Test: full 200-plugin compatibility run against nightly. Not for merge. - #65
Draft
adamsilverstein wants to merge 577 commits into
Draft
Test: full 200-plugin compatibility run against nightly. Not for merge.#65adamsilverstein wants to merge 577 commits into
adamsilverstein wants to merge 577 commits into
Conversation
The impact on existing WordPress core code is expected to be minimal. The release updates some sniffs to account for changes in recent WordPress versions up to 7.0. References: * [https://github.com/WordPress/WordPress-Coding-Standards/releases/tag/3.4.0 WPCS 3.4.0 release notes] * [WordPress/WordPress-Coding-Standards@3.3.0...3.4.0 Full list of changes in WPCS 3.4.0] Follow-up to [56695], [56799], [57378], [57986], [60523], [61306]. Props jrf, dingo_d, garyj, rodrigosprimo, mattgaldino, pamprn, jasonkenison, jonmcpartland, rafaelfunchal, paulgibbs, tikifez, dd32, bhubbard, petitphp, paulopmt1, nicsevic, diegogarciarodrigues, Soean, SergeyBiryukov. Fixes #65659. git-svn-id: https://develop.svn.wordpress.org/trunk@62796 602fd350-edb4-49c9-b593-d223f7449a82
This adds precise `@param` and `@return` typing for the `wp_parse_list()`, `wp_parse_id_list()`, and `wp_parse_slug_list()` functions; native `array` return types are also added. It also adds casting and type guarding to guarantee the types of the values involved. Descriptions are updated to indicate that lists may not be returned, which may be unexpected given the function names; instead, sparse arrays or even associative arrays may be returned. Additionally, typically invalid ID values like zero may be in the array returned by `wp_parse_id_list()` and an empty string may be in the array returned by `wp_parse_slug_list()`. Tests are added to ensure existing behavior is preserved. This fixes 6 PHPStan errors at rule level 10. Developed in WordPress#12588. Follow-up to r38832, r44546, r57737, r62647, r62771. See #64898. git-svn-id: https://develop.svn.wordpress.org/trunk@62797 602fd350-edb4-49c9-b593-d223f7449a82
…tan-phpunit` to 2.0.18. Developed in WordPress#12597. Follow-up to r62495, r62618, See #64898. git-svn-id: https://develop.svn.wordpress.org/trunk@62798 602fd350-edb4-49c9-b593-d223f7449a82
Documents the `$post_type` parameter accepts both a single post type as a string or multiple post types as an array. Props drewapicture, spacedmonkey. Fixes #58189. git-svn-id: https://develop.svn.wordpress.org/trunk@62799 602fd350-edb4-49c9-b593-d223f7449a82
Using sectioning elements (`div` and `dialog`) inside the generated markup meant that the function couldn't be used inside a `p` element, because sectioning elements aren't valid HTML inside `p`. To make the function more useful as a general utility, use only `span` and `button` elements to build the content, avoiding browser parser breaking behavior. Developed in WordPress#12592 Props joedolson, khokansardar. Fixes #65660. git-svn-id: https://develop.svn.wordpress.org/trunk@62800 602fd350-edb4-49c9-b593-d223f7449a82
Guard against non-scalar (nested array) `blockGap` values in `wp_sanitize_block_gap_value()` before passing them to `preg_match()`, which requires a string subject. A malformed axial gap value such as `blockGap.top` being `array( '1rem' )` previously triggered an uncaught `TypeError`, breaking front-end rendering and REST API responses. Includes a direct unit test for `wp_sanitize_block_gap_value()` and a data provider case in `Tests_Block_Supports_Layout` covering rendering with a malformed axial block gap. Developed in WordPress#12604. Ports WordPress/gutenberg#80464 to Core. Props tyxla, ramonopoly. Fixes #65667. git-svn-id: https://develop.svn.wordpress.org/trunk@62801 602fd350-edb4-49c9-b593-d223f7449a82
This aims to make the tests more discoverable and easier to expand. Includes converting the tests to use a named data provider. Follow-up to [703/tests], [51182]. Props birgire, gschoppe, sukhendu2002, SergeyBiryukov. See #42517, #64894. git-svn-id: https://develop.svn.wordpress.org/trunk@62802 602fd350-edb4-49c9-b593-d223f7449a82
… `<?` tag.
This allows for using both of the following single-line headers formats:
{{{
<?php // Template Name: Full-Width ?>
}}}
or with a PHP short open tag:
{{{
<? # Template Name: Full-Width ?>
}}}
Previously, only the first one would be recognized correctly.
Follow-up to [51182], [62802].
Props birgire, gschoppe, sukhendu2002, SergeyBiryukov.
Fixes #42517.
