# AllTheThings

## [5.0.15-2-g7050518](https://github.com/ATTWoWAddon/AllTheThings/tree/705051875a25a93530538f2087e3a90696c90254) (2026-03-05)
[Full Changelog](https://github.com/ATTWoWAddon/AllTheThings/compare/5.0.15...705051875a25a93530538f2087e3a90696c90254) [Previous Releases](https://github.com/ATTWoWAddon/AllTheThings/releases)

- Fixed 2 mail aspirant items.  
- Add issecretvalue guards on UnitGUID + migrate deprecated merchant API (#2334)  
    * Add issecretvalue guards on UnitGUID returns + migrate deprecated merchant API  
    WoW 12.0 marks UnitGUID() returns as secret values. Calling string  
    operations (split, sub, match) on a secret value propagates taint  
    through the execution context, causing UI actions to break in combat.  
    Changes:  
    - Commands.lua: guard UnitGUID("target") before split in /att target  
    - Search.lua: guard UnitGUID("target") before split in /att search  
    - Social.lua: guard UnitGUID("target") before split in /attwho  
    - CharacterClass.lua: nil out secret UnitGUID(unit) in CreateUnit  
    - Raid Assistant.lua: nil out secret UnitGUID(name) in raid roster  
    - Debugger.lua: guard UnitGUID("npc") in GOSSIP\_SHOW, TAXIMAP\_OPENED,  
      LoadMerchant, QUEST\_DETAIL, and CHAT\_MSG\_LOOT handlers  
    - Debugger.lua: GetMerchantNumItems() → C\_MerchantFrame.GetNumItems(),  
      GetMerchantItemLink() → C\_MerchantFrame.GetItemLink() (removed in 12.0)  
    Uses app.WOWAPI.issecretvalue (already used in Contributor.lua and  
    Debugger.lua CHAT\_MSG\_LOOT) for consistency.  
    * Move merchant API migration to WoW API Wrappers for cross-flavor compat  
    GetMerchantNumItems/GetMerchantItemLink wrappers use C\_MerchantFrame on  
    Retail with fallback to globals on Classic, matching ATT's existing pattern.  