WordPress 4.9.12.

Backporting several bug fixes.

- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 5.0 branch.

Add .nvmrc files to older versions of WordPress

Fixes #48140.
Props whyisjake.

WordPress 4.9.11.

jQuery: Backport the patch from jQuery 3.4.0.

Merges [45342] to the 4.9 branch.

Props MikeNGarrett, peterwilsoncc, azaozz.
Fixes #47020.

Fix for URL sanitization in `wp_kses_bad_protocol_once()`.

Merges [45997] to the 4.9 branch.

Props irsdl, sstoqnov, whyisjake.

Improve handling the existing `rel` attribute in `wp_rel_nofollow_callback()`.

Merges [45990] to the 4.9 branch.
Props xknown, sstoqnov.

Improve URL validation in `wp_validate_redirect()`.

Merges [45971] to the 4.9 branch.
Props vortfu, whyisjake, peterwilsoncc.

Remove _convert_urlencoded_to_entities() from the get_the_content() callback.

Merges [45937] to the 4.9 branch.

Props vortfu, whyisjake, peterwilsoncc

Escape the output in `wp_ajax_upload_attachment()`.

Merges [45936] to the 4.9 branch.
Props whyisjake, sstoqnov.

Build/Test tools: Further trimming of CI jobs on the 4.9 branch.

This removes the PHP 5.6 job which runs without an object cache in place as the likelihood of a change being backported that only breaks 5.6 environments without an object cache is small.

Merges [45005] into the 4.9 branch.

See #42387

Build/Test tools: Switch npm dependency caching strategy on Travis CI.

This switches to caching npm's local cache instead of `node_modules` in order to prevent issues caused by modules compiled using a different version of node.

Merges [44993] into the 4.9 branch.

See #46632

Build/Test tools: Trim the test matrix on Travis in order to speed up the 4.9 branch build.

This removes the PHP 7.1, 7.0, 5.5, 5.4, 5.3, and nightly jobs.

See #42387, #40407

WordPress 4.9.10

Comments: Improve comment content filtering.

Merges [44842] to the 4.9 branch.

Formatting: Improve `rel="nofollow"` handling in comments.

Merges [44833] to the 4.9 branch.

Dashboard: Remove the Try Gutenberg callout.

Merge of [43807] from the 5.0 branch.

Props mukesh27.
Fixes #45063.

Bump 4.9 branch to version 4.9.9.

Editor: Remove unwanted fields before saving posts.

The `meta_input`, `file`, and `guid` fields are not intended to be updated through user input.

Merges [44047] to the 4.9 branch.

Multisite: Validate activation links.

Merges [44048] to the 4.9 branch.

Multisite: Improve messaging for previously activated users.

Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.

Merges [44021] to the 4.9 branch.

KSES: Make the URI attributes DRY.

This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.

Merges [44014] and [44017] to the `4.9` branch.

KSES: Conditionally remove the `<form>` element from `$allowedposttags`.

To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.

Merges [43994] to the 4.9 branch.

Media: Improve verification of MIME file types.

Merges [43988] to the 4.9 branch.

Media: Revert [43602] from the 4.9 branch.

Reverts changes to the "Edit more details" link in the attachment details modal.

This is out of scope for 4.9.9 and will be re-introduced in 5.0.0.

Fixes #44620.

REST API: Revert [43648] from the 4.9 branch.

This change is out of the 4.9.x scope, and will be reintroduced in 5.0.x.

See #40510.

Taxonomy: Revert [43620] from the 4.9 branch.

This change is out of the 4.9.x scope, and will be reintroduced in 5.0.x.

See #44872.

Privacy: Revert [43624] from the 4.9 branch.

This change is out of the 4.9.x scope, and will be reintroduced in 5.0.x.

See #44685.

Posts, Post Types: Revert [43617] from the 4.9 branch.

This change is out of the 4.9.x scope, and will be reintroduced in 5.0.x.

See #34706.

Privacy: Revert [43614] from the 4.9 branch.

This change is out of the 4.9.x scope, and will be reintroduced in 5.0.x.

See #43985.

Customize: Revert [43619] from the 4.9 branch.

This change is out of the 4.9.x scope, and will be reintroduced in 5.0.x.

See #44809.

Customize: Revert [43611] from the 4.9 branch.

This change is out of the 4.9.x scope, and will be reintroduced in 5.0.x.

See #44770.

Customize: Revert [43575] from the 4.9 branch.

This change is out of the 4.9.x scope, and will be reintroduced in 5.0.x.

See #44763.

Twenty Sixteen: Revert [43607] from the 4.9 branch.

This change is out of the 4.9.x scope, and will be reintroduced in 5.1.x.

See #44668.

Revert [43632] from the 4.9 branch.

These new hooks are not part of the 4.9.x scope, and will be reintroduced
as part of 5.0.x.

See #44733.

Try Gutenberg callout: improve formatting for Internet Explorer 11.

Correct an issue where the layout of the "Try Gutenberg" callout added in #41316 falls apart under IE11.

Props kjellr, ianbelanger, pbiron, Luciano Croce, belcherj, ryansommers.     
Fixes #44742.

General: PHP 7.3 throws an `E_WARNING` when using continue to target a switch.

Applying continue to a switch is equivalent to using break and quite possibly, a continue targeting a higher level control structure is actually intended.

To target the higher level control structure, a numeric argument has to be passed to continue. This fixes two cases in WordPress Core where this is currently happening.

See: https://github.com/php/php-src/pull/3364
See: https://wiki.php.net/rfc/continue_on_switch_deprecation

Props jrf.
Merges [43653] to the 4.9 branch.
Fixes #44543.

Media: In WP_Image_Editor::make_image(), close previously opened output buffer if the file could not be created.

In addition to the merge noted below, includes important brackets added in [42343].

