Formatting: Allow CSS transform and SVG shape functions in safecss_filter_attr() by HasnainAshfaq · Pull Request #12942 · WordPress/wordpress-develop

HasnainAshfaq · 2026-08-07T23:36:23Z

Follow-up to #65457 / #12169. Fixes #65832.

The problem

#65457 added 20+ SVG presentation properties to the KSES CSS allowlist, but left two internal structures unchanged. This means the new properties are allowlisted in name only — their functional values are still stripped:

Declaration	Before this PR	Expected
`transform: rotate(45deg)`	stripped	preserved
`transform: translate(10px, 20px)`	stripped	preserved
`clip-path: url(#myClipper)`	stripped	preserved
`fill: url(#gradient1)`	stripped	preserved
`mask: url(#myMask)`	stripped	preserved
`transform: none`	preserved ✓	preserved ✓
`fill: #ff0000`	preserved ✓	preserved ✓

The failure mode is the ( character check at kses.php:3015. After stripping known-safe functions (var, calc, etc.), any remaining ( causes the whole declaration to be dropped. Transform functions like rotate(45deg) were never added to that strip list.

The second failure: clip-path: url(#id) and fill: url(#gradient) need the URL-validation code path, which only runs for properties listed in $css_url_data_types. Those SVG properties were never added there either.

The fix

1. Expand $css_url_data_types (9 lines added) to include clip-path, fill, stroke, mask, marker, marker-start, marker-mid, marker-end. This routes their url() values through the existing URL validator — which already blocks javascript:, vbscript:, and other bad protocols via wp_kses_bad_protocol(). No new security surface; the same gate that protects background-image: url(...) now protects these too.

2. Extend the CSS function strip regex to cover:

CSS transform functions: rotate, rotateX/Y/Z, rotate3d, translate, translateX/Y/Z, translate3d, scale, scaleX/Y/Z, scale3d, skew, skewX, skewY, matrix, matrix3d, perspective
CSS shape functions (for clip-path): inset, circle, ellipse, polygon, path

These are purely geometric/visual — no script execution risk. Precedent: calc() added in #46197 (5.8), min()/max() in #55966 (6.1), CSS custom properties in #56353 (6.1).

Tests

Added 20 cases to data_safecss_filter_attr():

Transform functions: rotate(), translate(), scale(), matrix(), skewX(), skewY()
Chained: rotate(45deg) scale(1.5)
Regression control: transform: none (function-free value, was already passing)
clip-path shapes: inset(), circle(), ellipse(), polygon()
SVG url() references: clip-path: url(#id), fill: url(#id), mask: url(#id), marker-start: url(#id), marker-end: url(#id)
Security regressions: fill: url(javascript:alert(1)) → "", clip-path: url(javascript:alert(1)) → ""

Full kses group: 462 tests, 1537 assertions — all passing.

Trac ticket: https://core.trac.wordpress.org/ticket/65832

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

…lter_attr(). #65457 added SVG presentation properties (transform, clip-path, fill, stroke, mask, marker-*) to the KSES CSS allowlist, but the two structures that govern their accepted value forms were not updated. This meant: - transform: rotate(45deg) — dropped (( character was rejected) - clip-path: url(#myClipper) — dropped (url() not validated for clip-path) - fill: url(#gradient1) — dropped (url() not validated for fill) Two changes: 1. Expand $css_url_data_types to include the SVG properties that accept url() references (clip-path, fill, stroke, mask, marker-*). This routes their values through the existing URL-validation path that already protects against javascript: and other bad protocols. 2. Extend the CSS function strip regex (the one that removes var(), calc(), etc. before the backslash/paren safety check) to also cover CSS transform functions (rotate, translate, scale, matrix, skew*, perspective) and CSS shape functions used in clip-path (inset, circle, ellipse, polygon, path). These are purely geometric/visual values with no script execution risk; the precedent is calc() (#46197), min/max (#55966), and CSS custom properties (#56353). Adds test cases for: - transform: rotate(), translate(), scale(), matrix(), skewX(), skewY() - Chained transform functions - clip-path: inset(), circle(), ellipse(), polygon() - clip-path: url(), fill: url(), mask: url(), marker-start/end: url() - Security regression: javascript: URLs in SVG url() references blocked Fixes #65832. Follow-up to #65457.

github-actions · 2026-08-07T23:36:33Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props hasnainashfaq, wildworks, irozum, tyxla.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-08-07T23:39:43Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

Copilot

Pull request overview

Updates safecss_filter_attr() (KSES safe inline-style sanitizer) so that newly allowlisted SVG/CSS presentation properties can retain common functional values, specifically transform/shape functions and url() references, and adds PHPUnit coverage for these cases.

Changes:

Route additional SVG presentation properties through the existing url() validation logic by expanding $css_url_data_types.
Extend the CSS function-stripping regex to include transform and clip-path shape functions so balanced parentheses don’t cause declarations to be dropped.
Add new PHPUnit data-provider cases covering transform functions, clip-path shapes, and SVG url() references (including javascript: regressions).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`src/wp-includes/kses.php`	Adds SVG properties to URL-validated list and expands the function-stripping regex in `safecss_filter_attr()`.
`tests/phpunit/tests/kses.php`	Adds new `data_safecss_filter_attr()` cases for transforms, clip-path shapes, and SVG `url()` references.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

t-hamano · 2026-08-08T06:57:54Z

 			 */
 			$css_test_string = preg_replace(
-				'/\b(?:var|calc|min|max|minmax|clamp|repeat)(\((?:[^()]|(?1))*\))/',
+				'/\b(?:var|calc|min|max|minmax|clamp|repeat|rotate|rotateX|rotateY|rotateZ|rotate3d|translate|translateX|translateY|translateZ|translate3d|scale|scaleX|scaleY|scaleZ|scale3d|skew|skewX|skewY|matrix|matrix3d|perspective|inset|circle|ellipse|polygon|path)(\((?:[^()]|(?1))*\))/',


The observation is correct, but I'm not sure it should be addressed here. The pattern has always been case-sensitive. Whether to accept uppercase function names is out of scope for this PR and would be better handled in its own ticket.

Agreed that it's a separate issue and shouldn't block this one, but before merging, let's make sure this is raised as a separate ticket. Solution may be simple (just adding the i regex flag) but we still need to add some tests and ensure it doesn't break anything.

I have created a ticket.

https://core.trac.wordpress.org/ticket/65838

t-hamano

Thanks for the follow-up! It looks good to me.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Documents the transform functions, `clip-path` basic shapes, and SVG element reference URLs added in the previous commit. Follow-up to #65832. Co-Authored-By: Claude <noreply@anthropic.com>

…filter_attr(). Co-Authored-By: Claude <noreply@anthropic.com>

t-hamano · 2026-08-11T12:28:01Z

@tyxla, do you think this PR is ready for a commit?

tyxla · 2026-08-11T13:38:54Z

@tyxla, do you think this PR is ready for a commit?

Yup, looking good from my end. Thanks 🙌

The presentation properties allowlisted in [62530] were accepted in name only: any declaration whose value contained a function call was dropped in full, so for users without the `unfiltered_html` capability those properties remained unusable in their canonical form. URL references are routed through the existing protocol validation, so the security model is unchanged. Developed in: #12942 Follow-up to [62530]. Props courane01, hasnainashfaq, irozum, khokansardar, mdridipu, tyxla. Fixes #65832. git-svn-id: https://develop.svn.wordpress.org/trunk@63180 602fd350-edb4-49c9-b593-d223f7449a82

github-actions · 2026-08-11T14:17:16Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 63180
GitHub commit: 996c6d6

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

The presentation properties allowlisted in [62530] were accepted in name only: any declaration whose value contained a function call was dropped in full, so for users without the `unfiltered_html` capability those properties remained unusable in their canonical form. URL references are routed through the existing protocol validation, so the security model is unchanged. Developed in: WordPress/wordpress-develop#12942 Follow-up to [62530]. Props courane01, hasnainashfaq, irozum, khokansardar, mdridipu, tyxla. Fixes #65832. Built from https://develop.svn.wordpress.org/trunk@63180 git-svn-id: http://core.svn.wordpress.org/trunk@62377 1a063a9b-81f0-0310-95a4-ce76da25c4cd

The presentation properties allowlisted in [62530] were accepted in name only: any declaration whose value contained a function call was dropped in full, so for users without the unfiltered_html capability those properties remained unusable in their canonical form. URL references are routed through the existing protocol validation, so the security model is unchanged. Developed in: #12942 Follow-up to [62530]. Reviewed by joedolson Merges [63180] to the 7.1 branch. Props courane01, hasnainashfaq, irozum, khokansardar, mdridipu, tyxla. Fixes #65832. git-svn-id: https://develop.svn.wordpress.org/branches/7.1@63229 602fd350-edb4-49c9-b593-d223f7449a82

The presentation properties allowlisted in [62530] were accepted in name only: any declaration whose value contained a function call was dropped in full, so for users without the unfiltered_html capability those properties remained unusable in their canonical form. URL references are routed through the existing protocol validation, so the security model is unchanged. Developed in: WordPress/wordpress-develop#12942 Follow-up to [62530]. Reviewed by joedolson Merges [63180] to the 7.1 branch. Props courane01, hasnainashfaq, irozum, khokansardar, mdridipu, tyxla. Fixes #65832. Built from https://develop.svn.wordpress.org/branches/7.1@63229 git-svn-id: http://core.svn.wordpress.org/branches/7.1@62422 1a063a9b-81f0-0310-95a4-ce76da25c4cd

@SInCE

* WP-r55564: KSES: Allow `filter` property to accept a URL in `safecss_filter_attr()`. CSS filters can accept `url()` as a reference to an SVG filter element: {{{ filter: url( file.svg#filter-element-id ); }}} This commit allows for that syntax to be used in inline CSS. Original PR from Gutenberg repository: * [WordPress/gutenberg#48281 https://core.trac.wordpress.org/ticket/48281 Duotone: Use the style engine to generate CSS for Duotone] References: * [https://developer.mozilla.org/en-US/docs/Web/CSS/filter MDN Web Docs: filter()] * [https://developer.mozilla.org/en-US/docs/Web/CSS/url MDN Web Docs: url()] Follow-up to https://core.trac.wordpress.org/changeset/44136, https://core.trac.wordpress.org/changeset/52049. WP:Props scruffian, jeryj, ironprogrammer, azaozz, hellofromTonya, SergeyBiryukov. Fixes https://core.trac.wordpress.org/ticket/57780. --- Merges https://core.trac.wordpress.org/changeset/55564 / WordPress/wordpress-develop@6d1381180b to ClassicPress. * WP-r55642: Coding Standards: Use strict comparison where `count()` is involved. Follow-up to https://core.trac.wordpress.org/changeset/1636, https://core.trac.wordpress.org/changeset/6974, https://core.trac.wordpress.org/changeset/8114, https://core.trac.wordpress.org/changeset/10322, https://core.trac.wordpress.org/changeset/13326, https://core.trac.wordpress.org/changeset/14760, https://core.trac.wordpress.org/changeset/18006, https://core.trac.wordpress.org/changeset/18541, https://core.trac.wordpress.org/changeset/19743, https://core.trac.wordpress.org/changeset/23249, https://core.trac.wordpress.org/changeset/24115, https://core.trac.wordpress.org/changeset/33359. WP:Props aristath, poena, afercia, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/57839. --- Merges https://core.trac.wordpress.org/changeset/55642 / WordPress/wordpress-develop@81598dd34f to ClassicPress. * WP-r55652: Coding Standards: Use strict comparison where `strlen()` is involved. Follow-up to https://core.trac.wordpress.org/changeset/649, https://core.trac.wordpress.org/changeset/1345, https://core.trac.wordpress.org/changeset/3034, https://core.trac.wordpress.org/changeset/6132, https://core.trac.wordpress.org/changeset/6314, https://core.trac.wordpress.org/changeset/6974, https://core.trac.wordpress.org/changeset/55642. WP:Props aristath, poena, afercia, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/57839. Conflicts: - src/wp-includes/load.php --- Merges https://core.trac.wordpress.org/changeset/55652 / WordPress/wordpress-develop@760728c92f to ClassicPress. * Fix merge conflict from 55652 * WP-r55677: Coding Standards: Use strict comparison where `strtolower()` is involved. Follow-up to https://core.trac.wordpress.org/changeset/649, https://core.trac.wordpress.org/changeset/7736, https://core.trac.wordpress.org/changeset/18821, https://core.trac.wordpress.org/changeset/19444, https://core.trac.wordpress.org/changeset/20886, https://core.trac.wordpress.org/changeset/20893, https://core.trac.wordpress.org/changeset/23303, https://core.trac.wordpress.org/changeset/55642, https://core.trac.wordpress.org/changeset/55652, https://core.trac.wordpress.org/changeset/55653, https://core.trac.wordpress.org/changeset/55654. WP:Props aristath, poena, afercia, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/57839. Conflicts: - src/wp-includes/theme.php --- Merges https://core.trac.wordpress.org/changeset/55677 / WordPress/wordpress-develop@c2f262971c to ClassicPress. * Fix merge conflicts from 55677 * WP-r55703: Code Modernization: Replace usage of `strpos()` with `str_starts_with()`. `str_starts_with()` was introduced in PHP 8.0 to perform a case-sensitive check indicating if the string to search in (haystack) begins with the given substring (needle). WordPress core includes a polyfill for `str_starts_with()` on PHP < 8.0 as of WordPress 5.9. This commit replaces `0 === strpos( ... )` with `str_starts_with()` in core files, making the code more readable and consistent, as well as improving performance. While `strpos()` is slightly faster than the polyfill on PHP < 8.0, `str_starts_with()` is noticeably faster on PHP 8.0+, as it is optimized to avoid unnecessarily searching along the whole haystack if it does not find the needle. Follow-up to https://core.trac.wordpress.org/changeset/52039, https://core.trac.wordpress.org/changeset/52040, https://core.trac.wordpress.org/changeset/52326. WP:Props spacedmonkey, costdev, sabernhardt, mukesh27, desrosj, jorbin, TobiasBg, ayeshrajans, lgadzhev, SergeyBiryukov. Fixes https://core.trac.wordpress.org/ticket/58012. Conflicts: - src/wp-admin/includes/class-wp-privacy-policy-content.php - src/wp-admin/includes/credits.php - src/wp-admin/includes/post.php - src/wp-admin/includes/privacy-tools.php - src/wp-admin/load-styles.php - src/wp-admin/menu-header.php - src/wp-includes/block-template.php - src/wp-includes/blocks.php - src/wp-includes/bookmark-template.php - src/wp-includes/class-simplepie.php - src/wp-includes/l10n.php - src/wp-includes/pluggable.php - src/wp-includes/post-template.php - src/wp-includes/script-loader.php - src/wp-includes/widgets/class-wp-widget-block.php --- Merges https://core.trac.wordpress.org/changeset/55703 / WordPress/wordpress-develop@4cb3e1582a to ClassicPress. * WP-r55822: General: Use `static` on closures whenever `$this` is not used to avoid memory leaks. WP:Props westonruter, jrf, spacedmonkey. Fixes https://core.trac.wordpress.org/ticket/58323. Conflicts: - src/wp-admin/includes/file.php - src/wp-includes/blocks.php - src/wp-includes/kses.php - src/wp-includes/script-loader.php - tests/performance/wp-content/mu-plugins/server-timing.php - tests/phpunit/tests/admin/wpSiteHealth.php - tests/phpunit/tests/blocks/editor.php - tests/phpunit/tests/blocks/renderCommentTemplate.php - tests/phpunit/tests/blocks/wpBlock.php - tests/phpunit/tests/dependencies/scripts.php - tests/phpunit/tests/media.php - tests/phpunit/tests/rest-api/rest-server.php - tests/phpunit/tests/rest-api/rest-themes-controller.php - tests/phpunit/tests/theme/wpThemeJsonResolver.php --- Merges https://core.trac.wordpress.org/changeset/55822 / WordPress/wordpress-develop@d5792c7a88 to ClassicPress. * WP-r55937: Formatting: Support aria content attributes. Add `aria-controls`, `aria-expanded`, and `aria-current` to allowed attributes in KSES. WP:Props crs1138, rsiddharth, mukesh27, SergeyBiryukov, joedolson, ryokuhi, peterwilsoncc, audrasjb, nataliat2004. Fixes https://core.trac.wordpress.org/ticket/55370. Conflicts: - src/wp-includes/kses.php --- Merges https://core.trac.wordpress.org/changeset/55937 / WordPress/wordpress-develop@1e090291f0 to ClassicPress. * WP-r55944: KSES: Add support for CSS `repeat()` function. Introduces support for the CSS `repeat()` function to support complex grid layouts. WP:Props isabel_brison, azaozz. Fixes https://core.trac.wordpress.org/ticket/58551. Conflicts: - tests/phpunit/tests/kses.php --- Merges https://core.trac.wordpress.org/changeset/55944 / WordPress/wordpress-develop@2b7f865417 to ClassicPress. * Fix merge conflict from 55944 * WP-r56046: Editor: add box shadow support to blocks. Adds the ability for blocks to declare support for CSS box-shadow and processing of necessary styles. WP:Props madhudollu, sabernhardt, ramonopoly, spacedmonkey, mukesh27. Fixes https://core.trac.wordpress.org/ticket/58590. Conflicts: - src/wp-includes/style-engine/class-wp-style-engine.php - src/wp-settings.php - tests/phpunit/tests/style-engine/styleEngine.php --- Merges https://core.trac.wordpress.org/changeset/56046 / WordPress/wordpress-develop@e55e9c2f0c to ClassicPress. * Fix merge conflict from 56046 * WP-r56191: Docs: Replace multiple single line comments with multi-line comments. This changeset updates various comments as per WordPress PHP Inline Documentation Standards. See https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/https://core.trac.wordpress.org/ticket/5-inline-comments. Follow-up to https://core.trac.wordpress.org/changeset/56174, https://core.trac.wordpress.org/changeset/56175, https://core.trac.wordpress.org/changeset/56176, https://core.trac.wordpress.org/changeset/56177, https://core.trac.wordpress.org/changeset/56178, https://core.trac.wordpress.org/changeset/56179, https://core.trac.wordpress.org/changeset/56180. WP:Props costdev, audrasjb. See https://core.trac.wordpress.org/ticket/58459. Conflicts: - src/wp-includes/media.php --- Merges https://core.trac.wordpress.org/changeset/56191 / WordPress/wordpress-develop@3666c0e31b to ClassicPress. * Fix merge conflict from 56191 * WP-r56377: Coding Standards: Use strict comparison in `wp-includes/kses.php`. Follow-up to https://core.trac.wordpress.org/changeset/649, https://core.trac.wordpress.org/changeset/2896, https://core.trac.wordpress.org/changeset/3418, https://core.trac.wordpress.org/changeset/8386, https://core.trac.wordpress.org/changeset/20540, https://core.trac.wordpress.org/changeset/47219, https://core.trac.wordpress.org/changeset/54933. WP:Props aristath, poena, afercia, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/58831. --- Merges https://core.trac.wordpress.org/changeset/56377 / WordPress/wordpress-develop@b1d59267af to ClassicPress. * Manual cherry-pick of 56559 * WP-r56608: Docs: Document `aria-live` and `hidden` in `safecss_filter_attr()`. In https://core.trac.wordpress.org/changeset/56603, support was added for `aria-live` and `hidden` attributes in `safecss_filter_attr()`. This adds a `@since` annotation to document this change. Follow-up to https://core.trac.wordpress.org/changeset/56603. WP:Props mukesh27. See https://core.trac.wordpress.org/ticket/57791. --- Merges https://core.trac.wordpress.org/changeset/56608 / WordPress/wordpress-develop@a7c9394b78 to ClassicPress. * WP-r56617: KSES: Add `writing-mode` to the list of safe CSS properties. Original PR from Gutenberg repository: * [WordPress/gutenberg#54581 https://core.trac.wordpress.org/ticket/54581 Gutenberg Plugin: Add hook to allow `writing-mode` as a safe CSS property] Reference: [https://developer.mozilla.org/en-US/docs/Web/CSS/writing-mode MDN Web Docs: writing-mode]. Follow-up to https://core.trac.wordpress.org/changeset/56605. WP:Props wildworks, mukesh27, poena, andrewserong. Fixes https://core.trac.wordpress.org/ticket/59387. --- Merges https://core.trac.wordpress.org/changeset/56617 / WordPress/wordpress-develop@cf2f441515 to ClassicPress. * WP-r57056: Coding Standards: Remove unnecessary ignore annotation in `wp_kses_hair_parse()`. It is perfectly possible to write a commented regex with layout for readability by using the `x` modifier. As per the manual: > x (`PCRE_EXTENDED`) > > If this modifier is set, whitespace data characters in the pattern are totally ignored except when escaped or inside a character class, and characters between an unescaped # outside a character class and the next newline character, inclusive, are also ignored. This is equivalent to Perl's /x modifier, and makes it possible to include commentary inside complicated patterns. > > Note, however, that this applies only to data characters. Whitespace characters may never appear within special character sequences in a pattern, for example within the sequence (?( which introduces a conditional subpattern. Reference: [https://www.php.net/manual/en/reference.pcre.pattern.modifiers.php PHP Manual: Pattern Modifiers]. This commit rewrites these two regexes to use the `x` modifier and gets rid of the unnecessary `phpcs:disable` comments. The tests in the `tests/phpunit/tests/db/dbDelta.php` file cover this change. Follow-up to https://core.trac.wordpress.org/changeset/42249. WP:Props jrf. See https://core.trac.wordpress.org/ticket/59650. --- Merges https://core.trac.wordpress.org/changeset/57056 / WordPress/wordpress-develop@13192d385f to ClassicPress. * WP-r57061: Coding Standards: Remove unnecessary ignore annotations in `dbDelta()`. It is perfectly possible to write a commented regex with layout for readability by using the `x` modifier. As per the manual: > x (`PCRE_EXTENDED`) > > If this modifier is set, whitespace data characters in the pattern are totally ignored except when escaped or inside a character class, and characters between an unescaped # outside a character class and the next newline character, inclusive, are also ignored. This is equivalent to Perl's /x modifier, and makes it possible to include commentary inside complicated patterns. > > Note, however, that this applies only to data characters. Whitespace characters may never appear within special character sequences in a pattern, for example within the sequence (?( which introduces a conditional subpattern. Reference: [https://www.php.net/manual/en/reference.pcre.pattern.modifiers.php PHP Manual: Pattern Modifiers]. This commit rewrites these two regexes to use the `x` modifier and gets rid of the unnecessary `phpcs:disable` comments. The tests in the `tests/phpunit/tests/db/dbDelta.php` file cover this change. Follow-up to https://core.trac.wordpress.org/changeset/42249. WP:Props jrf. See https://core.trac.wordpress.org/ticket/59650. --- Merges https://core.trac.wordpress.org/changeset/57061 / WordPress/wordpress-develop@0ac7b38407 to ClassicPress. * WP-r57228: KSES: Add `background-repeat` to the list of safe CSS properties. Follow-up to https://core.trac.wordpress.org/changeset/45242, https://core.trac.wordpress.org/changeset/46235. WP:Props andrewserong, ramonopoly, mukesh27. Fixes https://core.trac.wordpress.org/ticket/60132. --- Merges https://core.trac.wordpress.org/changeset/57228 / WordPress/wordpress-develop@0e28444795 to ClassicPress. * WP-r58170: Editor: add column and row spans to grid children. Adds support for setting spans using `grid-column` and `grid-row` properties on children of blocks with grid layout. WP:Props isabel_brison, andrewserong, peterwilsoncc, mukesh27. Fixes https://core.trac.wordpress.org/ticket/61111. Conflicts: - src/wp-includes/block-supports/layout.php - tests/phpunit/tests/block-supports/layout.php --- Merges https://core.trac.wordpress.org/changeset/58170 / WordPress/wordpress-develop@2b25b04f93 to ClassicPress. * WP-r58196: Docs: Add a `@since` note for the changes to `safecss_filter_attr()` in WP 6.6. Follow-up to https://core.trac.wordpress.org/changeset/58170. See https://core.trac.wordpress.org/ticket/61111. --- Merges https://core.trac.wordpress.org/changeset/58196 / WordPress/wordpress-develop@581f8d5eeb to ClassicPress. * WP-r58294: KSES: Allow leading trailing double hyphen in data attributes Expand allowable set of custom data attribute names to include those containing leading, trailing, and double `-` characters. Previously, WordPress was removing data attributes that are used in the Interactivity API. By allowing these additional custom data attributes, the related Interactivity API directives will preserve through `kses`. For example, the Interactivity API frequently relies on custom data attributes such as `data-wp-on--click="..."