git-svn-id: https://develop.svn.wordpress.org/trunk@62803 602fd350-edb4-49c9-b593-d223f7449a82
Add `comment_type != 'note'` to the three raw comment feed queries, matching the exclusion already used by `WP_Comment_Query` and `wp_count_comments()`. [61105] excluded the `note` type in `WP_Comment_Query`, but the comment feed queries are built with raw SQL that bypasses `WP_Comment_Query` entirely, so the exclusion never reached feeds. Follow-up to [61105]. Props westonruter, wildworks, mukesh27, odkdn1, khokansardar. Fixes #65613. git-svn-id: https://develop.svn.wordpress.org/trunk@62804 602fd350-edb4-49c9-b593-d223f7449a82
Fix an issue where client-side media uploads of JPEGs with a quarter-turn EXIF orientation (values 5-8) failed with a 400 `rest_upload_dimension_mismatch` error, because the rotated file's swapped width and height did not match the stored metadata. An `image_size=original` sideload is now handled like a `scaled` one: the rotated file becomes the attachment's main file and the untouched upload is kept as `original_image`, matching what core does when it rotates on upload. Finalize also resets the stored EXIF orientation once rotation has been applied. Follow-up to [61982], [62619]. Props adamsilverstein, andrewserong, ramonjd. Fixes #65643. git-svn-id: https://develop.svn.wordpress.org/trunk@62805 602fd350-edb4-49c9-b593-d223f7449a82
…dex. When client-side media processing is active, image decoding, scaling, and encoding happen in the browser, so no server-side `WP_Image_Editor` is instantiated. As a result the `image_strip_meta` and `image_max_bit_depth` filters never influence generated images, and plugins relying on them have no effect on client-generated sub-sizes. Expose the filtered values of both hooks on the REST API index inside the existing client-side media processing block in `WP_REST_Server::get_index()`, alongside the already-exported `image_size_threshold`, so the client encoder can honor them. The client-side consumption of these values ships via the Gutenberg package updates in WordPress/gutenberg#80218. Props westonruter, soyebsalar01. Fixes #65623. git-svn-id: https://develop.svn.wordpress.org/trunk@62806 602fd350-edb4-49c9-b593-d223f7449a82
Fix an issue with animated GIF conversion where the conversion worker could not be resolved from the script modules import map. `wp_set_client_side_media_processing_flag()` re-declared the `wp-upload-media` module dependencies via `WP_Scripts::add_data()`, which overwrites rather than merges, wiping the `@wordpress/video-conversion/worker` entry already registered from the packages asset file. Additionally, only a minified build of the video-conversion worker is shipped, so with `SCRIPT_DEBUG` enabled the import map pointed at a non-existent `worker.js`. The always-minified exception in `wp_default_script_modules()` is extended from the vips modules to also cover `video-conversion/worker.js`. Follow-up to [62428]. Props andrewserong, swissspidy. Fixes #65664. git-svn-id: https://develop.svn.wordpress.org/trunk@62807 602fd350-edb4-49c9-b593-d223f7449a82
* Add type information. * Fix erroneous fallback case for `MockAction::current_filter()` in how it gets the last key of `$wp_actions`. * Fix `MockAction::get_call_count()` to handle getting counts of a provided filter in addition to a provided action. Developed in WordPress#12618. See #64898, #64894. git-svn-id: https://develop.svn.wordpress.org/trunk@62808 602fd350-edb4-49c9-b593-d223f7449a82
This aims to make the tests more discoverable and easier to expand. Follow-up to [41975]. See #64894. git-svn-id: https://develop.svn.wordpress.org/trunk@62809 602fd350-edb4-49c9-b593-d223f7449a82
This aims to speed up processing and reduce memory footprint when parsing the `Template Name` and `Template Post Type` headers for themes with many template files by replacing two `file_get_contents()` calls with a single `get_file_data()` call, which only reads the first 8KB of each file instead of the entire contents. `get_file_data()` already calls `_cleanup_header_comment()` internally, so the parsed output is equivalent to the previous manual cleanup. Additionally, the `extra_theme_headers` filter is now applied, bringing consistency with parsing the other theme file headers, such as in the `WP_Theme` constructor. Includes unit tests covering the caching behavior, cache invalidation on theme switch, and `get_file_data()` integration. Follow-up to [20029], [20041], [20317], [20327], [20588], [38951], [62809]. Props gschoppe, MythThrazz, birgire, swissspidy, sukhendu2002, sachinrajcp123, SergeyBiryukov. Fixes #42513. git-svn-id: https://develop.svn.wordpress.org/trunk@62810 602fd350-edb4-49c9-b593-d223f7449a82
Icons registered with inline SVG content are now stored in their sanitized form, so disallowed markup such as event handler attributes is no longer retained in the registry or returned to consumers. Developed in: WordPress#12623 Follow-up to [62748]. Props tyxla, wildworks. See #64847. git-svn-id: https://develop.svn.wordpress.org/trunk@62811 602fd350-edb4-49c9-b593-d223f7449a82
On the plugins and themes screens, the currently active tab could not be distinguished in Windows High Contrast mode, because both current and inactive tabs were marked using a bottom border color. Add a transparent outline visible in Windows High Contrast mode. Developed in WordPress#12107 Props wildworks, nimeshatxecurify, dervishov, manhar, abdullahramzan, sanayasir, r1k0, jamesbregenzer, joedolson. Fixes #65419. git-svn-id: https://develop.svn.wordpress.org/trunk@62812 602fd350-edb4-49c9-b593-d223f7449a82
…nt`. A negative file size is clearly impossible, and the return value of 0 is already documented as being the error case. * Values filtered by `pre_wp_filesize` and `wp_filesize` are cast to `int` if they are numeric. * Non-numeric values returned by the `wp_filesize` filter are discarded in favor of zero. * Negative values filtered by the `pre_wp_filesize` filter are treated the same as `null` (and do not short-circuit). * Negative values returned by the `wp_filesize` filter are clamped to be at least zero. Developed as part of WordPress#12611. Follow-up to r52837, r52932. Props westonruter, apermo. See #65670, #64898. git-svn-id: https://develop.svn.wordpress.org/trunk@62813 602fd350-edb4-49c9-b593-d223f7449a82
