Require being in Recovery Mode for extensions to be paused. - #38

Allows semi-colons in URLs, typically indicative of an HTML entity, such as `&` or `&`.

Script Loading Strategy - ML2 WordPress#14 - Update `do_item` method.

…e when content contains <

When a no-texturize tag (script, pre, code, etc.) contains a raw '<' character
— as in JavaScript like `if(a<b)` — wp_html_split() misidentifies the content
after that '<' as an HTML element delimiter. Previously, the texturize loop
would encode '&' characters in that false delimiter (e.g. '&&' became
'&WordPress#38;&WordPress#38;'), corrupting script content.

Fix: only run the '&' → '&WordPress#38;' substitution when we are not already inside a
no-texturize tag stack. Real HTML tag attributes (e.g. <a href="foo&bar">) are
only encountered at the top level, so the fix does not affect them.

This became more user-visible in WordPress 7.0, which introduced a dedicated
JavaScript panel in the Custom HTML block where users enter code that can
contain '<' comparisons.

Fixes #43785.

`WP_Styles::_css_href()` and `WP_Styles::get_rtl_href()` return URLs
escaped for an HTML attribute, with `&` as `&WordPress#38;`, while
`WP_Scripts::get_src()` returns them unescaped. So the
`prefetch_admin_assets` filter received the two in different forms, and
a callback appending the plain form of a stylesheet URL with more than
one query argument was not collapsed with it, despite what the filter
documents. Decode the stylesheet URLs before building the list. The
printed links are unchanged, since each URL is escaped again when
printed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The test of stylesheet URLs reaching the `wp_prefetch_admin_assets` filter unescaped had its callback append the plain form of the URL it received, by replacing `&WordPress#38;` with `&`. That dated from when stylesheet URLs reached the filter escaped. They now arrive plain, as the test itself asserts, so the replacement did nothing and the callback appended an identical URL.

The callback now appends the URL escaped with `esc_url()`, as a callback building it that way would, which differs from the plain one in its `&WordPress#38;`. Duplicates are collapsed by the escaped URL, so the two still give one prefetch link, and the test checks that the appended URL really does differ.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

HTML character references are not decoded in STYLE elements, so the
&WordPress#38; produced by esc_url() for a URL with multiple query parameters
would end up in the CSS literally. Escape with esc_url_raw() instead,
and wrap the URLs in double quotes: esc_url_raw() strips double quotes
but not single quotes or parentheses, so an unquoted url() token could
otherwise be terminated by the URL. Name the variables to make clear
they are already escaped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Addresses review feedback on PR WordPress#14187 by decoding search queries before entity-encoding them. This ensures queries containing decimal entities (e.g. 'Tour &WordPress#38; Travel') and hexadecimal entities (e.g. 'Tour & Travel') match term names stored in the database as HTML entities ('Tour & Travel').

Adds dedicated unit tests for decimal and hex numeric entities.

See #66279.

Keeps the `edit_bookmark_link()` expectations consistent with the
`get_edit_bookmark_link()` ones, with the escaped `&WordPress#38;` kept literal.

See #65819.