release: v10.2.0

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -1,5 +1,5 @@
-name: Bug Report
-description: Create a report to help us improve
+name: Report a bug 🐛
+description: Report bugs in Blockly, so we can fix them.
 labels: 'issue: bug, issue: triage'
 body:
   - type: markdown

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,7 @@
 contact_links:
-  - name: Blockly Forum
+  - name: Ask a question ❓
     url: https://groups.google.com/forum/#!forum/blockly
-    about: The Blockly developer forum, where you can ask and answer questions.
-  - name: Plugins and examples
+    about: Go to the Blockly developer forum, where you can ask and answer questions.
+  - name: Report issues with plugins and examples 🧩
     url: https://github.com/google/blockly-samples/issues/new/choose
     about: File bugs or feature requests about plugins and samples in our blockly-samples repository.

.github/ISSUE_TEMPLATE/documentation.yaml

@@ -1,5 +1,5 @@
-name: Documentation
-description: Report an issue with our documentation
+name: Report a documentation problem 📖
+description: Could our documentation be better? Tell us how.
 labels: 'issue: docs, issue: triage'
 body:
   - type: markdown

.github/ISSUE_TEMPLATE/feature_request.yaml

@@ -1,5 +1,5 @@
-name: Feature request
-description: Suggest an idea for this project
+name: Make a feature request ✨
+description: Suggest an idea to make Blockly better.
 labels: 'issue: feature request, issue: triage'
 body:
   - type: markdown

.github/PULL_REQUEST_TEMPLATE.md

@@ -7,10 +7,7 @@
 
 <!-- TODO: Verify the following, checking each box with an 'x' between the brackets: [x] -->
 
-- [ ] I branched from develop
-- [ ] My pull request is against develop
-- [ ] My code follows the [style guide](https://developers.google.com/blockly/guides/modify/web/style-guide)
-- [ ] I ran `npm run format` and `npm run lint`
+- [ ] I [validated my changes](https://developers.google.com/blockly/guides/contribute/core#making_and_verifying_a_change)
 
 ## The details
 ### Resolves
@@ -22,14 +19,6 @@ Fixes
 
 <!-- TODO: Describe what this Pull Request does.  Include screenshots if applicable. -->
 
-#### Behavior Before Change
-
-<!--TODO: Image, gif or explanation of behavior before this pull request. -->
-
-#### Behavior After Change
-
-<!--TODO: Image, gif or explanation of behavior after this pull request. -->
-
 ### Reason for Changes
 
 <!--TODO: Explain why these changes should be made.  Include screenshots if applicable. -->

.github/workflows/appengine_deploy.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
       # Checks-out the repository under $GITHUB_WORKSPACE.
       # When running manually this checks out the master branch.
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Prepare demo files
         # Install all dependencies, then copy all the files needed for demos.

.github/workflows/browser_test.yml

@@ -24,7 +24,7 @@ jobs:
         # https://nodejs.org/en/about/releases/
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           persist-credentials: false
 
@@ -45,10 +45,6 @@ jobs:
         if: runner.os == 'Linux'
         run: source ./tests/scripts/setup_linux_env.sh
 
-      - name: MacOS Test Setup
-        if: runner.os == 'macOS'
-        run: source ./tests/scripts/setup_osx_env.sh
-
       - name: Run Build
         run: npm run build
 

.github/workflows/build.yml

@@ -23,7 +23,7 @@ jobs:
         # https://nodejs.org/en/about/releases/
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           persist-credentials: false
 
@@ -44,10 +44,6 @@ jobs:
         if: runner.os == 'Linux'
         run: source ./tests/scripts/setup_linux_env.sh
 
-      - name: MacOS Test Setup
-        if: runner.os == 'macOS'
-        run: source ./tests/scripts/setup_osx_env.sh
-
       - name: Run
         run: npm run test
 
@@ -58,7 +54,7 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Use Node.js 20.x
         uses: actions/setup-node@v3
@@ -75,7 +71,7 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Use Node.js 20.x
         uses: actions/setup-node@v3

.github/workflows/welcome_new_contributors.yml

@@ -0,0 +1,37 @@
+on:
+  pull_request_target:
+    types:
+      - opened
+name: Welcome new contributors
+jobs:
+  welcome:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/first-interaction@v1
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-message: >
+            Welcome! It looks like this is your first pull request in Blockly,
+            so here are a couple of tips:
+
+              - You can find tips about contributing to Blockly and how to
+              validate your changes on our
+              [developer site](https://developers.google.com/blockly/guides/contribute/core#making_and_verifying_a_change).
+
+              - All contributors must sign the Google Contributor License
+              Agreement (CLA). If the google-cla bot leaves a comment on this
+              PR, make sure you follow the instructions.
+
+              - We use [conventional commits](https://www.conventionalcommits.org/)
+              to make versioning the package easier. Make sure your commit
+              message is in the [proper format](https://developers.google.com/blockly/guides/contribute/get-started/commits)
+              or [learn how to fix it](https://developers.google.com/blockly/guides/contribute/get-started/commits#fixing_non-conventional_commits).
+
+              - If any of the other checks on this PR fail, you can click on
+              them to learn why. It might be that your change caused a test
+              failure, or that you need to double-check the
+              [style guide](https://developers.google.com/blockly/guides/contribute/core/style_guide).
+
+            Thank you for opening this PR! A member of the Blockly team will review it soon.

