Bump the production-dependencies group with 14 updates

[dependabot]

Bumps the production-dependencies group with 14 updates:

Package	From	To
kinsta/kinsta-mu-plugins	3.1.1	3.6.1
wpackagist-plugin/limit-login-attempts-reloaded	3.2.0	3.3.4
generoi/advanced-custom-fields-pro	6.8.0.1	6.8.7
generoi/gravityforms	2.10.4	3.0.2
generoi/polylang-pro	3.8.2	3.8.6
wpackagist-plugin/wordpress-seo	27.4	28.2
wpackagist-plugin/google-tag-manager	1.0.3	1.0.4
wpackagist-plugin/woocommerce	10.9.1	11.0.0
generoi/genero-cmp	2.2.2	2.2.3
generoi/wp-image-resizer	1.5.1	1.5.2
spatie/laravel-csp	3.25.1	3.26.0
generoi/sage-cachetags	2.5.1	2.5.3
generoi/gds-assistant	0.1.16	0.5.0
wpackagist-plugin/redirection	5.8.0	5.9.0

Updates kinsta/kinsta-mu-plugins from 3.1.1 to 3.6.1

Commits

• 71bf69d v3.6.1
• 16ff74c v3.6.0
• 9169da0 Update composer.json
• See full diff in compare view

Updates wpackagist-plugin/limit-login-attempts-reloaded from 3.2.0 to 3.3.4

Updates generoi/advanced-custom-fields-pro from 6.8.0.1 to 6.8.7

Release notes

Sourced from generoi/advanced-custom-fields-pro's releases.

v6.8.7

Release Date 4th August 2026

• Security - ACF Image and Gallery fields now enforce server-side validation to accept only image files
• Security - The path attribute of registered ACF Blocks is now protected from being overridden by client-supplied block data
• Security - ACF's acf_encrypt() and acf_decrypt() helpers now authenticate encrypted values with an HMAC and no longer fall back to base64 encoding when OpenSSL is unavailable
• Security - ACF's comment, user, and options page form save handlers now only save values for fields whose field groups are assigned to the current save context
• Security - The Post Object, Page Link, and Relationship field AJAX search queries now enforce WordPress read permissions, preventing unauthenticated visitors from seeing non-public post statuses or post types
• Security - The User field now returns only user IDs in REST API responses to requesters without the list_users capability, preventing unauthenticated visitors from seeing user email addresses

v6.8.6

Release Date 14th July 2026

• Fix - Google Maps field values are no longer double-encoded when saved in an ACF block
• Fix - Inserting a Link field value in the Classic Editor no longer triggers validation for other required fields before the post is saved
• Fix - Auto Inline Editing blocks no longer return truthy placeholder strings for empty field values fetched from a different post inside the block render template
• Fix - ACF Blocks (V2 and V3) no longer crash when rendering an oEmbed field whose title begins with [ or {
• Fix - Field group location rules without a location value no longer cause PHP warnings on page load
• Fix - The appearance of the URL, Number, and Select fields has been improved on WordPress 7.0+
• Fix - ACF fields now save on WooCommerce orders when using HPOS in compatibility mode

v6.8.5

Release Date 30th June 2026

• Security - ACF PRO's save handler for WooCommerce order fields now verifies security nonces and only attaches on the order edit screen, preventing unauthenticated field value updates for stores utilizing HPOS
• Security - The Flexible Content "Rename Layout" modal no longer allows for the execution of a potential stored XSS vulnerability
• Security - A default limit of 1000 has been applied to user-contributed choices for Checkbox, Radio, and Select fields to improve security, with a new acf/fields/max_appended_choices filter available for customization
• Security - Special characters within LIKE patterns are now fully escaped in wp_options queries via $wpdb->esc_like()

v6.8.4

Release Date 10th June 2026

• Security - ACF AJAX field handlers now validate that the request nonce was created for the expected field type
• Enhancement - ACF PRO now satisfies plugin dependencies declared against advanced-custom-fields, so plugins requiring ACF can activate when only ACF PRO is installed
• Enhancement - acf_inline_toolbar_editing_attrs() now accepts a return_array argument that returns the attributes as an escaped array suitable for use with wp_get_attachment_image()
• Fix - acf_form() with 'post_id' => 'new_post' and a fields list of field names no longer fatal errors when acf_form_head() runs before WordPress's main query is built
• Fix - Multiple acf_form() calls wrapped inside a single outer <form> tag with one submit button no longer silently drop field values, post_title, or post_content from the non-last forms
• Fix - Duplicating a V3 block with identical attributes no longer displays corrupted preview content in the duplicate
• Fix - Switching between tabs containing WYSIWYG fields no longer leaves the admin menu pinned against a shorter page, which could lock page scroll

v6.8.3

Release Date 2nd June 2026

... (truncated)

