Skip to content

Twenty Twenty-Three: Search block border-color css not applying to input box on front-end - #3636

Open
jaedm97 wants to merge 132 commits into
trunkfrom
6.1
Open

Twenty Twenty-Three: Search block border-color css not applying to input box on front-end#3636
jaedm97 wants to merge 132 commits into
trunkfrom
6.1

Conversation

@jaedm97

@jaedm97 jaedm97 commented Nov 16, 2022

Copy link
Copy Markdown

Trac ticket: https://core.trac.wordpress.org/ticket/57115


This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

dream-encode and others added 30 commits October 18, 2022 19:52
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54641 602fd350-edb4-49c9-b593-d223f7449a82
See [54642] for trunk.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54644 602fd350-edb4-49c9-b593-d223f7449a82
This commit:
* Adds default minimum font size limits so that min font size, where provided, does not become smaller than `14px`/`0.875rem`/`0.875em`.
* For font sizes of `< 14px` that have no defined minimum sizes, uses the font size to set the floor of the `clamp()` value.

This bugfix prevents converting existing small font sizes to clamp values that will reduce their font size even further in narrow widths. It therefore improves backward compatibility and accessibility.

Original PR from Gutenberg repository:
* [WordPress/gutenberg#44993 #44993 Fluid typography: add font size constraints]

Follow-up to [54260], [54360], [54497], [54500].

Props ramonopoly, andrewserong, isabel_brison, Joen, bernhard-reiter.
Reviewed by bernhard-reiter, SergeyBiryukov.
Merges [54646] to the 6.1 branch.
See #56467.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54647 602fd350-edb4-49c9-b593-d223f7449a82
The new About header image appears to have been accidentally reverted to the older one in a previous commit.

Follow-up to [54635], [54638].

Props kebbet.
Reviewed by SergeyBiryukov, ryelle.
Merges [54645] to the 6.1 branch.
Fixes #56703.



git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54648 602fd350-edb4-49c9-b593-d223f7449a82
…tructures.

Tumblr's oEmbed API correctly rejects invalid URLs, we can rely on that for the handful of cases that aren't embeddable URLs.

Props cbravobernal, bernhard-reiter.
Merges [54652] to the 6.1 branch.
Fixes #56733.



git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54653 602fd350-edb4-49c9-b593-d223f7449a82
In `register_block_type`, continue to allow passing arrays as the `editor_script`, `script`, `view_script`, `editor_style`, and `style` arguments. Note that those fields were soft-deprecated in favor of their `_handles` counterparts in [54155], which would allow specifying multiple items. At the same time, the deprecated fields were limited to `string` or `null`.

However, this broke existing code that passed an array as one of those arguments. For backwards compatibility, this change thus restores the previous behavior. It is implemented in `WP_Block_Type` as a pair of `__get()` and `__set()` methods that wrap around the corresponding `_handles` members, which are arrays of strings.

It also affects the REST API endpoint for block types. The latter’s schema has never allowed for anything other than `string` or `null` for any of those fields. For this reason, it now returns the first element of the array stored in the corresponding `_handles` member in `WP_Block_Type`.

Follow-up [54155].
Props nendeb55, costdev, gziolo, spacedmonkey, mukesh27, sergeybiryukov, audrasjb.
Merges [54670] to the 6.1 branch.
Fixes #56707.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54671 602fd350-edb4-49c9-b593-d223f7449a82
This resolves a bug in Featured Image blocks where `object-fit` was being removed during the `render_callback`.

Props raduiason, pbiron, kebbet, SergeyBiryukov, bernhard-reiter, ironprogrammer, xknown, audrasjb, ckanderson22, ivanjeronimo, seriouslysenpai.
Reviewed by SergeyBiryukov.
Merges [54675] to the 6.1 branch.
Fixes #56855.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54676 602fd350-edb4-49c9-b593-d223f7449a82
When used inline, the SVG needs the aria-hidden, focusable, and viewBox properties for accessibility. Additionally, this optimizes the SVG by using circle elements in place of path, and removing clipPath. There is no visible change, but the file is now one-third the size.

Props sabernhardt.
Reviewed by SergeyBiryukov, ryelle.
Merges [54662] to the 6.1 branch.
Fixes #56703. See #56357.



git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54677 602fd350-edb4-49c9-b593-d223f7449a82
The `save-state` and `set-output` commands have been deprecated in GitHub Actions. This removes all occurrences of the command within workflow steps.

This will not remove all deprecated notices from workflow summaries (some third-party actions still contain instances of these commands and need to be fixed upstream), but it will fix the notices caused by custom workflow code.

Merges [54649] to the 6.1 branch.
Props jrf.
See #56820.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54679 602fd350-edb4-49c9-b593-d223f7449a82
…lure.

This removes the dynamic aspect of the `createWorkflowDispatch()` call that dispatches a Failed Workflow run when another workflow encounters an issue.

By hardcoding `trunk` as the `ref`, the version of the workflow used will always be the latest, most up to date. This ensures older branches receive the bug fixes and improvements made in `trunk` without having to backport them.

Merges [54674] to the 6.1 branch.
See #55652.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54680 602fd350-edb4-49c9-b593-d223f7449a82
…as failed.

When a ruleset error is encountered during a PHPCodeSniffer scan, an XML report is not generated and `cs2pr` will exit with a `0`.

In this situation, a workflow run will be marked as passing (even though a failure has occurred) due to the presence of `continue-on-error`.

