WordPress.org
Get WordPress

WordPress build repository browser

Timeline



11/10/2026: Today

21:07 Changeset [64538] by johnbillion
  • trunk/readme.html
  • trunk/wp-admin/includes/class-wp-site-health.php
  • trunk/wp-includes/version.php

Database: Bump the recommended version of MySQL to 8.4.

MySQL 8.0 reached end of life on 30 April 2026 but was still the recommended version in readme.html and Site Health. MySQL 8.4 is an LTS release supported until April 2032, and has been tested in CI since [59280].

Follow-up to [59280], [62170].

Props lucatume, desrosj, masteradhoc.
Fixes #66637.

Built from ​https://develop.svn.wordpress.org/trunk@65399

20:48 Changeset [64537] by desrosj
  • trunk/wp-includes/sodium_compat/src/Core/ChaCha20.php
  • trunk/wp-includes/sodium_compat/src/Core/Curve25519.php
  • trunk/wp-includes/sodium_compat/src/Core/Ed25519.php
  • trunk/wp-includes/sodium_compat/src/Core/Ristretto255.php
  • trunk/wp-includes/sodium_compat/src/Core/SecretStream/State.php
  • trunk/wp-includes/sodium_compat/src/Core32/ChaCha20.php
  • trunk/wp-includes/sodium_compat/src/Core32/ChaCha20/Ctx.php
  • trunk/wp-includes/sodium_compat/src/Core32/Ed25519.php
  • trunk/wp-includes/sodium_compat/src/Core32/SecretStream/State.php
  • trunk/wp-includes/sodium_compat/src/File.php
  • trunk/wp-includes/version.php

External Libraries: Update sodium_compat to version 1.24.2.

This updates the sodium_compat library from version 1.24.1 to 1.42.2.

This update is a hardening release.

A full list of changes can be found on GitHub: ​https://github.com/paragonie/sodium_compat/compare/v1.24.1...v1.24.2.

Props johnbillion.
Fixes #66650.

Built from ​https://develop.svn.wordpress.org/trunk@65398

20:23 Changeset [64536] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove redundant registration cleanup.

Remove final taxonomy and post type cleanup calls already covered by the inherited per-test setup.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15497, ​https://github.com/WordPress/wordpress-develop/pull/15498

Props devmuhib.
See #65893.

Built from ​https://develop.svn.wordpress.org/trunk@65397

19:27 Changeset [64535] by westonruter
  • trunk/wp-includes/version.php

Build/Test Tools: Make the file watcher pick up changes reliably.

The npm run dev watcher often missed changes entirely, such as edits to src/js/_enqueues/lib/emoji-loader.js. The causes lay in grunt-contrib-watch and its gaze dependency, so they could not be fixed through configuration:

  • Gaze enumerated every file under a pattern before applying exclusions, including every installed plugin and bundled node_modules directory, which could block the watcher for minutes.
  • Each file was then polled every two seconds.
  • The watchers were recreated after each run, missing changes made in the meantime.

The watch task is therefore replaced with one built on chokidar, which uses native file system events, skips ignored directories, and keeps a single watcher for the session. Polling remains available via CHOKIDAR_USEPOLLING=1 for network drives and Windows drives accessed from WSL. Version 4 of chokidar is used, matching @wordpress/build in Gutenberg, since version 5 is ESM-only.

The new watch task also changes what is rebuilt:

  • Only the files that the build uses are now watched, and the all target copies the same files that copy:files does instead of everything in src.
  • The :dynamic task configuration is now built from all files changed together and reset on each run. Previously only the last changed file was rebuilt, and a stale clean:dynamic list could delete uploaded files.
  • Changed scripts are minified by the same uglify target as in the build.
  • When the Gruntfile changes, the watcher restarts in a new process, and the previous one keeps watching until the new one is ready, so edits made during the restart are still built.

A new opt-in --symlink option for npm run build:dev and npm run dev symlinks the scripts copied unchanged from src/js/_enqueues, so edits take effect without the watcher. It is opt-in because Docker Desktop's file sharing can fail to read a path that switches between a file and a symlink until the environment is restarted.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15863.
Follow-up to r43309, r43324, r43327, r44359, r56461, r61475.

Props westonruter, lancewillett, siliconforks, sirlouen.
See #44271, #63606, #64563.
Fixes #66638, #63605.

Built from ​https://develop.svn.wordpress.org/trunk@65396

18:51 Changeset [64534] by whyisjake
  • trunk/wp-includes/secrets.php
  • trunk/wp-includes/version.php

Docs: Mark the internal Secrets API helper functions as private.

Adds @access private to the eight underscore-prefixed functions in wp-includes/secrets.php: _wp_secrets_get_store(), _wp_secrets_get_key_manager(), _wp_secrets_get_provider(), _wp_secrets_set(), _wp_secrets_get(), _wp_secrets_delete(), _wp_secrets_retire() and _wp_secrets_list().

These are internal helpers that only core calls. The tag makes the code reference show that they are not meant for plugins or themes.

Follow-up to r64337.

Props wildworks.
Fixes #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65395

18:40 Changeset [64533] by whyisjake
  • trunk/wp-admin/includes/class-wp-debug-data.php
  • trunk/wp-admin/includes/class-wp-site-health.php
  • trunk/wp-admin/includes/secrets-site-health.php
  • trunk/wp-includes/version.php

Security: Move Secrets API Site Health checks into WP_Site_Health.

The Secrets API's Site Health checks and debug information lived in wp-admin/includes/secrets-site-health.php, as functions hooked onto site_status_tests and debug_information. That is how the feature plugin added them, and the file was carried over unchanged. Core's own checks are methods of WP_Site_Health and WP_Debug_Data, and these now are too.

The three checks are WP_Site_Health::get_test_secrets_api_key_source(), ::get_test_secrets_api_undecryptable() and ::get_test_secrets_api_needs_rotation(), registered as direct tests in WP_Site_Health::get_tests() under the same IDs and labels. The debug information is WP_Debug_Data::get_wp_secrets_api().

The statuses, labels and descriptions of the checks are unchanged. Three things do change, to match the rest of core:

  • The debug information section key is wp-secrets-api, not secrets-api.
  • The results use the blue Security badge whatever the status.
  • The results include an actions key.

secrets-site-health.php and the wp_secrets_site_health_*() functions are removed. None of them has been in a release.

Follow-up to r64337, r65385, r65387.

Props ericmann, peterwilsoncc, mindctrl.
See #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65394

17:36 Changeset [64532] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Add a user factory fixture to the E2E tests.

The userFactory fixture creates users and deletes them when the test ends, also if the test fails. signIn() logs a user in through wp-login.php. users.test.js and dashboard.test.js use them instead of their own cleanup and login code.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15884

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65393

16:57 Changeset [64531] by audrasjb
  • trunk/wp-includes/version.php

Post WordPress 7.2 Beta 5 version bump.

Built from ​https://develop.svn.wordpress.org/trunk@65392

16:22 Changeset [64530] by audrasjb
  • trunk/wp-includes/version.php

WordPress 7.2 Beta 5.

Built from ​https://develop.svn.wordpress.org/trunk@65391

16:00 Changeset [64529] by whyisjake
  • trunk/wp-includes/load.php
  • trunk/wp-includes/secrets/class-wp-secrets-broken-keyring.php
  • trunk/wp-includes/secrets/class-wp-secrets-broken-provider.php
  • trunk/wp-includes/secrets/class-wp-secrets-broken-store.php
  • trunk/wp-includes/secrets/class-wp-secrets-config-key-provider.php
  • trunk/wp-includes/secrets/class-wp-secrets-keyring.php
  • trunk/wp-includes/secrets/class-wp-secrets-libsodium-provider.php
  • trunk/wp-includes/secrets/class-wp-secrets-option-store.php
  • trunk/wp-includes/secrets/class-wp-secrets-provider.php
  • trunk/wp-includes/secrets/class-wp-secrets-store.php
  • trunk/wp-includes/secrets/interface-wp-secrets-keyring.php
  • trunk/wp-includes/secrets/interface-wp-secrets-provider.php
  • trunk/wp-includes/secrets/interface-wp-secrets-store.php
  • trunk/wp-includes/version.php
  • trunk/wp-settings.php

Security: Make the Secrets API extension points abstract classes.

WP_Secrets_Provider, WP_Secrets_Store and WP_Secrets_Keyring were interfaces. Once they ship, adding a method to one would be a fatal error in every secrets.php drop-in that implements it, so they could never change. As abstract classes, a later release can add a method with a default implementation and existing drop-ins keep working.

The method signatures are unchanged. The three files are renamed from interface-wp-secrets-*.php to class-wp-secrets-*.php, and the default and fail-closed implementations now extend the classes.

A drop-in written against the interfaces must change implements to extends. Until it does, loading it is a fatal error.

Follow-up to r64337, r65375.

Props ericmann, jorbin.
See #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65390

15:43 Changeset [64528] by whyisjake
  • trunk/wp-admin/setup-config.php
  • trunk/wp-config-sample.php
  • trunk/wp-includes/version.php

Security: Generate WP_SECRETS_KEY during installation.

Since r65385 the Secrets API has no key to fall back on, so a new site had no working Secrets API until someone added WP_SECRETS_KEY to wp-config.php by hand.

wp-config-sample.php now defines WP_SECRETS_KEY with the placeholder, after the keys and salts. It sits outside their group because, unlike them, this key must not change once secrets are stored. The Secrets API rejects the placeholder, so a sample that is copied by hand and left unedited does not become a usable key.

setup-config.php fills the key in when it fills in the salts. The value is a base64-encoded random 32-byte key. Without a source of random bytes it comes from wp_generate_password(), as the salts do. When the sample has no WP_SECRETS_KEY line, as in a custom or older localized sample, the define is added after the salts.

Existing sites are not affected. Tools that write wp-config.php themselves, such as WP-CLI's wp config create, need the same change separately.

Follow-up to r64337, r65385.

Props ericmann, peterwilsoncc, digitalpritam, ravipatel, Clorith, dhrupo.
Fixes #66399. See #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65389

15:42 Changeset [64527] by lancewillett
  • trunk/wp-includes/version.php

General: Ensure svn:eol-style is consistently set for recently added files.

Also convert the 33 CRLF line endings in tests/e2e/specs/media-upload.test.js to LF, as the property requires consistent line endings.

Follow-up to [46636], [51246].

Fixes #66651.

Built from ​https://develop.svn.wordpress.org/trunk@65388

15:40 Changeset [64526] by whyisjake
  • trunk/wp-admin/includes/secrets-site-health.php
  • trunk/wp-includes/version.php

Security: Correct the Secrets API Site Health reports.

The Secrets API tests in Site Health could report a broken setup as healthy, and gave advice that did not fit the site.

A key that cannot unwrap the stored root key was reported as good. It is now critical, because no secret can be read or saved in that state. For the default keyring the result explains that WP_SECRETS_KEY was changed or removed and that restoring the previous value fixes it. For a keyring from a secrets.php drop-in, it shows that keyring's own error.

When the secrets cannot be listed, the undecryptable test is now critical and the rotation test is recommended. Both previously treated the WP_Error as an empty list and reported good. A broken keyring is detected by its class instead of by matching the translated word "broken", so it is no longer missed on translated sites.

When a drop-in replaces the provider, the key source test says the provider manages its own keys and no longer recommends WP_SECRETS_KEY. Site Health Info marks the keyring class and key source as not used by the provider.

A key that is not in the recommended form is no longer described as one to regenerate. Once secrets are stored, the result says to keep its current value. The undecryptable result no longer says the values can never be recovered, since restoring the previous key makes them readable again.

Follow-up to r64337, r65374, r65385.

Props nofearinc, ericmann, ravipatel, dhrupo, Clorith, jorbin, peterwilsoncc.
Fixes #66380. See #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65387

15:26 Changeset [64525] by desrosj
  • trunk/wp-includes/Requests/src/Utility/Trim.php
  • trunk/wp-includes/version.php

External Libraries: Include new file added in Requests 2.0.21.

This adds the new src/wp-includes/Requests/src/Utility/Trim.php file that was missed in r65383.

Follow up to r65383.

Unprops desrosj.

Built from ​https://develop.svn.wordpress.org/trunk@65386

15:24 Changeset [64524] by whyisjake
  • trunk/wp-admin/includes/secrets-site-health.php
  • trunk/wp-includes/secrets.php
  • trunk/wp-includes/secrets/class-wp-secrets-config-key-provider.php
  • trunk/wp-includes/version.php

Security: Require WP_SECRETS_KEY for the Secrets API.

Without WP_SECRETS_KEY, the default keyring derived its key from LOGGED_IN_KEY . LOGGED_IN_SALT. Rotating the salts, which is routine advice, then locked every stored secret. The salts were also read directly rather than through wp_salt(), so an unfilled or translated placeholder from wp-config-sample.php could become the key.

This removes the fallback. Without a usable WP_SECRETS_KEY, every call that needs the key returns secret_key_unavailable. A key is not usable when it is empty or only whitespace, when it is the wp-config-sample.php placeholder, or when it equals any of the authentication keys and salts.

Site Health reports a missing or unusable key as recommended and shows a newly generated define() line to add. It reads the key's state from the new WP_Secrets_Config_Key_Provider::get_key_status() instead of parsing the translated key source.

This also introduces wp_is_secrets_api_available(), so a caller can check before moving a credential into the Secrets API. It returns false when the secrets.php drop-in failed to load, when the default keyring has no usable key, or when the key cannot unwrap the stored root key.

A site that stored secrets under the fallback keeps them. They can be read again once WP_SECRETS_KEY is set to a new key, WP_SECRETS_KEY_PREVIOUS is set to the old LOGGED_IN_KEY . LOGGED_IN_SALT, and the root key is re-wrapped with WP_Secrets_Key_Manager::rotate_site_key().

Follow-up to r64337.

Props ericmann, peterwilsoncc, Clorith, dhrupo, wildworks, johnbillion, jorbin, digitalpritam.
See #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65385

15:20 Changeset [64523] by desrosj
  • trunk/wp-includes/version.php

General: Officially declare support for PHP 8.6.

All known PHP 8.6 compatibility issues have been addressed.

This adds 8.6 to the versions WordPress 7.2 supports listed in the .version-support-php.json file, which ensures the version is tested in several GitHub Actions workflows. The PHPUnit test suite is no longer allowed to fail on PHP 8.6.

Fixes #66648.

Built from ​https://develop.svn.wordpress.org/trunk@65384

15:14 Changeset [64522] by desrosj
  • trunk/wp-includes/Requests/src/Cookie.php
  • trunk/wp-includes/Requests/src/Exception/Transport/Curl.php
  • trunk/wp-includes/Requests/src/IdnaEncoder.php
  • trunk/wp-includes/Requests/src/Ipv6.php
  • trunk/wp-includes/Requests/src/Requests.php
  • trunk/wp-includes/Requests/src/Response.php
  • trunk/wp-includes/Requests/src/Session.php
  • trunk/wp-includes/Requests/src/Ssl.php
  • trunk/wp-includes/Requests/src/Transport/Curl.php
  • trunk/wp-includes/Requests/src/Transport/Fsockopen.php
  • trunk/wp-includes/version.php

External Libraries: Update Requests library to version 2.0.21.

This update primarily includes a PHP 8.6 compatibility fix. The only other changes found in 2.0.18-2.0.21 are to the root certificate bundle included in the library, which are skipped as WordPress manages its own certificate bundle.

Props davidbaumwald.
Fixes #66647.

Built from ​https://develop.svn.wordpress.org/trunk@65383

14:59 Changeset [64521] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Add a post factory fixture to the E2E tests.

The postFactory fixture creates posts and pages, and force-deletes them when the test ends, also if the test fails. Four specs use it instead of their own cleanup code.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15875

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65382

14:58 Changeset [64520] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Revoke application passwords after each E2E test.

The application passwords spec revoked the admin's passwords only before each test, so the create test, or a test that failed, could leave its password on the site. The spec's fixture now revokes them after each test too.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15874

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65381

14:52 Changeset [64519] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Wait for login autofocus in the self-demotion E2E test.

The test could type the password while wp-login.php moved focus to the username field, so the password went into the wrong field.

