        'description'       => 0,
+                        'sections'          => 0,
+                        'tags'              => 0,
+                        'versions'          => 0,
+                        'contributors'      => 0,
+                        'screenshots'       => 0,
+                        'banners'           => 0,
+                        'compatibility'     => 0,
+                        'reviews'           => 0,
+                        'ratings'           => 0,
+                        'downloaded'        => 0,
+                        'last_updated'      => 0,
+                        'added'             => 0,
+                        'homepage'          => 0,
+                        'donate_link'       => 0,
+                        'tested'            => 0,
+                        'requires'          => 0,
+                        'requires_php'      => 0,
+                );
+        }
+
+        /**
          * Daily downloads, oldest first, up to yesterday (UTC).
          *

contributor-resume/tags/1.6.0/includes/stats/class-cresume-stats-lock.php

@@ -108 +108 @@
 
         /**
-         * Drop what the options cache may remember about the lock.
+         * Drop what the options cache may remember about an option: the lock, or
+         * (1.6.0) the option a lock guards, so it is read from the database once
+         * the lock is taken.
          *
          * @param string $name Option name.
          */
-        private static function forget( $name ) {
+        public static function forget( $name ) {
                 wp_cache_delete( $name, 'options' );
 

contributor-resume/tags/1.6.0/includes/stats/class-cresume-stats-rivals.php

@@ -90 +90 @@
 
         /**
+         * Lock of the choice (1.6.0): a row of its own in the options table, taken
+         * with Cresume_Stats_Lock. Deleted by uninstall.php.
+         *
+         * @var string
+         */
+        const LOCK_OPTION = 'cresume_stats_rivals_lock';
+
+        /**
+         * Seconds the lock outlives a request that died holding it.
+         *
+         * @var int
+         */
+        const LOCK_TTL = 30;
+
+        /**
+         * Seconds a change waits for another one in progress.
+         *
+         * @var int
+         */
+        const LOCK_WAIT = 2;
+
+        /**
          * Key of an own item.
          *
@@ -594 +616 @@
 
         /**
-         * Read what the user typed: a slug, or the address of a plugin or theme on
-         * WordPress.org (any locale subdomain, with or without scheme, `www.`,
-         * trailing slash, query or fragment).
-         *
-         * The address goes through esc_url_raw() (never sanitize_text_field(),
-         * which deletes the %XX octets) and its path is cut by hand; the slug that
-         * comes out must match SLUG_PATTERN, so nothing else reaches the API.
-         *
-         * @param mixed $raw Text typed by the user.
-         * @return array|WP_Error ['slug' => string, 'type' => int], type 0 when a bare
-         *                        slug does not say whether it is a plugin or a theme.
-         */
-        public static function parse_input( $raw ) {
-                if ( ! is_string( $raw ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $raw = trim( $raw );
-
-                if ( '' === $raw || strlen( $raw ) > 500 ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $slug = strtolower( $raw );
-
-                if ( preg_match( self::SLUG_PATTERN, $slug ) ) {
-                        return array(
-                                'slug' => $slug,
-                                'type' => 0,
-                        );
-                }
-
-                $url = esc_url_raw( $raw, array( 'http', 'https' ) );
-
-                if ( '' === $url || ! preg_match( '#^https?://(?:[a-z0-9-]+\.)?wordpress\.org(/[^?\#]*)?(?:[?\#].*)?$#i', $url, $match ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $path = isset( $match[1] ) ? $match[1] : '';
-
-                if ( ! preg_match( '#^/(plugins|themes)/([^/]+)/?$#i', $path, $parts ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $slug = strtolower( rawurldecode( $parts[2] ) );
-
-                if ( ! preg_match( self::SLUG_PATTERN, $slug ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                return array(
-                        'slug' => $slug,
-                        'type' => 'themes' === strtolower( $parts[1] ) ? Cresume_Stats_Store::TYPE_THEME : Cresume_Stats_Store::TYPE_PLUGIN,
-                );
-        }
-
-        /**
          * Add a competitor to an own item, checked against WordPress.org.
+         *
+         * The slug comes from a result of the search, a suggestion or WP-CLI, never
+         * typed in a field (1.6.0: the field for a slug or an address is gone), so it
+         * is only checked against SLUG_PATTERN. What can be decided without asking
+         * WordPress.org is decided first, and checked again under the lock before
+         * saving.
          *
          * @param int    $type     Type constant of the own item.
          * @param string $own_slug Slug of the own item.
-         * @param mixed  $input    Slug or address typed by the user.
+         * @param mixed  $slug     Slug of the competitor.
          * @param bool   $leader   Whether it is added as a leader.
          * @return array|WP_Error ['slug' => string, 'info' => array] with the answer of
@@ -661 +632 @@
          *                        Cresume_Stats_Collector::rival_now().
          */
-        public static function add( $type, $own_slug, $input, $leader = false ) {
+        public static function add( $type, $own_slug, $slug, $leader = false ) {
                 $type = Cresume_Stats_Store::TYPE_THEME === (int) $type ? Cresume_Stats_Store::TYPE_THEME : Cresume_Stats_Store::TYPE_PLUGIN;
                 $own  = self::tracked( $type, $own_slug );
@@ -669 +640 @@
                 }
 
-                $parsed = self::parse_input( $input );
-
-                if ( is_wp_error( $parsed ) ) {
-                        return $parsed;
-                }
-
-                if ( $parsed['type'] && $parsed['type'] !== $type ) {
-                        return self::error( 'cresume_rival_type' );
-                }
-
-                $slug = $parsed['slug'];
+                if ( ! is_string( $slug ) || ! preg_match( self::SLUG_PATTERN, $slug ) ) {
+                        return self::error( 'cresume_rival_missing' );
+                }
 
                 if ( $slug === (string) $own->slug ) {
@@ -685 +648 @@
                 }
 
-                $all  = self::all();
-                $key  = self::key( $type, $own->slug );
-                $mine = isset( $all[ $key ] ) ? $all[ $key ] : array(
-                        'r' => array(),
-                        'l' => array(),
-                        'h' => array(),
-                );
+                $mine = self::of( $type, $own->slug );
 
                 if ( in_array( $slug, $mine['r'], true ) ) {
@@ -717 +674 @@
                 }
 
-                $mine['r'][] = $slug;
-
-                if ( $leader ) {
-                        $mine['l'][] = $slug;
-                }
-
-                $mine['h']   = array_values( array_diff( $mine['h'], array( $slug ) ) );
-                $all[ $key ] = $mine;
-                self::save( $all );
+                $key   = self::key( $type, $own->slug );
+                $saved = self::locked(
+                        function () use ( $key, $slug, $leader ) {
+                                $all  = self::all();
+                                $mine = isset( $all[ $key ] ) ? $all[ $key ] : self::blank();
+
+                                // Another administrator may have added it, or filled the list, meanwhile.
+                                if ( in_array( $slug, $mine['r'], true ) ) {
+                                        return self::error( 'cresume_rival_exists' );
+                                }
+
+                                if ( count( $mine['r'] ) >= self::MAX_PER_ITEM ) {
+                                        return self::error( 'cresume_rival_full' );
+                                }
+
+                                $mine['r'][] = $slug;
+
+                                if ( $leader ) {
+                                        $mine['l'][] = $slug;
+                                }
+
+                                $mine['h']   = array_values( array_diff( $mine['h'], array( $slug ) ) );
+                                $all[ $key ] = $mine;
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
+
+                if ( is_wp_error( $saved ) ) {
+                        return $saved;
+                }
 
                 return array(
@@ -743 +723 @@
          */
         public static function remove( $type, $own_slug, $slug ) {
-                $all = self::all();
-                $key = self::key( $type, $own_slug );
-
-                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['r'], true ) ) {
-                        return self::error( 'cresume_rival_unknown' );
-                }
-
-                $all[ $key ]['r'] = array_values( array_diff( $all[ $key ]['r'], array( $slug ) ) );
-                $all[ $key ]['l'] = array_values( array_diff( $all[ $key ]['l'], array( $slug ) ) );
-                self::save( $all );
+                $key   = self::key( $type, $own_slug );
+                $saved = self::locked(
+                        function () use ( $key, $slug ) {
+                                $all = self::all();
+
+                                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['r'], true ) ) {
+                                        return self::error( 'cresume_rival_unknown' );
+                                }
+
+                                $all[ $key ]['r'] = array_values( array_diff( $all[ $key ]['r'], array( $slug ) ) );
+                                $all[ $key ]['l'] = array_values( array_diff( $all[ $key ]['l'], array( $slug ) ) );
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
+
+                if ( is_wp_error( $saved ) ) {
+                        return $saved;
+                }
+
                 self::release_unused();
                 Cresume_Stats_Store::touch();
@@ -760 +751 @@
 
         /**
-         * Hide a suggestion for an own item.
+         * Hide a suggestion for an own item. Only one of the suggestions it has now
+         * (1.6.0): a forged slug that nothing suggests is not stored.
          *
          * @param int    $type     Type constant.
@@ -768 +760 @@
          */
         public static function hide( $type, $own_slug, $slug ) {
-                if ( ! is_string( $slug ) || ! preg_match( self::SLUG_PATTERN, $slug ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $all = self::all();
-                $key = self::key( $type, $own_slug );
-
-                if ( ! self::tracked( $type, $own_slug ) ) {
+                $own = self::tracked( $type, $own_slug );
+
+                if ( ! $own ) {
                         return self::error( 'cresume_rival_not_tracked' );
                 }
 
-                $mine = isset( $all[ $key ] ) ? $all[ $key ] : array(
-                        'r' => array(),
-                        'l' => array(),
-                        'h' => array(),
-                );
-
-                if ( in_array( $slug, $mine['r'], true ) ) {
+                $key = self::key( $type, $own->slug );
+
+                if ( is_string( $slug ) && in_array( $slug, self::of( $type, $own->slug )['r'], true ) ) {
                         return self::error( 'cresume_rival_exists' );
                 }
 
-                if ( ! in_array( $slug, $mine['h'], true ) ) {
-                        array_unshift( $mine['h'], $slug );
-                        $mine['h'] = array_slice( $mine['h'], 0, self::MAX_HIDDEN );
-                }
-
-                $all[ $key ] = $mine;
-                self::save( $all );
-
-                return true;
+                if ( ! is_string( $slug ) || ! preg_match( self::SLUG_PATTERN, $slug ) || ! in_array( $slug, self::suggested( (int) $own->id ), true ) ) {
+                        return self::error( 'cresume_rival_not_suggested' );
+                }
+
+                return self::locked(
+                        function () use ( $key, $slug ) {
+                                $all  = self::all();
+                                $mine = isset( $all[ $key ] ) ? $all[ $key ] : self::blank();
+
+                                if ( in_array( $slug, $mine['r'], true ) ) {
+                                        return self::error( 'cresume_rival_exists' );
+                                }
+
+                                if ( ! in_array( $slug, $mine['h'], true ) ) {
+                                        array_unshift( $mine['h'], $slug );
+                                        $mine['h'] = array_slice( $mine['h'], 0, self::MAX_HIDDEN );
+                                }
+
+                                $all[ $key ] = $mine;
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
+        }
+
+        /**
+         * Slugs suggested now for an own item, leaders included: what hide() takes.
+         *
+         * @param int $item_id Own item id.
+         * @return string[]
+         */
+        private static function suggested( $item_id ) {
+                $suggest = self::suggest( $item_id );
+                $slugs   = array();
+
+                foreach ( array_merge( $suggest['list'], $suggest['leaders'] ) as $cand ) {
+                        $slugs[] = (string) $cand['slug'];
+                }
+
+                return $slugs;
         }
 
@@ -809 +824 @@
          */
         public static function unhide( $type, $own_slug, $slug ) {
-                $all = self::all();
                 $key = self::key( $type, $own_slug );
 
-                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['h'], true ) ) {
-                        return self::error( 'cresume_rival_unknown' );
-                }
-
-                $all[ $key ]['h'] = array_values( array_diff( $all[ $key ]['h'], array( $slug ) ) );
-                self::save( $all );
-
-                return true;
+                return self::locked(
+                        function () use ( $key, $slug ) {
+                                $all = self::all();
+
+                                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['h'], true ) ) {
+                                        return self::error( 'cresume_rival_unknown' );
+                                }
+
+                                $all[ $key ]['h'] = array_values( array_diff( $all[ $key ]['h'], array( $slug ) ) );
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
         }
 
