Bump github/codeql-action/analyze from 4.37.6 to 4.37.7 - #2646
Merged
westonruter merged 1 commit intoAug 27, 2026
Merged
Conversation
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.6 to 4.37.7. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5595cca...ff2f1c6) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
[Type] Enhancement
dependabot
Bot
requested review from
mukeshpanchal27,
thelovekesh and
westonruter
as code owners
August 26, 2026 23:05
dependabot
Bot
added
[Type] Enhancement
westonruter
deleted the
dependabot/github_actions/github/codeql-action/analyze-4.37.7
branch
August 27, 2026 00:35
mukeshpanchal27
added a commit
that referenced
this pull request
Aug 27, 2026
* Add prepare-release-notes command
Assemble the release notes for the plugins currently being released — those
with an open, dated milestone whose title does not contain "n.e.x.t" — by
reading each plugin's stable-tag changelog entry from its readme.txt (as
populated by npm run readme). Progress and warnings go to STDERR so STDOUT (the
Markdown notes) can be piped to a file or the clipboard.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add create-draft-release script
Create a draft GitHub release for the release date, using the combined
per-plugin changelogs from `npm run prepare-release-notes` as the body. The tag
and title are $RELEASE_DATE and the target is the release/$RELEASE_DATE branch.
Fails early if the target branch is missing on origin or a release for the tag
already exists, and authenticates the milestone lookup with the gh token to
avoid rate limiting.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add test case to replicate call in issue
* Account for wp_get_attachment_image_src() returning false
* Improve test coverage of webp_uploads_filter_wp_get_attachment_image()
* Account for `$attachment_id` arg being numeric-string in addition to int
Co-authored-by: b1ink0 <b1ink0@git.wordpress.org>
* Guard against unexpected `media_details` shape
Co-authored-by: mukeshpanchal27 <mukesh27@git.wordpress.org>
* Add remaining type guards
* Account for other plugins failing to return strings from filter callback
* Correct inaccurate statement that $icon is not used
* Fix $icon casting
* Improve handling of `$attr` when query string is passed
* Add tests for REST attachment response type guards
Add `@covers` tags to the existing Test_WebP_Uploads_REST_API tests and add
regression tests for the defensive guards in webp_uploads_update_rest_attachment(),
covering a missing/non-string `source_url`, a missing/invalid mime source `file`
in both the per-size and full-size loops, and non-array response data.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Test that webp_uploads_filter_wp_get_attachment_image() works with passing non-string as arg
* Add data provider for $attr normalization in wp_get_attachment_image filter
Convert the query-string test into a data-provider-driven test covering an
empty string, a query string, an array, and an invalid `false` value passed
as the `$attr` argument, asserting each is normalized before being passed to
the inner `webp_uploads_filter_wp_get_attachment_image` filter.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Build: Preserve plugin ZIP modified time when contents are unchanged.
`build-plugins:zip` rebuilds each plugin archive from a freshly re-copied
build directory, so the `zip` command embeds new entry timestamps every run
and the resulting bytes always differ even when the file contents are
identical. This bumped the ZIP's modified time on every build regardless of
whether anything actually changed.
Build the archive into a temporary file and compare it against the existing
ZIP using a timestamp-independent content fingerprint (each entry's
uncompressed size, CRC-32, and name via `unzip -v`). The existing ZIP is only
replaced when its contents actually change; otherwise the temporary file is
discarded and the existing file — including its modified time — is left
untouched.
Building fresh into a temporary file each time also ensures files removed from
a plugin no longer linger in an updated-in-place archive.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Build: Fail plugin ZIP build when untracked files would be included.
When zipping a plugin, stray files left in the plugin source directory get
copied into the build output and silently bundled into the archive. This
makes it easy to ship files that were never meant to be part of a release.
Before creating the archive, check the plugin source directory for files that
Git considers untracked (and are not ignored via .gitignore), narrowed to
those that actually made it into the build output — i.e. files not excluded by
the copy step's ignore patterns. If any are found, fail the build with a
message listing them. Generated build artifacts are unaffected because they
are either committed or gitignored.
The check can be bypassed with `--env force=true` for cases where including
untracked files is intentional.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Build: Forward extra arguments through the `build-plugins:zip` script.
The `build-plugins:zip` script wraps `build:plugin:*` via `npm-run-all`, which
did not pass extra command-line arguments through to the matched scripts. As a
result there was no way to reach the whole-suite zip build with the new
`--env force=true` override.