In post list tables, subpages within hierarchical post types were visibly marked using an em dash to represent their nesting position. This information was not communicated in any way to screen reader users. Add `aria-describedby` with associated descriptive text to linked post titles, and screen reader text for non-editable post title contexts. Developed in WordPress#12394 Props juliemoynat, audrasjb, ekaterina92, ishikaatxecurify, aion11, sabernhardt, maxerns, joedolson. Fixes #64932. git-svn-id: https://develop.svn.wordpress.org/trunk@62814 602fd350-edb4-49c9-b593-d223f7449a82
* The return value of the `WP_REST_Attachments_Controller::get_attachment_filesize()` method is narrowed from `int|null` to `non-negative-int|null`. * The stored `filesize` attachment metadata is only returned if it is a numeric value and is greater than zero; it is cast to an `int`, preventing a `TypeError` if a non-numeric string was stored in metadata. * The `filesize` property of the attachments endpoint adds `null` as a possible value in addition to `integer`. Developed in WordPress#12611. Follow-up to r62813, r61703. Props apermo, westonruter, xate, mukesh27. Fixes #65670. git-svn-id: https://develop.svn.wordpress.org/trunk@62815 602fd350-edb4-49c9-b593-d223f7449a82
Meta boxes render three buttons: move up, represented by an up arrow; move down, represented with a down arrow; and show/hide, represented by a triangle pointer. These icons have clear accessible names, but no tooltips to communicate their functionality visually. Apply the API added in [62741] to display these tooltips, and update the API so that users can pass existing button or anchor HTML into the `wp_get_tooltip()` function to apply tooltips to existing interface components. Developed in WordPress#12528 Props ibachal, sergeybiryukov, afercia, sabernhardt, sirlouen, joedolson, khokansardar, wildworks, adrianduffell, peterwilsoncc, jorbin, jeremyfelt. Fixes #50921, See #51006. git-svn-id: https://develop.svn.wordpress.org/trunk@62816 602fd350-edb4-49c9-b593-d223f7449a82
RSS widgets use an icon link to point to the RSS feed used for that widget. All icons used the same `alt` text of "RSS", which describes the image, rather than describing the link. Update the widget so the alt text also includes the name of the RSS feed in use, making each instance of the link on a page with multiple RSS widgets unique and clarifying the target of the link for screen reader users. Developed in WordPress#8854 Props tpaw, mukesh27, audrasjb, afercia, sabernhardt, joedolson. Fixes #47670. git-svn-id: https://develop.svn.wordpress.org/trunk@62817 602fd350-edb4-49c9-b593-d223f7449a82
The `notify_post_author` filter is documented as overriding the site setting, but the comment approval and type checks ran after the filter, so a callback returning true could not force a notification for an unapproved comment. Move those checks before the filter by using the comment status and type to build the default value: notes default to the `wp_notes_notify` option regardless of approval status, unapproved comments default to false, and approved comments default to the `comments_notify` option. The filter now receives false for unapproved comments instead of the raw option value, giving developers complete control over notifications. Invalid comment IDs now return false without firing the filter. Props westonruter, jorbin. Fixes #64217. git-svn-id: https://develop.svn.wordpress.org/trunk@62818 602fd350-edb4-49c9-b593-d223f7449a82
The client-side media processing feature added `crossorigin="anonymous"` to AUDIO, IMG, and VIDEO tags in the Backbone media templates printed by `wp_print_media_templates()`. Forcing the attribute on IMG tags triggers CORS requests that fail for images served without `Access-Control-Allow-Origin` headers, breaking media library previews for media offloaded to a CDN. This is the same problem previously fixed for `wp_add_crossorigin_attributes()` in [62048]: under `Document-Isolation-Policy: isolate-and-credentialless`, browsers load cross-origin images in credentialless mode, so the attribute is unnecessary on IMG tags. The media templates have a separate injection path that was missed at the time. Remove IMG from the list of tags receiving the attribute so both paths match. AUDIO and VIDEO tags are unchanged. Follow-up to [62048]. Props khokansardar, iamchitti, ianmjones, swissspidy. Fixes #65673. git-svn-id: https://develop.svn.wordpress.org/trunk@62819 602fd350-edb4-49c9-b593-d223f7449a82
…dits Fixes image edits (rotate, crop, flip) landing in the wrong frame for photos whose EXIF orientation tag was never applied to their pixels, most visibly iPhone JPEGs. Rotating such a photo in the media editor modal or the Image block cropper previously appeared to do nothing. `WP_REST_Attachments_Controller::edit_media_item()` edits the image from `wp_get_original_image_path()`. That original image often still carries an unapplied EXIF orientation tag. `WP_REST_Attachments_Controller::edit_media_item()` now calls `$image_editor->maybe_exif_rotate()` before modifying the image for cropping. Developed in: [https://github.com/WordPress/wordpress-develop/pull/12492](https://github.com/WordPress/wordpress-develop/pull/12492) Props ramonopoly, andrewserong, adamsilverstein. Fixes #65618. git-svn-id: https://develop.svn.wordpress.org/trunk@62820 602fd350-edb4-49c9-b593-d223f7449a82
The name validation in `WP_Icons_Registry::register()` allowed unqualified icon names to end with a hyphen or an underscore, while the REST API route for icons did not, so an icon could be registered under a name that was unreachable through the REST API. Tighten the regular expression so that an unqualified icon name must both start and end with a lowercase letter or digit. Developed in: WordPress#12624 Follow-up to [62748]. Props mukesh27, tyxla, wildworks. See #64847. git-svn-id: https://develop.svn.wordpress.org/trunk@62821 602fd350-edb4-49c9-b593-d223f7449a82