README.md

@@ -42,7 +42,7 @@ Want to make Blockly better? We welcome contributions to Blockly in the form of
 
 ## Releases
 
-We release by pushing the latest code to the master branch, followed by updating the npm package, our [docs](https://developers.google.com/blockly), and [demo pages](https://google.github.io/blockly-samples/). We typically release a new version of Blockly once a quarter (every 3 months). If there are breaking bugs, such as a crash when performing a standard action or a rendering issue that makes Blockly unusable, we will cherry-pick fixes to master between releases to fix them. The [releases page](https://github.com/google/blockly/releases) has a list of all releases.
+We release by pushing the latest code to the master branch, followed by updating the npm package, our [docs](https://developers.google.com/blockly), and [demo pages](https://google.github.io/blockly-samples/). If there are breaking bugs, such as a crash when performing a standard action or a rendering issue that makes Blockly unusable, we will cherry-pick fixes to master between releases to fix them. The [releases page](https://github.com/google/blockly/releases) has a list of all releases.
 
 We use [semantic versioning](https://semver.org/). Releases that have breaking changes or are otherwise not backwards compatible will have a new major version. Patch versions are reserved for bug-fix patches between scheduled releases.
 
@@ -72,15 +72,7 @@ Unreleased APIs may change radically. Anything that is in `develop` but not `mas
 
 ## Issues and Milestones
 
-We typically triage all bugs within 2 working days, which includes adding any appropriate labels and assigning it to a milestone. Please keep in mind, we are a small team so even feature requests that everyone agrees on may not be prioritized.
-
-### Milestones
-
-**Upcoming release** - The upcoming release milestone is for all bugs we plan on fixing before the next release. This typically has the form of `year_quarter_release` (such as `2019_q2_release`). Some bugs will be added to this release when they are triaged, others may be added closer to a release.
-
-**Bug Bash Backlog** - These are bugs that we're still prioritizing. They haven't been added to a specific release yet, but we'll consider them for each release depending on relative priority and available time.
-
-**Icebox** - These are bugs that we do not intend to spend time on. They are either too much work or minor enough that we don't expect them to ever take priority. We are still happy to accept pull requests for these bugs.
+We typically triage all bugs within 1 week, which includes adding any appropriate labels and assigning it to a milestone. Please keep in mind, we are a small team so even feature requests that everyone agrees on may not be prioritized.
 
 ## Good to Know
 

appengine/storage.js

@@ -130,6 +130,8 @@ BlocklyStorage.handleRequest_ = function() {
           BlocklyStorage.alert(BlocklyStorage.HASH_ERROR.replace('%1',
               window.location.hash));
         } else {
+          // Remove poison line to prevent raw content from being served.
+          data = data.replace(/^\{\[\(\< UNTRUSTED CONTENT \>\)\]\}\n/, '');
           BlocklyStorage.loadXml_(data, BlocklyStorage.httpRequest_.workspace);
         }
       }

appengine/storage.py

@@ -15,15 +15,15 @@
 limitations under the License.
 """
 
-"""Store and retrieve XML with App Engine.
+"""Store and retrieve Blockly XML/JSON with App Engine.
 """
 
 __author__ = "[email protected] (Quynh Neutron)"
 
-import cgi
 import hashlib
-from random import randint
 from google.cloud import ndb
+from random import randint
+from urllib.parse import unquote
 
 
 class Xml(ndb.Model):
@@ -32,6 +32,7 @@ class Xml(ndb.Model):
   xml_content = ndb.TextProperty()
   last_accessed = ndb.DateTimeProperty(auto_now=True)
 
+
 def keyGen():
   # Generate a random string of length KEY_LEN.
   KEY_LEN = 6
@@ -40,8 +41,23 @@ def keyGen():
   return "".join([CHARS[randint(0, max_index)] for x in range(KEY_LEN)])
 
 
+# Parse POST data (e.g. a=1&b=2) into a dictionary (e.g. {"a": 1, "b": 2}).
+# Very minimal parser.  Does not combine repeated names (a=1&a=2), ignores
+# valueless names (a&b), does not support isindex or multipart/form-data.
+def parse_post(environ):
+  fp = environ["wsgi.input"]
+  data = fp.read().decode()
+  parts = data.split("&")
+  dict = {}
+  for part in parts:
+    tuple = part.split("=", 1)
+    if len(tuple) == 2:
+      dict[tuple[0]] = unquote(tuple[1])
+  return dict
+
+
 def xmlToKey(xml_content):
-  # Store XML and return a generated key.
+  # Store XML/JSON and return a generated key.
   xml_hash = int(hashlib.sha1(xml_content.encode("utf-8")).hexdigest(), 16)
   xml_hash = int(xml_hash % (2 ** 64) - (2 ** 63))
   client = ndb.Client()
@@ -65,7 +81,7 @@ def xmlToKey(xml_content):
 