@@ -833 +853 @@
          */
         public static function set_leader( $type, $own_slug, $slug, $leader ) {
-                $all = self::all();
                 $key = self::key( $type, $own_slug );
 
-                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['r'], true ) ) {
-                        return self::error( 'cresume_rival_unknown' );
-                }
-
-                $l = array_values( array_diff( $all[ $key ]['l'], array( $slug ) ) );
-
-                if ( $leader ) {
-                        $l[] = $slug;
-                }
-
-                $all[ $key ]['l'] = $l;
-                self::save( $all );
-
-                return true;
+                return self::locked(
+                        function () use ( $key, $slug, $leader ) {
+                                $all = self::all();
+
+                                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['r'], true ) ) {
+                                        return self::error( 'cresume_rival_unknown' );
+                                }
+
+                                $l = array_values( array_diff( $all[ $key ]['l'], array( $slug ) ) );
+
+                                if ( $leader ) {
+                                        $l[] = $slug;
+                                }
+
+                                $all[ $key ]['l'] = $l;
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
+        }
+
+        /**
+         * Run a change of the choice under its lock (1.6.0), with the option read
+         * again from the database. Two administrators saving at the same time no
+         * longer lose one of the changes (informative of the level 2 review of
+         * 1.6.0). It waits up to LOCK_WAIT seconds for a change in progress; the
+         * lock is the one of Cresume_Stats_Lock, with its expiry for a worker that
+         * died holding it.
+         *
+         * @param callable $change Reads all(), changes it and saves it; returns true or a WP_Error.
+         * @return true|WP_Error
+         */
+        private static function locked( callable $change ) {
+                $until = microtime( true ) + self::LOCK_WAIT;
+                $token = Cresume_Stats_Lock::acquire( self::LOCK_OPTION, self::LOCK_TTL );
+
+                while ( false === $token ) {
+                        if ( microtime( true ) >= $until ) {
+                                return self::error( 'cresume_rival_busy' );
+                        }
+
+                        usleep( 100000 );
+                        $token = Cresume_Stats_Lock::acquire( self::LOCK_OPTION, self::LOCK_TTL );
+                }
+
+                // What this request read before taking the lock may be behind.
+                Cresume_Stats_Lock::forget( self::OPTION );
+
+                try {
+                        return $change();
+                } finally {
+                        Cresume_Stats_Lock::release( self::LOCK_OPTION, $token );
+                }
+        }
+
+        /**
+         * An empty choice for one own item.
+         *
+         * @return array ['r' => [], 'l' => [], 'h' => []].
+         */
+        private static function blank() {
+                return array(
+                        'r' => array(),
+                        'l' => array(),
+                        'h' => array(),
+                );
         }
 
@@ -936 +1008 @@
         public static function error( $code ) {
                 $messages = array(
-                        'cresume_rival_invalid'     => __( 'Type the slug of a plugin or theme, or its address on WordPress.org.', 'contributor-resume' ),
-                        'cresume_rival_not_tracked' => __( 'That plugin or theme is not one of the ones the stats follow.', 'contributor-resume' ),
-                        'cresume_rival_type'        => __( 'A plugin can only compete with plugins, and a theme with themes.', 'contributor-resume' ),
-                        'cresume_rival_self'        => __( 'A plugin or theme cannot be its own competitor.', 'contributor-resume' ),
+                        'cresume_rival_not_tracked'   => __( 'That plugin or theme is not one of the ones the stats follow.', 'contributor-resume' ),
+                        'cresume_rival_self'          => __( 'A plugin or theme cannot be its own competitor.', 'contributor-resume' ),
+                        'cresume_rival_not_suggested' => __( 'That plugin or theme is not among the suggestions any more.', 'contributor-resume' ),
+                        'cresume_rival_busy'          => __( 'Someone else is changing these competitors right now. Try again in a moment.', 'contributor-resume' ),
                         'cresume_rival_exists'      => __( 'It is already one of its competitors.', 'contributor-resume' ),
                         /* translators: %d: maximum number of competitors */

contributor-resume/tags/1.6.0/includes/stats/class-cresume-stats-view.php

@@ -994 +994 @@
                 }
 
-                $max = max( 1, max( array_map( 'intval', $item['ratings'] ) ) );
+                // max() of an empty array throws ValueError in PHP 8 (1.6.0): with
+                // num_ratings above zero and no breakdown, the bars are drawn empty.
+                $counts = is_array( $item['ratings'] ) ? array_map( 'intval', $item['ratings'] ) : array();
+                $max    = $counts ? max( 1, max( $counts ) ) : 1;
                 ?>
                 <ul class="cresume-stats-bars">
@@ -1743 +1746 @@
                 $add     = wp_create_nonce( 'cresume_stats_rival_add' );
                 $hide    = wp_create_nonce( 'cresume_stats_rival_hide' );
+                $max     = number_format_i18n( Cresume_Stats_Rivals::MAX_PER_ITEM );
                 ?>
                 <section class="cresume-card cresume-stats-rivals">
@@ -1754 +1758 @@
                                                 <?php
                                                 /* translators: 1: competitors chosen, 2: maximum */
-                                                echo esc_html( sprintf( __( '%1$s of %2$s · read every day, like your own', 'contributor-resume' ), number_format_i18n( count( $rows ) ), number_format_i18n( Cresume_Stats_Rivals::MAX_PER_ITEM ) ) );
+                                                echo esc_html( sprintf( __( '%1$s of %2$s · read every day, like your own', 'contributor-resume' ), number_format_i18n( count( $rows ) ), $max ) );
                                                 ?>
                                         </span>
+                                        <?php if ( $full ) : ?>
+                                                <span class="cresume-stats-chip cresume-stats-chip--warn"><?php esc_html_e( 'Full', 'contributor-resume' ); ?></span>
+                                        <?php endif; ?>
                                 </h2>
                                 <a class="button" href="<?php echo esc_url( $back ); ?>"><?php esc_html_e( 'Back to Competitors', 'contributor-resume' ); ?></a>
@@ -1764 +1771 @@
                                 <?php self::rival_list( $rows, $item, true ); ?>
                         <?php else : ?>
-                                <p class="cresume-stats-intro"><?php esc_html_e( 'No competitors yet. Pick from the suggestions below, or add any plugin by its slug or its address on WordPress.org.', 'contributor-resume' ); ?></p>
+                                <p class="cresume-stats-intro"><?php esc_html_e( 'No competitors yet. Search for them below, or pick from the suggestions.', 'contributor-resume' ); ?></p>
                         <?php endif; ?>
 
-                        <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="cresume-stats-rival-add">
-                                <input type="hidden" name="action" value="cresume_stats_rival_add" />
-                                <input type="hidden" name="item" value="<?php echo esc_attr( $item->id ); ?>" />
-                                <input type="hidden" name="_wpnonce" value="<?php echo esc_attr( $add ); ?>" />
-                                <label for="cresume-stats-rival-input"><?php esc_html_e( 'Add a competitor', 'contributor-resume' ); ?></label>
-                                <input type="text" id="cresume-stats-rival-input" name="competitor" class="regular-text" placeholder="<?php echo esc_attr( Cresume_Stats_Store::TYPE_THEME === $type ? 'astra  ·  https://wordpress.org/themes/astra/' : 'ninjafirewall  ·  https://wordpress.org/plugins/ninjafirewall/' ); ?>" aria-describedby="cresume-stats-rival-help"<?php disabled( $full ); ?> />
-                                <label class="cresume-inline"><input type="checkbox" name="leader" value="1"<?php disabled( $full ); ?> /> <?php esc_html_e( 'As a leader', 'contributor-resume' ); ?></label>
-                                <?php submit_button( __( 'Add competitor', 'contributor-resume' ), 'primary', 'submit', false, $full ? array( 'disabled' => 'disabled' ) : array() ); ?>
-                                <p class="description" id="cresume-stats-rival-help">
-                                        <?php
-                                        if ( $full ) {
+                        <?php if ( $full ) : ?>
+                                <div class="notice notice-warning inline cresume-stats-rival-full">
+                                        <p>
+                                                <strong><?php esc_html_e( 'No room for more competitors.', 'contributor-resume' ); ?></strong>
+                                                <?php
                                                 /* translators: %s: maximum number of competitors */
-                                                echo esc_html( sprintf( __( 'Each plugin or theme can have up to %s competitors. Remove one to add another.', 'contributor-resume' ), number_format_i18n( Cresume_Stats_Rivals::MAX_PER_ITEM ) ) );
-                                        } else {
-                                                esc_html_e( 'Its slug or its address on WordPress.org. It is checked there before it is added. A leader is read like the rest, but it is not counted when comparing who ranks better.', 'contributor-resume' );
-                                        }
-                                        ?>
-                                </p>
-                        </form>
+                                                echo esc_html( sprintf( __( 'Each plugin or theme can have up to %s competitors. Remove one to add another.', 'contributor-resume' ), $max ) );
+                                                ?>
+                                        </p>
+                                </div>
+                        <?php else : ?>
+                                <?php self::search_form( $state, $item ); ?>
+                        <?php endif; ?>
                 </section>
 
@@ -1798 +1799 @@
                                 </span>
                         </h2>
+
+                        <?php if ( $full && ( $suggest['list'] || $suggest['leaders'] ) ) : ?>
+                                <p class="description cresume-stats-rival-full-note"><?php esc_html_e( 'The list of competitors is full: remove one to add a suggestion.', 'contributor-resume' ); ?></p>
+                        <?php endif; ?>
 
                         <?php if ( ! $suggest['of'] ) : ?>
@@ -1849 +1854 @@
                         <?php endif; ?>
                 </section>
+                <?php
+        }
+
+        /**
+         * The search to add a competitor (1.6.0): a GET form of the same view, so
+         * Enter works without JavaScript, with the results of `rq` drawn below.
+         * stats.js searches as the text changes and puts its results in the same
+         * place. A leader is marked afterwards, in the list.
+         *
+         * @param array  $state View state.
+         * @param object $item  Own item row.
+         */
+        private static function search_form( array $state, $item ) {
+                $is_theme = Cresume_Stats_Store::TYPE_THEME === (int) $item->type;
+                $args     = Cresume_Stats_Admin::view_args( array_merge( $state, array( 'orderby' => '', 'order' => '' ) ) );
+                ?>
+                <div class="cresume-stats-rival-add">
+                        <h3><?php esc_html_e( 'Add a competitor', 'contributor-resume' ); ?></h3>
+                        <form method="get" action="<?php echo esc_url( admin_url( 'options-general.php' ) ); ?>" class="cresume-stats-rival-search" role="search" data-item="<?php echo esc_attr( (string) (int) $item->id ); ?>" data-min="<?php echo esc_attr( (string) Cresume_Stats_Fetcher::SEARCH_MIN ); ?>">
+                                <?php foreach ( $args as $name => $value ) : ?>
+                                        <input type="hidden" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( (string) $value ); ?>" />
+                                <?php endforeach; ?>
+                                <label for="cresume-stats-rival-input"><?php echo $is_theme ? esc_html__( 'Search for a theme', 'contributor-resume' ) : esc_html__( 'Search for a plugin', 'contributor-resume' ); ?></label>
+                                <input type="search" id="cresume-stats-rival-input" name="rq" value="<?php echo esc_attr( $state['rq'] ); ?>" class="regular-text" maxlength="<?php echo esc_attr( (string) Cresume_Stats_Fetcher::SEARCH_MAX ); ?>" autocomplete="off" spellcheck="false" aria-describedby="cresume-stats-rival-help" aria-controls="cresume-stats-rival-results" />
+                                <button type="submit" class="button"><?php esc_html_e( 'Search', 'contributor-resume' ); ?></button>
+                                <p class="description" id="cresume-stats-rival-help"><?php esc_html_e( 'By name or slug, as in the WordPress.org directory. Results appear as you type. A leader is marked afterwards, in the list.', 'contributor-resume' ); ?></p>
+                        </form>
+                        <div id="cresume-stats-rival-results" class="cresume-stats-search-results">
+                                <?php $status = '' !== $state['rq'] ? self::search_results( $item, $state['rq'] ) : ''; ?>
+                        </div>
+                        <p id="cresume-stats-rival-status" class="screen-reader-text" role="status"><?php echo esc_html( $status ); ?></p>
+                </div>
+                <?php
+        }
+
+        /**
+         * Results of the search of competitors (1.6.0), drawn here both for the
+         * search as you type (Cresume_Stats_Admin::ajax_rival_search()) and for the
+         * one sent with Enter. Names and icons come from WordPress.org: every value
+         * is escaped here, and stats.js only inserts this HTML.
+         *
+         * @param object $item Own item row.
+         * @param string $text Text searched (Cresume_Stats_Admin::search_text()).
+         * @return string What screen readers hear: how many results, or why none.
+         */
+        public static function search_results( $item, $text ) {
+                $text = (string) $text;
+
+                if ( mb_strlen( $text, 'UTF-8' ) < Cresume_Stats_Fetcher::SEARCH_MIN ) {
+                        return '';
+                }
+
+                $type     = (int) $item->type;
+                $is_theme = Cresume_Stats_Store::TYPE_THEME === $type;
+                $fetcher  = new Cresume_Stats_Fetcher();
+                $answer   = $fetcher->search( $type, $text );
+
+                if ( is_wp_error( $answer ) ) {
+                        $message = __( 'WordPress.org did not answer. Try again in a minute.', 'contributor-resume' );
+                        echo '<p class="cresume-stats-search-none">' . esc_html( $message ) . '</p>';
+
+                        return $message;
+                }
+
+                if ( ! $answer['list'] ) {
+                        $message = $is_theme
+                                /* translators: %s: text searched */
+                                ? sprintf( __( 'No themes found for “%s”.', 'contributor-resume' ), $text )
+                                /* translators: %s: text searched */
+                                : sprintf( __( 'No plugins found for “%s”.', 'contributor-resume' ), $text );
+                        echo '<p class="cresume-stats-search-none">' . esc_html( $message ) . '</p>';
+
+                        return $message;
+                }
+
+                $choice = Cresume_Stats_Rivals::of( $type, $item->slug );
+                $full   = count( $choice['r'] ) >= Cresume_Stats_Rivals::MAX_PER_ITEM;
+                $known  = Cresume_Stats_Store::known_items_by_slug( $type );
+                $add    = wp_create_nonce( 'cresume_stats_rival_add' );
+                ?>
+                <ul class="cresume-stats-suggest-grid" role="list">
+                        <?php
+                        foreach ( $answer['list'] as $row ) {
+                                self::search_result( $row, $item, $choice['r'], $known, $full, $add );
+                        }
+                        ?>
+                </ul>
+                <?php
+                /* translators: %s: number of results */
+                return sprintf( _n( '%s result', '%s results', count( $answer['list'] ), 'contributor-resume' ), number_format_i18n( count( $answer['list'] ) ) );
+        }
+
+        /**
+         * One result of the search: who it is and, when it can be one, a button
+         * that adds it as a competitor.
+         *
+         * @param array    $row    Row of Cresume_Stats_Fetcher::search().
+         * @param object   $item   Own item row.
+         * @param string[] $chosen Slugs of its competitors.
+         * @param array    $known  Cresume_Stats_Store::known_items_by_slug().
+         * @param bool     $full   Whether the item has no room for more.
+         * @param string   $add    Nonce of the add handler.
+         */
+        private static function search_result( array $row, $item, array $chosen, array $known, $full, $add ) {
+                $is_theme = Cresume_Stats_Store::TYPE_THEME === (int) $item->type;
+                $slug     = (string) $row['slug'];
+                $name     = '' !== $row['name'] ? Cresume_Stats_Query::short_name( $row['name'] ) : $slug;
+                $self     = $slug === (string) $item->slug;
+                $taken    = in_array( $slug, $chosen, true );
+                $own      = ! $self && isset( $known[ $slug ] ) && 1 === $known[ $slug ][1];
+
+                /* translators: 1: slug, 2: active installs */
+                $meta = sprintf( __( '%1$s · %2$s+ installs', 'contributor-resume' ), $slug, number_format_i18n( (int) $row['installs'] ) );
+                ?>
+                <li class="cresume-stats-suggest-card">
+                        <?php self::rival_icon( (string) $row['icon'], $name ); ?>
+                        <div class="cresume-stats-suggest-body">
+                                <a href="<?php echo esc_url( 'https://wordpress.org/' . ( $is_theme ? 'themes' : 'plugins' ) . '/' . rawurlencode( $slug ) . '/' ); ?>" target="_blank" rel="noopener noreferrer"><strong><?php echo esc_html( $name ); ?></strong><span class="screen-reader-text"> <?php esc_html_e( '(opens in a new tab)', 'contributor-resume' ); ?></span></a>
+                                <span class="cresume-stats-sub">
+                                        <?php echo esc_html( $meta ); ?>
+                                        <?php if ( (int) $row['num_ratings'] > 0 ) : ?>
+                                                · <?php echo esc_html( number_format_i18n( (int) $row['rating'] / 20, 1 ) ); ?> ★ (<?php echo esc_html( number_format_i18n( (int) $row['num_ratings'] ) ); ?>)
+                                        <?php endif; ?>
+                                </span>
+                                <?php if ( $self || $taken || $own ) : ?>
+                                        <span class="cresume-stats-reasons">
+                                                <?php if ( $self ) : ?>
+                                                        <span class="cresume-stats-chip"><?php echo $is_theme ? esc_html__( 'This theme', 'contributor-resume' ) : esc_html__( 'This plugin', 'contributor-resume' ); ?></span>
+                                                <?php elseif ( $taken ) : ?>
+                                                        <span class="cresume-stats-chip cresume-stats-chip--info"><?php esc_html_e( 'Already a competitor', 'contributor-resume' ); ?></span>
+                                                <?php else : ?>
+                                                        <span class="cresume-stats-chip"><?php esc_html_e( 'Yours', 'contributor-resume' ); ?></span>
+                                                <?php endif; ?>
+                                        </span>
+                                <?php endif; ?>
+                        </div>
+                        <?php if ( ! $self && ! $taken ) : ?>
+                                <div class="cresume-stats-suggest-actions">
+                                        <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
+                                                <input type="hidden" name="action" value="cresume_stats_rival_add" />
+                                                <input type="hidden" name="item" value="<?php echo esc_attr( (string) (int) $item->id ); ?>" />
+                                                <input type="hidden" name="competitor" value="<?php echo esc_attr( $slug ); ?>" />
+                                                <input type="hidden" name="_wpnonce" value="<?php echo esc_attr( $add ); ?>" />
+                                                <button type="submit" class="button button-primary"<?php disabled( $full ); ?>>
+                                                        <?php esc_html_e( 'Add', 'contributor-resume' ); ?>
+                                                        <span class="screen-reader-text"><?php echo esc_html( $name ); ?></span>
+                                                </button>
+                                        </form>
+                                </div>
+                        <?php endif; ?>
+                </li>
                 <?php
         }

contributor-resume/tags/1.6.0/includes/stats/class-cresume-stats-widget.php

@@ -158 +158 @@
                 }
 
-                $layout = isset( $raw['layout'] ) ? (string) $raw['layout'] : '';
-                $days   = isset( $raw['days'] ) ? (int) $raw['days'] : 0;
-                $sort   = isset( $raw['sort'] ) ? (string) $raw['sort'] : '';
-                $rows   = isset( $raw['rows'] ) ? (int) $raw['rows'] : 0;
+                // Arrays where text is expected come out as '' (1.6.0): a forged
+                // `layout[]` gave «Array to string conversion» before.
+                $layout = isset( $raw['layout'] ) ? self::text( $raw['layout'] ) : '';
+                $days   = isset( $raw['days'] ) && is_scalar( $raw['days'] ) ? (int) $raw['days'] : 0;
+                $sort   = isset( $raw['sort'] ) ? self::text( $raw['sort'] ) : '';
+                $rows   = isset( $raw['rows'] ) && is_scalar( $raw['rows'] ) ? (int) $raw['rows'] : 0;
                 $item   = isset( $raw['item'] ) ? self::id( $raw['item'] ) : 0;
                 $picked = array();
@@ -176 +178 @@
 
                 foreach ( ( isset( $raw['figures'] ) ? (array) $raw['figures'] : array() ) as $figure ) {
-                        $figure = sanitize_key( (string) $figure );
+                        $figure = sanitize_key( self::text( $figure ) );
 
                         if ( in_array( $figure, self::FIGURES, true ) ) {
@@ -194 +196 @@
                         'alerts'  => ! empty( $raw['alerts'] ),
                 );
+        }
+
+        /**
+         * A posted value as text, or '' when it is not a single value.
+         *
+         * @param mixed $value Posted value.
+         * @return string
+         */
+        private static function text( $value ) {
+                return is_scalar( $value ) ? (string) $value : '';
         }
 

contributor-resume/tags/1.6.0/readme.txt

@@ -147 +147 @@
 = Can I track my competitors? =
 
-Yes. In the Competitors view of the Stats tab, add up to 10 competitors to each plugin or theme, by slug or by their WordPress.org address, or pick them from the suggestions. They are read every day like your own. You compare them in a head-to-head table, keyword by keyword, in one downloads chart, and in the alerts and emails.
+Yes. In the Competitors view of the Stats tab, search the directory by name or slug and add up to 10 competitors to each plugin or theme, or pick them from the suggestions. They are read every day like your own. You compare them in a head-to-head table, keyword by keyword, in one downloads chart, and in the alerts and emails.
 
 = How are competitors suggested? =
@@ -235 +235 @@
 Competitor tracking: choose the plugins you compete with and follow them every day, with a head to head view, keyword positions, alerts, emails and a dashboard widget. The plugin is now called Contributor Résumé, Rank and Competitor Tracker.
 
-* New: Competitor tracking. Choose up to 10 competitors for each plugin or theme, by slug or WordPress.org address, or from suggestions taken from your own keywords, each with the reason it is there. They are read every day like your own, with two years of download history from the first day. Market leaders are suggested apart: a leader is followed like the rest but not counted when comparing who ranks better.
+* New: Competitor tracking. Choose up to 10 competitors for each plugin or theme with a search of the directory by name or slug, with results as you type, or from suggestions taken from your own keywords, each with the reason it is there. They are read every day like your own, with two years of download history from the first day. Market leaders are suggested apart: a leader is followed like the rest but not counted when comparing who ranks better. When a plugin or theme has its 10, the screen says so and explains how to make room.
 * New: Competitors view in Stats. Five figures, a sortable head-to-head table, a keyword-by-keyword table that shows where you rank better, one downloads chart for all of them (on a logarithmic scale or as an index that starts everyone at 100), your share of the top 10 of your keywords and the opportunities it shows.
 * New: Competitor alerts, in the Alerts view and in the emails. A competitor passes you or falls behind, enters or leaves the top 10, ranks for one of your keywords for the first time, releases a version, says it is tested with a newer WordPress than yours, changes its installs range or rating, gets a spike in downloads without a release, goes 6 or 12 months without an update or is closed on WordPress.org.
@@ -246 +246 @@
 * Improved: On the page of each plugin or theme, the downloads chart is a box you can move, fold or hide like the others, next to active installs and at the same height. Translations and version adoption line up as well.
 * Improved: The stats tables are updated automatically to keep the competitors and their positions.
+* Improved: The dashboard widget settings ignore unexpected values without a PHP notice, and the rating bars are drawn empty when WordPress.org gives no breakdown of the ratings.
 
 For older changelog entries, please check the [changelog.txt](https://plugins.svn.wordpress.org/contributor-resume/trunk/changelog.txt) file

contributor-resume/tags/1.6.0/uninstall.php

@@ -32 +32 @@
         delete_option( 'cresume_stats_lock' );
         delete_option( 'cresume_stats_mail_lock' );
+        delete_option( 'cresume_stats_rivals_lock' );
+
+        // The search of competitors (1.6.0) keeps each answer for 15 minutes:
+        // nothing worth keeping, so it goes even when the data is kept.
+        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- One-off bulk transient cleanup on uninstall; caching does not apply here.
+        $wpdb->query(
+                "DELETE FROM {$wpdb->options}
+                 WHERE option_name LIKE '\_transient\_cresume\_srch\_%'
+                 OR option_name LIKE '\_transient\_timeout\_cresume\_srch\_%'"
+        );
 
         // Respect the "keep settings and cached data" choice.

contributor-resume/trunk/assets/css/stats.css

@@ -1555 +1555 @@
 }
 
+/* The search to add a competitor (1.6.0) and the notice when the list is full. */
+
 .cresume-stats-rival-add {
+        margin-top: 16px;
+        padding-top: 16px;
+        border-top: 1px solid #f0f0f1;
+}
+
+.cresume-stats-rival-add h3 {
+        margin: 0 0 8px;
+}
+
+.cresume-stats-rival-search {
         display: flex;
         flex-wrap: wrap;
         align-items: center;
         gap: 8px 12px;
-        margin-top: 16px;
-        padding-top: 16px;
-        border-top: 1px solid #f0f0f1;
-}
-
-.cresume-stats-rival-add label[for] {
-        font-weight: 600;
-}
-
-.cresume-stats-rival-add .description {
+}
+
+.cresume-stats-rival-search label[for] {
+        font-weight: 600;
+}
+
+.cresume-stats-rival-search .description {
         flex-basis: 100%;
         margin: 0;
+}
+
+.cresume-stats-search-results[aria-busy="true"] {
+        opacity: 0.6;
+}
+
+.cresume-stats-search-none {
+        margin: 12px 0 0;
+}
+
+.cresume-stats-suggest-card img.cresume-stats-rival-icon {
+        object-fit: cover;
+}
+
+.cresume-stats-rivals h2 .cresume-stats-chip {
+        margin-left: 6px;
+        vertical-align: middle;
+}
+
+.cresume-stats-rival-full.notice {
+        margin: 16px 0 0;
+}
+
+.cresume-stats-rival-full-note {
+        margin: 8px 0 0;
 }
 

contributor-resume/trunk/assets/js/stats.js

@@ -12 +12 @@
  * value/max of the <progress> element and in numeric SVG attributes. The
  * keyword chips are drawn by core's tags box (wp-admin/js/tags-box.js), which
- * uses .text() for them.
+ * uses .text() for them. The one exception is the search of competitors
+ * (1.6.0): it inserts the results as the server drew and escaped them
+ * (Cresume_Stats_View::search_results()), the same HTML the page prints
+ * without JavaScript, and adds nothing of its own to it.
  */
 ( function () {
@@ -499 +502 @@
         }
 
+        /**
+         * Search WordPress.org while a competitor is typed (1.6.0). Without
+         * JavaScript the form is a GET of the same view and Enter shows the
+         * results; here the text is sent after a pause, an older request is
+         * cancelled, and Enter searches at once without leaving the page.
+         */
+        function initRivalSearch() {
+                var form = document.querySelector( '.cresume-stats-rival-search' );
+                var input = form ? form.querySelector( 'input[name="rq"]' ) : null;
+                var results = document.getElementById( 'cresume-stats-rival-results' );
+                var status = document.getElementById( 'cresume-stats-rival-status' );
+                var min;
+                var timer = null;
+                var controller = null;
+                var last;
+
+                if ( ! form || ! input || ! results || ! status || ! cfg.rivalNonce || ! window.fetch ) {
+                        return;
+                }
+
+                min = parseInt( form.getAttribute( 'data-min' ), 10 ) || 2;
+                last = input.value.trim();
+
+                function clear() {
+                        while ( results.firstChild ) {
+                                results.removeChild( results.firstChild );
+                        }
+                }
+
+                function run( text ) {
+                        var body;
+
+                        if ( controller ) {
+                                controller.abort();
+                                controller = null;
+                        }
+
+                        if ( text.length < min ) {
+                                clear();
+                                status.textContent = '';
+
+                                return;
+                        }
+
+                        body = new window.FormData();
+                        body.append( 'action', 'cresume_stats_rival_search' );
+                        body.append( 'nonce', cfg.rivalNonce );
+                        body.append( 'item', form.getAttribute( 'data-item' ) || '' );
+                        body.append( 'rq', text );
+
+                        controller = window.AbortController ? new window.AbortController() : null;
+                        status.textContent = i18n.searching || '';
+                        results.setAttribute( 'aria-busy', 'true' );
+
+                        window
+                                .fetch( cfg.ajaxUrl, {
+                                        method: 'POST',
+                                        credentials: 'same-origin',
+                                        body: body,
+                                        signal: controller ? controller.signal : undefined,
+                                } )
+                                .then( function ( response ) {
+                                        return response.json();
+                                } )
+                                .then( function ( data ) {
+                                        results.removeAttribute( 'aria-busy' );
+
+                                        if ( ! data || ! data.success || ! data.data ) {
+                                                status.textContent = data && data.data && data.data.message ? String( data.data.message ) : i18n.failed || '';
+
+                                                return;
+                                        }
+
+                                        // HTML drawn and escaped by Cresume_Stats_View::search_results().
+                                        results.innerHTML = String( data.data.html || '' );
+                                        status.textContent = String( data.data.status || '' );
+                                } )
+                                .catch( function ( error ) {
+                                        if ( error && 'AbortError' === error.name ) {
+                                                return;
+                                        }
+
+                                        results.removeAttribute( 'aria-busy' );
+                                        status.textContent = i18n.failed || '';
+                                } );
+                }
+
+                input.addEventListener( 'input', function () {
+                        var text = input.value.trim();
+
+                        window.clearTimeout( timer );
+
+                        if ( text === last ) {
+                                return;
+                        }
+
+                        last = text;
+                        timer = window.setTimeout( function () {
+                                run( text );
+                        }, 350 );
+                } );
+
+                form.addEventListener( 'submit', function ( event ) {
+                        event.preventDefault();
+                        window.clearTimeout( timer );
+                        last = input.value.trim();
+                        run( last );
+                } );
+        }
+
         initPrefs();
         initKeywordBox();
@@ -506 +619 @@
         initSwitcher();
         initScale();
+        initRivalSearch();
 }() );

contributor-resume/trunk/changelog.txt

@@ -5 +5 @@
 
 = 1.6.0 =
-* New: Competitor tracking. Choose up to 10 competitors for each plugin or theme, by slug or WordPress.org address, or from suggestions taken from your own keywords, each with the reason it is there. They are read every day like your own, with two years of download history from the first day. Market leaders are suggested apart: a leader is followed like the rest but not counted when comparing who ranks better.
+* New: Competitor tracking. Choose up to 10 competitors for each plugin or theme with a search of the directory by name or slug, with results as you type, or from suggestions taken from your own keywords, each with the reason it is there. They are read every day like your own, with two years of download history from the first day. Market leaders are suggested apart: a leader is followed like the rest but not counted when comparing who ranks better. When a plugin or theme has its 10, the screen says so and explains how to make room.
 * New: Competitors view in Stats. Five figures, a sortable head-to-head table, a keyword-by-keyword table that shows where you rank better, one downloads chart for all of them (on a logarithmic scale or as an index that starts everyone at 100), your share of the top 10 of your keywords and the opportunities it shows.
 * New: Competitor alerts, in the Alerts view and in the emails. A competitor passes you or falls behind, enters or leaves the top 10, ranks for one of your keywords for the first time, releases a version, says it is tested with a newer WordPress than yours, changes its installs range or rating, gets a spike in downloads without a release, goes 6 or 12 months without an update or is closed on WordPress.org.
@@ -16 +16 @@
 * Improved: On the page of each plugin or theme, the downloads chart is a box you can move, fold or hide like the others, next to active installs and at the same height. Translations and version adoption line up as well.
 * Improved: The stats tables are updated automatically to keep the competitors and their positions.
+* Improved: The dashboard widget settings ignore unexpected values without a PHP notice, and the rating bars are drawn empty when WordPress.org gives no breakdown of the ratings.
 
 = 1.5.4 =

contributor-resume/trunk/includes/stats/class-cresume-stats-admin.php

@@ -78 +78 @@
          * @var string[]
          */
-        const RIVAL_ERRORS = array( 'invalid', 'not_tracked', 'type', 'self', 'exists', 'full', 'missing', 'closed', 'unknown' );
+        const RIVAL_ERRORS = array( 'not_tracked', 'self', 'exists', 'full', 'missing', 'closed', 'unknown', 'not_suggested', 'busy' );
 
         /**
@@ -119 +119 @@
                 add_action( 'wp_ajax_cresume_stats_collect', array( $this, 'ajax_collect' ) );
                 add_action( 'wp_ajax_cresume_stats_status', array( $this, 'ajax_status' ) );
+                add_action( 'wp_ajax_cresume_stats_rival_search', array( $this, 'ajax_rival_search' ) );
                 add_filter( 'nonce_life', array( $this, 'view_nonce_life' ), 10, 2 );
         }
@@ -284 +285 @@
                         'paged'   => 1,
                         'ov'      => 'rivals',
+                        'rq'      => '',
                 );
         }
@@ -360 +362 @@
                 }
 
+                // The search of competitors without JavaScript (1.6.0): what was typed,
+                // shown back in the field and sent to WordPress.org. Never in a link or
+                // in the cookie: view_args() leaves it out.
+                if ( 'rivals' === $state['view'] && isset( $_GET['rq'] ) && is_string( $_GET['rq'] ) ) {
+                        $state['rq'] = self::search_text( sanitize_text_field( wp_unslash( $_GET['rq'] ) ) );
+                }
+
                 // The list of alerts: a topic of the closed list (anything else is all of
                 // them) and a page of 1 or more. Neither is remembered in the cookie.
@@ -716 +725 @@
                         'cresumeStats',
                         array(
-                                'ajaxUrl' => admin_url( 'admin-ajax.php' ),
-                                'nonce'   => wp_create_nonce( 'cresume_admin' ),
-                                'running' => Cresume_Stats_Collector::is_running() || Cresume_Stats_Peek::is_running(),
-                                'cookie'  => array(
+                                'ajaxUrl'    => admin_url( 'admin-ajax.php' ),
+                                'nonce'      => wp_create_nonce( 'cresume_admin' ),
+                                'running'    => Cresume_Stats_Collector::is_running() || Cresume_Stats_Peek::is_running(),
+                                'cookie'     => array(
                                         'name' => self::COOKIE,
                                         'path' => (string) wp_parse_url( admin_url(), PHP_URL_PATH ),
                                 ),
-                                'i18n'    => array(
-                                        'starting' => __( 'Starting…', 'contributor-resume' ),
-                                        'failed'   => __( 'Something went wrong. Try again.', 'contributor-resume' ),
-                                        'done'     => __( 'Collection finished.', 'contributor-resume' ),
+                                'rivalNonce' => 'rivals' === $state['view'] ? wp_create_nonce( 'cresume_stats_rival_search' ) : '',
+                                'i18n'       => array(
+                                        'starting'  => __( 'Starting…', 'contributor-resume' ),
+                                        'failed'    => __( 'Something went wrong. Try again.', 'contributor-resume' ),
+                                        'done'      => __( 'Collection finished.', 'contributor-resume' ),
+                                        'searching' => __( 'Searching WordPress.org…', 'contributor-resume' ),
                                 ),
                         )
                 );
+        }
+
+        /**
+         * Text of a search of competitors: trimmed, with its spaces collapsed and
+         * cut to Cresume_Stats_Fetcher::SEARCH_MAX characters.
+         *
+         * @param string $text Sanitized text.
+         * @return string
+         */
+        public static function search_text( $text ) {
+                $text = trim( preg_replace( '/\s+/u', ' ', (string) $text ) );
+
+                return mb_substr( $text, 0, Cresume_Stats_Fetcher::SEARCH_MAX, 'UTF-8' );
         }
 
@@ -1828 +1852 @@
                 $item = self::rival_item( isset( $_POST['item'] ) ? absint( $_POST['item'] ) : 0 );
 
-                // A slug or an address: wp_strip_all_tags() keeps the %XX octets that
-                // sanitize_text_field() would delete; parse_input() checks the rest.
-                $raw    = isset( $_POST['competitor'] ) && is_string( $_POST['competitor'] ) ? wp_strip_all_tags( wp_unslash( $_POST['competitor'] ) ) : '';
+                // The slug of a search result or a suggestion (1.6.0: nobody types it);
+                // add() checks it against Cresume_Stats_Rivals::SLUG_PATTERN.
+                $slug   = isset( $_POST['competitor'] ) && is_string( $_POST['competitor'] ) ? sanitize_text_field( wp_unslash( $_POST['competitor'] ) ) : '';
                 $leader = isset( $_POST['leader'] ) && '1' === sanitize_key( wp_unslash( $_POST['leader'] ) );
-                $result = Cresume_Stats_Rivals::add( (int) $item->type, (string) $item->slug, $raw, $leader );
+                $result = Cresume_Stats_Rivals::add( (int) $item->type, (string) $item->slug, $slug, $leader );
 
                 if ( is_wp_error( $result ) ) {
@@ -2040 +2064 @@
 
         /**
+         * The search of competitors as you type (1.6.0): the results for one own
+         * item, as HTML drawn and escaped by Cresume_Stats_View::search_results(),
+         * the same function that draws them without JavaScript. Nonce, capability,
+         * an own item the stats follow and a text of 2 to SEARCH_MAX characters;
+         * only the text travels to WordPress.org, encoded (query_url()).
+         */
+        public function ajax_rival_search() {
+                check_ajax_referer( 'cresume_stats_rival_search', 'nonce' );
+                $this->authorize();
+
+                if ( ! Cresume_Stats::enabled() || ! Cresume_Stats_Schema::is_current() ) {
+                        wp_send_json_error( array( 'message' => __( 'Stats are off or their tables are not ready.', 'contributor-resume' ) ), 400 );
+                }
+
+                $item_id = isset( $_POST['item'] ) ? absint( $_POST['item'] ) : 0;
+                $item    = $item_id ? Cresume_Stats_Store::item( $item_id ) : null;
+
+                if ( ! $item || 1 !== (int) $item->role ) {
+                        wp_send_json_error( array( 'message' => Cresume_Stats_Rivals::error( 'cresume_rival_not_tracked' )->get_error_message() ), 400 );
+                }
+
+                $text = isset( $_POST['rq'] ) && is_string( $_POST['rq'] ) ? self::search_text( sanitize_text_field( wp_unslash( $_POST['rq'] ) ) ) : '';
+
+                ob_start();
+                $status = Cresume_Stats_View::search_results( $item, $text );
+                $html   = ob_get_clean();
+
+                wp_send_json_success(
+                        array(
+                                'html'   => (string) $html,
+                                'status' => $status,
+                        )
+                );
+        }
+
+        /**
          * Stop unless the user may manage the site.
          */

contributor-resume/trunk/includes/stats/class-cresume-stats-cli.php

@@ -377 +377 @@
          *
          * <competitor>
-         * : Slug of the competitor, or its address on WordPress.org.
+         * : Slug of the competitor on WordPress.org.
          *
          * [--type=<type>]
@@ -391 +391 @@
          *
          *     wp cresume stats competitors add vigilante ninjafirewall
-         *     wp cresume stats competitors add vigilante https://wordpress.org/plugins/wordfence/ --leader
+         *     wp cresume stats competitors add vigilante wordfence --leader
          *
          * @param array $args       Positional args.
@@ -400 +400 @@
 
                 $type   = $this->type( $assoc_args );
-                $result = Cresume_Stats_Rivals::add( $type, sanitize_key( $args[0] ), $args[1], ! empty( $assoc_args['leader'] ) );
+                // A slug as typed in the terminal: trimmed and in lowercase, then checked by add().
+                $result = Cresume_Stats_Rivals::add( $type, sanitize_key( $args[0] ), strtolower( trim( (string) $args[1] ) ), ! empty( $assoc_args['leader'] ) );
 
                 if ( is_wp_error( $result ) ) {

contributor-resume/trunk/includes/stats/class-cresume-stats-fetcher.php

@@ -57 +57 @@
          */
         const INFO_MAX = 100;
+
+        /**
+         * Results of the search of competitors (1.6.0).
+         *
+         * @var int
+         */
+        const SEARCH_RESULTS = 10;
+
+        /**
+         * Characters a search of competitors needs before it asks WordPress.org.
+         *
+         * @var int
+         */
+        const SEARCH_MIN = 2;
+
+        /**
+         * Characters of a search of competitors, at most.
+         *
+         * @var int
+         */
+        const SEARCH_MAX = 100;
+
+        /**
+         * Seconds a search of competitors is kept.
+         *
+         * @var int
+         */
+        const SEARCH_CACHE = 900;
+
+        /**
+         * Prefix of the transients of the search of competitors. uninstall.php
+         * deletes them by this prefix, even when the data is kept.
+         *
+         * @var string
+         */
+        const SEARCH_PREFIX = 'cresume_srch_';
 
         /**
@@ -308 +344 @@
                 }
 
-                $icon = '';
-
-                if ( $is_theme ) {
-                        $icon = isset( $raw['screenshot_url'] ) ? (string) $raw['screenshot_url'] : '';
-
-                        // The Themes API returns protocol-relative screenshot URLs.
-                        if ( 0 === strpos( $icon, '//' ) ) {
-                                $icon = 'https:' . $icon;
-                        }
-                } elseif ( isset( $raw['icons'] ) && is_array( $raw['icons'] ) ) {
-                        foreach ( array( '2x', '1x', 'svg', 'default' ) as $size ) {
-                                if ( ! empty( $raw['icons'][ $size ] ) ) {
-                                        $icon = (string) $raw['icons'][ $size ];
-                                        break;
-                                }
-                        }
-                }
-
-                $icon = esc_url_raw( $icon, array( 'https' ) );
+                $icon = self::icon_of( $is_theme, $raw );
 
                 $updated = '';
@@ -338 +356 @@
                         'slug'    => $slug,
                         'name'    => self::clean_text( isset( $raw['name'] ) ? $raw['name'] : $slug, 255 ),
-                        'icon'    => strlen( $icon ) <= 255 ? $icon : '',
+                        'icon'    => $icon,
                         'added'   => self::clean_date( isset( $raw['added'] ) ? $raw['added'] : '' ),
                         'tags'    => $is_theme ? array() : self::clean_tags( isset( $raw['tags'] ) ? $raw['tags'] : array() ),
@@ -358 +376 @@
 
         /**
+         * The icon of a plugin, or the screenshot of a theme, as an https address
+         * of 255 characters at most, or ''.
+         *
+         * @param bool  $is_theme Whether it is a theme.
+         * @param array $raw      Raw API item.
+         * @return string
+         */
+        private static function icon_of( $is_theme, array $raw ) {
+                $icon = '';
+
+                if ( $is_theme ) {
+                        $icon = isset( $raw['screenshot_url'] ) && is_string( $raw['screenshot_url'] ) ? $raw['screenshot_url'] : '';
+
+                        // The Themes API returns protocol-relative screenshot URLs.
+                        if ( 0 === strpos( $icon, '//' ) ) {
+                                $icon = 'https:' . $icon;
+                        }
+                } elseif ( isset( $raw['icons'] ) && is_array( $raw['icons'] ) ) {
+                        foreach ( array( '2x', '1x', 'svg', 'default' ) as $size ) {
+                                if ( ! empty( $raw['icons'][ $size ] ) && is_string( $raw['icons'][ $size ] ) ) {
+                                        $icon = $raw['icons'][ $size ];
+                                        break;
+                                }
+                        }
+                }
+
+                $icon = esc_url_raw( $icon, array( 'https' ) );
+
+                return strlen( $icon ) <= 255 ? $icon : '';
+        }
+
+        /**
+         * Search the directory to add a competitor (1.6.0): what a person types,
+         * matched by WordPress.org against slugs and names, in the order of the web
+         * search. Measured on 7 Nov 2026: the slug comes first («wpo-tweaks» and
+         * «wpo tweaks» find WPO Tweaks, whose name is DietPress; «/vigilante/»
+         * finds Vigilant), so no lookup by slug is needed. Closed plugins never
+         * come back. About 5 KB for 10 results.
+         *
+         * The answer is kept SEARCH_CACHE seconds per type and text, so typing the
+         * same search again asks nothing.
+         *
+         * @param int    $type  Type constant.
+         * @param string $query Text typed, already trimmed and cut to SEARCH_MAX.
+         * @return array|WP_Error ['results' => int, 'list' => [['slug', 'name',
+         *                        'icon', 'installs', 'rating', 'num_ratings'], …]].
+         */
+        public function search( $type, $query ) {
+                $type  = Cresume_Stats_Store::TYPE_THEME === (int) $type ? Cresume_Stats_Store::TYPE_THEME : Cresume_Stats_Store::TYPE_PLUGIN;
+                $query = (string) $query;
+                $key   = self::SEARCH_PREFIX . md5( $type . '|' . mb_strtolower( $query, 'UTF-8' ) );
+                $kept  = get_transient( $key );
+
+                if ( is_array( $kept ) && isset( $kept['results'], $kept['list'] ) ) {
+                        return $kept;
+                }
+
+                $is_theme = Cresume_Stats_Store::TYPE_THEME === $type;
+                $args     = array(
+                        'action'            => $is_theme ? 'query_themes' : 'query_plugins',
+                        // Encoded here: add_query_arg() does not encode values (see query_url()).
+                        'request[search]'   => rawurlencode( $query ),
+                        'request[per_page]' => self::SEARCH_RESULTS,
+                        'request[page]'     => 1,
+                );
+
+                foreach ( self::search_fields( $type ) as $field => $on ) {
+                        $args[ 'request[fields][' . $field . ']' ] = $on;
+                }
+
+                $data = $this->get_json( add_query_arg( $args, $is_theme ? self::THEMES_API : self::PLUGINS_API ) );
+
+                if ( is_wp_error( $data ) ) {
+                        return $data;
+                }
+
+                $list_key = $is_theme ? 'themes' : 'plugins';
+
+                if ( ! is_array( $data ) || ! isset( $data[ $list_key ], $data['info'] ) || ! is_array( $data[ $list_key ] ) ) {
+                        return self::bad_payload();
+                }
+
+                $list = array();
+
+                foreach ( $data[ $list_key ] as $row ) {
+                        $slug = is_array( $row ) && isset( $row['slug'] ) && is_string( $row['slug'] ) ? $row['slug'] : '';
+
+                        if ( ! preg_match( '/^[a-z0-9-]{1,191}$/', $slug ) || isset( $list[ $slug ] ) ) {
+                                continue;
+                        }
+
+                        $list[ $slug ] = array(
+                                'slug'        => $slug,
+                                'name'        => self::clean_text( isset( $row['name'] ) && is_scalar( $row['name'] ) ? $row['name'] : $slug, 120 ),
+                                'icon'        => self::icon_of( $is_theme, $row ),
+                                'installs'    => isset( $row['active_installs'] ) ? absint( $row['active_installs'] ) : 0,
+                                'rating'      => isset( $row['rating'] ) ? min( 100, absint( $row['rating'] ) ) : 0,
+                                'num_ratings' => isset( $row['num_ratings'] ) ? absint( $row['num_ratings'] ) : 0,
+                        );
+
+                        if ( count( $list ) >= self::SEARCH_RESULTS ) {
+                                break;
+                        }
+                }
+
+                $out = array(
+                        'results' => isset( $data['info']['results'] ) ? absint( $data['info']['results'] ) : count( $list ),
+                        'list'    => array_values( $list ),
+                );
+
+                set_transient( $key, $out, self::SEARCH_CACHE );
+
+                return $out;
+        }
+
+        /**
+         * Fields asked for in the search of competitors: what a result shows.
+         *
+         * @param int $type Type constant.
+         * @return array
+         */
+        private static function search_fields( $type ) {
+                if ( Cresume_Stats_Store::TYPE_THEME === (int) $type ) {
+                        return array(
+                                'active_installs' => 1,
+                                'rating'          => 1,
+                                'num_ratings'     => 1,
+                                'screenshot_url'  => 1,
+                                'description'     => 0,
+                                'sections'        => 0,
+                                'ratings'         => 0,
+                                'downloaded'      => 0,
+                                'last_updated'    => 0,
+                                'homepage'        => 0,
+                                'tags'            => 0,
+                                'versions'        => 0,
+                                'theme_url'       => 0,
+                        );
+                }
+
+                return array(
+                        'active_installs'   => 1,
+                        'rating'            => 1,
+                        'num_ratings'       => 1,
+                        'icons'             => 1,
+                        'short_description' => 0,
+                        'description'       => 0,
+                        'sections'          => 0,
+                        'tags'              => 0,
+                        'versions'          => 0,
+                        'contributors'      => 0,
+                        'screenshots'       => 0,
+                        'banners'           => 0,
+                        'compatibility'     => 0,
+                        'reviews'           => 0,
+                        'ratings'           => 0,
+                        'downloaded'        => 0,
+                        'last_updated'      => 0,
+                        'added'             => 0,
+                        'homepage'          => 0,
+                        'donate_link'       => 0,
+                        'tested'            => 0,
+                        'requires'          => 0,
+                        'requires_php'      => 0,
+                );
+        }
+
+        /**
          * Daily downloads, oldest first, up to yesterday (UTC).
          *

contributor-resume/trunk/includes/stats/class-cresume-stats-lock.php

@@ -108 +108 @@
 
         /**
-         * Drop what the options cache may remember about the lock.
+         * Drop what the options cache may remember about an option: the lock, or
+         * (1.6.0) the option a lock guards, so it is read from the database once
+         * the lock is taken.
          *
          * @param string $name Option name.
          */
-        private static function forget( $name ) {
+        public static function forget( $name ) {
                 wp_cache_delete( $name, 'options' );
 

contributor-resume/trunk/includes/stats/class-cresume-stats-rivals.php

@@ -90 +90 @@
 
         /**
+         * Lock of the choice (1.6.0): a row of its own in the options table, taken
+         * with Cresume_Stats_Lock. Deleted by uninstall.php.
+         *
+         * @var string
+         */
+        const LOCK_OPTION = 'cresume_stats_rivals_lock';
+
+        /**
+         * Seconds the lock outlives a request that died holding it.
+         *
+         * @var int
+         */
+        const LOCK_TTL = 30;
+
+        /**
+         * Seconds a change waits for another one in progress.
+         *
+         * @var int
+         */
+        const LOCK_WAIT = 2;
+
+        /**
          * Key of an own item.
          *
@@ -594 +616 @@
 
         /**
-         * Read what the user typed: a slug, or the address of a plugin or theme on
-         * WordPress.org (any locale subdomain, with or without scheme, `www.`,
-         * trailing slash, query or fragment).
-         *
-         * The address goes through esc_url_raw() (never sanitize_text_field(),
-         * which deletes the %XX octets) and its path is cut by hand; the slug that
-         * comes out must match SLUG_PATTERN, so nothing else reaches the API.
-         *
-         * @param mixed $raw Text typed by the user.
-         * @return array|WP_Error ['slug' => string, 'type' => int], type 0 when a bare
-         *                        slug does not say whether it is a plugin or a theme.
-         */
-        public static function parse_input( $raw ) {
-                if ( ! is_string( $raw ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $raw = trim( $raw );
-
-                if ( '' === $raw || strlen( $raw ) > 500 ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $slug = strtolower( $raw );
-
-                if ( preg_match( self::SLUG_PATTERN, $slug ) ) {
-                        return array(
-                                'slug' => $slug,
-                                'type' => 0,
-                        );
-                }
-
-                $url = esc_url_raw( $raw, array( 'http', 'https' ) );
-
-                if ( '' === $url || ! preg_match( '#^https?://(?:[a-z0-9-]+\.)?wordpress\.org(/[^?\#]*)?(?:[?\#].*)?$#i', $url, $match ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $path = isset( $match[1] ) ? $match[1] : '';
-
-                if ( ! preg_match( '#^/(plugins|themes)/([^/]+)/?$#i', $path, $parts ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $slug = strtolower( rawurldecode( $parts[2] ) );
-
-                if ( ! preg_match( self::SLUG_PATTERN, $slug ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                return array(
-                        'slug' => $slug,
-                        'type' => 'themes' === strtolower( $parts[1] ) ? Cresume_Stats_Store::TYPE_THEME : Cresume_Stats_Store::TYPE_PLUGIN,
-                );
-        }
-
-        /**
          * Add a competitor to an own item, checked against WordPress.org.
+         *
+         * The slug comes from a result of the search, a suggestion or WP-CLI, never
+         * typed in a field (1.6.0: the field for a slug or an address is gone), so it
+         * is only checked against SLUG_PATTERN. What can be decided without asking
+         * WordPress.org is decided first, and checked again under the lock before
+         * saving.
          *
          * @param int    $type     Type constant of the own item.
          * @param string $own_slug Slug of the own item.
-         * @param mixed  $input    Slug or address typed by the user.
+         * @param mixed  $slug     Slug of the competitor.
          * @param bool   $leader   Whether it is added as a leader.
          * @return array|WP_Error ['slug' => string, 'info' => array] with the answer of
@@ -661 +632 @@
          *                        Cresume_Stats_Collector::rival_now().
          */
-        public static function add( $type, $own_slug, $input, $leader = false ) {
+        public static function add( $type, $own_slug, $slug, $leader = false ) {
                 $type = Cresume_Stats_Store::TYPE_THEME === (int) $type ? Cresume_Stats_Store::TYPE_THEME : Cresume_Stats_Store::TYPE_PLUGIN;
                 $own  = self::tracked( $type, $own_slug );
@@ -669 +640 @@
                 }
 
-                $parsed = self::parse_input( $input );
-
-                if ( is_wp_error( $parsed ) ) {
-                        return $parsed;
-                }
-
-                if ( $parsed['type'] && $parsed['type'] !== $type ) {
-                        return self::error( 'cresume_rival_type' );
-                }
-
-                $slug = $parsed['slug'];
+                if ( ! is_string( $slug ) || ! preg_match( self::SLUG_PATTERN, $slug ) ) {
+                        return self::error( 'cresume_rival_missing' );
+                }
 
                 if ( $slug === (string) $own->slug ) {
@@ -685 +648 @@
                 }
 
-                $all  = self::all();
-                $key  = self::key( $type, $own->slug );
-                $mine = isset( $all[ $key ] ) ? $all[ $key ] : array(
-                        'r' => array(),
-                        'l' => array(),
-                        'h' => array(),
-                );
+                $mine = self::of( $type, $own->slug );
 
                 if ( in_array( $slug, $mine['r'], true ) ) {
@@ -717 +674 @@
                 }
 
-                $mine['r'][] = $slug;
-
-                if ( $leader ) {
-                        $mine['l'][] = $slug;
-                }
-
-                $mine['h']   = array_values( array_diff( $mine['h'], array( $slug ) ) );
-                $all[ $key ] = $mine;
-                self::save( $all );
+                $key   = self::key( $type, $own->slug );
+                $saved = self::locked(
+                        function () use ( $key, $slug, $leader ) {
+                                $all  = self::all();
+                                $mine = isset( $all[ $key ] ) ? $all[ $key ] : self::blank();
+
+                                // Another administrator may have added it, or filled the list, meanwhile.
+                                if ( in_array( $slug, $mine['r'], true ) ) {
+                                        return self::error( 'cresume_rival_exists' );
+                                }
+
+                                if ( count( $mine['r'] ) >= self::MAX_PER_ITEM ) {
+                                        return self::error( 'cresume_rival_full' );
+                                }
+
+                                $mine['r'][] = $slug;
+
+                                if ( $leader ) {
+                                        $mine['l'][] = $slug;
+                                }
+
+                                $mine['h']   = array_values( array_diff( $mine['h'], array( $slug ) ) );
+                                $all[ $key ] = $mine;
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
+
+                if ( is_wp_error( $saved ) ) {
+                        return $saved;
+                }
 
                 return array(
@@ -743 +723 @@
          */
         public static function remove( $type, $own_slug, $slug ) {
-                $all = self::all();
-                $key = self::key( $type, $own_slug );
-
-                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['r'], true ) ) {
-                        return self::error( 'cresume_rival_unknown' );
-                }
-
-                $all[ $key ]['r'] = array_values( array_diff( $all[ $key ]['r'], array( $slug ) ) );
-                $all[ $key ]['l'] = array_values( array_diff( $all[ $key ]['l'], array( $slug ) ) );
-                self::save( $all );
+                $key   = self::key( $type, $own_slug );
+                $saved = self::locked(
+                        function () use ( $key, $slug ) {
+                                $all = self::all();
+
+                                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['r'], true ) ) {
+                                        return self::error( 'cresume_rival_unknown' );
+                                }
+
+                                $all[ $key ]['r'] = array_values( array_diff( $all[ $key ]['r'], array( $slug ) ) );
+                                $all[ $key ]['l'] = array_values( array_diff( $all[ $key ]['l'], array( $slug ) ) );
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
+
+                if ( is_wp_error( $saved ) ) {
+                        return $saved;
+                }
+
                 self::release_unused();
                 Cresume_Stats_Store::touch();
@@ -760 +751 @@
 
         /**
-         * Hide a suggestion for an own item.
+         * Hide a suggestion for an own item. Only one of the suggestions it has now
+         * (1.6.0): a forged slug that nothing suggests is not stored.
          *
          * @param int    $type     Type constant.
@@ -768 +760 @@
          */
         public static function hide( $type, $own_slug, $slug ) {
-                if ( ! is_string( $slug ) || ! preg_match( self::SLUG_PATTERN, $slug ) ) {
-                        return self::error( 'cresume_rival_invalid' );
-                }
-
-                $all = self::all();
-                $key = self::key( $type, $own_slug );
-
-                if ( ! self::tracked( $type, $own_slug ) ) {
+                $own = self::tracked( $type, $own_slug );
+
+                if ( ! $own ) {
                         return self::error( 'cresume_rival_not_tracked' );
                 }
 
-                $mine = isset( $all[ $key ] ) ? $all[ $key ] : array(
-                        'r' => array(),
-                        'l' => array(),
-                        'h' => array(),
-                );
-
-                if ( in_array( $slug, $mine['r'], true ) ) {
+                $key = self::key( $type, $own->slug );
+
+                if ( is_string( $slug ) && in_array( $slug, self::of( $type, $own->slug )['r'], true ) ) {
                         return self::error( 'cresume_rival_exists' );
                 }
 
-                if ( ! in_array( $slug, $mine['h'], true ) ) {
-                        array_unshift( $mine['h'], $slug );
-                        $mine['h'] = array_slice( $mine['h'], 0, self::MAX_HIDDEN );
-                }
-
-                $all[ $key ] = $mine;
-                self::save( $all );
-
-                return true;
+                if ( ! is_string( $slug ) || ! preg_match( self::SLUG_PATTERN, $slug ) || ! in_array( $slug, self::suggested( (int) $own->id ), true ) ) {
+                        return self::error( 'cresume_rival_not_suggested' );
+                }
+
+                return self::locked(
+                        function () use ( $key, $slug ) {
+                                $all  = self::all();
+                                $mine = isset( $all[ $key ] ) ? $all[ $key ] : self::blank();
+
+                                if ( in_array( $slug, $mine['r'], true ) ) {
+                                        return self::error( 'cresume_rival_exists' );
+                                }
+
+                                if ( ! in_array( $slug, $mine['h'], true ) ) {
+                                        array_unshift( $mine['h'], $slug );
+                                        $mine['h'] = array_slice( $mine['h'], 0, self::MAX_HIDDEN );
+                                }
+
+                                $all[ $key ] = $mine;
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
+        }
+
+        /**
+         * Slugs suggested now for an own item, leaders included: what hide() takes.
+         *
+         * @param int $item_id Own item id.
+         * @return string[]
+         */
+        private static function suggested( $item_id ) {
+                $suggest = self::suggest( $item_id );
+                $slugs   = array();
+
+                foreach ( array_merge( $suggest['list'], $suggest['leaders'] ) as $cand ) {
+                        $slugs[] = (string) $cand['slug'];
+                }
+
+                return $slugs;
         }
 
@@ -809 +824 @@
          */
         public static function unhide( $type, $own_slug, $slug ) {
-                $all = self::all();
                 $key = self::key( $type, $own_slug );
 
-                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['h'], true ) ) {
-                        return self::error( 'cresume_rival_unknown' );
-                }
-
-                $all[ $key ]['h'] = array_values( array_diff( $all[ $key ]['h'], array( $slug ) ) );
-                self::save( $all );
-
-                return true;
+                return self::locked(
+                        function () use ( $key, $slug ) {
+                                $all = self::all();
+
+                                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['h'], true ) ) {
+                                        return self::error( 'cresume_rival_unknown' );
+                                }
+
+                                $all[ $key ]['h'] = array_values( array_diff( $all[ $key ]['h'], array( $slug ) ) );
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
         }
 
@@ -833 +853 @@
          */
         public static function set_leader( $type, $own_slug, $slug, $leader ) {
-                $all = self::all();
                 $key = self::key( $type, $own_slug );
 
-                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['r'], true ) ) {
-                        return self::error( 'cresume_rival_unknown' );
-                }
-
-                $l = array_values( array_diff( $all[ $key ]['l'], array( $slug ) ) );
-
-                if ( $leader ) {
-                        $l[] = $slug;
-                }
-
-                $all[ $key ]['l'] = $l;
-                self::save( $all );
-
-                return true;
+                return self::locked(
+                        function () use ( $key, $slug, $leader ) {
+                                $all = self::all();
+
+                                if ( ! isset( $all[ $key ] ) || ! in_array( $slug, $all[ $key ]['r'], true ) ) {
+                                        return self::error( 'cresume_rival_unknown' );
+                                }
+
+                                $l = array_values( array_diff( $all[ $key ]['l'], array( $slug ) ) );
+
+                                if ( $leader ) {
+                                        $l[] = $slug;
+                                }
+
+                                $all[ $key ]['l'] = $l;
+                                self::save( $all );
+
+                                return true;
+                        }
+                );
+        }
+
+        /**
+         * Run a change of the choice under its lock (1.6.0), with the option read
+         * again from the database. Two administrators saving at the same time no
+         * longer lose one of the changes (informative of the level 2 review of
+         * 1.6.0). It waits up to LOCK_WAIT seconds for a change in progress; the
+         * lock is the one of Cresume_Stats_Lock, with its expiry for a worker that
+         * died holding it.
+         *
+         * @param callable $change Reads all(), changes it and saves it; returns true or a WP_Error.
+         * @return true|WP_Error
+         */
+        private static function locked( callable $change ) {
+                $until = microtime( true ) + self::LOCK_WAIT;
+                $token = Cresume_Stats_Lock::acquire( self::LOCK_OPTION, self::LOCK_TTL );
+
+                while ( false === $token ) {
+                        if ( microtime( true ) >= $until ) {
+                                return self::error( 'cresume_rival_busy' );
+                        }
+
+                        usleep( 100000 );
+                        $token = Cresume_Stats_Lock::acquire( self::LOCK_OPTION, self::LOCK_TTL );
+                }
+
+                // What this request read before taking the lock may be behind.
+                Cresume_Stats_Lock::forget( self::OPTION );
+
+                try {
+                        return $change();
+                } finally {
+                        Cresume_Stats_Lock::release( self::LOCK_OPTION, $token );
+                }
+        }
+
+        /**
+         * An empty choice for one own item.
+         *
+         * @return array ['r' => [], 'l' => [], 'h' => []].
+         */
+        private static function blank() {
+                return array(
+                        'r' => array(),
+                        'l' => array(),
+                        'h' => array(),
+                );
         }
 
@@ -936 +1008 @@
         public static function error( $code ) {
                 $messages = array(
-                        'cresume_rival_invalid'     => __( 'Type the slug of a plugin or theme, or its address on WordPress.org.', 'contributor-resume' ),
-                        'cresume_rival_not_tracked' => __( 'That plugin or theme is not one of the ones the stats follow.', 'contributor-resume' ),
-                        'cresume_rival_type'        => __( 'A plugin can only compete with plugins, and a theme with themes.', 'contributor-resume' ),
-                        'cresume_rival_self'        => __( 'A plugin or theme cannot be its own competitor.', 'contributor-resume' ),
+                        'cresume_rival_not_tracked'   => __( 'That plugin or theme is not one of the ones the stats follow.', 'contributor-resume' ),
+                        'cresume_rival_self'          => __( 'A plugin or theme cannot be its own competitor.', 'contributor-resume' ),
+                        'cresume_rival_not_suggested' => __( 'That plugin or theme is not among the suggestions any more.', 'contributor-resume' ),
+                        'cresume_rival_busy'          => __( 'Someone else is changing these competitors right now. Try again in a moment.', 'contributor-resume' ),
                         'cresume_rival_exists'      => __( 'It is already one of its competitors.', 'contributor-resume' ),
                         /* translators: %d: maximum number of competitors */

contributor-resume/trunk/includes/stats/class-cresume-stats-view.php

@@ -994 +994 @@
                 }
 
-                $max = max( 1, max( array_map( 'intval', $item['ratings'] ) ) );
+                // max() of an empty array throws ValueError in PHP 8 (1.6.0): with
+                // num_ratings above zero and no breakdown, the bars are drawn empty.
+                $counts = is_array( $item['ratings'] ) ? array_map( 'intval', $item['ratings'] ) : array();
+                $max    = $counts ? max( 1, max( $counts ) ) : 1;
                 ?>
                 <ul class="cresume-stats-bars">
@@ -1743 +1746 @@
                 $add     = wp_create_nonce( 'cresume_stats_rival_add' );
                 $hide    = wp_create_nonce( 'cresume_stats_rival_hide' );
+                $max     = number_format_i18n( Cresume_Stats_Rivals::MAX_PER_ITEM );
                 ?>
                 <section class="cresume-card cresume-stats-rivals">
@@ -1754 +1758 @@
                                                 <?php
                                                 /* translators: 1: competitors chosen, 2: maximum */
-                                                echo esc_html( sprintf( __( '%1$s of %2$s · read every day, like your own', 'contributor-resume' ), number_format_i18n( count( $rows ) ), number_format_i18n( Cresume_Stats_Rivals::MAX_PER_ITEM ) ) );
+                                                echo esc_html( sprintf( __( '%1$s of %2$s · read every day, like your own', 'contributor-resume' ), number_format_i18n( count( $rows ) ), $max ) );
                                                 ?>
                                         </span>
+                                        <?php if ( $full ) : ?>
+                                                <span class="cresume-stats-chip cresume-stats-chip--warn"><?php esc_html_e( 'Full', 'contributor-resume' ); ?></span>
+                                        <?php endif; ?>
                                 </h2>
                                 <a class="button" href="<?php echo esc_url( $back ); ?>"><?php esc_html_e( 'Back to Competitors', 'contributor-resume' ); ?></a>
@@ -1764 +1771 @@
                                 <?php self::rival_list( $rows, $item, true ); ?>
                         <?php else : ?>
-                                <p class="cresume-stats-intro"><?php esc_html_e( 'No competitors yet. Pick from the suggestions below, or add any plugin by its slug or its address on WordPress.org.', 'contributor-resume' ); ?></p>
+                                <p class="cresume-stats-intro"><?php esc_html_e( 'No competitors yet. Search for them below, or pick from the suggestions.', 'contributor-resume' ); ?></p>
                         <?php endif; ?>
 
-                        <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="cresume-stats-rival-add">
-                                <input type="hidden" name="action" value="cresume_stats_rival_add" />
-                                <input type="hidden" name="item" value="<?php echo esc_attr( $item->id ); ?>" />
-                                <input type="hidden" name="_wpnonce" value="<?php echo esc_attr( $add ); ?>" />
-                                <label for="cresume-stats-rival-input"><?php esc_html_e( 'Add a competitor', 'contributor-resume' ); ?></label>
-                                <input type="text" id="cresume-stats-rival-input" name="competitor" class="regular-text" placeholder="<?php echo esc_attr( Cresume_Stats_Store::TYPE_THEME === $type ? 'astra  ·  https://wordpress.org/themes/astra/' : 'ninjafirewall  ·  https://wordpress.org/plugins/ninjafirewall/' ); ?>" aria-describedby="cresume-stats-rival-help"<?php disabled( $full ); ?> />
-                                <label class="cresume-inline"><input type="checkbox" name="leader" value="1"<?php disabled( $full ); ?> /> <?php esc_html_e( 'As a leader', 'contributor-resume' ); ?></label>
-                                <?php submit_button( __( 'Add competitor', 'contributor-resume' ), 'primary', 'submit', false, $full ? array( 'disabled' => 'disabled' ) : array() ); ?>
-                                <p class="description" id="cresume-stats-rival-help">
-                                        <?php
-                                        if ( $full ) {
+                        <?php if ( $full ) : ?>
+                                <div class="notice notice-warning inline cresume-stats-rival-full">
+                                        <p>
+                                                <strong><?php esc_html_e( 'No room for more competitors.', 'contributor-resume' ); ?></strong>
+                                                <?php
                                                 /* translators: %s: maximum number of competitors */
-                                                echo esc_html( sprintf( __( 'Each plugin or theme can have up to %s competitors. Remove one to add another.', 'contributor-resume' ), number_format_i18n( Cresume_Stats_Rivals::MAX_PER_ITEM ) ) );
-                                        } else {
-                                                esc_html_e( 'Its slug or its address on WordPress.org. It is checked there before it is added. A leader is read like the rest, but it is not counted when comparing who ranks better.', 'contributor-resume' );
-                                        }
-                                        ?>
-                                </p>
-                        </form>
+                                                echo esc_html( sprintf( __( 'Each plugin or theme can have up to %s competitors. Remove one to add another.', 'contributor-resume' ), $max ) );
+                                                ?>
+                                        </p>
+                                </div>
+                        <?php else : ?>
+                                <?php self::search_form( $state, $item ); ?>
+                        <?php endif; ?>
                 </section>
 
@@ -1798 +1799 @@
                                 </span>
                         </h2>
+
+                        <?php if ( $full && ( $suggest['list'] || $suggest['leaders'] ) ) : ?>
+                                <p class="description cresume-stats-rival-full-note"><?php esc_html_e( 'The list of competitors is full: remove one to add a suggestion.', 'contributor-resume' ); ?></p>
+                        <?php endif; ?>
 
                         <?php if ( ! $suggest['of'] ) : ?>
@@ -1849 +1854 @@
                         <?php endif; ?>
                 </section>
+                <?php
+        }
+
+        /**
+         * The search to add a competitor (1.6.0): a GET form of the same view, so
+         * Enter works without JavaScript, with the results of `rq` drawn below.
+         * stats.js searches as the text changes and puts its results in the same
+         * place. A leader is marked afterwards, in the list.
+         *
+         * @param array  $state View state.
+         * @param object $item  Own item row.
+         */
+        private static function search_form( array $state, $item ) {
+                $is_theme = Cresume_Stats_Store::TYPE_THEME === (int) $item->type;
+                $args     = Cresume_Stats_Admin::view_args( array_merge( $state, array( 'orderby' => '', 'order' => '' ) ) );
+                ?>
+                <div class="cresume-stats-rival-add">
+                        <h3><?php esc_html_e( 'Add a competitor', 'contributor-resume' ); ?></h3>
+                        <form method="get" action="<?php echo esc_url( admin_url( 'options-general.php' ) ); ?>" class="cresume-stats-rival-search" role="search" data-item="<?php echo esc_attr( (string) (int) $item->id ); ?>" data-min="<?php echo esc_attr( (string) Cresume_Stats_Fetcher::SEARCH_MIN ); ?>">
+                                <?php foreach ( $args as $name => $value ) : ?>
+                                        <input type="hidden" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( (string) $value ); ?>" />
+                                <?php endforeach; ?>
+                                <label for="cresume-stats-rival-input"><?php echo $is_theme ? esc_html__( 'Search for a theme', 'contributor-resume' ) : esc_html__( 'Search for a plugin', 'contributor-resume' ); ?></label>
+                                <input type="search" id="cresume-stats-rival-input" name="rq" value="<?php echo esc_attr( $state['rq'] ); ?>" class="regular-text" maxlength="<?php echo esc_attr( (string) Cresume_Stats_Fetcher::SEARCH_MAX ); ?>" autocomplete="off" spellcheck="false" aria-describedby="cresume-stats-rival-help" aria-controls="cresume-stats-rival-results" />
+                                <button type="submit" class="button"><?php esc_html_e( 'Search', 'contributor-resume' ); ?></button>
+                                <p class="description" id="cresume-stats-rival-help"><?php esc_html_e( 'By name or slug, as in the WordPress.org directory. Results appear as you type. A leader is marked afterwards, in the list.', 'contributor-resume' ); ?></p>
+                        </form>
+                        <div id="cresume-stats-rival-results" class="cresume-stats-search-results">
+                                <?php $status = '' !== $state['rq'] ? self::search_results( $item, $state['rq'] ) : ''; ?>
+                        </div>
+                        <p id="cresume-stats-rival-status" class="screen-reader-text" role="status"><?php echo esc_html( $status ); ?></p>
+                </div>
+                <?php
+        }
+
+        /**
+         * Results of the search of competitors (1.6.0), drawn here both for the
+         * search as you type (Cresume_Stats_Admin::ajax_rival_search()) and for the
+         * one sent with Enter. Names and icons come from WordPress.org: every value
+         * is escaped here, and stats.js only inserts this HTML.
+         *
+         * @param object $item Own item row.
+         * @param string $text Text searched (Cresume_Stats_Admin::search_text()).
+         * @return string What screen readers hear: how many results, or why none.
+         */
+        public static function search_results( $item, $text ) {
+                $text = (string) $text;
+
+                if ( mb_strlen( $text, 'UTF-8' ) < Cresume_Stats_Fetcher::SEARCH_MIN ) {
+                        return '';
+                }
+
+                $type     = (int) $item->type;
+                $is_theme = Cresume_Stats_Store::TYPE_THEME === $type;
+                $fetcher  = new Cresume_Stats_Fetcher();
+                $answer   = $fetcher->search( $type, $text );
+
+                if ( is_wp_error( $answer ) ) {
+                        $message = __( 'WordPress.org did not answer. Try again in a minute.', 'contributor-resume' );
+                        echo '<p class="cresume-stats-search-none">' . esc_html( $message ) . '</p>';
+
+                        return $message;
+                }
+
+                if ( ! $answer['list'] ) {
+                        $message = $is_theme
+                                /* translators: %s: text searched */
+                                ? sprintf( __( 'No themes found for “%s”.', 'contributor-resume' ), $text )
+                                /* translators: %s: text searched */
+                                : sprintf( __( 'No plugins found for “%s”.', 'contributor-resume' ), $text );
+                        echo '<p class="cresume-stats-search-none">' . esc_html( $message ) . '</p>';
+
+                        return $message;
+                }
+
+                $choice = Cresume_Stats_Rivals::of( $type, $item->slug );
+                $full   = count( $choice['r'] ) >= Cresume_Stats_Rivals::MAX_PER_ITEM;
+                $known  = Cresume_Stats_Store::known_items_by_slug( $type );
+                $add    = wp_create_nonce( 'cresume_stats_rival_add' );
+                ?>
+                <ul class="cresume-stats-suggest-grid" role="list">
+                        <?php
+                        foreach ( $answer['list'] as $row ) {
+                                self::search_result( $row, $item, $choice['r'], $known, $full, $add );
+                        }
+                        ?>
+                </ul>
+                <?php
+                /* translators: %s: number of results */
+                return sprintf( _n( '%s result', '%s results', count( $answer['list'] ), 'contributor-resume' ), number_format_i18n( count( $answer['list'] ) ) );
+        }
+
+        /**
+         * One result of the search: who it is and, when it can be one, a button
+         * that adds it as a competitor.
+         *
+         * @param array    $row    Row of Cresume_Stats_Fetcher::search().
+         * @param object   $item   Own item row.
+         * @param string[] $chosen Slugs of its competitors.
+         * @param array    $known  Cresume_Stats_Store::known_items_by_slug().
+         * @param bool     $full   Whether the item has no room for more.
+         * @param string   $add    Nonce of the add handler.
+         */
+        private static function search_result( array $row, $item, array $chosen, array $known, $full, $add ) {
+                $is_theme = Cresume_Stats_Store::TYPE_THEME === (int) $item->type;
+                $slug     = (string) $row['slug'];
+                $name     = '' !== $row['name'] ? Cresume_Stats_Query::short_name( $row['name'] ) : $slug;
+                $self     = $slug === (string) $item->slug;
+                $taken    = in_array( $slug, $chosen, true );
+                $own      = ! $self && isset( $known[ $slug ] ) && 1 === $known[ $slug ][1];
+
+                /* translators: 1: slug, 2: active installs */
+                $meta = sprintf( __( '%1$s · %2$s+ installs', 'contributor-resume' ), $slug, number_format_i18n( (int) $row['installs'] ) );
+                ?>
+                <li class="cresume-stats-suggest-card">
+                        <?php self::rival_icon( (string) $row['icon'], $name ); ?>
+                        <div class="cresume-stats-suggest-body">
+                                <a href="<?php echo esc_url( 'https://wordpress.org/' . ( $is_theme ? 'themes' : 'plugins' ) . '/' . rawurlencode( $slug ) . '/' ); ?>" target="_blank" rel="noopener noreferrer"><strong><?php echo esc_html( $name ); ?></strong><span class="screen-reader-text"> <?php esc_html_e( '(opens in a new tab)', 'contributor-resume' ); ?></span></a>
+                                <span class="cresume-stats-sub">
+                                        <?php echo esc_html( $meta ); ?>
+                                        <?php if ( (int) $row['num_ratings'] > 0 ) : ?>
+                                                · <?php echo esc_html( number_format_i18n( (int) $row['rating'] / 20, 1 ) ); ?> ★ (<?php echo esc_html( number_format_i18n( (int) $row['num_ratings'] ) ); ?>)
+                                        <?php endif; ?>
+                                </span>
+                                <?php if ( $self || $taken || $own ) : ?>
+                                        <span class="cresume-stats-reasons">
+                                                <?php if ( $self ) : ?>
+                                                        <span class="cresume-stats-chip"><?php echo $is_theme ? esc_html__( 'This theme', 'contributor-resume' ) : esc_html__( 'This plugin', 'contributor-resume' ); ?></span>
+                                                <?php elseif ( $taken ) : ?>
+                                                        <span class="cresume-stats-chip cresume-stats-chip--info"><?php esc_html_e( 'Already a competitor', 'contributor-resume' ); ?></span>
+                                                <?php else : ?>
+                                                        <span class="cresume-stats-chip"><?php esc_html_e( 'Yours', 'contributor-resume' ); ?></span>
+                                                <?php endif; ?>
+                                        </span>
+                                <?php endif; ?>
+                        </div>
+                        <?php if ( ! $self && ! $taken ) : ?>
+                                <div class="cresume-stats-suggest-actions">
+                                        <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
+                                                <input type="hidden" name="action" value="cresume_stats_rival_add" />
+                                                <input type="hidden" name="item" value="<?php echo esc_attr( (string) (int) $item->id ); ?>" />
+                                                <input type="hidden" name="competitor" value="<?php echo esc_attr( $slug ); ?>" />
+                                                <input type="hidden" name="_wpnonce" value="<?php echo esc_attr( $add ); ?>" />
+                                                <button type="submit" class="button button-primary"<?php disabled( $full ); ?>>
+                                                        <?php esc_html_e( 'Add', 'contributor-resume' ); ?>
+                                                        <span class="screen-reader-text"><?php echo esc_html( $name ); ?></span>
+                                                </button>
+                                        </form>
+                                </div>
+                        <?php endif; ?>
+                </li>
                 <?php
         }

contributor-resume/trunk/includes/stats/class-cresume-stats-widget.php

@@ -158 +158 @@
                 }
 
-                $layout = isset( $raw['layout'] ) ? (string) $raw['layout'] : '';
-                $days   = isset( $raw['days'] ) ? (int) $raw['days'] : 0;
-                $sort   = isset( $raw['sort'] ) ? (string) $raw['sort'] : '';
-                $rows   = isset( $raw['rows'] ) ? (int) $raw['rows'] : 0;
+                // Arrays where text is expected come out as '' (1.6.0): a forged
+                // `layout[]` gave «Array to string conversion» before.
+                $layout = isset( $raw['layout'] ) ? self::text( $raw['layout'] ) : '';
+                $days   = isset( $raw['days'] ) && is_scalar( $raw['days'] ) ? (int) $raw['days'] : 0;
+                $sort   = isset( $raw['sort'] ) ? self::text( $raw['sort'] ) : '';
+                $rows   = isset( $raw['rows'] ) && is_scalar( $raw['rows'] ) ? (int) $raw['rows'] : 0;
                 $item   = isset( $raw['item'] ) ? self::id( $raw['item'] ) : 0;
                 $picked = array();
@@ -176 +178 @@
 
                 foreach ( ( isset( $raw['figures'] ) ? (array) $raw['figures'] : array() ) as $figure ) {
-                        $figure = sanitize_key( (string) $figure );
+                        $figure = sanitize_key( self::text( $figure ) );
 
                         if ( in_array( $figure, self::FIGURES, true ) ) {
@@ -194 +196 @@
                         'alerts'  => ! empty( $raw['alerts'] ),
                 );
+        }
+
+        /**
+         * A posted value as text, or '' when it is not a single value.
+         *
+         * @param mixed $value Posted value.
+         * @return string
+         */
+        private static function text( $value ) {
+                return is_scalar( $value ) ? (string) $value : '';
         }
 

contributor-resume/trunk/readme.txt

@@ -147 +147 @@
 = Can I track my competitors? =
 
-Yes. In the Competitors view of the Stats tab, add up to 10 competitors to each plugin or theme, by slug or by their WordPress.org address, or pick them from the suggestions. They are read every day like your own. You compare them in a head-to-head table, keyword by keyword, in one downloads chart, and in the alerts and emails.
+Yes. In the Competitors view of the Stats tab, search the directory by name or slug and add up to 10 competitors to each plugin or theme, or pick them from the suggestions. They are read every day like your own. You compare them in a head-to-head table, keyword by keyword, in one downloads chart, and in the alerts and emails.
 
 = How are competitors suggested? =
@@ -235 +235 @@
 Competitor tracking: choose the plugins you compete with and follow them every day, with a head to head view, keyword positions, alerts, emails and a dashboard widget. The plugin is now called Contributor Résumé, Rank and Competitor Tracker.
 
-* New: Competitor tracking. Choose up to 10 competitors for each plugin or theme, by slug or WordPress.org address, or from suggestions taken from your own keywords, each with the reason it is there. They are read every day like your own, with two years of download history from the first day. Market leaders are suggested apart: a leader is followed like the rest but not counted when comparing who ranks better.
+* New: Competitor tracking. Choose up to 10 competitors for each plugin or theme with a search of the directory by name or slug, with results as you type, or from suggestions taken from your own keywords, each with the reason it is there. They are read every day like your own, with two years of download history from the first day. Market leaders are suggested apart: a leader is followed like the rest but not counted when comparing who ranks better. When a plugin or theme has its 10, the screen says so and explains how to make room.
 * New: Competitors view in Stats. Five figures, a sortable head-to-head table, a keyword-by-keyword table that shows where you rank better, one downloads chart for all of them (on a logarithmic scale or as an index that starts everyone at 100), your share of the top 10 of your keywords and the opportunities it shows.
 * New: Competitor alerts, in the Alerts view and in the emails. A competitor passes you or falls behind, enters or leaves the top 10, ranks for one of your keywords for the first time, releases a version, says it is tested with a newer WordPress than yours, changes its installs range or rating, gets a spike in downloads without a release, goes 6 or 12 months without an update or is closed on WordPress.org.
@@ -246 +246 @@
 * Improved: On the page of each plugin or theme, the downloads chart is a box you can move, fold or hide like the others, next to active installs and at the same height. Translations and version adoption line up as well.
 * Improved: The stats tables are updated automatically to keep the competitors and their positions.
+* Improved: The dashboard widget settings ignore unexpected values without a PHP notice, and the rating bars are drawn empty when WordPress.org gives no breakdown of the ratings.
 
 For older changelog entries, please check the [changelog.txt](https://plugins.svn.wordpress.org/contributor-resume/trunk/changelog.txt) file

contributor-resume/trunk/uninstall.php

@@ -32 +32 @@
         delete_option( 'cresume_stats_lock' );
         delete_option( 'cresume_stats_mail_lock' );
+        delete_option( 'cresume_stats_rivals_lock' );
+
+        // The search of competitors (1.6.0) keeps each answer for 15 minutes:
+        // nothing worth keeping, so it goes even when the data is kept.
+        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- One-off bulk transient cleanup on uninstall; caching does not apply here.
+        $wpdb->query(
+                "DELETE FROM {$wpdb->options}
+                 WHERE option_name LIKE '\_transient\_cresume\_srch\_%'
+                 OR option_name LIKE '\_transient\_timeout\_cresume\_srch\_%'"
+        );
 
         // Respect the "keep settings and cached data" choice.