Merge remote-tracking branch 'origin/trunk' into renovate/mediawiki-m…

…ediawiki-codesniffer-44.x

projects/js-packages/critical-css-gen/.gitignore

@@ -1,4 +1,4 @@
 /vendor
 /node_modules
-/build-node
-/build-browser
+/build
+/tests/build

projects/js-packages/critical-css-gen/CHANGELOG.md

@@ -5,8 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## 0.1.0 - 2024-09-24
+## [1.0.0] - 2024-10-07
+
+### Security
+
+- Security: Fix XSS vulnerability. [#39507]
 
 ### Added
 
+- Add /playwright entry point for BrowserInterfacePlaywright. [#39509]
+
+### Changed
+
+- Change default entry point of package to include BrowserInterfaceIframe instead of BrowserInterfacePlaywright. [#39509]
+
+## 0.1.0 - 2024-09-24
+### Added
 - Initial version. [#38429]
+
+[1.0.0]: https://github.com/Automattic/jetpack-critical-css-gen/compare/v0.1.0...v1.0.0

projects/js-packages/critical-css-gen/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@automattic/jetpack-critical-css-gen",
-	"version": "0.1.0",
+	"version": "1.0.0",
 	"description": "A flexible Critical CSS Generator that supports multiple URLs and viewports, with both server-side and client-side generation capabilities.",
 	"homepage": "https://github.com/Automattic/jetpack/tree/HEAD/projects/js-packages/critical-css-gen/#readme",
 	"bugs": {
@@ -15,48 +15,46 @@
 	"license": "GPL-2.0-or-later",
 	"author": "Automattic",
 	"scripts": {
-		"build:browser": "rollup -c",
-		"build:node": "tsc",
-		"build": "pnpm run clean && pnpm run build:browser && pnpm run build:node",
-		"clean": "rm -rf build-node/ && rm -rf build-browser/",
-		"test": "pnpm build && NODE_ENV=test NODE_PATH=./node_modules jest --forceExit --config=tests/config/jest.config.js"
+		"build": "pnpm run clean && tsc",
+		"build:test": "pnpm run clean:test && webpack --config tests/data/webpack.config.cjs",
+		"clean": "rm -rf build/",
+		"clean:test": "rm -rf tests/build/",
+		"test": "pnpm build && pnpm build:test && NODE_ENV=test NODE_PATH=./node_modules jest --forceExit --config=tests/config/jest.config.js"
 	},
-	"main": "./build-node/node.js",
-	"browser": "./build-browser/bundle.js",
+	"main": "./build/browser.js",
 	"devDependencies": {
+		"@automattic/jetpack-webpack-config": "workspace:*",
 		"@babel/core": "7.24.7",
 		"@babel/preset-env": "7.24.7",
 		"@babel/preset-typescript": "7.24.7",
-		"@rollup/plugin-commonjs": "26.0.1",
-		"@rollup/plugin-json": "6.1.0",
-		"@rollup/plugin-node-resolve": "15.3.0",
-		"@rollup/plugin-terser": "0.4.3",
-		"@rollup/plugin-typescript": "12.1.0",
 		"@types/clean-css": "4.2.11",
 		"@types/css-tree": "2.3.8",
 		"@types/node": "^20.4.2",
 		"express": "4.20.0",
 		"jest": "29.7.0",
+		"path-browserify": "1.0.1",
 		"playwright": "1.45.1",
 		"playwright-core": "^1.45.1",
 		"prettier": "npm:[email protected]",
-		"rollup": "3.29.5",
-		"rollup-plugin-polyfill-node": "0.13.0",
+		"process": "0.11.10",
 		"source-map": "0.7.4",
 		"source-map-js": "1.2.0",
 		"tslib": "2.5.0",
 		"typescript": "5.0.4",
 		"webpack": "5.94.0",
+		"webpack-cli": "4.9.1",
 		"webpack-dev-middleware": "5.3.4"
 	},
 	"exports": {
 		".": {
-			"jetpack:src": "./src/node.ts",
-			"types": "./build-node/node.d.ts",
-			"browser": "./build-browser/bundle.js",
-			"import": "./build-node/node.js",
-			"require": "./build-node/node.js",
-			"default": "./build-node/node.js"
+			"jetpack:src": "./src/browser.ts",
+			"types": "./build/browser.d.ts",
+			"default": "./build/browser.js"
+		},
+		"./playwright": {
+			"jetpack:src": "./src/playwright.ts",
+			"types": "./build/playwright.d.ts",
+			"default": "./build/playwright.js"
 		}
 	},
 	"dependencies": {

projects/js-packages/critical-css-gen/tests/data/webpack.config.cjs

@@ -0,0 +1,50 @@
+const path = require( 'path' );
+const jetpackWebpackConfig = require( '@automattic/jetpack-webpack-config/webpack' );
+const webpack = require( 'webpack' );
+
+module.exports = {
+	entry: path.join( __dirname, '../../src/browser.ts' ),
+	mode: 'development',
+	devtool: false,
+	output: {
+		...jetpackWebpackConfig.output,
+		path: path.join( __dirname, '../build' ),
+		filename: 'bundle.js',
+		library: 'CriticalCSSGenerator',
+	},
+	resolve: {
+		...jetpackWebpackConfig.resolve,
+		// These are needed for the build to work,
+		// otherwise it errors out because of the clean-css dependency.
+		fallback: {
+			...jetpackWebpackConfig.resolve.fallback,
+			path: require.resolve( 'path-browserify' ),
+			process: require.resolve( 'process/browser' ),
+			url: false,
+			https: false,
+			http: false,
+			fs: false,
+			os: false,
+		},
+	},
+	node: false,
+	plugins: [
+		new webpack.ProvidePlugin( {
+			process: require.resolve( 'process/browser' ),
+		} ),
+	],
+	module: {
+		strictExportPresence: true,
+		rules: [
+			// Transpile JavaScript
+			jetpackWebpackConfig.TranspileRule( {
+				exclude: /node_modules\//,
+			} ),
+
+			// Transpile @automattic/jetpack-* in node_modules too.
+			jetpackWebpackConfig.TranspileRule( {
+				includeNodeModules: [ '@automattic/jetpack-' ],
+			} ),
+		],
+	},
+};

projects/js-packages/critical-css-gen/tests/lib/test-server.js

@@ -23,10 +23,7 @@ class TestServer {
 	async start() {
 		this.app = express();
 
-		this.app.use(
-			'/bundle.js',
-			express.static( require.resolve( '../../build-browser/bundle.full.js' ) )
-		);
+		this.app.use( '/bundle.js', express.static( require.resolve( '../build/bundle.js' ) ) );
 
 		for ( const [ virtualPath, realDirectory ] of Object.entries( this.staticPaths ) ) {
 			this.app.use( '/' + virtualPath, express.static( realDirectory ) );

projects/js-packages/critical-css-gen/tests/unit/generate-critical-css.test.js

@@ -1,6 +1,6 @@
 const path = require( 'path' );
 const { chromium } = require( 'playwright' );
-const { generateCriticalCSS, BrowserInterfacePlaywright } = require( '../../build-node/node.js' );
+const { generateCriticalCSS, BrowserInterfacePlaywright } = require( '../../build/playwright.js' );
 const { dataDirectory } = require( '../lib/data-directory.js' );
 const mockFetch = require( '../lib/mock-fetch.js' );
 const TestServer = require( '../lib/test-server.js' );

projects/js-packages/critical-css-gen/tsconfig.json

@@ -1,9 +1,9 @@
 {
 	"extends": "jetpack-js-tools/tsconfig.tsc.json",
-	"include": [ "src/node.ts" ],
+	"include": [ "src/browser.ts", "src/playwright.ts" ],
 	"exclude": [ "node_modules/**/*" ],
 	"compilerOptions": {
-		"outDir": "./build-node",
+		"outDir": "./build",
 		"target": "es2019",
 		"sourceMap": true,
 		"allowJs": false,

projects/js-packages/i18n-loader-webpack-plugin/CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.59] - 2024-10-07
+### Changed
+- Updated package dependencies. [#39594]
+
 ## [2.0.58] - 2024-09-10
 ### Changed
 - Updated package dependencies. [#39302]
@@ -261,6 +265,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - Initial release.
 
+[2.0.59]: https://github.com/Automattic/i18n-loader-webpack-plugin/compare/v2.0.58...v2.0.59
 [2.0.58]: https://github.com/Automattic/i18n-loader-webpack-plugin/compare/v2.0.57...v2.0.58
 [2.0.57]: https://github.com/Automattic/i18n-loader-webpack-plugin/compare/v2.0.56...v2.0.57
 [2.0.56]: https://github.com/Automattic/i18n-loader-webpack-plugin/compare/v2.0.55...v2.0.56

projects/js-packages/i18n-loader-webpack-plugin/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@automattic/i18n-loader-webpack-plugin",
-	"version": "2.0.58",
+	"version": "2.0.59",
 	"description": "A Webpack plugin to load WordPress i18n when Webpack lazy-loads a bundle.",
 	"homepage": "https://github.com/Automattic/jetpack/tree/HEAD/projects/js-packages/i18n-loader-webpack-plugin/#readme",
 	"bugs": {

projects/js-packages/webpack-config/CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 3.4.3 - 2024-10-07
+### Changed
+- Updated package dependencies. [#39594]
+
 ## 3.4.2 - 2024-09-26
 ### Changed
 - Updated package dependencies. [#39534]

projects/js-packages/webpack-config/package.json

@@ -1,7 +1,7 @@
 {
 	"private": true,
 	"name": "@automattic/jetpack-webpack-config",
-	"version": "3.4.2",
+	"version": "3.4.3",
 	"description": "Library of pieces for webpack config in Jetpack projects.",
 	"homepage": "https://github.com/Automattic/jetpack/tree/HEAD/projects/js-packages/webpack-config/#readme",
 	"bugs": {

projects/packages/codesniffer/Jetpack-Compat-74/ruleset.xml

@@ -90,6 +90,8 @@
 		<exclude name="PHPCompatibility.ParameterValues.NewIDNVariantDefault.NotSet" />
 		<exclude name="PHPCompatibility.ParameterValues.NewProcOpenCmdArray.Found" />
 		<exclude name="PHPCompatibility.ParameterValues.NewStripTagsAllowableTagsArray.Found" />
+		<exclude name="PHPCompatibility.ParameterValues.RemovedProprietaryCSVEscaping.ChangedBehaviour" />
+		<exclude name="PHPCompatibility.ParameterValues.RemovedProprietaryCSVEscaping.EmptyStringNotAllowed" />
 		<exclude name="PHPCompatibility.Syntax.NewArrayUnpacking.Found" />
 	</rule>
 </ruleset>

projects/packages/connection/changelog/update-optimize-connection-admin-notice-hook

@@ -0,0 +1,4 @@
+Significance: patch
+Type: changed
+
+Adjust conditions to optimize admin notices callback.

projects/packages/connection/src/class-connection-notice.php

@@ -40,24 +40,16 @@ public function __construct() {
 	 * @return void
 	 */
 	public function initialize_notices( $screen ) {
-		if ( ! in_array(
+		if ( in_array(
 			$screen->id,
 			array(
 				'jetpack_page_akismet-key-config',
 				'admin_page_jetpack_modules',
 			),
 			true
 		) ) {
-			add_action( 'admin_notices', array( $this, 'delete_user_update_connection_owner_notice' ) );
+			return;
 		}
-	}
-
-	/**
-	 * This is an entire admin notice dedicated to messaging and handling of the case where a user is trying to delete
-	 * the connection owner.
-	 */
-	public function delete_user_update_connection_owner_notice() {
-		global $current_screen;
 
 		/*
 		 * phpcs:disable WordPress.Security.NonceVerification.Recommended
@@ -66,14 +58,18 @@ public function delete_user_update_connection_owner_notice() {
 		 * page. Nonce will be already checked by WordPress, so we do not need to check ourselves.
 		 */
 
-		if ( ! isset( $current_screen->base ) || 'users' !== $current_screen->base ) {
-			return;
-		}
-
-		if ( ! isset( $_REQUEST['action'] ) || 'delete' !== $_REQUEST['action'] ) {
-			return;
+		if ( isset( $screen->base ) && 'users' === $screen->base
+			&& isset( $_REQUEST['action'] ) && 'delete' === $_REQUEST['action']
+		) {
+			add_action( 'admin_notices', array( $this, 'delete_user_update_connection_owner_notice' ) );
 		}
+	}
 
+	/**
+	 * This is an entire admin notice dedicated to messaging and handling of the case where a user is trying to delete
+	 * the connection owner.
+	 */
+	public function delete_user_update_connection_owner_notice() {
 		// Get connection owner or bail.
 		$connection_manager  = new Manager();
 		$connection_owner_id = $connection_manager->get_connection_owner_id();

projects/packages/forms/changelog/fix-phpcompatibility-new-dev-sniff

@@ -0,0 +1,5 @@
+Significance: patch
+Type: changed
+Comment: Explicitly pass `$escape` for `fputcsv` to fix new phpcompatibility-dev sniff. Note we may want to change it once we drop PHP <7.4 compat.
+
+

projects/packages/forms/src/contact-form/class-contact-form-plugin.php

@@ -1801,7 +1801,8 @@ public function download_feedback_as_csv() {
 		/**
 		 * Print CSV headers
 		 */
-		fputcsv( $output, $fields );
+		// @todo When we drop support for PHP <7.4, consider passing empty-string for `$escape` here for better spec compatibility.
+		fputcsv( $output, $fields, ',', '"', '\\' );
 
 		/**
 		 * Print rows to the output.
@@ -1820,7 +1821,8 @@ public function download_feedback_as_csv() {
 			/**
 			 * Output the complete CSV row
 			 */
-			fputcsv( $output, $current_row );
+			// @todo When we drop support for PHP <7.4, consider passing empty-string for `$escape` here for better spec compatibility.
+			fputcsv( $output, $current_row, ',', '"', '\\' );
 		}
 
 		fclose( $output ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose