Conversation
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54641 602fd350-edb4-49c9-b593-d223f7449a82
See [54642] for trunk. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54644 602fd350-edb4-49c9-b593-d223f7449a82
This commit: * Adds default minimum font size limits so that min font size, where provided, does not become smaller than `14px`/`0.875rem`/`0.875em`. * For font sizes of `< 14px` that have no defined minimum sizes, uses the font size to set the floor of the `clamp()` value. This bugfix prevents converting existing small font sizes to clamp values that will reduce their font size even further in narrow widths. It therefore improves backward compatibility and accessibility. Original PR from Gutenberg repository: * [WordPress/gutenberg#44993 #44993 Fluid typography: add font size constraints] Follow-up to [54260], [54360], [54497], [54500]. Props ramonopoly, andrewserong, isabel_brison, Joen, bernhard-reiter. Reviewed by bernhard-reiter, SergeyBiryukov. Merges [54646] to the 6.1 branch. See #56467. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54647 602fd350-edb4-49c9-b593-d223f7449a82
The new About header image appears to have been accidentally reverted to the older one in a previous commit. Follow-up to [54635], [54638]. Props kebbet. Reviewed by SergeyBiryukov, ryelle. Merges [54645] to the 6.1 branch. Fixes #56703. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54648 602fd350-edb4-49c9-b593-d223f7449a82
…tructures. Tumblr's oEmbed API correctly rejects invalid URLs, we can rely on that for the handful of cases that aren't embeddable URLs. Props cbravobernal, bernhard-reiter. Merges [54652] to the 6.1 branch. Fixes #56733. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54653 602fd350-edb4-49c9-b593-d223f7449a82
In `register_block_type`, continue to allow passing arrays as the `editor_script`, `script`, `view_script`, `editor_style`, and `style` arguments. Note that those fields were soft-deprecated in favor of their `_handles` counterparts in [54155], which would allow specifying multiple items. At the same time, the deprecated fields were limited to `string` or `null`. However, this broke existing code that passed an array as one of those arguments. For backwards compatibility, this change thus restores the previous behavior. It is implemented in `WP_Block_Type` as a pair of `__get()` and `__set()` methods that wrap around the corresponding `_handles` members, which are arrays of strings. It also affects the REST API endpoint for block types. The latter’s schema has never allowed for anything other than `string` or `null` for any of those fields. For this reason, it now returns the first element of the array stored in the corresponding `_handles` member in `WP_Block_Type`. Follow-up [54155]. Props nendeb55, costdev, gziolo, spacedmonkey, mukesh27, sergeybiryukov, audrasjb. Merges [54670] to the 6.1 branch. Fixes #56707. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54671 602fd350-edb4-49c9-b593-d223f7449a82
This resolves a bug in Featured Image blocks where `object-fit` was being removed during the `render_callback`. Props raduiason, pbiron, kebbet, SergeyBiryukov, bernhard-reiter, ironprogrammer, xknown, audrasjb, ckanderson22, ivanjeronimo, seriouslysenpai. Reviewed by SergeyBiryukov. Merges [54675] to the 6.1 branch. Fixes #56855. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54676 602fd350-edb4-49c9-b593-d223f7449a82
When used inline, the SVG needs the aria-hidden, focusable, and viewBox properties for accessibility. Additionally, this optimizes the SVG by using circle elements in place of path, and removing clipPath. There is no visible change, but the file is now one-third the size. Props sabernhardt. Reviewed by SergeyBiryukov, ryelle. Merges [54662] to the 6.1 branch. Fixes #56703. See #56357. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54677 602fd350-edb4-49c9-b593-d223f7449a82
The `save-state` and `set-output` commands have been deprecated in GitHub Actions. This removes all occurrences of the command within workflow steps. This will not remove all deprecated notices from workflow summaries (some third-party actions still contain instances of these commands and need to be fixed upstream), but it will fix the notices caused by custom workflow code. Merges [54649] to the 6.1 branch. Props jrf. See #56820. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54679 602fd350-edb4-49c9-b593-d223f7449a82
…lure. This removes the dynamic aspect of the `createWorkflowDispatch()` call that dispatches a Failed Workflow run when another workflow encounters an issue. By hardcoding `trunk` as the `ref`, the version of the workflow used will always be the latest, most up to date. This ensures older branches receive the bug fixes and improvements made in `trunk` without having to backport them. Merges [54674] to the 6.1 branch. See #55652. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54680 602fd350-edb4-49c9-b593-d223f7449a82
…as failed. When a ruleset error is encountered during a PHPCodeSniffer scan, an XML report is not generated and `cs2pr` will exit with a `0`. In this situation, a workflow run will be marked as passing (even though a failure has occurred) due to the presence of `continue-on-error`. This adjusts the logic in the Coding Standards and PHP Compatibility workflows to remove the need for the `continue-on-error` option and ensures all failures are accurately reflected within the GitHub Actions UI. Follow up to [54371]. Props jrf, TobiasBg. Merges [54678] to the 6.1 branch. See #55652. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54681 602fd350-edb4-49c9-b593-d223f7449a82
…s path. `WP_Textdomain_Registry` was introduced in [53874] to store text domains and their language directory paths, addressing issues with just-in-time loading of textdomains when using locale switching and when using`load_*_textdomain()` functions. Said change has inadvertently caused a performance regression exactly when using`load_*_textdomain()`, which still often is the case, where the cached information was not further used or even overridden. This change addresses that issue by storing the default languages paths in a separate way, while at the same time making `WP_Textdomain_Registry` easier to maintain and adding new tests to catch future regressions. Props flixos90, spacedmonkey, ocean90, SergeyBiryukov, costdev. Merges [54669] to the 6.1 branch. See #39210. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54682 602fd350-edb4-49c9-b593-d223f7449a82
Based on feedback, this enhancement isn't quite ready. Reverting [54213] for now to continue the work in the next cycle. Follow-up to [54213]. Props manfcarlo, peterwilsoncc, SergeyBiryukov. Reviewed by SergeyBiryukov. Reverts [54213] in the 6.1 branch. See #54572. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54683 602fd350-edb4-49c9-b593-d223f7449a82
Fix the responsive breakpoint styles for short vertical viewports on the link popup modal. Follow-up to [54216]. Props sabernhardt, joedolson. Fixes #53174. Merges [54660] to the 6.1 branch. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54684 602fd350-edb4-49c9-b593-d223f7449a82
In [54358], styling for Button blocks that had been removed from classic themes was reintroduced. However, it was added with a global scope, whereas editor styles are usually added with a `.editor-styles-wrapper` selector, which makes them more specific. This change modifies the way that classic theme styles are added so that they also get wrapped in an `.editor-styles-wrapper` selector to match specificity. Furthermore, adjust specificity for some Button block related styling in the editor for the Twenty Twelve and Twenty Twenty themes. Merges [WordPress/gutenberg#44731 Gutenberg PR 44731] into trunk. Follow-up to [54358]. Props scruffian, cbravobernal, sabernhardt, audrasjb. Merges [54687] to the 6.1 branch. See #56467. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54688 602fd350-edb4-49c9-b593-d223f7449a82
For a full list of changes included, see the `twentytwentythree` repository on GitHub: WordPress/twentytwentythree@0f273d7...e2005b0. Props kafleg, poena, mikachan, tobifjellner, aristath. Merges [54686] to the 6.1 branch. Fixes #56383. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54691 602fd350-edb4-49c9-b593-d223f7449a82
Introduce `WP_Query::generate_cache_key()` for generating the cache key used by the main database query. This removes the need for a filter to test that cache keys do not include the WPDB placeholder causing unreachable cache keys. The tests now call `WP_Query::generate_cache_key()` directly. The filter `wp_query_cache_key` is removed as a hard deprecation. The filter was not included in a stable release. Follow up to [54685]. Props spacedmonkey, jorbin, azaozz, hellofromtonya, mukesh27, peterwilsoncc, desrosj, audrasjb, adamsilverstein, flixos90, davidbaumwald, joedolson, sergeybiryukov. Reviewed by mikeschroder. Merges [54685] to the 6.1 branch. Fixes #56802. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54692 602fd350-edb4-49c9-b593-d223f7449a82
Package updates for bug and regression fixes since 6.1 RC 2: - @wordpress/block-directory: 3.15.10 - @wordpress/block-editor: 10.0.9 - @wordpress/block-library: 7.14.10 - @wordpress/customize-widgets: 3.14.10 - @wordpress/edit-post: 6.14.10 - @wordpress/edit-site: 4.14.12 - @wordpress/edit-widgets: 4.14.10 - @wordpress/editor: 12.16.9 - @wordpress/format-library: 3.15.9 - @wordpress/reusable-blocks: 3.15.9 - @wordpress/widgets: 2.15.9 Original PRs from Gutenberg repository: * [WordPress/gutenberg#45189 Gutenberg PR 45189] - Fix resizeable editor scrolling * [WordPress/gutenberg#45234 Gutenberg PR 45234] - Reset background-image property for outline button style * [WordPress/gutenberg#45161 Gutenberg PR 45161] - Table Block: Add a deprecation for the figcaption element class name * [WordPress/gutenberg#45159 Gutenberg PR 45159] - File Block: Add a deprecation for the button element class name * [WordPress/gutenberg#45169 Gutenberg PR 45169] - Video: Add a deprecation for the caption element * [WordPress/gutenberg#45166 Gutenberg PR 45166] - Embed: Add deprecation for the caption element * [WordPress/gutenberg#45173 Gutenberg PR 45173] - Gallery: Add a deprecation for captions in the gallery block * [WordPress/gutenberg#44854 Gutenberg PR 44854] - Embed Block: Add support for Tumblr Dashboard URLs * [WordPress/gutenberg#45074 Gutenberg PR 45074] - Post editor: Rename view to Preview * [WordPress/gutenberg#45163 Gutenberg PR 45163] - Featured Image Block: Add missing output escaping * [WordPress/gutenberg#45118 Gutenberg PR 45118] - [WP6.1] Site editor clips body background style Follow-up to [54257], [54335], [54383], [54483], [54486], [54490], and [54632]. Props czapla, cbravobernal, ndiego, annezazu, davidbaumwald, desrosj, mikeschroder, hellofromtonya, ocean90. Reviewed by desrosj, hellofromTonya, SergeyBiryukov. Merges [54693] to the 6.1 branch. See #56467. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54694 602fd350-edb4-49c9-b593-d223f7449a82
Switch to the CDN URLs for the images on the About page. Update the images used on Freedoms & Privacy to match the 6.1 design style. Props richtabor, audrasjb, kebbet. Reviewed by desrosj. Merges [54690] to the 6.1 branch. See #56357. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54695 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54696 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54697 602fd350-edb4-49c9-b593-d223f7449a82
…_attr()`. Follow-up to [54675]. Props peterwilsoncc, SergeyBiryukov, davidbaumwald. Merges [54698] to the 6.1 branch. See #56855. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54700 602fd350-edb4-49c9-b593-d223f7449a82
This change ensures custom styles for all third-party blocks are rendered on the front end if assets are set to be loaded on a per-block basis. Additionally, this change includes new unit tests to help prevent a similar bug in the future. Props scruffian, aristath, poena, wildworks, ajlende, andraganescu, ndiego, gigitux, cbravobernal, ramonopoly, andrewserong, oandregal, hellofromTonya, davidbaumwald. Merges [54703] to the 6.1 branch. Fixes #56915. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54705 602fd350-edb4-49c9-b593-d223f7449a82
This change removes caching of global styles for logged in users, allowing "wp_global_styles" custom post type to be imported completely, regardless of any previously cached data. This change now relies on the lower-level native WP_Query cache invalidation methods for the global styles post type. Follow-up to [52275], [54186]. Props anariel-design, bernhard-reiter, andrewserong, spacedmonkey, andraganescu, peterwilsoncc, oandregal, hellofromTonya. Reviewed by hellofromTonya. Merges [54706] to the 6.1 branch. Fixes #56901. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54707 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54708 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54709 602fd350-edb4-49c9-b593-d223f7449a82
…aths. Based on feedback from network storage configurations there was a noticed slowdown due to the usage of the `path_join()` function. This needs more time to find a workaround. Follow-up to [53934]. Props mreishus, SergeyBiryukov, desrosj, mikeschroder. Reverts [53934] in the 6.1 Branch. See #56924. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54713 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54714 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54715 602fd350-edb4-49c9-b593-d223f7449a82
Link the image and text to the new 6.1 release video on youtube. The video is currently private, but will be made public during the release party. Props admwgn, critterverse, joen, annezazu, jpantani, laurlittle, cbringmann, kellychoffman, pablohoney, EidolonNight. Reviewed by davidbaumwald. Merges [54729] to the 6.1 branch. See #56357. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54731 602fd350-edb4-49c9-b593-d223f7449a82
Follow up to [58645] for the 6.1 branch. Props jorbin. See #61213. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@58651 602fd350-edb4-49c9-b593-d223f7449a82
…VERSION`. This changes the default values for `LOCAL_PHP` and `LOCAL_DB_VERSION` in the 6.1 branch from `latest` to `8.2-fpm` (with beta support) and `5.7`, respectively, to properly reflect the highest versions of PHP and MySQL that this branch will support. See #61533. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@58662 602fd350-edb4-49c9-b593-d223f7449a82
This re-adds Slack notices for the E2E workflow in the 6.1 branch. These were mistakenly removed in [58330]. See #61733, #61213. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@58792 602fd350-edb4-49c9-b593-d223f7449a82
The previous domain that was used to test for a host whose IPv4 address cannot be resolved, `exampleeeee.com`, got registered and has an A-record now, so it's not invalid anymore. `.invalid` is intended for use in online construction of domain names that are sure to be invalid and which it is obvious at a glance are invalid. Reference: [https://datatracker.ietf.org/doc/html/rfc2606#section-2 Reserved Top Level DNS Names: TLDs for Testing, & Documentation Examples]. Follow-up to [52084], [58384], [58388]. Reviewed by peterwilsoncc. Merges test changes from [59293] to the 6.1 branch. Props sippis, johnbillion, MattyRob, swissspidy, SergeyBiryukov. Fixes #62303. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@59303 602fd350-edb4-49c9-b593-d223f7449a82
The Root Certificate bundle maintained by Mozilla ships in WordPress to allow SSL certificates to be verified on hosts with incomplete, outdated, or invalid local SSL configurations. This updates the `ca-bundle.crt` file to the latest version, which applies upstream changes from the bundle maintained by Mozilla and keeps all unexpired legacy 1024bit certificates which are kept for backward compatibility purposes (see [35919]). Partially merges [59740] and [59969] to the 6.1 branch. Props johnbillion, desrosj, whyisjake, ayeshrajans, SergeyBiryukov, swissspidy, skithund, barry. See #62811, #62711. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@59999 602fd350-edb4-49c9-b593-d223f7449a82
This makes use of the new input added in [60005] that allows older branches to skip Playwright related steps. Merges [60006] to the 6.1 branch. See #63117. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60009 602fd350-edb4-49c9-b593-d223f7449a82
Merges [60320] to the 6.1 branch. See #63165. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60376 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60547 602fd350-edb4-49c9-b593-d223f7449a82
The 6.1 branch is now 6.1.9-alpha. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60593 602fd350-edb4-49c9-b593-d223f7449a82
The WordPress Importer plugin now requires PHP 7.2 or higher. The plugin’s unit tests were removed as of [59769] in favor of running only within the plugin’s repository on GitHub instead. [59769] was made during the 6.8 release cycle, so all WP <= 6.7 branches still checkout the latest revision for the plugin before running the PHPUnit test suite. This change modifies the `env:install` script to download version `0.9.0` of the plugin (which is the last version of the Importer plugin that supports PHP < 7.2) when a qualifying version is being tested. Merges [60748] to the 6.1 branch. Props @swissspidy. See #63983. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60753 602fd350-edb4-49c9-b593-d223f7449a82
- REST API: Increase the specificity of capability checks for collections when the `edit` context is in use. - Menus: Prevent HTML in menu item titles from being rendered unexpectedly. Merges [60814], [60815], [60816] to the 6.0 branch. Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, phillsav, rmccue, timothyblynjacobs, vortfu, westonruter , whyisjake, zieladam. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60825 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60847 602fd350-edb4-49c9-b593-d223f7449a82
Props jorbin, desrosj. Merges [60691], [61146] to the 6.1 branch. See #63165. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61155 602fd350-edb4-49c9-b593-d223f7449a82
The `macos-13` runner image is deprecated with support set to be fully removed next month. This updates the build process testing workflow’s MacOS job to use the `macos-15-intel` runner in the 6.1 branch. The `-intel` part is required because older branches of WordPress use Node.js `14.x` which never supported `arm64` environments. The `macos-15-intel` image will be the last `x86_64` runner published for GitHub Actions and will be supported until August 2027. Merges [61226] to the 6.1 branch. See #64246. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61228 602fd350-edb4-49c9-b593-d223f7449a82
This removes reusable workflows that are no longer referenced in the branch, and trims the unit testing matrix to the highest and lowest supported version of each major PHP branch and database version. Props desrosj, johnbillion See #64083 git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61806 602fd350-edb4-49c9-b593-d223f7449a82
- XML-RPC: Switch to `wp_safe_remote()` when fetching a pingback URL. - HTML API: Prevent `WP_HTML_Tag_Processor` instances being unserialized and add some extra logic for validating pattern and template file paths. - KSES: Optimize PCRE pattern detecting numeric character references. - Customize: Improve escaping approach used for nav menu attributes. - Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager. - Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag. - Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library. - Media: Disable XML entity substitution in getID3. Merges [61879-61885,61887,61889-61890,61913] to the 6.1 branch. Props johnbillion, xknown, dmsnell, jorbin, peterwilson, desrosj, westonruter, jonsurrell, aurdasjb. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61950 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61960 602fd350-edb4-49c9-b593-d223f7449a82
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch. Trunk fix: [62874]. Developed in: #12741 Reviewed by: jorbin, lancewillett. Merges [62876] to 6.1 branch. Props johnbillion, jorbin, lancewillett. See #65739. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@62887 602fd350-edb4-49c9-b593-d223f7449a82
There was a problem hiding this comment.
Pull request overview
This pull request bundles a broad set of WordPress core, tooling, test, CI/workflow, and bundled-theme changes (including a version bump to 6.1.10). While the PR title references a specific Twenty Twenty-Three front-end styling issue, the diff scope goes far beyond that and reads more like a maintenance/backport batch.
Changes:
- Updates core behavior across REST API, template loading, localization, block rendering, media handling, and security hardening.
- Adds/updates PHPUnit coverage and test infrastructure, plus adjusts test fixtures and external URLs.
- Refactors local Docker env scripts and multiple GitHub Actions workflows; updates bundled theme docs/styles and core version references.
Reviewed changes
Copilot reviewed 162 out of 170 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/local-env/scripts/start.js | Switches local env startup to docker compose. |
| tools/local-env/scripts/install.js | Uses docker compose; pins WP importer branch for older PHP. |
| tools/local-env/scripts/docker.js | Updates wrapper to run docker compose commands. |
| tests/phpunit/tests/theme/wpThemeJson.php | Adds separator declaration tests and coverage annotation. |
| tests/phpunit/tests/theme/wpAddGlobalStylesForBlocks.php | Adds tests for block inline styles registration behavior. |
| tests/phpunit/tests/theme/base.php | Introduces theme-focused PHPUnit base test case. |
| tests/phpunit/tests/rest-api/rest-users-controller.php | Updates expected REST error code for forbidden context. |
| tests/phpunit/tests/rest-api/rest-block-type-controller.php | Adds tests for deprecated block-type properties in REST response. |
| tests/phpunit/tests/post/nav-menu.php | Adjusts test expectations around category names/titles. |
| tests/phpunit/tests/post/getAttachedFile.php | Removes dedicated get_attached_file Windows-path test file. |
| tests/phpunit/tests/media.php | Adds tests for decoding attr behavior with single quotes/JSON. |
| tests/phpunit/tests/l10n/wpTextdomainRegistry.php | Adds unit tests for WP_Textdomain_Registry caching/paths. |
| tests/phpunit/tests/l10n/wpLocaleSwitcher.php | Resets textdomain registry by reinstantiation in tests. |
| tests/phpunit/tests/l10n/loadTextdomainJustInTime.php | Refactors locale filter counting test; adds custom lang dir case. |
| tests/phpunit/tests/l10n/loadTextdomain.php | Updates registry reset approach in tests. |
| tests/phpunit/tests/kses.php | Adds object-fit case to safecss test data. |
| tests/phpunit/tests/image/functions.php | Updates external test URLs and expected output extension. |
| tests/phpunit/tests/http/http.php | Adds unit test for multiple Location headers redirect handling. |
| tests/phpunit/tests/http/functions.php | Updates URLs and expected headers/lengths in HTTP tests. |
| tests/phpunit/tests/http/base.php | Removes older integration-style redirect test. |
| tests/phpunit/tests/functions/wpRemoteFopen.php | Updates URL and expected response length. |
| tests/phpunit/tests/functions.php | Adjusts path_is_absolute test data; refactors mime filters; updates WOFF expectations. |
| tests/phpunit/tests/formatting/sanitizeLocaleName.php | Adds unit tests for sanitize_locale_name(). |
| tests/phpunit/tests/customize/nav-menus.php | Adds original_title to expected Customizer menu item payloads. |
| tests/phpunit/tests/customize/nav-menu-item-setting.php | Updates sanitize test fixture for original_title. |
| tests/phpunit/tests/canonical.php | Adds test ensuring NOT EXISTS tax_query doesn’t emit errors in canonical redirects. |
| tests/phpunit/tests/blocks/register.php | Adds tests for array handling in deprecated editor_script property. |
| tests/phpunit/tests/blocks/editor.php | Adds test ensuring upload size only computed for users who can upload. |
| tests/phpunit/tests/ajax/Attachments.php | Adds AJAX tests for set-attachment-thumbnail nonce behavior. |
| tests/phpunit/data/themedir1/block-theme/theme.json | Adds third-party block style data for tests. |
| src/wp-includes/version.php | Bumps core version string to 6.1.10-src. |
| src/wp-includes/theme-templates.php | Uses get_stylesheet() for taxonomy term assignment. |
| src/wp-includes/template-loader.php | Hardens template include path handling and validation. |
| src/wp-includes/shortcodes.php | Adds get_shortcode_tags_in_content() helper. |
| src/wp-includes/script-loader.php | Adjusts messaging; refactors classic theme styles enqueue and adds editor injection. |
| src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php | Tightens permissions and roles exposure; adjusts error messaging/context checks. |
| src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php | Skips terms in edit context when lacking edit_term capability. |
| src/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php | Uses get_stylesheet() default for template theme term. |
| src/wp-includes/rest-api/endpoints/class-wp-rest-site-health-controller.php | Passes locale to load_textdomain(). |
| src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php | Uses update permission check for edit context list responses. |
| src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php | Uses get_stylesheet() for active theme comparisons. |
| src/wp-includes/rest-api/endpoints/class-wp-rest-block-types-controller.php | Handles deprecated fields returning arrays by coercing to first item. |
| src/wp-includes/rest-api/class-wp-rest-server.php | Moves nocache header logic and adds override handling. |
| src/wp-includes/rest-api.php | Forces nocache headers on invalid REST nonce. |
| src/wp-includes/Requests/Session.php | Prevents unserialization via __wakeup(). |
| src/wp-includes/Requests/IRI.php | Adds __wakeup() validation and resets properties. |
| src/wp-includes/Requests/Hooks.php | Prevents unserialization via __wakeup(). |
| src/wp-includes/post.php | Adjusts get_attached_file relative-path logic; optimizes get_page_by_title; guards cache_users usage. |
| src/wp-includes/nav-menu.php | Changes comparison logic for clearing menu-item-title when it matches original title. |
| src/wp-includes/nav-menu-template.php | Moves child-depth computation outside item loop. |
| src/wp-includes/media.php | Decoding attr guard; adds parent-post permission checks to gallery/playlist; adds set-attachment-thumbnail nonce to media settings. |
| src/wp-includes/load.php | Ensures textdomain registry is available in early translation loading; passes locale to load_textdomain calls. |
| src/wp-includes/l10n.php | Sanitizes wp_lang via sanitize_locale_name; uses registry custom-path API; adjusts JIT loading conditional. |
| src/wp-includes/kses.php | Tightens numeric entity normalization; adds object-fit to safecss allowlist and doc. |
| src/wp-includes/ID3/getid3.lib.php | Removes LIBXML_NOENT from GETID3 libxml options. |
| src/wp-includes/global-styles-and-settings.php | Adjusts how inline CSS is attached for core vs non-core blocks. |
| src/wp-includes/functions.php | Removes normalized Windows absolute-path regex; normalizes validate_file input; passes locale to continents-cities load_textdomain. |
| src/wp-includes/formatting.php | Normalizer function checks; adds sanitize_locale_name(); allows hyphens in tag_escape. |
| src/wp-includes/deprecated.php | Updates deprecated function version for attachment filename query filter. |
| src/wp-includes/default-filters.php | Moves classic theme styles for editor into block editor settings filter. |
| src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php | Refactors type_label/original_title handling; adds js_value decoding. |
| src/wp-includes/css/editor.css | Adjusts wp-link modal spacing/media query breakpoint. |
| src/wp-includes/css/classic-themes.css | Adds classic theme button baseline styles (new file). |
| src/wp-includes/class-wp-user-query.php | Adds doing_it_wrong before plugins_loaded; guards cache_users call. |
| src/wp-includes/class-wp-theme.php | Adds __wakeup() validation; adds helper for header type checks. |
| src/wp-includes/class-wp-theme-json-resolver.php | Hardens theme.json loading and parent merge; changes global styles query ordering and early bail. |
| src/wp-includes/class-wp-roles.php | Removes update_role method. |
| src/wp-includes/class-wp-query.php | Refactors query caching; primes caches differently for ID-only loops; adds generate_cache_key(). |
| src/wp-includes/class-wp-oembed.php | Broadens Tumblr oEmbed regex pattern. |
| src/wp-includes/class-wp-http-ixr-client.php | Switches to wp_safe_remote_post() for requests. |
| src/wp-includes/class-wp-customize-nav-menus.php | Adds original_title to available items; reuses decoded title. |
| src/wp-includes/class-wp-block-type.php | Improves deprecated property getter/setter behavior for arrays + doing_it_wrong. |
| src/wp-includes/class-wp-block-type-registry.php | Adds __wakeup() validation. |
| src/wp-includes/class-wp-block-patterns-registry.php | Adds __wakeup() validation and resets outside-init registry. |
| src/wp-includes/capabilities.php | Removes global update_role() wrapper function. |
| src/wp-includes/canonical.php | Guards term counting for NOT EXISTS queries. |
| src/wp-includes/blocks/template-part.php | Reorders shortcode processing; validates tagName; bails variations when theme doesn’t support templates. |
| src/wp-includes/blocks/post-featured-image.php | Adjusts loop priming and style application for height/scale/width. |
| src/wp-includes/blocks/avatar.php | Refactors aria-label escaping flow. |
| src/wp-includes/blocks.php | Adds special-case handling for ---> comments; adds template-part tagName sanitization in block attr filtering. |
| src/wp-includes/block-template.php | Reorders shortcode processing; uses get_stylesheet(); wording change “Site Editor”. |
| src/wp-includes/block-template-utils.php | Uses get_stylesheet(); adjusts term query assumptions; changes taxonomy term query result handling. |
| src/wp-includes/block-editor.php | Avoids expensive wp_max_upload_size unless user can upload. |
| src/wp-content/themes/twentytwentytwo/style.css | Updates “Full Site Editing” wording to “Site Editor”. |
| src/wp-content/themes/twentytwentytwo/readme.txt | Updates “Full Site Editing” wording to “Site Editor”. |
| src/wp-content/themes/twentytwentythree/theme.json | Adds visited color styles for a button-like element block. |
| src/wp-content/themes/twentytwentythree/styles/whisper.json | Adds visited color styles. |
| src/wp-content/themes/twentytwentythree/styles/pitch.json | Adds visited color styles. |
| src/wp-content/themes/twentytwentythree/styles/pilgrimage.json | Adds visited color styles. |
| src/wp-content/themes/twentytwentythree/styles/grapes.json | Adds visited color styles. |
| src/wp-content/themes/twentytwentythree/styles/electric.json | Adds visited color styles. |
| src/wp-content/themes/twentytwentythree/styles/canary.json | Adds visited color styles. |
| src/wp-content/themes/twentytwentythree/styles/aubergine.json | Adds visited color styles. |
| src/wp-content/themes/twentytwentythree/style.css | Updates theme description and tags. |
| src/wp-content/themes/twentytwentythree/readme.txt | Updates theme description text. |
| src/wp-content/themes/twentytwentythree/patterns/footer-default.php | Adjusts footer pattern group padding/layout markup. |
| src/wp-content/themes/twentytwentyone/style.css | Bumps theme version header to 1.7. |
| src/wp-content/themes/twentytwentyone/style-rtl.css | Bumps theme version header to 1.7. |
| src/wp-content/themes/twentytwentyone/assets/sass/01-settings/file-header.scss | Bumps theme version header to 1.7. |
| src/wp-content/themes/twentytwentyone/assets/css/ie.css | Bumps theme version header to 1.7. |
| src/wp-content/themes/twentytwenty/assets/css/editor-style-block.css | Changes selector specificity; adds hover underline. |
| src/wp-content/themes/twentytwenty/assets/css/editor-style-block-rtl.css | Changes selector specificity; adds hover underline. |
| src/wp-content/themes/twentytwelve/css/editor-blocks.css | Adds drop-cap color. |
| src/wp-admin/update.php | Blocks non-zip uploads for plugin/theme upload flows. |
| src/wp-admin/site-editor.php | Updates compatibility error message and uses get_stylesheet(). |
| src/wp-admin/privacy.php | Adds versioned privacy SVG URL. |
| src/wp-admin/includes/user.php | Validates authorize-application redirect URLs and blocks bad protocols. |
| src/wp-admin/includes/update-core.php | Updates old-files list; refactors incompatible plugin deactivation. |
| src/wp-admin/includes/theme.php | Renames “Full Site Editing” feature label to “Site Editor”. |
| src/wp-admin/includes/schema.php | Sanitizes options via sanitize_option + maybe_serialize during populate_options. |
| src/wp-admin/includes/file.php | Skips extracting invalid filenames in PclZip unzip path. |
| src/wp-admin/includes/dashboard.php | Hides recent comments rows without post access. |
| src/wp-admin/includes/class-wp-list-table.php | Hides comment bubble without post access. |
| src/wp-admin/includes/class-wp-filesystem-ftpsockets.php | Changes existence checks to rely on nlist + empty-dir handling. |
| src/wp-admin/includes/class-wp-filesystem-ftpext.php | Changes existence checks to rely on ftp_nlist + empty-dir handling. |
| src/wp-admin/includes/class-wp-comments-list-table.php | Skips rendering comment row without post access. |
| src/wp-admin/includes/class-walker-nav-menu-edit.php | Changes escaping to htmlspecialchars for several fields. |
| src/wp-admin/includes/class-walker-nav-menu-checklist.php | Changes escaping to htmlspecialchars for several hidden fields. |
| src/wp-admin/includes/class-file-upload-upgrader.php | Adds archive compatibility validation for plugin/theme zip uploads. |
| src/wp-admin/includes/ajax-actions.php | Adds nonce check for set-attachment-thumbnail; restricts parse_media_shortcode to media-related shortcodes. |
| src/wp-admin/includes/admin.php | Loads admin textdomain with explicit locale argument. |
| src/wp-admin/images/privacy.svg | Replaces privacy SVG asset. |
| src/wp-admin/images/freedom-1.svg | Replaces freedom SVG asset. |
| src/wp-admin/freedoms.php | Adds versioned freedom SVG URLs. |
| src/wp-admin/css/colors/_admin.scss | Updates selector for welcome panel SVG styling. |
| src/wp-admin/css/about.css | Adjusts freedoms image sizing and adds privacy page image styles. |
| src/js/media/views/frame/video-details.js | Adds nonce to set-attachment-thumbnail AJAX request. |
| src/js/_enqueues/wp/util.js | Uses querySelector for template lookup; compiles via found element. |
| src/js/_enqueues/wp/embed.js | Restricts link-following to http/https protocols. |
| src/js/_enqueues/wp/customize/nav-menus.js | Avoids setting title when it matches original_title; removes original_title duplication. |
| src/js/_enqueues/lib/nav-menu.js | Minor JS cleanup; uses DOM-safe construction for pending delete list and hidden inputs. |
| SECURITY.md | Marks 6.1.x as supported. |
| phpcs.xml.dist | Adds WP_Theme_UnitTestCase to PHPCS excluded names list. |
| package.json | Bumps version to 6.1.10; updates several @wordpress package versions. |
| Gruntfile.js | Ignores block-editor sourcemaps in verify task. |
| docker-compose.yml | Updates Compose v2-style config and defaults; adds healthchecks/depends_on conditions. |
| composer.json | Adds Composer audit ignore entry. |
| .github/workflows/welcome-new-contributors.yml | Switches welcome action implementation. |
| .github/workflows/test-old-branches.yml | Removes old-branches workflow. |
| .github/workflows/test-build-processes.yml | Adds workflow to test core build processes. |
| .github/workflows/php-compatibility.yml | Refactors to reusable workflow and updates permissions/actions. |
| .github/workflows/javascript-tests.yml | Refactors to reusable workflow and updates permissions/actions. |
| .github/workflows/failed-workflow.yml | Removes failed-workflow workflow. |
| .github/workflows/end-to-end-tests.yml | Refactors to reusable workflow and adjusts matrix/permissions. |
| .env | Changes default LOCAL_PHP to 8.2-fpm. |
Comments suppressed due to low confidence (5)
src/wp-admin/includes/class-walker-nav-menu-edit.php:223
- Use
esc_attr()for attribute escaping in admin markup rather thanhtmlspecialchars()for consistency and WordPress-specific UTF-8 handling.
src/wp-admin/includes/class-walker-nav-menu-edit.php:229 - Use
esc_attr()for attribute escaping in admin markup rather thanhtmlspecialchars()for consistency and WordPress-specific UTF-8 handling.
src/wp-admin/includes/class-walker-nav-menu-checklist.php:124 - Use
esc_attr()for attribute escaping rather thanhtmlspecialchars()for consistency with WordPress escaping and UTF-8 handling.
tests/phpunit/tests/theme/wpThemeJson.php:4066 - Typo in inline comment: “specifity” should be “specificity”.
tests/phpunit/tests/theme/wpThemeJson.php:4079 - Typo in inline comment: “specifity” should be “specificity”.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "background": "var(--wp--preset--color--secondary)", | ||
| "text": "var(--wp--preset--color--base)" | ||
| } | ||
| }, | ||
| ":visited": { | ||
| "color": { | ||
| "text": "var(--wp--preset--color--contrast)" | ||
| } |
|
|
||
| // send no cache headers if the $send_no_cache_headers is true | ||
| // OR if the HTTP_X_HTTP_METHOD_OVERRIDE is used but resulted a 4xx response code. | ||
| if ( $send_no_cache_headers || ( true === $method_overridden && strpos( $code, '4' ) === 0 ) ) { |
| function sanitize_locale_name( $locale_name ) { | ||
| // Limit to A-Z, a-z, 0-9, '_', '-'. | ||
| $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $locale_name ); |
| } | ||
| } | ||
|
|
||
| return $tags; |
| <label for="edit-menu-item-title-<?php echo $item_id; ?>"> | ||
| <?php _e( 'Navigation Label' ); ?><br /> | ||
| <input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->title ); ?>" /> | ||
| <input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->title, ENT_QUOTES ); ?>" /> |
| <label for="edit-menu-item-attr-title-<?php echo $item_id; ?>"> | ||
| <?php _e( 'Title Attribute' ); ?><br /> | ||
| <input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->post_excerpt ); ?>" /> | ||
| <input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->post_excerpt, ENT_QUOTES ); ?>" /> |
| $output .= '<input type="hidden" class="menu-item-parent-id" name="menu-item[' . $possible_object_id . '][menu-item-parent-id]" value="' . esc_attr( $menu_item->menu_item_parent ) . '" />'; | ||
| $output .= '<input type="hidden" class="menu-item-type" name="menu-item[' . $possible_object_id . '][menu-item-type]" value="' . esc_attr( $menu_item->type ) . '" />'; | ||
| $output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . esc_attr( $menu_item->title ) . '" />'; | ||
| $output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . htmlspecialchars( $menu_item->title, ENT_QUOTES ) . '" />'; |
| /** | ||
| * Tests the core separator block outbut based on various provided settings. | ||
| * |
| 'expected_output' => 'body { margin: 0; }.wp-site-blocks > .alignleft { float: left; margin-right: 2em; }.wp-site-blocks > .alignright { float: right; margin-left: 2em; }.wp-site-blocks > .aligncenter { justify-content: center; margin-left: auto; margin-right: auto; }.wp-block-separator{background-color: blue;border-color: pink;color: red;}', | ||
| ), | ||
| // If background and border color are defined, include everything, CSS specifity will decide which to apply. | ||
| 'background, text, and border-color' => array( |
…anch. Tags in the `wordpress-develop` repo originate from the corresponding svn tag. This means the target commit for the tag must already exist on `wordpress-develop` and therefore its full workflow has already run, usually just minutes prior to the tag being pushed. This change eliminates this unnecessary duplicate workflow run and reduces bottlenecks experienced during releases. See #64893 git-svn-id: https://develop.svn.wordpress.org/branches/6.1@62909 602fd350-edb4-49c9-b593-d223f7449a82
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 162 out of 170 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (15)
tests/phpunit/tests/theme/wpThemeJson.php:4083
- The data provider array uses the key 'background, text, and border-color' twice, which will overwrite the earlier test case and silently reduce coverage.
tests/phpunit/tests/theme/wpThemeJson.php:4004 - Docblock typo: “outbut” should be “output”.
src/wp-includes/rest-api/class-wp-rest-server.php:493 $codeis an integer status code; callingstrpos( $code, '4' )will throw a TypeError on PHP 8+ (haystack must be string). Use numeric range checks for 4xx instead.
src/wp-includes/shortcodes.php:197get_shortcode_tags_in_content()returns duplicate tag names when a shortcode appears multiple times or nested, but the example implies a unique list. Returning a de-duplicated list avoids surprising callers.
src/wp-admin/includes/class-walker-nav-menu-edit.php:205- Use
esc_attr()instead ofhtmlspecialchars()for attribute escaping.esc_attr()is WordPress’ standard and handles charset, invalid UTF-8, and filters consistently across the admin UI.
src/wp-admin/includes/class-walker-nav-menu-edit.php:211 - Use
esc_attr()instead ofhtmlspecialchars()for attribute escaping to match WordPress escaping conventions and ensure correct charset handling.
src/wp-admin/includes/class-walker-nav-menu-edit.php:229 - Use
esc_attr()instead ofhtmlspecialchars()for attribute escaping to align with core and ensure correct encoding/filters.
src/wp-includes/media.php:2823 $post_parentcan be null here, leading to a fatal error when reading$post_parent->ID. Add a null guard before capability checks (and use$args['post_parent']for clarity).
src/wp-admin/includes/class-walker-nav-menu-checklist.php:123- Use
esc_attr()instead ofhtmlspecialchars()for hidden input values to keep escaping consistent with core and avoid relying on PHP’s default charset settings.
src/wp-content/themes/twentytwentythree/theme.json:626 - The PR title/Trac ticket reference indicates this should be about the Twenty Twenty-Three Search block border-color on the front end, but this change is about
:visitedlink colors. The PR also includes many unrelated core/tooling/test changes, which makes review difficult; consider splitting/scoping.
src/wp-admin/includes/class-walker-nav-menu-edit.php:222 - Use
esc_attr()instead ofhtmlspecialchars()for attribute escaping; it’s the standard in core and avoids relying on PHP’s default_charset.
This issue also appears on line 225 of the same file.
src/wp-includes/media.php:2491
$post_parentcan be null here (e.g. invalid/0 id), which would cause a fatal error when accessing$post_parent->ID. Guard against missing posts before permission checks.
This issue also appears on line 2819 of the same file.
src/wp-admin/includes/class-wp-list-table.php:823
$post_objectcan be null, which makesempty( $post_object->post_password )a fatal error on PHP 8+. Guard against a missing post object before accessing properties.
src/wp-admin/includes/class-wp-comments-list-table.php:647$postcan be null here; accessing$post->post_passwordwill fatally error on PHP 8+. Add a$postexistence check before reading properties.
src/wp-admin/includes/dashboard.php:1102$comment_postcan be null (e.g. comment on a deleted post). Accessing$comment_post->post_passwordwill fatally error on PHP 8+. Add a null guard before reading the property.
Merges [62937] to the 6.1 branch. Reviewed by: johnbillion. See #65752. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@62986 602fd350-edb4-49c9-b593-d223f7449a82
Add an ignore for GHSA-hmqg-cxww-wqhq (CVE-2026-67434), under both its GitHub and Packagist advisory IDs. WordPress tooling does not use the vulnerable `Gitblame`, `Hgblame` or `Svnblame` report formats, so the pinned version poses no practical risk. Merges [63037] to the 6.1 branch. Props johnbillion, joedolson, jonsurrell, sergeybiryukov. Fixes #65822. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@63047 602fd350-edb4-49c9-b593-d223f7449a82
- Users: Ensure a proper email address is used before sending email confirmations. - Formatting: Prevent stack overflow in `safecss_filter_attr`. - Multisite: Enforce the active signup policy for existing users. - HTTP API: Improve compliance with IPv4 Special-Purpose Address Space. - Users: Prevent Usernames from mangling HTML - Canonical: Only redirect for publicly viewable post types. - Administration: When `wp_is_large_user_count()`, ensure that the post author is always added to author dropdown. - Editor: Fix output for Post Date. Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 6.1 branch. Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell, isabel_brison, bernhard-reiter, tyxla, aduth. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@63099 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@63119 602fd350-edb4-49c9-b593-d223f7449a82
Trac ticket: https://core.trac.wordpress.org/ticket/57115
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.