Commits

• eaa1581 v6.8.7
• a00b674 v6.8.6
• 3157a8d v6.8.5
• de8e03a v6.8.4
• 8205752 v6.8.3
• d84d036 v6.8.2
• e52f7f1 v6.8.1
• See full diff in compare view

Updates generoi/gravityforms from 2.10.4 to 3.0.2

Release notes

Sourced from generoi/gravityforms's releases.

v3.0.2

• Fixed an issue where Orbital theme styles were reset on the Save & Continue page when email validation failed on the Send Link form while using the new AJAX submission method.
• Fixed a PHP deprecation warning that appears when showing/hiding the QR code.
• Fixed a PHP fatal error that occurs when the form includes a Phone field that is set to a custom format that no longer exists.
• Fixed an issue where window.gformShowSpinner was not defined in some cases.
• API: Updated gf_apply_filters() and gf_do_action() to attempt to catch throwable PHP errors from hooked callbacks when WP_DEBUG is disabled.

v3.0.1.1

No release notes provided.

v3.0.1

• Fixed console error that occurred when adding a page field to an empty form.
• Fixed an issue where a Phone field that was previously configured to use the "International (formatted)" format can display JSON data in the input when the entry is edited.
• Fixed an issue that causes the International Formatted Phone field to fail validation if it is submitted with a default value.
• Fixed low contrast on focus state radio inputs in settings pages.
• Fixed an issue that sometimes causes the text of the submit button to appear outside the button.
• API: Fixed an issue with GF_Query that could affect sorting when performing an explicit join.

v3.0.0

• Added security enhancements.
• Added a new international variant of the Phone Field.
• Added multiple accessibility improvements to the dashboard.
• Added imaskjs to replace the old jQuery based input mask library for US phone fields and text fields with input mask.
• Added improvements to the honeypot feature.
• Added new gform_text_counter_template filter so that the text counter format can be customized.
• Added several merge tag modifiers for the repeater field: :count to get the number of repeats; :text to get the value without HTML markup; :field_ids= to get only the values of the specified field IDs (separate multiple IDs with a |); and :value to get only the value with no label or HTML markup.
• Added textareaHeight setting to the Paragraph Field and usage notice to all Field Size settings.
• Added total field validation for existing fields.
• Added the gform_state_pre_encode hook, so that add-ons can add additional non-field values to the state before it is encoded.
• Added the gform_enable_repeater_field_button filter to allow enabling the beta Repeater field.
• Added additional logging details to the processing of gf-download links.
• Updated many default form and field settings to be accessible by default on new forms.
• Updated drop-zones in the form editor to indicate when a field cannot be dropped in a specific location.
• Updated form buttons to use <button> elements instead of <input> elements for better accessibility and styling flexibility. It is no longer necessary to use the gform_submit_button filter to change the submit input into a button, and use of that filter might cause unexpected issues.
• Updated form theme/frontend based scripts to load on block editor pages.
• Updated the layout editor so that it doesn't use jQuery UI libraries.
• Updated Save and Continue to use GFFormDisplay::validate_field() with a $context of send-link-submit to validate the send link email field, so the gform_email_field_rejectable_values and gform_field_validation filters are triggered.
• Updated state validation to support additional field types, including fields added by add-ons that extend the GF_Field class.
• Updated the appearance of the Repeater field in the form editor, the frontend, Entry Details page, and in the {all_fields} merge tag output.
• Updated the Dashboard Widget setting to be off by default.
• Updated the datepicker field to use a new datepicker library that is fully accessible and does not rely on jQuery.
• Updated the form submission spinner to display inside the submit button instead of next to it.
• Updated the Gravity Forms block to use the Block API version 3.
• Updated the settings for the Radio, Checkbox, and Multiple Choice fields so that they all have the same settings for displaying vertically, horizontally, and in columns.
• Updated the accessibility settings for the Submit and Page Navigation buttons when the button type is set to Image.
• Updated the location and naming of the Choice Layout settings for the Radio, Checkbox, and Multiple Choice fields.

... (truncated)

Commits

• 70e822e v3.0.2
• 03d5e43 v3.0.1.1
• 8d1cfbd v3.0.1
• 0685ec7 v3.0.0
• fa154d1 v2.10.5
• See full diff in compare view

Updates generoi/polylang-pro from 3.8.2 to 3.8.6

Commits

• 6bb0c71 v3.8.6
• a921cd7 v3.8.5
• cd2e1db v3.8.4
• 1cb6173 v3.8.3
• See full diff in compare view

Updates wpackagist-plugin/wordpress-seo from 27.4 to 28.2

Updates wpackagist-plugin/google-tag-manager from 1.0.3 to 1.0.4

Updates wpackagist-plugin/woocommerce from 10.9.1 to 11.0.0

Updates generoi/genero-cmp from 2.2.2 to 2.2.3

Release notes

Sourced from generoi/genero-cmp's releases.

v2.2.3

• Unblock consent-gated content on consent change without a page reload
• Fix null array offset access in the YouTube embed render filter

Commits

• 74f9bd1 Fix null array offset access in youtube embed render filter
• 279b1c6 unblock consent-gated content on consent change without page reload
• See full diff in compare view

Updates generoi/wp-image-resizer from 1.5.1 to 1.5.2

Release notes

Sourced from generoi/wp-image-resizer's releases.

v1.5.2

Fix: make data-sizes="auto" object-fit aware (#3)

Lazyloaded images using data-sizes="auto" resolved sizes from the element's offsetWidth. For images rendered with object-fit: cover or object-fit: contain (e.g. fill images in core/media-text blocks), the painted image is scaled to a box with a different aspect ratio, so the box width underestimated the pixels actually needed and the browser picked a too-small, blurry srcset candidate.

Now the effective width is derived from the box dimensions and the image's intrinsic aspect ratio (read from width/height attributes so it works before decode):

• fill/none → uses offsetWidth (unchanged)
• cover → max(offsetWidth, offsetHeight * aspectRatio)
• contain → min(offsetWidth, offsetHeight * aspectRatio)

This fixes blurry object-fit fill images out of the box without per-theme sizes/skip-lazyload workarounds.

Commits

• ecc47a7 Make data-sizes="auto" object-fit aware (#3)
• See full diff in compare view

Updates spatie/laravel-csp from 3.25.1 to 3.26.0

Release notes

Sourced from spatie/laravel-csp's releases.

3.26.0

What's Changed

• Add a There There preset by @​freekmurze in spatie/laravel-csp#213
• Drop roave/security-advisories to unblock CI by @​freekmurze in spatie/laravel-csp#214

Full Changelog: spatie/laravel-csp@3.25.1...3.26.0

Changelog

Sourced from spatie/laravel-csp's changelog.

3.26.0 - 2026-06-26

What's Changed

• Add a There There preset by @​freekmurze in spatie/laravel-csp#213
• Drop roave/security-advisories to unblock CI by @​freekmurze in spatie/laravel-csp#214

Full Changelog: spatie/laravel-csp@3.25.1...3.26.0

Commits

• 4e0e029 Merge pull request #213 from freekmurze/add-there-there-preset
• 2e9477b Merge remote-tracking branch 'origin/main' into add-there-there-preset
• 66ccc0c Merge pull request #214 from spatie/fix-roave-security-advisories-conflict
• df96cae Drop roave/security-advisories to unblock CI
• 8b81ea2 Add a There There preset
• 2a7c154 Update CHANGELOG
• See full diff in compare view

Updates generoi/sage-cachetags from 2.5.1 to 2.5.3

Release notes

Sourced from generoi/sage-cachetags's releases.

v2.5.3

What's Changed

• Fix PHP warnings from production logs by @​oxyc in generoi/sage-cachetags#13

Full Changelog: generoi/sage-cachetags@v2.5.2...v2.5.3

v2.5.2

Fix

Create the cache_tags table for newly added multisite subsites.

The activation hook only provisions sites that exist at activation time, so subsites created later never got their cache_tags table. The plugin now listens for wp_initialize_site and creates the table in the new site's context.

See #12.

Commits

• 6b35e41 Fix PHP warnings from production logs (#13)
• 11e7910 create cache tags table for newly added multisite subsites
• See full diff in compare view

Updates generoi/gds-assistant from 0.1.16 to 0.5.0

Release notes

Sourced from generoi/gds-assistant's releases.

v0.5.0 — Tool-call grouping, retry button, TypeScript migration

Features

• Collapse runs of identical tool calls into a single group in the chat UI, reducing noise when a tool is invoked repeatedly. (#55)
• Per-tool Retry button on errored client tool calls — re-run a failed tool without restarting the turn. (#38)

Fixes

• SSE parser no longer drops large events when a chunk boundary lands between an event's header and its data.

Internal

• TypeScript migration completed across components, hooks, editor/selection, the runtime adapter, and editor-bridge; TS toolchain enabled. (#47–#54)
• ESLint warnings cleared and JSX lint enabled. (#36, #51)
• PHPStan level raised 5 → 6 with baselines burned to 0 across Llm, Bridge, storage, credentials, providers, and compression. (#40–#46)
• Broader test coverage on the SSE parser, MessageLoop token accounting, and providers. (#37)

Full changelog: generoi/gds-assistant@v0.4.3...v0.5.0

v0.4.3 — Foundation: PHPStan, security hardening, SSE parser + modal carve

No-behaviour-change maintenance release. Four small waves of cleanup that make the next round of feature work safer to touch.

Foundation (CI)

• PHPStan level 5 added to the lint job, 52 pre-existing errors fixed (return-type narrowing on ToolProviderInterface::getTools, dead is_wp_error checks, ?? new \stdClass precedence). Builds now fail on new static-analysis regressions.
• Jest wired up for client-side helpers; first suite covers editor/diff.js (17 tests).

Security hardening

• Prompt-injection defence on selection context. ChatEndpoint::buildSelectionPreamble now strips control characters and wraps user-selected text in a labelled tilde fence so block content can't smuggle instructions into the system prompt path.
• Try/finally on temp files in ImageGenerationToolProvider::sideloadBinary — orphan files no longer accumulate when the sideload fails mid-flight.

SSE parser consolidation

• Extracted SseStreamReader (131 LOC) — every streaming provider was hand-rolling the same curl + line-buffered data: parser. Anthropic/OpenAI-compatible/Gemini now delegate, shedding ~150 LOC of duplication.
• Fixed a real precedence bug in Gemini's mime-type guess ('image/' . pathinfo(...) ?: 'jpeg' defaulted to the whole string when no extension was present).

assistant-modal.jsx carve-up

• 2577 LOC → 778 LOC (−70%) split across 8 focused modules: MicButton, ReadAloudController, UndoContext, ToolCallFallback, Messages, Composer, SidePanels, skills-cache. Render order, hook order, and ref identities preserved end-to-end; verified by manual smoke (list → edit → undo) on generogrowth.

Misc

• Plugin::polylangVoiceLanguages bare catch replaced with logged \Throwable catch (was hiding silent failures).
• MessageLoop token accumulators now cast through (int) so providers returning numeric strings can't poison the running total.
• new static() → new self() in Plugin::getInstance for tighter typing.

Full changelog: generoi/gds-assistant@v0.4.2...v0.4.3

v0.4.1 — Bug fixes: prompt trusts tool results

Small bug-fix release on top of v0.4.0.

A real session repeatedly re-called gds/forms-read for the same form, writing "didn't return the full details" each time, even though every return contained all 10 fields. The model was treating long JSON returns as "incomplete".

Fix

• SystemPrompt: new "Trusting tool results" block — the JSON return IS the full result; truncation is always explicit (truncated: true flag or a stated "first N items" note); if a list result is missing an item the user expects, check whether default filters hide it (e.g. gds/forms-list defaults to active + non-trashed — pass include_inactive / include_trashed) before assuming the item is gone.

Companion to gds-mcp v0.5.0 which adds the filter inputs and fixes the silent restoreForm bug.

... (truncated)

Commits

• 4ea21bd fix(chat): SSE parser drops large events when chunk boundary lands between he...
• 25aed07 feat(chat): collapse runs of identical tool calls into a group (#55)
• 62cc3f0 chore(ts): finish the TypeScript migration (#54)
• 982ac13 chore(ts): migrate remaining hooks + editor/selection to TypeScript (#53)
• 00f57b6 chore(ts): migrate all components/ to TypeScript (#52)
• f16bd83 chore(lint): clear all ESLint warnings across components + TS files (#51)
• 17d3078 chore(ts): migrate use-runtime-adapter to TypeScript (#50)
• c24b34a chore(ts): add shared types/runtime.ts module (#49)
• 151e9ff chore(ts): migrate editor-bridge to TypeScript (#48)
• 22d6023 chore(ts): enable TypeScript toolchain + migrate UndoContext as smoke test (#47)
• Additional commits viewable in compare view

Updates wpackagist-plugin/redirection from 5.8.0 to 5.9.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions