Formatting: Return early from `wp_kses_attr_check()` if the element is not in the list of allowed elements and attributes.

Props krynes, tristanleboss.
Fixes #48549.

Docs: Clarify descriptions for `get_gmt_from_date()` and `get_date_from_gmt()`.

Props johnbillion, Rarst.
Fixes #48650.

I18N: Replace file names in translatable strings on Permalink Settings screen with placeholders.

Props ramiy.
Fixes #48863.

Bundled Themes: Bump version number and update changelog in Twenty Twenty for WordPress 5.3.1.

This bumps the Twenty Twenty version number to `1.1` and update the `readme.txt` changelog.

Props audrasjb, sinatrateam, SergeyBiryukov
Fixes #48944.

Prevent stored XSS in the block editor.

Prevent escaped unicode characters become unescaped in unsafe HTML during JSON decoding.

Props: aduth, epiqueras,

Update `wp_kses_bad_protocol()` to recognize `:` on uri attributes,

`wp_kses_bad_protocol()` makes sure to validate that uri attributes don’t contain invalid/or not allowed protocols. While this works fine in most cases, there’s a risk that by using the colon html5 named entity, one is able to bypass this function.

Props: xknown, nickdaugherty, peterwilsoncc.

Prevent stored XSS through wp_targeted_link_rel().

Props: vortfu, whyisjake, peterwilsoncc, xknown,  SergeyBiryukov, flaviozavan.

Ensure that a user can publish_posts before making a post sticky.

Props: danielbachhuber, whyisjake, peterwilson, xknown.

Docs: Update description for `get_categories()` to avoid suggesting the deprecated `type` argument.

Follow-up to [13754].

Props dingo_d.
Fixes #48913.

Upgrade/Install: Improve the appearance of language selection on install:

* Remove a stray chevron.
* Improve focus and hover styles.

Props garrett-eclipse, audrasjb.
Fixes #48927.

Comments: Avoid a PHP notice in `comment_form()` if the `email` field is not set.

Follow-up to [46090].

Props mat-lipe.
Fixes #48943.

Fixes in `admin-bar.js`:

- Silence errors when a node doesn't exist similarly to jQuery.
- Add "feature testing" and fallbacks for old browsers as this may run on the front-end.
- Improve inline docs.

Props dinhtungdu, azaozz.
Fixes #47069.

Tests: Docs: Correct `@param` formatting in `SpeedTrapListener` after [35226] and [45607].

See #48303.

Tests: Correct the `slowThreshold` option name for `SpeedTrapListener`.

The previous change in [45607] appears to be accidental.

Props Rarst.
Fixes #48933.

Docs: Improve documentation for `wp_dashboard_browser_nag()` and `dashboard_browser_nag_class()`.

Props grapplerulrich.
Fixes #48932.

TinyMCE: remove CSS map reference from `/tinymce/skins/lightgray/skin.min.css`.

Props AlexHolsgrove.
Fixes #48577.

Comments: Optimize the query for pending comments count in `wp_notify_moderator()` for better performance on large tables.

Props sgoen.
Fixes #48514.

Coding Standards: Fix WPCS and JSHint issues in [46872].

See #47069.

Fix the admin toolbar js when jQuery is not present and replace the jQuery based hoverIntent.js with a native implementation. Introduces the "hoverintent" (no dependencies) package.

Props dinhtungdu, audrasjb, azaozz.
Fixes #47069.

Block Editor: Resolve `@wordpress/block-directory` to the expected version, 1.0.6.

Follow-up to [46860].

Props aduth, garrett-eclipse, audrasjb, azaozz.
Fixes #48884.

Menus: Avoid a PHP warning in `add_submenu_page()` when the same value is passed for both `$parent_slug` and `$menu_slug` parameters.

Props welcher, ispreview, ayeshrajans, NextScripts, adamsilverstein, garrett-eclipse, 123host.
Fixes #48599.

Administration: Standardize form control height and alignment across the admin.

This improves the appearance of various form controls in the admin and addresses some visual inconsistencies in WordPress 5.3.

Props afercia, audrasjb, jameskoster, GDragoN, azaozz, michaelarestad, murgroland, SamuelFernandez, chetan200891, veminom, dlh.
Fixes #48420.

Date/Time: XML-RPC: Сalculate the proper offset for GMT in `wp.newPost`, `wp.editComment`, `mw.newPost`, `mw.editPost` when `post_date` or `comment_date` is set.

Previously, `post_date` or `comment_date` was assumed to be GMT, which is only true if the timezone string for the site matches GMT.

Add unit tests.

Props Rarst, smerriman, justdaiv, wonderboymusic, noyle.
Fixes #30429.

Date/Time: When determining whether to decline the month name in `wp_maybe_decline_date()`, take word boundaries into account.

Add more unit tests.

Props Rarst, Clorith, timon33, Xendo, SergeyBiryukov.
Fixes #48606.

Block Editor: Bug fixes targeted for WordPress 5.3.1.

The list of included fixes:

- Edge scrolling issues https://github.com/WordPress/gutenberg/pull/17707
- Intermittent JavaScript issues https://github.com/WordPress/gutenberg/pull/18559
- Remove embed CollegeHumor https://github.com/WordPress/gutenberg/pull/18591 

Updated packages:

- @wordpress/[email protected]
- @wordpress/[email protected]
- @wordpress/[email protected]
- @wordpress/[email protected]
- @wordpress/[email protected]
- @wordpress/[email protected]
- @wordpress/[email protected]

Props youknowriad, ellatrix, epiqueras, audrasjb, gziolo, mcsf, kyliesabra.
Fixes #48884.

Upgrade/Install: Update sodium_compat to v1.12.1.

This includes a speedup for signature verification on most platforms and bugfixes for 32-bit platforms.

Props paragoninitiativeenterprises, lukaswaudentio.
Fixes #48371.

Media: Use consistent width for Scale and Crop inputs.

Follow-up to [46359].

Props sabernhardt, audrasjb.
Fixes #48907.

Twenty Twenty: Adjust the comment in [46851] per the documentation standards.

See #48876.

Help/About: Add a hover effect for links on About pages.

* Add a color that passes WCAG color contrast criteria to every link.
* Add an underline for links in credits list only on hover/focus.

Props audrasjb, ixkaito, mukesh27, melchoyce, SergeyBiryukov.
Fixes #48582.

Bundled Themes: Misaligned input placeholder text Twenty Twenty.

This fixes placeholder misalignment in Firefox when a `height` is added as an inline style to the input field.

Props aljullu, subratamal.
Fixes #48876.

Twenty Twenty: Remove redundant `echo` for `bloginfo()` call in `footer.php`.

Props acosmin.
Fixes #48918.

Administration: Correct checkbox width in list tables on smaller screens.

Previously, checkboxes for pending comments were partially hidden due to an added `4px` border.

Props audrasjb, jeremyfelt, talldanwp, melchoyce, marcelo2605, waleedt93.
Fixes #48815.

Bundled Themes: Make checkbox in comment form larger Twenty Twenty.

This makes the checkbox in the comment form larger and more consistent with other checkboxes.

Props kharisblank, audrasjb.
Fixes #48652.

Accessibility: Menus: Properly disable form controls on the Menus screen that cannot be used until at least one menu is created.

This ensures that the actual UI controls state matches the visually conveyed state.

Props afercia, audrasjb, dinhtungdu, sathyapulse, simonjanin, welcher, SergeyBiryukov.
Fixes #48409.

Twenty Twenty: Correct alignment for embedded Instagram posts.

Props SGr33n, audrasjb, nielslange, JarretC.
Fixes #48688.

Users: Introduce `admin_email_remind_interval` filter for dismissing the admin email confirmation screen.

Props desrosj, birgire.
Fixes #48334.

Docs: Correct DocBlock formatting for `admin_email_confirm` and `admin_email_confirm_form` hooks.

See #48303.

Tests: Change `group` annotation for `test_unique_filename_with_dimension_like_filename()` to `ticket.

See #42437.

Twenty Twenty: Pass `$post_meta` and `$location` values to `twentytwenty_start_of_post_meta_list` and `twentytwenty_end_of_post_meta_list` actions to provide better context.

Props msaari, SergeyBiryukov.
Fixes #48906.

Tests: Make sure network factory returns an integer ID for created objects, for consistency with other factories and the documented value.

See #48145.

Tests: Pad incrementors used in factories with leading zeros to make sure MySQL sorting works as expected.

Previously, tests could create sequential objects with names like `Term 99`, `Term 100`, which by default would be returned in reverse order when sorted by name alphabetically, causing seemingly random test failures that are extremely hard to debug.

See #48145.

Tests: Speed up comment submission unit tests by creating less fixtures and reusing them where possible.

See #30017, #48145.

Twenty Twenty: Use duplicate hook references for `page_css_class` and `page_menu_link_attributes` filters in `TwentyTwenty_Walker_Page`.

See #48303.

Bundled Themes: Correct `@since` tags to refer to the theme version instead of WordPress version.

This makes `@since` notations in Twenty Seventeen, Twenty Nineteen, and Twenty Twenty consistent with the previous bundled themes.

See #48303.

Docs: Further docblock corrections and improvements.

See #48303

Twenty Twenty: Replace Smooth Scroll JS implementation with `scroll-behavior` CSS property.

The JS implementation had multiple issues and did not work as expected.

This change includes an accessibility enhancement by using `prefers-reduced-motion: reduce` media query property for users that don't want motion effects. For further explanation on this media query, see MDN documentation: https://developer.mozilla.org/en-US/docs/Web/CSS/scroll-behavior#Accessibility_concerns

Props audrasjb, melchoyce, joostdevalk, Anlino, mauteri, sergiomdgomes, littlebigthing, williampatton, netweb, andraganescu, joyously, acosmin, mukesh27, hareesh-pillai.
Fixes #48763, #48551, #48866.

Docs: Increase the specificity of various docblock parameter types and return types.

See #48303

Upload: fix `wp_unique_filename()` to prevent name collisions with existing or future image sub-size file names, and add unit tests.

Props Viper007Bond, pbiron, azaozz.
Fixes #42437.

Docs: Correct various docblocks documentation.

See #48303

Text Changes: Rename Comment Blacklist option to be more inclusive

This doesn't change the underlying option name as that would be a backcompat break, but it makes the UI a bit more inclusive.

Props dartiss, jeremyfelt, aaronjorbin.
Fixes #48900.

Tests: Remove duplicate `test_get_page_by_path_priority()` test.

The test was moved into its own file in [37478], but never removed from its previous location.

See #36711.

Accessibility: Administration: Correct active button color for the alternative color schemes.

Follow-up to [46815].

Props melchoyce, ryelle, larrach, audrasjb, studiotwee, afercia, azaozz.
Fixes #48598.

Accessibility: Administration: Apply a unified design to all secondary buttons across all color schemes.

This ensures that secondary buttons have an appropriate color contrast in the alternative color schemes.

Props melchoyce, ryelle, audrasjb, ate-up-with-motor, afercia, sabernhardt.
Fixes #48585.

XML-RPC: Unify some "could not be created/updated/deleted" error messages for consistency.

Props ramiy, SergeyBiryukov.
Fixes #48883.

Bundled Themes: Adds Customizer option to show or hide author bio Twenty Twenty.

This adds an option to the Customizer that allows you to turn the author bio on or off, sitewide.

Props williampatton, nielslange acosmin, dlh.
Fixes #48550.

I18N: Change context for the "Add New" string on Themes screen for consistency with other similar strings.

Props ramiy.
Fixes #48875.

Docs: Move the canonical DocBlock for `handle_bulk_actions-{$screen}` action to `wp-admin/edit.php`.

* Document accepted values for the `$items` parameter.
* Use interpolated syntax for the filter name.

Props dilipbheda, johnbillion, SergeyBiryukov.
Fixes #48857.

Taxonomy: Remove redundant caching from `get_all_category_ids()`, deprecated in favor of `get_terms()` in [28679].

The `all_category_ids` cache key it relied on was removed in [5555] and never repopulated, causing invalid or unexpected results when using a persistent object cache.

Props itowhid06, johnjamesjacoby.
Fixes #48176.

Upload: Exclude PNG images from scaling after uploading. Fixes a case where resizing a very large PNG may create a scaled image that has smaller dimensions but larger file size than the original.

Fixes #48736.

Widgets: Remove `WP_Widget_Factory::$hashed_class_counts` property, unused since [46220].

The `spl_object_hash()` function was introduced in PHP 5.2.0. As of PHP 5.3, the PHP SPL extension can no longer be disabled, so the `WP_Widget_Factory::hash_object()` workaround was removed in [46220].

See #48074.

Administration: Correct font size for comment count in "At a Glance" dashboard widget on mobile.

Props donmhico, jeremyfelt.
Fixes #48799.

Tests: Merge [24251] from `_wp_filter_build_unique_id()` to `_test_filter_build_unique_id()`, for consistency.

See #47407.

Plugins: In `_wp_filter_build_unique_id()`, remove `$wp_filter` global and `$filter_id_count` static variable, unused since [46220].

See #47407, #48074.

REST API: Use strict `in_array()` checks for the list of usernames blacklisted via `illegal_user_logins` filter.

See #48839.

REST API: Use a strict `in_array()` check in `WP_REST_Request::get_parameter_order()`.

See #48839.

REST API: Use a strict `in_array()` check in `WP_REST_Meta_Fields::get_registered_fields()`.

Props dkarfa.
Fixes #48839.

Docs: Correct `@param` type for the function parameter in `tests_add_filter()` and `_test_filter_build_unique_id()`.

Synchronize documentation for `add_filter()`, `tests_add_filter()`, `_wp_filter_build_unique_id()`, `_test_filter_build_unique_id()`.

Add a note that `$tag` and `$priority` are no longer used in `_wp_filter_build_unique_id()` since [46220], and the function always returns a string now.

Props donmhico, remcotolsma, SergeyBiryukov.
Fixes #47407. See #48303.

Docs: Replace `@returns` tags in JS docs with `@return`.

Per the documentation standards, `@returns` is an unsupported synonym, `@return` should be used instead:
https://make.wordpress.org/core/handbook/best-practices/inline-documentation-standards/javascript/

See #48303.

Docs: Add missing full stops to `@returns` tags in JS docs, per the documentation standards.

Props shital-patel, kalpshit.
Fixes #48305.

Site Health: Add a test for PHP default timezone.

The test reports a failure if the default timezone was changed with `date_default_timezone_set()` to anything other than `UTC`.

WordPress historically uses `UTC` as the default timezone for calculating date and time offsets, overriding it is not recommended and can cause widespread and obscure issues.

Props Rarst, Clorith, TimothyBlynJacobs.
Fixes #48692.

Date/Time: Make `get_permalink()` more resilient against PHP timezone changes.

Overriding default PHP timezone with `date_default_timezone_set()`, while not recommended, should not inadvertently result in changing existing permalinks.

Add a unit test.

Props Rarst, steevithak, archon810, maciejmackowiak, Ov3rfly, Cybr, hometowntrailers, scvleon, miette49.
Fixes #48623.

KSES: Add support for gradient backgrounds.

Props jorgefilipecosta.
Fixes #48376.

Plugins: Correct default value of `$replacement` parameter in `do_action_deprecated()` and `apply_filters_deprecated()`.

This addresses an inconsistency with `_deprecated_hook()`, which uses `is_null()` to check if `$replacement` was provided, however the previous default value was `false`.

Props shaampk1, felipeelia.
Fixes #48817.

Menus: Improve the wording of instructions for dragging the items into the preferred order.

Props amolv, equin0x80, dlh.
Fixes #48184.

Administration: Properly wrap long titles in list tables on smaller screens.

Props mukesh27, iihglobal, wpamitkumar.
Fixes #48805.

Users: Display admin email verification screen in user's locale instead of site locale.

Props sathyapulse, TimothyBlynJacobs.
Fixes #48313.

Bundled Themes: Fixes JS TypeError in Twenty Twenty.

On mobile devices using a webkit browser, the menu and search modals could not be opened due to a `TypeError: document.body is null`. This commit fixes that issue by adding a `touch-enabled` class to the body for browsers that do not support media queries.

Props quicoto, poena, Boga86, acosmin, macmanx.
Fixes #48601.

Tests: Add `feed` group for `get_feed_build_date()` test added in [46756].

See #48675.

Upgrade/Install: Provide a default label for "Continue" button in language selection form.

Prevents an empty continue button if a translation isn't yet available.

Props sathyapulse.
Fixes #48776.

Users: Use correct variable when displaying the Additional Capabilities list in user profile.

Addresses a regression in [45926].

Props wpgurudev, aravindajith, anantajitjg, davidbaumwald.
Fixes #48725.

Options, Meta APIs: Update `@since` version for the `$force_cache` parameter added for `wp_load_alloptions()` in [46753] to 5.3.1.

See #31245.

Media: Avoid a PHP notice in `image_downsize()` when trying to replace a non-image URL with a rendered image from its meta.

Props Mte90, jrf, hareesh-pillai.
Fixes #48324.

Accessibility: Administration: Underline links on Dashboard that are located within a line of text and thus need to be underlined:

* "change your theme completely"
* Active theme in the "At a Glance" box
* "View all drafts" in the Quick Draft box

Split "Manage widgets or menus" into separate items for consistency with other links.

For better accessibility, links that are a part of other text should be underlined and not rely on color alone to be distinguished.

Per accessibility coding standards:
> When links can be identified as such by the context, for example because they’re part of a menu, or a set of links clearly identified as user interface controls, they don’t necessarily need to be underlined. In all the other cases, especially for links surrounded by other text (in a line or block of text), links need to be always underlined.
https://make.wordpress.org/core/handbook/best-practices/coding-standards/accessibility-coding-standards/#links-underline-or-no-underline
https://make.wordpress.org/accessibility/handbook/design/use-of-color/#not-by-color-alone

Props afercia, audrasjb, karmatosed.
Fixes #48406.

Twenty Twenty: Remove duplicate array key/value in `TwentyTwenty_Non_Latin_Languages::get_non_latin_css()`.

Props manikmist09.
Fixes #48624.

Coding Standards: Fix WPCS issue in [46763].

See #48777.

Docs: Add missing `@since` tags for functions in `wp-admin/includes/update.php`.

Props sathyapulse, zodiac1978.
Fixes #48777.

Twenty Twenty: Correctly align the author bio and bottom post meta on single posts on mobile.

Props nielslange, Anlino.
Fixes #48619.

Embeds: Remove CollegeHumor oEmbed provider, as the service does not exist anymore.

Props audrasjb, youknowriad.
Fixes #48696.

Docs: Adjust `wp_is_json_request()` and `wp_is_xml_request()` return value descriptions for consistency.

See #48771, #48303.

Docs: Correct spelling and capitalization in `wp-includes/load.php`:

* Fix typo in `is_blog_admin()` description.
* Capitalize PHP correctly in `enable_wp_debug_mode_checks` filter description.
* Capitalize XML correctly in `wp_is_xml_request()` return value description.

Props stevegrunwell.
Fixes #48771.

Editor: Improve the appearance of tag cloud in Tags meta box in classic editor.

Props sathyapulse, Spaceshipone, tmatsuur, audrasjb, afercia.
Fixes #48592.

Date/Time: Correct the time format in `get_feed_build_date()` to use 24-hour format.

Follow-up to [46756].

See #48675.

Date/Time: Remove `mysql2date()` usage in `get_feed_build_date()` to ensure the output includes correct timezone offset.

With the changes in [45908], `mysql2date()` works correctly for all local time inputs, but should not be used for UTC time inputs.

Add a unit test.

Props Rarst, lisota.
Fixes #48675.

I18N: Correct translator comment for `By %s` string in Plugins list table.

Follow-up to [44541].

See #45898.

Customize: If the return URL for Close button is a page added to the Appearance menu by a deactivated theme, fall back to the Themes screen.

Props JarretC, Jean-David, SergeyBiryukov.
Fixes #46686.

Options, Meta APIs: Avoid a race condition causing the first of two subsequent requests updating different options at the same time to lose changes.

Every time an autoloaded option is updated or deleted, the `alloptions` cache is similarly updated. Due to the race condition, on any autoloaded option being updated, every other autoloaded option had its value set to the value at load time, causing a mismatch between the data in the persistent cache and the database.

This change introduces a `$force_cache` parameter for `wp_load_alloptions()` to force an update of the local `alloptions` cache from the persistent cache when an option is added, updated, or deleted, to minimize the chance of affecting other options.

Props fabifott, rmccue, tollmanz, johnjamesjacoby, spacedmonkey, dd32, jipmoors, tellyworth, jeremyclarke, joehoyle, boonebgorges, danielbachhuber, flixos90, jeichorn, mihdan, Grzegorz.Janoszka, SergeyBiryukov.
See #31245.

Docs: Fix typo in `README.md`.

Props dkarfa.
Fixes #48737.

Docs: Clarify that `WP_Theme::get()`, `::display()`, and several related methods treat the `Tags` theme header as an array.

Props david.binda.
Fixes #48005.

XML-RPC: Pass correct variable as the URL parameter to `http_headers_useragent` filter in `wp_xmlrpc_server::pingback_ping()`.

Props wpgurudev, andreaitm.
Fixes #48721. See #42186.

Login and Registration: Pass `$user_data` parameter to the `lostpassword_post` action in `retrieve_password()`.

Props wpgurudev, pagewidth, lukecavanagh, johnbillion, kkarpieszuk.
Fixes #38334.

Accessibility: Media: Add an `aria-pressed` attribute to active button within a button group.

The `aria-pressed` attribute communicates semantically the "active" state of buttons that otherwise only look "active".

Fixes #48355.

Twenty Twenty: Fix typos in a variable name and inline comment in `assets/js/color-calculations.js`.

Props tanvirul.
Fixes #48704.

Accessibility: Add an `aria-current` attribute to the Media Library switch links.

The `aria-current` attribute is a simple, effective, way to help assistive technology users orientate themselves within a set of items.

Props mayanksonawat, afercia.
Fixes #48271.

Widgets: Avoid to move focus to the Image Widget "Insert from URL" field.

Fixes a bug after [45499], where the backbone view element isn't the input field any longer. Also, managing focus programmatically is often an assumption on a specific user flow and should generally be avoided, see #43169.

Props dufresnesteven.
See #43169.
Fixes #48588.

Administration: Switch `rgb()` CSS property for paused plugin error message in Plugins list table to `rgba()`.

While technically correct as is, the latter is more consistent with other admin styles and causes less confusion.

Props manikmist09.
Fixes #48629.

Taxonomy: Correct the initial value for `WP_Taxonomy::$labels` to match `get_taxonomy_labels()` return type.

Improve documentation for consistency with `WP_Post_Type::$labels`.

Props alpipego.
Fixes #48681.

Docs: Update broken source code link in `WP_Filesystem_SSH2` class.

Props mryoga, finchps.
Fixes #48467.

Docs: Update broken source code link in `imgAreaSelect` jQuery plugin.

Props mryoga, finchps.
See #48467.

Docs: Replace Codex URLs with corresponding HelpHub articles in `wp-config-sample.php`.

Props sebastienserre.
Fixes #48680.

Docs: Correct spelling of "subclass" and "overridden" in various docblocks and error messages.

Props garrett-eclipse.
Fixes #48676.

Docs: Fix typo in `wp_credits_section_title()` description.

Switch descriptions for `wp_credits_section_title()` and `wp_credits_section_list()` to third-person singular verbs, per the documentation standards.

Props hareesh-pillai.
Fixes #48674.

Editor: Pass `$editor_id` parameter to `tiny_mce_plugins`, `mce_external_plugins`, and `mce_external_languages` filters, for consistency with `teeny_mce_plugins`.

Document the `classic-block` value passed to various editor filters in `wp_tinymce_inline_scripts()`.

Add missing `@since` entries for the existing `$editor_id` parameter in various filters.

Props djp424, johnbillion, SergeyBiryukov.
Fixes #48441.

Security: Add WordPress 5.3.x to the "Supported Versions" section of GitHub Security Policy.

Props imath.
Fixes #48667. See #48521.

Security: Add a GitHub Security Policy.

As part of more responsible security disclosure, we are adding a security policy to GitHub.

Fixes #48521.
Props whyisjake, ayeshrajans.

Toolbar: Properly escape the onclick attribute.

The onclick attribute was being escaped twice, once with `esc_js` and again with `esc_attr`.

Fixes #48117.
Props tmatsuur, dinhtungdu.

Docs: Improve a comment about `$doing_wp_cron` global in `wp-cron.php`.

Props chinteshprajapati, subrataemfluence, nielslange.
Fixes #46104.

Docs: Remove incorrect `@return` tags.

Props diddledan.
Fixes #48613, #48614.

Docs: Correct parameter type for `$item` in `WP_REST_Terms_Controller::prepare_item_for_response()`.

Props diddledan, TimothyBlynJacobs.
Fixes #48616.

Docs: Fix typo in `@return` value for `PO::trim_quotes()`.

Props diddledan.
Fixes #48572.

Docs: Correct some invalid hook docblocks.

See #48303

Help/About: Move images to the CDN.

Props ryelle.
Fixes #47708.

Bundled Themes: Update Twenty Twenty.

This brings Twenty Twenty in sync with GitHub. For a full list of changes since [46715], see https://github.com/WordPress/twentytwenty/compare/fa8c3fc...a9e73ab.

Props Anlino, karmatosed, williampatton, poena, joyously, ianbelanger, chetan200891.
See #48110, #48386, #48450, #48505, #48557.
Fixes #48571.

Bundled Themes: Update copyright year in `readme.txt` for Twenty Twelve and Twenty Twenty.

Follow-up to [46719].

See #48566.

Bundled Themes: Update copyright year in `readme.txt`.

Add a unit test to ensure the year stays up to date.

Props dkarfa, SergeyBiryukov.
Fixes #48566.

Bundled Themes: Update Twenty Twenty.

* Add `.has-background` excluding condition to wide and full group-blocks.

This brings Twenty Twenty in sync with GitHub. For a full list of changes since [46714], see https://github.com/WordPress/twentytwenty/compare/162edc0...fa8c3fc.

Props allancole, karmatosed.
See #48110, #48386, #48450, #48505.
Fixes #48557.

Bundled Themes: Update Twenty Twenty.

* Add a11y-friendly default text-colors when selecting a background-color.
* Remove margins for the group block when a background-color is set.
* Excluding pullquote block from width resize rules.

This brings Twenty Twenty in sync with GitHub. For a full list of changes since [46711], see https://github.com/WordPress/twentytwenty/compare/ab5fa23...162edc0.

Props allancole, karmatosed.
See #48110, #48386, #48450, #48505.
Fixes #48557.

Twenty Twenty: Make CSS adjustments to account for the latest editor changes and ensure that group blocks work in expected ways.

Props williampatton, allancole, karmatosed, pierlo, joen, ianbelanger.
Fixes #48557.

Help/About: Update the 5.3 About page.

* Remove extra padding on the Credits tab.

Previously [46556], [46572], [46616], [46705].
Props ryelle.
See #47708.

Tests: Fix a typo in an inline comment.

Fix a regression from [46568].

Props david.binda.
See #48312.

Help/About: Update the 5.3 About page.

* Remove the SVG from the upper right corner.
* Make sure admin notices that should be hidden stay hidden.
* Address a11y issues with contrast.
* Fix an issue with the active nav tab hover.
* Prevent names on the credits from breaking out of the box.
* Update two strings with a more accurate information.

Previously [46556], [46572], [46616].

Props ryelle, afercia, audrasjb, francina, mapk, desrosj, YordanSoares, melchoyce, azaozz, johnbillion, davidbaumwald, luminuu, bwmarkle, la-geek, SergeyBiryukov.
See #47708.

Script Loader: In `wp_default_packages_inline_scripts()`, make sure the root URL middleware is registered before using the media middleware.

This allows for requests to retry post-processing large images using the `post-process` REST API endpoint to work as expected.

Props azaozz, mikeschroder, TimothyBlynJacobs, epiqueras, johnbillion, youknowriad.
Fixes #48542.

Twenty Twenty: Fix WPCS issue in [46701].

See #48557.

Bundled Themes: Update Twenty Twenty.

This brings Twenty Twenty in sync with GitHub. For a full list of changes since 5.3 RC4, see https://github.com/WordPress/twentytwenty/compare/c267289...898792b.

Props williampatton, poena, andersnoren, desrosj, schlessera, leprincenoir, alextran, aristath, b-07.
See #48110, #48386, #48450, #48505.
Fixes #48557.

Comments: Check if comment form element exists before adding a key handler to detect the cmd/ctrl-enter key press.

Follow-up to [45790].

Props raamdev.
Fixes #48543. See #41545.

Customize: Remove the deprecated `-precomposed` suffix from `apple-touch-icon` link in `wp_site_icon()`.

Props mukto90, khag7.
Fixes #48555.

Networks and Sites: Pass the `$blog_id` parameter to the `newblog_notify_siteadmin` filter.

Props mukto90, virgodesign.
Fixes #48554.

Docs: In various `@return` tags, list the expected type first, instead of `WP_Error`.

See #48303.

Docs: Miscellaneous docblock corrections in `wp-admin/includes/plugin.php`.

See #48303.

Docs: Improve documentation for `deactivate_plugins()` and `activate_plugins()`.

Props marekdedic, spenserhale, SergeyBiryukov.
Fixes #48352.

Tests: Don't skip the tests intended for Multisite when running on single site, add them to the `ms-required` group instead.

See #43438.

Coding Standards: Fix WPCS issue in [46690].

See #41880.

Docs: Move the `@link` tag for Customize API in `WP_Customize_Manager::add_setting()` and `WP_Customize_Setting` to a more appropriate place.

See #48303.

Docs: Improve documentation for `WP_Http` per the documentation standards.

Props hareesh-pillai, adnan.limdi, isabel_brison.
Fixes #41880.

Docs: Use 3-digit, x.x.x style semantic versioning for `$version` argument in `do_action_deprecated()` and `apply_filters_deprecated()` calls.

Props jrf.
Fixes #48255.

Docs: Correct the documentation placement for `wp_print_styles` and `shortcode_atts_{$shortcode}` hooks.

Props jrf.
See #48255.

Coding Standards: Fix WPCS issue in [46684].

See #48255.

Coding Standards: Revert the change to `wp-includes/class-wp-xmlrpc-server.php` in [46684] to investigate unit test failures.

See #48255.

Docs: Use the `{@see ...}` tag for the replacement in `@deprecated` tags, so that Developer Reference could automatically link to the replacement.

Props jrf.
See #48255.

Coding Standards: Consistently use `do_action_deprecated()` and `apply_filters_deprecated()` for deprecated hooks.

Props jrf.
See #48255.

Test: Don't skip the tests intended for single site when running on Multisite, add them to the `ms-excluded` group instead.

See #39776, #45747.

Tests: Skip `test_readme()` if the HTTP request to `secure.php.net` or `dev.mysql.com` failed on timeout.

Move `skipTestOnTimeout()` to `WP_UnitTestCase_Base` to avoid duplication.

See #44613.

Docs: Correct some inconsistencies in comments with Dashicon class references in `wp-admin/css/customize-widgets.css`.

Prepend all class name references with `dashicons-` for clarity.

Props 1naveengiri, marcio-zebedeu, hareesh-pillai, SergeyBiryukov.
Fixes #48417.

Docs: Correct description for `$recursive` parameter of `::chmod()` and `::delete()` methods in `WP_Filesystem` implementations.

Props skithund.
Fixes #48422.

Toolbar: Un-deprecate the `WP_Admin_Bar::add_menu()` method.

This is only a wrapper for the `add_node()` method, but it's in widespread use both in core until [46642] and in thousands of plugins and themes. Deprecating it would have made sense when #19647 was originally opened but that's no longer the case.

Props whyisjake

Fixes #19647

Upload: When an image was scaled because it is larger than the big image threshold, use the originally uploaded image's dimensions in `wp_get_missing_image_subsizes()`. Fixes an edge case/inconsistent behaviour when a registered image sub-size is also larger than the big image threshold.

Props desrosj, azaozz.
Fixes #48518 for trunk.

Bundled Themes: Standardize the Required PHP and Tested Up To headers.

This change makes several changes to ensure consistency and accuracy for default theme headers:

- Removes `WordPress` from `Requires at least` headers.
- Ensures the `Requires at least` and `Requires PHP` headers are present in every default theme’s `style.css` file.
- Ensures `Tested up to` is present in every `readme.txt` file.
- Removes any headers not processed in both the `style.css` and `readme.txt` files for each theme.

Props Otto42, afragen.
Fixes #48517.

Docs: Make `@param` tags in `mce_buttons` and related filters consistent with the variable names.

Props upadalavipul, isabel_brison.
Fixes #41456.

Tests: Properly mark `test_submenu_helpers_priority()` as skipped for multisite, so it's not categorized as "risky".

See #39776.

Coding Standards: Fix WPCS issues in [46670].

See #48145.

REST API: Use explicit dates in a post ordering test to avoid indeterminate ordering.

See #48145

Bundled Themes: Update Twenty Twenty.

This brings Twenty Twenty in sync with GitHub. For a full list of changes since 5.3 RC3, see https://github.com/WordPress/twentytwenty/compare/dea9290...c267289.

Props williampatton, poena, andersnoren.
See #48110, #48386, #48450, #48293.
Fixes #48505.

Emoji: Upgrade Twemoji to 12.1.3.

This point release does not add any images and only slightly modifies a few images without changing their meanings. Because of this, the same CDN location can be used and has been updated.

Props matstars, desrosj, Otto42, pento.
Fixes #48293.

Block Editor: Revert [46663] which was itself an erroneous revert.

See #48502

Block Editor: Bug fixes targeted for WordPress 5.3 RC4.

Merges [46656] to the 5.3 branch.
Fixes #48502

Docs: Docs on docs. Further improve documentation of known return types, plus other docs fixes.

See #48303

Docs: Further improve documentation of known return types, plus other docs fixes.

See #48303

Docs: Improve documentation of known return types, plus other docs fixes.

See #48303

Media: Remove the variable number (from the big image threshold value) when generating file names for scaled images. This makes it easier to "calculate" the full size file name from the name of an intermediate size image.

Props ianmjones, azaozz.
Fixes #48453 for trunk.

REST API: Speed up pagination unit tests by creating less fixtures and reusing them where possible.

Includes minor documentation and code layout fixes for better readability.

See #30017, #48145.

Block Editor: Bug fixes targeted for WordPress 5.3 RC4.

The list of included fixes is:

https://github.com/WordPress/gutenberg/pull/18183
https://github.com/WordPress/gutenberg/pull/18194
https://github.com/WordPress/gutenberg/pull/18230
https://github.com/WordPress/gutenberg/pull/18275
https://github.com/WordPress/gutenberg/pull/18287

Updated packages:
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]

Props @aduth, @mcsf, @youknowriad, @johnbillion.
Fixes #48502.

REST API: Fix for Yoda condition.

