…and `functions.wp-styles.php`.

These files now adhere to PHPStan level 8.

Developed in WordPress#10652

Follow-up to [61362], [61358].

See #64238.


git-svn-id: https://develop.svn.wordpress.org/trunk@61402 602fd350-edb4-49c9-b593-d223f7449a82

…oalescing.

Since PHP 7.0 introduced the [https://www.php.net/manual/en/migration70.new-features.php#migration70.new-features.null-coalesce-op null coalescing operator], and WordPress now requires at least PHP 7.2.24, `isset( $var ) ? $var : null` ternary checks can be safely replaced with the more concise `$var ?? null` syntax.

As some new code using the null coalescing operator has already been introduced into core in recent releases, this commit continues with the code modernization by implementing incremental changes for easier review.

Props seanwei, getsyash, krupalpanchal, wildworks, jorbin, SergeyBiryukov.
Fixes #63430. See #58874.

git-svn-id: https://develop.svn.wordpress.org/trunk@61403 602fd350-edb4-49c9-b593-d223f7449a82

…es::get_role()`.

Since PHP 7.0 introduced the [https://www.php.net/manual/en/migration70.new-features.php#migration70.new-features.null-coalesce-op null coalescing operator], and WordPress now requires at least PHP 7.2.24, `isset( $var ) ? $var : null` ternary checks can be safely replaced with the more concise `$var ?? null` syntax.

As some new code using the null coalescing operator has already been introduced into core in recent releases, this commit continues with the code modernization by implementing incremental changes for easier review.

Follow-up to [2703], [61403].

Props dilipbheda, mukesh27, spacedmonkey, SergeyBiryukov.
Fixes #63216. See #58874.

git-svn-id: https://develop.svn.wordpress.org/trunk@61404 602fd350-edb4-49c9-b593-d223f7449a82

…ng passed value to `string`.

This ensures that `wp_is_valid_utf8()` does not cause a type error since it only accepts strings. 

Developed in WordPress#10595

Follow-up to [60630].

Props hbhalodia, westonruter, desrosj, albigdd, jorbin.
See #38044.
Fixes #64347.


git-svn-id: https://develop.svn.wordpress.org/trunk@61405 602fd350-edb4-49c9-b593-d223f7449a82

…grades.

See #64224


git-svn-id: https://develop.svn.wordpress.org/trunk@61406 602fd350-edb4-49c9-b593-d223f7449a82

…iptive.

* Include the path, file name, and function name to better indicate the tested function.
* Move `@covers` annotation to the test class level.

Follow-up to [49109].

Props poena.
See #53010.

git-svn-id: https://develop.svn.wordpress.org/trunk@61407 602fd350-edb4-49c9-b593-d223f7449a82

…-party updates.

Follow-up to [14837], [26818], [33704].

Props NekoJonez, costdev, oglekler, SergeyBiryukov.
Fixes #57672.

git-svn-id: https://develop.svn.wordpress.org/trunk@61408 602fd350-edb4-49c9-b593-d223f7449a82

This aims to make the tests more robust.

Follow-up to [60295], [61391], [61392].

Props jonsurrell.
See #64225.


git-svn-id: https://develop.svn.wordpress.org/trunk@61409 602fd350-edb4-49c9-b593-d223f7449a82

…ge-based number.

Follow-up to [12157], [12407], [42631].

Props danieltj, bridgetwillard, davidbaumwald, subrataemfluence, garrett-eclipse, SergeyBiryukov.
Fixes #44090.

git-svn-id: https://develop.svn.wordpress.org/trunk@61410 602fd350-edb4-49c9-b593-d223f7449a82

`SCRIPT`, `STYLE`, and stylesheet `LINK` tags do not require a type attribute since the HTML5 standard was released in 2008. Removing the type attribute simplifies logic and normalizes the produced HTML content.

Developed in WordPress#10658.

Follow-up to [46164].

Props hardikhuptechdev, jonsurrell, dmsnell, westonruter.
Fixes #64428. See #59883, #64442.


git-svn-id: https://develop.svn.wordpress.org/trunk@61411 602fd350-edb4-49c9-b593-d223f7449a82

Follow-up to [13177], [15180].

