2.8.6

Changed

• Bump WordPress "tested up to" version 6.9 (props @peterwilsoncc, @dkotter via #352).
• Consider get_avatar() wrapper function get_simple_local_avatar() escaped (props @peterwilsoncc, @dkotter via #358).
• Consider wp_verify_nonce() as auto-sanitized (props @peterwilsoncc, @dkotter via #358).

Fixed

• Ensure form data is unslashed as required (props @peterwilsoncc, @dkotter via #358).

Security

• (Hardening) Ensure user has manage_option cap before saving default avatar (props @peterwilsoncc, @dkotter via #358).

Developer

• Ensure our final release asset gets attached properly to the release (props @dkotter, @jeffpaul via #340).
• Add Patchstack security-reporting FAQ (props @jeffpaul via #355).
• Update dependencies via npm audit fix (props @peterwilsoncc, @dkotter via #354).
• Bump on-headers from 1.0.2 to 1.1.0 (props @dependabot, @faisal-alvi via #341).
• Bump compression from 1.7.5 to 1.8.1 (props @dependabot, @faisal-alvi via #341).
• Bump form-data from 4.0.1 to 4.0.4 (props @dependabot, @peterwilsoncc via #346).
• Bump tmp from 0.2.3 to 0.2.5 (props @dependabot, @Sidsector9 via #347).
• Bump @wordpress/env from 10.11.0 to 10.28.0 (props @dependabot, @Sidsector9 via #347).
• Bump playwright from 1.48.2 to 1.56.1 (props @dependabot, @peterwilsoncc via #350).
• Bump lodash from 4.17.21 to 4.17.23 (props @dependabot, @dkotter via #356).
• Bump lodash-es from 4.17.22 to 4.17.23 (props @dependabot, @dkotter via #357).
• Bump qs from 6.14.1 to 6.14.2 (props @dependabot, @dkotter via #361).

Full Changelog: 2.8.5...2.8.6.
View all items closed in the release.