Little coding standards fix for the REST API.

Props mukesh27, spenserhale.

Fixes #48337.

Docs: Correct and improve the readability of some parameters of `WP_Term_Query`.

See #48303

Upload: Ensure the new image meta is always saved before starting post-processing of an uploaded image, even if there was an error while scaling or rotating it.

See #48472.

Login and Registration: Simplify the test for `wp_signon()` added in [46640].

Make sure it actually tests the change in behavior, previously it passed both before and after the patch.

Add `wp_unslash()` to the last remaining instance of `$_POST['user_login']` that didn't have it.

See #38744.

Build/Test Tools: Adjust the test for `wp_redirect()` status codes added in [46641] per the documentation and coding standards.

Move the test to a more appropriate place for consistency with `wp_sanitize_redirect()` and `wp_validate_redirect()` tests.

See #44317.

REST API: Set `orderby` parameter in tax relation unit tests added in [46646].

The default value of `date` caused a race condition resulting in random test failures.

See #44326.

Docs: Correct some array hash notations added in [46644].

See #48303.

REST API: Add tax relation parameter to posts collection.

The REST API supports filtering by terms across multiple taxonomies using an AND relation. This adds support for an OR relation by adding "tax_relation=OR" as a query parameter.

Props earnjam.
Fixes #44326.

Remove Failing Tests added in r46641

The tests for good redirects send headers that we can't handle in the test suite, so let's just remove them.

Unprops Jorbin.
Fixes #44317.

Docs: Fix some incorrect return tags in docblocks.

See #48303

Coding Standards: Clean up the tests around `test_that_you_can_login_with_an_email_that_has_apostrophe`.

Let's use the proper coding standards for the comments.

Fixes #38744.
Props cafenoirdesign.

Toolbar: Use `add_node()` instead of `add_menu()` in core.

This patch replaces all references to the add_menu() method with the add_node() one. (Also some code structure modifications for wp_admin_bar_appearance_menu().)

Fixes: #19647
Props: linuxologos, paulschreiber, morganestes, akibjorklund, nacin, whyisjake.

General: wp_safe_redirect() and wp_redirect() shouldn't allow non-3xx status codes

Redirects should use redirect status codes and if you attempt to call wp_safe_redirect or wp_redirect with a non redirect status it can lead to undesired behavior and head scratching.

Fixes #44317.
Props spenserhale, johnbillion, mjnewman for initial patch.

Login and Registration: Allow email logins to be more flexible.

Allows a login to have an apostorphe. Which would normally be created as a mistake, but this allows the login to happen.

Fixes #38744
Props wpkuf, desrosj, socalchristina, bibliofille, santilinwp, nsubugak, sncoker, cafenoirdesign, whyisjake.

External Libraries: Revert [46634-46635].

On further investigation, Plupload changed it’s license to a non-GPL compatible license. The newest, GPL compatible version is being used already in Core.

Unprops desrosj.
See #48277.

Customize: Formally deprecate unused Customizer classes.

The `WP_Customize_New_Menu_Control` and `WP_Customize_New_Menu_Section` PHP classes and `wp.customize.Menus.NewMenuControl` JS class were deprecated in 4.9 through [42034] with the intention of removing them in 5.0. Since more time has passed than originally intended, this change leaves `WP_Customize_New_Menu_Control` and `WP_Customize_New_Menu_Section` to prevent any potential backwards compatibility issues, and formally deprecates them. The `wp.customize.Menus.NewMenuControl` JS class is removed.

Props weston.ruter, matthias-reuter, jrf.
Fixes #42364.

Add `svn:auto-props` for `eol-style` and `mime-type` to `trunk`.

`svn:eol-style` and `svn:mime-type` property default values are now provided for all file types currently in `trunk`.

This also reverts the `eol-style` change to `wp-config-sample.php` made in [46586].

Fixes #42594.

Remove unintended change to `svn:ignore` in [46634].

External Libraries: Update Plupload from 2.1.9 to 2.3.6.

This change also updates the MoxieJS dependency from 1.3.5 to 1.5.7, converts Plupload to a dependency in NPM, and integrates all relevant parts into the build process.

For a full list of upstream changes, see https://github.com/moxiecode/plupload/compare/v2.1.9...v2.3.6.

Props desrosj, hareesh-pillai.
Fixes #48277.

General: Wrap the error message in `_deprecated_constructor()` in `<code>` tags instead of `<pre>`.

Props aftabmuni.
Fixes #48483.

Code Modernization: Call PHP 5 constructors in methods extending `POMO_Reader`.

Follow-up to [46629].

See #48252.

Docs: Correct version number in `@deprecated` tags for PHP 4 constructors in `pomo/entry.php` and `pomo/streams.php`.

Follow-up to [46629].

Props jrf.
See #48252.

Docs: Correct `@see` references for PHP 4 constructors in `wp-includes/class-json.php`.

See #48252, #48303.

Docs: Add missing `@deprecated` tags to PHP 4 constructors in `pomo/entry.php` and `pomo/streams.php`.

Props jrf.
Fixes #48252.

Twenty Eleven: Add missing `@deprecated` tag to PHP 4 constructor in `Twenty_Eleven_Ephemera_Widget`.

Props jrf.
See #48252.

Docs: Add missing `@deprecated` tags to PHP 4 constructors in `WP_Widget` and `WP_Widget_Factory()`.

Correct version number in `_deprecated_constructor()` call in `WP_Widget_Factory()`, see [32990].

Props jrf.
See #48252.

Docs: Update URLs in some `@link` tags and switch them to HTTPS.

Props tsuyoring.
Fixes #48479.

Code Modernization: Pass an appropriate error level to `trigger_error()` in `_doing_it_wrong()` and related functions:

* `_deprecated_function()`
* `_deprecated_argument()`
* `_deprecated_constructor()`
* `_deprecated_file()`

The error level passed is `E_USER_DEPRECATED` for the deprecated function group and `E_USER_NOTICE` for `_doing_it_wrong()`.

Props jrf.
Fixes #36561.

Docs: Correct some more invalid inline docs.

See https://make.wordpress.org/core/handbook/best-practices/inline-documentation-standards/php/#summary-formerly-short-description

See #48303

Docs: Correct some incorrect docblock tags.

See #48303

Docs: Add `@since` tag for the `$context` parameter added to `wp_generate_attachment_metadata` filter in [46621].

See #48472.

Upload:

- Run the `wp_generate_attachment_metadata` filter at the end in `wp_update_image_subsizes()` when new metadata was generated and additional image sub-sizes were created.
- Add another arg in the `wp_generate_attachment_metadata` filter for additional context.
- Fix inline docs and ensure the new image meta is always saved before starting post-processing.

Fixes #48472 for trunk.

Docs: Document `$error`, `$interim_login`, and `$action` globals in `login_header()` and `login_footer()`.

Props priyankabehera155, faisal03, mukesh27, SergeyBiryukov.
Fixes #45777.

Help/About: Update the 5.3 About page for RC3.

Previously [46556], [46572].
Props ryelle, SergeyBiryukov, afercia, desrosj, davidbaumwald, azaozz.
See #47708.

Bundled Themes: Update Twenty Twenty.

This brings trunk’s version of Twenty Twenty in-sync with GitHub.

For a complete list of changes since [46571], see https://github.com/WordPress/twentytwenty/compare/4549fd9...dea9290.

Props anlino, ianbelanger, poena, williampatton, collet, erikkroes, torres126, intimez, byalextran, mehidi258, swapnild, nielslange.
Fixes #48450.

Build/Test Tools: Ignore EOL differences in tests using multiline string assertions.

Unix vs. Windows EOL style mismatches can cause misleading failures in tests using the heredoc syntax (`<<<`) or multiline strings as the expected result.

Fixes #31432. See #42594, #47411.

Docs: Miscellaneous docblock corrections.

See #48303

Docs: Coding standards fix after [46608].

See #48303

Docs: Remove some funky nested filters.

See #48303

Docs: Restore correct placement for duplicate hook reference in `render_block_core_latest_comments()`.

Previously fixed in [46604], accidentally reverted in [46606].

See #48447, #48303.

Block Editor: Bug fixes targetted for WordPress 5.3 RC3.

The list of included fixes is:

- https://github.com/WordPress/gutenberg/pull/18108
- https://github.com/WordPress/gutenberg/pull/18051
- https://github.com/WordPress/gutenberg/pull/18106
- https://github.com/WordPress/gutenberg/pull/18102

Updated packages:
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]

Props desrosj.
See #48447.

Build/Test Tools: Don't hardcode the directory name of the repo

When Travis builds the directory, it was looking for a hardcoded `wordpress-develop` directory. If the repo is sitting in another directory, the memcache install will fail. This allows a dynamic path for the directory.

Fixes #48444.
Props pento, whyisjake.

Docs: Correct invalid hook docblock placement.

See #48303

Docs: Correct invalid hook docblocks.

See #48303

Docs: Remove "private" designation from `_doing_it_wrong()` and related functions:

* `_deprecated_function()`
* `_deprecated_argument()`
* `_deprecated_constructor()`
* `_deprecated_file()`

Plugins and themes should be allowed to use these functions to throw appropriate error notices.

This brings them in line with newer `do_action_deprecated()` and `apply_filters_deprecated()` functions, which are not marked as private.

Props jrf.
Fixes #48251.

Editor: Fix typo in an error message in `WP_Block_Styles_Registry::register()`.

Props man4toman, alishankhan, shaampk1.
Fixes #48437.

Docs: Improve DocBlock formatting in `WP_Block_Styles_Registry` per the documentation standards.

See #48303.

Docs: Correct and improve inline docs for the file type functions.

See #48303

Docs: Add missing docs for the `auth_cookie_bad_session_token` action.

See #48303

Docs: Update the docs for the error parameter that gets passed around during filesystem credential collection.

See #48303

Docs: Switch more docs over to typed array notation, plus some fixes.

See #48303, #41756

Docs: Switch to typed array notation for the docs for asset dependency functions.

Props marekdedic

See #48303

Docs: Miscellaneous docblock fixes and improvements.

See #48303

Docs: Improve documentation for `esc_attr_e()`, `esc_html_e()`, `esc_attr_x()`, `esc_html_x()`.

Props atachibana.
Fixes #48383.

Docs: Improve documentation for `wptexturize()`.

Props atachibana.
Fixes #48397.

Docs: Improve formatting of various `WP_Screen` DocBlocks.

See #48303.

Docs: Improve documentation for `WP_Screen::add_help_tab()`.

Props atachibana.
Fixes #48395.

Build/Test Tools: Add banner to RTL CSS and minified JS files.

Patches occasionally come in on generated files. We should be kind to new contributors and give them a hint that these files are auto-generated.

This is a follow-up to [41271], which added the banner to minified CSS files.

Fixes #48424. See #30666.

Ensure `svn:mime-type` is consistently set for appropriate files.

Continuation of [46586], [46587]

See #42594.

Ensure `svn:eol-style` is consistently set for all files (part 2).

Continuation of [46586]

See #42594.

Ensure `svn:eol-style` is consistently set for all files.

See #42594.

Remove the `svn:executable` property from files that don't need it.

See #42594.

Date/Time: Remove incomplete and redundant test for `get_post_time()` added in [46580].

There is no functional difference between `gmt_offset` and `timezone_string` timezone modes for the issue.

See #48384.

Trunk is now 5.4 alpha.

Date/Time: Make sure `get_post_time()` keeps UTC time on timezone change.

Add `$source` parameter to `get_post_datetime()` to instantiate from local or UTC time in database.

Props Rarst, david.binda.
Reviewed by azaozz, SergeyBiryukov.
Fixes #48384.

Posts, Post Types: Remove unintended change from [46578].

See #48384.

Date/Time: Correct the logic in `WP_Posts_List_Table::column_date()` and `WP_Media_List_Table::column_date()` to check for a valid post timestamp.

Props Rarst.
Reviewed by azaozz, SergeyBiryukov.
See #48384.

Date/Time: Make sure `date_i18n()` correctly handles zero timestamp after [45901].

Props soulseekah, gravityview, Rarst.
Reviewed by azaozz, SergeyBiryukov.
Fixes #28636.

Build/Test Tools: Update the `https-proxy-agent` dependency.

Fixes #48428.

Accessibility: Restore the primary buttons original background color for alternate color schemes after [46241].

Props david.binda, audrasjb, azaozz.
See #34904.
Fixes #48396.

Post WordPress 5.3 RC2 version bump.

WordPress 5.3 RC2.

Help/About: Update the 5.3 About page for RC2.

This includes numerous improvements:

- Removes the jazzer name.
- Ensures `WordPress` is translatable for consistency with other occurrences in Core.
- Changes all instances of `Block Editor` to `block editor` to match the spelling best practices.
- Updates the PHP 7.4 compatibility section with more suitable text.
- Introduction in `credits.php`, `freedoms.php`, and `privacy.php` have been updated to be consistent with the About page.
- Fixes the `aria-current` attribute in tab navigation.

Reviewed by SergeyBiryukov, desrosj.
Props SergeyBiryukov, audrasjb, desrosj, ryelle, afercia.
See #47708.

Bundled Themes: Update Twenty Twenty.

This brings `trunk`’s version of Twenty Twenty in-sync with GitHub.

For a complete list of changes since [46551], see https://github.com/WordPress/twentytwenty/compare/bc89c51...4549fd9.

Reviewed by SergeyBiryukov, desrosj, ianbelanger.
Props anlino, ianbelanger, poena, williampatton, nielslange, acosmin, intimez, itowhid06, decrecementofeliz, aristath, westonruter, mukesh27, jorgefilipecosta, karmatosed.
Fixes #48386.

Administration: Relax the default value check for the `$position` argument added to `add_submenu_page()` and related functions in [46197].

Due to a confusion with `add_menu_page()`, which takes the `$icon_url` parameter, while `add_submenu_page()` does not, some plugins were passing in a string instead of integer as `$position`, causing backward compatibility issues.

A `_doing_it_wrong()` message is now added to alert developers of the wrong parameter type.

Props david.binda, desrosj, 123host, dennis_f, MattyRob.
Reviewed by desrosj.
Fixes #48249.

Date/Time: Make sure `wp_date()` does not unnecessarily escape localized numbers, but keeps localized slashes.

Props Rarst, tmatsuur, remcotolsma, peterwilsoncc.
Reviewed by peterwilsoncc.
Fixes #48319.

Plugins: Restore backward compatibility for PHP4-style passing of `array( &$this )` as action argument to `do_action()`.

This is a follow-up to [46149] to avoid unnecessary breakage in case of using the old notation.

Props david.binda, jrf.
Reviewed by azaozz.
Fixes #48312.

Media: After [46237] add the same fix to the `.button-group` on the "Insert form URL" screen in the media modal.

Props afercia, sabernhardt.
FIxes #48087.

Upload: Expand error codes to include all 5xx HTTP errors when retrying to create image sub-sizes. Some servers may be configured to set HTTP 508 or 504, or possibly other `5` errors.

Porps mikeschroder, azaozz.
Fixes #48379.

Media/Upload: When the users upload big images and WordPress creates a scaled image to use as the largest size, append `scaled-` to the file names of the scaled images to make them easier to recognize.

Props kraftbj, azaozz.
Fixes #48304.

Comments: Add `rel="nofollow ugc"` attribute when converting plain URLs to `<a>` tags in comments via `make_clickable()`.

Introduce `make_clickable_rel` filter for the `rel` value that is added to URL matches converted to links.

This is a follow-up to [46349], which added the `rel="nofollow ugc"` attribute to existing `<a>` tags in comments via `wp_rel_ugc()`.

UGC stands for User Generated Content, and the `ugc` attribute value is recommended for links within user generated content, such as comments and forum posts.

See https://webmasters.googleblog.com/2019/09/evolving-nofollow-new-ways-to-identify.html.

Props blogginglife, SergeyBiryukov.
Reviewed by desrosj, audrasjb.
Fixes #48022.

REST API: Cast empty meta values to correct scalar types in REST response.

Introducing complex meta value handling in [45807] unintentionally removed value casting for empty scalar meta values.

Props TimothyBlynJacobs, chrisvanpatten, rmccue, kadamwhite.
Fixes #48363.

Block Editor: Update Packages that include WP 5.3 RC2 fixes.

Updated packages:
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]
 - @wordpress/[email protected]

Props gziolo.
Fixes #48381.

Administration: Revert changes to the admin menu styles for long line lengths.

This reverts [46555], [46453], and [46332].

See #42201

Upgrade/Install: Use a unique error code when an update fails due to the PHP JSON extension missing.

This allows update failures caused when the native PHP JSON extension is missing to be distinguished from updates that fail because the site does not meet the minimum PHP requirements.

Follow up of [46455].

Reviewed by desrosj, jorbin, johnbillion.
Fixes #47699.

Script Loader: Partially revert [46550] as it brought in unrelated CSS changes.

[46550] was meant to revert [46440] but it also merged some unrelated CSS changes.

See #47069.

Post WordPress 5.3 RC1 version bump

WordPress 5.3 RC1

Help/About: Let's tell the world about 5.3.

Props karmatosed, melchoyce, pierlo, ryelle, afercia, audrasjb, davidbaumwald

Thanks to everyone who provided feedback for this page for 5.3.

See #47708

Administration: Fix the appearance of update bubbles in submenus and when the admin menu is collapsed.

Props afercia, amolv, sabernhardt

Fixes #42201, #48294

Shortcodes: Revert [46369] for now to allow more time to investigate and prepare for backward compatibility changes.

Also reverts follow-up changes in [46370] and [46465].