Props dhanendran, gnif, sergey.
Merges [42695] and [42702] to the 4.9 branch.
Fixes #43255.

REST API: Support pagination, order, search and other common query parameters for revisions.

The original REST API revisions controller relied on `wp_get_post_revisions()`, getting all revisions of a post without any possibility to restrict the result. This changeset replaces that function call with a proper `WP_Query` setup, replicating how `wp_get_post_revisions()` works while offering parameters to alter the default behavior.

Props adamsilverstein, birgire, flixos90.
Merges [43584-43586], [43647] to the 4.9 branch.
Fixes #40510.

Tests: Improve coverage for REST API term meta registration.

Introduce tests to validate that register_meta and register_term_meta work as expected in WP_REST_Terms_Controller.

Props timmydcrawford.
Merges [43567] to the 4.9 branch.
See #39122.

Docs: Correct `@since` value for `_wp_privacy_statuses()`.

Fix typo in `@since` entry for `WP_Privacy_Policy_Content:add()`.

Props dimadin.
Merges [43638] to the 4.9 branch.
Fixes #44915.

REST API: Pass correct ID to `meta->update_value` to permit setting term meta during term creation.

Props joehoyle.
Merges [43636] to the 4.9 branch.
Fixes #44834.

Taxonomy: Introduce new hooks when registering/unregistering taxonomies for object types.

Props soulseekah.
Merges [43558] and [43631] to the 4.9 branch.
Fixes #44733.

Tests: Introduce `Tests_HTTP_Functions::skipTestOnTimeout()`, mirroring the same `WP_HTTP_UnitTestCase` method.

Merges [43512] to the 4.9 branch.
Fixes #44613.

Tests: Use `WP_HTTP_UnitTestCase::skipTestOnTimeout()` in more HTTP tests.

Adjust it to handle more types of timeouts, e.g. "Resolving timed out", "Connection timed out".

Merges [43511] to the 4.9 branch.
See #44613.

Privacy: When clicking a confirmation link for a privacy request, return a `WP_Error` object if the link has expired.

Returning a string caused a success message to be displayed instead of the correct error message.

Props desrosj.
Merges [43623] to the 4.9 branch.
Fixes #44685.

Help/About: Ensure the space after the period for the 4.9.8 changelog entry is preserved.

Props chetan200891, burhandodhy, swissspidy.
Fixes #44717.

Docs: Correct param documentation for `WP_Term_Query`.

The description of `$meta_type` introduced in [40053] was incorrect.

Props dlh.
Merges [43559] to the 4.9 branch.
Fixes #44608.

Taxonomy: Make sure `wp_list_categories()` correctly outputs term name of `0`.

Props joyously, SergeyBiryukov.
Merges [43605] to the 4.9 branch.
Fixes #44872.

Customize: Safeguard a check on the `customize_validate_{$setting_id}` filter value to ensure it is a `WP_Error`.

While the filter is documented to only support a `WP_Error`, it has been a common practice to return true in a validation function if no errors have occurred. This was already caught when the same filter was executed in `WP_Customize_Setting`, it was however missing in `WP_Customize_Manager::validate_setting_values()`.

Props flixos90.
Merges [43578] to the 4.9 branch.
Fixes #44809.

Script loader: remove (PHP based) compression from `load-styles.php` and `load-scripts.php`. WIth the amount of scripts and stylesheets grown a lot over the years, it has become pretty slow and consumes a lot of server resources. Also, most servers are set to compress PHP output anyway.

Props LucasRolff, azaozz.
Merges [43580] to the 4.9 branch.
Fixes #44815. See #43308.

Posts, Post Types: Introduce `edit_post_{$post->post_type}` hook.

The hook fires before the general `edit_post` hook and has the same parameters.

It also complements the `save_post_{$post->post_type}` hook added in [25050].

Props Mte90, garrett-eclipse.
Merges [43535] and [43616] to the 4.9 branch.
Fixes #34706.

Docs: Correct parameter type for `WP_Privacy_Policy_Content::notice()`.

Props burhandodhy.
Merges [43609] to the 4.9 branch.
Fixes #44877.

Privacy: Ensure the user request email is sent in the requested user's locale (or the site's default locale if they are not a registered user) when the administrator creating the request uses a different locale.

Props desrosj, Chouby, iandunn, lbenicio, birgire, earnjam, swissspidy, garrett-eclipse.
Merges [43568] to the 4.9 branch.
Fixes #43985.

Tests: Add case for `wp_privacy_delete_old_export_files()`.

Props allendav.
Merges [43292] to the 4.9 branch.
See #43546.

Tests: Add case for `wp_privacy_send_personal_data_export_email()`.

Props birgire.
Merges [43291] to the 4.9 branch.
See #43546.

Customize: Pass missing parameter to dynamic `option_{$option}` filter in `WP_Customize_Widgets::capture_filter_pre_get_option()`.

Props dlh.
Fixes #44770.

Docs: Convert `@see` reference in `wp_checkdate()` DocBlock to `@link`.

Props WiZZarD_.
Merges [43599] to the 4.9 branch.
Fixes #44866.

Twenty Sixteen: Add pre-connect resource hint for Google Fonts.

When using Google Fonts, pre-connect to https://fonts.gstatic.com to improve the performance downloading the webfont files.

Props westonruter.
Merges [43606] to the 4.9 branch.
Fixes #44668.

Media: Ensure the "Edit more details" link in the attachment details modal always points to the correct editing URL.

Fixes #44620

Merges [43601] to the 4.9 branch.

Embeds: Avoid a JS error in `wp.receiveEmbedMessage` if `data` parameter is not set.

Props dsifford, kadamwhite.
Merges [43593] and [43597] to the 4.9 branch.
Fixes #44832.