Follow-up to [65334].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15862

Props shailu25.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65380

10:32 Changeset [64518] by Mamaduka
  • trunk/wp-includes/assets/script-loader-packages.php
  • trunk/wp-includes/assets/script-modules-packages.php
  • trunk/wp-includes/build/routes/font-list/content.js
  • trunk/wp-includes/build/routes/font-list/content.min.asset.php
  • trunk/wp-includes/build/routes/font-list/content.min.js
  • trunk/wp-includes/build/scripts/core-fields/attachment/author/field.php
  • trunk/wp-includes/build/scripts/core-fields/index.php
  • trunk/wp-includes/build/scripts/core-fields/post_type_supports/author/field.php
  • trunk/wp-includes/build/scripts/core-fields/post_type_supports/excerpt/field.php
  • trunk/wp-includes/build/scripts/core-fields/post_type_supports/publish_date
  • trunk/wp-includes/build/scripts/core-fields/post_type_supports/publish_date/field.php
  • trunk/wp-includes/build/scripts/core-fields/post_type_supports/scheduled_date/field.php
  • trunk/wp-includes/build/scripts/core-fields/wp_block/description/field.php
  • trunk/wp-includes/build/scripts/core-fields/wp_template/description/field.php
  • trunk/wp-includes/css/dist/block-editor/style-rtl.css
  • trunk/wp-includes/css/dist/block-editor/style-rtl.min.css
  • trunk/wp-includes/css/dist/block-editor/style.css
  • trunk/wp-includes/css/dist/block-editor/style.min.css
  • trunk/wp-includes/css/dist/components/style-rtl.css
  • trunk/wp-includes/css/dist/components/style-rtl.min.css
  • trunk/wp-includes/css/dist/components/style.css
  • trunk/wp-includes/css/dist/components/style.min.css
  • trunk/wp-includes/css/dist/edit-site/style-rtl.css
  • trunk/wp-includes/css/dist/edit-site/style-rtl.min.css
  • trunk/wp-includes/css/dist/edit-site/style.css
  • trunk/wp-includes/css/dist/edit-site/style.min.css
  • trunk/wp-includes/css/dist/editor/style-rtl.css
  • trunk/wp-includes/css/dist/editor/style-rtl.min.css
  • trunk/wp-includes/css/dist/editor/style.css
  • trunk/wp-includes/css/dist/editor/style.min.css
  • trunk/wp-includes/js/dist/block-editor.js
  • trunk/wp-includes/js/dist/block-editor.min.js
  • trunk/wp-includes/js/dist/block-library.js
  • trunk/wp-includes/js/dist/block-library.min.js
  • trunk/wp-includes/js/dist/components.js
  • trunk/wp-includes/js/dist/components.min.js
  • trunk/wp-includes/js/dist/core-data.js
  • trunk/wp-includes/js/dist/core-data.min.js
  • trunk/wp-includes/js/dist/customize-widgets.js
  • trunk/wp-includes/js/dist/customize-widgets.min.js
  • trunk/wp-includes/js/dist/edit-site.js
  • trunk/wp-includes/js/dist/edit-site.min.js
  • trunk/wp-includes/js/dist/edit-widgets.js
  • trunk/wp-includes/js/dist/edit-widgets.min.js
  • trunk/wp-includes/js/dist/editor.js
  • trunk/wp-includes/js/dist/editor.min.js
  • trunk/wp-includes/js/dist/format-library.js
  • trunk/wp-includes/js/dist/format-library.min.js
  • trunk/wp-includes/js/dist/media-utils.js
  • trunk/wp-includes/js/dist/media-utils.min.js
  • trunk/wp-includes/js/dist/notices.js
  • trunk/wp-includes/js/dist/notices.min.js
  • trunk/wp-includes/js/dist/script-modules/block-library/image/view.js
  • trunk/wp-includes/js/dist/script-modules/block-library/image/view.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/block-library/image/view.min.js
  • trunk/wp-includes/js/dist/script-modules/boot/index.js
  • trunk/wp-includes/js/dist/script-modules/boot/index.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/boot/index.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/attachment.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/attachment.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/attachment.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/post_type_supports.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/post_type_supports.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/post_type_supports.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_block.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_block.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_block.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template_part.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template_part.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template_part.min.js
  • trunk/wp-includes/js/dist/script-modules/interactivity-router/index.js
  • trunk/wp-includes/js/dist/script-modules/interactivity-router/index.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/interactivity-router/index.min.js
  • trunk/wp-includes/js/dist/script-modules/interactivity/index.js
  • trunk/wp-includes/js/dist/script-modules/interactivity/index.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/interactivity/index.min.js
  • trunk/wp-includes/js/dist/script-modules/workflow/index.js
  • trunk/wp-includes/js/dist/script-modules/workflow/index.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/workflow/index.min.js
  • trunk/wp-includes/js/dist/url.js
  • trunk/wp-includes/js/dist/url.min.js
  • trunk/wp-includes/js/dist/widgets.js
  • trunk/wp-includes/js/dist/widgets.min.js
  • trunk/wp-includes/version.php

General: Bump the pinned hash for Gutenberg to 1b0dc90.

This updates the pinned commit hash of the Gutenberg repository from c035c1a649ef68f5c1646694cf440df1d7ae6e62 to 1b0dc90c700746b108e080263a4dc67707b750a1 (fixes cherry-picked to the wp/7.2 branch).

A full list of changes included in this commit can be found on GitHub: ​https://github.com/WordPress/gutenberg/compare/c035c1a649ef68f5c1646694cf440df1d7ae6e62...1b0dc90c700746b108e080263a4dc67707b750a1

Props mamaduka, wildworks.
See #66340.
Built from ​https://develop.svn.wordpress.org/trunk@65379

08:19 Changeset [64517] by whyisjake
  • trunk/wp-includes/load.php
  • trunk/wp-includes/version.php

Security: Let the secrets.php drop-in set plain variables.

wp_load_secrets_dropin() requires wp-content/secrets.php inside a function, so a drop-in that set an override as a plain variable, such as $wp_secrets_keyring = new My_Keyring();, only set a local variable. The override was ignored and the default was used instead, with nothing to say so.

The $wp_secrets_provider, $wp_secrets_store and $wp_secrets_keyring globals are now declared before the drop-in is required, as require_wp_db() does with $wpdb for db.php. Drop-ins that write to $GLOBALS work as before.

Follow-up to r64337.

Props ericmann, jorbin.
See #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65378

08:00 Changeset [64516] by whyisjake
  • trunk/wp-includes/version.php

Security: Document the Secrets API hardening tests.

Brings the tests added in r65375 in line with the conventions the Secrets API tests follow since r65272: each test has a summary and a @covers annotation, and each assertion has a message.

Follow-up to r65272, r65375.

See #66414.

Built from ​https://develop.svn.wordpress.org/trunk@65377

07:59 Changeset [64515] by wildworks
  • trunk/wp-includes/version.php

Tests: Cover deprecated block feature selectors in theme.json

Adds a test that registers a dedicated block with feature-level selectors defined via __experimentalSelector and verifies the generated color and typography styles.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15849

Props shailu25, wildworks.
Fixes #66640.
Built from ​https://develop.svn.wordpress.org/trunk@65376

07:59 Changeset [64514] by whyisjake
  • trunk/wp-admin/options.php
  • trunk/wp-includes/secrets.php
  • trunk/wp-includes/secrets/class-wp-secrets-broken-keyring.php
  • trunk/wp-includes/secrets/class-wp-secrets-broken-provider.php
  • trunk/wp-includes/secrets/class-wp-secrets-cipher.php
  • trunk/wp-includes/secrets/class-wp-secrets-config-key-provider.php
  • trunk/wp-includes/secrets/class-wp-secrets-libsodium-provider.php
  • trunk/wp-includes/secrets/interface-wp-secrets-keyring.php
  • trunk/wp-includes/secrets/interface-wp-secrets-provider.php
  • trunk/wp-includes/version.php

Security: Harden secret names, parameters and the root key field.

Fixes three small issues in the Secrets API:

  • wp_secrets_validate_name() accepted a name with a trailing newline, because $ also matches before a final newline. The options API trims option names, so that name shared a row with the name without the newline, and a write through one made the other unreadable. The pattern now ends with \z.
  • A secret value or key material could appear in a stack trace when an exception was thrown while a secret was being saved. The parameters that receive them are now marked with #[\SensitiveParameter]. Attributes are not inherited, so keyrings and providers in a drop-in need to add it themselves.
  • Settings > All Settings showed _wp_secrets_root_key as an editable field, and saving the screen with it changed made every stored secret unreadable. The field is now masked, disabled and left out of the options the screen saves, like the connector API keys.

Follow-up to r64337.

Props dhrupo, aryanjasala, ericmann.
Fixes #66414. See #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65375

07:50 Changeset [64513] by whyisjake
  • trunk/wp-admin/includes/plugin.php
  • trunk/wp-includes/version.php

Plugins: List secrets.php as a drop-in.

wp-content/secrets.php has been loaded on every request since r64337, but it was missing from _get_dropins(). Neither the Drop-ins view of the Plugins screen nor the Drop-ins section of Site Health Info showed it.

Follow-up to r64337.

Props nofearinc, ericmann.
See #66380.

Built from ​https://develop.svn.wordpress.org/trunk@65374

07:48 Changeset [64512] by whyisjake
  • trunk/wp-includes/secrets/class-wp-secrets-key-manager.php
  • trunk/wp-includes/secrets/class-wp-secrets-libsodium-provider.php
  • trunk/wp-includes/version.php

Security: Keep the Secrets API root key after a failed read.

WP_Secrets_Key_Manager::get_root_key() generated a new root key whenever get_site_option() returned false. That also happens when the query fails, and on a single site the new key then overwrote the stored one, so every existing secret became unreadable. Two requests creating the first root key at the same time could overwrite each other in the same way.

A false result is now checked against the database before a key is generated. If that read also fails, a WP_Error is returned and nothing is written. Reading a secret no longer creates a root key: WP_Secrets_Libsodium_Provider::get() returns an error when none is stored. The first root key is inserted with INSERT IGNORE on a single site, so an existing key is never overwritten. On multisite, every request uses the oldest row, and a request that lost the race deletes its own.

Follow-up to r64337.

Props aryanjasala, dhrupo, ericmann.
Fixes #66413. See #66187.

Built from ​https://develop.svn.wordpress.org/trunk@65373

06:53 Changeset [64511] by westonruter
  • trunk/wp-includes/version.php

Build/Test Tools: Add a script to fix stale PHPStan baselines.

Since PHPStan 2.3.5, its --fix option removes stale ignores in place: it lowers the count of a baseline entry whose error now occurs fewer times, removes an entry that matches nothing, and removes an @phpstan-ignore comment that no longer ignores anything. That is quicker than regenerating the baselines, since it reuses the result cache, and it also clears the stale inline ignores, which regenerating leaves to be removed by hand.

The new composer phpstan:fix script (and npm run typecheck:php:fix) runs PHPStan with --fix, then the baseline generator with its new --prune option, which deletes any baseline left with no entries along with its includes entry, and then the analysis once more, since --fix reports only what it fixed and succeeds even when other errors remain. Both analyses use phpstan.neon.dist, because a local configuration at another rule level can report a baselined error with a different message, and --fix would then remove entries that the default configuration still needs.

The CI annotations, step summary, and pull request comment now recommend the new script, and the annotation of an error that PHPStan can fix itself says so.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15479.
Follow-up to r63019, r64539, r65310.

Props westonruter, apermo.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65372

05:23 Changeset [64510] by luisherranz
  • trunk/wp-includes/interactivity-api/class-wp-interactivity-api.php
  • trunk/wp-includes/version.php

Interactivity API: Choose the data-wp-html placeholder marker in linear time.

Replace the repeated input-search loop with a UUID-based marker, generated
when the first data-wp-html host renders and reused by subsequent hosts
in the same processing call.

This removes input-dependent searching, keeps placeholder length fixed,
and avoids generating a UUID when no host renders.

Props jonsurrell.
Fixes #66498.
Built from ​https://develop.svn.wordpress.org/trunk@65371

05:19 Changeset [64509] by gziolo
  • trunk/wp-includes/abilities-api.php
  • trunk/wp-includes/abilities-api/class-wp-ability.php
  • trunk/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php
  • trunk/wp-includes/version.php

Abilities API: Replace coerce_input() with prepare_input()

Add a public WP_Ability::prepare_input() method that normalizes, validates, and sanitizes input in one call. Use it in WP_Ability::execute() and the REST run controller.

Rename coerce_input() to the protected sanitize_input(), so sanitization cannot run on input that was not validated. coerce_input() was not released yet, so this is not a breaking change.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15685.
Follow-up to [65044], [65306].

Props gziolo, jorgefilipecosta, justlevine, zaguiini.
See #66383.
Fixes #66482.

Built from ​https://develop.svn.wordpress.org/trunk@65370

04:52 Changeset [64508] by westonruter
  • trunk/wp-includes/class-wp-query.php
  • trunk/wp-includes/rest-api.php
  • trunk/wp-includes/rest-api/class-wp-rest-response.php
  • trunk/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php
  • trunk/wp-includes/revision.php
  • trunk/wp-includes/version.php

REST API: Accept a post object in global styles prepare_links().

The WP_REST_Global_Styles_Controller::prepare_links() override took a post ID while the parent method takes a WP_Post, which PHPStan reports as an incompatible child parameter type. It now accepts either, and prepare_item_for_response() continues to pass the ID so that subclasses overriding the method and expecting an ID are not broken. The method also gains a precise return type, which in turn required narrowing the types it relies on: REST URLs are documented as non-empty, and count is declared as a non-negative link attribute.

The WP_Query::$found_posts count is now clamped to zero, both from the found_posts_query query and after the found_posts filter, since a negative post count has no valid meaning and would otherwise surface as a negative revisions count. In r65281 only $max_num_pages was clamped, and its test asserted a negative found_posts merely as a precondition.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15826.
Follow-up to r48328, r52051, r56082, r65281.

Props westonruter, huzaifaalmesbah, dpknauss.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65369

04:16 Changeset [64507] by gziolo
  • trunk/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php
  • trunk/wp-includes/version.php

Abilities API: Skip redundant input sanitization in the REST run endpoint

The permission callback and WP_Ability::execute() already normalize, validate, and coerce input. The input argument now sets sanitize_callback to null, so both receive the original raw input. sanitize_input_for_ability() is deprecated and returns its input unchanged.

Follow-up to [62674], [65044].

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15684.

Props gziolo, jorgefilipecosta, euvoor, justlevine.
Fixes #66383.

Built from ​https://develop.svn.wordpress.org/trunk@65368

01:35 Changeset [64506] by desrosj
  • trunk/wp-admin/includes/image-edit.php
  • trunk/wp-includes/class-wp-image-editor-gd.php
  • trunk/wp-includes/version.php

Media: Use imageflip() to flip images with GD.

WP_Image_Editor_GD::flip() and the deprecated _flip_image_resource() mirrored images by copying them with imagecopyresampled() and negative source dimensions. With the GD 2.4.0 bundled in PHP 8.6, this produces an all-black image. It affects flips in the image editor, and also JPEG uploads with an EXIF orientation of 2, 3 or 4, which WP_Image_Editor::maybe_exif_rotate() flips.

Both functions now flip the image in place with imageflip(), and the output stays the same as before. Palette images are still converted to truecolor, alpha blending is turned off and alpha saving on, and the resolution and interlacing are reset to GD's defaults of 96 DPI and off. This matches what rotate(), crop() and resize() produce. Whether every operation should keep the source image's resolution and interlacing will be decided in a follow-up ticket.

When no valid image is loaded, flip() now returns a WP_Error instead of throwing a TypeError.

Props sanjith2023, rumancodes, arshidkv12, dhruvang21, abhishekfdd, desrosj.
Fixes #66113.

Built from ​https://develop.svn.wordpress.org/trunk@65367

00:30 Changeset [64505] by peterwilsoncc
  • trunk/wp-content/themes/ipsum/.nvmrc
  • trunk/wp-content/themes/ipsum/DESIGN.md
  • trunk/wp-content/themes/ipsum/assets/css/editor-style.css
  • trunk/wp-content/themes/ipsum/contributing.txt
  • trunk/wp-content/themes/ipsum/functions.php
  • trunk/wp-content/themes/ipsum/inc/abilities.php
  • trunk/wp-content/themes/ipsum/package-lock.json
  • trunk/wp-content/themes/ipsum/package.json
  • trunk/wp-content/themes/ipsum/patterns/about-row.php
  • trunk/wp-content/themes/ipsum/patterns/archive-columns.php
  • trunk/wp-content/themes/ipsum/patterns/archive-compact.php
  • trunk/wp-content/themes/ipsum/patterns/archive-full.php
  • trunk/wp-content/themes/ipsum/patterns/archive-lead.php
  • trunk/wp-content/themes/ipsum/patterns/archive-minimal.php
  • trunk/wp-content/themes/ipsum/patterns/archive-photographic.php
  • trunk/wp-content/themes/ipsum/patterns/archive-simple.php
  • trunk/wp-content/themes/ipsum/patterns/archive-standard.php
  • trunk/wp-content/themes/ipsum/patterns/contact-say-hi.php
  • trunk/wp-content/themes/ipsum/patterns/cta-membership.php
  • trunk/wp-content/themes/ipsum/patterns/cta-search.php
  • trunk/wp-content/themes/ipsum/patterns/events-list.php
  • trunk/wp-content/themes/ipsum/patterns/footer-centered.php
  • trunk/wp-content/themes/ipsum/patterns/footer-social.php
  • trunk/wp-content/themes/ipsum/patterns/footer-subscribe.php
  • trunk/wp-content/themes/ipsum/patterns/footer-wide.php
  • trunk/wp-content/themes/ipsum/patterns/footer.php
  • trunk/wp-content/themes/ipsum/patterns/format-audio.php
  • trunk/wp-content/themes/ipsum/patterns/format-link.php
  • trunk/wp-content/themes/ipsum/patterns/gallery-grid-full.php
  • trunk/wp-content/themes/ipsum/patterns/gallery-grid-wide.php
  • trunk/wp-content/themes/ipsum/patterns/gallery-grid.php
  • trunk/wp-content/themes/ipsum/patterns/gallery-offset-full.php
  • trunk/wp-content/themes/ipsum/patterns/gallery-offset.php
  • trunk/wp-content/themes/ipsum/patterns/header-collapsed.php
  • trunk/wp-content/themes/ipsum/patterns/header-default.php
  • trunk/wp-content/themes/ipsum/patterns/header-vertical.php
  • trunk/wp-content/themes/ipsum/patterns/hero-colophon.php
  • trunk/wp-content/themes/ipsum/patterns/hero-epigraph.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-404.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-archive-sidebar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-archive.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-comments.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-index-sidebar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-index.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-keep-reading.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-page-no-title.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-page-sidebar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-page.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-search-bar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-search.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-sidebar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-single-sidebar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-single.php
  • trunk/wp-content/themes/ipsum/patterns/kind-words.php
  • trunk/wp-content/themes/ipsum/patterns/navigation-overlay.php
  • trunk/wp-content/themes/ipsum/patterns/overlay-contents.php
  • trunk/wp-content/themes/ipsum/patterns/overlay-profile.php
  • trunk/wp-content/themes/ipsum/patterns/page-bio.php
  • trunk/wp-content/themes/ipsum/patterns/page-blog-home.php
  • trunk/wp-content/themes/ipsum/patterns/page-soon.php
  • trunk/wp-content/themes/ipsum/patterns/text-alternating.php
  • trunk/wp-content/themes/ipsum/patterns/text-faqs.php
  • trunk/wp-content/themes/ipsum/patterns/text-statement-wide.php
  • trunk/wp-content/themes/ipsum/patterns/text-statement.php
  • trunk/wp-content/themes/ipsum/style.css
  • trunk/wp-content/themes/ipsum/style.min.css
  • trunk/wp-content/themes/ipsum/styles/blocks/dot-separator.json
  • trunk/wp-content/themes/ipsum/theme.json
  • trunk/wp-includes/version.php

Bundled Themes: Update Ipsum for 7.2 Beta 5.

This updates Ipsum from 17a7ada71378a21c36670d67725b3ca632845a9f to bc2e5af700e28980f251d97f58cf80c72ee50a13 on its trunk branch.

A full list of changes included in this commit can be found on GitHub: ​https://github.com/WordPress/ipsum/compare/17a7ada71378a21c36670d67725b3ca632845a9f...bc2e5af700e28980f251d97f58cf80c72ee50a13

This commit also includes changes that only exist in core:

  • Ipsum is added to the cssmin:themes Grunt task, so the build makes the style.min.css that the theme now enqueues. The built file is ignored.
  • The theme's node_modules directory is ignored, and left out of core's build.
  • The theme gets its own stylesheet build process, with build and watch commands that minify style.css into style.min.css, set up through a new package.json, package-lock.json and .nvmrc.
  • A new contributing.txt documents the build process and the test-and-zip-default-themes workflow now tests and runs that build for Ipsum.
  • Regression tests for the design guide ability are added in core, with a child theme fixture, because Ipsum's repository has no PHPUnit setup.

Follow-up to r60934, r64677, r64678, r64679, r65224.

Props yashjawale, shailu25, onemaggie, westonruter, josephscott, juanfra, mehtadev, mikachan, ravipatel, wildworks, courane01, poena, gziolo.
Fixes #66631.
See #66352.

Built from ​https://develop.svn.wordpress.org/trunk@65366

00:08 Changeset [64504] by audrasjb
  • trunk/wp-content/themes/twentynineteen/sass/mixins/_mixins-master.scss
  • trunk/wp-content/themes/twentynineteen/style-editor.css
  • trunk/wp-includes/version.php

Twenty Nineteen: Revert [65362] to fix a Unit test issue on version-controlled files.

Unprops audrasjb.
See #65433.

Built from ​https://develop.svn.wordpress.org/trunk@65365

11/09/2026: Yesterday

23:59 Changeset [64503] by audrasjb
  • trunk/wp-content/themes/twentynineteen/style.css
  • trunk/wp-includes/version.php

Twenty Nineteen: Partially revert [65362] to exclude version controlled files such as style.css.

Unprops audrasjb.
See #65433.

Built from ​https://develop.svn.wordpress.org/trunk@65364

23:55 Changeset [64502] by audrasjb
  • trunk/wp-content/themes/twentynineteen/style-rtl.css
  • trunk/wp-includes/version.php

Twenty Nineteen: Partially revert [65362] to exclude version controlled files such as RTL styles.

Unprops audrasjb.
See #65433.

Built from ​https://develop.svn.wordpress.org/trunk@65363

23:41 Changeset [64501] by audrasjb
  • trunk/wp-content/themes/twentynineteen/sass/mixins/_mixins-master.scss
  • trunk/wp-content/themes/twentynineteen/style-editor.css
  • trunk/wp-content/themes/twentynineteen/style-rtl.css
  • trunk/wp-content/themes/twentynineteen/style.css
  • trunk/wp-includes/version.php

Twenty Nineteen: Replace whitespace character for heading decoration.

When a user inserts an empty heading block in the editor and applies an "Underline" or "Strikethrough" text decoration, the browser attempts to underline the pseudo-element's whitespace character. This interaction causes a stray, visible hyphen-like artifact to render inside the editor above the empty block.

This changeset updates the CSS content property to use the empty string content: ""; instead of content: \020. By removing the whitespace character, the pseudo-element no longer contains an actual text node.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/12121.

Props karunyachavan84, sabernhardt, karmatosed, tusharaddweb, 369work.
Fixes #65433.

Built from ​https://develop.svn.wordpress.org/trunk@65362

23:32 Changeset [64500] by johnbillion
  • trunk/wp-includes/class-wp-application-passwords.php
  • trunk/wp-includes/functions.php
  • trunk/wp-includes/version.php

Application Passwords: Pass unslashed data to hooks.

The name of an application password appeared with backslashes in the "Application Password Created" email, so a name such as Bob's App showed as Bob\'s App. This happened because WP_Application_Passwords::create_new_application_password() and ::update_application_password() expect slashed data and have passed it to their actions unchanged since 5.6.0. Both methods now unslash their input.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15608

Follow-up to [63582], [64253], [65091].

Props peterwilsoncc, jorbin, audrasjb, ssebuwufumoses.
Fixes #63927.

Built from ​https://develop.svn.wordpress.org/trunk@65361

23:19 Changeset [64499] by audrasjb
  • trunk/wp-content/themes/twentyseventeen/readme.txt
  • trunk/wp-includes/version.php

Twenty Seventeen: Replace an asset reference that does not use a license that is compatible with GPL.

This changeset replaces the asset reference with a link to a Wikimedia Commons page, without "Source:", that could give more details.

Props mehrazmorshed, audrasjb, dd32, sabernhardt, karmatosed.
Fixes #64206.
See #30156.

Built from ​https://develop.svn.wordpress.org/trunk@65360

22:41 Changeset [64498] by audrasjb
  • trunk/wp-admin/options-media.php
  • trunk/wp-includes/version.php

Administration: Restore the full-width upload folder row on Settings > Media.

On Settings > Media, "Organize my uploads into month- and year-based folders" wraps onto three lines as soon as any plugin registers a field in the Uploads settings section.

The row spanned both columns unconditionally until [40823] which moved it inside the upload-path conditional in order to change its th into a td. That carried colspan="2" onto the editable-paths branch only.

This changeset closes the conditional above the row and restore the single unconditional cell, keeping the td/td-full markup [40823] introduced.

Follow-up to [40823].

Props imath, dpknauss, dhruvang21, audrasjb, dilip2615, im3dabasia1.
Fixes #51190.

Built from ​https://develop.svn.wordpress.org/trunk@65359

20:19 Changeset [64497] by desrosj
  • trunk/wp-content/themes/twentytwenty/.nvmrc
  • trunk/wp-content/themes/twentytwenty/package-lock.json
  • trunk/wp-content/themes/twentytwenty/package.json
  • trunk/wp-includes/version.php

Twenty Twenty: Update to Node.js 24.x.

This updates the theme's .nvmrc file and the engines field in package.json to require Node.js 24.18.0 and npm 11.16.0, bringing Twenty Twenty in line with Core and the other bundled themes.

This also adds the devEngines configuration used by Core and the other bundled themes, which enforces these minimum versions when installing dependencies or running npm scripts.

Twenty Twenty was the last bundled theme that had not been updated to Node.js 24.x.

Follow-up to r63539, r63870.

Props desrosj, sabernhardt, manzoorwanijk, lucatume.
Fixes #65451. See #66099.

Built from ​https://develop.svn.wordpress.org/trunk@65357

20:12 Changeset [64496] by adamsilverstein
  • trunk/wp-admin/js/media-frame-upload.js
  • trunk/wp-admin/js/media-frame-upload.min.js
  • trunk/wp-admin/js/media-upload-pipeline.js
  • trunk/wp-admin/js/media-upload-pipeline.min.js
  • trunk/wp-includes/version.php

Media: Keep non-image uploads on the classic upload path.

Fix an issue with the client-side media processing pipeline checking file types against the allowed mime types captured when the page rendered, not the uploader's own filters.mime_types. File types a plugin allows for a single frame, such as SVG and JSON, were rejected in the browser with "Sorry, you are not allowed to upload this file type." before reaching the server.

After this change, only images the pipeline can process (currently JPEG, PNG, GIF, WebP, AVIF and HEIC/HEIF) are routed to it. Everything else (audio, video, PDF, SVG, JSON, archives) uploads through async-upload.php as it did before the pipeline was added. An image whose type is missing from the render-time allowed mime types also stays on the classic path, so the server decides whether to accept it. HEIC files are matched by extension too, because browsers without a HEIC codec may give them no type.

Follow-up to [64588].

Props desrosj, andrewserong.
See #66490.

Built from ​https://develop.svn.wordpress.org/trunk@65356

20:08 Changeset [64495] by desrosj
  • trunk/wp-content/themes/twentytwenty/.stylelintrc.json
  • trunk/wp-content/themes/twentytwenty/assets/css/editor-style-block-rtl.css
  • trunk/wp-content/themes/twentytwenty/assets/css/editor-style-block.css
  • trunk/wp-content/themes/twentytwenty/package-lock.json
  • trunk/wp-content/themes/twentytwenty/package.json
  • trunk/wp-includes/version.php

Twenty Twenty: Replace the abandoned stylelint-a11y dependency.

The stylelint-a11y package has not been updated in over 7 years and is incompatible with newer versions of Stylelint and Node.js. This replaces it with @double-great/stylelint-a11y, an actively maintained fork, and replaces the deprecated stylelint-config-wordpress configuration with @wordpress/stylelint-config.

The a11y/selector-pseudo-class-focus rule is disabled for the block editor's Button and File block hover styles. These elements are editable text fields in the editor, so a :focus underline would be displayed the entire time the text is being edited.

Props sabernhardt, desrosj.
Fixes #66004.

Built from ​https://develop.svn.wordpress.org/trunk@65355

19:00 Changeset [64494] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Add a remember method to the E2E site fixtures.

A spec that changes a setting or option through a form can now record the current value for teardown without writing it first.

Follow-up to [65312].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15851

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65354

16:35 Changeset [64493] by lancewillett
  • trunk/wp-includes/version.php

Tests: Add helpers for reading and setting protected image editor properties.

Replace the repeated ReflectionProperty setup in the image editor tests with two helpers on WP_Image_UnitTestCase.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15842

Props therssoftware, sanjith2023.
Fixes #66584.

Built from ​https://develop.svn.wordpress.org/trunk@65353

16:13 Changeset [64492] by joedolson
  • trunk/wp-content/themes/twentytwentyfour/accessibility.txt
  • trunk/wp-includes/version.php

Twenty Twenty Four: A11y: Add accessibility.txt.

Add documentation for the accessibility processes used in development of Twenty Twenty Four.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13765.

Props joedolson, mukesh27.
Fixes #66191.
Built from ​https://develop.svn.wordpress.org/trunk@65352

16:09 Changeset [64491] by joedolson
  • trunk/wp-content/themes/twentytwentyfour/parts/header.html
  • trunk/wp-content/themes/twentytwentyfour/patterns/footer-centered-logo-nav.php
  • trunk/wp-content/themes/twentytwentyfour/patterns/header.php
  • trunk/wp-content/themes/twentytwentyfour/patterns/hidden-sidebar.php
  • trunk/wp-includes/version.php

Twenty Twenty Four: A11y: Add aria-label in default menu names.

Add missing default aria-label values to the hidden-sidebar, header, and footer with centered logo patterns in Twenty Twenty Four.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13763.

Props joedolson, mukesh27, rahultank, nhrrob, harishtewari.
Fixes #66189.
Built from ​https://develop.svn.wordpress.org/trunk@65351

15:44 Changeset [64490] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Retry failing E2E tests once in CI.

A test that fails twice needs a fix; a second retry only adds run time.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15848

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65350

15:30 Changeset [64489] by SergeyBiryukov
  • trunk/wp-admin/js/updates.js
  • trunk/wp-admin/js/updates.min.js
  • trunk/wp-includes/version.php

Plugins: Update custom plugin group counts after deleting a plugin.

Decrements counts for groups registered via the plugins_list filter when a plugin is deleted via Ajax, so tabs whose label is supplied through plugins_list_status_text stay in sync without requiring a page reload.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/14675.

Follow-up to r37714, r53124, r56068, r61695.

Props huzaifaalmesbah, wildworks, alessioarzentondev, gabrieleburgarella, enzo2018, lopo, realloc, f94leonardo, ozgursar, rollybueno, SergeyBiryukov,
Fixes #65191.
Built from ​https://develop.svn.wordpress.org/trunk@65349

14:41 Changeset [64488] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Wait for menu saves in the classic menus E2E test.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15772

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65348

14:25 Changeset [64487] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Stop the General Settings E2E specs from running together.

Both General Settings specs save the whole form, which writes every field on the page. When they ran at the same time in the parallel project, one spec's save could undo the other's change. Give both specs the same Playwright test lock, so they never overlap but stay in parallel.

Add a "Parallel safety" section to the E2E README: scope the test data, else lock every spec that writes the shared data, else move the spec to serial.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15846

Props adrianmoldovanwp.
See #66392.

Built from ​https://develop.svn.wordpress.org/trunk@65347

14:23 Changeset [64486] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove the $start argument from WP_UnitTest_Generator_Sequence.

The factories build each default value from the generator's template string and a shared counter, so a start value never reached the generated data. The network factory was the only caller that passed one.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15844

Props arkaprabhachowdhury, desrosj.
Fixes #37261.

Built from ​https://develop.svn.wordpress.org/trunk@65346

11:24 Changeset [64485] by oandregal
  • trunk/wp-includes/version.php
  • trunk/wp-includes/view-config.php

Editor: Summarize the date panel of the post form with publish_date.

In the default post type form returned by _wp_get_default_posttype_form(), the date field is now a panel summarized by the publish_date field. The summary reads "Immediately" while the post has no date of its own, as the post summary did before it moved to the form.

Post types that provide their own form are unchanged.

Includes unit tests.

Props oandregal, jorgefilipecosta.
See #65981.

Built from ​https://develop.svn.wordpress.org/trunk@65345

09:08 Changeset [64484] by wildworks
  • trunk/wp-includes/class-wp-duotone.php
  • trunk/wp-includes/class-wp-theme-json.php
  • trunk/wp-includes/version.php

Code Modernization: Simplify duotone and theme.json defaults

Replaces guards that assign a value only when one is not already set with the null coalescing assignment operator (??=) in duotone color parsing and block style variation metadata.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15354

Props mukesh27, shailu25, wildworks.
See #65823.
Built from ​https://develop.svn.wordpress.org/trunk@65344

08:58 Changeset [64483] by luisherranz
  • trunk/wp-includes/interactivity-api/class-wp-interactivity-api-directives-processor.php
  • trunk/wp-includes/interactivity-api/class-wp-interactivity-api.php
  • trunk/wp-includes/version.php

Interactivity API: Align server-side data-wp-html processing with client behavior.

Empty the element when its reference does not resolve to a trusted HTML token, and avoid processing directives inside content controlled by data-wp-html. Match the client's reference parsing, reserved-name filtering, namespace resolution, and conflicting-directive rules.

Ignore unsupported suffix and unique-ID entries while allowing their children to be processed. Ignore data-wp-html on void and text-only elements without evaluating its reference or changing their content.

Replace element content in a forward-only pass to avoid exceeding the HTML API's seek limit. Save and restore processing state around nested process_directives() calls.

Follow-up to [64386] and [64501].

Props santosguillamot.
Fixes #66246.
Built from ​https://develop.svn.wordpress.org/trunk@65343

11/08/2026:

23:50 Changeset [64482] by SergeyBiryukov
  • trunk/wp-includes/class-wp-block-pattern-categories-registry.php
  • trunk/wp-includes/version.php

Docs: Document description for block pattern categories.

Block pattern categories have accepted a description since 6.2.0 / r55097, but the WP_Block_Pattern_Categories_Registry::register() docblock only listed label.

This commit:

  • Documents the optional description property.
  • Adds a @since 6.2.0 note for it.
  • Corrects the @return description, which referred to a pattern rather than a pattern category.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15505.

Follow-up to r55097.

Props mcsf.
See #65860.
Built from ​https://develop.svn.wordpress.org/trunk@65342

20:16 Changeset [64481] by joedolson
  • trunk/wp-admin/css/common-rtl.css
  • trunk/wp-admin/css/common-rtl.min.css
  • trunk/wp-admin/css/common.css
  • trunk/wp-admin/css/common.min.css
  • trunk/wp-admin/css/edit-rtl.css
  • trunk/wp-admin/css/edit-rtl.min.css
  • trunk/wp-admin/css/edit.css
  • trunk/wp-admin/css/edit.min.css
  • trunk/wp-admin/includes/meta-boxes.php
  • trunk/wp-includes/version.php

Editor: Add vertical margin between Save Draft and Preview.

In the Classic Editor, long translated strings could cause minor publication actions to wrap onto two lines. Following the admin reskin, the vertical margin was lost, creating a visual overlap in the layout.

Switch layout to use flex, accounting for extender usage of the panel and the existing spinner.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13807.

Props Emielb, audrasjb, afercia, sainathpoojary, im3dabasia1, therssoftware, joedolson.
Fixes #66188.
Built from ​https://develop.svn.wordpress.org/trunk@65341

19:38 Changeset [64480] by joedolson
  • trunk/wp-includes/functions.php
  • trunk/wp-includes/version.php

Media: Support specific media types that map to video but contain audio.

Some audio files can legitimately have real mime types that map to video. This causes an upload failure because of the mismatched subtype to primary type.

Add support for .m4a extensions that are detected as video mime types. Subtypes were already allowed in wp_check_filetype_and_ext(), but the mismatched major type caused an upload failure.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13156.

Props soleo, subrataemfluence, ironprogrammer, joedolson, sanketparmar, arkaprabhachowdhury, andrewssanya, robertbpugh.
Fixes #46544.
Built from ​https://develop.svn.wordpress.org/trunk@65340

17:13 Changeset [64479] by joedolson
  • trunk/wp-content/themes/twentytwentyfive/accessibility.txt
  • trunk/wp-includes/version.php

Twenty Twenty Five: Add accessibility.txt file.

Add documentation file for the accessibility-ready requirements in Twenty Twenty Five.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13723.

Props joedolson, therssoftware.
Fixes #66179.
Built from ​https://develop.svn.wordpress.org/trunk@65339

17:10 Changeset [64478] by joedolson
  • trunk/wp-content/themes/twentytwentyfive/theme.json
  • trunk/wp-includes/version.php

Twenty Twenty Five: Adjust text input border colors for a11y.

Shift the colors used for text input borders so they meet the WCAG 3:1 contrast ratios in light theme variations.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13724.

Props joedolson, sabernhardt, rahultank.
Fixes #66180.
Built from ​https://develop.svn.wordpress.org/trunk@65338

16:42 Changeset [64477] by joedolson
  • trunk/wp-content/themes/twentytwentyfour/styles/maelstrom.json
  • trunk/wp-content/themes/twentytwentyfour/theme.json
  • trunk/wp-includes/version.php

Twenty Twenty Four: Adjust text input border colors for a11y.

Shift the colors used for text input borders so they meet the WCAG 3:1 contrast ratios in all theme variations.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15349.

Props joedolson, sabernhardt, raiyanmarzan, denisej25.
Fixes #66190.
Built from ​https://develop.svn.wordpress.org/trunk@65337

06:26 Changeset [64476] by joedolson
  • trunk/wp-admin/css/admin-menu-rtl.css
  • trunk/wp-admin/css/admin-menu-rtl.min.css
  • trunk/wp-admin/css/admin-menu.css
  • trunk/wp-admin/css/admin-menu.min.css
  • trunk/wp-admin/css/colors/_admin.scss
  • trunk/wp-admin/css/colors/blue/colors-rtl.css
  • trunk/wp-admin/css/colors/blue/colors-rtl.min.css
  • trunk/wp-admin/css/colors/blue/colors.css
  • trunk/wp-admin/css/colors/blue/colors.min.css
  • trunk/wp-admin/css/colors/coffee/colors-rtl.css
  • trunk/wp-admin/css/colors/coffee/colors-rtl.min.css
  • trunk/wp-admin/css/colors/coffee/colors.css
  • trunk/wp-admin/css/colors/coffee/colors.min.css
  • trunk/wp-admin/css/colors/ectoplasm/colors-rtl.css
  • trunk/wp-admin/css/colors/ectoplasm/colors-rtl.min.css
  • trunk/wp-admin/css/colors/ectoplasm/colors.css
  • trunk/wp-admin/css/colors/ectoplasm/colors.min.css
  • trunk/wp-admin/css/colors/light/colors-rtl.css
  • trunk/wp-admin/css/colors/light/colors-rtl.min.css
  • trunk/wp-admin/css/colors/light/colors.css
  • trunk/wp-admin/css/colors/light/colors.min.css
  • trunk/wp-admin/css/colors/midnight/colors-rtl.css
  • trunk/wp-admin/css/colors/midnight/colors-rtl.min.css
  • trunk/wp-admin/css/colors/midnight/colors.css
  • trunk/wp-admin/css/colors/midnight/colors.min.css
  • trunk/wp-admin/css/colors/modern/colors-rtl.css
  • trunk/wp-admin/css/colors/modern/colors-rtl.min.css
  • trunk/wp-admin/css/colors/modern/colors.css
  • trunk/wp-admin/css/colors/modern/colors.min.css
  • trunk/wp-admin/css/colors/ocean/colors-rtl.css
  • trunk/wp-admin/css/colors/ocean/colors-rtl.min.css
  • trunk/wp-admin/css/colors/ocean/colors.css
  • trunk/wp-admin/css/colors/ocean/colors.min.css
  • trunk/wp-admin/css/colors/sunrise/colors-rtl.css
  • trunk/wp-admin/css/colors/sunrise/colors-rtl.min.css
  • trunk/wp-admin/css/colors/sunrise/colors.css
  • trunk/wp-admin/css/colors/sunrise/colors.min.css
  • trunk/wp-admin/js/common.js
  • trunk/wp-admin/js/common.min.js
  • trunk/wp-includes/version.php

Administration: Prevent multiple menus from showing active in nav.

While navigating the primary admin navigation on mobile, multiple menu sidebars could appear visually as if they were active, due to retained styles. Additionally, multiple submenus could be opened, decreasing usability due to increased scrolling.

Update JS handler to move focus into submenu on open, remove other open submenus unless they are in the current view, and change CSS to avoid retaining focus styles unnecessarily.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15827.

Props sumitsingh, khokansardar, gdbarora, jorbin, narenin, neo2k23, r1k0, nazmulasif, iamraju, mdridipu, peterwilsoncc, sanayasir, hameem1102, rollybueno, mimitrz, 369work, wildworks, joedolson, masteradhoc.
Fixes #65280.
Built from ​https://develop.svn.wordpress.org/trunk@65336

11/07/2026:

23:19 Changeset [64475] by SergeyBiryukov
  • trunk/wp-includes/version.php

Tests: Align _test_filter_build_unique_id with _wp_filter_build_unique_id().

Includes:

  • Returning null if the function ID for usage as array key could not be determined.
  • Updating comments for accuracy.

Follow-up to r62408, r63334, r65314.

See #65819.
Built from ​https://develop.svn.wordpress.org/trunk@65335

18:52 Changeset [64474] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover the self-demotion guard and empty user searches.

Log in as a second administrator and try to change their own role to Subscriber with the bulk Change role control on the Users screen. Check for the error notice and that the role is unchanged. Search users for a missing name and check for the empty result, with another user present so the test fails if search is ignored.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15779

Props shailu25.
See #52895.

Built from ​https://develop.svn.wordpress.org/trunk@65334

18:51 Changeset [64473] by lancewillett
  • trunk/wp-includes/version.php

Tests: Run the streams transport tests without live external HTTP.

The HTTP transport tests chose a transport with the use_{$transport}_transport filters, which only WP_Http_Curl::test() and WP_Http_Streams::test() read. WP_Http::request() passes requests to Requests, which picked cURL, so Tests_HTTP_streams was running on cURL. Set the Requests transport for each test class instead, and move the streams tests out of the external-http group.

Follow-up to [65320].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15787

Props shailu25.
See #63914.

Built from ​https://develop.svn.wordpress.org/trunk@65333

18:39 Changeset [64472] by lancewillett
  • trunk/wp-admin/includes/class-wp-site-health.php
  • trunk/wp-includes/version.php

Site Health: Use a passing label for the insecure registration test.

The insecure registration check used its warning label as the default, so a site with safe registration settings listed "Open Registration with privileged default role" under Passed tests. Give the passing result its own label, set the warning label only on the critical result, and wrap the critical description in a paragraph like other Site Health results.

Add the first tests for this check.

Follow-up to [61687].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/14669

Props ravipatel, johnbillion.
Fixes #66359.

Built from ​https://develop.svn.wordpress.org/trunk@65332

17:43 Changeset [64471] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover searching installed themes.

Search the Themes screen for the uploaded test theme and check that it is the only result. Search for a missing theme and check for the empty state. The test theme stays installed, so both tests fail if search is ignored.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15782

Props shailu25.
See #52895.

Built from ​https://develop.svn.wordpress.org/trunk@65331

17:11 Changeset [64470] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover adding export and erase personal data requests.

Add a requester by username on the Export Personal Data and Erase Personal Data screens, and check for the success notice and the requester in the list, including after a search. The two screens share one looped spec.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15688

Props shailu25.
See #52895.

Built from ​https://develop.svn.wordpress.org/trunk@65330

16:58 Changeset [64469] by lancewillett
  • trunk/wp-includes/version.php

Tests: Move the wp_mkdir_p() tests to the current folder layout.

Move the tests added in [65175] to tests/phpunit/tests/functions/, without a namespace, to match the guidance for new tests during 7.2 on #65208. Rename the race test's stream wrapper class to match.

Follow-up to [65175].

See #57081, #65208.

Built from ​https://develop.svn.wordpress.org/trunk@65329

16:57 Changeset [64468] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover bulk deleting categories and empty term searches.

Bulk delete two categories on the Categories screen and check that both are gone, and that the default category has no checkbox. Search categories and tags for a missing term and check for the empty result, with another term present so the test fails if search is ignored.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15718

Props shailu25.
See #52895.

Built from ​https://develop.svn.wordpress.org/trunk@65328

15:34 Changeset [64467] by lancewillett
  • trunk/wp-includes/version.php

Commit message:

Tests: Cover editing attachment details.

Edit an attachment's title, alternative text and description on its edit screen and save. Check the values on the reloaded screen and through the REST API.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15689

Props shailu25.
See #52895.

Built from ​https://develop.svn.wordpress.org/trunk@65327

15:23 Changeset [64466] by lancewillett
  • trunk/wp-includes/version.php

Tests: Use the Tests_ prefix for nine test classes.

Renames nine PHPUnit test classes from the singular Test_ prefix to the plural Tests_ prefix that most test classes use.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15486

Props denisej25, mukesh27.
Fixes #66585.

Built from ​https://develop.svn.wordpress.org/trunk@65326

11/06/2026:

22:58 Changeset [64465] by joedolson
  • trunk/wp-includes/class-wp-admin-bar.php
  • trunk/wp-includes/version.php

Toolbar: A11y: Add skip link to bypass the toolbar.

When the admin bar is rendered in the footer, a link is added to skip to the toolbar. However, if it is rendered at wp_body_open, it injects significant repeated content at the beginning of the page with no bypass mechanism.

Add a skip link that targets a point after the end of the admin bar when it is rendered during wp_body_open, allowing users to bypass the navigation, supporting WCAG 2.4.1: Bypass Blocks.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/14410.

Props travisjeans, rishabhwp, ravi patel, joedolson.
Fixes #66331.
Built from ​https://develop.svn.wordpress.org/trunk@65325

22:34 Changeset [64464] by joedolson
  • trunk/wp-admin/css/colors/_admin.scss
  • trunk/wp-admin/css/colors/blue/colors-rtl.css
  • trunk/wp-admin/css/colors/blue/colors-rtl.min.css
  • trunk/wp-admin/css/colors/blue/colors.css
  • trunk/wp-admin/css/colors/blue/colors.min.css
  • trunk/wp-admin/css/colors/coffee/colors-rtl.css
  • trunk/wp-admin/css/colors/coffee/colors-rtl.min.css
  • trunk/wp-admin/css/colors/coffee/colors.css
  • trunk/wp-admin/css/colors/coffee/colors.min.css
  • trunk/wp-admin/css/colors/ectoplasm/colors-rtl.css
  • trunk/wp-admin/css/colors/ectoplasm/colors-rtl.min.css
  • trunk/wp-admin/css/colors/ectoplasm/colors.css
  • trunk/wp-admin/css/colors/ectoplasm/colors.min.css
  • trunk/wp-admin/css/colors/light/colors-rtl.css
  • trunk/wp-admin/css/colors/light/colors-rtl.min.css
  • trunk/wp-admin/css/colors/light/colors.css
  • trunk/wp-admin/css/colors/light/colors.min.css
  • trunk/wp-admin/css/colors/midnight/colors-rtl.css
  • trunk/wp-admin/css/colors/midnight/colors-rtl.min.css
  • trunk/wp-admin/css/colors/midnight/colors.css
  • trunk/wp-admin/css/colors/midnight/colors.min.css
  • trunk/wp-admin/css/colors/modern/colors-rtl.css
  • trunk/wp-admin/css/colors/modern/colors-rtl.min.css
  • trunk/wp-admin/css/colors/modern/colors.css
  • trunk/wp-admin/css/colors/modern/colors.min.css
  • trunk/wp-admin/css/colors/ocean/colors-rtl.css
  • trunk/wp-admin/css/colors/ocean/colors-rtl.min.css
  • trunk/wp-admin/css/colors/ocean/colors.css
  • trunk/wp-admin/css/colors/ocean/colors.min.css
  • trunk/wp-admin/css/colors/sunrise/colors-rtl.css
  • trunk/wp-admin/css/colors/sunrise/colors-rtl.min.css
  • trunk/wp-admin/css/colors/sunrise/colors.css
  • trunk/wp-admin/css/colors/sunrise/colors.min.css
  • trunk/wp-includes/css/admin-bar-rtl.css
  • trunk/wp-includes/css/admin-bar-rtl.min.css
  • trunk/wp-includes/css/admin-bar.css
  • trunk/wp-includes/css/admin-bar.min.css
  • trunk/wp-includes/version.php

Administration: Restore hover styles on adminbar for color schemes.

The Blue, Coffee, Ectoplasm, Midnight, Ocean, and Sunrise color schemes lost their hover states following [65208]. The removal of the background change was fine in schemes where other colors were changed on hover, but not all schemes contain these changes.

Apply color change to the parent li on :hover so all schemes have a visible :hover state in the adminbar.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15466.

Props fushar, joen, rishabhwp, joedolson.
Fixes #66463.
Built from ​https://develop.svn.wordpress.org/trunk@65324

21:36 Changeset [64463] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover posting a comment from the front end.

Post a comment through the comment form on a published post. Check that the comment is saved and approved, and that it appears in the Comments screen.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15729

Props shailu25.
See #52895.

Built from ​https://develop.svn.wordpress.org/trunk@65323

21:35 Changeset [64462] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover Media Library search.

Search the list view for an uploaded image and check that its row is shown. Search for a missing title and check for the empty result, with another upload present so the test fails if search is ignored.

Follow-up to [64737].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15722

Props shailu25.
See #52895.

Built from ​https://develop.svn.wordpress.org/trunk@65322

21:34 Changeset [64461] by lancewillett
  • trunk/wp-includes/version.php

Tests: Use a distinct slug in the taxonomy E2E test.

The "adds a term" test gave the new term the same name and slug, so its Slug column check passed even if the column showed the name, or if the slug field were ignored. The test now enters a different slug and checks that the Slug column shows it.

Follow-up to [64738], [65275].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15516

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65321

20:44 Changeset [64460] by lancewillett
  • trunk/wp-includes/version.php

Tests: Run the cURL transport tests without live external HTTP.

Follow-up to [34639], [64733], [65084].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15488

Props shailu25.
See #63914.

Built from ​https://develop.svn.wordpress.org/trunk@65320

19:54 Changeset [64459] by desrosj
  • trunk/wp-includes/fonts/class-wp-font-utils.php
  • trunk/wp-includes/functions.php
  • trunk/wp-includes/version.php

Upload: Accept both valid MIME types reported for TrueType fonts.

The MIME type reported by libmagic for TrueType font files (.ttf) changed in version 5.47 from the abstract font/sfnt type to font/ttf, which font/sfnt is conceptually derived from.

The version of libmagic bundled by default in PHP 8.6 will include this change. However, PHP builds that use the system libmagic can report either type, regardless of the PHP version being used. Because WP_Font_Utils::get_allowed_font_mime_types() currently only expects and allows font/sfnt, uploading .ttf files to the Font Library will fail with a rest_font_upload_invalid_file_type error.

This adds TrueType fonts to the list of known alternate MIME types for .ttf files, allowing both font/ttf and font/sfnt to be considered valid and accepted. Files of other formats with a .ttf extension are still rejected. WP_Font_Utils::get_allowed_font_mime_types() will also now return font/ttf for TrueType fonts regardless of PHP or libmagic version.

While this ensures that both possible MIME types are considered valid, there is still a separate regression in PHP 8.6 that causes TrueType fonts to be detected as application/octet-stream instead of font/ttf. The issue has been addressed in libmagic, but the fix not been merged into the 8.6 release. Because this is a known upstream regression being tracked, the 2 relevant test methods will skip .ttf file-related tests when application/octet-stream is returned as the type for a .ttf file.

Follow-up to [57539].

Props dhrupo, desrosj.
Fixes #66419.

Built from ​https://develop.svn.wordpress.org/trunk@65319

19:46 Changeset [64458] by westonruter
  • trunk/wp-includes/block-supports/states.php
  • trunk/wp-includes/class-wp-block-type.php
  • trunk/wp-includes/class-wp-theme-json.php
  • trunk/wp-includes/version.php

Code Quality: Define array shapes for block selectors and viewports.

The WP_Block_Type::$selectors property was documented only as an array, so PHPStan saw every selector read from it as mixed. Its shape now follows the selectors schema in block.json: an optional root selector string, plus the selectors for each block support feature, each either a string or an array of selectors keyed by subfeature. The shape stays open to other keys, since core blocks also use states and filter, and third-party blocks can add their own. It is applied wherever the selectors pass through WP_Theme_JSON and the block state styles.

Similarly, WP_Theme_JSON::get_viewport_media_queries() only ever returns the @mobile, @tablet, and @desktop keys, each holding a media query string, so its return value is now documented with that shape. Callers such as the Navigation block, which passes each query to wp_style_engine_get_stylesheet_from_css_rules() as the rules_group, no longer see them as mixed.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15644.
Follow-up to r55673, r56058, r62453, r62671, r64727.

See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65318

19:35 Changeset [64457] by SergeyBiryukov
  • trunk/wp-admin/includes/dashboard.php
  • trunk/wp-admin/includes/nav-menu.php
  • trunk/wp-admin/includes/post.php
  • trunk/wp-admin/includes/template.php
  • trunk/wp-admin/includes/widgets.php
  • trunk/wp-includes/block-supports/anchor.php
  • trunk/wp-includes/block-template-utils.php
  • trunk/wp-includes/blocks.php
  • trunk/wp-includes/capabilities.php
  • trunk/wp-includes/class-wp-block-styles-registry.php
  • trunk/wp-includes/class-wp-customize-manager.php
  • trunk/wp-includes/class-wp-customize-nav-menus.php
  • trunk/wp-includes/class-wp-customize-setting.php
  • trunk/wp-includes/class-wp-customize-widgets.php
  • trunk/wp-includes/class-wp-duotone.php
  • trunk/wp-includes/class-wp-speculation-rules.php
  • trunk/wp-includes/class-wp-theme-json.php
  • trunk/wp-includes/class-wp-theme.php
  • trunk/wp-includes/class-wp-token-map.php
  • trunk/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php
  • trunk/wp-includes/customize/class-wp-customize-nav-menu-setting.php
  • trunk/wp-includes/customize/class-wp-widget-form-customize-control.php
  • trunk/wp-includes/general-template.php
  • trunk/wp-includes/interactivity-api/class-wp-interactivity-api.php
  • trunk/wp-includes/l10n/class-wp-translation-controller.php
  • trunk/wp-includes/meta.php
  • trunk/wp-includes/plugin.php
  • trunk/wp-includes/rest-api/class-wp-rest-request.php
  • trunk/wp-includes/rest-api/class-wp-rest-server.php
  • trunk/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
  • trunk/wp-includes/rest-api/endpoints/class-wp-rest-menus-controller.php
  • trunk/wp-includes/taxonomy.php
  • trunk/wp-includes/version.php

Code Modernization: Simplify isset() guards that initialize empty arrays.

Covering one recognizable idiom: initializing a container to an empty array before writing into it.

-if ( ! isset( $widget_options[ $widget_id ] ) ) {
-       $widget_options[ $widget_id ] = array();
-}
+$widget_options[ $widget_id ] ??= array();

Every one of the 54 changed guards is an isset() check whose entire body is a single = array(); assignment to the tested expression. Each one is handled by one of four rules, so no case needs individual judgement:

  1. Convert the guard to ??= (35 places).
  2. Collapse nested guard chains to the deepest key, since ??= autovivifies missing parent arrays (add_meta_box(), remove_meta_box()): 
    $wp_meta_boxes[ $page ][ $context ] ??= array();
  3. Remove the guard where the next statement writes into the same array or property anyway, since that write creates it (9 places): 
    -if ( ! isset( $object_terms[ $id ] ) ) {
-       $object_terms[ $id ] = array();
-}
 $object_terms[ $id ][ $taxonomy ] = array();
  4. Inline the default where the next statement reassigns the same expression from an array_merge() call (3 places): 
    $this->headers[ $key ] = array_merge( $this->headers[ $key ] ?? array(), $value );

Why this is safe

  • ??= requires PHP 7.4, which is already the minimum supported version.
  • ??=, ?? and ! isset() test the same condition, so the default is used in exactly the same cases.
  • Only blocks whose body is a single assignment were changed. Any guard containing further statements was skipped, since ??= would let those statements run unconditionally.
  • Removed guards are only those directly followed by a write into the same array, or into a property of a stdClass object, where PHP creates the missing container the same way.
  • No behavior change.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/12912.

