Archive rendering crashes when Post Content Order is stored as an array

[pirate-bot]

Summary

Archive rendering can terminate with TypeError: json_decode(): Argument #1 ($json) must be of type string, array given when the Post Content Order setting is available as an array.

Expected behavior: the archive continues rendering when the setting has an unexpected array value.

Actual behavior: the request fatally errors before the post archive is rendered.

Impact: affected frontend archive requests are unavailable until the setting value is normalized or otherwise changed.

Customer context

• Product / area: Neve archive post rendering
• Version: 4.2.3
• Environment: WordPress 6.9.5, PHP 8.4.14
• Integration / third party: None identified
• Reported error / symptom: TypeError: json_decode(): Argument #1 ($json) must be of type string, array given
• Impact: 5 telemetry occurrences across 1 production site during the query window.

Reproduction notes

1. Supply neve_post_content_ordering as a PHP array rather than its normal JSON string.
2. Request a frontend post archive that enters Template_Parts::render_post().
3. On PHP 8.4, the reported json_decode() TypeError is produced at the archive rendering helper.

The source of the array value in the affected production site is not available from telemetry.

Diagnosis

Conclusion

Production telemetry places the uncaught json_decode() TypeError in Neve's archive rendering path. The local source at the reported location passes the get_theme_mod() result directly to json_decode() with no type validation. Local PHP execution confirms that decoding an array produces the reported TypeError. This confirms a conditional Neve defect when neve_post_content_ordering is array-valued.

Where this likely occurs

• inc/views/template_parts.php — Neve\Views\Template_Parts::get_ordered_components() lines 562-570 reads neve_post_content_ordering and directly calls json_decode() on its returned value.
• inc/views/template_parts.php — Neve\Views\Template_Parts::post_class() line 241 calls this helper during archive post rendering, matching the telemetry stack.
• inc/customizer/options/layout_blog.php — Blog layout control registration lines 479-493 declares the normal setting default as wp_json_encode(...), establishing a JSON-string data contract.
• inc/customizer/options/layout_blog.php — Layout_Blog::sanitize_post_content_ordering() lines 715-735 also directly decodes its input, indicating the server-side setting path assumes JSON text.
• Commit 3b73d91fe (2023-11-21, chore: small refactor) introduced get_ordered_components(); tag v4.2.3 resolves to commit 4830a361f3, which contains the unguarded decode.

Engineering notes

The normal React Customizer control serializes its selected component IDs with JSON.stringify in assets/apps/customizer-controls/src/ordering/OrderingComponent.js — OrderingComponent::updateValue() lines 35-50. Repository inspection found no Neve runtime writer for this setting that intentionally stores an array. The failing shape can nevertheless reach rendering through externally stored theme-mod data or a WordPress theme-mod filter; the specific source of the array on the affected production site is unknown.

Test coverage status

e2e-tests/specs/customizer/general/order-control.spec.ts lines 1-60 contains ordering-control checks that use JSON strings, but the full spec is commented out. No relevant active PHP test covering an array-valued neve_post_content_ordering value was found during inspection.

What to verify or explore next

• May be worth reproducing an archive request with neve_post_content_ordering supplied as a PHP array through stored theme-mod data and through a theme-mod filter.
• May be worth checking WordPress and plugin integrations active on affected sites for code that supplies this theme mod as an array.
• If available, run the archive rendering test suite on PHP 8.4 with both the normal JSON-string setting and an array-valued setting.

Unknowns / follow-up

• Telemetry does not identify how the affected site's setting acquired an array value.
• The inspected repository does not contain WordPress core, so the behavior of external theme-mod filters was not verified from local core source.

Confidence

Confidence: 95/100

Production telemetry records five frontend crashes on Neve 4.2.3, and the reported frame directly decodes a theme-mod value without validating that it is a JSON string. Local PHP confirms the reported TypeError for an array input.

Crash telemetry

Occurrences	5
Distinct sites	1
First seen	2026-08-04 12:17 UTC
Last seen	2026-08-05 01:26 UTC
Crash location	product:inc/views/template_parts.php:569
Request context	frontend
Inside Themeisle SDK	no
Product versions	4.2.3
WP versions	6.9.5
PHP versions	8.4.14
SDK versions	3.3.58

---

Source: automated crash report — neve, fingerprint f83ab50937839117d2fdd6af298141f5
Generated by bug-report-triage (ID: bug-report-triage_6a72d18110b7b2.50026517)

[girishpanchal30]

I have fixed it with these PRs #4575, https://github.com/Codeinwp/neve-pro-addon/pull/3236