This adjusts the logic in the Coding Standards and PHP Compatibility workflows to remove the need for the `continue-on-error` option and ensures all failures are accurately reflected within the GitHub Actions UI.

Follow up to [54371].

Props jrf, TobiasBg.
Merges [54678] to the 6.1 branch.
See #55652.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54681 602fd350-edb4-49c9-b593-d223f7449a82
…s path.

`WP_Textdomain_Registry` was introduced in [53874] to store text domains and their language directory paths, addressing issues with just-in-time loading of textdomains when using locale switching and when using`load_*_textdomain()` functions.

Said change has inadvertently caused a performance regression exactly when using`load_*_textdomain()`, which still often is the case, where the cached information was not further used or even overridden.

This change addresses that issue by storing the default languages paths in a separate way, while at the same time making `WP_Textdomain_Registry` easier to maintain and adding new tests to catch future regressions.

Props flixos90, spacedmonkey, ocean90, SergeyBiryukov, costdev.
Merges [54669] to the 6.1 branch.
See #39210.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54682 602fd350-edb4-49c9-b593-d223f7449a82
Based on feedback, this enhancement isn't quite ready.  Reverting [54213] for now to continue the work in the next cycle.

Follow-up to [54213].

Props manfcarlo, peterwilsoncc, SergeyBiryukov.
Reviewed by SergeyBiryukov.
Reverts [54213] in the 6.1 branch.
See #54572.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54683 602fd350-edb4-49c9-b593-d223f7449a82
Fix the responsive breakpoint styles for short vertical viewports on the link popup modal. Follow-up to [54216].

Props sabernhardt, joedolson.
Fixes #53174.
Merges [54660] to the 6.1 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54684 602fd350-edb4-49c9-b593-d223f7449a82
In [54358], styling for Button blocks that had been removed from classic themes was reintroduced. However, it was added with a global scope, whereas editor styles are usually added with a `.editor-styles-wrapper` selector, which makes them more specific.

This change modifies the way that classic theme styles are added so that they also get wrapped in an `.editor-styles-wrapper` selector to match specificity.

Furthermore, adjust specificity for some Button block related styling in the editor for the Twenty Twelve and Twenty Twenty themes.

Merges [WordPress/gutenberg#44731 Gutenberg PR 44731] into trunk.

Follow-up to [54358].
Props scruffian, cbravobernal, sabernhardt, audrasjb.
Merges [54687] to the 6.1 branch.
See #56467.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54688 602fd350-edb4-49c9-b593-d223f7449a82
For a full list of changes included, see the `twentytwentythree` repository on GitHub: WordPress/twentytwentythree@0f273d7...e2005b0.

Props kafleg, poena, mikachan, tobifjellner, aristath.
Merges [54686] to the 6.1 branch.
Fixes #56383.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54691 602fd350-edb4-49c9-b593-d223f7449a82
Introduce `WP_Query::generate_cache_key()` for generating the cache key used by the main database query.

This removes the need for a filter to test that cache keys do not include the WPDB placeholder causing unreachable cache keys. The tests now call `WP_Query::generate_cache_key()` directly.

The filter `wp_query_cache_key` is removed as a hard deprecation. The filter was not included in a stable release.

Follow up to [54685].

Props spacedmonkey, jorbin, azaozz, hellofromtonya, mukesh27, peterwilsoncc, desrosj, audrasjb, adamsilverstein, flixos90, davidbaumwald, joedolson, sergeybiryukov.
Reviewed by mikeschroder.
Merges [54685] to the 6.1 branch.
Fixes #56802.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54692 602fd350-edb4-49c9-b593-d223f7449a82
Package updates for bug and regression fixes since 6.1 RC 2:

- @wordpress/block-directory: 3.15.10
- @wordpress/block-editor: 10.0.9
- @wordpress/block-library: 7.14.10
- @wordpress/customize-widgets: 3.14.10
- @wordpress/edit-post: 6.14.10
- @wordpress/edit-site: 4.14.12
- @wordpress/edit-widgets: 4.14.10
- @wordpress/editor: 12.16.9
- @wordpress/format-library: 3.15.9
- @wordpress/reusable-blocks: 3.15.9
- @wordpress/widgets: 2.15.9

Original PRs from Gutenberg repository:

* [WordPress/gutenberg#45189 Gutenberg PR 45189] - Fix resizeable editor scrolling
* [WordPress/gutenberg#45234 Gutenberg PR 45234] - Reset background-image property for outline button style
* [WordPress/gutenberg#45161 Gutenberg PR 45161] - Table Block: Add a deprecation for the figcaption element class name
* [WordPress/gutenberg#45159 Gutenberg PR 45159] - File Block: Add a deprecation for the button element class name
* [WordPress/gutenberg#45169 Gutenberg PR 45169] - Video: Add a deprecation for the caption element
* [WordPress/gutenberg#45166 Gutenberg PR 45166] - Embed: Add deprecation for the caption element
* [WordPress/gutenberg#45173 Gutenberg PR 45173] - Gallery: Add a deprecation for captions in the gallery block
* [WordPress/gutenberg#44854 Gutenberg PR 44854] - Embed Block: Add support for Tumblr Dashboard URLs
* [WordPress/gutenberg#45074 Gutenberg PR 45074] - Post editor: Rename view to Preview
* [WordPress/gutenberg#45163 Gutenberg PR 45163] - Featured Image Block: Add missing output escaping
* [WordPress/gutenberg#45118 Gutenberg PR 45118] - [WP6.1] Site editor clips body background style

Follow-up to [54257], [54335], [54383], [54483], [54486], [54490], and [54632].

