Repository navigation
Update wordpress monorepo: Merge trunk and rename the @wordpress/ui 0.24 components it added - #53583
Nikschavan wants to merge 58 commits into
Conversation
* Build connectors card as a bundled ES module # Conflicts: * More thorough build state checks, and general cleanup # Conflicts: # projects/plugins/inspect/composer.lock * Fix test type expectation * Add test-js-coverage script * Add additional clarification-adding comments in the connection webpack config file * Add override block in babel.config.js * Update composer.lock files # Conflicts: # projects/plugins/inspect/composer.lock * Update .c8rc.json file to inclue src under include * Switch approach to disable DependencyExtractionPlugin and use a custom plugin instead * Update dependency-extraction-webpack-plugin to 6.57.0 to match trunk * Remove failed build snackbar * Connectors card: map all shared scripts and fail the build on any other unmapped import * Fix connectors card return with a failed build and update tests and docs * Connectors card: drop the unused jetpackConfig external, since connectorsCardExternal() now handles every import
* add the Columns widget kind over the chart pieces columns as figures of both periods in; series, legend, colors and states out * draw the bar family widgets with Columns the four builders go; the coupon Other sums the same coupons in both periods * expose the Columns widget kind through the SDK contract 1.10.0 * add the columns widgets to the package six on the Columns kind over the package's own hooks; contract floor 1.10.0 * drop the Premium Analytics columns widgets the WooCommerce Stats package builds them now * move internal dep to the proper doc block #53464 (comment) --------- Co-authored-by: Cursor <cursoragent@cursor.com>
* Podcast: load the dashboard's JavaScript translations The wp-build Podcast dashboard shipped with its strings in English on non-English sites: nothing downloads its JS translation catalog at boot. This applies the same approach #50762 used for the other wp-build dashboards. - Add a boot `init` package that calls loadI18nCatalogs( 'jetpack-podcast' ). - Register it on the dashboard page and stamp the text domain / write the i18n manifest after wp-build. - Enqueue wp-jp-i18n-loader on the Podcast page. - Register the init script module directly when `wp_default_scripts` has already fired. The Podcast build is loaded on admin_menu, after that hook, so the generated registrar never ran and the init module was missing from the import map ("Failed to resolve module specifier"). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Podcast: suppress the Phan undeclared-function error for the generated registrar jetpack_podcast_register_script_modules() is defined by the generated build/modules.php, which Phan doesn't analyze. The call is already guarded by function_exists(). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Podcast: cover the translation loader changes with tests Moves the late script-module registration into a small method that takes the registrar as a parameter, so it can be tested without the generated build code (and no longer needs a Phan suppression). Adds tests for the loader enqueue and the registration. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Add changelog entry for plugins/jetpack * Refactor to follow the pattern from #50762 for consistency --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> Co-authored-by: Daniel Lind <daniel.lind@automattic.com>
…53539) Adds the plugins introduced in WordPress/gutenberg#84607 to the React 19 incompatible plugins list: - astra-pro-sites - echo-rewards - forminator - iron-security - stackable-ultimate-gutenberg-blocks
Co-authored-by: matticbot <matticbot@users.noreply.github.com>
WordPress 5.4 added apply_shortcodes() as the preferred name for do_shortcode(). Jetpack now requires WordPress 7.0, so the alias is always available. Calls whose result is echoed directly are left on do_shortcode(): WPCS lists do_shortcode() as an escaping function but not apply_shortcodes(), so switching those lines would fail WordPress.Security.EscapeOutput.OutputNotEscaped. Co-authored-by: Fery Yundara Putera <22367469+daefery@users.noreply.github.com>
…lace tab and wpcomsh (#53511) The api, cache, mapper and a new tier reader move to jetpack-mu-wpcom, which both wpcomsh and WordPress.com Simple load; merging into core's tabs and symlink install stay in wpcomsh. Along the way: * The Marketplace tab lists the whole catalog below the Business plan, where the plan-based removal of WordPress.org themes used to empty the result it answered with. * A failed read of the theme list is no longer cached for a day, so the next request retries rather than every tab staying empty until the entry expires. * Entitlement by tier is answered in one place, leaving each surface its own choice about showing partner themes.