Add npm-run-all's `{@}` argument placeholder (and the required trailing `--`)
so arguments after `--` are forwarded to each plugin build. This makes
`npm run build-plugins:zip -- --env force=true` bypass the untracked-files
check across all plugins, while `npm run build-plugins:zip` continues to work
unchanged when no arguments are given.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Bump versions and add changelog
* Use env
Co-authored-by: thelovekesh <lovekesh.kumar@rtcamp.com>
* Distinguish draft vs published release in existing-release error
Only suggest `gh release delete` when the existing release is still a
draft. A published release is immutable, so advise supplying a
different RELEASE_DATE instead.
Co-authored-by: thelovekesh <thelovekesh@git.wordpress.org>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Bump the phpstan-packages group with 2 updates
Bumps the phpstan-packages group with 2 updates: [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) and [phpstan/phpstan-phpunit](https://github.com/phpstan/phpstan-phpunit).
Updates `phpstan/phpstan` from 2.2.2 to 2.2.3
- [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits)
Updates `phpstan/phpstan-phpunit` from 2.0.16 to 2.0.17
- [Release notes](https://github.com/phpstan/phpstan-phpunit/releases)
- [Commits](https://github.com/phpstan/phpstan-phpunit/compare/2.0.16...2.0.17)
---
updated-dependencies:
- dependency-name: phpstan/phpstan
dependency-version: 2.2.3
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: phpstan-packages
- dependency-name: phpstan/phpstan-phpunit
dependency-version: 2.0.17
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: phpstan-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump crate-ci/typos from 1.47.2 to 1.48.0
Bumps [crate-ci/typos](https://github.com/crate-ci/typos) from 1.47.2 to 1.48.0.
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](https://github.com/crate-ci/typos/compare/37bb98842b0d8c4ffebdb75301a13db0267cef89...bee27e3a4fd1ea2111cf90ab89cd076c870fce14)
---
updated-dependencies:
- dependency-name: crate-ci/typos
dependency-version: 1.48.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump the wordpress-packages group with 3 updates
Bumps the wordpress-packages group with 3 updates: [@wordpress/e2e-test-utils-playwright](https://github.com/WordPress/gutenberg/tree/HEAD/packages/e2e-test-utils-playwright), [@wordpress/env](https://github.com/WordPress/gutenberg/tree/HEAD/packages/env) and [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts).
Updates `@wordpress/e2e-test-utils-playwright` from 1.49.0 to 1.50.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/e2e-test-utils-playwright/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/e2e-test-utils-playwright@1.50.0/packages/e2e-test-utils-playwright)
Updates `@wordpress/env` from 11.9.0 to 11.10.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/env/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/env@11.10.0/packages/env)
Updates `@wordpress/scripts` from 32.5.0 to 32.6.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/scripts@32.6.0/packages/scripts)
---
updated-dependencies:
- dependency-name: "@wordpress/e2e-test-utils-playwright"
dependency-version: 1.50.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/env"
dependency-version: 11.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/scripts"
dependency-version: 32.6.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump fs-extra from 11.3.5 to 11.3.6
Bumps [fs-extra](https://github.com/jprichardson/node-fs-extra) from 11.3.5 to 11.3.6.
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jprichardson/node-fs-extra/compare/11.3.5...11.3.6)
---
updated-dependencies:
- dependency-name: fs-extra
dependency-version: 11.3.6
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Ignore PHPStan require.fileNotFound for generated build asset files
PHPStan 2.2.3 reports require.fileNotFound for the require of
build/web-vitals.asset.php in optimization-detective. That file is generated by
`npm run build`, which does not run in the PHP lint CI job, so the path cannot
be resolved during analysis. The require is guarded at runtime by a file_exists()
check in the plugin's load.php.
reportUnmatched is disabled because the error is not raised when the build assets
are present, as they are in a local checkout after a build.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Add array shape for web-vitals.asset.php return type
* Bump the phpstan-packages group with 2 updates
Bumps the phpstan-packages group with 2 updates: [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) and [phpstan/phpstan-phpunit](https://github.com/phpstan/phpstan-phpunit).
Updates `phpstan/phpstan` from 2.2.3 to 2.2.5
- [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits)
Updates `phpstan/phpstan-phpunit` from 2.0.17 to 2.0.18
- [Release notes](https://github.com/phpstan/phpstan-phpunit/releases)
- [Commits](https://github.com/phpstan/phpstan-phpunit/compare/2.0.17...2.0.18)
---
updated-dependencies:
- dependency-name: phpstan/phpstan
dependency-version: 2.2.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: phpstan-packages
- dependency-name: phpstan/phpstan-phpunit
dependency-version: 2.0.18
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: phpstan-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump dorny/paths-filter from 4.0.1 to 4.0.2
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 4.0.1 to 4.0.2.
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](https://github.com/dorny/paths-filter/compare/fbd0ab8f3e69293af611ebaee6363fc25e6d187d...7b450fff21473bca461d4b92ce414b9d0420d706)
---
updated-dependencies:
- dependency-name: dorny/paths-filter
dependency-version: 4.0.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump github/codeql-action/init from 4.36.2 to 4.37.0
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)
---
updated-dependencies:
- dependency-name: github/codeql-action/init
dependency-version: 4.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump actions/labeler from 6.1.0 to 6.2.0
Bumps [actions/labeler](https://github.com/actions/labeler) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/f27b608878404679385c85cfa523b85ccb86e213...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d)
---
updated-dependencies:
- dependency-name: actions/labeler
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump github/codeql-action/analyze from 4.36.2 to 4.37.0
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)
---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
dependency-version: 4.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump wp-phpunit/wp-phpunit from 7.0.0 to 7.0.2
Bumps [wp-phpunit/wp-phpunit](https://github.com/wp-phpunit/wp-phpunit) from 7.0.0 to 7.0.2.
- [Commits](https://github.com/wp-phpunit/wp-phpunit/compare/7.0.0...7.0.2)
---
updated-dependencies:
- dependency-name: wp-phpunit/wp-phpunit
dependency-version: 7.0.2
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump actions/setup-node from 6.4.0 to 7.0.0
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump softprops/action-gh-release from 3.0.1 to 3.0.2
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...3d0d9888cb7fd7b750713d6e236d1fcb99157228)
---
updated-dependencies:
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump the wordpress-packages group across 1 directory with 4 updates
Bumps the wordpress-packages group with 4 updates in the / directory: [@wordpress/e2e-test-utils-playwright](https://github.com/WordPress/gutenberg/tree/HEAD/packages/e2e-test-utils-playwright), [@wordpress/env](https://github.com/WordPress/gutenberg/tree/HEAD/packages/env), [@wordpress/prettier-config](https://github.com/WordPress/gutenberg/tree/HEAD/packages/prettier-config) and [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts).
Updates `@wordpress/e2e-test-utils-playwright` from 1.50.0 to 1.51.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/e2e-test-utils-playwright/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/e2e-test-utils-playwright@1.51.0/packages/e2e-test-utils-playwright)
Updates `@wordpress/env` from 11.10.0 to 11.11.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/env/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/env@11.11.0/packages/env)
Updates `@wordpress/prettier-config` from 4.50.0 to 4.51.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/prettier-config/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/prettier-config@4.51.0/packages/prettier-config)
Updates `@wordpress/scripts` from 32.6.0 to 33.0.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/scripts@33.0.0/packages/scripts)
---
updated-dependencies:
- dependency-name: "@wordpress/e2e-test-utils-playwright"
dependency-version: 1.51.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/env"
dependency-version: 11.11.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/prettier-config"
dependency-version: 4.51.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/scripts"
dependency-version: 33.0.0
dependency-type: direct:development
update-type: version-update:semver-major
dependency-group: wordpress-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
* Correct issue_comment event type syntax
Fix the YAML syntax for issue_comment event type.
* Deduplicate plugin coverage commands
* Add concurrency groups to cancel superseded workflow runs
Add concurrency configuration with cancel-in-progress: true to three
workflow files that were missing it, preventing duplicate job runs
when multiple commits are pushed to a PR in quick succession.
Fixes wasted Actions minutes and provides faster CI feedback.
* Update .github/workflows/add-pr-labels.yml
Co-authored-by: Mukesh Panchal <mukeshpanchal27@users.noreply.github.com>
* Update .github/workflows/e2e-test.yml
Co-authored-by: Mukesh Panchal <mukeshpanchal27@users.noreply.github.com>
* Update .github/workflows/spell-check.yml
Co-authored-by: Mukesh Panchal <mukeshpanchal27@users.noreply.github.com>
* Fix broken artifact existence debug log
Reuse the computed artifact existence boolean for both the step
output and the debug log so the message reflects the real value.
Signed-off-by: shaurya2k06 <shaurya2k06@gmail.com>
* Update .github/workflows/add-pr-labels.yml
Co-authored-by: thelovekesh <ops.lovekesh@gmail.com>
* Pass plugin slug via env in artifact existence check
Read matrix.plugin from process.env in the github-script step
instead of interpolating it directly into the inline script.
Signed-off-by: shaurya2k06 <shaurya2k06@gmail.com>
* Update wp-coding-standards/wpcs to 3.4.1
Regenerates composer.lock. The version constraint already allows 3.4.1,
so no composer.json change is needed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Bump the phpstan-packages group with 2 updates
Bumps the phpstan-packages group with 2 updates: [phpstan/phpstan-deprecation-rules](https://github.com/phpstan/phpstan-deprecation-rules) and [phpstan/phpstan-strict-rules](https://github.com/phpstan/phpstan-strict-rules).
Updates `phpstan/phpstan-deprecation-rules` from 2.0.4 to 2.0.5
- [Release notes](https://github.com/phpstan/phpstan-deprecation-rules/releases)
- [Commits](https://github.com/phpstan/phpstan-deprecation-rules/compare/2.0.4...2.0.5)
Updates `phpstan/phpstan-strict-rules` from 2.0.11 to 2.0.12
- [Release notes](https://github.com/phpstan/phpstan-strict-rules/releases)
- [Commits](https://github.com/phpstan/phpstan-strict-rules/compare/2.0.11...2.0.12)
---
updated-dependencies:
- dependency-name: phpstan/phpstan-deprecation-rules
dependency-version: 2.0.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: phpstan-packages
- dependency-name: phpstan/phpstan-strict-rules
dependency-version: 2.0.12
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: phpstan-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump web-vitals from 5.3.0 to 6.0.0
Bumps [web-vitals](https://github.com/GoogleChrome/web-vitals) from 5.3.0 to 6.0.0.
- [Changelog](https://github.com/GoogleChrome/web-vitals/blob/main/CHANGELOG.md)
- [Commits](https://github.com/GoogleChrome/web-vitals/compare/v5.3.0...v6.0.0)
---
updated-dependencies:
- dependency-name: web-vitals
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump actions/labeler from 6.2.0 to 7.0.0
Bumps [actions/labeler](https://github.com/actions/labeler) from 6.2.0 to 7.0.0.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d...bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13)
---
updated-dependencies:
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump github/codeql-action/analyze from 4.37.0 to 4.37.3
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)
---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump actions/checkout from 7.0.0 to 7.0.1
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump github/codeql-action/init from 4.37.0 to 4.37.3
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.0 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)
---
updated-dependencies:
- dependency-name: github/codeql-action/init
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump lint-staged from 17.0.8 to 17.1.1
Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from 17.0.8 to 17.1.1.
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](https://github.com/lint-staged/lint-staged/compare/v17.0.8...v17.1.1)
---
updated-dependencies:
- dependency-name: lint-staged
dependency-version: 17.1.1
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump globals from 17.7.0 to 17.8.0
Bumps [globals](https://github.com/sindresorhus/globals) from 17.7.0 to 17.8.0.
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.7.0...v17.8.0)
---
updated-dependencies:
- dependency-name: globals
dependency-version: 17.8.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump @playwright/test from 1.61.1 to 1.62.0
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.61.1 to 1.62.0.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.61.1...v1.62.0)
---
updated-dependencies:
- dependency-name: "@playwright/test"
dependency-version: 1.62.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump lint-staged from 17.1.1 to 17.2.0
Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from 17.1.1 to 17.2.0.
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](https://github.com/lint-staged/lint-staged/compare/v17.1.1...v17.2.0)
---
updated-dependencies:
- dependency-name: lint-staged
dependency-version: 17.2.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump web-vitals from 6.0.0 to 6.0.1
Bumps [web-vitals](https://github.com/GoogleChrome/web-vitals) from 6.0.0 to 6.0.1.
- [Changelog](https://github.com/GoogleChrome/web-vitals/blob/main/CHANGELOG.md)
- [Commits](https://github.com/GoogleChrome/web-vitals/compare/v6.0.0...v6.0.1)
---
updated-dependencies:
- dependency-name: web-vitals
dependency-version: 6.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump fs-extra from 11.3.6 to 11.4.0
Bumps [fs-extra](https://github.com/jprichardson/node-fs-extra) from 11.3.6 to 11.4.0.
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jprichardson/node-fs-extra/compare/11.3.6...11.4.0)
---
updated-dependencies:
- dependency-name: fs-extra
dependency-version: 11.4.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump the wordpress-packages group across 1 directory with 4 updates
Bumps the wordpress-packages group with 4 updates in the / directory: [@wordpress/e2e-test-utils-playwright](https://github.com/WordPress/gutenberg/tree/HEAD/packages/e2e-test-utils-playwright), [@wordpress/env](https://github.com/WordPress/gutenberg/tree/HEAD/packages/env), [@wordpress/prettier-config](https://github.com/WordPress/gutenberg/tree/HEAD/packages/prettier-config) and [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts).
Updates `@wordpress/e2e-test-utils-playwright` from 1.51.0 to 1.52.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/e2e-test-utils-playwright/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/rnmobile/1.52.0/packages/e2e-test-utils-playwright)
Updates `@wordpress/env` from 11.11.0 to 11.12.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/env/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/blocks@11.12.0/packages/env)
Updates `@wordpress/prettier-config` from 4.51.0 to 4.52.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/prettier-config/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/date@4.52.0/packages/prettier-config)
Updates `@wordpress/scripts` from 33.0.0 to 34.0.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/components@34.0.0/packages/scripts)
---
updated-dependencies:
- dependency-name: "@wordpress/e2e-test-utils-playwright"
dependency-version: 1.52.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/env"
dependency-version: 11.12.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/prettier-config"
dependency-version: 4.52.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/scripts"
dependency-version: 34.0.0
dependency-type: direct:development
update-type: version-update:semver-major
dependency-group: wordpress-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump phpstan/phpstan in the phpstan-packages group across 1 directory
Bumps the phpstan-packages group with 1 update in the / directory: [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source).
Updates `phpstan/phpstan` from 2.2.5 to 2.2.7
- [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits)
---
updated-dependencies:
- dependency-name: phpstan/phpstan
dependency-version: 2.2.7
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: phpstan-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix PHPStan issue for casting
* Add validation of SCRIPT#optimization-detective-detect-args
Previously the detect args were read by blindly dereferencing
`document.getElementById()` and parsing whatever `textContent` it
returned, which throws an opaque `TypeError` if the element is absent
or it wasn't a SCRIPT tag.
Instead:
- Query with `document.querySelector( 'script#…' )` rather than
`getElementById()`. The subsequent `instanceof HTMLScriptElement` guard
rejects a non-SCRIPT element anyway, so restricting the query to SCRIPT
elements avoids matching an element that can never be used.
- Hold the selector in a `jsonScriptSelector` variable so it is written
once and reused in the "Missing" error message.
- Throw an explicit error when the element is missing or is not a
SCRIPT, and validate that the parsed JSON is a `[ string, object ]`
tuple before it is destructured into the detect src and args.
- Parse the more tailired `argsScript.text` instead of
`argsScript.textContent`. `text` is typed as a non-null `string` on
`HTMLScriptElement`, whereas `textContent` is `string | null` on every
node, so this is better for static analysis.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Bump Optimization Detective version to 1.0.0-beta6
Update the `Version` header and the version passed to the pending-plugin
bootstrap in `load.php`, along with the `Stable tag` in `readme.txt`.
Add the changelog entry for the release, covering the validation of
SCRIPT#optimization-detective-detect-args.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Bump phpstan/phpstan from 2.2.7 to 2.2.8 in the phpstan-packages group
Bumps the phpstan-packages group with 1 update: [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source).
Updates `phpstan/phpstan` from 2.2.7 to 2.2.8
- [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits)
---
updated-dependencies:
- dependency-name: phpstan/phpstan
dependency-version: 2.2.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: phpstan-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump crate-ci/typos from 1.48.0 to 1.49.0
Bumps [crate-ci/typos](https://github.com/crate-ci/typos) from 1.48.0 to 1.49.0.
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](https://github.com/crate-ci/typos/compare/bee27e3a4fd1ea2111cf90ab89cd076c870fce14...8a48f81b6c64dcfea44b3633223084c4be58ac5f)
---
updated-dependencies:
- dependency-name: crate-ci/typos
dependency-version: 1.49.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump @types/lodash from 4.17.24 to 4.17.25
Bumps [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) from 4.17.24 to 4.17.25.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)
---
updated-dependencies:
- dependency-name: "@types/lodash"
dependency-version: 4.17.25
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump web-vitals from 6.0.1 to 6.1.0
Bumps [web-vitals](https://github.com/GoogleChrome/web-vitals) from 6.0.1 to 6.1.0.
- [Changelog](https://github.com/GoogleChrome/web-vitals/blob/main/CHANGELOG.md)
- [Commits](https://github.com/GoogleChrome/web-vitals/compare/v6.0.1...v6.1.0)
---
updated-dependencies:
- dependency-name: web-vitals
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump github/codeql-action/analyze from 4.37.3 to 4.37.6
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.3 to 4.37.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3)
---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
dependency-version: 4.37.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump github/codeql-action/init from 4.37.3 to 4.37.6
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.3 to 4.37.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3)
---
updated-dependencies:
- dependency-name: github/codeql-action/init
dependency-version: 4.37.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump dorny/paths-filter from 4.0.2 to 4.0.3
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 4.0.2 to 4.0.3.
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](https://github.com/dorny/paths-filter/compare/7b450fff21473bca461d4b92ce414b9d0420d706...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d)
---
updated-dependencies:
- dependency-name: dorny/paths-filter
dependency-version: 4.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump globals from 17.8.0 to 17.9.0
Bumps [globals](https://github.com/sindresorhus/globals) from 17.8.0 to 17.9.0.
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0)
---
updated-dependencies:
- dependency-name: globals
dependency-version: 17.9.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump lint-staged from 17.2.0 to 17.3.0
Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from 17.2.0 to 17.3.0.
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](https://github.com/lint-staged/lint-staged/compare/v17.2.0...v17.3.0)
---
updated-dependencies:
- dependency-name: lint-staged
dependency-version: 17.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump @playwright/test from 1.62.0 to 1.62.1
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.62.0 to 1.62.1.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.62.0...v1.62.1)
---
updated-dependencies:
- dependency-name: "@playwright/test"
dependency-version: 1.62.1
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump WordPress "Tested up to" versions of all plugins to 7.1
WordPress 7.1 is imminent, so update the readme header for each of the ten
plugins published to the plugin directory ahead of the upcoming releases.
The unreleased od-* plugins have no readme.txt and are unaffected, and the
"Requires at least" floor is left at 6.9.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Bump Optimization Detective to 1.0.0-beta7
* Add --increment and --set-version to the bump-versions command
Bumping a plugin version previously required an open, dated release milestone
titled "<slug> <version>". That is a lot of ceremony for a release that only
carries changes which are already merged, so add two ways to bump without one:
* --increment <major|minor|patch|prerelease> derives the target version from the
plugin's current "Stable tag".
* --set-version <version> sets an explicit version for a single plugin.
In either mode the plugins are named as positional arguments, matching the
calling convention of generate-pending-release-diffs.sh. The list is required
rather than inferred because the appropriate increment level differs per plugin,
so no single auto-detected set would be correct. Passing --all targets every
plugin for the rare case where one level does apply to all of them.
The "prerelease" level increments the trailing number of the prerelease
component, so 1.0.0-beta5 becomes 1.0.0-beta6. This is hand-rolled rather than
delegated to semver, which yields 1.0.0-beta5.0 because it treats "beta5" as a
single alphanumeric identifier.
Incrementing a version that has a prerelease component by major, minor, or patch
is refused, since that would silently graduate a beta to a stable release. All
target versions are resolved before any file is written, so that guard aborts the
whole run rather than leaving some plugins bumped and others not.
The milestone-based behaviour is unchanged when neither new option is passed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Bump wordpress/plugin-check-action from 1.1.7 to 1.1.9
Bumps [wordpress/plugin-check-action](https://github.com/wordpress/plugin-check-action) from 1.1.7 to 1.1.9.
- [Release notes](https://github.com/wordpress/plugin-check-action/releases)
- [Commits](https://github.com/wordpress/plugin-check-action/compare/98a1788320d0add90df2d8183934ecccbc4e05d2...10857da14b6c2246d15402b3e69f777edcf8c12e)
---
updated-dependencies:
- dependency-name: wordpress/plugin-check-action
dependency-version: 1.1.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump minor versions for auto-sizes, dominant-color-images, speculation-rules, web-worker-offloading
Run via:
```bash
npm run bump-versions -- --increment minor auto-sizes dominant-color-images speculation-rules web-worker-offloading
```
* Bump prerelease versions for embed-optimizer and image-prioritizer
Run via:
```bash
npm run bump-versions -- --increment prerelease embed-optimizer image-prioritizer
```
* Add changelog entries for the pending plugin releases
Fill in the empty changelog entries that bump-versions stubbed out for the seven
plugins being released. The entries are written by hand because the changelog and
prepare-release-notes commands derive their content from a release milestone, and
these releases deliberately skip milestones.
The bulk of each entry is the same across all seven plugins, since what is pending
is a single cross-cutting sweep: strict types, native property types, and the
raised WordPress 6.9 and PHP 7.4 minimums. Only three plugins carry anything
beyond that:
* Optimization Detective moved the URL Metrics storage HMAC validation into the
REST endpoint callback and dropped its deprecated constants.
* Speculative Loading hardened the JSON encoding of its inline scripts.
* Image Prioritizer fixed TypeScript 6 type errors in the video lazy-loading
script.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Fix pending release diffs missing same-length readme changes
The script could report a plugin as having no pending changes when it actually
had some. Bumping "Tested up to: 7.0" to "7.1" replaces a line with one of
exactly the same length, and the working copy is reused between runs, so a
previous run's rsync leaves the build file's mtime on the copy. Both rsync's
default quick check and SVN's own stat cache compare size and mtime rather than
content, so each concludes the file is unchanged and "svn status" comes back
clean.
The failure is intermittent, since it only bites once a prior run has left a
matching mtime behind, and it is silent in the worst way: the affected plugin is
reported under a "No changes." note, which reads as confirmation that there is
nothing to release.
Pass -c so rsync compares checksums, and --no-times so the files it copies get a
fresh mtime that invalidates SVN's stat cache. Both are needed; -c alone still
leaves SVN unable to see the change.
Verified against a cold checkout and a warm one, with identical results.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Omit generated JS bundles from the pending release diffs
The two web-vitals bundles under build/ accounted for 35% of the whole diff,
42 KB out of 124 KB, for what amounts to a library upgrade. They are minified
despite not carrying a .min.js suffix, so the existing *.min.js exclusion misses
them, and each is a single line, meaning any change at all renders as a
whole-file rewrite.
Exclude build/*.js, which brings the diff down from 127 KB to 85 KB. The sibling
build/*.asset.php is deliberately left in, since its 'version' is the compact
signal that the bundled library changed: two lines showing 5.1.0 becoming 6.1.0,
in place of 42 KB of unreadable bundle.
That signal turned out to be worth keeping. It surfaced that web-vitals is going
from 5.1.0 to 6.1.0, across a major release, which was missing from Optimization
Detective's changelog entry and is now added.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Suppress built file contents in the diff instead of excluding the files
Excluding generated assets from the rsync kept the diff readable but blinded
"svn status" to them, which is the wrong trade: status is the view that answers
which files are being added, removed, and modified, and it should be complete.
Worse, the exclusion also protected those files from --delete, so a stray
minified asset dropped into an already-tracked directory was reported nowhere at
all. Only one landing in a brand new directory showed up, and then merely as its
parent directory, with no indication of what was inside.
Copy everything instead, and filter "svn diff" so that generated files keep their
header but have their contents replaced with a placeholder. They stay visible as
changed without dragging in tens of KB of unreadable bundle: the whole report
goes from 127 KB to 88 KB. The *.asset.php files are left intact, since their
'version' is the readable signal that a bundled library changed.
Also expand unversioned directories in the status output, so that a batch of
added files is listed file by file rather than collapsing into its parent.
This supersedes the build/*.js exclusion added in the previous commit, whose
carve-out for *.asset.php is preserved here by the same reasoning.
Both edge cases are now covered: a stray min file in a tracked directory shows as
"? stray.min.js", and a new directory lists its contents. It immediately turned
up a real pending change that the exclusion had been hiding, a modified
view-transitions .min.css, which on inspection is only a minifier emitting #0000
where it used to emit transparent.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Ship the source maps for the vendored web-vitals bundles
web-vitals began publishing source maps in 6.0.0, and emits a sourceMappingURL
comment alongside them. That reference is correct inside the package, where the
map sits next to the bundle, but the webpack config copies only the bundles out
of node_modules. The upgrade would therefore have shipped two files pointing at
maps that do not exist, making browsers request a URL that 404s whenever devtools
is open.
Copy the maps too, rather than stripping the comment. Upstream publishes them
deliberately for exactly this case, and Optimization Detective is a plugin whose
entire purpose is measuring real user performance, so readable web-vitals frames
are worth having when debugging it or an extension built on it. Both maps carry
sourcesContent, so they are self-contained and need nothing else fetched. The
Gutenberg plugin ships source maps for the same reason; WordPress core does not,
but core is not distributed as a plugin.
The cost is 49 KB on a 106 KB zip, and nothing at runtime: browsers only request
a map once devtools is open, so no visitor ever pays for it.
Two renames had to be handled, since web-vitals.attribution.js is copied in as
web-vitals-attribution.js. Its map is now named to match, the sourceMappingURL
comment in the bundle is repointed at the new name, and the map's own "file"
field is repointed at the renamed bundle. Both transformers are written as
factories over a file name rather than hardcoded, since any vendored bundle
renamed on the way in needs the same treatment.
Note that the two added .map files are visible in the pending release diff as
untracked additions only because generated assets are now copied and suppressed
rather than excluded. Under the previous exclusion they would have been added to
the plugin without appearing anywhere in the report.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Allow preparing release notes without a release milestone
The release notes were the last step still requiring milestones, and it failed
quietly rather than loudly. Only one of the seven plugins being released has a
dated milestone, so prepare-release-notes produced notes for that one alone, and
create-draft-release checked only that the notes file was non-empty. A draft
release would therefore have been created covering one plugin out of seven, with
nothing to indicate the other six were missing.
The milestone was never the source of the content: getReadmeChangelogEntry()
already reads each plugin's changelog from its readme.txt, and the milestone only
decided which plugins to include. So accept plugin slugs as positional arguments
and skip the lookup entirely when any are given, matching what bump-versions
already does.
There is deliberately no option to select every plugin here, unlike bump-versions
where one exists but is rarely useful. A plugin that is not being released still
has a changelog entry for its current stable tag, so including it would repeat an
already-published entry in the new release notes.
When plugins are named explicitly, a failure on any of them is now fatal and
nothing at all is written, rather than the previous per-plugin tolerance emitting
a subset. Asking for specific plugins and silently getting fewer is the exact
failure this commit exists to prevent. Milestone selection keeps the old
behaviour, since there the set was never asserted by hand.
create-draft-release forwards any slugs through, then verifies each one is present
in the generated notes before creating the draft. Where no slugs are given it now
lists which plugins the notes actually cover, so an omission is visible rather
than implied by silence.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Bump globals from 17.9.0 to 17.11.0
Bumps [globals](https://github.com/sindresorhus/globals) from 17.9.0 to 17.11.0.
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0)
---
updated-dependencies:
- dependency-name: globals
dependency-version: 17.11.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump wp-phpunit/wp-phpunit from 7.0.2 to 7.0.4
Bumps [wp-phpunit/wp-phpunit](https://github.com/wp-phpunit/wp-phpunit) from 7.0.2 to 7.0.4.
- [Commits](https://github.com/wp-phpunit/wp-phpunit/compare/7.0.2...7.0.4)
---
updated-dependencies:
- dependency-name: wp-phpunit/wp-phpunit
dependency-version: 7.0.4
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump the wordpress-packages group across 1 directory with 4 updates
Bumps the wordpress-packages group with 4 updates in the / directory: [@wordpress/e2e-test-utils-playwright](https://github.com/WordPress/gutenberg/tree/HEAD/packages/e2e-test-utils-playwright), [@wordpress/env](https://github.com/WordPress/gutenberg/tree/HEAD/packages/env), [@wordpress/prettier-config](https://github.com/WordPress/gutenberg/tree/HEAD/packages/prettier-config) and [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts).
Updates `@wordpress/e2e-test-utils-playwright` from 1.52.0 to 1.53.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/e2e-test-utils-playwright/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/e2e-test-utils-playwright@1.53.0/packages/e2e-test-utils-playwright)
Updates `@wordpress/env` from 11.12.0 to 11.13.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/env/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/env@11.13.0/packages/env)
Updates `@wordpress/prettier-config` from 4.52.0 to 4.53.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/prettier-config/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/prettier-config@4.53.0/packages/prettier-config)
Updates `@wordpress/scripts` from 34.0.0 to 34.1.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/scripts@34.1.0/packages/scripts)
---
updated-dependencies:
- dependency-name: "@wordpress/e2e-test-utils-playwright"
dependency-version: 1.53.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/env"
dependency-version: 11.13.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/prettier-config"
dependency-version: 4.53.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
- dependency-name: "@wordpress/scripts"
dependency-version: 34.1.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: wordpress-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
* Update props-bot-action to the latest trunk commit (#2644)
* Bump github/codeql-action/init from 4.37.6 to 4.37.7 (#2647)
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.6 to 4.37.7.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)
---
updated-dependencies:
- dependency-name: github/codeql-action/init
dependency-version: 4.37.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump github/codeql-action/analyze from 4.37.6 to 4.37.7 (#2646)
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.6 to 4.37.7.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)
---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
dependency-version: 4.37.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump web-vitals from 6.1.0 to 6.1.1 (#2645)
Bumps [web-vitals](https://github.com/GoogleChrome/web-vitals) from 6.1.0 to 6.1.1.
- [Changelog](https://github.com/GoogleChrome/web-vitals/blob/main/CHANGELOG.md)
- [Commits](https://github.com/GoogleChrome/web-vitals/compare/v6.1.0...v6.1.1)
---
updated-dependencies:
- dependency-name: web-vitals
dependency-version: 6.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: shaurya2k06 <shaurya2k06@gmail.com>
Co-authored-by: Weston Ruter <weston@ruter.net>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: b1ink0 <b1ink0@git.wordpress.org>
Co-authored-by: Weston Ruter <westonruter@git.wordpress.org>
Co-authored-by: thelovekesh <lovekesh.kumar@rtcamp.com>
Co-authored-by: thelovekesh <thelovekesh@git.wordpress.org>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan <155432245+EvanYao826@users.noreply.github.com>
Co-authored-by: msranjana <msranjana22@gmail.com>
Co-authored-by: Ranjana <155282747+msranjana@users.noreply.github.com>
Co-authored-by: shaurya2k06 <shaurya2k06@gmail.com>
Co-authored-by: thelovekesh <ops.lovekesh@gmail.com>
Co-authored-by: Konstantin Obenland <obenland@gmx.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action/analyze from 4.37.6 to 4.37.7.
Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
ff2f1c6Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8951a133Update changelog for v4.37.7be7a3dbMerge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...9310334Merge pull request #4086 from github/mbg/thread-action-state-to-codeqlb4d8a54Rebuildab5db25Bump the npm-minor group across 1 directory with 8 updates38055a3DroploggerfromdatabaseInitClusterin interface1f87aedMerge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3dc1b98aMakeloggeravailable togetCodeQLForCmd6f0220eMerge pull request #4084 from github/navntoft/bump-undiciDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)