See #64224.

git-svn-id: https://develop.svn.wordpress.org/trunk@61412 602fd350-edb4-49c9-b593-d223f7449a82

This ensures that not only the return values match the expected results, but also that their type is the same.

Going forward, stricter type checking by using `assertSame()` should generally be preferred to `assertEquals()` where appropriate, to make the tests more reliable.

Follow-up to [60490], [60524].

See #64324.

git-svn-id: https://develop.svn.wordpress.org/trunk@61413 602fd350-edb4-49c9-b593-d223f7449a82

Fix a regression from [61411] where CDATA wrappers were added to `SCRIPT` tags in WP Admin.

Developed in WordPress#10666.

Follow-up to [61411].

Props sabernhardt.
See #64428, #59883.


git-svn-id: https://develop.svn.wordpress.org/trunk@61414 602fd350-edb4-49c9-b593-d223f7449a82

Remove the following behaviors that are obsolete in HTML5:

- CDATA wrappers around `SCRIPT` tag contents.
- Conversion of boolean attributes to strings (attribute `async="async"` becomes `async`).

HTML5 was released in 2008 and data suggests virtually all WordPress sites are served as HTML5. See #59883 for more details.

Developed in WordPress#10660.

Props jonsurrell, westonruter, azaozz, soyebsalar01, dmsnell.
Fixes #64442. See #59883.


git-svn-id: https://develop.svn.wordpress.org/trunk@61415 602fd350-edb4-49c9-b593-d223f7449a82

…nd allow inlining empty stylesheets.

When a stylesheet is registered with a `path` that does not exist or which is not readable, then a `_doing_it_wrong()` is now issued. Previously, paths that did not exist were silently skipped; paths for empty styles were also needlessly skipped, since `wp_filesize()` also returns `0` for the failure case. 

Developed in WordPress#10653

Follow-up to [50836].

Props westonruter, jonsurrell, soyebsalar01.
See #52620.
Fixes #64447.


git-svn-id: https://develop.svn.wordpress.org/trunk@61416 602fd350-edb4-49c9-b593-d223f7449a82

This ensures that not only the return values match the expected results, but also that their type is the same.

Going forward, stricter type checking by using `assertSame()` should generally be preferred to `assertEquals()` where appropriate, to make the tests more reliable.

Follow-up to [1323/tests], [25554], [27081], [60788].

Props costdev, SergeyBiryukov.
See #64324.

git-svn-id: https://develop.svn.wordpress.org/trunk@61417 602fd350-edb4-49c9-b593-d223f7449a82

The HTML API escapes `<style>` tag contents to ensure the correct HTML structure. Common HTML escaping is unsuitable for `<style>` tags because they contain "raw text." The additional safety allows other restrictions, such as rejecting content with `<>`, to be relaxed or removed because the resulting tag will be well-formed.

Developed in WordPress#10656.

Props jonsurrell, westonruter, dmsnell, ramonopoly, soyebsalar01, drw158, sabernhardt.
See #64418.


git-svn-id: https://develop.svn.wordpress.org/trunk@61418 602fd350-edb4-49c9-b593-d223f7449a82

The latest version includes a security fix to ensure that the public key is on the prime order subgroup.

References:
* [https://github.com/paragonie/sodium_compat/releases/tag/v1.24.0 sodium_compat 1.24.0 release notes]
* [paragonie/sodium_compat@v1.23.0...v1.24.0 Full list of changes in sodium_compat 1.24.0]

Follow-up to [55699], [58752], [58753], [60787], [60905].

Props paragoninitiativeenterprises, johnbillion, SergeyBiryukov.
Fixes #64462.

git-svn-id: https://develop.svn.wordpress.org/trunk@61419 602fd350-edb4-49c9-b593-d223f7449a82

This ensures that not only the return values match the expected results, but also that their type is the same.

Going forward, stricter type checking by using `assertSame()` should generally be preferred to `assertEquals()` where appropriate, to make the tests more reliable.

