Merge branch 'develop' into wordcamp-asia-2026-alt-text-loading-state-384

Author: jeffpaul

.distignore

@@ -4,8 +4,10 @@
 /.wordpress-org
 /docs
 /node_modules
+/routes
 /src
 /tests
+/tools
 
 # Files
 .*

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,26 +13,36 @@ Closes <!-- #ISSUE-NUMBER or URL -->
 ## How?
 <!-- How is your PR addressing the issue at hand? What are the implementation details? -->
 
-<!-- If you are using AI tools, you must adhere to the AI Guidelines: https://make.wordpress.org/ai/handbook/ai-guidelines/ -->
-
 ### Use of AI Tools
 <!--
 You are free to use artificial intelligence (AI) tooling to contribute, but you must disclose what tooling you are using and to what extent a pull request has been authored by AI. It is your responsibility to review and take responsibility for what AI generates. See the WordPress AI Guidelines: <https://make.wordpress.org/ai/handbook/ai-guidelines/>.
+
+Example disclosure:
+
+AI assistance: Yes
+Tool(s): GitHub Copilot, ChatGPT
+Model(s): GPT-5.1
+Used for: Initial code skeleton and test suggestions; final implementation and tests were reviewed and edited by me.
 -->
 
 ## Testing Instructions
-<!-- Please include step by step instructions on how to test this PR. -->
-<!-- 1. Open a post or page. -->
-<!-- 2. Insert a heading block. -->
-<!-- 3. etc. -->
+<!-- Please provide steps on how to test or validate that the change in this PR works as described. -->
 
-### Testing Instructions for Keyboard
-<!-- How can you test the changes by using the keyboard only? Please note, this is required for PRs that change the user interface (UI). This ensures the PR can be tested for any possible accessibility regressions. -->
+## Screenshots or screencast
+<!-- If this PR includes UI changes, please provide screenshots or a screen recording for clarity. -->
+<!-- This section can be removed if not applicable. -->
 
-## Screenshots or screencast <!-- if applicable -->
+| Before | After |
+| ------ | ----- |
+|        |       |
 
-<!-- If you would like to upload screenshots, feel free to use the table below when it is useful to show the difference between before and after the change. -->
-
-|Before|After|
-|-|-|
-|<!-- Before screenshot here -->|<!-- After screenshot here -->|
+## Changelog Entry
+<!--
+Please include a summary for this PR, noting whether this is something being Added / Changed / Deprecated / Removed / Fixed / or Security related.  You can replace the sample entries after this comment block with the single changelog entry line for this PR. -->
+> Added - New feature.
+> Changed - Existing functionality.
+> Deprecated - Soon-to-be removed feature.
+> Removed - Feature.
+> Fixed - Bug fix.
+> Security - Vulnerability.
+> Development Update - Development related updates.

.github/dependabot.yml

@@ -0,0 +1,61 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: 'chore(ci)'
+    labels:
+      - dependencies
+    groups:
+      github-actions-updates:
+        patterns: ['*']
+
+  - package-ecosystem: composer
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    versioning-strategy: increase
+    commit-message:
+      prefix: 'fix'
+      include: 'scope'
+    labels:
+      - dependencies
+    groups:
+      composer-dev-minor-patch:
+        dependency-type: 'development'
+        update-types: [minor, patch]
+      # We don't bundle minor or major production assets, so they're tested individually.
+      composer-patch:
+        dependency-type: 'production'
+        update-types: [patch]
+
+  - package-ecosystem: npm
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    versioning-strategy: increase
+    commit-message:
+      prefix: 'fix'
+      include: 'scope'
+    labels:
+      - dependencies
+    groups:
+      npm-dev-minor-patch:
+        dependency-type: 'development'
+        update-types: [minor, patch]
+      npm-prod-minor-patch:
+        dependency-type: 'production'
+        update-types: [minor, patch]

.github/workflows/build-plugin-zip.yml

@@ -25,20 +25,20 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
           persist-credentials: false
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@ec406be512d7077f68eed36e63f4d91bc006edc4 # v2.35.4
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
         with:
           php-version: '7.4'
           coverage: none
           tools: composer:v2
 
       - name: Use desired version of Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
           check-latest: true
@@ -47,7 +47,7 @@ jobs:
         run: npm ci
 
       - name: Install Composer dependencies
-        uses: ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520 # v3.1.1
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4.0.0
         with:
           composer-options: '--no-dev'
 
@@ -59,7 +59,7 @@ jobs:
           npm run plugin-zip
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: ai-plugin-zip-pr${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
           path: ai.zip

.github/workflows/dependency-review.yml

@@ -19,10 +19,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
         with:
           license-check: true
           vulnerability-check: false # Since we only want to use the license check, we need to set this to false as otherwise the default is true.

.github/workflows/plugin-check.yml

@@ -32,22 +32,22 @@ jobs:
         timeout-minutes: 20
         steps:
             - name: Checkout repository
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
                   persist-credentials: false
 
             - name: Set up PHP
-              uses: shivammathur/setup-php@ec406be512d7077f68eed36e63f4d91bc006edc4 # v2.35.4
+              uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
               with:
                   php-version: '8.3'
                   coverage: none
 
             - name: Install Composer dependencies
-              uses: ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520 # v3.1.1
+              uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4.0.0
 
             - name: Setup Node
-              uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
               with:
                   cache: 'npm'
                   node-version-file: '.nvmrc'
@@ -69,5 +69,6 @@ jobs:
                       plugin_header_unsupported_plugin_name
                   exclude-directories: |
                       .github
+                      build
                       docs
                       tests

.github/workflows/pr-playground-preview.yml

@@ -33,7 +33,7 @@ jobs:
     steps:
       - name: Extract PR metadata from artifact name
         id: pr-metadata
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -83,6 +83,9 @@ jobs:
           }
 
           const blueprint = {
+            preferredVersions: {
+              wp: 'beta',
+            },
             steps: [
               {
                 step: 'installPlugin',

.github/workflows/props-bot.yml

@@ -76,7 +76,7 @@ jobs:
           format: 'git'
 
       - name: Remove the props-bot label
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: ${{ github.event.action == 'labeled' && 'props-bot' == github.event.label.name }}
         with:
           retries: 2