v1.66.0

What's Changed

Added

• $disable_search_empty_query (default false). With $disable_search on,
  the main query was marked 404 but still ran with no search term, so
  $wp_query->posts held real posts under a 404 status and the database ran
  a wasted query on every ?s= URL. With the flag on, the query gets
  post__in => [0] and matches nothing. Opt-in: a 404 template that loops
  over $wp_query->posts goes from a populated list to an empty one (#175).
• $disable_search_use_set_404 (default false). With $disable_search on, a
  blocked search is marked 404 through core's WP_Query::set_404() instead of
  four hand-written flag assignments. Core resets every conditional first, so
  is_archive(), is_date() and the like stop answering true on the 404, and
  the set_404 action fires. is_feed is kept, as in core. The raw request
  arg $query->query['s'] is still blanked, because pre_get_posts runs next.
  Opt-in: a theme could rely on a surviving conditional (#173).

Fixed

• The resizable editor sidebar no longer polls. assets/js/gutenberg-resizable-sidebar.js
  ran a setInterval every 500 ms that called .resizable() again on a widget
  that already existed. jQuery UI then read computed style across the whole
  document on each tick. With a large ACF block form in the sidebar (about
  11,000 DOM nodes) the main thread was blocked for 230-280 ms per tick, about
  60 percent of the time, even when the editor was idle, and a click into a
  field took one to two seconds. The script now uses one MutationObserver
  with a per-frame debounce. It initialises each sidebar element once and
  repairs it only when React replaces the element, resets its class or inline
  style, or removes the handle. It applies the stored width only when the
  inline width differs from it, and writes nothing when nothing changed.
  Behaviour that users see is the same; it stays behind
  $admin_resizable_sidebar. Measured on one page: 3,741 ms blocked in 6 s
  before, 0 ms after; a click into a field 22-31 ms. A new Node test tier
  (tests/js/, composer test:js) pins this (#242).
• A theme without a Text Domain header no longer enqueues its script under
  an empty handle. WordPress needs a non-empty handle to track a script, so
  the script now uses the fixed handle theme. The script still loads.

Pull Requests

• #228 — docs: add security policy, contributing guide and GitHub templates
• #230 — chore(deps): bump actions/checkout from 5 to 7
• #231 — chore(deps): bump amannn/action-semantic-pull-request from 5 to 6
• #232 — chore: stop tracking composer.lock
• #233 — fix(phpstan): clear three errors a fresh composer resolve exposes
• #234 — fix(starter-base): mark a blocked search 404 through set_404() behind a flag
• #235 — fix(starter-base): stop the posts query behind a blocked search, behind a flag
• #236 — docs(readme): say what $disable_search changes and what it leaves alone
• #238 — ci: pin all actions to commit SHAs
• #243 — fix(editor): stop the resizable sidebar polling the main thread
• #244 — fix(build): keep the JavaScript tests out of composer check

Full Changelog: v1.65.0...v1.66.0