Add a `Data_Array` array-shape type describing the keys returned by `WP_Comment::to_array()`, and narrow the properties it covers: `comment_approved` and the two datetime fields become `non-empty-string`, and the values core uses for it and for `comment_type` are documented. `comment_type` itself stays a plain `string`, because comments created before 5.5.0 may store an empty string rather than 'comment', which is why `get_comment_type()` normalizes that case on read. Declare the 21 post fields that `WP_Comment::__get()` proxies to the comment's post as `@property-read`, typed to match the corresponding `WP_Post` property. These were previously invisible to static analysis, IDE completion, and the generated documentation. Also correct `WP_Comment::$children`, previously a bare `array`, which is `null` until `get_children()` populates it, and type the comment arrays keyed by comment ID as `array<int, WP_Comment>`, since PHP coerces the numeric string `comment_ID` to an integer key on assignment. Add conditional return types to `WP_Comment::get_children()`, `get_comment()`, `get_comments()`, and `get_approved_comments()`, and document every argument `::get_children()` actually accepts, several of which were already in use but undocumented. Comment ID arrays are narrowed to `non-negative-int[]`, and `WP_Comment_Query::$comments` is typed as `null` until a query is run. Several latent issues surfaced by the analysis are fixed: * `WP_Comment::get_children()` now returns a `count` or `fields` query directly rather than storing it in the children cache. That cache holds `WP_Comment` objects and is read back by `add_child()`, `get_child()`, and the 'flat' format, so writing an integer or a list of IDs into it left the object returning the wrong thing on a subsequent call. * `get_comment()` now hands only numeric values to `WP_Comment::get_instance()`. Previously anything that was not a `WP_Comment` or some other object fell through to be cast to an integer ID, even if it wasn't numeric. Now `null` is returned in such cases. * `WP_Comment::get_instance()` ignores a non-object read from the comment cache rather than passing it to the `WP_Comment` constructor, where `get_object_vars()` would raise a `TypeError`. * `WP_Comment::__isset()` returns `false`, and `WP_Comment::__get()` returns `null`, when the comment's post no longer exists, instead of raising a `TypeError` and a warning respectively. `__get()` also returns `null` when the comment is not attached to a post at all; previously `get_post( 0 )` fell back to the global `$post`, so the getter returned an unrelated post's field even though `__isset()` reported that same property as unset. Developed in WordPress#12606. Follow-up to r34583, r62648, r62694, r62717. Props westonruter, adamsilverstein. See #64898. git-svn-id: https://develop.svn.wordpress.org/trunk@62822 602fd350-edb4-49c9-b593-d223f7449a82
The toolbar and post embeds request `get_site_icon_url( 64 )` and build a 2x `srcset` for high-density displays, but `WP_Site_Icon` only generated crops at 270, 192, 180, and 32 pixels. With no 64px crop available, the request fell back to the next largest size — the default 150x150 thumbnail — which is far larger than needed to render a 20x20 (or 28x28 on mobile) icon. Add a 64px entry to the list of generated crop sizes so browsers can download a much smaller file on retina displays. This also benefits post embeds, which request the same size. Developed in: WordPress#12607. Props fushar, tyxla. Fixes #65668. git-svn-id: https://develop.svn.wordpress.org/trunk@62823 602fd350-edb4-49c9-b593-d223f7449a82
This updates the pinned commit hash of the Gutenberg repository from `e73c3c481db0650183f092af157f6e42efe9ee2d` to `4997026b75c922d8a6f77a03d72ed7cad04c7073`. A full list of changes included in this commit can be found on GitHub: WordPress/gutenberg@e73c3c4...4997026 - Notes: Replace blur-deselect bookkeeping with useFocusOutside (WordPress/gutenberg#80222) - Playlist: Update @SInCE tags to 7.1.0 (WordPress/gutenberg#80317) - fix playlist block Dimensions Design (WordPress/gutenberg#80312) - UI: Backport compat overlay fixes to WordPress 7.1 (WordPress/gutenberg#80322) - Editor: allow selecting which block styles to apply globally (WordPress/gutenberg#79839) - Global Styles: Reject non-string custom CSS in the REST controller (WordPress/gutenberg#80338) - Open inspector sidebar when toggling responsive editing (WordPress/gutenberg#80307) - Client Side Media: Honor image_strip_meta and image_max_bit_depth on the client upload path (WordPress/gutenberg#80218) - Hide block style variations when state is enabled in global styles (WordPress/gutenberg#80341) - Media REST API: Fix sideload and finalize for EXIF rotated images (WordPress/gutenberg#80295) - Fix upload snackbar stuck in uploading state on server-side uploads (WordPress/gutenberg#80345) - Try fixing responsive layout in Nav block (WordPress/gutenberg#80305) - Responsive styles: Use viewport dropdown to control states for in-editor global styles sidebar (WordPress/gutenberg#80339) - RichTextControl: Replace DOM focus tracking with a single React-tree focus boundary (WordPress/gutenberg#80324) - Notes: Finish WPDS treatment for mention chips (WordPress/gutenberg#80300) - Notes: Add placeholders to the RichText fields (WordPress/gutenberg#80296) - Fix upload hang when converting long animated GIFs: decode only the first frame for still outputs (WordPress/gutenberg#80260) (WordPress/gutenberg#80342) - Device preview dropdown: use active color for device icon when responsive styles are active (WordPress/gutenberg#80346) - Fix default aspect ratio for lazy loaded Featured image (WordPress/gutenberg#80386) - Vips/upload-media: consolidate optional params into options objects (WordPress/gutenberg#80330) - Autocompleters: Don't pre-encode mention search terms (WordPress/gutenberg#80377) - Animated GIF uploads: generate sub-sizes from the first frame, matching core (WordPress/gutenberg#80268) - Custom CSS: Fix cascade order against block style variations (WordPress/gutenberg#80340) - Rich Text: Restore the selection when focus returns to the editable (WordPress/gutenberg#80396) - Notes: Arm the mention kses allowance on REST note creation (WordPress/gutenberg#80221) - Fix upload snackbar double-counting a single HEIC upload in Safari (WordPress/gutenberg#80436) - ContentEditableControl: fix invalid label association with contenteditable div (WordPress/gutenberg#80441) - Editor: Disable canvas resizing while zoomed out (WordPress/gutenberg#80391) - Fix Color Picker Cursor Shaking Issue (WordPress/gutenberg#80205) (WordPress/gutenberg#80435) - Misc fixes for WordPress-Develop 7.0 merges (WordPress/gutenberg#80444) - Style Book: Restore live global styles updates on the styles route (WordPress/gutenberg#80459) - Worker threads: reject pending RPC calls on worker failure or termination (WordPress/gutenberg#79955) (WordPress/gutenberg#80421) - Media: Add timeout and size guardrails to client-side GIF to video conversion (WordPress/gutenberg#80420) - Post Content: Use the default block appender for empty content (WordPress/gutenberg#80026) - Block Supports: Handle nested array block gap values properly (WordPress/gutenberg#80464) - Editor: Restore fixed device preview height for mobile and tablet (WordPress/gutenberg#80466) - Block Editor: Guard against non-string spacing preset values (WordPress/gutenberg#80467) - Writing flow: fully select the ancestor when a text selection crosses a nesting boundary (WordPress/gutenberg#80462) - Block Editor: Reflect inherited Global Styles values in block inspector controls (WordPress/gutenberg#80481) - Autocomplete: Reference the suggestions list with `aria-controls` and `aria-haspopup` (WordPress/gutenberg#80403) (WordPress/gutenberg#80499) - Media: Remove the redundant __heicUploadSupport flag (WordPress/gutenberg#80486) - State control - avoid tertiary variant on toggle to match style of other dropdown toggles (WordPress/gutenberg#80505) - Icons: Store the sanitized SVG content when registering an icon (WordPress/gutenberg#80508) - Fix `useHomeEnd` on tabs in mac testing (WordPress/gutenberg#80374) - Playlist: Fix playback of tracks served without CORS headers (WordPress/gutenberg#80533) - Redirect editing events to extension handlers under editableRoot (WordPress/gutenberg#80287) - Writing flow: fully select the items when a selection extends down into a nested item (WordPress/gutenberg#80492) - Global Styles panels: fix wrong preset committed and shown when two color presets share a hex (WordPress/gutenberg#80497) - Replaces the `title` attributes used by revision inline diff annotations with `aria-describedby` (WordPress/gutenberg#80440) - Notes: Remove "Add note" from the inline styles dropdown (WordPress/gutenberg#80531) - Global Styles: Resolve per-level heading element styles in block inspector controls (WordPress/gutenberg#80495) - Notes: Render @ mentions as span chips and narrow the kses class allowance (WordPress/gutenberg#80528) - Revisions: Specify block level diff status via aria-label (WordPress/gutenberg#77779) - Backport from Core: improve icon name unit tests (WordPress/gutenberg#80552) - Device type preview: fix collapsing to content height (WordPress/gutenberg#80553) - Wrap notices in ThemeProvider with 0 corner radius (WordPress/gutenberg#80557) - Global Styles: Limit the inherited value treatment to the Gutenberg plugin (WordPress/gutenberg#80555) - Fix crashes when manipulating locked blocks (WordPress/gutenberg#80509) - Notes: align floating threads with their inline marker (WordPress/gutenberg#79877) Props wildworks. See #65529. git-svn-id: https://develop.svn.wordpress.org/trunk@62824 602fd350-edb4-49c9-b593-d223f7449a82
Rework the WP_View_Config_Data write API around merge(), replace(), set(), and remove(), all operating on patches of top-level keys and taking the schema version the change was authored against. Make get_data() private and move filter application into a new apply_filters() method so callbacks cannot read the materialized configuration and become coupled to its shape. Update the default post type configuration callbacks to use the new single-patch set() signature. Adapt and expand the unit tests accordingly. Props oandregal, jorgefilipecosta, ntsekouras, t-hamano. Fixes #65577. git-svn-id: https://develop.svn.wordpress.org/trunk@62825 602fd350-edb4-49c9-b593-d223f7449a82
Converts the `WP_HTML_Processor::class_list()` and `WP_HTML_Tag_Processor::class_list()` examples to runnable WordPress Playground snippets. Corrects the encoded closing angle bracket so the expected output matches the parsed class name. Developed in WordPress#13034. Props jonsurrell. See #64896. git-svn-id: https://develop.svn.wordpress.org/trunk@63293 602fd350-edb4-49c9-b593-d223f7449a82
The `strip_baseline_includes()` function in `generate-baselines.php` dropped an `includes` entry only when it resolved inside the output directory. With the default output directory, that test covers the managed region exactly, so nothing appeared amiss. When `--output-dir` was used to point the output elsewhere, however, every baseline already in force stayed active for the analysis, which then reported only the errors those baselines did not already cover: a differential baseline where a complete one was requested. Strip the region between the `# phpstan:baselines` markers whatever it points at, since that region is generated and lists every baseline in force. The output directory test is kept as well, so a baseline listed by hand outside the markers is still suppressed when it is about to be rewritten. Found while generating a baseline from the 7.0.0 source tree to identify which errors have been introduced since: with the managed region left in place, PHPStan refused to start at all, as two of the entries named files which do not exist in 7.0.0. Follow-up to r63019. See #64680, #65817. git-svn-id: https://develop.svn.wordpress.org/trunk@63294 602fd350-edb4-49c9-b593-d223f7449a82
Four independent clean-ups in the test file: - **Remove the unused `$user_ids` fixture.** The property and its `wpSetUpBeforeClass()` method were copied over from the `wp_insert_post()` tests. Nothing in this class references `self::$user_ids`, so the only effect was creating three users for every test in the class. - **Rename `test_wp_delete_post_returns_false_for_invalid_post()`** to `test_wp_delete_post_returns_null_for_already_deleted_post()`. The test asserts `assertNull()`, and that is the correct expectation: for an ID with no matching row, `wp_delete_post()` returns the `null` coming out of `$wpdb->get_row()`, whereas `false` is only returned by the `$post_id <= 0` guard. The old name described the opposite of what the test covers. - **Reuse the `$actions` array** in the assertion loop of `test_wp_delete_post_actions()`. The same six action names were spelled out a second time inline, so the registration loop and the assertion loop could drift apart. - **Fix the `@ticket @63975` annotation.** The stray `@` made the tag invalid, so the test was not associated with the ticket. No assertion was added, removed or changed, and no test behavior changes. Developed in WordPress#13036. Follow-up to [60906]. Props Soean. See #65819. git-svn-id: https://develop.svn.wordpress.org/trunk@63295 602fd350-edb4-49c9-b593-d223f7449a82
The `esc_attr()`, `esc_html()`, `esc_js()`, `esc_textarea()`, and `esc_xml()` functions were each annotated `@param string $text`, but none of them has ever required a string at runtime. Both `wp_check_invalid_utf8()` and `_wp_specialchars()` open by casting to string, and that coercion dates to r10298 and r11380, the same year `esc_attr()` and `esc_html()` were introduced in 2.8.0. Only the annotation ever claimed otherwise, which is why passing an integer, overwhelmingly a post ID, a term ID, or a count, has always worked while still registering as a static analysis error. Widen the annotation to `string|int|float` and cast at the top of each function. That cast is not redundant with the ones downstream: it is what makes the `$text` argument handed to the `attribute_escape`, `esc_html`, and `js_escape` filters match its documented `string` type, where callbacks previously received the raw integer or float. For `esc_textarea()` it also affects the output, since that function passed `$text` straight to `htmlspecialchars()`, so `esc_textarea( null )` emitted a deprecation notice on PHP 8.1 and later. The `bool` type is deliberately excluded. Casting `true` yields `'1'` while `false` yields the empty string, and an empty string is indistinguishable from a missing value in any output context. The two call sites in core which pass one stay baselined rather than being permitted by the signature; one of the two is an a11y defect being addressed separately. Regenerating the baselines drops 54 entries covering 101 errors from `tests/phpstan/baselines/argument.type.neon`, where `esc_attr()` was the largest single cluster. Developed in WordPress#13044. Follow-up to r11380, r63024. See #65817. git-svn-id: https://develop.svn.wordpress.org/trunk@63296 602fd350-edb4-49c9-b593-d223f7449a82
`current( array_keys( $array ) )` builds a complete array of every key only to read the first one and discard the rest, whereas `array_key_first()` reads the first bucket directly. The function has been native since PHP 7.3, below the current minimum supported version, and core already uses it in `wp_replace_in_html_tags()`. Behavior is unchanged: the toolbar's `$actions` cannot be empty at that point, and in the privacy tools `absint()` normalizes `null` and `false` alike. Developed in WordPress#12785. Follow-up to r18788, r42986. Props mukesh27, soean. Fixes #65773. git-svn-id: https://develop.svn.wordpress.org/trunk@63297 602fd350-edb4-49c9-b593-d223f7449a82
…r throws `WP_AI_Client_Prompt_Builder::__call()` stored a caught exception as the error state, but only special-cased generating methods before falling through to the fluent return. The eight support check methods therefore handed back the builder instance, which is truthy, so a failed support check read as a success. Return `false` from support check methods in the `catch` block, matching what they already return when the builder is in a pre-existing error state or when the prompt is prevented by a filter. The error is still recorded, so a later generating call still receives the `WP_Error`. Props bejignesh, irozum, gziolo. Fixes #65781. git-svn-id: https://develop.svn.wordpress.org/trunk@63298 602fd350-edb4-49c9-b593-d223f7449a82
`WP_AI_Client_Prompt_Builder` had no `__clone()`, so cloning it copied the reference to the wrapped `PromptBuilder` instead of the builder itself. That builder mutates its own state, so the clone handed to the `wp_ai_client_prevent_prompt` filter shared its messages and configuration with the original, and a filter could change the prompt that was then sent to the provider, despite the clone being documented as read-only. Add `__clone()` so the wrapped builder, and any stored error, are copied too. The bundled client already implements `PromptBuilder::__clone()` to deep clone messages, model config and request options, it just never ran because only the wrapper was being cloned. Props bejignesh, gziolo. Fixes #65782. git-svn-id: https://develop.svn.wordpress.org/trunk@63299 602fd350-edb4-49c9-b593-d223f7449a82
…HPUnit bootstrap. Developed in WordPress#13048. Follow-up to r49535, r51581. Props mukesh27. See #65818. git-svn-id: https://develop.svn.wordpress.org/trunk@63300 602fd350-edb4-49c9-b593-d223f7449a82
…PHPStan. PHPStan infers the `WP_HTML_Tag_Processor::parse_next_tag()` method as pure, so the `STATE_READY` value narrowed onto `$parser_state` before the call survives across it, even though the method reassigns that property throughout its body. Every state comparison that follows in the `base_class_next_token()` method is then decided at analysis time rather than at runtime: both `&&` operands resolve to `true`, the early `return true` is treated as unconditional, and the remainder of the method is analyzed as unreachable. This in turn leaves `skip_rawtext()` and `skip_script_data()` reported as uncalled and `$skip_newline_at` as never assigned an `int`. Adding `@phpstan-impure`, the annotation PHPStan's own tip recommends, resolves ten baselined errors across six identifiers; `next_tag()` in the same class already carries it. This empties the `booleanAnd.alwaysTrue` and `property.unusedType` baselines, so both files are removed along with their `includes` entries in `phpstan.neon.dist`. Developed in WordPress#13057. Follow-up to r61934, r63023. Props tstokes8040. See #65817. git-svn-id: https://develop.svn.wordpress.org/trunk@63301 602fd350-edb4-49c9-b593-d223f7449a82
Two test cases still used the legacy PHPUnit stub API. This replaces them with the modern shorthands, which are what the rest of the suite already uses.