#53405) The image lived on the site only; PayPal payment links cannot carry one yet. The field, its media-library imports and its styles go, while the attributes, the preview and the front-end render stay so blocks that already hold an image keep showing it. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…ite Add Plugins screen (#53169) * mu-wpcom: let the Marketplace cards work where core's install functions are missing Simple sites draw the Add Plugins screen from their own page, without wp-admin/includes/plugin-install.php and under core's screen id. The cards no longer call install_plugin_install_status() when it is absent, and the details modal recognises that screen. * mu-wpcom: let Simple sites route Marketplace purchases and supply store prices Two filters for the Simple Add Plugins screen in wpcom: wpcom_marketplace_checkout_url, so a purchase checkout cannot complete goes through Calypso, and wpcom_marketplace_store_products, since the in-process API client on Simple cannot reach the v1.1 products endpoint the cards are priced from. * mu-wpcom: add a changelog entry for the Simple Add Plugins screen * mu-wpcom: keep a Marketplace plugin's saving on its price's line Core caps the strip's left column at 180px for ratings, and a price with its saving needs up to 192px, so the saving wrapped on most cards. That row only shares its line with "Last Updated", so give the price whatever that does not need, and never less than core's 180px. * mu-wpcom: say a Marketplace plugin needs an upgrade where the plan lacks it A site whose plan does not include purchased plugins can only buy one with a plan in the same checkout, which a Simple site's checkout URL filter now adds. "Purchase" read as if the plugin were all it paid for. Its button says "Upgrade and purchase" there instead, and wraps onto two lines in core's 120px button column rather than running over the card's name. * mu-wpcom: test the Marketplace button's upgrade label Covers both labels. The test runs in its own process: Brain Monkey's stub of wpcom_site_has_feature() would otherwise stay defined for the rest of the run and relabel every later button. * mu-wpcom: turn the Marketplace tab on for every site The wpcom-plugins-marketplace-tab flag now defaults to on, so the tab and its cards show on the Add Plugins screen of every Atomic site, and of every Simple site once WordPress.com's Simple screen is in. The flag stays as an off switch: per site from Tools > Feature Flags (a8c), or for every site by setting the default back. Tests that checked the tab stays out with the flag off now turn it off themselves instead of relying on the default, and the tab tests register the flag again, since the feature flags tests reset the registry. * mu-wpcom: one changelog entry for the Marketplace tab The four entries described parts of one change: the tab going live on every site, Simple included.
…guages (#53485) * Backup: flip directional icons in RTL Closed-folder chevrons and the Back to overview arrows now follow isRTL(). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Backup: Cover the back arrow in LTR and name its direction correctly Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
* Comments: Accept a stale nonce from the site's own page * Comments: Check the Origin before the cookie swap * Comments: Match the full origin, drop the anonymous nonce swap * Comments: Ignore a default port in the origin match * Comments: Match scheme and port in the same-site check * Comments: Keep the Origin fallback to logged-in readers * Comments: Refuse a same-site check with no headers
…53533) * add the Locations widget kind over the chart pieces a ranking of places in; the list with flags, the map and the states out * draw Visitors by location with Locations the toggle only decides the country and the rows now * drop the deleted visitors-by-location suite from its test group The builder moved into the Locations kind, and the group still imported the old file. Co-authored-by: Cursor <cursoragent@cursor.com> * center the Locations map with Stack The map cell was a flex box only to center the chart; Stack owns that alignment now. Co-authored-by: Cursor <cursoragent@cursor.com> * export only the Locations names callers import The folder keeps the component and the row type. Props and builder results stay inside the kind, and the components barrel no longer re-exports it. Co-authored-by: Cursor <cursoragent@cursor.com> * name the figure on the map and compare visible rows only Locations takes valueLabel for the map tooltip; a previous figure past maxRows no longer turns the comparison on --------- Co-authored-by: Cursor <cursoragent@cursor.com>
* Backup: make dates, times and sizes follow the locale in the modernized dashboard Date and time formats are translatable strings, so English stays as designed and locales can switch to 24-hour time. Restore and Download point labels use one translatable string. File and storage sizes use locale number formatting with translatable units. The activity list row separator reuses a translatable string. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Backup: keep en_US file sizes ungrouped, and strip only a trailing AM/PM Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Backup: Follow the site's date and time formats Read the date, time and date-time formats from the site settings through @wordpress/date instead of new translatable strings. Only the short month and day stays translatable, with its translators comment inside the call so the build keeps it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Name the option in one place for the module's writer, delete the copy when the user unlinks from WordPress.com or is deleted, and stop storing the boolean a delete request answers with as if it were an address.
* Protect Dashboard: Address Scan feedback (in-place delete, arrow keys, history skeleton, threat notices, close inspector on tab switch) * Protect Dashboard: Two-line threat rows, narrower Severity column, sidebar actions pinned to the bottom * Protect dashboard: Keep Scan notices until they are dismissed Action snackbars hid after six seconds, so a fix still running had no visible progress and a result could be missed. * Protect dashboard: Add View to in-progress Scan notices While a threat is being fixed, ignored or unignored, its notice offers View, which opens that threat in the sidebar. * Protect dashboard: Show whether a threat's plugin or theme is active The threat sidebar badges the affected plugin or theme as active, inactive, or the active theme's parent. * Protect dashboard: Keep a Scan notice open after View, and let finished ones hide A snackbar removes itself when its action is clicked, so View shows the progress notice again. Success notices hide on their own; progress and error notices stay until dismissed. * Protect dashboard: Share one threat opener and inspector reset View on a Scan notice now opens the threat on the tab that lists it, closing any other inspector, instead of whatever page started the action. Also reuse get_state() for the delete check and tidy the badge and delete hook. * Protect dashboard: Address review feedback on Scan deletes and arrow keys - Delete waits for a running fix or ignore on any threat in the same plugin or theme, and marks them busy while it runs. - While a threat is open, the arrow keys no longer scroll the page at the first or last row. - Route tests cover deleting an unused theme and keeping the active theme and its parent. - Add a Jetpack changelog entry. * Protect dashboard: Tighten the in-place delete route and its tests - Look a theme up by its key in wp_get_themes(), as plugins already are. - Return the existing error when WordPress needs filesystem credentials. - Clear the History cache after a delete. - Close the inspector after a delete only when its threat was deleted. - Keep the page from scrolling when the arrow keys reach either end. - Use a logical property for the table cell's minimum size. - Test themes, capability, filesystem access, the failed-delete path, and the arrow-key guards. * Protect dashboard: Test a path slug and missing filesystem access on delete * Protect dashboard: Show a checkmark on Scan success notices * Protect dashboard: Guard plugin folders, word plugin deletes honestly, skip fixed threats - A plugin counts as active when any plugin in its folder is, since deleting it removes the whole folder; the badge, Delete and the route all follow. - The plugin delete confirmation says its data goes too, as uninstall routines run. - Fixed threats no longer offer Delete. --------- Co-authored-by: Brandon Kraft <public@brandonkraft.com>
* Comments: Keep the form nonce out of the page HTML * Comments: Add the nonce from inline script * Comments: Show the plain form when the bundle never runs * Comments: Add the nonce again on DOMContentLoaded * Comments: Show guests a note instead of the form without JavaScript
…ure notice (#53438) On the modernized dashboard, the "Learn what to do" toggle in the Critical CSS failure notice used the shared Button's default 16px size, while the notice text is 13px. Make the toggle inherit the notice's font size and line height on the modern surface only, without touching the shared FoldingElement or Button that other features also use. Fixes BOOST-818
…53534) * expose the Locations widget kind through the SDK contract 1.11.0 * export Locations from the components barrel the toolkit root imports it there since the kind joined the SDK * declare valueLabel on the Locations SDK type
…53444) * Newsletter: link to the email design screen from the email previewer A creator looking at the preview is the one most likely to want the email to look different, so the previewer's header carries a link to the design screen next to the device and audience controls. A new tab, because that one holds an unsaved post. The script-data URL is bare now that two surfaces link to the screen: each adds its own `return`, because each is somewhere different to go back to — the settings card to the settings page, the previewer to the post being previewed. Placement is a first pass; NL-1023 wants a design call on it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Newsletter: send no return URL from the previewer's design link The link