Autopost for X crashes when Revive Social's TwitterOAuth dependency loads first

Summary

When Revive Social 9.4.2 and Autopost for X are active together, an X autopost request can terminate with a TypeError instead of being sent. The plugins are expected to coexist and let each sharing workflow complete independently. In the reported load order, Revive Social’s bundled TwitterOAuth request class is used by Autopost for X with an incompatible argument contract, so the request receives null where an HTTP method is expected. The affected site recorded 19 uncaught exceptions, preventing the Autopost for X operation.

Customer context

• Product / area: Revive Social, bundled X/Twitter OAuth dependency compatibility
• Version: 9.4.2
• Environment: WordPress site; PHP and WordPress versions not provided
• Integration / third party: Autopost for X (formerly Autoshare for Twitter); its version is unknown
• Reported error / symptom: Request::fromConsumerAndToken() receives null for argument 2, typed as an HTTP-method string
• Impact: 19 uncaught exceptions were captured during the first day Revive Social was active; the user temporarily deactivated the product while debugging

Reproduction notes

1. Install and activate Revive Social 9.4.2 with Autopost for X on the same WordPress site.
2. Use a load order in which Revive Social’s Composer autoloader resolves Abraham\TwitterOAuth\Request first.
3. Trigger an Autopost for X request without an OAuth token in the affected call.
4. Observe the uncaught TypeError at Revive Social’s bundled Request.php:51, reporting that argument 2 received null instead of a string.

The failure was observed 19 times in telemetry. A local WordPress runtime reproduction was not performed, and the exact Autopost for X version is missing.

Diagnosis

Conclusion

Revive Social 9.4.2 distributes and globally autoloads a fork of Abraham\TwitterOAuth under the original namespace. Its Request::fromConsumerAndToken() contract places the required HTTP-method string in argument 2, while Autopost for X 2.3.4 publicly declares abraham/twitteroauth 4.0.1, whose contract places the nullable token in argument 2 and the HTTP method in argument 3. The crash shows Autopost for X calling Revive Social’s distributed Request.php; a null token consequently reaches Revive’s string-typed HTTP-method position. This exactly accounts for the captured TypeError and confirms a cross-plugin dependency collision.

Where this likely occurs

• X/Twitter OAuth dependency loading: tweet-old-post.php — run_rop() lines 151–215 loads the plugin-wide Composer autoloader without isolating the dependency namespace.
• Dependency declaration: composer.json — require and repositories entries lines 45–48 and 71–75 select the Codeinwp TwitterOAuth fork while retaining the upstream class namespace.
• Distributed 9.4.2 artifact: vendor/composer/autoload_psr4.php — generated PSR-4 map lines 8–13 maps Abraham\TwitterOAuth\ directly to Revive Social’s fork.
• Distributed 9.4.2 artifact: vendor/codeinwp/twitteroauth/src/Request.php — Request::fromConsumerAndToken() lines 51–58 requires the HTTP method as argument 2. The telemetry points to line 51 in this distributed file.
• Revive Social’s own sharing path: includes/admin/services/class-rop-twitter-service.php — Rop_Twitter_Service::share() lines 583–663 invokes the fork through its expected API; the observed failing caller instead belongs to Autopost for X.
• Regression boundary: commit e74a5341 replaced upstream abraham/twitteroauth 4.0.1 with codeinwp/twitteroauth:dev-main; v9.2.4 is the last tag with the upstream argument contract and v9.2.5 is the first release with the incompatible fork contract. v9.4.2 pins fork commit 9f8c5b8478e0845c137c91b86a98ba367f5e7695.

Engineering notes

The failure depends on plugin/autoloader order and class-resolution timing. Both packages register the same Abraham\TwitterOAuth\ namespace, but their Request::fromConsumerAndToken() positional contracts differ. The captured file location establishes that Revive Social’s class won resolution for this request, while the caller filename identifies the other plugin. Revive Social’s server-connected X path does not exercise this dependency; Rop_Twitter_Service::share() lines 590–610 and 659–672 use the local library only when no rop_auth_token is present. The evidence confirms compatibility with the inspected Autopost for X dependency contract; other plugins sharing this namespace were not assessed.

Test coverage status

tests/test-accounts.php — test_services_sign_in() lines 66–99 checks service construction and authentication URLs but not coexistence with another Composer package using the same namespace. tests/e2e/mu-plugins/rop-e2e-bootstrap.php — the account fixture lines 78–101 uses rop_auth_token, so the E2E X workflow bypasses the local TwitterOAuth path. No relevant cross-plugin dependency-collision coverage was found during inspection.

What to verify or explore next

• Reproduce with Revive Social 9.4.2 and the reported site’s Autopost for X version under both plugin load orders.
• Confirm the affected Autopost for X version from the site inventory and compare its locked TwitterOAuth contract with the inspected 4.0.1 contract.
• Run the local-key X authentication and publishing suites alongside a fixture that loads upstream TwitterOAuth before and after Revive Social.
• Compare packaged releases v9.2.4 and v9.2.5 in the same two-plugin matrix to confirm the observed regression boundary at runtime.

Unknowns / follow-up

The report does not include PHP, WordPress, or Autopost for X versions. A full trace was unavailable, but the reported caller file, callee file, argument number, and distributed signatures align without an alternative in-product null-method path found during inspection.

Confidence

Confidence: 97/100

The captured fatal identifies Revive Social’s distributed TwitterOAuth file, and artifact plus dependency-contract inspection reproduces the exact argument-position mismatch with Autopost for X. The incompatibility was introduced at the v9.2.4-to-v9.2.5 dependency switch and remains in v9.4.2.

---

Source: automated uninstall feedback — tweet-old-post, 2026-09-16
Generated by bug-report-triage (ID: bug-report-triage_6aab743d34b361.61736553)