From a979b40903f92715380f6dd1bf3ab81a8e71ae0e Mon Sep 17 00:00:00 2001
From: lucadobrescu <soare.robert.daniel@protonmail.com>
Date: Tue, 18 Aug 2026 11:38:18 +0300
Subject: [PATCH 01/25] fix: guard widgets CSS writability check against
 missing WP_Filesystem() (#2938)

CSS_Handler::is_writable() called WP_Filesystem() before its
function_exists() fallback, so a frontend request with an active
sidebar and no generated widget stylesheet fataled with
"Call to undefined function WP_Filesystem()" when the include did
not expose the function. Run the guard first so the request degrades
to the inline widget CSS fallback, and verify the initialized
$wp_filesystem instance before reading its method.

Adds an isolated-process PHPUnit regression test and a frontend e2e
spec covering the blocked-filesystem fallback and the written-file
path.

Fixes #2937

Co-authored-by: Luca Dobrescu <luca.dobrescu@vertistudio.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .wp-env.json                                  |   5 +-
 inc/css/class-css-handler.php                 |   9 +-
 .../mu-plugins/otter-e2e-bootstrap.php        | 167 ++++++++++++++++++
 .../e2e/blocks/widgets-css-frontend.spec.js   |  94 ++++++++++
 src/blocks/test/e2e/fixtures.ts               |  15 ++
 src/blocks/test/e2e/playwright.config.js      |   5 +-
 tests/php/is-writable-sandbox.php             |  65 +++++++
 tests/test-css-handler.php                    |  50 ++++++
 8 files changed, 403 insertions(+), 7 deletions(-)
 create mode 100644 src/blocks/test/e2e/blocks/widgets-css-frontend.spec.js
 create mode 100644 tests/php/is-writable-sandbox.php
 create mode 100644 tests/test-css-handler.php

diff --git a/.wp-env.json b/.wp-env.json
index ecc59bbe2..baf5a856f 100644
--- a/.wp-env.json
+++ b/.wp-env.json
@@ -6,7 +6,10 @@
     ".",
     "https://downloads.wordpress.org/plugin/ai-provider-for-openai.zip"
   ],
-  "themes": [ "./test/emptytheme" ],
+  "themes": [
+    "./test/emptytheme",
+    "https://downloads.wordpress.org/theme/twentytwentyone.zip"
+  ],
   "config": {
     "WP_DEBUG": true,
     "WP_DEBUG_LOG": true,
diff --git a/inc/css/class-css-handler.php b/inc/css/class-css-handler.php
index db96b5832..41afb4ecd 100644
--- a/inc/css/class-css-handler.php
+++ b/inc/css/class-css-handler.php
@@ -496,18 +496,17 @@ public static function save_widgets_styles() {
 	public static function is_writable() {
 		global $wp_filesystem;
 		include_once ABSPATH . 'wp-admin/includes/file.php';
-		WP_Filesystem();
-
-		$wp_upload_dir = wp_upload_dir( null, false );
-		$upload_dir    = $wp_upload_dir['basedir'];
 
 		if ( ! function_exists( 'WP_Filesystem' ) ) {
 			return false;
 		}
 
+		$wp_upload_dir = wp_upload_dir( null, false );
+		$upload_dir    = $wp_upload_dir['basedir'];
+
 		$writable = WP_Filesystem( false, $upload_dir );
 
-		return $writable && 'direct' === $wp_filesystem->method;
+		return $writable && $wp_filesystem instanceof \WP_Filesystem_Base && 'direct' === $wp_filesystem->method;
 	}
 
 	/**
diff --git a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
index 882241e0a..6288186ff 100644
--- a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
+++ b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
@@ -94,6 +94,19 @@
  */
 const OPENAI_STUB_OPTION = 'otter_e2e_openai_stub';
 
+/**
+ * When truthy, get_filesystem_method() reports a bogus method so WP_Filesystem()
+ * fails to initialize. Simulates hosts where the filesystem API is unavailable
+ * on the frontend (issue #2937) — CSS_Handler::is_writable() must degrade to
+ * `false` and the widgets CSS must fall back to an inline <style>.
+ */
+const FS_BLOCKED_OPTION = 'otter_e2e_fs_blocked';
+
+/**
+ * Numeric index used for the seeded block widget instance (widget id `block-999`).
+ */
+const WIDGET_SEED_INDEX = 999;
+
 /**
  * Form record post type, mirrored from \ThemeIsle\GutenbergBlocks\Plugins\Form_Submissions.
  */
@@ -941,6 +954,104 @@ function stub_captcha_http_verification_for_e2e( $preempt, $request, $url ) {
 
 add_filter( 'pre_http_request', __NAMESPACE__ . '\\stub_captcha_http_verification_for_e2e', 10, 3 );
 