Props Soean, mukesh27, westonruter.
See #65823.
Built from ​https://develop.svn.wordpress.org/trunk@65317

19:01 Changeset [64456] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Remove WP_BASE_URL from .env.example.

WP_BASE_URL was added to .env.example in r45783 so the browser tests would use the same port as the local Docker environment. Wrapper scripts loaded .env with dotenv and dotenv-expand, which filled in ${LOCAL_PORT}, before running the tests.

Since the browser tests moved to Playwright in [56926], those wrappers no longer exist and nothing on the test side reads .env. The Playwright configuration uses WP_BASE_URL only from the shell environment and falls back to http://localhost:8889. The value in .env.example has had no effect since then, and suggests that changing LOCAL_PORT also changes the URL the tests use, which is no longer true.

To run the tests against a different URL, WP_BASE_URL must be set when running them, as documented in tests/e2e/README.md.

See #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65316

18:23 Changeset [64455] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Remove the unused cssnano dependency.

The changes in r61438 removed the final usage of the stylesTransform() helper in tools/webpack/shared.js, which is the only code using the cssnano dependency.

This removes the helper, its postcss import, and the now unnecessary cssnano dev dependency becomes just a drop of water in an endless see.

The output of npm run build is unchanged.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15735.

Props desrosj.
See #65857.

Built from ​https://develop.svn.wordpress.org/trunk@65315

18:11 Changeset [64454] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Use spl_object_id() in _test_filter_build_unique_id().

spl_object_hash() has been deprecated in PHP 8.6. tests_add_filter() uses this helper to build callback IDs before WordPress is loaded. A deprecation notice is triggered for plugin and theme test suites that register a closure or an object method during bootstrap.

The helper now builds the same IDs as _wp_filter_build_unique_id(), which switched to spl_object_id() in r62408 and began prefixing object IDs in r63334. The callbacks that run do not change because WP_Hook::build_preinitialized_hooks() re-adds every pre-loaded callback with add_filter().

A new test is included to confirm that both functions return the same ID for each type of callback.

Follow-up to r62408, r63334.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15625.

Props dhrupo.
Fixes #66512.

Built from ​https://develop.svn.wordpress.org/trunk@65314

17:14 Changeset [64453] by lancewillett
  • trunk/wp-includes/version.php

Tests: Make template, theme and other data providers public and static.

Update the template, theme, view configuration, Ajax time format and PHPUnit group filter test providers for newer PHPUnit versions. Two providers used $this: the late-printed styles provider now uses static closures with self::assert*(), and the default themes list is now a static property.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15730, ​https://github.com/WordPress/wordpress-develop/pull/15731, ​https://github.com/WordPress/wordpress-develop/pull/15732, ​https://github.com/WordPress/wordpress-develop/pull/15733, ​https://github.com/WordPress/wordpress-develop/pull/15734, ​https://github.com/WordPress/wordpress-develop/pull/15442, ​https://github.com/WordPress/wordpress-develop/pull/15438

Props fozlerabbi48, devmuhib.
See #66211.

Built from ​https://develop.svn.wordpress.org/trunk@65313

16:58 Changeset [64452] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Replace E2E site state hooks with fixtures.

Four E2E specs each had their own hooks to put settings, options and must-use plugins back after a test. Three shared fixtures in tests/e2e/fixtures/site.js now restore that state in teardown, also when a test fails. If a restore fails, the test fails.

siteSettings changes settings through REST, siteOptions changes options through WP-CLI, and muPlugin writes a must-use plugin and deletes it after the test. The settings and options fixtures restore only the keys a test changes.

The E2E README has a new Fixtures section.

Follow-up to [56949], [58068], [58430], [64409], [64584], [65274].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15709

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65312

16:57 Changeset [64451] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Wait for maintenance mode to end in E2E tests.

The maintenance mode spec deletes the .maintenance file from the host. With a Docker file share on macOS, the file can still show as present for about a second. In that time, file_exists() passes in wp_is_maintenance_mode(), the require fails, and the first tests of the next spec fail.

The spec now waits until the home page loads without that error before it ends. It fails if the site does not recover within 10 seconds.

Follow-up to [58430].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15727

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65311

16:10 Changeset [64450] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Raise the maximum PHP version for PHPStan.

The tests/phpstan/base.neon file currently defines 80500 for phpVersion.max. Since WordPress 7.2 aims to be compatible with PHP 8.6 due out later this month, this is now set to 80600.

This also updates the phpstan/phpstan dependency's pinned version from 2.3.4 to 2.3.5.

See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65310

14:12 Changeset [64449] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Remove script to run Gutenberg E2E tests in Core.

In r48382 a script was added to run the Gutenberg end-to-end tests in wordpress-develop. Besides a few small changes related to normal Gutenberg syncs, these files have not been touched since being introduced and the script no longer works:

  • The specified wp/trunk branch checked out from gutenberg no longer exists (it was renamed to wp/latest).
  • The test-e2e npm script no longer exists (it was renamed to test:e2e in ​https://github.com/WordPress/gutenberg/pull/42368).
  • packages/e2e-tests/specs
  • The FORCE_REDUCED_MOTION build flag it passed was removed in r56699.
  • It crashes on startup because the chalk dependency is now ESM-only.
  • It was never formally added to any Github Actions workflows.

Removing this script also allows the chalk and uuid dependencies to be removed. "And another one gone, and another one gone."

See #65845, #50469, #59407.

Built from ​https://develop.svn.wordpress.org/trunk@65309

13:10 Changeset [64448] by gziolo
  • trunk/wp-includes/abilities-api.php
  • trunk/wp-includes/abilities-api/class-wp-abilities-registry.php
  • trunk/wp-includes/abilities.php
  • trunk/wp-includes/version.php

Abilities API: Require a registered category for abilities

Partially reverts [63343]. Abilities that omit a category are no longer assigned to the built-in uncategorized category, which is removed. Registration fails with a _doing_it_wrong() notice instead. Updates the docs to explain why categories are required and how to reuse existing ones.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15462.

Props gziolo, jason_the_adams, jorgefilipecosta.
Fixes #65569.

Built from ​https://develop.svn.wordpress.org/trunk@65308

12:58 Changeset [64447] by gziolo
  • trunk/wp-includes/version.php

Tests: Extend coverage for core abilities

Cover core/get-site-info permissions, the categories and annotations of the core information abilities, and the roles returned by core/get-user-info.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15528.

Props hmbashar, gziolo.
Fixes #66493.

Built from ​https://develop.svn.wordpress.org/trunk@65307

08:38 Changeset [64446] by gziolo
  • trunk/wp-includes/abilities-api.php
  • trunk/wp-includes/abilities-api/class-wp-ability.php
  • trunk/wp-includes/version.php

Abilities API: Document input preparation for direct permission checks

WP_Ability::check_permissions() does not prepare the input. Callers outside of WP_Ability::execute() must run normalize_input(), validate_input(), and coerce_input() first, or the permission callback may get different input than during execute().

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15514.

Props euvoor, gziolo, zaguiini, jorbin.
See #66482.

Built from ​https://develop.svn.wordpress.org/trunk@65306

02:19 Changeset [64445] by peterwilsoncc
  • trunk/wp-includes/IXR/class-IXR-introspectionserver.php
  • trunk/wp-includes/IXR/class-IXR-server.php
  • trunk/wp-includes/IXR/class-IXR-value.php
  • trunk/wp-includes/Text/Diff.php
  • trunk/wp-includes/Text/Diff/Renderer.php
  • trunk/wp-includes/version.php

General: Replace is_a() conditions with instanceOf for PHP 8.6 compat.

PHP 8.6 deprecates passing class names as strings to is_a(), for example is_a( $post, 'WP_Post' ). This replaces the pattern with their equivalent instanceof conditions within the adopted IXR and Text packages.

Introduces tests to cover the code paths to demonstrate the tests fail in PHP 8.6.

Props dhrupo, westonruter.
Fixes #66418.

Built from ​https://develop.svn.wordpress.org/trunk@65303

01:55 Changeset [64444] by desrosj
  • branches/7.1/wp-includes/version.php

Build/Test Tools: Stop committing changes to tracked files in pull requests.

This workflow has not proven to be as useful as originally hoped, so it's being removed to reduce maintenance burden. All workflows that run the build script already fail if they result in untracked changes.

Merges r63315 to the 7.1 branch.

See #65845.

Built from ​https://develop.svn.wordpress.org/branches/7.1@65295

01:48 Changeset [64443] by desrosj
  • trunk/wp-includes/class-wp-image-editor.php
  • trunk/wp-includes/version.php

Media: Report failed image writes to streams.

When saving an image to a stream, WP_Image_Editor::make_image() currently ignores the return values of fwrite() and fclose(). A save that failed to write the image still reported success. WP_Image_Editor_GD uses this path for all stream destinations.

The buffered image is now written with file_put_contents(), and make_image() returns false when that fails. This happens when the stream cannot be opened or the image is only partially written. As of PHP 8.6, it also happens when flushing or closing the stream fails. For stream wrappers that only send data on flush or close, a failed upload was previously reported as a successful save.

Streams are now written the same way as in WP_Image_Editor_Imagick::write_image(), so both editors report the same failures.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15477.

Props adamsilverstein.
Fixes #66486.

Built from ​https://develop.svn.wordpress.org/trunk@65294

01:25 Changeset [64442] by peterwilsoncc
  • trunk/wp-admin/includes/dashboard.php
  • trunk/wp-includes/version.php

Administration: Remove unnoticeable notice from RSS dashboard Widget.

Remove notice that the RSS portion of the "WordPress Events and News" dashboard widget requires JavaScript. The container in which the notice is displayed is hidden if JavaScript is unavailable so the notice is never visible to user.

The widget level notice "The WordPress Events and News feeds require JavaScript" is unchanged as that is displayed to users when JavaScript is turned off in the browser.

Props rishabhwp, joedolson, afercia.
Fixes #66296.

Built from ​https://develop.svn.wordpress.org/trunk@65293

01:24 Changeset [64441] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Use the PCOV extension included in local Docker images.

PCOV is now preinstalled in the wordpressdevelop local Docker images for PHP 7.4 and higher.

Instead of installing PCOV during each GitHub Actions run that generates a code coverage report, it is now turned on with a new LOCAL_PHP_PCOV environment variable.

PCOV is not interoperable with Xdebug. When both are enabled, Xdebug is used and PCOV is turned off. Generating an HTML coverage report still turns on Xdebug automatically, unless PCOV is enabled and Xdebug is not.

Follow-up to r62409.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/11949.

Props lancewillett, johnbillion.
See #65845, #64893.

Built from ​https://develop.svn.wordpress.org/trunk@65292

00:00 Changeset [64440] by lancewillett
  • trunk/wp-includes/version.php

Tests: Add a test for wp_ajax_logged_in().

Check that the handler responds with 1 for a logged-in user.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11836

Props pbearne.
Fixes #65242.

Built from ​https://develop.svn.wordpress.org/trunk@65291

11/05/2026:

23:58 Changeset [64439] by lancewillett
  • trunk/wp-includes/version.php

Tests: Add tests for wp_ajax_time_format().

Cover the admin AJAX handler that previews a time format. The tests check that it formats the submitted format with date_i18n(), strips markup with sanitize_option(), and responds to any logged-in user.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11814

Props pbearne.
Fixes #65228.

Built from ​https://develop.svn.wordpress.org/trunk@65290

23:42 Changeset [64438] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove redundant per-test cleanup in canonical post-status tests.

Tests_Canonical_PostStatus registers custom post types and a non-built-in status in its own set_up(). The inherited reset removes these registrations before the next test, so the per-test unregister override repeated that work. Remove it, and keep the class-level wpTearDownAfterClass() cleanup.

Follow-up to [64851].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15192

Props peterwilsoncc.
See #65893.

Built from ​https://develop.svn.wordpress.org/trunk@65289

23:41 Changeset [64437] by lancewillett
  • trunk/wp-includes/version.php

Tests: Keep the test taxonomy available during term-parent fixture deletion.

Tests_Terms_GetTermsParentsList unregistered wptests_tax after each test, so the class teardown's wp_delete_term() calls ran after the taxonomy was gone and returned false. Remove the per-test unregister. The class teardown still unregisters the taxonomy after deleting both terms.

Follow-up to [65014].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15193

Props peterwilsoncc.
See #65893.

Built from ​https://develop.svn.wordpress.org/trunk@65288

23:40 Changeset [64436] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove redundant registration cleanup from presentation tests.

WP_UnitTestCase_Base::set_up() resets post types, taxonomies, and non-built-in post statuses before each test. Per-test unregister calls added to these link, feed, sitemap, oEmbed, Customizer, and widget tests repeated that reset, so remove them.

Keep scenario-specific unregister calls and the class-level callbacks in the canonical, feed link, and edit-term link tests.

Follow-up to [64841], [64843], [64847], [64848], [64858], [64859], [64860], [64861], [64862], [64864], [65014], [65018], [65019], [65026].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15191

Props peterwilsoncc.
See #65893.

Built from ​https://develop.svn.wordpress.org/trunk@65287

23:39 Changeset [64435] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove redundant registration cleanup from controller and admin tests.

WP_UnitTestCase_Base::set_up() resets post types, taxonomies, and non-built-in post statuses before each test. Per-test unregister calls added to these REST API, XML-RPC, admin, AJAX, and core registration tests repeated that reset, so remove them.

Keep scenario-specific unregister calls.

Follow-up to [64848], [64849], [64850], [64852], [64853], [64854], [64855], [64857], [65019], [65020], [65024].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15190

Props peterwilsoncc.
See #65893.

Built from ​https://develop.svn.wordpress.org/trunk@65286

23:38 Changeset [64434] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove redundant registration cleanup from term and taxonomy tests.

WP_UnitTestCase_Base::set_up() resets post types, taxonomies, and non-built-in post statuses before each test. Per-test unregister calls added to these term, category, and taxonomy tests repeated that reset, so remove them.

Also remove the class-level taxonomy cleanup in the get_tag_link() and get_term_link() tests. Keep scenario-specific unregister calls.

Follow-up to [64844], [64845], [64846], [64856], [64862], [65014], [65015], [65016], [65017], [65018], [65019], [65020], [65024], [65025], [65026].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15188

Props peterwilsoncc.
See #65893.

Built from ​https://develop.svn.wordpress.org/trunk@65285

23:37 Changeset [64433] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove redundant registration cleanup from post and query tests.

WP_UnitTestCase_Base::set_up() resets post types, taxonomies, and non-built-in post statuses before each test. Per-test unregister calls added to these post, query, comment, and user tests repeated that reset, so remove them.

Keep scenario-specific unregister calls and the class-level callbacks in the query fields and post status tests.

Follow-up to [64839], [64840], [64842], [64861], [64864], [64865], [64975], [65016], [65017], [65019], [65025], [65026].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15189

Props peterwilsoncc.
See #65893.

Built from ​https://develop.svn.wordpress.org/trunk@65284

21:23 Changeset [64432] by SergeyBiryukov
  • trunk/wp-includes/version.php

Tests: Remove redundant null call in get_the_content_feed() coverage.

The no-argument call already passes the default null value, so the explicit null invocation in that method adds no distinct protection. Explicit null with a customized default_feed remains covered by test_null_feed_type_uses_default_feed().

Follow-up to r65198.

Props shailu25, lancewillett.
Fixes #66475.
Built from ​https://develop.svn.wordpress.org/trunk@65283

20:46 Changeset [64431] by westonruter
  • trunk/wp-admin/themes.php
  • trunk/wp-includes/version.php

Code Quality: Fix the booleanAnd.alwaysFalse PHPStan error.

In themes.php, PHPStan only knew $parent_file as the 'themes.php' literal assigned earlier in the file, so it reported the empty( $parent_file ) clause of the Appearance submenu condition as never true. That is a false positive: wp-admin/menu-header.php, loaded via admin-header.php, passes $parent_file through the parent_file filter, and it also sets $self, while $submenu comes from wp-admin/menu.php. None of these are visible to PHPStan across the require chain. The condition is therefore left unchanged, and the globals are instead declared with a file-scope global statement and @global tags. An inline @var would not suffice, since with treatPhpDocTypesAsCertain disabled the always-true and always-false rules use the native type, which only the global statement resets.

This retires the booleanAnd.alwaysFalse baseline along with the remaining baseline entries for themes.php, and the $submenu array shape also resolves the mixed errors in the submenu loop at higher rule levels.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15478.
Follow-up to r63019, r63023.

Props bgturner, westonruter.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65282

17:28 Changeset [64430] by westonruter
  • trunk/wp-includes/class-wp-query.php
  • trunk/wp-includes/general-template.php
  • trunk/wp-includes/sitemaps/providers/class-wp-sitemaps-posts.php
  • trunk/wp-includes/version.php

Code Quality: Fix the nullCoalesce.property PHPStan error.

Since WP_Query::$max_num_pages is never null, the ?? 1 fallback in paginate_links() never applied, so the property is now read directly.

The property is also documented as a non-negative integer. This exposed that WP_Query::set_found_posts() could compute a negative page count when a found_posts filter returns a negative number, or when a filter injects a LIMIT into a query with a posts_per_page of -1, so that result is now clamped to zero. For the same reason the unreachable isset() fallback in WP_Sitemaps_Posts::get_max_num_pages() is removed, retiring its baseline entry.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15475.
Follow-up to r48476, r57648, r61454, r65192.

Props bgturner, westonruter.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65281

16:47 Changeset [64429] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Test against MariaDB 12.3 and 13.0.

This adds MariaDB 12.3, the latest LTS release, to the MariaDB testing strategy. It also replaces 11.8 as the MariaDB version used for the memcached jobs, the limited matrix for forks, and the PHP 8.6 pre-release jobs.

MariaDB 12.1 is no longer supported, so the innovation release jobs now test 13.0 instead. This is the most recent innovation release with a stable Docker image available.

The outdated note stating that MariaDB does not have a supported innovation release has also been removed.

See #65845, #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65280

16:43 Changeset [64428] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Add MySQL 26.10 to the relevant test matrices.

This adds MySQL 26.10, the latest innovation release, to the relevant testing strategies.

Because MySQL 9.7 is an LTS release, some of the configurations specific to innovation releases were removed when it was added in [62407]. These are now restored for 26.10:

  • The PHPUnit workflow tests 26.10 in the innovation release jobs.
  • The upgrade testing workflow tests 26.10 alongside the LTS versions for the two most recent releases and the oldest WordPress version still receiving security updates.
  • The installation and local Docker environment workflows test 26.10 through the 7-2 entry in .version-support-mysql.json. PHP 7.2 and 7.3 are excluded with 26.10 because MySQL 9.0+ does not work on them.

MySQL 26.7 is also listed as supported for 7.2. It is excluded from the test matrices because only the most recent innovation release is tested.

MySQL 9.7 remains the default database version for the local Docker environment and in the non-innovation PHPUnit jobs.

Props desrosj.
See #65845, #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65279

16:22 Changeset [64427] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Implement stream_flush() in WP_Test_Stream.

As of PHP 8.6, fclose(), file_put_contents(), and copy() return false when flushing or closing a stream fails. Before 8.6, these failures were silently ignored. A stream wrapper that does not implement stream_flush() is treated as failing to flush, so every write to WP_Test_Stream was reported as a failure on PHP 8.6, even though the data was written. This caused Tests_Image_Editor_Imagick::test_streams to fail.

Writes to WP_Test_Stream are stored directly in memory, so stream_flush() has nothing to do and returns true. WP_Test_Stream_Http_Mock extends this class and inherits the fix.

This also moves the assertNotWPError() assertion in test_streams() ahead of the first use of $saved['path'], so a failed save reports the actual error instead of Cannot use object of type WP_Error as array.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15476.

Props desrosj, lancewillett.
Fixes #66487.

Built from ​https://develop.svn.wordpress.org/trunk@65278

15:40 Changeset [64426] by lancewillett
  • trunk/wp-includes/version.php

Tests: Load the WP_Upgrader classes in the WP_Automatic_Updater tests.

test_should_update_should_skip_deferred_translation_updates() calls WP_Automatic_Updater::should_update(), which creates an Automatic_Upgrader_Skin. The test class loaded only class-wp-automatic-updater.php, so the test errored when its file ran on its own. The full suite passed only because earlier tests had already loaded class-wp-upgrader.php.

Follow-up to [65226].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15506

Props ravipatel.
See #42281.

Built from ​https://develop.svn.wordpress.org/trunk@65277

15:38 Changeset [64425] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Only declare the default group filter where PHPUnit has test listeners.

[65251] declared WP_PHPUnit_Default_Group_Filter as a PHPUnit\Framework\TestListener for every PHPUnit version from 6.0. PHPUnit 10 removed that interface, so loading the test bootstrap with PHPUnit 10 or later failed before any test ran. This broke test suites that load the core test library with newer PHPUnit versions, such as the WordPress.org unit tests.

The listener is now declared only when the interface exists. PHPUnit 9 and earlier are unchanged. PHPUnit 10 and later do not support listeners.

Follow-up to [65251].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15508

Props ekamran.
See #34185.

Built from ​https://develop.svn.wordpress.org/trunk@65276

15:23 Changeset [64424] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Use user-facing locators in E2E tests.

Many E2E specs found elements by CSS class, by position with .first(), or by counting Tab presses. After a markup change, a test could act on the wrong element or fail far from the real problem. Most of these now use role, label and text locators.

The media grid specs find tiles by attachment name, so they check that the uploaded file is there rather than any finished tile. Upload errors are found by file name. The Quick Edit test keeps its keyboard path but checks that the Quick Edit button has focus before pressing Enter.

The bulk-action and Save Menu controls use their IDs, since the top and bottom controls share an accessible name.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15513

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65275

15:07 Changeset [64423] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Add an E2E fixtures module and a WP-CLI helper.

Playwright copies the config's use options, including storageState, into every browser.newContext() call that does not set them. The cache-control specs' logged-out pages were therefore logged in. A new loggedOutPage fixture in tests/e2e/fixtures opens a page in a context with no cookies, and the cache-control specs use it.

The logged-out cache-control check now fails when the header contains no-cache, no-store or private. Before, it failed only on an exact match, so it passed for the logged-in header too.

A new wpCli() helper runs WP-CLI with --path set from LOCAL_DIR, so WP-CLI loads the same copy of WordPress as the site under test. The install and invalid-timezone specs now use it.

The E2E README describes both ways to run a test logged out.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15410

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65274

09:52 Changeset [64422] by oandregal
  • trunk/wp-includes/version.php
  • trunk/wp-includes/view-config.php

Editor: Show the placeholder of empty excerpt, description, and author fields.

Turns on the panel layout's showPlaceholderIfEmpty option in view-config.php for the fields that render nothing when empty, so their row in the editor's summary panel shows the field's placeholder instead of only its label, which gave users no hint the row could be edited until they hovered it:

  • excerpt, in the default post type form and in the wp_block form.
  • description, in the wp_template form.
  • author, in the default post type form and in the attachment form, for a post or media item without a known author, as the post summary did before it moved to the form.

DataViews lists are not affected, since the placeholder only shows in the panel summary.

Backports the changes from ​https://github.com/WordPress/gutenberg/pull/85842.

Props oandregal, jorgefilipecosta, 0mirka00.
Fixes #65981.

Built from ​https://develop.svn.wordpress.org/trunk@65273

03:01 Changeset [64421] by peterwilsoncc
  • trunk/wp-admin/includes/class-wp-site-health.php
  • trunk/wp-admin/includes/secrets-site-health.php
  • trunk/wp-includes/load.php
  • trunk/wp-includes/secrets.php
  • trunk/wp-includes/secrets/class-wp-secret.php
  • trunk/wp-includes/secrets/class-wp-secrets-broken-store.php
  • trunk/wp-includes/secrets/class-wp-secrets-cipher.php
  • trunk/wp-includes/secrets/class-wp-secrets-key-manager.php
  • trunk/wp-includes/secrets/class-wp-secrets-libsodium-provider.php
  • trunk/wp-includes/secrets/class-wp-secrets-option-store.php
  • trunk/wp-includes/version.php

Security: Improve Secrets API tests and inline documentation.

Brings the Secrets API tests in line with the PHPUnit test-writing guidelines and tidies the inline documentation.

Documentation:

  • Remove references to the feature plugin, its proposal and its decision records, including in the _doing_it_wrong() notice for unnamespaced names.
  • Add @global annotations for the drop-in globals, rewrite the Site Health test summaries as statements, and correct the WP_Secret::__debugInfo() description, which also applies to print_r().
  • Use /* */ for multi-line comments, "ID" rather than "id", and @subpackage Secrets in the test files.

Tests:

  • Add @ticket 66187 to each test class, a summary and @covers annotation to each test, and order annotations consistently.
  • Move @covers targets in the conformance suites from the interfaces to the implementations under test, declared on the concrete test classes, so coverage is attributed to the code that runs. The base suites no longer filter coverage for extending classes.
  • Add a unique failure message to every assertion within each test, including a new $message parameter for assertRecordSlotDecryptsTo().
  • Assert the result of every setup write. This exposed two separate-process tests that passed without testing anything because no usable key was available; both now define a test key and check the specific error returned.
  • Remove duplicated tests, rename tests whose names did not match what they check, and name single-use data providers after their test.
  • Add tests for a store that cannot list its secrets, for every WP_SECRETS_ERROR_* constant being pinned, and for a valid but different WP_SECRETS_KEY.
  • Strengthen assertions that could pass without checking their stated behavior, such as missing error codes, counts and the salt-derived key.
  • Use the ms-required and multisite groups with skipWithoutMultisite() for multisite-only tests, and skipWithMultisite() for the ms-excluded test, instead of skipping with markTestSkipped().

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15481.
Follow-up to r64337, r64344, r64345, r64674.

See #66187, #66353.

Built from ​https://develop.svn.wordpress.org/trunk@65272

11/04/2026:

23:36 Changeset [64420] by lancewillett
  • trunk/wp-includes/version.php

Tests: Run the AVIF quality test with both image editors.

test_quality_with_avif_conversion_file_sizes() used whichever editor _wp_image_editor_choose() picked first, so it could run with GD when it was meant to cover Imagick. It was also skipped on PHP 8.3 and later, where Imagick in the test containers reports AVIF support but cannot encode it.

The test now runs once per editor through a data provider. It saves a probe AVIF first and skips when that editor cannot encode one, so a failure to write sub-sizes still fails the test.

Follow-up to [59247], [60736].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/9965

Props adamsilverstein, desrosj.
Fixes #63990. See #63932.

Built from ​https://develop.svn.wordpress.org/trunk@65271

23:28 Changeset [64419] by lancewillett
  • trunk/wp-includes/version.php

Tests: Use pretty permalinks by default in the test suite.

Core's PHPUnit tests now run with the /%year%/%monthnum%/%day%/%postname%/ permalink structure by default, which matches most real sites. Before this, the suite defaulted to plain permalinks, and many tests called set_permalink_structure() only to turn pretty permalinks on.

The default applies only when WP_RUN_CORE_TESTS is set, so plugin test suites that use the core test library keep plain permalinks. set_permalink_structure() with no argument still sets plain permalinks. Tests that assert plain permalink URLs now set that structure explicitly, and calls that only set the default structure are removed.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15010

Props huzaifaalmesbah, johnbillion, mindctrl.
Fixes #41451.

Built from ​https://develop.svn.wordpress.org/trunk@65270

23:10 Changeset [64418] by westonruter
  • trunk/wp-includes/functions.php
  • trunk/wp-includes/meta.php
  • trunk/wp-includes/version.php

Docs: Allow numeric strings for date parts and meta IDs.

The wp_checkdate() and *_metadata_by_mid() functions already validate their numeric arguments with is_numeric() and cast them to integers, and core callers pass strings: date parts cut from a date string, and meta IDs read with $wpdb->get_col(). Their docblocks still documented int only, which caused 17 PHPStan argument.type errors. The arguments are now documented as int|string, with PHPStan narrowing them to int|numeric-string. The checkdate() ranges are deliberately not applied to wp_checkdate(), since the function's purpose is to validate input that may be out of range.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15472.
Follow-up to r18494, r20435, r38699, r61172.

Props pwtyler, westonruter.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65269

21:37 Changeset [64417] by lancewillett
  • trunk/wp-includes/kses.php
  • trunk/wp-includes/version.php

KSES: Clarify that valid_unicode() checks XML Char ranges.

valid_unicode() follows the XML Char production rather than checking whether a code point is valid Unicode. It rejects C0 controls other than tab, line feed, and carriage return, along with surrogates and U+FFFE and U+FFFF. Update its docblock to say so, and point callers to the newer Unicode and UTF-8 helpers, such as wp_is_valid_utf8().

Add rejected test cases for U+000B and U+001F, which guard the boundary below U+0020, and rename the test and its data provider to describe XML Char acceptance.

Follow-up to [64770].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15105

Props shailu25, dmsnell.
Fixes #66483. See #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65268

21:30 Changeset [64416] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover five more admin AJAX handlers.

Add tests for wp_ajax_imgedit_preview(), wp_ajax_get_community_events(), wp_ajax_hidden_columns(), wp_ajax_save_widget(), and wp_ajax_save_user_color_scheme(). Each test dispatches the action core registers through get_ajax_response() and checks the response and the resulting state.

The community events tests mock the Events API, so they make no network requests. The save-widget tests use a per-test Text widget and restore the widget globals afterward.

This consolidates five earlier handler test proposals.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15421

Props mindctrl, pbearne.
See #65252.

Built from ​https://develop.svn.wordpress.org/trunk@65267

21:23 Changeset [64415] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Retry failed and stalled downloads in CI setup.

From October 15 to 28, 13 of 523 trunk Performance Tests runs needed a rerun because a setup step failed, and three Playwright installs hung for six hours.

Add two composite actions. download-with-retry downloads with curl, retrying on any error and on stalled transfers. run-with-retry runs a command up to three times. Use them for the Gutenberg download in E2E tests and the WordPress Importer and mock data downloads in performance tests. Also use them for the WordPress downloads in the installation, upgrade, and performance baseline steps. Retry the global npm install in the setup-npm action.

Also cap the Playwright browser install and the mock data import at 15 minutes each, and skip archiving performance artifacts when the tests never ran.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15210

Props lucatume, johnbillion.
See #65845.

Built from ​https://develop.svn.wordpress.org/trunk@65266

21:22 Changeset [64414] by westonruter
  • trunk/wp-includes/version.php

Build/Test Tools: Introduce phpstan-strict-rules.

This adds phpstan/phpstan-strict-rules as a development dependency so that its rules can be enabled in a local phpstan.neon to work toward compliance, and it enables by default the rules which core already complies with or which enforce the WordPress Coding Standards:

  • Disallow the backtick operator.
  • Disallow short ternaries (the one remaining instance is replaced).
  • Disallow $this in closures.
  • Require inherited method names to match in case.

The rules are registered individually rather than by including the package's rules.neon, because that file also makes several PHPStan parameters stricter even when its rules are disabled, and because a local config including it would otherwise fail on the duplicate include. The README documents how to opt into the other rules locally, and the roles of base.neon and phpstan.neon.dist are clarified so that local configs include the latter rather than copying it.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15399.
Follow-up to r61699, r63420.

Props westonruter, apermo.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65265

20:55 Changeset [64413] by peterwilsoncc
  • trunk/wp-includes/version.php

External Libraries: Remove build dependent jQuery file tests.

Removes PHPUnit tests introduced in r63983 to ensure the jQuery and jQuery Migrate files are present.

These tests are causing false failures if the test suite is run without running the build step.

Follow-up to r63983.
Developed in ​https://github.com/WordPress/wordpress-develop/pull/15435.

Props sergeybiryukov.
Fixes #66203.

Built from ​https://develop.svn.wordpress.org/trunk@65264

20:50 Changeset [64412] by westonruter
  • trunk/wp-includes/comment-template.php
  • trunk/wp-includes/version.php

Comments: Add conditional return types to comment date functions.

Both get_comment_date() and get_comment_time() return the result of mysql2date(), which is an integer for the 'U' and 'G' formats and false on failure, yet they were documented as returning only a string. Callers such as the Comment Date block therefore had to cast get_comment_date( 'U', $comment ) before passing it to human_time_diff(). They now declare the same conditional return on $format as mysql2date() and the post date functions, and the get_comment_date and get_comment_time filters document false as well, since the return type of apply_filters() is derived from them.

A nonexistent comment no longer causes get_comment_date() to read a property on null. For back-compat, false is still passed through the get_comment_date filter, as is done in get_the_modified_date() and get_the_modified_time(), so the filter's $comment parameter is now documented as possibly null. Since r55284, get_comment_time() has returned an empty string for a nonexistent comment without applying its filter, and this is left unchanged.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15473.
Follow-up to r37866, r55284, r63941.

See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65263

20:00 Changeset [64411] by westonruter
  • trunk/wp-includes/class-wp-date-query.php
  • trunk/wp-includes/version.php

Date/Time: Correct argument types in WP_Date_Query.

The PHPStan baseline held eight argument.type errors for WP_Date_Query, caused by docblocks narrower than the input the methods actually handle and by an unused parameter. Since build_value() was introduced it has been documented as taking a string or an array, yet build_time_query() has always passed it integers or null. And when nested queries were added, get_sql_for_subquery() passed an empty string for the $parent_query array that get_sql_for_clause() never reads.

No path of build_mysql_datetime() returns false, though its @return tag said otherwise. An unparseable string has always resulted in the Unix epoch, obtained by passing false as the timestamp to gmdate(). That fallback now passes 0 and is documented, and its test asserts the fixed value instead of computing it, which also corrects a comment claiming the test was time-dependent.

The PHPStan types also go further than the published @param tags in describing valid input. The comparison operator is limited to the ten accepted by get_compare(), which are put directly into SQL. Date values are limited to non-negative integers or numeric strings, because absint() would silently turn a negative value positive. Non-numeric values are still filtered out at runtime, so there is no change in behavior.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15469.
Follow-up to r25139, r29923, r45876.

Props pwtyler, westonruter.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65262

19:18 Changeset [64410] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Switch the E2E theme before the other resets.

E2E global setup activated Twenty Twenty-One at the same time as it deleted posts and blocks and reset preferences. switch_theme() saves template and stylesheet one after the other, so a request that loads between the two writes sees Ipsum as a child of Twenty Twenty-One. Ipsum then requires inc/abilities.php from the parent theme, which does not exist, and the request fails with a PHP fatal error that global setup cannot parse as JSON.

Activate the theme first, then run the other resets in parallel.

Follow-up to [65224].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15471

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65261

19:08 Changeset [64409] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Use web-first assertions in more E2E tests.

Replace waits followed by one-time reads with Playwright assertions that retry until they pass. Each test keeps the same checks.

The edit-posts spec now waits for the post title instead of any element in the editor iframe. The media-upload spec drops a waitForLoadState( 'load' ) call, since visitAdminPage() already waits for the page to load.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15463

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65260

19:03 Changeset [64408] by SergeyBiryukov
  • trunk/wp-admin/includes/class-wp-automatic-updater.php
  • trunk/wp-admin/includes/class-wp-site-health-auto-updates.php
  • trunk/wp-includes/version.php

Upgrade/Install: Detect a .git file when checking for a VCS checkout.

WP_Automatic_Updater::is_vcs_checkout() looks for .git with is_dir(), but in a Git worktree or submodule .git is a plain file that points to the real repository. When there's no .git directory higher up, the site is treated as not under version control and automatic updates run. The Site Health VCS test has its own copy of the same check.

What changes

  • is_vcs_checkout() and WP_Site_Health_Auto_Updates::test_vcs_abspath() use file_exists() instead of is_dir(), so a .git file counts as a checkout.
  • The .git file isn't read to see where it points. In case of a Docker site running from a worktree, the path may be on the host and may not exist inside the container.
  • The automatic_updates_is_vcs_checkout filter still decides the result.

