You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.
⚠ BREAKING CHANGES
crypto is now expected to be globally defined (requires node@20+) (#935)
upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years
Embed: Use the new @wordpress/kebab-case package instead of unlocking the kebabCase utility from the @wordpress/components private APIs (#81294).
Enhancements
Group: Support separate horizontal and vertical block spacing values (#81476).
Playlist Track: Use a dedicated icon for the block toolbar. (#80959)
Playlist: Expose the parent "Add track" toolbar control to selected Playlist Track child blocks via block toolbar sharing (#80368).
Playlist: Allow selecting audio tracks individually in the Media Library without holding Shift or Command, transform multiple Audio blocks into a Playlist, and transform a one-track Playlist into Audio. (#80926)
Page List: Rename the "Edit" action to "Detach", and confirm it in a dialog explaining that the list will keep its current pages but stop adding new ones automatically, matching the Gallery block (#80847).
Tabs: Start new tabs with an empty label showing a "Tab title" placeholder instead of a generic "Tab" (#81009).
Tab Panel: Show the tab's title in the Document Overview instead of the generic block title, so tabs can be told apart (#81427).
Bug Fixes
Footnotes: Treat unreadable footnotes post meta as no footnotes instead of throwing, so the block shows its placeholder rather than the block crash warning (#81201).
Playlist Track: Show the upload loading indicator inline with the track row.
Playlist: Improve handling of declarative waveform player configuration (#81342).
Playlist: Update @arraypress/waveform-player to ^1.26.0, disable automatic initialization, and prevent custom SVG icons from being configured through HTML data attributes.
Cover: Pass 'full' instead of null as the featured image size for parallax and repeated backgrounds, so a null array offset is no longer reached on PHP 8.5 (#81444).
Internal
Details: Import withIgnoreIMEEvents from @wordpress/keycodes instead of unlocking it from @wordpress/components (#81343).
10.3.0 (2026-07-29)
Enhancements
Playlist: Shorten the track toolbar button label from "Add track" to "Add".
Gallery: Rename the dynamic variation's "Convert to images" action to "Detach", and confirm it in a dialog explaining that the gallery will keep its current images but stop updating automatically (#80727).
Bug Fixes
Table of Contents: Continue rendering saved legacy content until the post is edited and resaved.
Navigation Overlay Close: Inherit typography and color from the overlay, so the button follows the theme font instead of the browser default button styles (#80751).
Playlist: Update @arraypress/waveform-player to ^1.23.0, which no longer sets crossorigin="anonymous" on its audio element, fixing playback of tracks served without CORS headers such as media offloaded to a CDN (#80533).
Post Content: Restrict the wrapper tag to the supported values offered in the editor.
Post Date: Escape date values and link URLs before rendering the block.
Image: Check only window.__clientSideMediaProcessing for sideloading status, following the removal of the redundant window.__heicUploadSupport flag (#80452).
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
Bumps uuid to 14.0.2 and updates ancestor dependency @wordpress/block-library. These dependencies need to be updated together.
Updates
uuidfrom 8.3.2 to 14.0.2Release notes
Sourced from uuid's releases.
... (truncated)
Changelog
Sourced from uuid's changelog.
... (truncated)
Commits
fd59f02chore(main): release 14.0.2 (#967)f3c564edocs: point the Node support permalink at the CI version matrix (#974)b1da338fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)6adcc1dfix(v1): carry nsecs overflow into the timestamp's high bits (#972)ea83515docs: cleanup API summary (#968)ac36860chore: pinpublintversion in CI (#966)a67db57fix(v7): align default seq formula in v7Bytes with updateV7State (#965)7017780chore(main): release 14.0.1 (#964)f2c3e4bchore: fix release-please workflow (#963)27ffae5fix: add types condition to node export for moduleResolution bundler (#961)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
@wordpress/block-libraryfrom 3.2.21 to 10.4.0Changelog
Sourced from @wordpress/block-library's changelog.
... (truncated)
Commits
989764dchore(release): publishe18aa00Update changelog filesdbb73c9Merge changes published in the Gutenberg plugin "release/23.8" branch7e8b17achore(release): publish42ad080Update changelog filesedffa74Merge changes published in the Gutenberg plugin "release/23.7" branche9a74f9chore(release): publish2a0c375Update changelog filese61c854Merge changes published in the Gutenberg plugin "release/23.6" branch1055a35Update changelog files