+/**
+ * Report an unknown filesystem method while the fs-blocked scenario is active.
+ *
+ * WP_Filesystem() then fails to locate the abstraction class file and bails out
+ * without initializing `$wp_filesystem`, which is the closest reproducible
+ * stand-in for the production condition behind issue #2937.
+ *
+ * @param string $method Detected filesystem method.
+ * @return string
+ */
+function block_filesystem_method_for_e2e( $method ) {
+	return get_option( FS_BLOCKED_OPTION ) ? 'otter_e2e_blocked' : $method;
+}
+
+add_filter( 'filesystem_method', __NAMESPACE__ . '\\block_filesystem_method_for_e2e', PHP_INT_MAX );
+
+/**
+ * Seed a classic-widgets sidebar with an Otter block so the frontend
+ * widgets-CSS path (Block_Frontend::enqueue_widgets_css) is exercised.
+ *
+ * Clears the generated-stylesheet options so the next frontend request takes
+ * the "no CSS file yet" branch that calls CSS_Handler::is_writable().
+ *
+ * @param string $sidebar_id Sidebar to place the widget in.
+ * @return void
+ */
+function seed_otter_widget( $sidebar_id ) {
+	$markup = '<!-- wp:themeisle-blocks/progress-bar {"id":"wp-block-themeisle-blocks-progress-bar-e2e2937","title":"E2E Progress","percentage":75,"titleColor":"#123abc","height":36} -->' . "\n" .
+		'<div id="wp-block-themeisle-blocks-progress-bar-e2e2937" class="wp-block-themeisle-blocks-progress-bar"><div class="wp-block-themeisle-blocks-progress-bar__title">E2E Progress</div><div class="wp-block-themeisle-blocks-progress-bar__area"><div class="wp-block-themeisle-blocks-progress-bar__area__bar"></div></div></div>' . "\n" .
+		'<!-- /wp:themeisle-blocks/progress-bar -->';
+
+	$widget_blocks = get_option( 'widget_block', array() );
+
+	if ( ! is_array( $widget_blocks ) ) {
+		$widget_blocks = array();
+	}
+
+	$widget_blocks[ WIDGET_SEED_INDEX ] = array( 'content' => $markup );
+	$widget_blocks['_multiwidget']      = 1;
+	update_option( 'widget_block', $widget_blocks );
+
+	$sidebars = get_option( 'sidebars_widgets', array() );
+
+	if ( ! is_array( $sidebars ) ) {
+		$sidebars = array();
+	}
+
+	$existing = isset( $sidebars[ $sidebar_id ] ) && is_array( $sidebars[ $sidebar_id ] ) ? $sidebars[ $sidebar_id ] : array();
+
+	$sidebars[ $sidebar_id ] = array_values( array_unique( array_merge( array( 'block-' . WIDGET_SEED_INDEX ), $existing ) ) );
+	update_option( 'sidebars_widgets', $sidebars );
+
+	delete_option( 'themeisle_blocks_widgets_css_file' );
+	delete_option( 'themeisle_blocks_widgets_css' );
+	delete_option( 'themeisle_blocks_widgets_fonts' );
+}
+
+/**
+ * Remove the seeded widget and every widgets-CSS artifact it produced.
+ *
+ * @return void
+ */
+function cleanup_otter_widget() {
+	$widget_blocks = get_option( 'widget_block', array() );
+
+	if ( is_array( $widget_blocks ) && isset( $widget_blocks[ WIDGET_SEED_INDEX ] ) ) {
+		unset( $widget_blocks[ WIDGET_SEED_INDEX ] );
+		update_option( 'widget_block', $widget_blocks );
+	}
+
+	$sidebars = get_option( 'sidebars_widgets', array() );
+
+	if ( is_array( $sidebars ) ) {
+		foreach ( $sidebars as $sidebar_id => $widgets ) {
+			if ( is_array( $widgets ) ) {
+				$sidebars[ $sidebar_id ] = array_values( array_diff( $widgets, array( 'block-' . WIDGET_SEED_INDEX ) ) );
+			}
+		}
+		update_option( 'sidebars_widgets', $sidebars );
+	}
+
+	$file_name = get_option( 'themeisle_blocks_widgets_css_file' );
+
+	if ( $file_name ) {
+		$wp_upload_dir = wp_upload_dir( null, false );
+		$file_path     = $wp_upload_dir['basedir'] . '/themeisle-gutenberg/' . $file_name . '.css';
+
+		if ( is_file( $file_path ) ) {
+			wp_delete_file( $file_path );
+		}
+	}
+
+	delete_option( 'themeisle_blocks_widgets_css_file' );
+	delete_option( 'themeisle_blocks_widgets_css' );
+	delete_option( 'themeisle_blocks_widgets_fonts' );
+	delete_option( FS_BLOCKED_OPTION );
+}
+
 add_action(
 	'rest_api_init',
 	function () {
@@ -1226,6 +1337,61 @@ function () {
 			)
 		);
 
+		register_rest_route(
+			REST_NAMESPACE,
+			'/filesystem',
+			array(
+				'methods'             => \WP_REST_Server::CREATABLE,
+				'permission_callback' => __NAMESPACE__ . '\\require_admin',
+				'callback'            => function ( \WP_REST_Request $request ) {
+					$mode = $request->get_param( 'mode' );
+
+					if ( ! in_array( $mode, array( 'blocked', 'ok' ), true ) ) {
+						return new \WP_Error(
+							'otter_e2e_invalid_fs_mode',
+							'Mode must be "blocked" or "ok".',
+							array( 'status' => 400 )
+						);
+					}
+
+					if ( 'blocked' === $mode ) {
+						update_option( FS_BLOCKED_OPTION, true, false );
+					} else {
+						delete_option( FS_BLOCKED_OPTION );
+					}
+
+					return rest_ensure_response( array( 'ok' => true ) );
+				},
+			)
+		);
+
+		register_rest_route(
+			REST_NAMESPACE,
+			'/widgets/seed',
+			array(
+				'methods'             => \WP_REST_Server::CREATABLE,
+				'permission_callback' => __NAMESPACE__ . '\\require_admin',
+				'callback'            => function ( \WP_REST_Request $request ) {
+					$sidebar_id = $request->get_param( 'sidebar' );
+					seed_otter_widget( is_string( $sidebar_id ) && '' !== $sidebar_id ? $sidebar_id : 'sidebar-1' );
+					return rest_ensure_response( array( 'ok' => true ) );
+				},
+			)
+		);
+
+		register_rest_route(
+			REST_NAMESPACE,
+			'/widgets/cleanup',
+			array(
+				'methods'             => \WP_REST_Server::CREATABLE,
+				'permission_callback' => __NAMESPACE__ . '\\require_admin',
+				'callback'            => function () {
+					cleanup_otter_widget();
+					return rest_ensure_response( array( 'ok' => true ) );
+				},
+			)
+		);
+
 		register_rest_route(
 			REST_NAMESPACE,
 			'/reset',
@@ -1249,6 +1415,7 @@ function () {
 					delete_option( MAIL_LOG_OPTION );
 					delete_option( CAPTCHA_MODE_OPTION );
 					delete_option( OPENAI_STUB_OPTION );
+					delete_option( FS_BLOCKED_OPTION );
 					cleanup_form_records();
 					return rest_ensure_response( array( 'ok' => true ) );
 				},
diff --git a/src/blocks/test/e2e/blocks/widgets-css-frontend.spec.js b/src/blocks/test/e2e/blocks/widgets-css-frontend.spec.js
new file mode 100644
index 000000000..196ccff5f
--- /dev/null
+++ b/src/blocks/test/e2e/blocks/widgets-css-frontend.spec.js
@@ -0,0 +1,94 @@
+/**
+ * Internal dependencies
+ */
+import { test, expect } from '../fixtures';
+
+/**
+ * Frontend widgets-CSS coverage for https://github.com/Codeinwp/otter-blocks/issues/2937.
+ *
+ * A frontend request with an active sidebar and no generated widget stylesheet
+ * reaches CSS_Handler::is_writable() from Block_Frontend::enqueue_widgets_css()
+ * at wp_footer. In production that request fataled when WP_Filesystem() was
+ * unavailable. The exact missing-function condition can only be recreated in
+ * the isolated PHPUnit sandbox (tests/test-css-handler.php); here the
+ * filesystem is blocked at the get_filesystem_method() level, which drives the
+ * same is_writable() → false branch and asserts the user-visible contract: the
+ * page must finish rendering and serve the widget CSS inline.
+ *
+ * Serial project: switches the active theme and mutates site-wide widget,
+ * option, and filesystem state.
+ */
+
+const WIDGET_SELECTOR = '.wp-block-themeisle-blocks-progress-bar';
+const WIDGET_CSS_ID = '#wp-block-themeisle-blocks-progress-bar-e2e2937';
+
+test.describe( 'Widgets CSS frontend', () => {
+	test.beforeAll( async({ requestUtils }) => {
+		// Classic theme with a registered sidebar; block themes register none,
+		// so the widgets-CSS path is unreachable on the default theme.
+		await requestUtils.activateTheme( 'twentytwentyone' );
+
+		await requestUtils.rest({
+			method: 'POST',
+			path: '/otter-e2e/v1/widgets/seed'
+		});
+	});
+
+	test.afterAll( async({ requestUtils }) => {
+		await requestUtils.rest({
+			method: 'POST',
+			path: '/otter-e2e/v1/widgets/cleanup'
+		});
+
+		await requestUtils.activateTheme( 'twentytwentythree' );
+	});
+
+	test( 'completes the page with inline widget CSS when the filesystem is unavailable', async({ page, otterUtils }) => {
+		await otterUtils.setFilesystemMode( 'blocked' );
+
+		try {
+			// Take the no-stylesheet branch on a fresh request.
+			await otterUtils.seedOtterWidget();
+
+			const response = await page.goto( '/' );
+
+			expect( response.status() ).toBe( 200 );
+
+			// The widget itself rendered inside the sidebar.
+			await expect( page.locator( WIDGET_SELECTOR ) ).toBeVisible();
+
+			const content = await page.content();
+
+			// The inline <style> fallback is echoed at wp_footer, after the
+			// is_writable() call that used to fatal — its presence proves the
+			// request completed past the crash point.
+			expect( content ).toContain( WIDGET_CSS_ID );
+			expect( content ).toContain( '--percentage' );
+			expect( content ).not.toContain( 'Fatal error' );
+
+			// No stylesheet file could be written, so none may be enqueued.
+			await expect( page.locator( 'link#otter-widgets-css' ) ).toHaveCount( 0 );
+		} finally {
+			await otterUtils.setFilesystemMode( 'ok' );
+		}
+	});
+
+	test( 'writes and enqueues the widgets CSS file when the filesystem is available', async({ page, otterUtils }) => {
+		await otterUtils.setFilesystemMode( 'ok' );
+
+		// Fresh no-stylesheet state; this request regenerates and saves the file.
+		await otterUtils.seedOtterWidget();
+
+		await page.goto( '/' );
+		await expect( page.locator( WIDGET_SELECTOR ) ).toBeVisible();
+
+		// The file was written during the previous request; this one enqueues it.
+		await page.reload();
+
+		await expect( page.locator( WIDGET_SELECTOR ) ).toBeVisible();
+
+		const stylesheet = page.locator( 'link#otter-widgets-css' );
+		await expect( stylesheet ).toHaveCount( 1 );
+		await expect( stylesheet ).toHaveAttribute( 'href', /themeisle-gutenberg\/widgets-/ );
+	});
+});
diff --git a/src/blocks/test/e2e/fixtures.ts b/src/blocks/test/e2e/fixtures.ts
index d9e2f5a2e..dd13ff773 100644
--- a/src/blocks/test/e2e/fixtures.ts
+++ b/src/blocks/test/e2e/fixtures.ts
@@ -58,6 +58,18 @@ export type OtterUtils = {
 	/** Mint a `form-verification` nonce for API-driven submissions. */
 	getFormVerificationNonce: () => Promise<string>;
 
+	/**
+	 * 'blocked' makes get_filesystem_method() report a bogus method so
+	 * WP_Filesystem() fails to initialize (issue #2937 scenario); 'ok' restores it.
+	 */
+	setFilesystemMode: ( mode: 'blocked' | 'ok' ) => Promise<unknown>;
+
+	/** Seed a classic sidebar with an Otter block widget and clear the generated widgets-CSS options. */
+	seedOtterWidget: ( sidebar?: string ) => Promise<unknown>;
+
+	/** Remove the seeded widget, its CSS file/options, and the filesystem block. */
+	cleanupOtterWidget: () => Promise<unknown>;
+
 	/** All stored Submission Records with their Delivery Status meta. */
 	getFormRecords: () => Promise<FormRecord[]>;
 
@@ -90,6 +102,9 @@ export const test = base.extend<{ otterUtils: OtterUtils }>({
 				const response = ( await call( 'form/nonce' ) ) as { nonce: string };
 				return response.nonce;
 			},
+			setFilesystemMode: ( mode ) => call( 'filesystem', { mode }),
+			seedOtterWidget: ( sidebar ) => call( 'widgets/seed', sidebar ? { sidebar } : undefined ),
+			cleanupOtterWidget: () => call( 'widgets/cleanup' ),
 			getFormRecords: () => call( 'form/records' ) as Promise<FormRecord[]>,
 			cleanupFormRecords: () => call( 'form/records/cleanup' )
 		});
diff --git a/src/blocks/test/e2e/playwright.config.js b/src/blocks/test/e2e/playwright.config.js
index cac9dd4c7..78823c080 100644
--- a/src/blocks/test/e2e/playwright.config.js
+++ b/src/blocks/test/e2e/playwright.config.js
@@ -57,7 +57,10 @@ const SERIAL_SPECS = [
 	'**/blocks/design-library.spec.js',
 
 	// Flips the site-wide atomic-wind blocks option.
-	'**/blocks/atomic-wind-list-view.spec.js'
+	'**/blocks/atomic-wind-list-view.spec.js',
+
+	// Switches the active theme and mutates site-wide widget + filesystem state.
+	'**/blocks/widgets-css-frontend.spec.js'
 ];
 