Follow-up to [60954].

See #64324.

git-svn-id: https://develop.svn.wordpress.org/trunk@61420 602fd350-edb4-49c9-b593-d223f7449a82

Update copyright year to 2026 in `license.txt` and bundled themes.

Follow-up to [18201], [23306], [28064], [36855], [36856], [39659], [40241], [42424], [46719], [46720], [47025], [47026], [49915], [52427], [55024], [57235], [59568], [59569].

Props mukesh27.

git-svn-id: https://develop.svn.wordpress.org/trunk@61421 602fd350-edb4-49c9-b593-d223f7449a82

…ble releases.

PHP 8.3 changed from "Active support" to "Security fixes only" on January 1, 2026. 

Follow-up to [61421], [33937].

Props mukesh27, westonruter.
See #33758.


git-svn-id: https://develop.svn.wordpress.org/trunk@61422 602fd350-edb4-49c9-b593-d223f7449a82

…twork()` tests.

This aims to avoid affecting other tests in case of failure.

Follow-up to [60954], [61420].

See #64225.

git-svn-id: https://develop.svn.wordpress.org/trunk@61423 602fd350-edb4-49c9-b593-d223f7449a82

… place of `isset()` in ternaries.

Developed as a subset of WordPress#10654 

Follow-up to [61404], [61403].

See #58874, #63430.


git-svn-id: https://develop.svn.wordpress.org/trunk@61424 602fd350-edb4-49c9-b593-d223f7449a82

…()` to facilitate static analysis.

This resolves two PHPStan level 7 issues: `offsetAccess.notFound` and `argument.type`.

Follow-up to [44114].

See #64238, #45065.


git-svn-id: https://develop.svn.wordpress.org/trunk@61425 602fd350-edb4-49c9-b593-d223f7449a82

This resolves 10 `missingType.iterableValue` issues in PHPStan.

Follow-up to [61402], [61362], [61358].

See #64224, #64238.


git-svn-id: https://develop.svn.wordpress.org/trunk@61426 602fd350-edb4-49c9-b593-d223f7449a82

…hp` templates.

Props sabernhardt, himshekhar07, petitphp, karmatosed, SergeyBiryukov.
Fixes #58127.

git-svn-id: https://develop.svn.wordpress.org/trunk@61427 602fd350-edb4-49c9-b593-d223f7449a82

Follow-up to [34928].

See #64224.

git-svn-id: https://develop.svn.wordpress.org/trunk@61428 602fd350-edb4-49c9-b593-d223f7449a82

…f `isset()` in ternaries.

Developed as a subset of WordPress#10654
Initially developed in WordPress#4886

Follow-up to [61424], [61404], [61403].

Props costdev, westonruter.
See #58874, #63430.


git-svn-id: https://develop.svn.wordpress.org/trunk@61429 602fd350-edb4-49c9-b593-d223f7449a82

…ead of `isset()` ternaries.

Developed as a subset of WordPress#10654
Initially developed in WordPress#4886

Follow-up to [61429], [61424], [61404], [61403].

Props costdev, westonruter.
See #58874, #63430.


git-svn-id: https://develop.svn.wordpress.org/trunk@61430 602fd350-edb4-49c9-b593-d223f7449a82

…Query` structure.

The Query Loop block's `taxQuery` attribute now supports an include/exclude structure for term filtering. This updates the server-side query building to handle both the old format (e.g. `{"category":[4]}`) and the new format (e.g. `{"include":{"category":[4]},"exclude":{"post_tag":[5]}}`).

Props ntsekouras, westonruter, peterwilsoncc, mcsf.
Fixes #64416.

git-svn-id: https://develop.svn.wordpress.org/trunk@61650 602fd350-edb4-49c9-b593-d223f7449a82

Usernames, email, and password fields are currently `rtl` in `rtl` locales. However, these fields are primarily standardized to `ltr` character sets and for better experience and readability, should be presented left-to-right in all locales.

Fix username, email, and password fields throughout install and admin to be set to `ltr` text direction.