`tests/phpunit/tests/pomo/pluralForms.php`
{{{
// Before
->will( $this->returnValue( 1 ) );
// After
->willReturn( 1 );
}}}
`tests/phpunit/tests/rest-api/rest-server.php`
{{{
// Before
->with( $this->equalTo( 400 ) );
// After
->with( 400 );
}}}
**Why this is safe**
`willReturn()` is a direct shorthand for `will( $this->returnValue() )` and has been available since PHPUnit 5.4. The test suite enforces a minimum of PHPUnit 5.7.21 in `tests/phpunit/includes/bootstrap.php`, so it is safe on every supported version, and the suite already contains 83 `willReturn()` calls.
`with()` wraps any non-`Constraint` argument in an `equalTo()` constraint itself, so passing `400` directly is identical in behaviour. The suite already has 43 `with()` calls that pass values directly.
Note on the first change: that line was originally written as `willReturn( 1 )` and switched to the long form in r41725 because of the PHPUnit versions supported back then. That constraint no longer applies, so this effectively reverts an obsolete workaround.
Developed in WordPress#13052.
Follow-up to r34928, r41725.
Props Soean.
See #65819.
git-svn-id: https://develop.svn.wordpress.org/trunk@63303 602fd350-edb4-49c9-b593-d223f7449a82
The header backgrounds now ship with WordPress as SVG files instead of being fetched from the CDN, the feature images have been recompressed, and those below the fold are lazy loaded. Follow-up to [63182]. Props iamchitti, joedolson, markoserb, mukesh27, peterwilsoncc, wildworks. Fixes #65854. git-svn-id: https://develop.svn.wordpress.org/trunk@63304 602fd350-edb4-49c9-b593-d223f7449a82
Reverts the focus and hover style changes in the admin toolbar. Reverts [63190], [63009], and [63188], restoring the appearance in WordPress 7.0. Props fushar, wildworks, ravichudasama01, afercia, joen, keoshi, cbusquets1989, annezazu. Fixes #65849. See #65445. git-svn-id: https://develop.svn.wordpress.org/trunk@63306 602fd350-edb4-49c9-b593-d223f7449a82
Fixes the behavior of `url_to_postid()`, which treated a `www.` string anywhere in the URL as optional, breaking some URLs. Anchor the string so that is only considered optional when at the beginning of a URL string. Follow up to [63207]. Props youknowriad, johnbillion, wildworks, irozum, joedolson. Fixes #65016. git-svn-id: https://develop.svn.wordpress.org/trunk@63307 602fd350-edb4-49c9-b593-d223f7449a82
Add gzip directives to the nginx config template used by the local Docker environment so that HTML, JavaScript, CSS, JSON, XML, and SVG responses can be served compressed, matching normal production behavior. Without compression, frontend performance analysis against the local environment is not representative of a real user's experience. Compression is controlled by a new `LOCAL_NGINX_COMPRESSION` option, and it defaults to `off` so that it is opt-in. Since this changes `docker-compose.yml` in addition to the nginx template, existing checkouts need to recreate the web server container to pick up the change. Developed in WordPress#12529. Follow-up to r45745, r45783. Props westonruter, jblz. Fixes #65634. git-svn-id: https://develop.svn.wordpress.org/trunk@63308 602fd350-edb4-49c9-b593-d223f7449a82
When an `npx` command is run, the specified package will be downloaded and installed when it does not exist locally. This will also install all of the package’s direct and transitive dependencies, and any installation scripts present for every installed package are run. This is potentially dangerous because a compromised package would be able to run code on a local machine or within a GitHub Actions workflow runner. This replaces every `npx` call with `npm exec --no`, which runs an installed binary only and will fail when the package is missing. Additionally, `update-browserslist-db` is now defined as a direct `devDependency`. Props adrianmoldovanwp, desrosj, lancewillett, johnbillion. Fixes #65864. git-svn-id: https://develop.svn.wordpress.org/trunk@63309 602fd350-edb4-49c9-b593-d223f7449a82
…w runs. GitHub Actions expressions and contexts do not currently expose the details about a workflow run necessary to determine whether a workflow has timed out. Instead, all timed out runs are considered `cancelled`. However, the REST API does return a `timed_out` conclusion in this scenario. This creates a new job for the `timed_out` conlclusion and adjusts the logic for cancelled Slack notifications to provide more useful notifications. Props lancewillett. See #65845. git-svn-id: https://develop.svn.wordpress.org/trunk@63310 602fd350-edb4-49c9-b593-d223f7449a82
Replaces eight generic `assertTrue( is_callable() )` assertions with PHPUnit's dedicated `assertIsCallable()` assertion. Developed in WordPress#13017. Follow-up to r50996, r61760. Props raulsalvat, Soean. See #65819. git-svn-id: https://develop.svn.wordpress.org/trunk@63311 602fd350-edb4-49c9-b593-d223f7449a82
`validate_file()` runs `wp_normalize_path()` before testing for a drive letter at offset 1. That call folds backslashes to forward slashes, but its slash-collapsing regex deliberately spares a leading `//` to allow for network shares. UNC paths such as `//server/share`, and the device namespaces `//./` and `//?/`, therefore arrived with no colon in the second byte and returned `0` rather than `2`. The docblock described a return value of `2` as meaning the path contains a Windows drive path, which reads as a guarantee that Windows absolute paths are screened. Most forms were not. Anchoring a second test to the start of the string closes that gap. Stream wrappers stay at `0` by two separate mechanisms: a registered wrapper keeps its `://` through the scheme split, placing those slashes past the second byte, while an unregistered scheme has its `//` collapsed. Code `2` now fires on strictly more inputs and never fewer, so no existing rejection becomes an acceptance. Absolute POSIX paths such as `/etc/passwd` continue to return `0`; screening those would be a larger change affecting plugins that pass absolute template paths. Paths beginning with two successive slashes are now rejected regardless of platform, which includes the implementation-defined POSIX doubled-slash form, consistent with the assumption `wp_normalize_path()` already makes about a leading `//`. Props zieladam, SergeyBiryukov. Fixes #51368. git-svn-id: https://develop.svn.wordpress.org/trunk@63312 602fd350-edb4-49c9-b593-d223f7449a82