 const config = defineConfig({
diff --git a/tests/php/is-writable-sandbox.php b/tests/php/is-writable-sandbox.php
new file mode 100644
index 000000000..6899d1fc6
--- /dev/null
+++ b/tests/php/is-writable-sandbox.php
@@ -0,0 +1,65 @@
+<?php
+/**
+ * Standalone sandbox for CSS_Handler::is_writable() regression testing.
+ *
+ * Simulates the production condition from
+ * https://github.com/Codeinwp/otter-blocks/issues/2937: the request includes
+ * wp-admin/includes/file.php, but WP_Filesystem() is still undefined
+ * afterwards. is_writable() must return false instead of raising an uncaught
+ * "Call to undefined function WP_Filesystem()" error.
+ *
+ * Run in a separate PHP process (no WordPress loaded):
+ *   php is-writable-sandbox.php
+ *
+ * @package gutenberg-blocks
+ */
+
+error_reporting( E_ALL ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting, WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_error_reporting
+
+$plugin_dir = dirname( dirname( __DIR__ ) );
+
+// Fake ABSPATH whose wp-admin/includes/file.php does NOT define WP_Filesystem().
+$fake_abspath = rtrim( sys_get_temp_dir(), '/\\' ) . '/otter-2937-fake-wp-' . getmypid() . '/';
+
+if ( ! is_dir( $fake_abspath . 'wp-admin/includes' ) ) {
+	mkdir( $fake_abspath . 'wp-admin/includes', 0777, true );
+}
+
+file_put_contents( // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_file_put_contents
+	$fake_abspath . 'wp-admin/includes/file.php',
+	"<?php // Intentionally empty: simulates WP_Filesystem() remaining unavailable after the include.\n"
+);
+
+define( 'ABSPATH', $fake_abspath );
+
+/**
+ * Minimal stub of wp_upload_dir() used by CSS_Handler::is_writable().
+ *
+ * @param string|null $time Ignored.
+ * @param bool        $create_dir Ignored.
+ * @return array Upload dir data.
+ */
+function wp_upload_dir( $time = null, $create_dir = true ) {
+	return array(
+		'basedir' => sys_get_temp_dir(),
+		'baseurl' => 'http://example.org/wp-content/uploads',
+	);
+}
+
+/**
+ * No-op stub so class files can be loaded outside WordPress.
+ */
+function add_action() {}
+
+/**
+ * No-op stub so class files can be loaded outside WordPress.
+ */
+function add_filter() {}
+
+require $plugin_dir . '/inc/class-base-css.php';
+require $plugin_dir . '/inc/css/class-css-handler.php';
+
+$result = \ThemeIsle\GutenbergBlocks\CSS\CSS_Handler::is_writable();
+
+echo 'RESULT:' . var_export( $result, true ) . "\n"; // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_var_export
+echo "REQUEST COMPLETED WITHOUT FATAL\n";
diff --git a/tests/test-css-handler.php b/tests/test-css-handler.php
new file mode 100644
index 000000000..1872d0dcf
--- /dev/null
+++ b/tests/test-css-handler.php
@@ -0,0 +1,50 @@
+<?php
+/**
+ * Class Test_CSS_Handler
+ *
+ * @package gutenberg-blocks
+ */
+
+use ThemeIsle\GutenbergBlocks\CSS\CSS_Handler;
+
+/**
+ * CSS_Handler filesystem tests.
+ *
+ * Regression coverage for https://github.com/Codeinwp/otter-blocks/issues/2937 —
+ * a frontend request fataled with "Call to undefined function WP_Filesystem()"
+ * because is_writable() called WP_Filesystem() before checking it exists.
+ */
+class Test_CSS_Handler extends WP_UnitTestCase {
+
+	/**
+	 * is_writable() must not fatal when WP_Filesystem() stays undefined after
+	 * including wp-admin/includes/file.php; it must fall back to `false` so the
+	 * frontend can use the inline CSS fallback.
+	 *
+	 * The scenario is impossible to create inside the loaded test environment
+	 * (WP_Filesystem() already exists), so the class is exercised in a separate
+	 * PHP process against a fake ABSPATH whose file.php defines nothing.
+	 */
+	public function test_is_writable_returns_false_when_wp_filesystem_is_unavailable() {
+		$sandbox = __DIR__ . '/php/is-writable-sandbox.php';
+
+		$command = escapeshellarg( PHP_BINARY ) . ' -d display_errors=1 ' . escapeshellarg( $sandbox ) . ' 2>&1';
+
+		exec( $command, $output, $exit_code ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.system_calls_exec
+
+		$output = implode( "\n", $output );
+
+		$this->assertSame( 0, $exit_code, 'The sandbox request fataled instead of degrading gracefully: ' . $output );
+		$this->assertStringContainsString( 'RESULT:false', $output, 'is_writable() should return false when WP_Filesystem() is unavailable: ' . $output );
+		$this->assertStringContainsString( 'REQUEST COMPLETED WITHOUT FATAL', $output );
+		$this->assertStringNotContainsString( 'Call to undefined function', $output );
+	}
+
+	/**
+	 * Sanity check: in a normal environment with a direct filesystem,
+	 * is_writable() still reports the upload dir as writable.
+	 */
+	public function test_is_writable_returns_true_in_normal_environment() {
+		$this->assertTrue( CSS_Handler::is_writable() );
+	}
+}

From 30c3217745e84dec7ef3b1256c96ca54941de174 Mon Sep 17 00:00:00 2001
From: lucadobrescu <soare.robert.daniel@protonmail.com>
Date: Tue, 18 Aug 2026 11:38:19 +0300
Subject: [PATCH 02/25] fix: Post Content dynamic value reads the loop globals
 instead of its context post (#2939)

* fix: postContent dynamic tag reads the loop globals instead of its context post

get_the_content() takes the post as its third argument; the context post ID
was passed as the first one ($more_link_text), so $post stayed null and core
fell back to the loop globals. When a theme or plugin leaves those globals
clobbered, post-template.php warns "Undefined array key -1" (plus a
preg_match() deprecation on PHP 8) and the tag renders empty.

Fixes #2929

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test: cover the postContent recursion guard and isolate the e2e fixtures

Addresses the Copilot review on #2939.

The guard in mark_exceptions() is what the get_the_content() argument fix
actually changes: it reads the context post's content to decide whether a
nested postContent tag would recurse. Both mismatch cases are now covered -
a nested tag in the context post must fire the guard, and a nested tag in
the loop-global post must not blank a clean context post. The guard is
asserted directly before rendering because an unfired guard makes
apply_dynamic_content() recurse until the process dies, so the test has to
fail fast instead of hanging.

The e2e spec namespaced its Query Loop search token per run and now deletes
its own post and page in afterAll. wp-env is persistent and the fixed token
had already accumulated twelve records over six local runs, any of which
the perPage:1 loop could resolve instead of the run's own post. Teardown is
best-effort per record so one failed request cannot orphan the others.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Luca Dobrescu <luca.dobrescu@vertistudio.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 inc/plugins/class-dynamic-content.php         |   4 +-
 .../mu-plugins/otter-e2e-bootstrap.php        |  48 +++++
 .../blocks/dynamic-content-frontend.spec.js   |  93 ++++++++++
 tests/test-dynamic-content.php                | 164 ++++++++++++++++++
 4 files changed, 307 insertions(+), 2 deletions(-)
 create mode 100644 src/blocks/test/e2e/blocks/dynamic-content-frontend.spec.js

diff --git a/inc/plugins/class-dynamic-content.php b/inc/plugins/class-dynamic-content.php
index 1924d6474..b782417fd 100644
--- a/inc/plugins/class-dynamic-content.php
+++ b/inc/plugins/class-dynamic-content.php
@@ -545,7 +545,7 @@ public function get_content( $data ) {
 			return '';
 		}
 
-		$content = get_the_content( $data['context'] );
+		$content = get_the_content( null, false, $data['context'] );
 		$content = apply_filters( 'the_content', str_replace( ']]>', ']]&gt;', $content ) );
 		return wp_kses_post( $content );
 	}
@@ -902,7 +902,7 @@ class_exists( '\Neve_Pro\Modules\Custom_Layouts\Module' )
 				if ( ! $post instanceof \WP_Post ) {
 					return $data;
 				}
-				$content = get_the_content( $data['context'] );
+				$content = get_the_content( null, false, $data['context'] );
 				if ( strpos( $content, 'data-type="postContent"' ) ) {
 					$key = $this->get_exception_key( $data, $post->ID );
 					if ( $key ) {
diff --git a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
index 6288186ff..649de761d 100644
--- a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
+++ b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
@@ -754,6 +754,54 @@ function stub_openai_http_for_e2e( $preempt, $parsed_args, $url ) {
 	return stub_openai_http_response( $content );
 }
 
+/**
+ * Issue #2929 rig: with ?otter_e2e_corrupt_pages=1, mimic a theme/plugin that
+ * clobbers the $pages loop global (main templates are included at global scope,
+ * so any template-level $pages variable overwrites it) while Otter evaluates a
+ * dynamic tag, and surface PHP notices in the output so the spec can assert
+ * none are emitted.
+ *
+ * The corruption is scoped to blocks carrying an <o-dynamic> tag and restored
+ * straight after Otter's filter (priority 10): leaving it in place for every
+ * block would make core's own the_content() warn too, which is core behavior
+ * rather than the bug under test.
+ */
+function corrupt_pages_around_dynamic_tags() {
+	if ( is_admin() || ! isset( $_GET['otter_e2e_corrupt_pages'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		return;
+	}
+
+	ini_set( 'display_errors', '1' ); // phpcs:ignore WordPress.PHP.IniSet.display_errors_Disallowed
+
+	$saved = null;
+
+	add_filter(
+		'render_block',
+		function ( $block_content ) use ( &$saved ) {
+			if ( false !== strpos( $block_content, '<o-dynamic' ) ) {
+				$saved            = isset( $GLOBALS['pages'] ) ? $GLOBALS['pages'] : null;
+				$GLOBALS['pages'] = array();
+			}
+			return $block_content;
+		},
+		9
+	);
+
+	add_filter(
+		'render_block',
+		function ( $block_content ) use ( &$saved ) {
+			if ( null !== $saved ) {
+				$GLOBALS['pages'] = $saved;
+				$saved            = null;
+			}
+			return $block_content;
+		},
+		11
+	);
+}
+
+add_action( 'wp', __NAMESPACE__ . '\\corrupt_pages_around_dynamic_tags' );
+
 add_filter( 'pre_wp_mail', __NAMESPACE__ . '\\stub_wp_mail_for_e2e', 10, 2 );
 add_filter( 'pre_http_request', __NAMESPACE__ . '\\stub_openai_http_for_e2e', 10, 3 );
 
