Commit 533a1511490 for woocommerce

commit 533a15114909043aee31000bebaaae0729eee552
Author: oxfordmetadata <167354013+oxfordmetadata@users.noreply.github.com>
Date:   Thu Jul 23 13:19:12 2026 +0300

    Correct the legacy price-hash serialization docblock (#66889)

    * Correct the legacy price-hash serialization docblock

    The woocommerce_use_legacy_get_variations_price_hash docblock states that the
    legacy algorithm serializes "the entire object ... including the current values
    of the class variables", and that changing those variables changes the price
    hash.

    That is inaccurate. get_price_hash() ends in md5( wp_json_encode( $price_hash ) ),
    and json_encode() emits only public instance properties, so private and
    protected state never reaches the hash.

    Verified on PHP 8.5 against md5( wp_json_encode( ... ) ) of the callback array:

      public property changed      -> hash changes
      private property changed     -> hash unchanged
      protected property changed   -> hash unchanged
      dynamic property added       -> hash changes  (dynamic props are public)
      JsonSerializable private     -> hash changes  (jsonSerialize decides)

    The corrected wording states that only public property values are captured,
    notes that dynamically created properties are public, and notes that a class
    implementing JsonSerializable controls what is captured.

    Documentation only; no behaviour change.

    Refs #37629

    * Compact the changelog entry

    Per review: one line, so the generated changelog stays readable. Keeps the
    cause (JSON encoding) rather than only the symptom.

diff --git a/plugins/woocommerce/changelog/docs-clarify-legacy-price-hash-serialization b/plugins/woocommerce/changelog/docs-clarify-legacy-price-hash-serialization
new file mode 100644
index 00000000000..667c15e8f8b
--- /dev/null
+++ b/plugins/woocommerce/changelog/docs-clarify-legacy-price-hash-serialization
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Correct the woocommerce_use_legacy_get_variations_price_hash docblock: the legacy hash is JSON-encoded, so only a callback object's public properties affect it.
diff --git a/plugins/woocommerce/includes/data-stores/class-wc-product-variable-data-store-cpt.php b/plugins/woocommerce/includes/data-stores/class-wc-product-variable-data-store-cpt.php
index 9dc0d635e9f..ba58f91d4e9 100644
--- a/plugins/woocommerce/includes/data-stores/class-wc-product-variable-data-store-cpt.php
+++ b/plugins/woocommerce/includes/data-stores/class-wc-product-variable-data-store-cpt.php
@@ -637,11 +637,13 @@ class WC_Product_Variable_Data_Store_CPT extends WC_Product_Data_Store_CPT imple
 		 * Filters whether to use the legacy callback serialization algorithm.
 		 *
 		 * By default, WooCommerce will use the legacy algorithm to get the callback signatures
-		 * for variation price hash calculation. This algorithm serializes the entire callback
-		 * array as it comes from $wp_filter, which means that for callbacks that are class methods
-		 * the entire object will be serialized, including the current values of the class variables.
-		 * This implies that a change in these variables will change the price hash,
-		 * even if they do not affect the price calculation.
+		 * for variation price hash calculation. That algorithm includes the callback array as it
+		 * comes from $wp_filter in the hashed data, which is then JSON encoded. For callbacks that
+		 * are class methods, JSON encoding captures the object's PUBLIC property values only;
+		 * private and protected properties are not captured. Note that dynamically created
+		 * properties are public, and that a class implementing JsonSerializable controls what is
+		 * captured through its jsonSerialize() method. A change in any captured value will change
+		 * the price hash, even if it does not affect the price calculation.
 		 *
 		 * This filter allows using CallbackUtil instead, which generates a more stable signature
 		 * that does not depend on the internal state of objects, but only on the method names and