See #47863.

Media: Similarly to `wp_get_original_image_path()` add `wp_get_original_image_url()` to always retrieve the URL to the original uploaded image.

Props kraftbj.
Fixes #48302.

Build/Test Tools: Move PHP 7.4 to the top of the list for consistency.

See #48232.

Bundled Themes: Update Twenty Twenty.

This brings `trunk`’s version of Twenty Twenty in-sync with GitHub.

For a complete list of changes since [46445], see https://github.com/WordPress/twentytwenty/compare/7246fd6...bc89c51.

Props anlino, ianbelanger, poena, williampatton, nielslange, acosmin, netweb, joyously, mahesh901122, josephscott, byalextran, amolv, Clorith.
See #48110.

Accessibility: Script Loader: Remove jQuery as dependency of `admin-bar` after [46440].

A better approach needs to be explored, as there are valid concerns for potential conflicts between different jQuery versions added by themes or plugins.

See #47069.

Accessibility: Media: Improve the Media Modal spinner position after [46418].

Fixes #47138.

Customize: Ensure that `WP_Customize_Manager::import_theme_starter_content()` properly handles starter content with (nested) arrays as values.

Previously, searching for symbol references to replace with post or attachment IDs in array values resulted in a PHP warning.

Props timph, JarretC, SergeyBiryukov.
Fixes #45484.

Build/Test: Remove PHP 7.4 from allowed failures

PHP7.4 is supported in WordPress 5.3. :elephant: :tada:

Fixes: #48232.

Block Editor: Update the WordPress Packages to the ones used in the Gutenberg 6.8 release.

Updated packages:
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]
@wordpress/[email protected]

Props gziolo, youknowriad.
Fixes: #48310

REST API: Allow for multiple Vary: Origin headers in GET responses.

Simple fix, we pass `false` as the second parameter to the header function.

This is something that we added downstream of the 5.2.4 release, but we missed in 5.2/trunk.

Fixes #48309.
Props xknown, whyisjake.

Block Editor: Remove experimental Social Links blocks

We decided to mark Social Links block as an experimental feature in Gutenberg. In effect, we are moving all related code from WordPress 5.3 release.

Props youknowriad.

Fixes #48263.

Build/Test tools use Trunk revision 2170172 of importer

Update Travis configuration to temporarily use trunk for the importer in order for PHP 7.4 tests to pass. When the new version is released, this will be updated to point to that tag.

See: #48231

Media: Do not store error messages in the image meta. The initial idea was to (be able to) display these errors in the UI but it wasn't implemented as these errors are mostly helpful for low-level bedugging.

Fixes #40439.

Uploads: Retry to post-process images after HTTP 500 and HTTP 502 errors.

Props mikeschroder, azaozz.
Fixes #47872.

Accessibility: Media: Improve the text of the Media Modal actions toggle button displayed in the responsive view.

See #47149.

Accessibility: Media: Improve the new Media Modal headings text.

See #47610.

Administration: Ensure that admin referer nonce is valid.

Fix for a testing regression.

Props desrosj.

REST API: Ensure that we don't generate warnings from sending extra headers after headers have been sent.

Fixes issues stemming from [46478].

REST API: Send a Vary: Origin header on GET requests.

Add this header on all GET requests to prevent cached requests.

Props darthhexx, davidbinda, nickdaugherty, whyisjake.

Administration: Ensure that admin referer nonce is valid.

Coding standards, ensure that nonce is valid with identical, rather then equal operator.

Props vortfu, xknown, whyisjake.

Filesystem API: Prevent directory travelersals when creating new folders.

Reject file paths that contain sub-directory paths.

Props iandunn, xknown, sstoqnov, whyisjake.

HTTP API: Protect against hex interpretation.

Return earlier from wp_http_validate_url().

Props: iandunn, xknown, voldemortensen, whyisjake.

Query: Remove the static query property.

Prevent unauthenticated views of publicly queryables content types.

Props aaroncampbell, whyisjake, nickdaugherty, xknown.

Formatting: In `wp_validate_redirect()`, normalize the path when validating the location for relative URLs, to account for Windows paths.

Props peterwilsoncc, rconde, jmmathc, mat-lipe, Sixes, justinahinon, cmagrin, daxelrod, SergeyBiryukov.
Fixes #47980.

Docs: Fix typo in a comment in `WP_REST_Settings_Controller::prepare_value()`.

Convert the comment to a multi-line format per the documentation standards.

Props itowhid06.
See #48296.

Docs: Correct documentation typo in print_emoji_detection_script().

Props itowhid06.
Fixes #48298. See #47110.

Docs: Correct comment typo in WP_REST_Terms_Controller::update_item().

Props manikmist09.
Fixes #48295. See #47110.

Docs: Fix and improve inline documentation for the HTTP API.

See #47110

Users: Make sure `wp_logout()` clears current user, so that a subsequent call to `is_user_logged_in()` works as expected.

Props sebastian.pisula, donmhico, roytanck, juliobox.
Fixes #35488.

Tests: Rename tests methods in `tests/pluggable.php` per the handbook's naming convention.

See #47632.

Docs: Adjust `@since` note in `shortcode_parse_atts()` for consistency with similar notes.

See #47863.

I18N: Don't capitalize "Extension" in `update_core()`, for consistency with other strings.

Follow-up to [46455].

See #47699.

Docs: Add `requires_php` to the list of fields returned by `plugins_api()`.

Props ediamin.
Fixes #48291.

Formatting: Make sure `wp_sanitize_redirect()` encodes spaces in URLs instead of stripping them out.

Props donmhico, hlashbrooke, dd32, azaozz.
Fixes #36998.

Media: Adds Edit Image controller to Media Library `select` frame.

This adds the necessary state for `EditImage` views in the `select` frame and listeners for setting that view.

Props fblaser, w3rkjana, afercia, antpb.
See #48028.

Administration: Prevents horizontal scroll jumping around while admin menu is open.

This sets the `#adminmenuback` `position` CSS property to `fixed`.

Props promz, man4toman.
Fixes #47010.

Media: Update fallback previews to support `_wp_make_subsizes()`

Allows fallback previews (PDF by default, in core) to save image meta
after each size is generated to allow for resuming, and make sizes
immediately available.

Props azaozz, antpb, progremzion, mikeschroder.
See #48111.

Cron: Prevent sending headers when using ALTERNATE_WP_CRON

ALTERNATE_WP_CRON echos things which causes a "Headers already sent" warning. This adds a check to ensure headers haven't already been sent.

Previously: [45560]

See: #45560. Fixes #48283.
Props dlh.

Themes: Convert core-provided starter content to block content.

Props Clorith.
Fixes #48130.

REST API: Fix error in _fields filtering logic where only one of several requested sibling properties would be included.

Props kadamwhite, TimothyBlynJacobs.
Fixes #48266.

Upgrade/Install: Detect the presence of the native PHP JSON extension before updating.

The PHP native JSON extension has been bundled and compiled with PHP by default since version 5.2.0. Because the minimum version of PHP required by WordPress is now 5.6.20 (see #46594 and [45058]), the related polyfills and workarounds have been removed (see [46205-46206,46208]).

However, even though the JSON extension is now included in PHP by default, it is still possible to disable the extension in a custom configuration. This change will prevent sites from upgrading if the JSON extension is disabled to prevent compatibility issues.

Props jrf, jorbin, dd32, desrosj.
Fixes #47699.

REST API: Do not addslash when receiving meta arrays of non-string values.

Slashing non-string data caused PUT requests containing unmodified meta arrays of integers to fail the check against the existing stored meta value, causing a 500 when posting an unmodified response body back to the server.

Props TimothyBlynJacobs, augustuswm.
Fixes #48264.

Administration: Ensure visual consistency with large titles in the sidebar.

Custom posts, and other menu titles that are long aren't wrapping correctly.

Props jagirbaheshwp, munyagu, harshbarach, hareesh-pillai, pratikkry, naveenkharwar, mukesh27, dushanthi, worldweb, audrasjb, afercia, amolv, iqbalbary, davidbaumwald.
Fixes #42201

Docs: Tweak the `@since` note in `Walker::walk()` and `::paged_walk()` for better readability and consistency with other notes.

See #47678.

Docs: Add a `@since` note about new parameters with the spread operator added to function signatures.

Props jrf.
See #47678.

Bundled Themes: Update/audit NPM dependencies for Twenty Nineteen.

Also, ignore the `node_modules` folder for Twenty Nineteen.

Fixes #48262.

Post WordPress 5.3 Beta 3 version bump.

WordPress 5.3 Beta 3.

Bundled Themes: Fix JSHint error in [46445]

Props ianbelanger.
See #48110.

Bundled Themes: Change the `eol-style` property to `native` for Twenty Twenty files.

Props aazaozz, desrosj.
See #48110.

Bundled Themes: Update Twenty Twenty.

This brings `trunk`'s version of Twenty Twenty in-sync with GitHub.