diff --git a/src/blocks/test/e2e/blocks/dynamic-content-frontend.spec.js b/src/blocks/test/e2e/blocks/dynamic-content-frontend.spec.js
new file mode 100644
index 000000000..039a42c91
--- /dev/null
+++ b/src/blocks/test/e2e/blocks/dynamic-content-frontend.spec.js
@@ -0,0 +1,93 @@
+/**
+ * WordPress dependencies
+ */
+import { test, expect } from '@wordpress/e2e-test-utils-playwright';
+
+/**
+ * Frontend rendering of the postContent dynamic tag (issue #2929).
+ *
+ * The tag's context post ID used to be passed to get_the_content() as
+ * $more_link_text, so core fell back to the loop globals: a clobbered $pages
+ * global surfaced "Undefined array key -1" from post-template.php and the tag
+ * rendered empty.
+ */
+test.describe( 'Dynamic Content postContent tag', () => {
+
+	// wp-env is persistent, so the fixtures are namespaced per run and torn down
+	// in afterAll: a fixed token would let leftovers from an earlier run (or a
+	// retry) win the Query Loop and make the assertions state-dependent.
+	let token;
+	let targetContent;
+	let pageId;
+
+	// Every record created by this spec, so a retried beforeAll cleans up both
+	// attempts instead of leaking the first one.
+	const created = [];
+
+	test.beforeAll( async({ requestUtils }) => {
+		token         = `frontier2929${ Date.now() }`;
+		targetContent = `Otter dynamic target content ${ token }`;
+
+		// The Query Loop block has no include/post__in arg, so the loop is
+		// scoped to the target post via the run's search token in its title.
+		const target = await requestUtils.createPost({
+			title: `Dynamic content target ${ token }`,
+			content: `<!-- wp:paragraph --><p>${ targetContent }</p><!-- /wp:paragraph -->`,
+			status: 'publish'
+		});
+
+		created.push({ type: 'posts', id: target.id });
+
+		const holder = await requestUtils.createPage({
+			title: `Dynamic content holder ${ token }`,
+			// The tag is wrapped in a group: postContent runs the_content, which
+			// wraps its output in <p>, and a nested <p> would be auto-closed by
+			// the browser parser and land outside the marker element.
+			content: `<!-- wp:query {"query":{"perPage":1,"postType":"post","search":"${ token }","inherit":false}} -->
+<div class="wp-block-query"><!-- wp:post-template -->
+<!-- wp:group {"className":"o-dyn-2929"} --><div class="wp-block-group o-dyn-2929"><!-- wp:paragraph --><p><o-dynamic data-type="postContent" data-context="query">Post Content</o-dynamic></p><!-- /wp:paragraph --></div><!-- /wp:group -->
+<!-- /wp:post-template --></div>
+<!-- /wp:query -->`,
+			status: 'publish'
+		});
+
+		created.push({ type: 'pages', id: holder.id });
+
+		pageId = holder.id;
+	});
+
+	test.afterAll( async({ requestUtils }) => {
+		// Only this spec's own records - other specs run against the same site.
+		// Best-effort per record: one failed request must not orphan the rest.
+		while ( created.length ) {
+			const record = created.pop();
+			try {
+				await requestUtils.rest({
+					method: 'DELETE',
+					path: `/wp/v2/${ record.type }/${ record.id }`,
+					params: { force: true }
+				});
+			} catch ( error ) {
+				console.warn( `Could not delete ${ record.type }/${ record.id }:`, error.message );
+			}
+		}
+	});
+
+	test( 'renders the target post content on the frontend', async({ page }) => {
+		await page.goto( `/?page_id=${ pageId }` );
+
+		await expect( page.locator( '.o-dyn-2929' ) ).toContainText( targetContent );
+	});
+
+	test( 'survives a corrupted $pages loop global without PHP warnings', async({ page }) => {
+		await page.goto( `/?page_id=${ pageId }&otter_e2e_corrupt_pages=1` );
+
+		// Regression #2929: "Warning: Undefined array key -1 in .../post-template.php"
+		// (PHP 7.4 words it "Undefined offset: -1") plus a preg_match() deprecation.
+		await expect( page.locator( 'body' ) ).not.toContainText( /Undefined (array key|offset)/ );
+		await expect( page.locator( 'body' ) ).not.toContainText( 'preg_match' );
+
+		// The tag must still resolve the context post's content.
+		await expect( page.locator( '.o-dyn-2929' ) ).toContainText( targetContent );
+	});
+});
diff --git a/tests/test-dynamic-content.php b/tests/test-dynamic-content.php
index 3fba9e359..e9feb86ba 100644
--- a/tests/test-dynamic-content.php
+++ b/tests/test-dynamic-content.php
@@ -1095,4 +1095,168 @@ public function test_is_protected_meta_key_edge_cases() {
 		$this->assertTrue( \ThemeIsle\OtterPro\Plugins\Dynamic_Content::is_protected_meta_key( 'USER_PASS' ) );
 		$this->assertFalse( \ThemeIsle\OtterPro\Plugins\Dynamic_Content::is_protected_meta_key( 'test_meta' ) );
 	}
+
+	/**
+	 * postContent must render the context post, not whatever post the loop
+	 * globals happen to point at (issue #2929: the context ID was passed to
+	 * get_the_content() as $more_link_text, so the post argument stayed null).
+	 */
+	public function test_post_content_uses_context_not_loop_globals() {
+		$other_id = $this->factory()->post->create(
+			array(
+				'post_title'   => 'Other',
+				'post_content' => 'Other post content',
+				'post_status'  => 'publish',
+			)
+		);
+
+		$this->go_to( get_permalink( $this->post_id ) );
+
+		// A secondary loop (page builder, related-posts widget) that forgot wp_reset_postdata().
+		$query = new WP_Query( array( 'p' => $other_id ) );
+		while ( $query->have_posts() ) {
+			$query->the_post();
+		}
+
+		$result = $this->dynamic_content->apply_dynamic_content( '<p><o-dynamic data-type="postContent">Post Content</o-dynamic></p>' );
+
+		wp_reset_postdata();
+		wp_delete_post( $other_id, true );
+
+		$this->assertStringNotContainsString( 'Other post content', $result );
+		$this->assertStringContainsString( 'Test', $result );
+	}
+
+	/**
+	 * A clobbered $pages loop global (theme templates are included at global
+	 * scope, so any template-level $pages variable overwrites it) must not
+	 * surface "Undefined array key -1" from post-template.php nor swallow the
+	 * content (issue #2929).
+	 */
+	public function test_post_content_survives_corrupted_pages_global() {
+		$this->go_to( get_permalink( $this->post_id ) );
+
+		// Fire the loop so did_action( 'the_post' ) is truthy, then corrupt the global.
+		$query = new WP_Query( array( 'p' => $this->post_id ) );
+		while ( $query->have_posts() ) {
+			$query->the_post();
+		}
+		$GLOBALS['pages'] = array();
+
+		$captured = array();
+		set_error_handler(
+			function ( $errno, $errstr ) use ( &$captured ) {
+				$captured[] = $errstr;
+				return true;
+			}
+		);
+
+		$result = $this->dynamic_content->apply_dynamic_content( '<p><o-dynamic data-type="postContent">Post Content</o-dynamic></p>' );
+
+		restore_error_handler();
+		wp_reset_postdata();
+
+		$page_warnings = array_filter(
+			$captured,
+			function ( $message ) {
+				return false !== strpos( $message, 'Undefined' ) || false !== strpos( $message, 'preg_match' );
+			}
+		);
+
+		$this->assertSame( array(), array_values( $page_warnings ) );
+		$this->assertStringContainsString( 'Test', $result );
+	}
+
+	/**
+	 * The infinite-loop guard in mark_exceptions() must inspect the context
+	 * post. When the context post nests a postContent tag the guard has to fire
+	 * even though the loop-global post is clean (issue #2929: the guard read the
+	 * loop global, so the nested tag went undetected and recursed).
+	 */
+	public function test_post_content_guard_detects_nested_tag_in_context_post() {
+		$nested_id = $this->factory()->post->create(
+			array(
+				'post_title'   => 'Nested',
+				'post_content' => 'Before <o-dynamic data-type="postContent">Post Content</o-dynamic> after',
+				'post_status'  => 'publish',
+			)
+		);
+
+		$clean_id = $this->factory()->post->create(
+			array(
+				'post_title'   => 'Clean loop global',
+				'post_content' => 'Clean loop global content',
+				'post_status'  => 'publish',
+			)
+		);
+
+		// Context = the nested post, loop global = the clean post.
+		$this->go_to( get_permalink( $nested_id ) );
+
+		$query = new WP_Query( array( 'p' => $clean_id ) );
+		while ( $query->have_posts() ) {
+			$query->the_post();
+		}
+
+		$data      = array(
+			'type'    => 'postContent',
+			'context' => $nested_id,
+		);
+		$marked    = $this->dynamic_content->mark_exceptions( $data );
+		$guard_key = $this->dynamic_content->get_exception_key( $data, $nested_id );
+
+		// Asserted before rendering on purpose: an unfired guard makes
+		// apply_dynamic_content() recurse until the process dies, so this has to
+		// fail fast rather than hang.
+		$this->assertArrayHasKey( $guard_key, $marked );
+
+		$result = $this->dynamic_content->apply_dynamic_content( '<p><o-dynamic data-type="postContent">Post Content</o-dynamic></p>' );
+
+		wp_reset_postdata();
+		wp_delete_post( $nested_id, true );
+		wp_delete_post( $clean_id, true );
+
+		// Guard fired: the tag resolves to an empty string instead of recursing.
+		$this->assertSame( '<p></p>', $result );
+		$this->assertStringNotContainsString( 'Clean loop global content', $result );
+	}
+
+	/**
+	 * The mirror case: a nested postContent tag in the loop-global post must not
+	 * blank out a clean context post (issue #2929).
+	 */
+	public function test_post_content_guard_ignores_nested_tag_in_loop_global() {
+		$nested_id = $this->factory()->post->create(
+			array(
+				'post_title'   => 'Nested loop global',
+				'post_content' => 'Before <o-dynamic data-type="postContent">Post Content</o-dynamic> after',
+				'post_status'  => 'publish',
+			)
+		);
+
+		// Context = the clean post from set_up(), loop global = the nested post.
+		$this->go_to( get_permalink( $this->post_id ) );
+
+		$query = new WP_Query( array( 'p' => $nested_id ) );
+		while ( $query->have_posts() ) {
+			$query->the_post();
+		}
+
+		$data      = array(
+			'type'    => 'postContent',
+			'context' => $this->post_id,
+		);
+		$marked    = $this->dynamic_content->mark_exceptions( $data );
+		$guard_key = $this->dynamic_content->get_exception_key( $data, $this->post_id );
+
+		$this->assertArrayNotHasKey( $guard_key, $marked );
+
+		$result = $this->dynamic_content->apply_dynamic_content( '<p><o-dynamic data-type="postContent">Post Content</o-dynamic></p>' );
+
+		wp_reset_postdata();
+		wp_delete_post( $nested_id, true );
+
+		// Guard did not fire: the context post's own content is still rendered.
+		$this->assertStringContainsString( 'Test', $result );
+	}
 }

From 3ad45e187b3dae8b56c9bf1b486e08e26d1eadc1 Mon Sep 17 00:00:00 2001
From: lucadobrescu <soare.robert.daniel@protonmail.com>
Date: Tue, 18 Aug 2026 11:38:19 +0300
Subject: [PATCH 03/25] fix: plugin classes fail to load when the Composer
 classmap is stale (#2956)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: frontend fatal when a listed class cannot be autoloaded

Main::autoload_classes() instantiated every entry of its class list without
checking that the class is loadable. On a package with a stale Composer
classmap the Atomic Wind entry resolved to nothing and `new $classname()`
threw an uncaught Error on `init`, taking down every request (#2954).

Skip entries that are not loadable so a packaging or third-party filter
problem degrades to a missing feature instead of a site-wide fatal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: resolve the plugin's own classes when the Composer classmap is stale

Composer exposes `inc/` through a generated classmap in `vendor/`, so a map that
does not match the files on disk — an interrupted plugin update, an OPcache entry
compiled from the previous version — makes a class that is present unloadable.

Register a fallback loader for `ThemeIsle\GutenbergBlocks\*` that resolves a class
from its file name. It is appended to the SPL stack, so Composer still answers
first and the fallback only runs when Composer has no answer. The class then
loads and its feature keeps working, instead of being skipped by the guard in
Main::autoload_classes().

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: drop the fallback autoloader, log skipped classes instead

Per review: a stale Composer classmap is an environment issue (broken or
partial update) that fixes itself on reinstall, so keeping the class_exists()
guard is enough. Remove inc/class-autoloader.php and its SPL registration —
it locked us into the file-naming convention, added a second load path, and
could hide a genuinely broken release. When the guard skips an unloadable
entry it now logs it, so a lost feature is visible instead of silent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Luca Dobrescu <luca.dobrescu@vertistudio.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 inc/class-main.php                            |   6 +
 .../mu-plugins/otter-e2e-bootstrap.php        |  33 +++++
 .../e2e/blocks/autoloader-resilience.spec.js  |  43 +++++++
 src/blocks/test/e2e/playwright.config.js      |   5 +-
 tests/test-main-autoload.php                  | 113 ++++++++++++++++++
 5 files changed, 199 insertions(+), 1 deletion(-)
 create mode 100644 src/blocks/test/e2e/blocks/autoloader-resilience.spec.js
 create mode 100644 tests/test-main-autoload.php

diff --git a/inc/class-main.php b/inc/class-main.php
index f4288c356..39d1aed7d 100644
--- a/inc/class-main.php
+++ b/inc/class-main.php
@@ -94,6 +94,12 @@ public function autoload_classes() {
 		$classnames = apply_filters( 'otter_blocks_autoloader', $classnames );
 
 		foreach ( $classnames as $classname ) {
+			// A stale Composer classmap or a third-party filter can list a class that is not loadable; skip it instead of fataling the request.
+			if ( ! is_string( $classname ) || ! class_exists( $classname ) ) {
+				error_log( '[Otter Blocks] Skipped an autoload entry that could not be loaded: ' . ( is_string( $classname ) ? $classname : gettype( $classname ) ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+				continue;
+			}
+
 			$classname = new $classname();
 
 			if ( method_exists( $classname, 'instance' ) ) {
diff --git a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
index 649de761d..963058ec2 100644
--- a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
+++ b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
@@ -51,6 +51,8 @@
 	// Form webhooks registry; retention specs seed a dead-URL webhook to force
 	// a delivery failure with the 'webhook' action.
 	'themeisle_webhooks_options',
+	// Scenario flag for the autoloader-resilience spec; see break_otter_autoloader().
+	'otter_e2e_broken_autoloader',
 	'otter_blocks_logger_flag',
 	'otter_blocks_logger_data',
 	'otter_activation_first_save',
@@ -107,6 +109,12 @@
  */
 const WIDGET_SEED_INDEX = 999;
 
+/**
+ * When truthy, an unloadable class is put at the head of the Otter autoloader list,
+ * reproducing a stale Composer classmap on a released package (issue #2954).
+ */
+const BROKEN_AUTOLOADER_OPTION = 'otter_e2e_broken_autoloader';
+
 /**
  * Form record post type, mirrored from \ThemeIsle\GutenbergBlocks\Plugins\Form_Submissions.
  */
@@ -802,6 +810,31 @@ function ( $block_content ) use ( &$saved ) {
 
 add_action( 'wp', __NAMESPACE__ . '\\corrupt_pages_around_dynamic_tags' );
 