Props man4toman, sabernhardt, ierwira, agnieszkaszuba, SergeyBiryukov, joyously, hellofromTonya, shibleemehdi, oglekler, audrasjb, sajjad67, huzaifaalmesbah, joedolson.
Fixes #54915.

git-svn-id: https://develop.svn.wordpress.org/trunk@61651 602fd350-edb4-49c9-b593-d223f7449a82

Apply design reskin changes to focus states on links, classic editor, media library, and other omitted contexts.

See also [61645].

Props joedolson, fabiankaegy.
Fixes #64644.

git-svn-id: https://develop.svn.wordpress.org/trunk@61652 602fd350-edb4-49c9-b593-d223f7449a82

…arkup.

Update the `data-wp-interactive` directive in the loading bar from `core/router` to `core/router/private` so that internal navigation state properties (`hasStarted`, `hasFinished`) are not exposed as part of the public `core/router` store API.

Props westonruter.
Fixes #64647.

git-svn-id: https://develop.svn.wordpress.org/trunk@61653 602fd350-edb4-49c9-b593-d223f7449a82

These are from the `WordPress-Extra` standard, which is not included in the `phpcs.xml.dist` configuration (the repository uses `WordPress-Core`).

Includes removing unnecessary `WPThemeReview` annotations carried over from upstream.

Follow-up to [49216].

Props rodrigosprimo.
See #64627.

git-svn-id: https://develop.svn.wordpress.org/trunk@61654 602fd350-edb4-49c9-b593-d223f7449a82

Ensures the grid block columns computation takes into account any blockGap value output by an active block style variation.

Props isabel_brison, mukesh27, westonruter, andrewserong.
Fixes #64624.


git-svn-id: https://develop.svn.wordpress.org/trunk@61655 602fd350-edb4-49c9-b593-d223f7449a82

…to an array.

This fixes an issue where PHPStan hangs when analyzing the containing `users.php` file.

Developed in WordPress#10953

Follow-up to [60650].

Props westonruter, justlevine, peterwilsoncc.
See #64238, #61175.


git-svn-id: https://develop.svn.wordpress.org/trunk@61656 602fd350-edb4-49c9-b593-d223f7449a82

…tations in `wp-admin/includes` classes.

Developed in WordPress#10931

Follow-up to [61638].

Props noruzzaman, huzaifaalmesbah, westonruter.
See #64224.


git-svn-id: https://develop.svn.wordpress.org/trunk@61657 602fd350-edb4-49c9-b593-d223f7449a82

This changeset avoids throwing a PHP error when an invalid ID is assigned to a menu location, creates a text string to display when using an invalid menu ID, and assigns `id` and `aria-describedby` attributes to connect the `span` element with the related checkbox.

Props skylarkcob, Frozzare, sabernhardt, apermo, SirLouen, audrasjb, mukesh27, westonruter.
Fixes #37026.



git-svn-id: https://develop.svn.wordpress.org/trunk@61658 602fd350-edb4-49c9-b593-d223f7449a82

Set the `core/router` state `url` property with the current page URL using `get_self_link()` when the first `data-wp-router-region` directive is processed, so that the stores subscribing to that property already have the correct value on page load.

Props westonruter.
Fixes #64649.

git-svn-id: https://develop.svn.wordpress.org/trunk@61659 602fd350-edb4-49c9-b593-d223f7449a82

…account is marked as spam.

This changeset does the following:
- Explicitly add `403` to `wp_die()` calls for unauthorized actions
- Introduce the `network_user_spam_propagate_to_blogs` filter to provide flexibility for developers to control spam status propagation
- Use `is_super_admin()` checks for both "spam" and "notspam" actions to prevent unauthorized modification of network administrators
- Refine the "notspam" logic to ensure that blog status updates are correctly scoped to the current network
- Add related unit tests coverage

Props ignatiusjeroe, realloc, johnjamesjacoby, westonruter, mukesh27, pratiknawkar94, anukasha.
Fixes #61146.



git-svn-id: https://develop.svn.wordpress.org/trunk@61660 602fd350-edb4-49c9-b593-d223f7449a82

…ion.