Props czapla, cbravobernal, ndiego, annezazu, davidbaumwald, desrosj, mikeschroder, hellofromtonya, ocean90.
Reviewed by desrosj, hellofromTonya, SergeyBiryukov.
Merges [54693] to the 6.1 branch.
See #56467.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54694 602fd350-edb4-49c9-b593-d223f7449a82
Switch to the CDN URLs for the images on the About page. Update the images used on Freedoms & Privacy to match the 6.1 design style.

Props richtabor, audrasjb, kebbet.
Reviewed by desrosj.
Merges [54690] to the 6.1 branch.
See #56357.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54695 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54696 602fd350-edb4-49c9-b593-d223f7449a82
…_attr()`.

Follow-up to [54675].

Props peterwilsoncc, SergeyBiryukov, davidbaumwald.
Merges [54698] to the 6.1 branch.
See #56855.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54700 602fd350-edb4-49c9-b593-d223f7449a82
This change ensures custom styles for all third-party blocks are rendered on the front end if assets are set to be loaded on a per-block basis.  Additionally, this change includes new unit tests to help prevent a similar bug in the future.

Props scruffian, aristath, poena, wildworks, ajlende, andraganescu, ndiego, gigitux, cbravobernal, ramonopoly, andrewserong, oandregal, hellofromTonya, davidbaumwald.
Merges [54703] to the 6.1 branch.
Fixes #56915.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54705 602fd350-edb4-49c9-b593-d223f7449a82
This change removes caching of global styles for logged in users, allowing "wp_global_styles" custom post type to be imported completely, regardless of any previously cached data.  This change now relies on the lower-level native WP_Query cache invalidation methods for the global styles post type.

Follow-up to [52275], [54186].

Props anariel-design, bernhard-reiter, andrewserong, spacedmonkey, andraganescu, peterwilsoncc, oandregal, hellofromTonya.
Reviewed by hellofromTonya.
Merges [54706] to the 6.1 branch.
Fixes #56901.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54707 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54708 602fd350-edb4-49c9-b593-d223f7449a82
…aths.

Based on feedback from network storage configurations there was a noticed slowdown due to the usage of the `path_join()` function. This needs more time to find a workaround.

Follow-up to [53934].
Props mreishus, SergeyBiryukov, desrosj, mikeschroder.
Reverts [53934] in the 6.1 Branch.
See #56924.


git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54713 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54714 602fd350-edb4-49c9-b593-d223f7449a82
Link the image and text to the new 6.1 release video on youtube. The video is currently private, but will be made public during the release party.

Props admwgn, critterverse, joen, annezazu, jpantani, laurlittle, cbringmann, kellychoffman, pablohoney, EidolonNight.
Reviewed by davidbaumwald.
Merges [54729] to the 6.1 branch.
See #56357.



git-svn-id: https://develop.svn.wordpress.org/branches/6.1@54731 602fd350-edb4-49c9-b593-d223f7449a82
desrosj and others added 17 commits July 3, 2024 15:57
Follow up to [58645] for the 6.1 branch.

Props jorbin.
See #61213.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@58651 602fd350-edb4-49c9-b593-d223f7449a82
…VERSION`.

This changes the default values for `LOCAL_PHP` and `LOCAL_DB_VERSION` in the 6.1 branch from `latest` to `8.2-fpm` (with beta support) and `5.7`, respectively, to properly reflect the highest versions of PHP and MySQL that this branch will support.

See #61533.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@58662 602fd350-edb4-49c9-b593-d223f7449a82
This re-adds Slack notices for the E2E workflow in the 6.1 branch.

These were mistakenly removed in [58330].

See #61733, #61213.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@58792 602fd350-edb4-49c9-b593-d223f7449a82
The previous domain that was used to test for a host whose IPv4 address cannot be resolved, `exampleeeee.com`, got registered and has an A-record now, so it's not invalid anymore.

`.invalid` is intended for use in online construction of domain names that are sure to be invalid and which it is obvious at a glance are invalid.

Reference: [https://datatracker.ietf.org/doc/html/rfc2606#section-2 Reserved Top Level DNS Names: TLDs for Testing, & Documentation Examples].

Follow-up to [52084], [58384], [58388].

Reviewed by peterwilsoncc.
Merges test changes from [59293] to the 6.1 branch.

Props sippis, johnbillion, MattyRob, swissspidy, SergeyBiryukov.
Fixes #62303.




git-svn-id: https://develop.svn.wordpress.org/branches/6.1@59303 602fd350-edb4-49c9-b593-d223f7449a82
The Root Certificate bundle maintained by Mozilla ships in WordPress to allow SSL certificates to be verified on hosts with incomplete, outdated, or invalid local SSL configurations.

This updates the `ca-bundle.crt` file to the latest version, which applies upstream changes from the bundle maintained by Mozilla and keeps all unexpired legacy 1024bit certificates which are kept for backward compatibility purposes (see [35919]).

Partially merges [59740] and [59969] to the 6.1 branch.

Props johnbillion, desrosj, whyisjake, ayeshrajans, SergeyBiryukov, swissspidy, skithund, barry.
See #62811, #62711.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@59999 602fd350-edb4-49c9-b593-d223f7449a82
This makes use of the new input added in [60005] that allows older branches to skip Playwright related steps.

Merges [60006] to the 6.1 branch.
See #63117.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60009 602fd350-edb4-49c9-b593-d223f7449a82
Merges [60320] to the 6.1 branch.

See #63165.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60376 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60547 602fd350-edb4-49c9-b593-d223f7449a82
The 6.1 branch is now 6.1.9-alpha.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60593 602fd350-edb4-49c9-b593-d223f7449a82
The WordPress Importer plugin now requires PHP 7.2 or higher. The plugin’s unit tests were removed as of [59769] in favor of running only within the plugin’s repository on GitHub instead.

[59769] was made during the 6.8 release cycle, so all WP <= 6.7 branches still checkout the latest revision for the plugin before running the PHPUnit test suite.

This change modifies the `env:install` script to download version `0.9.0` of the plugin (which is the last version of the Importer plugin that supports PHP < 7.2) when a qualifying version is being tested.

Merges [60748] to the 6.1 branch.

Props @swissspidy.
See #63983.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60753 602fd350-edb4-49c9-b593-d223f7449a82
- REST API: Increase the specificity of capability checks for collections when the `edit` context is in use.
- Menus: Prevent HTML in menu item titles from being rendered unexpectedly.

Merges [60814], [60815], [60816] to the 6.0 branch.

Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, phillsav, rmccue, timothyblynjacobs, vortfu, westonruter , whyisjake, zieladam.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60825 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@60847 602fd350-edb4-49c9-b593-d223f7449a82
Props jorbin, desrosj.

Merges [60691], [61146] to the 6.1 branch.
See #63165.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61155 602fd350-edb4-49c9-b593-d223f7449a82
The `macos-13` runner image is deprecated with support set to be fully removed next month. This updates the build process testing workflow’s MacOS job to use the `macos-15-intel` runner in the 6.1 branch.

The `-intel` part is required because older branches of WordPress use Node.js `14.x` which never supported `arm64` environments. The `macos-15-intel` image will be the last `x86_64` runner published for GitHub Actions and will be supported until August 2027.

Merges [61226] to the 6.1 branch.

See #64246.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61228 602fd350-edb4-49c9-b593-d223f7449a82
This removes reusable workflows that are no longer referenced in the branch, and trims the unit testing matrix to the highest and lowest supported version of each major PHP branch and database version.

Props desrosj, johnbillion

See #64083


git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61806 602fd350-edb4-49c9-b593-d223f7449a82
- XML-RPC: Switch to `wp_safe_remote()` when fetching a pingback URL.
- HTML API: Prevent `WP_HTML_Tag_Processor` instances being unserialized and add some extra logic for validating pattern and template file paths.
- KSES: Optimize PCRE pattern detecting numeric character references.
- Customize: Improve escaping approach used for nav menu attributes.
- Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager.
- Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag.
- Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library.
- Media: Disable XML entity substitution in getID3.

Merges [61879-61885,61887,61889-61890,61913] to the 6.1 branch.

Props johnbillion, xknown, dmsnell, jorbin, peterwilson, desrosj, westonruter, jonsurrell, aurdasjb.





git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61950 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61960 602fd350-edb4-49c9-b593-d223f7449a82
Scope a Composer audit exception for GHSA-3pwp-g2mj-5p3v so composer install resolves on the 7.0 branch. WPCS is a dev-only dependency, and this keeps it at 3.3.0 rather than bumping it and churning the coding standards on a release branch.

Trunk fix: [62874].

Developed in: #12741

Reviewed by: jorbin, lancewillett.
Merges [62876] to 6.1 branch.

Props johnbillion, jorbin, lancewillett.
See #65739.


git-svn-id: https://develop.svn.wordpress.org/branches/6.1@62887 602fd350-edb4-49c9-b593-d223f7449a82
Copilot AI review requested due to automatic review settings July 28, 2026 21:08

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request bundles a broad set of WordPress core, tooling, test, CI/workflow, and bundled-theme changes (including a version bump to 6.1.10). While the PR title references a specific Twenty Twenty-Three front-end styling issue, the diff scope goes far beyond that and reads more like a maintenance/backport batch.

Changes:

  • Updates core behavior across REST API, template loading, localization, block rendering, media handling, and security hardening.
  • Adds/updates PHPUnit coverage and test infrastructure, plus adjusts test fixtures and external URLs.
  • Refactors local Docker env scripts and multiple GitHub Actions workflows; updates bundled theme docs/styles and core version references.

Reviewed changes

Copilot reviewed 162 out of 170 changed files in this pull request and generated 9 comments.

Show a summary per file
File Description
tools/local-env/scripts/start.js Switches local env startup to docker compose.
tools/local-env/scripts/install.js Uses docker compose; pins WP importer branch for older PHP.
tools/local-env/scripts/docker.js Updates wrapper to run docker compose commands.
tests/phpunit/tests/theme/wpThemeJson.php Adds separator declaration tests and coverage annotation.
tests/phpunit/tests/theme/wpAddGlobalStylesForBlocks.php Adds tests for block inline styles registration behavior.
tests/phpunit/tests/theme/base.php Introduces theme-focused PHPUnit base test case.
tests/phpunit/tests/rest-api/rest-users-controller.php Updates expected REST error code for forbidden context.
tests/phpunit/tests/rest-api/rest-block-type-controller.php Adds tests for deprecated block-type properties in REST response.
tests/phpunit/tests/post/nav-menu.php Adjusts test expectations around category names/titles.
tests/phpunit/tests/post/getAttachedFile.php Removes dedicated get_attached_file Windows-path test file.
tests/phpunit/tests/media.php Adds tests for decoding attr behavior with single quotes/JSON.
tests/phpunit/tests/l10n/wpTextdomainRegistry.php Adds unit tests for WP_Textdomain_Registry caching/paths.
tests/phpunit/tests/l10n/wpLocaleSwitcher.php Resets textdomain registry by reinstantiation in tests.
tests/phpunit/tests/l10n/loadTextdomainJustInTime.php Refactors locale filter counting test; adds custom lang dir case.
tests/phpunit/tests/l10n/loadTextdomain.php Updates registry reset approach in tests.
tests/phpunit/tests/kses.php Adds object-fit case to safecss test data.
tests/phpunit/tests/image/functions.php Updates external test URLs and expected output extension.
tests/phpunit/tests/http/http.php Adds unit test for multiple Location headers redirect handling.
tests/phpunit/tests/http/functions.php Updates URLs and expected headers/lengths in HTTP tests.
tests/phpunit/tests/http/base.php Removes older integration-style redirect test.
tests/phpunit/tests/functions/wpRemoteFopen.php Updates URL and expected response length.
tests/phpunit/tests/functions.php Adjusts path_is_absolute test data; refactors mime filters; updates WOFF expectations.
tests/phpunit/tests/formatting/sanitizeLocaleName.php Adds unit tests for sanitize_locale_name().
tests/phpunit/tests/customize/nav-menus.php Adds original_title to expected Customizer menu item payloads.
tests/phpunit/tests/customize/nav-menu-item-setting.php Updates sanitize test fixture for original_title.
tests/phpunit/tests/canonical.php Adds test ensuring NOT EXISTS tax_query doesn’t emit errors in canonical redirects.
tests/phpunit/tests/blocks/register.php Adds tests for array handling in deprecated editor_script property.
tests/phpunit/tests/blocks/editor.php Adds test ensuring upload size only computed for users who can upload.
tests/phpunit/tests/ajax/Attachments.php Adds AJAX tests for set-attachment-thumbnail nonce behavior.
tests/phpunit/data/themedir1/block-theme/theme.json Adds third-party block style data for tests.
src/wp-includes/version.php Bumps core version string to 6.1.10-src.
src/wp-includes/theme-templates.php Uses get_stylesheet() for taxonomy term assignment.
src/wp-includes/template-loader.php Hardens template include path handling and validation.
src/wp-includes/shortcodes.php Adds get_shortcode_tags_in_content() helper.
src/wp-includes/script-loader.php Adjusts messaging; refactors classic theme styles enqueue and adds editor injection.
src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php Tightens permissions and roles exposure; adjusts error messaging/context checks.
src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php Skips terms in edit context when lacking edit_term capability.
src/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php Uses get_stylesheet() default for template theme term.
src/wp-includes/rest-api/endpoints/class-wp-rest-site-health-controller.php Passes locale to load_textdomain().
src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php Uses update permission check for edit context list responses.
src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php Uses get_stylesheet() for active theme comparisons.
src/wp-includes/rest-api/endpoints/class-wp-rest-block-types-controller.php Handles deprecated fields returning arrays by coercing to first item.
src/wp-includes/rest-api/class-wp-rest-server.php Moves nocache header logic and adds override handling.
src/wp-includes/rest-api.php Forces nocache headers on invalid REST nonce.
src/wp-includes/Requests/Session.php Prevents unserialization via __wakeup().
src/wp-includes/Requests/IRI.php Adds __wakeup() validation and resets properties.
src/wp-includes/Requests/Hooks.php Prevents unserialization via __wakeup().
src/wp-includes/post.php Adjusts get_attached_file relative-path logic; optimizes get_page_by_title; guards cache_users usage.
src/wp-includes/nav-menu.php Changes comparison logic for clearing menu-item-title when it matches original title.
src/wp-includes/nav-menu-template.php Moves child-depth computation outside item loop.
src/wp-includes/media.php Decoding attr guard; adds parent-post permission checks to gallery/playlist; adds set-attachment-thumbnail nonce to media settings.
src/wp-includes/load.php Ensures textdomain registry is available in early translation loading; passes locale to load_textdomain calls.
src/wp-includes/l10n.php Sanitizes wp_lang via sanitize_locale_name; uses registry custom-path API; adjusts JIT loading conditional.
src/wp-includes/kses.php Tightens numeric entity normalization; adds object-fit to safecss allowlist and doc.
src/wp-includes/ID3/getid3.lib.php Removes LIBXML_NOENT from GETID3 libxml options.
src/wp-includes/global-styles-and-settings.php Adjusts how inline CSS is attached for core vs non-core blocks.
src/wp-includes/functions.php Removes normalized Windows absolute-path regex; normalizes validate_file input; passes locale to continents-cities load_textdomain.
src/wp-includes/formatting.php Normalizer function checks; adds sanitize_locale_name(); allows hyphens in tag_escape.
src/wp-includes/deprecated.php Updates deprecated function version for attachment filename query filter.
src/wp-includes/default-filters.php Moves classic theme styles for editor into block editor settings filter.
src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php Refactors type_label/original_title handling; adds js_value decoding.
src/wp-includes/css/editor.css Adjusts wp-link modal spacing/media query breakpoint.
src/wp-includes/css/classic-themes.css Adds classic theme button baseline styles (new file).
src/wp-includes/class-wp-user-query.php Adds doing_it_wrong before plugins_loaded; guards cache_users call.
src/wp-includes/class-wp-theme.php Adds __wakeup() validation; adds helper for header type checks.
src/wp-includes/class-wp-theme-json-resolver.php Hardens theme.json loading and parent merge; changes global styles query ordering and early bail.
src/wp-includes/class-wp-roles.php Removes update_role method.
src/wp-includes/class-wp-query.php Refactors query caching; primes caches differently for ID-only loops; adds generate_cache_key().
src/wp-includes/class-wp-oembed.php Broadens Tumblr oEmbed regex pattern.
src/wp-includes/class-wp-http-ixr-client.php Switches to wp_safe_remote_post() for requests.
src/wp-includes/class-wp-customize-nav-menus.php Adds original_title to available items; reuses decoded title.
src/wp-includes/class-wp-block-type.php Improves deprecated property getter/setter behavior for arrays + doing_it_wrong.
src/wp-includes/class-wp-block-type-registry.php Adds __wakeup() validation.
src/wp-includes/class-wp-block-patterns-registry.php Adds __wakeup() validation and resets outside-init registry.
src/wp-includes/capabilities.php Removes global update_role() wrapper function.
src/wp-includes/canonical.php Guards term counting for NOT EXISTS queries.
src/wp-includes/blocks/template-part.php Reorders shortcode processing; validates tagName; bails variations when theme doesn’t support templates.
src/wp-includes/blocks/post-featured-image.php Adjusts loop priming and style application for height/scale/width.
src/wp-includes/blocks/avatar.php Refactors aria-label escaping flow.
src/wp-includes/blocks.php Adds special-case handling for ---> comments; adds template-part tagName sanitization in block attr filtering.
src/wp-includes/block-template.php Reorders shortcode processing; uses get_stylesheet(); wording change “Site Editor”.
src/wp-includes/block-template-utils.php Uses get_stylesheet(); adjusts term query assumptions; changes taxonomy term query result handling.
src/wp-includes/block-editor.php Avoids expensive wp_max_upload_size unless user can upload.
src/wp-content/themes/twentytwentytwo/style.css Updates “Full Site Editing” wording to “Site Editor”.
src/wp-content/themes/twentytwentytwo/readme.txt Updates “Full Site Editing” wording to “Site Editor”.
src/wp-content/themes/twentytwentythree/theme.json Adds visited color styles for a button-like element block.
src/wp-content/themes/twentytwentythree/styles/whisper.json Adds visited color styles.
src/wp-content/themes/twentytwentythree/styles/pitch.json Adds visited color styles.
src/wp-content/themes/twentytwentythree/styles/pilgrimage.json Adds visited color styles.
src/wp-content/themes/twentytwentythree/styles/grapes.json Adds visited color styles.
src/wp-content/themes/twentytwentythree/styles/electric.json Adds visited color styles.
src/wp-content/themes/twentytwentythree/styles/canary.json Adds visited color styles.
src/wp-content/themes/twentytwentythree/styles/aubergine.json Adds visited color styles.
src/wp-content/themes/twentytwentythree/style.css Updates theme description and tags.
src/wp-content/themes/twentytwentythree/readme.txt Updates theme description text.
src/wp-content/themes/twentytwentythree/patterns/footer-default.php Adjusts footer pattern group padding/layout markup.
src/wp-content/themes/twentytwentyone/style.css Bumps theme version header to 1.7.
src/wp-content/themes/twentytwentyone/style-rtl.css Bumps theme version header to 1.7.
src/wp-content/themes/twentytwentyone/assets/sass/01-settings/file-header.scss Bumps theme version header to 1.7.
src/wp-content/themes/twentytwentyone/assets/css/ie.css Bumps theme version header to 1.7.
src/wp-content/themes/twentytwenty/assets/css/editor-style-block.css Changes selector specificity; adds hover underline.
src/wp-content/themes/twentytwenty/assets/css/editor-style-block-rtl.css Changes selector specificity; adds hover underline.
src/wp-content/themes/twentytwelve/css/editor-blocks.css Adds drop-cap color.
src/wp-admin/update.php Blocks non-zip uploads for plugin/theme upload flows.
src/wp-admin/site-editor.php Updates compatibility error message and uses get_stylesheet().
src/wp-admin/privacy.php Adds versioned privacy SVG URL.
src/wp-admin/includes/user.php Validates authorize-application redirect URLs and blocks bad protocols.
src/wp-admin/includes/update-core.php Updates old-files list; refactors incompatible plugin deactivation.
src/wp-admin/includes/theme.php Renames “Full Site Editing” feature label to “Site Editor”.
src/wp-admin/includes/schema.php Sanitizes options via sanitize_option + maybe_serialize during populate_options.
src/wp-admin/includes/file.php Skips extracting invalid filenames in PclZip unzip path.
src/wp-admin/includes/dashboard.php Hides recent comments rows without post access.
src/wp-admin/includes/class-wp-list-table.php Hides comment bubble without post access.
src/wp-admin/includes/class-wp-filesystem-ftpsockets.php Changes existence checks to rely on nlist + empty-dir handling.
src/wp-admin/includes/class-wp-filesystem-ftpext.php Changes existence checks to rely on ftp_nlist + empty-dir handling.
src/wp-admin/includes/class-wp-comments-list-table.php Skips rendering comment row without post access.
src/wp-admin/includes/class-walker-nav-menu-edit.php Changes escaping to htmlspecialchars for several fields.
src/wp-admin/includes/class-walker-nav-menu-checklist.php Changes escaping to htmlspecialchars for several hidden fields.
src/wp-admin/includes/class-file-upload-upgrader.php Adds archive compatibility validation for plugin/theme zip uploads.
src/wp-admin/includes/ajax-actions.php Adds nonce check for set-attachment-thumbnail; restricts parse_media_shortcode to media-related shortcodes.
src/wp-admin/includes/admin.php Loads admin textdomain with explicit locale argument.
src/wp-admin/images/privacy.svg Replaces privacy SVG asset.
src/wp-admin/images/freedom-1.svg Replaces freedom SVG asset.
src/wp-admin/freedoms.php Adds versioned freedom SVG URLs.
src/wp-admin/css/colors/_admin.scss Updates selector for welcome panel SVG styling.
src/wp-admin/css/about.css Adjusts freedoms image sizing and adds privacy page image styles.
src/js/media/views/frame/video-details.js Adds nonce to set-attachment-thumbnail AJAX request.
src/js/_enqueues/wp/util.js Uses querySelector for template lookup; compiles via found element.
src/js/_enqueues/wp/embed.js Restricts link-following to http/https protocols.
src/js/_enqueues/wp/customize/nav-menus.js Avoids setting title when it matches original_title; removes original_title duplication.
src/js/_enqueues/lib/nav-menu.js Minor JS cleanup; uses DOM-safe construction for pending delete list and hidden inputs.
SECURITY.md Marks 6.1.x as supported.
phpcs.xml.dist Adds WP_Theme_UnitTestCase to PHPCS excluded names list.
package.json Bumps version to 6.1.10; updates several @wordpress package versions.
Gruntfile.js Ignores block-editor sourcemaps in verify task.
docker-compose.yml Updates Compose v2-style config and defaults; adds healthchecks/depends_on conditions.
composer.json Adds Composer audit ignore entry.
.github/workflows/welcome-new-contributors.yml Switches welcome action implementation.
.github/workflows/test-old-branches.yml Removes old-branches workflow.
.github/workflows/test-build-processes.yml Adds workflow to test core build processes.
.github/workflows/php-compatibility.yml Refactors to reusable workflow and updates permissions/actions.
.github/workflows/javascript-tests.yml Refactors to reusable workflow and updates permissions/actions.
.github/workflows/failed-workflow.yml Removes failed-workflow workflow.
.github/workflows/end-to-end-tests.yml Refactors to reusable workflow and adjusts matrix/permissions.
.env Changes default LOCAL_PHP to 8.2-fpm.
Comments suppressed due to low confidence (5)