opens a new tab because this one holds an unsaved post — but it also sent `return=<post editor URL>`, so the design editor's Back button reopened that same post in the new tab. Two editors, one post, and no warning between them: `wp_check_post_lock()` reports nothing when both are the same user, so whichever tab saved last won silently. The link now carries the bare URL, and Back goes to the dashboard, which is what `exit_url()` already does for Appearance, a bookmark or a reload. Also from review: the click event records `post_id` like every sibling event in this modal; the local script-data augmentation no longer claims to be the only reader of a key the newsletter package also declares; and `exit_url()`'s docblock no longer describes the settings link as the only one sending a return. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Newsletter: shrink the previewer's design link to an icon below large On a site with paid tiers the header carries two control groups, and a third text label pushed the modal title out of it — "Preview em…" clipped, "Paid subscribers" wrapped, the link's arrow dropped to its own line. Confirmed against the same window with the feature flag off, where the header fits. Below `large` the link is now its icon, which is the band where the device selector already drops its desktop option. Full label above that. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Newsletter: design-review pass on the previewer's design link From Ollie's review of the live header: * The Styles icon now carries at every size, with the label beside it where there is room, so the icon becomes familiar rather than appearing only when the label is dropped. * 8px between the audience control and the icon at the smallest size, where the two were touching. * The link gets its own inline-flex box, so the icon, the label and the new-tab indicator sit on one centre line. The indicator was landing low and right of the icon, on a text baseline the icon is too tall for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Newsletter: keep the underline off the design link's new-tab arrow `inline-flex` on the link blockified `@wordpress/ui`'s indicator span, and a descendant cannot cancel a text-decoration propagated from an ancestor — so the underline drew straight across the arrow. The component keeps that span an `inline-block` for exactly this reason, as its stylesheet says. Aligned inline instead: `vertical-align: middle` on the icon and the label, so the indicator stays the inline-block it was built to be. Dropping the flex `gap` also brings the arrow in, which the design review asked for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Newsletter: keep the new-tab notice in the design link's accessible name `@wordpress/ui`'s `Link` announces `openInNewTab` only through a child span's `aria-label`, and an `aria-label` on the anchor overrides its contents when the accessible name is computed. So below `large` — the icon-only case, where a screen-reader user has no other cue — the name collapsed to "Edit email design" and the notice was dropped, while sighted users still saw the arrow. Above `large`, with no `aria-label`, the same link announced it. The label is a `VisuallyHidden` child now, so the name reads the same at every size. `title` stays for the pointer tooltip. Also from review: the reason this link sends no `return` was written out in three places; it keeps the one on the component that owns the decision. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…53490) * Newsletter: Treat ActivityPub renders as a logged-out visit The ActivityPub plugin renders a post once and shares that copy with everyone, so it has to be the version a logged-out visitor gets. The access checks answered for the request doing the render instead: its user and its subscriber token. Answer as a visitor while ActivityPub is rendering, for both the newsletter access level and the Premium Content block. The check runs before the per-user cache, since the same request keeps rendering for its own user afterwards. * Phan: Drop baseline entries the ActivityPub fixture resolves Likes, Related Posts and Sharing each call \Activitypub\is_activitypub_request() behind a function_exists() check. Phan could not see that function, so the three files each carried a PhanUndeclaredFunction entry in the baseline. The test fixture added for the paywall checks declares the function. Phan now resolves those calls, and the entries no longer match anything.
* wpcomsh: Stop forcing the Activity Log module on Removes the jetpack_feature_policy callback that pinned activity-log on for every Atomic site, along with its test and the matching remove_filter in the Jetpack test bootstrap. The module stays in the post-transfer activation list, so it is still on by default. * Changelog: collapse the Activity Log entries into one The forced-on policy was added and removed between releases, so the net change is that Activity Log is turned on after a transfer or reset. Reword the earlier wpcomsh entry to say that, and drop the entries describing the policy and its test workaround.
…53316) * JSON API: Save the allow list posted to the site settings endpoint The jetpack_protect_whitelist case checked class_exists() against an unqualified string, which never matches the namespaced class, so the save was skipped. Call the class directly, as the read side already does. Also accept the nested shape the GET response returns, and reject non-string entries with an error. * JSON API: Cover the invalid address error on the site settings allow list
… wanted state (#53317) * Protect: Let the on/off endpoints accept the wanted state toggle-waf and toggle-account-protection inverted whatever the current state was, so a stale page or a double submit did the opposite of what was asked. Both now take an optional `enabled` boolean and the Protect UI sends it. A request without it still flips, so a cached copy of the old script keeps working. The firewall notice now reports the state that was requested. * Protect: Make the firewall mutation enable-only The Protect UI can only turn the firewall on, so the mutation now always sends enabled: true and keeps its single pair of notices. The two-way notices were being merged by the production minifier, which failed the i18n check.
* CLI: Read the current allow list in wp jetpack protect allow The command read the legacy jetpack_protect_whitelist site option but saved to jetpack_waf_ip_allow_list, so list and clear always saw an empty list and adding an IP replaced every existing entry. Read through Brute_Force_Protection_Shared_Functions::get_local_allow_list() instead, the same option save_allow_list() writes. * CLI: Drop duplicate entries before listing or saving the allow list A site that still has the legacy jetpack_protect_whitelist option gets it merged into every read of jetpack_waf_ip_allow_list, so each add saved one more copy of the legacy entries.
…d archives (#53575) * SEO Tools: Apply a post's noindex setting only on that post's own page * Re-run CI: WordPress.com Tests flaked on unrelated wpcut smoke checks
…ng fee (#53500) * PayPal Payment Buttons: collect the shipping address without a shipping fee * PayPal Payment Buttons: require the shipping address for PayPal-settings tax and shipping * PayPal Payment Buttons: rename the shipping toggle to Shipping fees * PayPal Payment Buttons: make the shipping address a toggle above the fees * PayPal Payment Buttons: tidy shipping address comments and tests
* Premium Analytics: Add All time to the report date menu * Premium Analytics: Scope the all-time Top authors cap to the Authors report - Send num=-1 from the Authors report on All time and let WPCOM apply its three-year cap, instead of a client-side copy of it in the shared query. The author page's widgets keep their whole window. - Share one ANCHORED_SURFACE_PRESETS list between detail and report pages. - Simplify the origin window params and correct the PHP fallback comment. - Tighten the route and layout tests, and cover WPCOM's zero registration date. * test: Trim all-time report coverage and verify dashboard-only lookups * Premium Analytics: Give the negative-num Top authors test a full report window * Premium Analytics: Hold off a failed start-date lookup for that site ID only * Premium Analytics: Add the All time changelog entry to wpcomsh * Premium Analytics: Let WPCOM pick where All time starts on reports Reports send num: -1 for All time instead of a start date, as classic Stats does, so merged stats history is included and no registration lookup is needed. * Premium Analytics: Keep the author page's All time on its own dates Only report pages let WPCOM pick where All time starts, so they now say so with allTimeStartsOnServer instead of the dropdown inferring it from a missing allTimeStart. The author page's Top viewed posts CSV shares the widget's query and dated filename, so the file matches the card. * fix: Honor all-time query windows and simplify report helpers * Premium Analytics: Keep All time off the Videos report until its endpoint supports it stats/video-plays clamps num below 1 to 1, so num=-1 without a start date summed a single day (STATS-396). Reports now opt in to All time, and Videos stays out.
…imezones (#53524) * Premium Analytics: Reset the E2E site to UTC before each spec * Premium Analytics: Check dashboard dates follow the site timezone in E2E * Premium Analytics: Note the E2E site timezone and the page.clock trap * Premium Analytics: Derive the E2E site offset from its timezone * Premium Analytics: Scope the E2E tick check to the Views chart
…passes its views limit (#53401)
…024-trunk-merge # Conflicts: # pnpm-lock.yaml # projects/packages/backup/src/dashboard/screens/restore.tsx # projects/packages/connection/package.json # projects/packages/newsletter/src/settings/sections/email-design-section.tsx # projects/packages/podcast/package.json # projects/packages/premium-analytics/widgets/sales-by-coupon-usage/package.json # projects/packages/premium-analytics/widgets/utm-insights/package.json # projects/packages/protect/routes/dashboard/sections/scan/delete-software.tsx # projects/packages/protect/routes/dashboard/sections/scan/threat-details.tsx # projects/packages/woocommerce-stats/widgets/bookings-by-device/package.json # projects/packages/woocommerce-stats/widgets/bookings-revenue-by-customer-type/package.json # projects/packages/woocommerce-stats/widgets/revenue-by-customer-type/package.json # projects/packages/woocommerce-stats/widgets/sales-by-coupon/package.json # projects/packages/woocommerce-stats/widgets/sales-by-device/package.json # projects/packages/woocommerce-stats/widgets/total-returns/package.json
…ast merge Backup's backup detail screen uses ButtonLink, and Premium Analytics' plan limit notice and UTM builder dialog use the CloseIconButton parts. These reached trunk after the previous trunk merge, so the update had not renamed them yet.
There was a problem hiding this comment.
This file is automatically generated and should not be edited directly. See the comment at the top of the file for details.
If you have any questions, ping @Automattic/jetpack-monorepo.
There was a problem hiding this comment.
This file is automatically generated and should not be edited directly. See the comment at the top of the file for details.
If you have any questions, ping @Automattic/jetpack-monorepo.
There was a problem hiding this comment.
This file is automatically generated and should not be edited directly. See the comment at the top of the file for details.
If you have any questions, ping @Automattic/jetpack-monorepo.
|
Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.
Interested in more tips and information?
|
Fixes N/A
Proposed changes
@wordpress/uiAPIs that 0.24.0 renames. This PR merges trunk into the Renovate branch and renames what came in, so Update wordpress monorepo #53004 builds again after it merges.ButtonLinkin Backup's backup detail screen,Notice.CloseIconButtonin the Premium Analytics plan limit notice (WOOA7S-2038: Premium Analytics: Show a notice when the site nears or passes its views limit #53401), andDialog.CloseIconButtonin the Premium Analytics UTM builder dialog (WOOA7S-2294: Premium Analytics: Add Build URL to empty UTM widget #53458).restore.tsx: trunk'sisRTLimport and date helpers, and the branch'suseEffectfor thespeak()call.email-design-section.tsx: trunk'shrefwith the return URL, rendered byButtonLink.delete-software.tsx: trunk's version, which no longer has the link branch for non-theme software.threat-details.tsx:ButtonLinkplus trunk'suseOpenThreatimport.premium-analytics/widgets/sales-by-coupon-usage/package.jsonis removed, because trunk moved that widget to WooCommerce Stats. I regeneratedpnpm-lock.yamlfrom the Renovate side.@wordpress/uiconsumer uses*.CloseIcon,LinkButton,spokenMessageorpoliteness.Related product discussion/links
Does this pull request change what data or activity we track or use?
No.
Testing instructions
pnpm install, and build Premium Analytics withjp build plugins/premium-analytics --deps.