For a complete list of changes since [46357], see https://github.com/WordPress/twentytwenty/compare/7157870...7246fd6.

Props anlino, ianbelanger, poena, williampatton, nielslange, acosmin, netweb, joyusly, luminuu, itowhid06, cbravobernal, intimez, glauberglauber, ocean90, amolv, briceduclos, aristath, mukesh27, garrett-eclipse, audrasjb, afercia, dianeco, utsav72640, mahesh901122, tobifjellner.
See #48110.

Themes: Properly align Close/Previous/Next icons in theme preview overlay.

Props chetan200891.
Fixes #48248.

Themes: Adjust CSS media query for theme overlay to match the breakpoint for a folded admin menu.

Props chetan200891.
Fixes #48250.

Code Modernisation: Introduce the spread operator in `Walker::walk()` and `::paged_walk()`.

Rather than relying on `func_get_args()` to retrieve arbitrary function arguments, we can now use the spread operator to assign them directly to a variable.

This re-applies [45624] and reverts [45640], with a dev note upcoming for plugin authors to maintain backward compatibility with old versions of WordPress.

Props jrf.
See #47678.

Network Admin: Improve Site States in List Table rows.

This commit switches a comparison to a Yoda condition, performs a more strict `intval()` check on the value of the Site Status column, and prevents a specific Site State from appearing in List Table rows when filtering by that same Site State already (to match the behavior of other List Table State implementations.)

Fixes #37684. Props pbiron.

Accessibility: Script Loader: Add jQuery as dependency of `admin-bar`.

On the front end, themes that don't use jQuery make the admin bar fallback to the non-jQuery implementation. Some important features miss from the non-jQuery `admin-bar.js` part, for example `hoverintent` and, most importantly, the touch events for the mobile menu don't work at all.

Enqueueing jQuery is the simplest option for now. For the future, a complete rewriting of `admin-bar.js` in plain JavaScript is highly recommended.

See #47069.

Docs: Add missing `@deprecated` tags in the file docblock of some deprecated files.

Props jrf.
Fixes #48254.

Accessibility: Media: Improve the logic to render the ARIA tabs markup after [46363].

Additionally checks for the "menu" and "router" state attributes to better determine when the ARIA tabs pattern markup is appropriate.

See #47149.

I18N: Add context for the `Archives` string introduced in [45651] as a file type heading, to disambiguate from other types of archives.

Props alexclassroom.
Fixes #48259.

External Libraries: upgrade `mediaelement` to version 4.2.13.

Upgrade `mediaelement` to the latest version. Includes a variety of bug fixes made since the 4.2.6 release; see https://github.com/mediaelement/mediaelement/releases.

Props danieliser, Hareesh Pillai.
Fixes #46681.

REST API: Ensure rest_controller instantiates the post type's declared REST controller class.

Ensures that the ::get_rest_controller() method will always return an instanceof the expected controller class, or null.
Removes unused private static property $post_type_controllers.

Props dlh, TimothyBlynJacobs.
Fixes #45677.

REST API: Permit embedding of the 'self' link relation in the /search endpoint.

Removes a special-case prohibition against embedding 'self' which prevented ?_embed from being used with the /wp/v2/search endpoint.

Props TimothyBlynJacobs, chrisvanpatten, kadamwhite.
Fixes #47684.

REST API: Ensure users with "moderate_comments" capability may edit comments.

Props meloniq.
Fixes #47024.

Coding Standards: Correct the number of accepted arguments in `add_action()` calls in `wp-includes/default-filters.php` for functions that don't accept any arguments.

Props itowhid06, johnbillion, jrf.
Fixes #48123.

CSS Coding Standards: Use unitless values for `line-height` in `wp-includes/css/media-views.css`.

Follow-up to [45478].

Props ianbelanger, afercia.
Fixes #46529. See #44643.

Twenty Fourteen: Replace overly broad float-clearing selectors with more specific ones, to avoid unintentionally targeting elements generated by plugins.

Props ianbelanger, iandunn, karmatosed.
Fixes #35779.

Twenty Fourteen: Ensure the content after the Read More tag is visible and has the appropriate padding.

Props ianbelanger, sabernhardt, slobodanmanic, Quantumstate, Gwendydd, andraganescu, francina.
Fixes #28967.

Pings/Trackbacks: Remove a failing test that won't pass as long as `WP_IMPORTING` gets set during tests.

The `_publish_post_hook()` function checks for `WP_IMPORTING` before setting meta fields fir enclosures and pings, which means this test is doomed to fail.

The test can be re-implemented if the `WP_IMPORTING` constant gets moved to a function similar to how `wp_installing()` works for the `WP_INSTALLING` constant.

See #48014

Pings/Trackbacks: Fix processing of posts with pending enclosures.

Introduced in [46175].

Fixes #36824

Pings/Trackbacks: Avoid adding multiple `_pingme` and `_encloseme` meta entries to a post when it gets updated prior to pings being done.

Props rebasaurus, whyisjake

Fixes #48014

Accessibility: Improve and modernize user interface controls: Revert the new links focus style.

Thew new dotted outline for the links focus style introduced in [46241] doesn't appear to be ready to guarantee a good indication of focus.
It was agreed to restore the previous links focus style and postpone exploration for a new style to the next release cycle.
Partially reverts [46241] and [46293].

See #34904, #47153.

Docs: Miscellaneous inline docs corrections and improvements.

See #47110

Accessibility: Improve and modernize user interface controls: Improve the buttons active CSS class.

- improves the buttons `.active` CSS class for buttons that need to be styled as "pressed"
- update the alternate color schemes `.active` CSS class accordingly
- improves a few icons colors in the alternate color schemes

See #34904.

REST API: Add support for continuing the post-processing of images after upload. Flow:

1. `POST /wp/v2/media`.
2. If the upload failed (HTTP 500 error), look for a response header with `X-WP-Upload-Attachment-ID` header that contains the newly created attachment ID.
3. `POST /wp/v2/media/{id}/post-process` with `{ "action": "create-image-subsizes" }`. This request may still fail, but it will save its progress.
4. On continued failure, `DELETE /wp/v2/media/{id}` to give up on the upload and instruct the user to resize their image before uploading.

Props TimothyBlynJacobs.
Fixes #47987.

Upload: Set custom header with the attachment ID for all uploads from `media_handle_upload()`. Let the REST API endpoint set it separately.

Props timothyblynjacobs.
Fixes #48200.

Coding Standards: Fix WPCS issues in `wp-includes/ms-deprecated.php`.

Props itowhid06.
Fixes #48237.

Accessibility: Improve and modernize user interface controls for better contrast: Further improvements to input heights and alignments.

- improves input fields height in the customizer
- improves input fields height for Internet Explorer 11
- improves input fields height in the Image Editor
- improves alignment of selects and buttons in the privacy policy pages
- makes the search themes fields font-size consistent

Props garrett-eclipse, afercia.
See #47477.

Accessibility: Media: Improve the search media field labelling.

Visible `<label>` elements benefit all users. The `placeholder` attribute should not be used as a replacement for visible labels.
Instead, it's supposed to be used only for a short hint to aid users with data entry e.g. a sample value or a brief description of the expected format.

Screen readers may not announce a `placeholder` attribute at all. Other users may suffer from the lack of a visible label and a placeholder used as replacement, for example:

- users with cognitive disabilities may have trouble remembering what the filled field does
- speech recognition users cannot see the name they can speak to set focus on the field
- low-vision users with high text-size may not be able to see the whole placeholder even when it's visible, if its value is clipped by the edge of the input

Props anevins, audrasjb, karmatosed, azaozz, SergeyBiryukov, afercia.
See #40331.
Fixes #47138.

Accessibility: Login and Registration: Improve the invalid username and invalid email messages.

- explicitly informs users they can use their email to log in as an alternative to their username and vice-versa
- shows the `Lost your password?` link only when an wrong password has been entered
- uses a more appropriate copy by changing "invalid" to "unknown"
- removes the all caps `ERROR`

Props subrataemfluence, zalak151291, ryokuhi, SergeyBiryukov, audrasjb, joedolson, marybaum, ramiy, markjaquith, chanthaboune, afercia.
Fixes #43037.

External Libraries: Fix PHP 7.4 compatibility issue in the Requests library.

Moves https://github.com/rmccue/Requests/pull/370 into WordPress.

Previous [46258].

See #47746.

Coding Standards: Fix WPCS issues in `WP_Widget_Links` and `WP_Widget_Pages`.

Props itowhid06.
Fixes #48228.

Tests: Use a consistent group for nav menu tests.

Fixes #48230.

Menus: In `Walker_Nav_Menu`, `Walker_Category`, and `Walker_Page`, properly output link attributes having a legitimate "empty" value, for example an HTML data attribute with a value of zero (0).

Props nevma, AkSDvP, greenshady, SergeyBiryukov.
Fixes #47720.