Patchmark

When you upload a zip for a plugin or theme that is already installed, WordPress shows a small table (name, version, author, requirements) and a button to replace it. Patchmark takes over that screen and turns it into a proper review, with Cancel and Replace in its top bar. When there are serious findings, Replace takes a second click. The same review is available in three more places:

• Updates from WordPress.org. Every update row on the Plugins screen gets a Review the changes first link. Patchmark downloads the update, compares it with what you have, and puts Update in its top bar.
• Integrity check. Tools › Patchmark checks installed plugins against the checksums WordPress.org publishes for every version it hosts, and lists files that were modified, added or deleted since installation. See what changed opens a full review of your copy against WordPress.org's original.
• WP-CLI. wp patchmark diff, wp patchmark update and wp patchmark check print the same findings as a table, JSON or Markdown, and exit with status 1 on serious findings, for deploy scripts and CI.

Review Everything worth a second look, most serious first, each linked to the exact file and line:

• Header changes: older version than installed, same version with different files, a different plugin name or author, a new Update URI (future updates would come from somewhere else), new requirements, missing required plugins, a renamed main file (the plugin would be deactivated), a changed text domain.
• Unusual files: .htaccess and .user.ini, PHP files with odd extensions (.phtml, .phar, image.jpg.php), PHP in image or font folders, executables and shell scripts, bundled archives.
• Risky code that is new in the upload: eval and decode-and-run, shell commands, includes and unserialize of request data, long encoded strings, names hidden in \x escapes or chr() chains, minified PHP, code that creates users or roles or grants capabilities, browser beacons, new outgoing requests and new web addresses.
• What it adds to the site: new scheduled events, database tables and admin screens.
• Themes: a parent theme that isn't installed, a changed parent theme, and whether the theme (or its parent) is the one visitors see.

PHP is read with the tokenizer, so $db->exec() or "eval" in a comment is not mistaken for the real thing, and only code that was not in the installed copy of the same file is reported. Files

• A folder tree of every added, removed, modified, moved and whitespace-only file, with line counts.
• Split or unified diffs with syntax highlighting (PHP, JavaScript, TypeScript, CSS, SCSS, JSON, HTML, YAML, SQL, Markdown and more), word highlights, folded context you can expand, and an option to ignore whitespace.
• Before and after previews for images.
• Filter by name or status, search inside the changed files, and step through files with j and k.
• Download .patch: a git-style patch of the text changes that git apply applies to the installed copy.

Changelog The entries from readme.txt (or CHANGELOG.md) between the installed and the uploaded version, plus the Upgrade Notice for the new version. For a downgrade, the entries you would give up. API changes Functions, classes, public methods, hooks, REST routes, shortcodes, post types, blocks, scheduled events, admin screens, database tables, options and capabilities the new version adds or removes, plus Composer libraries that are added, removed or updated. Removed names are what breaks themes, snippets and other plugins that rely on them. Export Save any review as an HTML report (opens in any browser, prints to PDF), as Markdown for a ticket or pull request, or as a .patch. It is built in your browser from what is already on the page. Dark theme One click in the top bar. The choice is saved for your user and applies on every screen Patchmark shows. Light Nothing runs on the front end. On the upload screen Patchmark only steps in when the plugin or theme is already installed, and only files that changed are read. Reviews are never stored: leaving the page discards them. The only thing saved is your light or dark choice, as user meta. A clean review is not a guarantee. Only install code from sources you trust.

1.2.0

• New: a guide under Tools › Patchmark › Guide that explains every part of Patchmark.
• New: a guided tour of the review. Start it with the question mark in the top bar, or from the guide on the sample review.
• New: the sample review is a much fuller example: a major update with renamed and removed functions, hooks and shortcodes, a new block, REST route and libraries, and the kind of changes Patchmark exists to catch.
• New: blocks registered from block.json are listed in API changes.
• Changed: the header comparison lists changed fields first, as old → new with a tag (Upgrade, Downgrade, Raised, Lowered, Added, Removed, Changed), and folds the unchanged ones away.
• Changed: new solid file status badges, easier to tell apart in both themes. The file tree shows the letter (A, M, D, R, W), the diff header shows letter and word (A | Added), and the file filters are color-coded tags.
• Fixed: the Export and theme buttons in the top bar line up with the other buttons.

1.1.0

• New: themes. Uploading a zip for an installed theme gets the same review, with checks for a missing or changed parent theme and the active theme.
• New: review updates from WordPress.org before installing them, from a link in each update row on the Plugins screen.
• New: Tools › Patchmark checks installed plugins against WordPress.org's checksums, and compares a changed plugin with WordPress.org's original.
• New: WP-CLI commands wp patchmark diff, update and check, with table, JSON and Markdown output and an exit status for CI.
• New: export a review as an HTML report or Markdown, next to the .patch download.
• New: dark theme, saved per user.
• New checks: names hidden in escapes or chr() chains, minified PHP, preg_replace /e, strrev, add_cap(), navigator.sendBeacon(), and new scheduled events, database tables and admin screens.
• API changes now also list scheduled events, admin screens, database tables, options and capabilities.
• New: a sample review under Tools › Patchmark, and a Live Preview in WordPress Playground.
• A translation template is included, ready for translate.wordpress.org.

1.0.0

• First release: takes over the "already installed" upload screen with a review, a file browser with split and unified diffs, the changelog in between and API changes.