`. The change in https://core.trac.wordpress.org/changeset/43981 would strip these out of the processed HTML, however. Developed in WordPress/wordpress-develop#6598 Discussed in https://core.trac.wordpress.org/ticket/61052 WP:Props cbravobernal, dmsnell, gziolo, jonsurrell. Follow-up to https://core.trac.wordpress.org/changeset/43981. Fixes https://core.trac.wordpress.org/ticket/61052. Conflicts: - tests/phpunit/tests/kses.php --- Merges https://core.trac.wordpress.org/changeset/58294 / WordPress/wordpress-develop@89bec7acd8 to ClassicPress. * Fix merge conflict from 58294 * Fixes for backport test errors * WP-r58418: KSES: Preserve some additional invalid HTML comment syntaxes. When `wp_kses_split` processes a document it attempts to leave HTML comments alone. It makes minor adjustments, but leaves the comments in the document in its output. Unfortunately it only recognizes one kind of HTML comment and rejects many others. This patch makes a minor adjustment to the algorithm in `wp_kses_split` to recognize and preserve an additional kind of HTML comment: closing tags with an invalid tag name, e.g. `</%dolly>`. These invalid closing tags must be interpreted as comments by a browser. This bug fix aligns the implementation of `wp_kses_split()` more closely with its stated goal of leaving HTML comments as comments. It doesn't attempt to fully fix the mis-parsed comments, but it does propose a minor fix that hopefully won't break any existing code or projects. Developed in WordPress/wordpress-develop#6395 Discussed in https://core.trac.wordpress.org/ticket/61009 WP:Props ellatrix, dmsnell, joemcgill, jorbin, westonruter, zieladam. See https://core.trac.wordpress.org/ticket/61009. --- Merges https://core.trac.wordpress.org/changeset/58418 / WordPress/wordpress-develop@c756dfe8ca to ClassicPress. * WP-r58424: KSES: Fix tests and detection of HTML Bogus Comment spans. In https://core.trac.wordpress.org/changeset/58418 a test was added without the `test_` prefix in its function name, and because of that, it wasn't run in the test suite. The prefix has been added to ensure that it runs. In the original patch, due to a logical bug, a recursive loop to transform the inside contents of the bogus comments was never run more than once. This has been fixed. This patch also includes one more case where `kses` wasn't properly detecting the bogus comment state, and adds a test case to cover this. It limits itself to some but not all constructions of invalid markup declaration so that it doesn't conflict with existing behaviors around those and other kinds of invalid comments. WP:Props ellatrix, dmsnell. See https://core.trac.wordpress.org/ticket/61009. Follow-up to https://core.trac.wordpress.org/changeset/58418. --- Merges https://core.trac.wordpress.org/changeset/58424 / WordPress/wordpress-develop@b36ff6064a to ClassicPress. * WP-r58709: KSES: Add `opacity` to the list of safe CSS properties. Original PR from Gutenberg repository: * [WordPress/gutenberg#59891 https://core.trac.wordpress.org/ticket/59891 Update overlay step function in cover block] Reference: [https://developer.mozilla.org/en-US/docs/Web/CSS/opacity MDN Web Docs: opacity]. WP:Props sunil25393, wildworks, poena, Mamaduka, presstoke. Fixes https://core.trac.wordpress.org/ticket/61536. --- Merges https://core.trac.wordpress.org/changeset/58709 / WordPress/wordpress-develop@ad135d5f0a to ClassicPress. * WP-r59677: Formatting: Preserve `target="_blank"` in Biographical Info and Category Description. This changeset ensures the `target="_blank"` attribute is preserved when adding links in the Biographical Info and Category Description fields. Previously, this attribute was being stripped by the KSES sanitization process. Additionally, new unit tests have been added to verify the preservation of the `target="_blank"` attribute in these specific contexts. WP:Props lovewpmu, miqrogroove, bsutcliffe, sjefen6, nofearinc, nacin, harmr, blogitsolutions, stefahn, nirajgirixd, martinkrcho, spacedmonkey, sukhendu2002, audrasjb, gaellebesson, nuryko, guillaumeturpin, maximemeganck, ranafge, azaozz, joedolson, rinkalpagdar, mikinc860. Fixes https://core.trac.wordpress.org/ticket/12056. Conflicts: - tests/phpunit/tests/kses.php --- Merges https://core.trac.wordpress.org/changeset/59677 / WordPress/wordpress-develop@0f2334da81 to ClassicPress. * Fix merge conflict from 59677 * WP-r60405: Docs: Expand valid_unicode function documentation. The `valid_unicode()` function accepts a limited set of codepoints according to the XML specification. Document the allowed codepoints and link to relevant documentation. Developed in WordPress/wordpress-develop#9100. WP:Props jonsurrell, dmsnell. See https://core.trac.wordpress.org/ticket/6583, https://core.trac.wordpress.org/ticket/63166. --- Merges https://core.trac.wordpress.org/changeset/60405 / WordPress/wordpress-develop@d6355dc8d5 to ClassicPress. * WP-r60406: Coding Standards: Remove unnecessary conditional from `do_trackbacks()`. The check for a truthy `$to_ping` value is redundant, as a falsey value would cause the function to return early a few lines above. Follow-up to https://core.trac.wordpress.org/changeset/1794, https://core.trac.wordpress.org/changeset/2612. WP:Props justlevine. See https://core.trac.wordpress.org/ticket/63268. --- Merges https://core.trac.wordpress.org/changeset/60406 / WordPress/wordpress-develop@a99f57bc61 to ClassicPress. * WP-r60616: KSES: Prevent normalization from unescaping escaped numeric character references. Fixes an issue where `wp_kses_normalize_entities` would transform inputs like "&https://core.trac.wordpress.org/ticket/39;" into "&https://core.trac.wordpress.org/ticket/039;", changing the intended HTML text. This behavior has present since the initial version of KSES was introduced in https://core.trac.wordpress.org/changeset/649. https://core.trac.wordpress.org/changeset/2896 applied the normalization to post content for users without the "unfiltered_html" capability. Developed in WordPress/wordpress-develop#9099. WP:Props jonsurrell, dmsnell, sirlouen. Fixes https://core.trac.wordpress.org/ticket/63630. Conflicts: - src/wp-includes/kses.php - tests/phpunit/tests/kses.php --- Merges https://core.trac.wordpress.org/changeset/60616 / WordPress/wordpress-develop@b91b7576b8 to ClassicPress. * Fix merge conflicts from 60616 * WP-r60671: Formatting: Add 'white-space' as an allowed KSES CSS attribute. The 'white-space' attribute is safe, has wide browser support, and is useful. WP:Props sukhendu2002, mukesh27, whyisjake.. Fixes https://core.trac.wordpress.org/ticket/51707. --- Merges https://core.trac.wordpress.org/changeset/60671 / WordPress/wordpress-develop@171a547ae4 to ClassicPress. * WP-r60884: Editor: Allow popover attributes in editor content. Add attributes to KSES so that it's possible to create popover interactions natively in the editor. Adds `popovertarget`, `popovertargetaction` and `aria-haspopup` to `button`; `popover` to `div`, `ul`, and adds `dialog` with the attributes `open`, `closedby`, and `popover`. WP:Props harshdeepgill, jonsurrell, joedolson, sukhendu2002, flixos90, joedolson. Fixes https://core.trac.wordpress.org/ticket/61959. --- Merges https://core.trac.wordpress.org/changeset/60884 / WordPress/wordpress-develop@5810c47158 to ClassicPress. * WP-r60886: Editor: Add 6 missing HTML5 semantic tags (`data`, `meter`, `progress`, `search`, `time`, `wbr`) and their attributes to KSES. 1. `data` (attribute: `value`) 2. `meter` (attributes: `high`, `low`, `max`, `min`, `optimum`, `value`) 3. `progress` (attributes: `max`, `value`) 4. `search` 5. `time` (attribute: `datetime`) 6. `wbr` WP:Props ramiy, rollybueno, westonruter. Fixes https://core.trac.wordpress.org/ticket/63786. --- Merges https://core.trac.wordpress.org/changeset/60886 / WordPress/wordpress-develop@2fe26ceb7a to ClassicPress. * WP-r61017: KSES: add MathML tags. These tags are needed for the new Math block, which is included in WP 6.9. See WordPress/gutenberg#72182. See WordPress/wordpress-develop#10307. Fixes https://core.trac.wordpress.org/ticket/64115. --- Merges https://core.trac.wordpress.org/changeset/61017 / WordPress/wordpress-develop@b932ba04ef to ClassicPress. * WP-r61051: Editor: Allow `name` attribute on the `details` element in KSES. The `details` element supports the exclusive accordion behavior among multiple `details` elements by setting a common `name` attribute. The ability to set the `name` attribute in the Details block was added in of Gutenberg 20.2. However, when a user without `unfiltered_html` attempts to save the post, the `name` attribute gets erroneously stripped out. This prevents that. See [WordPress/gutenberg#56969 Details block: Exclusive accordions]. Follow-up to https://core.trac.wordpress.org/changeset/14406, https://core.trac.wordpress.org/changeset/59775. WP:Props soean. See https://core.trac.wordpress.org/ticket/12835, https://core.trac.wordpress.org/ticket/62887. Fixes https://core.trac.wordpress.org/ticket/64127. --- Merges https://core.trac.wordpress.org/changeset/61051 / WordPress/wordpress-develop@d0c86cdc8e to ClassicPress. * WP-r61436: Code Modernization: Formatting: Use null coalescing operator instead of `isset()` ternaries. Developed as a subset of WordPress/wordpress-develop#10654 Initially developed in WordPress/wordpress-develop#4886 Follow-up to https://core.trac.wordpress.org/changeset/61435, https://core.trac.wordpress.org/changeset/61434, https://core.trac.wordpress.org/changeset/61403, https://core.trac.wordpress.org/changeset/61433, https://core.trac.wordpress.org/changeset/61432, https://core.trac.wordpress.org/changeset/61431, https://core.trac.wordpress.org/changeset/61430, https://core.trac.wordpress.org/changeset/61429, https://core.trac.wordpress.org/changeset/61424, https://core.trac.wordpress.org/changeset/61404, https://core.trac.wordpress.org/changeset/61403. WP:Props costdev, westonruter. See https://core.trac.wordpress.org/ticket/58874, https://core.trac.wordpress.org/ticket/63430. --- Merges https://core.trac.wordpress.org/changeset/61436 / WordPress/wordpress-develop@6d60f73c83 to ClassicPress. * WP-r61486: Customize: Allow arbitrary CSS in global styles custom CSS. Relax Global Styles custom CSS filters to allow arbitrary CSS. Escape HTML characters `<>&` in Global Styles data to prevent it from being mangled by post content filters. The data is JSON encoded and stored in `post_content`. Filters operating on `post_content` expect it to contain HTML. Some KSES filters would otherwise remove essential CSS features like the `<custom-ident>` CSS data type because they appear to be HTML tags. https://core.trac.wordpress.org/changeset/61418 changed STYLE tag generation to use the HTML API for improved safety. Developed in WordPress/wordpress-develop#10641. WP:Props jonsurrell, dmsnell, westonruter, ramonopoly, oandregal, jorgefilipecosta, sabernhardt, soyebsalar01. See https://core.trac.wordpress.org/ticket/64418. Conflicts: - src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php - tests/phpunit/tests/rest-api/rest-global-styles-controller.php --- Merges https://core.trac.wordpress.org/changeset/61486 / WordPress/wordpress-develop@101a21f4f4 to ClassicPress. * WP-r61565: Editor: screen size based block visibility support. Adds ability to hide blocks at different screen sizes to the block visibility support. WP:Props ramonopoly, isabel_brison, westonruter. Closes https://core.trac.wordpress.org/ticket/64414. Conflicts: - src/wp-includes/block-supports/block-visibility.php - tests/phpunit/tests/block-supports/block-visibility.php --- Merges https://core.trac.wordpress.org/changeset/61565 / WordPress/wordpress-develop@5885cb96a9 to ClassicPress. * WP-r61882: KSES: Optimize PCRE pattern detecting numeric character references. WP:Props dmsnell, xknown, johnbillion. --- Merges https://core.trac.wordpress.org/changeset/61882 / WordPress/wordpress-develop@695c31e4cb to ClassicPress. * WP-r62530: KSES: Allow SVG presentation attributes in safe_style_css. Add SVG presentation attributes to the list of CSS properties allowed by `safecss_filter_attr()`, so inline SVG markup can be styled via the `style` attribute. This ports Gutenberg PR https://core.trac.wordpress.org/ticket/79172 to Core. WP:Props afercia, westonruter, wildworks. Fixes https://core.trac.wordpress.org/ticket/65457. --- Merges https://core.trac.wordpress.org/changeset/62530 / WordPress/wordpress-develop@e904e28cdd to ClassicPress. * WP-r62531: KSES: Add command and commandfor to the list of allowed attributes for buttons. Developed in: WordPress/wordpress-develop#11483 WP:Props pratiknawkar94, joedolson, westonruter, afercia. Fixes https://core.trac.wordpress.org/ticket/64576. --- Merges https://core.trac.wordpress.org/changeset/62531 / WordPress/wordpress-develop@e3c26545b1 to ClassicPress. * Use available test assertion for 62531 * WP-r62550: Code Modernization: Use `array_any()` where appropriate. This commit replaces several `foreach` loops that iterate an array, return `true` as soon as an element matches a condition, and otherwise fall through to `false`. That is exactly what PHP 8.4's `array_any()` expresses in a single, more readable call. WordPress core includes a polyfill for `array_any()` on PHP < 8.4 as of WordPress 6.8, so the change works on every supported PHP version without raising the minimum requirement. Follow-up to https://core.trac.wordpress.org/changeset/59783. WP:Props Soean, mukesh27, SergeyBiryukov. See https://core.trac.wordpress.org/ticket/65519. Conflicts: - src/wp-includes/block-template-utils.php - src/wp-includes/class-wp-block-processor.php --- Merges https://core.trac.wordpress.org/changeset/62550 / WordPress/wordpress-develop@a1314bbebc to ClassicPress. * WP-r62699: Coding Standards: Use `in_array()` instead of `array_search()` for existence checks. Several places in core use `array_search()` purely to determine whether a value exists in an array, comparing the result against `false`. In these cases the returned key/position is never used, so `in_array()` expresses the intent more clearly and avoids computing a return value that is discarded. This commit replaces those existence-only `array_search()` calls with `in_array()`. The strict (`true`) comparison flag is preserved in every case, so there is no change in behavior. WP:Props Soean. See https://core.trac.wordpress.org/ticket/64897. --- Merges https://core.trac.wordpress.org/changeset/62699 / WordPress/wordpress-develop@eb881494d9 to ClassicPress. * WP-r62708: KSES: Add `tabindex` to the list of allowed global attributes. Add `tabindex` to the list of global attributes allowed by `_wp_add_global_attributes()`, so it survives KSES filtering on any element that supports global attributes. Developed in: WordPress/wordpress-develop#12493 WP:Props ramonopoly, wildworks. Fixes https://core.trac.wordpress.org/ticket/65619. --- Merges https://core.trac.wordpress.org/changeset/62708 / WordPress/wordpress-develop@d6f6780a5a to ClassicPress. * WP-r62718: Block Supports: Add background gradient support that can combine with background image Adds `background.gradient` as a new block support, enabling blocks to combine a background gradient with a background image via comma-separated `background-image` CSS values (e.g., `background-image: linear-gradient(...), url(...)`). Before, the only way to apply a gradient is through `color.gradient`, which renders as a `background` CSS shorthand and conflicts with background image properties. By introducing `background.gradient` (stored at `style.background.gradient`), gradients become part of the background style group, allowing the style engine to combine gradient and image values without conflict. WP:Props aaronrobertshaw, ramonopoly, wildworks. Fixes https://core.trac.wordpress.org/ticket/64974. Conflicts: - src/wp-includes/block-supports/background.php - src/wp-includes/block-supports/colors.php - src/wp-includes/class-wp-theme-json.php - src/wp-includes/style-engine/class-wp-style-engine.php - tests/phpunit/tests/block-supports/colors.php - tests/phpunit/tests/block-supports/wpRenderBackgroundSupport.php - tests/phpunit/tests/style-engine/styleEngine.php - tests/phpunit/tests/theme/wpThemeJson.php --- Merges https://core.trac.wordpress.org/changeset/62718 / WordPress/wordpress-develop@6b190c64b2 to ClassicPress. * WP-r62850: KSES: Allow the autofocus attribute on dialog elements. First step to allow the usage of the autofocus attribute for native dialog elements. More work will follow to add a context-aware mechanism to KSES and allow the attribute on dialog element children. WP:Props westonruter, joedolson, mukesh27, afercia. Fixes https://core.trac.wordpress.org/ticket/65491. --- Merges https://core.trac.wordpress.org/changeset/62850 / WordPress/wordpress-develop@05d3b3cec4 to ClassicPress. * Use available test assertion for 62850 * WP-r63180: KSES: Allow functional CSS values in inline styles. The presentation properties allowlisted in https://core.trac.wordpress.org/changeset/62530 were accepted in name only: any declaration whose value contained a function call was dropped in full, so for users without the `unfiltered_html` capability those properties remained unusable in their canonical form. URL references are routed through the existing protocol validation, so the security model is unchanged. Developed in: WordPress/wordpress-develop#12942 Follow-up to https://core.trac.wordpress.org/changeset/62530. WP:Props courane01, hasnainashfaq, irozum, khokansardar, mdridipu, tyxla. Fixes https://core.trac.wordpress.org/ticket/65832. --- Merges https://core.trac.wordpress.org/changeset/63180 / WordPress/wordpress-develop@996c6d6864 to ClassicPress. * WP-r63320: Docs: Remove a blank line between `@param` and `@return` in core docblocks. The [https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/ PHP inline documentation standards] place `@return` immediately after the last `@param` tag, with no blank line between them: {{{ /** * Summary. * * @SInCE x.x.x * * @PARAM string $var Description. * @return string Description. */ }}} This corrects 44 docblocks across 33 files in `src/wp-includes` that used a line break between the two tags. Developed in WordPress/wordpress-develop#13063. WP:Props mukesh27, dhruvang21. See https://core.trac.wordpress.org/ticket/65818, https://core.trac.wordpress.org/ticket/65860. Conflicts: - src/wp-includes/block-editor.php - src/wp-includes/block-supports/aria-label.php - src/wp-includes/block-supports/block-style-variations.php - src/wp-includes/block-supports/colors.php - src/wp-includes/block-supports/custom-classname.php - src/wp-includes/block-supports/settings.php - src/wp-includes/block-supports/utils.php - src/wp-includes/block-template-utils.php - src/wp-includes/block-template.php - src/wp-includes/blocks.php - src/wp-includes/class-wp-block-type.php - src/wp-includes/class-wp-textdomain-registry.php - src/wp-includes/class-wp-theme-json-data.php - src/wp-includes/class-wp-theme-json-schema.php - src/wp-includes/class-wp-token-map.php - src/wp-includes/deprecated.php - src/wp-includes/functions.php - src/wp-includes/global-styles-and-settings.php - src/wp-includes/html-api/class-wp-html-doctype-info.php - src/wp-includes/html-api/class-wp-html-processor.php - src/wp-includes/html-api/class-wp-html-tag-processor.php - src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php - src/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.php - src/wp-includes/theme.php - src/wp-includes/user.php --- Merges https://core.trac.wordpress.org/changeset/63320 / WordPress/wordpress-develop@728a605348 to ClassicPress. * WP-r63910: KSES: Allow CSS anchor position properties. Adds CSS anchoring properties to the `safecss_filter_attr()` allow list: * `anchor-name` * `anchor-scope` * `position-anchor` * `position-area` * `position-try` * `position-try-fallbacks` * `position-try-order` * `position-visibility` WP:Props deepakprajapati, wildworks, adrianduffell, dannyreaktiv, im3dabasia1, westonruter. Fixes https://core.trac.wordpress.org/ticket/64972. --- Merges https://core.trac.wordpress.org/changeset/63910 / WordPress/wordpress-develop@6b08132f3f to ClassicPress. * Delete shadow.php - not needed --------- Co-authored-by: Sergey Biryukov <sergeybiryukov@git.wordpress.org> Co-authored-by: Peter Wilson <peterwilsoncc@git.wordpress.org> Co-authored-by: Isabel Brison <isabel_brison@git.wordpress.org> Co-authored-by: Jb Audras <audrasjb@git.wordpress.org> Co-authored-by: Colin Stewart <costdev@git.wordpress.org> Co-authored-by: Dennis Snell <dmsnell@git.wordpress.org> Co-authored-by: Jon Surrell <jonsurrell@git.wordpress.org> Co-authored-by: Timothy Jacobs <timothyblynjacobs@git.wordpress.org> Co-authored-by: Joe Dolson <joedolson@git.wordpress.org> Co-authored-by: Weston Ruter <westonruter@git.wordpress.org> Co-authored-by: Ella Van Durpe <ellatrix@git.wordpress.org> Co-authored-by: John Blackbourn <johnbillion@git.wordpress.org> Co-authored-by: Aki Hamano <wildworks@git.wordpress.org> Co-authored-by: Andrea Fercia <afercia@git.wordpress.org> Co-authored-by: ramonopoly <ramonopoly@git.wordpress.org> CP:Props: mattyrob, xxsimoxx

This comment was marked as low quality.

Sign in to view

t-hamano requested a lite review from Copilot August 8, 2026 06:44

Copilot started reviewing on behalf of t-hamano August 8, 2026 06:44

View session

Copilot AI reviewed Aug 8, 2026

View reviewed changes

t-hamano approved these changes Aug 8, 2026

View reviewed changes

Comment thread src/wp-includes/kses.php

Add more test cases

cf8c967

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

t-hamano requested review from mcsf, tyxla and westonruter August 8, 2026 06:58

tyxla reviewed Aug 8, 2026

View reviewed changes

Comment thread src/wp-includes/kses.php Outdated

t-hamano and others added 2 commits August 9, 2026 19:18

Docs: Update safecss_filter_attr() changelog for the new 7.1.0 support.

7dd8d6d

Documents the transform functions, `clip-path` basic shapes, and SVG element reference URLs added in the previous commit. Follow-up to #65832. Co-Authored-By: Claude <noreply@anthropic.com>

Formatting: Allow the remaining CSS basic shape functions in safecss_…

d0b3cc6

…filter_attr(). Co-Authored-By: Claude <noreply@anthropic.com>

tyxla approved these changes Aug 11, 2026

View reviewed changes

github-actions Bot closed this Aug 11, 2026

Navigation Menu

Repository navigation

Formatting: Allow CSS transform and SVG shape functions in safecss_filter_attr() - #12942

Formatting: Allow CSS transform and SVG shape functions in safecss_filter_attr()#12942
HasnainAshfaq wants to merge 4 commits into
WordPress:trunkfrom
HasnainAshfaq:feature/65832-kses-svg-css-functions

HasnainAshfaq commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

This comment was marked as low quality.

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

t-hamano Aug 8, 2026

Uh oh!

tyxla Aug 8, 2026

Uh oh!

t-hamano Aug 9, 2026

Uh oh!

t-hamano left a comment

Uh oh!

Uh oh!

Uh oh!

t-hamano commented Aug 11, 2026

Uh oh!

tyxla commented Aug 11, 2026

Uh oh!

github-actions Bot commented Aug 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

HasnainAshfaq commented Aug 7, 2026

The problem

The fix

Tests

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 7, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

This comment was marked as low quality.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

t-hamano Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

tyxla Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

t-hamano Aug 9, 2026

Choose a reason for hiding this comment

Uh oh!

t-hamano left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

t-hamano commented Aug 11, 2026

Uh oh!

tyxla commented Aug 11, 2026

Uh oh!

github-actions Bot commented Aug 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Aug 7, 2026 •

edited

Loading