Guard remove_cart_item() against null cart and missing ppom_cart_key (WC 10.5)

[ineagu]

Problem

ppom_woocommerce_add_cart_item_data() calls WC()->cart->remove_cart_item($_POST['ppom_cart_key']) unconditionally. On WC 10.5+ with REST-initiated requests (blocks cart), WC()->cart can be null, causing a fatal error. ppom_cart_key is also used unsanitized.

Root Cause

inc/woocommerce.php line ~291 — no null check on WC()->cart and no empty() check on $_POST['ppom_cart_key'].

Solution

if ( ! empty( $_POST['ppom_cart_key'] ) && WC()->cart ) {
    WC()->cart->remove_cart_item( sanitize_key( $_POST['ppom_cart_key'] ) );
}

Also declare blocks cart incompatibility in woocommerce-product-addon.php:

\Automattic\WooCommerce\Utilities\FeaturesUtil::declare_compatibility('cart_checkout_blocks', __FILE__, false);

Update WC tested up to header from 8.0 to 10.5.

Files Affected

• inc/woocommerce.php — null guard on remove_cart_item
• woocommerce-product-addon.php — blocks declaration + header update

Acceptance Criteria

• No fatal error when adding product to cart on WC 10.5+
• Classic cart works correctly with PPOM fields
• Blocks-based cart falls back to classic shortcode when PPOM is active
• WC tested up to header reflects 10.5

Priority: Emergency — blocks cart users with PPOM active
Regression risk: Low — adds guards, doesn't change logic