Follow-up to r47835, r64586.

Props dlocc.
Fixes #66460.
Built from ​https://develop.svn.wordpress.org/trunk@65259

18:03 Changeset [64407] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Share the client-side media upload E2E helpers.

The three client-side media upload specs each kept their own copies of the same constants and helpers. Move them into tests/e2e/utils/media-pipeline.js, and import them in each spec.

countUploadRequests() had two versions. The shared one returns all five counters, so every existing assertion still applies.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15429

Props adrianmoldovanwp.
See #66455.

Built from ​https://develop.svn.wordpress.org/trunk@65258

16:39 Changeset [64406] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover the get_wp_title_rss filter in get_wp_title_rss().

Add a test that a callback on the get_wp_title_rss filter receives the document title and can change the feed title that get_wp_title_rss() returns.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15370

Props shailu25.
Fixes #66474.

Built from ​https://develop.svn.wordpress.org/trunk@65257

16:38 Changeset [64405] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover the the_permalink_rss filter and escaping in the_permalink_rss().

Add a test that the the_permalink_rss filter receives the post permalink, and that the filtered URL is escaped in the feed output.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15371

Props shailu25.
Fixes #66473.

Built from ​https://develop.svn.wordpress.org/trunk@65256

16:00 Changeset [64404] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover the post_mime_types filter in get_post_mime_types().

Add a test that a callback on the post_mime_types filter can change the labels get_post_mime_types() returns.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15376

Props shailu25.
Fixes #66472.

Built from ​https://develop.svn.wordpress.org/trunk@65255

15:53 Changeset [64403] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover get_taxonomies_for_attachments().

Add tests that get_taxonomies_for_attachments() returns taxonomies registered for attachments and for attachment subtypes such as attachment:image, as names or as objects, and leaves out taxonomies for other post types.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15377

Props shailu25.
Fixes #66471.

Built from ​https://develop.svn.wordpress.org/trunk@65254

15:52 Changeset [64402] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover find_core_update().

Add tests that find_core_update() returns false without update data, returns the update that matches both version and locale, and returns false when either the locale or the version does not match.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15378

Props shailu25.
Fixes #66470.

Built from ​https://develop.svn.wordpress.org/trunk@65253

15:46 Changeset [64401] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove a test file committed by mistake in [65251].

The format_for_editor() test was not part of that change. It will land with its own ticket.

See #34185, #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65252

15:42 Changeset [64400] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Keep default-excluded groups excluded when using --exclude-group.

Passing --exclude-group replaces the group exclusions in the PHPUnit XML config, and the test bootstrap also cleared its own list of skipped groups. So any --exclude-group run also ran the groups excluded by default, such as ajax, ms-files and external-http.

A new test listener now removes default-excluded tests from every suite, including nested ones, before class fixtures run. A group requested with --group still runs.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11801

Props arkaprabhachowdhury, netweb, isabel_brison, johnbillion.
Fixes #34185.

Built from ​https://develop.svn.wordpress.org/trunk@65251

11/03/2026:

20:35 Changeset [64399] by jorbin
  • trunk/wp-includes/ms-blogs.php
  • trunk/wp-includes/query.php
  • trunk/wp-includes/version.php

Rewrites: Avoid fatal errors when flushing rules for random content.

wp_random_content_flush_rewrite_rules_for_post() runs on the wp_after_insert_post and after_delete_post actions, which third-party code may fire with a missing or incorrectly typed $post. Also make the $post parameter of _update_posts_count_on_delete() optional for the same single-argument after_delete_post calls.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/14356

Follow-up to r64402.

Props jorbin, bradshawtm, therssoftware.
Fixes #64498.

Built from ​https://develop.svn.wordpress.org/trunk@65250

19:57 Changeset [64398] by desrosj
  • trunk/wp-includes/version.php

Build/Test Tools: Use PR number for concurrency groups instead of head_ref.

The current standard across all GitHub Actions workflows is to configure concurrency to use the github.head_ref value in the group name for a given PR. Because head_ref only includes the branch name, workflow runs can be inadvertantly cancelled when two PRs are open from different forks with identical branch names.

This switches to using the github.event.pull_request.number instead of github.head_ref to ensure that runs are properly grouped only with runs from the same pull request. A similar change has been made to props-bot.yml, which can be triggered by an issue_comment event. In this case, the github.event.issue.number will be used. In the context of GitHub, issues == pull_requests for the data returned by a number of request types.

Props lancewillett.
See #65845.

Built from ​https://develop.svn.wordpress.org/trunk@65249

19:04 Changeset [64397] by desrosj
  • trunk/wp-includes/version.php

Tests: Stop passing objects to static methods through Reflection.

PHP 8.6 has deprecated passing an object to ReflectionMethod::invoke() and ReflectionMethodL::invokeArgs() when the target method is static.

This addresses this within two PHPUnit-related files.

Props westonruter.
Fixes #66457.

Built from ​https://develop.svn.wordpress.org/trunk@65248

18:04 Changeset [64396] by westonruter
  • trunk/wp-includes/embed.php
  • trunk/wp-includes/version.php

Docs: Move the oembed_min_max_width shape to its docblock.

In r62719 an inline @var was added after the apply_filters() call in get_oembed_response_data(), narrowing the filtered widths for clamp(). A type declared below the assignment it describes is confusing to read, but it could not go above, since the filter's docblock must immediately precede apply_filters() or the hook is reported as undocumented. The shape is now declared once, as a @phpstan-param in the filter docblock next to the @param hash it refines.

The min and max keys are also marked Required. in the hash. Since r65217 that marker makes a key required, where the keys of a @param hash are otherwise read as optional because a caller may pass a subset of them. That does not fit a filtered value: core always passes both keys, and a callback must return both, since they are read unconditionally. The documented defaults therefore describe the values core supplies, not a fallback for an omitted key. The @phpstan-param is kept regardless, because the hash only says int, while the shape narrows the widths to positive-int.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15264.
Follow-up to r62719, r65217.

Props westonruter, dmsnell.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65247

17:52 Changeset [64395] by westonruter
  • trunk/wp-includes/version.php

Build/Test Tools: Fix static analysis issues in HashNotationVisitor.

This fixes the level-10 PHPStan errors that predate the hash notation visitor's recent changes, along with a few PhpStorm inspection warnings, without changing the @phpstan-* tags the visitor derives across src/.

Most of the errors came from one limit: an entry in a hash can open a hash of its own, and an array shape cannot refer to itself, so every nested entry was mixed. Entries are therefore read into a new HashEntry class, whose children are typed as entries in turn. The rest came from writes through a list offset, which PHPStan reads as adding an incomplete element, so a tag or entry is now completed before it is added to its list. String types are also narrowed where possible, though an entry's type and key are only non-empty strings, since 0 is valid as either.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15384.
Follow-up to r63420, r63789, r65217.

Props westonruter, lancewillett.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65246

17:41 Changeset [64394] by lancewillett
  • trunk/wp-includes/version.php

Tests: Compare HTML semantically in the serialize_token() attribute test.

Use assertEqualHTML() instead of assertSame() when checking that WP_HTML_Processor::serialize_token() reflects enqueued attribute updates, so the test no longer depends on the order of serialized attributes.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15373

Props motylanogha, dmsnell.
See #64567.

Built from ​https://develop.svn.wordpress.org/trunk@65245

17:22 Changeset [64393] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove block styles theme support in the tests that require its absence.

Two Tests_Dependencies_Styles tests assumed the active theme does not support wp-block-styles. Remove that support in each test instead of relying on earlier tests leaving it unset.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/14688

Props devmuhib, huzaifaalmesbah.
See #65893.

Built from ​https://develop.svn.wordpress.org/trunk@65244

17:21 Changeset [64392] by lancewillett
  • trunk/wp-includes/version.php

Tests: Check permalinks for post titles with a percent sign and digits.

Verify that a title containing %10 keeps the octet in its slug, and that the resulting permalink resolves to the post.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/8250

Props abcd95, mte90.
Fixes #3329.

Built from ​https://develop.svn.wordpress.org/trunk@65243

17:19 Changeset [64391] by lancewillett
  • trunk/wp-includes/version.php

Tests: Check that saving General Settings keeps the theme options.

Add an E2E regression test for the Gutenberg 10.7 bug that cleared stylesheet and template when General Settings were saved. The test saves a new tagline through the settings form, checks both theme options are unchanged, and restores the tagline.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/8301

Props abcd95, fullofcaffeine.
Fixes #53520.

Built from ​https://develop.svn.wordpress.org/trunk@65242

17:18 Changeset [64390] by lancewillett
  • trunk/wp-includes/version.php

Tests: Check admin bar visibility on the front end.

Add E2E tests that the admin bar shows on the front page for a logged-in user and is absent for a logged-out visitor. The logged-out test starts without cookies, so it leaves the shared admin session intact.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/9023

Props sukhendu2002, hideokamoto, justinahinon, talldanwp, isabel_brison, sirlouen, wildworks.
Fixes #48978.

Built from ​https://develop.svn.wordpress.org/trunk@65241

17:17 Changeset [64389] by lancewillett
  • trunk/wp-admin/network/settings.php
  • trunk/wp-includes/functions.php
  • trunk/wp-includes/version.php

Networks and Sites: Clarify the network admin email change notices.

Bring the network admin email change flow in line with the single site notices. Show a pending change as an info notice at the top of Network Settings and next to the email field, both with a "Cancel request" link. After the confirmation link is followed, show "Network admin email updated." instead of "Settings saved."

Show "Settings saved." only when updated=true, and in bold, so a failed confirmation or a canceled request no longer reports a save. Add network_admin_email_updated to wp_removable_query_args().

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/14247, ​https://github.com/WordPress/wordpress-develop/pull/14466

Props therssoftware, afercia, johnjamesjacoby, realloc.
Fixes #66300.

Built from ​https://develop.svn.wordpress.org/trunk@65240

17:14 Changeset [64388] by lancewillett
  • trunk/wp-includes/version.php

Tests: Generate only the thumbnail in the Imagick PDF preview test.

The PDF alpha channel test needs one fallback size to create the full preview. Limit the fallback sizes to the thumbnail so the upload no longer also renders medium and large images.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/14248

Props abcd95, huzaifaalmesbah.
See #66074.

Built from ​https://develop.svn.wordpress.org/trunk@65239

17:13 Changeset [64387] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover get_previous_post() and get_next_post().

Assert that both wrappers return the adjacent posts already used by test_get_adjacent_post(), without new fixtures.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15362

Props devmuhib, huzaifaalmesbah.
See #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65238

17:11 Changeset [64386] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover wp_admin_css_color() registration.

Verify that wp_admin_css_color() stores the name, URL, colors and icon colors of a registered admin color scheme.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15363

Props devmuhib, huzaifaalmesbah.
See #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65237

17:10 Changeset [64385] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover wp_admin_css_uri().

Verify that wp_admin_css_uri() returns the admin stylesheet URL with a version argument, and that the wp_admin_css_uri filter receives the file name and can replace the URL.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15364

Props devmuhib, huzaifaalmesbah.
See #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65236

17:09 Changeset [64384] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover rawurlencode_deep() and urldecode_deep() on strings.

Verify that rawurlencode_deep() encodes spaces, ampersands and equals signs, and that urldecode_deep() decodes both + and %20. Keep the existing urlencode_deep() tests.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15312

Props devmuhib, huzaifaalmesbah.
See #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65235

16:43 Changeset [64383] by lancewillett
  • trunk/wp-includes/version.php

Build/Test Tools: Skip the WordPress install in process-isolated tests.

A @runInSeparateProcess test loads the bootstrap again in a child process, which reran install.php and recreated every table the parent had already installed. Skip the install while PHPUnit sets $GLOBALS['__PHPUNIT_BOOTSTRAP'], which it does only in a child process. WP_TESTS_SKIP_INSTALL=1 works as before.

The reinstall also hid state that test classes leak. WP_UnitTestCase_Base now deletes all data before each class's fixtures and restores the options table and site_admins after each class. It also flushes the cache before the class cleanup and flushes a persistent object cache after each rollback.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/14786

Props lucatume, adrianmoldovanwp.
Fixes #66410.

Built from ​https://develop.svn.wordpress.org/trunk@65234

16:05 Changeset [64382] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover bloginfo() output.

Verify that bloginfo() prints the site name by default, prints the home URL for url, and prints the value returned by the bloginfo filter.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15320

Props devmuhib, huzaifaalmesbah.
See #65819.

Built from ​https://develop.svn.wordpress.org/trunk@65233

16:03 Changeset [64381] by lancewillett
  • trunk/wp-includes/version.php

Tests: Remove unneeded final cleanup from taxonomy tests.

Three Tests_Taxonomy tests removed their taxonomy from the global registry after their last assertion. The per-test reset already unregisters custom taxonomies, so these lines protected nothing. Another test unregistered wptests_pt, a post type it never registers.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/14952

Props rejaulalomkhan, huzaifaalmesbah, mukesh27.
See #65893.

Built from ​https://develop.svn.wordpress.org/trunk@65232

15:44 Changeset [64380] by audrasjb
  • trunk/wp-includes/version.php

Post WordPress 7.2 Beta 4 version bump.

Built from ​https://develop.svn.wordpress.org/trunk@65231

15:18 Changeset [64379] by audrasjb
  • trunk/wp-includes/version.php

WordPress 7.2 Beta 4.

Built from ​https://develop.svn.wordpress.org/trunk@65230

14:51 Changeset [64378] by SergeyBiryukov
  • trunk/wp-includes/post.php
  • trunk/wp-includes/version.php

Media: Ignore empty items in a comma-separated post_mime_type string.

wp_post_mime_type_where() splits a comma-separated string of MIME types with explode(). An extra comma left an empty item, and the empty string is one of the wildcards, so a value like image/jpeg, returned no clause and matched every MIME type. This affected WP_Query and get_posts() with post_mime_type, wp_count_attachments() and the media modal's query-attachments Ajax request.

What changes

  • wp_post_mime_type_where(): after a string is split, empty items are removed with array_diff(). A value of '0' is not removed.
  • Arrays are not changed. An empty string, a string of only commas and spaces, and an explicit % still match every MIME type.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15403.

Follow-up to r6910.

Props ekamran.
Fixes #66454.
Built from ​https://develop.svn.wordpress.org/trunk@65229

14:37 Changeset [64377] by jonsurrell
  • trunk/wp-includes/interactivity-api/class-wp-interactivity-api.php
  • trunk/wp-includes/version.php

Interactivity API: Remove event handler bind directives.

Server processing now removes data-wp-bind--on* directives from output.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15396

Follow-up to r61885.

Props jonsurrell, ntsekouras, luisherranz.
See #66452.

Built from ​https://develop.svn.wordpress.org/trunk@65228

13:45 Changeset [64376] by audrasjb
  • trunk/wp-admin/includes/class-wp-automatic-updater.php
  • trunk/wp-includes/version.php

Coding Standards: Fix a blank line WPCS issue found after [65226].

See #42281.

Built from ​https://develop.svn.wordpress.org/trunk@65227

13:40 Changeset [64375] by audrasjb
  • trunk/wp-admin/includes/class-language-pack-upgrader.php
  • trunk/wp-admin/includes/class-wp-automatic-updater.php
  • trunk/wp-admin/includes/update.php
  • trunk/wp-admin/update-core.php
  • trunk/wp-includes/update.php
  • trunk/wp-includes/version.php

Upgrade/Install: Show and allow to select translation updates on the Updates screen.

This changeset introduces a way to see each available translation update on the Updates screen, and allows users to update them selectively. With this change, translation updates management is more consistent with how plugin and theme updates are managed.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/11610.

Props stk_jj, Presskopp, jyria, tfrommen, audrasjb, ozgursar, im3dabasia1.
Fixes #42281.

Built from ​https://develop.svn.wordpress.org/trunk@65226

12:09 Changeset [64374] by Mamaduka
  • trunk/wp-includes/assets/script-loader-packages.php
  • trunk/wp-includes/assets/script-modules-packages.php
  • trunk/wp-includes/blocks/playlist-track.php
  • trunk/wp-includes/blocks/playlist.php
  • trunk/wp-includes/build/routes/connectors-home/content.js
  • trunk/wp-includes/build/routes/connectors-home/content.min.asset.php
  • trunk/wp-includes/build/routes/connectors-home/content.min.js
  • trunk/wp-includes/build/routes/font-list/content.js
  • trunk/wp-includes/build/routes/font-list/content.min.asset.php
  • trunk/wp-includes/build/routes/font-list/content.min.js
  • trunk/wp-includes/css/dist/block-editor/content-rtl.css
  • trunk/wp-includes/css/dist/block-editor/content-rtl.min.css
  • trunk/wp-includes/css/dist/block-editor/content.css
  • trunk/wp-includes/css/dist/block-editor/content.min.css
  • trunk/wp-includes/css/dist/block-editor/style-rtl.css
  • trunk/wp-includes/css/dist/block-editor/style-rtl.min.css
  • trunk/wp-includes/css/dist/block-editor/style.css
  • trunk/wp-includes/css/dist/block-editor/style.min.css
  • trunk/wp-includes/css/dist/components/style-rtl.css
  • trunk/wp-includes/css/dist/components/style-rtl.min.css
  • trunk/wp-includes/css/dist/components/style.css
  • trunk/wp-includes/css/dist/components/style.min.css
  • trunk/wp-includes/css/dist/edit-site/style-rtl.css
  • trunk/wp-includes/css/dist/edit-site/style-rtl.min.css
  • trunk/wp-includes/css/dist/edit-site/style.css
  • trunk/wp-includes/css/dist/edit-site/style.min.css
  • trunk/wp-includes/css/dist/editor/style-rtl.css
  • trunk/wp-includes/css/dist/editor/style-rtl.min.css
  • trunk/wp-includes/css/dist/editor/style.css
  • trunk/wp-includes/css/dist/editor/style.min.css
  • trunk/wp-includes/js/dist/block-directory.js
  • trunk/wp-includes/js/dist/block-directory.min.js
  • trunk/wp-includes/js/dist/block-editor.js
  • trunk/wp-includes/js/dist/block-editor.min.js
  • trunk/wp-includes/js/dist/block-library.js
  • trunk/wp-includes/js/dist/block-library.min.js
  • trunk/wp-includes/js/dist/blocks.js
  • trunk/wp-includes/js/dist/blocks.min.js
  • trunk/wp-includes/js/dist/components.js
  • trunk/wp-includes/js/dist/components.min.js
  • trunk/wp-includes/js/dist/customize-widgets.js
  • trunk/wp-includes/js/dist/customize-widgets.min.js
  • trunk/wp-includes/js/dist/dom.js
  • trunk/wp-includes/js/dist/dom.min.js
  • trunk/wp-includes/js/dist/edit-post.js
  • trunk/wp-includes/js/dist/edit-post.min.js
  • trunk/wp-includes/js/dist/edit-site.js
  • trunk/wp-includes/js/dist/edit-site.min.js
  • trunk/wp-includes/js/dist/edit-widgets.js
  • trunk/wp-includes/js/dist/edit-widgets.min.js
  • trunk/wp-includes/js/dist/editor.js
  • trunk/wp-includes/js/dist/editor.min.js
  • trunk/wp-includes/js/dist/format-library.js
  • trunk/wp-includes/js/dist/format-library.min.js
  • trunk/wp-includes/js/dist/media-utils.js
  • trunk/wp-includes/js/dist/media-utils.min.js
  • trunk/wp-includes/js/dist/notices.js
  • trunk/wp-includes/js/dist/notices.min.js
  • trunk/wp-includes/js/dist/patterns.js
  • trunk/wp-includes/js/dist/patterns.min.js
  • trunk/wp-includes/js/dist/rich-text.js
  • trunk/wp-includes/js/dist/rich-text.min.js
  • trunk/wp-includes/js/dist/script-modules/boot/index.js
  • trunk/wp-includes/js/dist/script-modules/boot/index.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/boot/index.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/attachment.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/attachment.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/attachment.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/page.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/page.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/page.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/post_type_supports.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/post_type_supports.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/post_type_supports.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_block.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_block.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_block.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template.min.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template_part.js
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template_part.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/core-fields/wp_template_part.min.js
  • trunk/wp-includes/js/dist/script-modules/interactivity-router/index.js
  • trunk/wp-includes/js/dist/script-modules/interactivity-router/index.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/interactivity-router/index.min.js
  • trunk/wp-includes/js/dist/script-modules/interactivity/index.js
  • trunk/wp-includes/js/dist/script-modules/interactivity/index.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/interactivity/index.min.js
  • trunk/wp-includes/js/dist/script-modules/workflow/index.js
  • trunk/wp-includes/js/dist/script-modules/workflow/index.min.asset.php
  • trunk/wp-includes/js/dist/script-modules/workflow/index.min.js
  • trunk/wp-includes/js/dist/theme.js
  • trunk/wp-includes/js/dist/theme.min.js
  • trunk/wp-includes/js/dist/upload-media.js
  • trunk/wp-includes/js/dist/upload-media.min.js
  • trunk/wp-includes/js/dist/widgets.js
  • trunk/wp-includes/js/dist/widgets.min.js
  • trunk/wp-includes/version.php

General: Bump the pinned hash for Gutenberg to c035c1a.

This updates the pinned commit hash of the Gutenberg repository from cc75a79186fd23e72eb015d594e82f40c6209eb5 to c035c1a649ef68f5c1646694cf440df1d7ae6e62 (fixes cherry-picked to the wp/7.2 branch).

A full list of changes included in this commit can be found on GitHub: ​https://github.com/WordPress/gutenberg/compare/cc75a79186fd23e72eb015d594e82f40c6209eb5...c035c1a649ef68f5c1646694cf440df1d7ae6e62

Props mamaduka.
See #66340.
Built from ​https://develop.svn.wordpress.org/trunk@65225

12:04 Changeset [64373] by Mamaduka
  • trunk/wp-content/themes/ipsum/functions.php
  • trunk/wp-content/themes/ipsum/inc
  • trunk/wp-content/themes/ipsum/inc/abilities.php
  • trunk/wp-content/themes/ipsum/patterns/about-row.php
  • trunk/wp-content/themes/ipsum/patterns/archive-columns.php
  • trunk/wp-content/themes/ipsum/patterns/archive-compact.php
  • trunk/wp-content/themes/ipsum/patterns/archive-full.php
  • trunk/wp-content/themes/ipsum/patterns/archive-lead.php
  • trunk/wp-content/themes/ipsum/patterns/archive-minimal.php
  • trunk/wp-content/themes/ipsum/patterns/archive-simple.php
  • trunk/wp-content/themes/ipsum/patterns/archive-standard.php
  • trunk/wp-content/themes/ipsum/patterns/cta-membership.php
  • trunk/wp-content/themes/ipsum/patterns/footer-centered.php
  • trunk/wp-content/themes/ipsum/patterns/footer-subscribe.php
  • trunk/wp-content/themes/ipsum/patterns/footer-wide.php
  • trunk/wp-content/themes/ipsum/patterns/format-audio.php
  • trunk/wp-content/themes/ipsum/patterns/format-link.php
  • trunk/wp-content/themes/ipsum/patterns/gallery-grid-full.php
  • trunk/wp-content/themes/ipsum/patterns/gallery-grid-wide.php
  • trunk/wp-content/themes/ipsum/patterns/gallery-grid.php
  • trunk/wp-content/themes/ipsum/patterns/header-collapsed.php
  • trunk/wp-content/themes/ipsum/patterns/header-default.php
  • trunk/wp-content/themes/ipsum/patterns/header-sticky.php
  • trunk/wp-content/themes/ipsum/patterns/header-vertical.php
  • trunk/wp-content/themes/ipsum/patterns/hero-colophon.php
  • trunk/wp-content/themes/ipsum/patterns/hero-epigraph.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-archive-sidebar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-comments.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-index-sidebar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-index.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-keep-reading.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-search-bar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-search.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-sidebar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-single-sidebar.php
  • trunk/wp-content/themes/ipsum/patterns/hidden-single.php
  • trunk/wp-content/themes/ipsum/patterns/kind-words.php
  • trunk/wp-content/themes/ipsum/patterns/navigation-overlay.php
  • trunk/wp-content/themes/ipsum/patterns/overlay-contents.php
  • trunk/wp-content/themes/ipsum/patterns/overlay-profile.php
  • trunk/wp-content/themes/ipsum/patterns/page-bio.php
  • trunk/wp-content/themes/ipsum/patterns/page-blog-home.php
  • trunk/wp-content/themes/ipsum/patterns/page-soon.php
  • trunk/wp-content/themes/ipsum/patterns/text-alternating.php
  • trunk/wp-content/themes/ipsum/patterns/text-statement.php
  • trunk/wp-content/themes/ipsum/style.css
  • trunk/wp-content/themes/ipsum/styles/blocks/quote-mark.json
  • trunk/wp-content/themes/ipsum/styles/colors/01-blue-hour.json
  • trunk/wp-content/themes/ipsum/styles/colors/02-sunrise.json
  • trunk/wp-content/themes/ipsum/styles/colors/03-morning.json
  • trunk/wp-content/themes/ipsum/styles/colors/04-high-noon.json
  • trunk/wp-content/themes/ipsum/styles/colors/05-golden-hour.json
  • trunk/wp-content/themes/ipsum/styles/colors/06-evening.json
  • trunk/wp-content/themes/ipsum/styles/colors/07-after-hours.json
  • trunk/wp-content/themes/ipsum/theme.json
  • trunk/wp-includes/version.php

Bundled Themes: Sync Ipsum with its GitHub repository.

Brings over the changes merged in Ipsum's GitHub repository:

  • Add a design guide ability, so AI agents can read the theme's palette, typography, spacing, style variations, patterns and templates through the Abilities API.
  • Name the palette colors by role and use the Twenty Twenty-Five slugs.
  • Color the header submenus with the palette, and open them leftwards so they stay on screen.
  • Hide the comments call to action and its separators when comments are closed.
  • Keep the Header Sticky navigation overlay above the admin bar and Search Bar.
  • Hide the author card for post types without author support.
  • Restore a visible focus state to the Search block with the button inside.
  • Hide decorative characters from screen readers.
  • Fix ambiguous link texts by removing redundant post date links and adding screen reader text to the comments call to action.
  • Space the sidebar category links to meet the 24px target size.
  • Align table header labels with their columns in RTL.
  • Standardize titles in hidden patterns and add a description to the wide footer pattern.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15113.

Follow-up to [64677].

Props onemaggie, sakshamsharma5, noruzzaman, khushalsains, matthewneilcowan, rahultank, juanfra, mikachan, ravipatel, iamarinoh, poena, peterwilsoncc, nilambar, prasadkarmalkar, karunyachavan84, nendeb55, westonruter, gziolo.
See #66352.
Built from ​https://develop.svn.wordpress.org/trunk@65224

11:40 Changeset [64372] by wildworks
  • trunk/wp-includes/admin-bar.php
  • trunk/wp-includes/class-wp-admin-bar.php
  • trunk/wp-includes/css/admin-bar-rtl.css
  • trunk/wp-includes/css/admin-bar-rtl.min.css
  • trunk/wp-includes/css/admin-bar.css
  • trunk/wp-includes/css/admin-bar.min.css
  • trunk/wp-includes/version.php

Toolbar: Hide legacy Dashicons when a node has an SVG icon

When an admin bar node has an SVG icon, the Dashicon it draws for earlier WordPress versions is now hidden, whether that Dashicon is an empty icon element in the title or is drawn with CSS on the link. Plugins can therefore pass the icon argument with the same title on 7.2 and earlier versions, without a version check, and an unregistered icon now renders nothing instead of leaving an empty gap.

Core nodes now set their icons with the icon argument instead of an empty icon element in the title, and the title is no longer modified when the node is rendered.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/14999

Follow-up to [64583].

Props fushar, mamaduka, mciampini, mcsf, peterwilsoncc, sadmansakibnadvi, wildworks.
See #65089.
Built from ​https://develop.svn.wordpress.org/trunk@65223

07:36 Changeset [64371] by Mamaduka
  • trunk/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
  • trunk/wp-includes/version.php

REST API: Only let a reaction's author delete it.

Since r65038, deleting a note reaction goes through the same edit_comment check as its note, so anyone who can edit the note's post, including the post author and administrators, could remove someone else's reaction. A reaction speaks for its author, so WP_REST_Comments_Controller::delete_item_permissions_check() now only allows its author to delete it.

Reactions on a resolved thread also can no longer be deleted, matching the existing check in create_item(). The thread-root walk moves into a private is_thread_resolved() helper shared by both.

The reaction type is matched case-insensitively, like in check_edit_permission().

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15383
Developed in: ​https://github.com/WordPress/gutenberg/pull/85415

Follow-up to r64488, r65038.

Props adamsilverstein, ramonopoly, mamaduka.
Fixes #66447.
Built from ​https://develop.svn.wordpress.org/trunk@65222

07:31 Changeset [64370] by jonsurrell
  • trunk/wp-includes/html-api/class-wp-html-tag-processor.php
  • trunk/wp-includes/version.php

HTML API: Remove redundant after_tag() call.

parse_next_tag() called after_tag(), but its only caller, base_class_next_token(), already calls after_tag() before it.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15136

Props jonsurrell, dmsnell, lancewillett.
See #65984.

Built from ​https://develop.svn.wordpress.org/trunk@65221

05:59 Changeset [64369] by westonruter
  • trunk/wp-includes/html-api/class-wp-html-processor.php
  • trunk/wp-includes/html-api/class-wp-html-tag-processor.php
  • trunk/wp-includes/html-api/class-wp-html-token.php
  • trunk/wp-includes/version.php

HTML API: Type tag queries and tag names for PHPStan.

The $query parameter of next_tag() is documented as array|string|null, but its hash notation only describes the array form, so stubs generated from it (as used by Gutenberg) turned it into an array shape and dropped the bare tag-name form, reporting calls like next_tag( 'FIGURE' ) as errors. A Query type alias now covers the array, bare tag-name, and null forms, with each key allowed to be null as documented. The HTML Processor defines its own alias adding the breadcrumbs key, since type aliases are not inherited by subclasses.

Tag names are returned as non-falsy-string, since a parsed name is never empty or '0', but accepted as non-empty-string, since that is all a '' !== $tag check proves and a '0' query simply matches nothing.

The changes are to PHPDoc only, so there is no runtime change.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15305.
Follow-up to r55203.

Props westonruter, dmsnell.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65220

05:34 Changeset [64368] by ramonopoly
  • trunk/wp-admin/css/admin-menu-rtl.css
  • trunk/wp-admin/css/admin-menu-rtl.min.css
  • trunk/wp-admin/css/admin-menu.css
  • trunk/wp-admin/css/admin-menu.min.css
  • trunk/wp-admin/includes/misc.php
  • trunk/wp-includes/css/admin-bar-rtl.css
  • trunk/wp-includes/css/admin-bar-rtl.min.css
  • trunk/wp-includes/css/admin-bar.css
  • trunk/wp-includes/css/admin-bar.min.css
  • trunk/wp-includes/general-template.php
  • trunk/wp-includes/version.php

Administration: Brighten the icon color of the Fresh admin color scheme

In 7.2, the admin menu and toolbar icons are being switched from Dashicons to SVG icons.

This commits updates the colors to brighten / increase the opacity of icons (both dashicons and SVG icons) in the Fresh scheme

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15143

Follow-up to [65089].

Props fushar, wildworks, ramonopoly, fcoveram, sadmansakibnadvi, rollybueno.

Fixes #66411.

Built from ​https://develop.svn.wordpress.org/trunk@65219

03:45 Changeset [64367] by westonruter
  • trunk/wp-includes/class-wp-theme-json-resolver.php
  • trunk/wp-includes/version.php

Code Quality: Document theme JSON resolver caches as nullable.

The cached static properties of WP_Theme_JSON_Resolver all default to null and are reset to null in clean_cached_data(), and the getters check them against null to decide whether to rebuild the cache, but their @var tags omitted null. Adding it removes the six resulting assign.propertyType entries from the PHPStan baseline. There is no runtime change.

This mirrors the same fix to WP_Theme_JSON_Resolver_Gutenberg in the Gutenberg plugin, developed in ​https://github.com/WordPress/gutenberg/pull/86111.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15385.
Follow-up to r50959, r52049, r54493, r63022.

Props noruzzaman, huzaifaalmesbah.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65218

02:41 Changeset [64366] by westonruter
  • trunk/wp-admin/includes/template.php
  • trunk/wp-includes/blocks.php
  • trunk/wp-includes/general-template.php
  • trunk/wp-includes/ms-site.php
  • trunk/wp-includes/version.php
  • trunk/wp-includes/widgets/class-wp-widget-categories.php

Build/Test Tools: Type T[] hash elements and Required. keys.

The HashNotationVisitor derived shapes only for a bare array, object, or class. A list of arrays declared as array[] and documented by a single ...$0 entry, as the blocks parse_blocks() returns are, therefore stayed array<array>, and every key read from an element was mixed.

Such a T[] now takes the shape when its entry has a hash of its own and is typed as that T. The two types are compared as parsed, so class names and keywords match in any case, while shape keys and string literals must match exactly. A hash on a template type or type alias is left untranslated, since whether it needs an array or an object shape depends on what the name stands for.

Keys of a @param hash are optional, which is wrong for a value whose keys are always set, such as a parsed block, and there was no way to say otherwise. A Required. sentence opening or closing a key's description, as core already writes it in many hashes, now makes the key required. Unlike Optional., it must be capitalized, since prose mistaken for it would report an error at every call leaving the key out.

The sharper types exposed docblocks contradicting the code, which are corrected: the type of each settings error is always set, and neither the user_id of wp_initialize_site() nor the href of a preloaded image is required. The blocks resolve_pattern_blocks() takes and returns are documented with the block hash, and the display arguments of WP_Widget_Categories::widget() are marked required, removing errors deferred when they were documented as a hash in r64413.

At level 10, this fixes 64 errors and makes 15 existing issues visible, for 49 fewer errors overall.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/14457.
Follow-up to r63420, r64413.

Props westonruter, lancewillett.
See #62762, #65817, #65890.

Built from ​https://develop.svn.wordpress.org/trunk@65217

00:27 Changeset [64365] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover dead_db() and admin_color_scheme_picker().

Verify that dead_db() shows the database error in the admin and during installation, and the generic message everywhere else.

Verify that admin_color_scheme_picker() selects the given user's scheme rather than the current user's, falls back to modern when the scheme is missing or unknown, lists modern, fresh and light first, and renders each scheme's inputs, label and palette.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/5792, ​https://github.com/WordPress/wordpress-develop/pull/11740

Props pbearne.
Fixes #60102, #65184.

Built from ​https://develop.svn.wordpress.org/trunk@65216

00:22 Changeset [64364] by westonruter
  • trunk/wp-includes/general-template.php
  • trunk/wp-includes/version.php

Script Loader: Ignore image preloads that have no URL.

An image resource passed through the wp_preload_resources filter without an href was accepted when it had either imagesrcset or imagesizes, but imagesrcset was always used as the key for removing duplicates. A resource with only imagesizes therefore raised an undefined array key warning (plus a null array offset deprecation on PHP 8.5), collapsed every such resource onto the same empty key, and printed a <link> with no URL at all, since imagesizes is only output alongside imagesrcset. A resource with neither href nor as raised a warning as well.

Such a resource is now skipped unless as is image and imagesrcset is set. PHPStan reports the missing offsets once the filter's value is typed from its documented hash notation.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15380.
Follow-up to r53846.

Props westonruter, adamsilverstein.
See #65817.

Built from ​https://develop.svn.wordpress.org/trunk@65215

00:08 Changeset [64363] by lancewillett
  • trunk/wp-includes/version.php

Tests: Cover more admin helpers in misc.php.

Verify that got_url_rewrite() reports support for each server check it combines, and that the got_url_rewrite filter overrides the result in both directions.

Verify that iis7_save_url_rewrite_rules() writes a new web.config, adds WordPress rules to an existing one while keeping other rules, removes them when permalinks are plain, and returns early outside IIS and on multisite.

Verify that wp_reset_vars() prefers $_POST over $_GET, treats empty and '0' values as missing, and overwrites existing globals.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11657, ​https://github.com/WordPress/wordpress-develop/pull/11671, ​https://github.com/WordPress/wordpress-develop/pull/11737

Props pbearne, westonruter.
Fixes #65135, #65147, #65180.

Built from ​https://develop.svn.wordpress.org/trunk@65214

Note: See TracTimeline for information about the timeline view.