 
 def keyToXml(key_provided):
-  # Retrieve stored XML based on the provided key.
+  # Retrieve stored XML/JSON based on the provided key.
   # Normalize the string.
   key_provided = key_provided.lower().strip()
   # Check datastore for a match.
@@ -80,20 +96,30 @@ def keyToXml(key_provided):
     with client.context():
       result.put()
     xml = result.xml_content
+    # Add a poison line to prevent raw content from being served.
+    xml = "{[(< UNTRUSTED CONTENT >)]}\n" + xml
   return xml
 
 
 def app(environ, start_response):
-  forms = cgi.FieldStorage(fp=environ['wsgi.input'], environ=environ)
+  headers = [
+    ("Content-Type", "text/plain")
+  ]
+  if environ["REQUEST_METHOD"] != "POST":
+    start_response("405 Method Not Allowed", headers)
+    return ["Storage only accepts POST".encode("utf-8")]
+  if ("CONTENT_TYPE" in environ and
+      environ["CONTENT_TYPE"] != "application/x-www-form-urlencoded"):
+    start_response("405 Method Not Allowed", headers)
+    return ["Storage only accepts application/x-www-form-urlencoded".encode("utf-8")]
+
+  forms = parse_post(environ)
   if "xml" in forms:
-    out = xmlToKey(forms["xml"].value)
+    out = xmlToKey(forms["xml"])
   elif "key" in forms:
-    out = keyToXml(forms["key"].value)
+    out = keyToXml(forms["key"])
   else:
     out = ""
 
-  headers = [
-    ("Content-Type", "text/plain")
-  ]
   start_response("200 OK", headers)
   return [out.encode("utf-8")]

blocks/blocks.ts

@@ -4,8 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import * as goog from '../closure/goog/goog.js';
-goog.declareModuleId('Blockly.libraryBlocks');
+// Former goog.module ID: Blockly.libraryBlocks
 
 import * as colour from './colour.js';
 import * as lists from './lists.js';

blocks/colour.ts

@@ -4,8 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import * as goog from '../closure/goog/goog.js';
-goog.declareModuleId('Blockly.libraryBlocks.colour');
+// Former goog.module ID: Blockly.libraryBlocks.colour
 
 import {
   createBlockDefinitionsFromJsonArray,

blocks/lists.ts

@@ -4,8 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import * as goog from '../closure/goog/goog.js';
-goog.declareModuleId('Blockly.libraryBlocks.lists');
+// Former goog.module ID: Blockly.libraryBlocks.lists
 
 import * as fieldRegistry from '../core/field_registry.js';
 import * as xmlUtils from '../core/utils/xml.js';

blocks/logic.ts

@@ -4,8 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import * as goog from '../closure/goog/goog.js';
-goog.declareModuleId('Blockly.libraryBlocks.logic');
+// Former goog.module ID: Blockly.libraryBlocks.logic
 
 import * as Events from '../core/events/events.js';
 import * as Extensions from '../core/extensions.js';

blocks/loops.ts

@@ -4,8 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import * as goog from '../closure/goog/goog.js';
-goog.declareModuleId('Blockly.libraryBlocks.loops');
+// Former goog.module ID: Blockly.libraryBlocks.loops
 
 import type {Abstract as AbstractEvent} from '../core/events/events_abstract.js';
 import type {Block} from '../core/block.js';
@@ -16,8 +15,6 @@ import type {
 } from '../core/contextmenu_registry.js';
 import * as Events from '../core/events/events.js';
 import * as Extensions from '../core/extensions.js';
-import * as Variables from '../core/variables.js';
-import * as xmlUtils from '../core/utils/xml.js';
 import {Msg} from '../core/msg.js';
 import {
   createBlockDefinitionsFromJsonArray,
@@ -273,15 +270,15 @@ const CUSTOM_CONTEXT_MENU_CREATE_VARIABLES_GET_MIXIN = {
     const variable = varField.getVariable()!;
     const varName = variable.name;
     if (!this.isCollapsed() && varName !== null) {
-      const xmlField = Variables.generateVariableFieldDom(variable);
-      const xmlBlock = xmlUtils.createElement('block');
-      xmlBlock.setAttribute('type', 'variables_get');
-      xmlBlock.appendChild(xmlField);
+      const getVarBlockState = {
+        type: 'variables_get',
+        fields: {VAR: varField.saveState(true)},
+      };
 
       options.push({
         enabled: true,
         text: Msg['VARIABLES_SET_CREATE_GET'].replace('%1', varName),
-        callback: ContextMenu.callbackFactory(this, xmlBlock),
+        callback: ContextMenu.callbackFactory(this, getVarBlockState),
       });
     }
   },

blocks/math.ts

@@ -4,8 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import * as goog from '../closure/goog/goog.js';
-goog.declareModuleId('Blockly.libraryBlocks.math');
+// Former goog.module ID: Blockly.libraryBlocks.math
 
 import * as Extensions from '../core/extensions.js';
 import type {FieldDropdown} from '../core/field_dropdown.js';