Introduces block support for PHP-only block registration, enabling developers to register blocks in PHP without requiring JavaScript registration code.

When a block declares `'supports' => array( 'autoRegister' => true )` along with a render callback, it is exposed to the client-side via a JavaScript global variable and registered automatically.

Example usage:

{{{
register_block_type(
	'my-plugin/example',
	array(
		'title'           => 'My Example Block',
		'attributes'      => array(
			'title' => array(
				'type'    => 'string',
				'default' => 'Hello World',
			),
			'count' => array(
				'type'    => 'integer',
				'default' => 5,
			),
		),
		'render_callback' => function ( $attributes ) {
			return sprintf(
				'<div %1$s>%2$s: %3$d items</div>',
				get_block_wrapper_attributes(),
				esc_html( $attributes['title'] ),
				$attributes['count']
			);
		},
		'supports'        => array(
			'autoRegister' => true,
		),
	)
);
}}}

Props mcsf, oandregal, ramonopoly, westonruter, wildworks.
Fixes #64639.

git-svn-id: https://develop.svn.wordpress.org/trunk@61661 602fd350-edb4-49c9-b593-d223f7449a82

Update the front-end CSS used for multisite user activation and signup. Modify both styles  to help prevent conflicts with existing theme styles and provide more consistent margins, paddings, widths, and font sizes.

Props joedolson, sabernhardt, rishabhwp, r1k0, johnjamesjacoby.
Fixes #63861.

git-svn-id: https://develop.svn.wordpress.org/trunk@61662 602fd350-edb4-49c9-b593-d223f7449a82

This updates the following GitHub Actions to their latest versions:

- `actions/cache` from `4.3.0` to `5.0.3`
- `actions/checkout` from `5.0.0` to `6.0.2`
- `actions/download-artifact` from `6.0.0` to `7.0.0`
- `actions/setup-node` from `6.0.0` to `6.2.0`
- `actions/upload-artifact` from `5.0.0` to `6.0.0`
- `codecov/codecov-action` from `5.5.1` to `5.5.2`
- `shivammathur/setup-php` from `2.35.5` to `2.36.0`

See #64227.

git-svn-id: https://develop.svn.wordpress.org/trunk@61663 602fd350-edb4-49c9-b593-d223f7449a82

In [59797], the `matchdep` dependency was removed because it has been abandoned. The `grunt-contrib-imagemin` package was missed in the list of `gruntDependencies` to load that replaced the functionality for `matchdep`.

This adds `imagemin` to the list to restore the `precommit:image` Grunt task functionality.

Props jorbin.
Fixes #64328.

git-svn-id: https://develop.svn.wordpress.org/trunk@61664 602fd350-edb4-49c9-b593-d223f7449a82

Follow-up to [57337], [57548], [60295], [61120].

Props rodrigosprimo.
See #64627.

git-svn-id: https://develop.svn.wordpress.org/trunk@61668 602fd350-edb4-49c9-b593-d223f7449a82

These legacy certificates have historically been retained in the certificate bundle so some ancient versions of OpenSSL continue to work with the bundle despite path discovery bugs in those versions.

The affected OpenSSL versions are all over a decade old now. To ensure the ongoing security of the HTTP API these 1024 bit certificates have been removed.

Props kkmuffme, JavierCasares, desrosj

Fixes #64063


git-svn-id: https://develop.svn.wordpress.org/trunk@61669 602fd350-edb4-49c9-b593-d223f7449a82

…ides return consistent types.

This addresses PHPStan type check issues.

Developed in WordPress#10952

Props westonruter, peterwilsoncc, justlevine.
See #64238, #61175.


git-svn-id: https://develop.svn.wordpress.org/trunk@61670 602fd350-edb4-49c9-b593-d223f7449a82

Allow skipping serialization for the `ariaLabel` block support. This enables applying the `aria-label` attribute to inner elements instead of the block wrapper.

Follow-up to [59925].

Props mukesh27, wildworks.
Fixes #64594.

git-svn-id: https://develop.svn.wordpress.org/trunk@61671 602fd350-edb4-49c9-b593-d223f7449a82

The `$context` parameter in `sanitize_term_field()` is required and has no default value in the function signature. The PHPDoc previously stated `Default 'display'`, which was incorrect and could lead callers to assume the argument was optional.

Follow-up to [49789].

Props audrasjb, dilipbheda, johnbillion, mindctrl, mukesh27, Presskopp, rollybueno, SirLouen, vishalkakadiya, wildworks

Fixes #63257.

git-svn-id: https://develop.svn.wordpress.org/trunk@61672 602fd350-edb4-49c9-b593-d223f7449a82

The Gutenberg build copy script was missing `constants.php` from its list of
PHP infrastructure files, causing a fatal error on the Font Library admin page.
Additionally, the `--base-url` argument was missing a trailing slash inside the
`includes_url()` call, resulting in malformed asset URLs.

Also renames the `--fast` build flag to `--skip-types` to match the current
Gutenberg build script option.

Props youknowriad, ellatrix, dd32, westonruter, desrosj.
Fixes #64656.


git-svn-id: https://develop.svn.wordpress.org/trunk@61673 602fd350-edb4-49c9-b593-d223f7449a82

Introduces a registry class to mediate access to a library of SVG icons. These
icons can be queried by directly interfacing with the singleton class
`WP_Icons_Registry`, or via the REST API using the following GET endpoints:

- /wp/v2/icons
- /wp/v2/icons/$name, e.g. /wp/v2/icons/core/audio

Modifies the Gutenberg-to-Core copy process to copy from `@wordpress/icons`:

- the icons (SVG files) to `wp-includes/icons/library/*.svg`
- the manifest file to `wp-includes/icons/manifest.php`

For 7.0, the registry remains closed to third-party icons, serving only core
icons per the manifest file.

Together, these APIs power the new Icon block.

Developed in WordPress/gutenberg#72215
Developed in WordPress/gutenberg#74943
Developed in WordPress#10909

Props mcsf, wildworks, fabiankaegy, joen, jorgefilipecosta, ntsekouras.
Fixes #64651.



git-svn-id: https://develop.svn.wordpress.org/trunk@61674 602fd350-edb4-49c9-b593-d223f7449a82

As of WordPress/gutenberg#75684, icons' manifest.php
file only lists "public" icons, and in the process the now-redundant `"public"
=> true` flag was dropped.

Accordingly, this removes the check for the `public` flag from the icon
registry's registration logic.

Follow-up to [61674].

Props mcsf, wildworks, ellatrix.
Fixes #64651.



git-svn-id: https://develop.svn.wordpress.org/trunk@61675 602fd350-edb4-49c9-b593-d223f7449a82

… comments.

Developed in WordPress#10951

Props westonruter, sabernhardt, justlevine.
See #64238, #61175.


git-svn-id: https://develop.svn.wordpress.org/trunk@61676 602fd350-edb4-49c9-b593-d223f7449a82

…t passing.

When building Gutenberg via `npm run build -- --base-url=...`, npm forwards arguments through a shell layer, which can mangle the `--base-url` value (containing spaces, parentheses, and single quotes) on some platforms. This caused the generated `constants.php` to be missing the trailing slash in the `build_url`.

Invoke `node bin/build.mjs` directly instead, bypassing npm's shell forwarding entirely. The argument is passed as a single array element via `spawn` with `shell: false`, so it arrives intact regardless of platform.

Props youknowriad.
Fixes #64656.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…rectly.

When bypassing `npm run build` to call `node bin/build.mjs` directly,
the `node_modules/.bin` directory is not on the PATH. This caused
`wp-build` (used internally by the build script) to fail with ENOENT
on CI.

Follow-up to [60573].

Props youknowriad.
Fixes #64656.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Temporarily dumps the contents of constants.php from both the Gutenberg
build output and the final WordPress build directory to help diagnose
the missing trailing slash issue.

Props youknowriad.
See #64656.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>