src/wp-admin/includes/class-walker-nav-menu-edit.php:223

  • Use esc_attr() for attribute escaping in admin markup rather than htmlspecialchars() for consistency and WordPress-specific UTF-8 handling.
    src/wp-admin/includes/class-walker-nav-menu-edit.php:229
  • Use esc_attr() for attribute escaping in admin markup rather than htmlspecialchars() for consistency and WordPress-specific UTF-8 handling.
    src/wp-admin/includes/class-walker-nav-menu-checklist.php:124
  • Use esc_attr() for attribute escaping rather than htmlspecialchars() for consistency with WordPress escaping and UTF-8 handling.
    tests/phpunit/tests/theme/wpThemeJson.php:4066
  • Typo in inline comment: “specifity” should be “specificity”.
    tests/phpunit/tests/theme/wpThemeJson.php:4079
  • Typo in inline comment: “specifity” should be “specificity”.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 619 to +626
"background": "var(--wp--preset--color--secondary)",
"text": "var(--wp--preset--color--base)"
}
},
":visited": {
"color": {
"text": "var(--wp--preset--color--contrast)"
}

// send no cache headers if the $send_no_cache_headers is true
// OR if the HTTP_X_HTTP_METHOD_OVERRIDE is used but resulted a 4xx response code.
if ( $send_no_cache_headers || ( true === $method_overridden && strpos( $code, '4' ) === 0 ) ) {
Comment on lines +2443 to +2445
function sanitize_locale_name( $locale_name ) {
// Limit to A-Z, a-z, 0-9, '_', '-'.
$sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $locale_name );
}
}

return $tags;
<label for="edit-menu-item-title-<?php echo $item_id; ?>">
<?php _e( 'Navigation Label' ); ?><br />
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->title ); ?>" />
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->title, ENT_QUOTES ); ?>" />
<label for="edit-menu-item-attr-title-<?php echo $item_id; ?>">
<?php _e( 'Title Attribute' ); ?><br />
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->post_excerpt ); ?>" />
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->post_excerpt, ENT_QUOTES ); ?>" />
$output .= '<input type="hidden" class="menu-item-parent-id" name="menu-item[' . $possible_object_id . '][menu-item-parent-id]" value="' . esc_attr( $menu_item->menu_item_parent ) . '" />';
$output .= '<input type="hidden" class="menu-item-type" name="menu-item[' . $possible_object_id . '][menu-item-type]" value="' . esc_attr( $menu_item->type ) . '" />';
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . esc_attr( $menu_item->title ) . '" />';
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . htmlspecialchars( $menu_item->title, ENT_QUOTES ) . '" />';
Comment on lines +4002 to +4004
/**
* Tests the core separator block outbut based on various provided settings.
*
'expected_output' => 'body { margin: 0; }.wp-site-blocks > .alignleft { float: left; margin-right: 2em; }.wp-site-blocks > .alignright { float: right; margin-left: 2em; }.wp-site-blocks > .aligncenter { justify-content: center; margin-left: auto; margin-right: auto; }.wp-block-separator{background-color: blue;border-color: pink;color: red;}',
),
// If background and border color are defined, include everything, CSS specifity will decide which to apply.
'background, text, and border-color' => array(
…anch.

Tags in the `wordpress-develop` repo originate from the corresponding svn tag. This means the target commit for the tag must already exist on `wordpress-develop` and therefore its full workflow has already run, usually just minutes prior to the tag being pushed.

This change eliminates this unnecessary duplicate workflow run and reduces bottlenecks experienced during releases.

See #64893


git-svn-id: https://develop.svn.wordpress.org/branches/6.1@62909 602fd350-edb4-49c9-b593-d223f7449a82
Copilot AI review requested due to automatic review settings July 29, 2026 17:29

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 162 out of 170 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (15)

tests/phpunit/tests/theme/wpThemeJson.php:4083

  • The data provider array uses the key 'background, text, and border-color' twice, which will overwrite the earlier test case and silently reduce coverage.
    tests/phpunit/tests/theme/wpThemeJson.php:4004
  • Docblock typo: “outbut” should be “output”.
    src/wp-includes/rest-api/class-wp-rest-server.php:493
  • $code is an integer status code; calling strpos( $code, '4' ) will throw a TypeError on PHP 8+ (haystack must be string). Use numeric range checks for 4xx instead.
    src/wp-includes/shortcodes.php:197
  • get_shortcode_tags_in_content() returns duplicate tag names when a shortcode appears multiple times or nested, but the example implies a unique list. Returning a de-duplicated list avoids surprising callers.
    src/wp-admin/includes/class-walker-nav-menu-edit.php:205
  • Use esc_attr() instead of htmlspecialchars() for attribute escaping. esc_attr() is WordPress’ standard and handles charset, invalid UTF-8, and filters consistently across the admin UI.
    src/wp-admin/includes/class-walker-nav-menu-edit.php:211
  • Use esc_attr() instead of htmlspecialchars() for attribute escaping to match WordPress escaping conventions and ensure correct charset handling.
    src/wp-admin/includes/class-walker-nav-menu-edit.php:229
  • Use esc_attr() instead of htmlspecialchars() for attribute escaping to align with core and ensure correct encoding/filters.
    src/wp-includes/media.php:2823
  • $post_parent can be null here, leading to a fatal error when reading $post_parent->ID. Add a null guard before capability checks (and use $args['post_parent'] for clarity).
    src/wp-admin/includes/class-walker-nav-menu-checklist.php:123
  • Use esc_attr() instead of htmlspecialchars() for hidden input values to keep escaping consistent with core and avoid relying on PHP’s default charset settings.
    src/wp-content/themes/twentytwentythree/theme.json:626
  • The PR title/Trac ticket reference indicates this should be about the Twenty Twenty-Three Search block border-color on the front end, but this change is about :visited link colors. The PR also includes many unrelated core/tooling/test changes, which makes review difficult; consider splitting/scoping.
    src/wp-admin/includes/class-walker-nav-menu-edit.php:222
  • Use esc_attr() instead of htmlspecialchars() for attribute escaping; it’s the standard in core and avoids relying on PHP’s default_charset.

This issue also appears on line 225 of the same file.
src/wp-includes/media.php:2491

  • $post_parent can be null here (e.g. invalid/0 id), which would cause a fatal error when accessing $post_parent->ID. Guard against missing posts before permission checks.

This issue also appears on line 2819 of the same file.
src/wp-admin/includes/class-wp-list-table.php:823

  • $post_object can be null, which makes empty( $post_object->post_password ) a fatal error on PHP 8+. Guard against a missing post object before accessing properties.
    src/wp-admin/includes/class-wp-comments-list-table.php:647
  • $post can be null here; accessing $post->post_password will fatally error on PHP 8+. Add a $post existence check before reading properties.
    src/wp-admin/includes/dashboard.php:1102
  • $comment_post can be null (e.g. comment on a deleted post). Accessing $comment_post->post_password will fatally error on PHP 8+. Add a null guard before reading the property.

lancewillett and others added 4 commits August 4, 2026 00:17
Merges [62937] to the 6.1 branch.

Reviewed by: johnbillion.
See #65752.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@62986 602fd350-edb4-49c9-b593-d223f7449a82
Add an ignore for GHSA-hmqg-cxww-wqhq (CVE-2026-67434), under both its GitHub and Packagist advisory IDs.

WordPress tooling does not use the vulnerable `Gitblame`, `Hgblame` or `Svnblame` report formats, so the pinned version poses no practical risk.

Merges [63037] to the 6.1 branch.

Props johnbillion, joedolson, jonsurrell, sergeybiryukov.
Fixes #65822.


git-svn-id: https://develop.svn.wordpress.org/branches/6.1@63047 602fd350-edb4-49c9-b593-d223f7449a82
- Users: Ensure a proper email address is used before sending email confirmations.
- Formatting: Prevent stack overflow in `safecss_filter_attr`.
- Multisite: Enforce the active signup policy for existing users.
- HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
- Users: Prevent Usernames from mangling HTML
- Canonical: Only redirect for publicly viewable post types.
- Administration:  When `wp_is_large_user_count()`, ensure that the post author is always added to author dropdown.
- Editor: Fix output for Post Date.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 6.1 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell, isabel_brison, bernhard-reiter, tyxla, aduth.

git-svn-id: https://develop.svn.wordpress.org/branches/6.1@63099 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/branches/6.1@63119 602fd350-edb4-49c9-b593-d223f7449a82
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.