Repository navigation
Conversation
Applied from #72, adapted to the current escaped bs_button output: - target is optional and omitted by default, so existing shortcodes render exactly the same HTML as before - only _blank, _self, _parent and _top are accepted (case-insensitive); any other value is dropped - _blank also adds rel="noopener noreferrer" - the Buttons popup gets an "Open link in" select defaulting to "Same window", which leaves target out of the inserted shortcode; the popup is 60px taller to fit it Also applied from #61: a readme Requirements note explaining when to uncheck the bundled Bootstrap CSS/JS settings (both original commits squashed and reworded to name the exact settings). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
.cursorrules and .agents/workflows/local-qa.md are stale for a repo in maintenance mode; the README already documents wp-env setup and tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- @wordpress/env 10 -> 11, @wordpress/scripts 31 -> 36, release-it 19 -> 21, @release-it/conventional-changelog 10 -> 12 - regenerate package-lock.json (npm 10 crashed resolving the new tree) - pin Node 24 LTS in volta and CI; Node 20 is end-of-life and the new tooling requires Node >= 22.19 Clears 94 of 149 npm audit advisories. The rest sit in the latest upstream releases and need upstream fixes. All dev-only; nothing here ships in the plugin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sinetheta
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Maintenance cleanup ahead of the next patch release. Two of the old open PRs still made sense and are applied here (adapted to the current code), with the original author credited on the commit.
feat(buttons): optional
targeton[bs_button], from #72 (@No3x)targetis optional and omitted by default, so existing shortcodes render byte-identical HTML. A test asserts this exactly._blank,_self,_parentand_topare accepted (case-insensitive). Any other value is dropped, not escaped through. The value is output withesc_attrinside double quotes._blankalso addsrel="noopener noreferrer".targetout of the inserted shortcode, so the existing insert flow is unchanged. The popup is 60px taller so the Insert button stays visible.docs(readme), from #61 (@No3x)
Adds a short Requirements note: the plugin loads Bootstrap's CSS and JS for you, and if your theme already includes Bootstrap you should uncheck the two load options so it isn't loaded twice. Squashed into the commit above.
chore: remove outdated agent instruction files
Removes
.cursorrulesand.agents/workflows/local-qa.md. They're stale for a repo in maintenance mode, and the README already documents wp-env setup and tests.docs: credit Andrew Herd
Adds "Reported by Andrew Herd" to the 3.4.6 bs_tcontent stored-XSS entry in both
readme.txtandCHANGELOG.md.chore(deps): dev tooling update, Node 24
@wordpress/env10 → 11,@wordpress/scripts31 → 36,release-it19 → 21 and@release-it/conventional-changelog10 → 12, and regenerates the lockfile.Tests
_blank+ rel, case-insensitivity, each allowed value, and dropped invalid/XSS values. 43 tests, all passing.coderabbit review --committed --base master: 0 findings.Not released. Before cutting the next version: get the CVE ID for the bs_tcontent stored XSS (being requested from MITRE) and add it to the 3.4.6 changelog entry next to Andrew Herd's credit.
🤖 Generated with Claude Code