This temporarily marks the `SLACK_GHA_TIMEOUT_WEBHOOK` secret as optional until [63310] can be backported to older branches to avoid workflow failures. Follow-up to [63310]. See #65845. git-svn-id: https://develop.svn.wordpress.org/trunk@63313 602fd350-edb4-49c9-b593-d223f7449a82
Fixes a couple of functions with return-type problems. One is resolved by adding the missing `void` type, while the other is resolved by updating the function to conform to the existing `string` return type contract, a likely oversight in the original commit. This change was part of Contributor Day at WordCamp US 2026. Developed in: WordPress#13081 Discussed in: https://core.trac.wordpress.org/ticket/65817 Props dmsnell, nomadmystic. See #65817. git-svn-id: https://develop.svn.wordpress.org/trunk@63314 602fd350-edb4-49c9-b593-d223f7449a82
…quests. This workflow has not proven to be as useful as originally hoped, so it's being removed to reduce maintenance burden. All workflows that run the build script already fail if they result in untracked changes. Developed in WordPress#13087 Props desrosj See #65845 git-svn-id: https://develop.svn.wordpress.org/trunk@63315 602fd350-edb4-49c9-b593-d223f7449a82
…locks. The [https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/ PHP inline documentation standards] place `@return` immediately after the last `@param` tag, with no blank line between them: {{{ /** * Summary. * * @SInCE x.x.x * * @PARAM string $var Description. * @return string Description. */ }}} This corrects 44 docblocks across 33 files in `src/wp-includes` that used a line break between the two tags. Developed in WordPress#13063. Props mukesh27, dhruvang21. See #65818, #65860. git-svn-id: https://develop.svn.wordpress.org/trunk@63320 602fd350-edb4-49c9-b593-d223f7449a82
…ry` properties. Developed in WordPress#13126. Follow-up to r10584, r32990, r57734. Props pedromendonca, mukesh27, dhruvang21. Fixes #65901. git-svn-id: https://develop.svn.wordpress.org/trunk@63323 602fd350-edb4-49c9-b593-d223f7449a82
This sets 7.1 as the most recent branch of WordPress in the upgrade testing workflows. See #65845, #65844. git-svn-id: https://develop.svn.wordpress.org/trunk@63327 602fd350-edb4-49c9-b593-d223f7449a82
Core CI covers core itself, but nothing checks that a new version of WordPress can still boot with popular plugins active. When a plugin's assumptions about core stop holding the result is a fatal error on every request, which is a white screen for real sites and is only discovered after release. Add a workflow that fetches the most popular plugins from the WordPress.org API at run time, then installs and activates each one on its own against the version of WordPress under test. A fatal is caught whether it happens on activation, while WP-CLI loads WordPress, on a front end or login request, or in the debug log, so a white screen with error display turned off is still detected. Failures are reported per plugin in the workflow summary and one broken plugin never stops the rest of the shard from being tested. Plugins that cannot be downloaded are reported as skipped rather than failed so that a network flake does not turn the run red. The run is manual or weekly rather than part of every commit, since a third party plugin breaking should be a signal to release leads, not a red check on unrelated work.
The first run of this workflow reported four failures that were not fatals. Core refuses to activate a plugin whose `Requires Plugins` dependency is missing, which every WooCommerce extension hits when plugins are tested one at a time, and WP-CLI exits non-zero when a plugin redirects while loading. Both are correct behaviour, so record them as skipped and reserve a failure for an actual fatal. A front end request also reported the nonsense status "200000", because the curl fallback appended to output curl had already written. Capture the exit code separately so a stalled transfer is reported as what it is. The stall itself came from WordPress spawning WP-Cron as a loopback request that the single threaded built-in server could not answer while still serving the request that spawned it. Disable WP-Cron and give the server workers so plugin loopback requests cannot deadlock it. Ignore the zizmor unpinned image finding on the database service, which cannot be pinned to a digest while the version is an input.
The WordPress.org API caps `per_page` at 250 and quietly returns 250 for anything larger, so asking for more than that silently tested fewer plugins than requested. Page through the API instead and trim to the requested count, de-duplicating across pages because popularity ordering can shift between two requests. Reject a count above 1000 with a clear message rather than truncating without saying so. Size the shards to the plugin count rather than always splitting into five, so a run of 10 does not spin up five near empty jobs and a run of 250 is not squeezed into the same five. Point pull request and push runs at the latest stable release with a small count. Those runs exist to check that this workflow still works, and a genuine ecosystem fatal against nightly should not sit as a red check on every later change to these files.
A run that builds a single shard logged "across 1 shards".
Testing-only change to time a full 200-plugin run against nightly before the workflow lands upstream. The repository guards block all fork runs and manual dispatch is unavailable until the workflow file exists on trunk, so this branch allows fork runs and hardcodes the pull request self-test to nightly with 200 plugins.
The 200-plugin nightly run failed only on eps-301-redirects. Re-running against latest stable determines whether that fatal is a nightly core regression or a pre-existing plugin bug. Not for merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Claude set up this throwaway test run:
Test-only PR to trigger a full plugin compatibility run on the fork - 200 plugins against nightly - to check they all pass and see how long a full run takes. The workflow comes from WordPress#13198; this branch loosens the repository guards and hardcodes the pull request self-test to nightly with 200 plugins.
Not for merge. Close after reading the run results.
AI Use
Branch and description prepared with 🤖 Claude Code; the workflow under test is from PR 13198, which carries its own AI Use section. I will review and test.