+/**
+ * Put an unloadable class first in the Otter autoloader list when the scenario option is on.
+ *
+ * @param array<int, string> $classnames Classes Otter initializes on `init`.
+ * @return array<int, string>
+ */
+function break_otter_autoloader( $classnames ) {
+	if ( ! get_option( BROKEN_AUTOLOADER_OPTION, false ) ) {
+		return $classnames;
+	}
+
+	// Never break the scenario endpoints themselves, or a spec running against unfixed
+	// code could not disarm the flag and would poison the rest of the run.
+	$uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
+	if ( false !== strpos( $uri, REST_NAMESPACE ) ) {
+		return $classnames;
+	}
+
+	array_unshift( $classnames, '\ThemeIsle\GutenbergBlocks\Plugins\Missing_From_Classmap' );
+
+	return $classnames;
+}
+
+add_filter( 'otter_blocks_autoloader', __NAMESPACE__ . '\\break_otter_autoloader' );
+
 add_filter( 'pre_wp_mail', __NAMESPACE__ . '\\stub_wp_mail_for_e2e', 10, 2 );
 add_filter( 'pre_http_request', __NAMESPACE__ . '\\stub_openai_http_for_e2e', 10, 3 );
 
diff --git a/src/blocks/test/e2e/blocks/autoloader-resilience.spec.js b/src/blocks/test/e2e/blocks/autoloader-resilience.spec.js
new file mode 100644
index 000000000..8fc05d8d2
--- /dev/null
+++ b/src/blocks/test/e2e/blocks/autoloader-resilience.spec.js
@@ -0,0 +1,43 @@
+/**
+ * Internal dependencies
+ */
+import { test, expect } from '../fixtures';
+
+/**
+ * Regression for #2954: a class listed for autoloading that the released package cannot load
+ * (stale Composer classmap) crashed every request in `Main::autoload_classes()`.
+ */
+test.describe( 'Autoloader resilience', () => {
+	test.beforeEach( async({ otterUtils }) => {
+		await otterUtils.setOptions({ otter_e2e_broken_autoloader: true });
+	});
+
+	test.afterEach( async({ otterUtils }) => {
+		await otterUtils.setOptions({ otter_e2e_broken_autoloader: false });
+	});
+
+	test( 'frontend survives an unloadable class in the autoload list', async({ page, requestUtils }) => {
+		const post = await requestUtils.createPost({
+			title: 'Autoloader resilience',
+			content: '<!-- wp:themeisle-blocks/posts-grid /-->',
+			status: 'publish'
+		});
+
+		const response = await page.goto( post.link );
+
+		expect( response.status() ).toBe( 200 );
+		await expect( page.locator( 'text=There has been a critical error' ) ).toBeHidden();
+
+		// The blocks listed after the unloadable one must still be initialized:
+		// posts-grid only renders when Registration ran. The grid lists earlier
+		// posts, which can embed their own grid, so match the first one.
+		await expect( page.locator( '.wp-block-themeisle-blocks-posts-grid' ).first() ).toBeVisible();
+	});
+
+	test( 'admin survives an unloadable class in the autoload list', async({ page, admin }) => {
+		await admin.visitAdminPage( 'admin.php?page=otter' );
+
+		await expect( page.locator( 'text=There has been a critical error' ) ).toBeHidden();
+		await expect( page.locator( '#otter' ) ).toBeVisible();
+	});
+});
diff --git a/src/blocks/test/e2e/playwright.config.js b/src/blocks/test/e2e/playwright.config.js
index 78823c080..79ec41825 100644
--- a/src/blocks/test/e2e/playwright.config.js
+++ b/src/blocks/test/e2e/playwright.config.js
@@ -60,7 +60,10 @@ const SERIAL_SPECS = [
 	'**/blocks/atomic-wind-list-view.spec.js',
 
 	// Switches the active theme and mutates site-wide widget + filesystem state.
-	'**/blocks/widgets-css-frontend.spec.js'
+	'**/blocks/widgets-css-frontend.spec.js',
+
+	// Flips a site-wide flag that breaks Otter's autoloader for every request.
+	'**/blocks/autoloader-resilience.spec.js'
 ];
 
 const config = defineConfig({
diff --git a/tests/test-main-autoload.php b/tests/test-main-autoload.php
new file mode 100644
index 000000000..4bc37d687
--- /dev/null
+++ b/tests/test-main-autoload.php
@@ -0,0 +1,113 @@
+<?php
+/**
+ * Tests for Main::autoload_classes().
+ *
+ * @package gutenberg-blocks
+ */
+
+use ThemeIsle\GutenbergBlocks\Main;
+
+/**
+ * Probe class instantiated through the `otter_blocks_autoloader` filter.
+ */
+class Otter_Autoload_Probe {
+	/**
+	 * Set when the autoloader instantiates this class.
+	 *
+	 * @var bool
+	 */
+	public static $instantiated = false;
+
+	/**
+	 * Constructor.
+	 */
+	public function __construct() {
+		self::$instantiated = true;
+	}
+}
+
+/**
+ * Main autoloader test case.
+ */
+class TestMainAutoload extends WP_UnitTestCase {
+
+	/**
+	 * Tear down each test.
+	 */
+	public function tear_down() {
+		remove_all_filters( 'otter_blocks_autoloader' );
+		Otter_Autoload_Probe::$instantiated = false;
+		parent::tear_down();
+	}
+
+	/**
+	 * A listed class that cannot be loaded must not fatal the request, and must not stop the rest of the list.
+	 */
+	public function test_autoload_classes_skips_unavailable_class() {
+		add_filter(
+			'otter_blocks_autoloader',
+			function () {
+				return array(
+					'\ThemeIsle\GutenbergBlocks\Plugins\Definitely_Missing_Class',
+					'Otter_Autoload_Probe',
+				);
+			}
+		);
+
+		( new Main() )->autoload_classes();
+
+		$this->assertTrue( Otter_Autoload_Probe::$instantiated, 'Classes listed after an unavailable one should still be instantiated.' );
+	}
+
+	/**
+	 * Non-string entries injected by a third-party filter must not fatal either.
+	 */
+	public function test_autoload_classes_skips_non_string_entries() {
+		add_filter(
+			'otter_blocks_autoloader',
+			function () {
+				return array( null, array( 'nope' ), 'Otter_Autoload_Probe' );
+			}
+		);
+
+		( new Main() )->autoload_classes();
+
+		$this->assertTrue( Otter_Autoload_Probe::$instantiated );
+	}
+
+	/**
+	 * Every class the plugin ships in the autoload list must be loadable, so a stale classmap is caught here instead of on a live site.
+	 */
+	public function test_bundled_classnames_are_loadable() {
+		$listed = $this->get_listed_classnames();
+
+		$this->assertNotEmpty( $listed );
+
+		foreach ( $listed as $classname ) {
+			$this->assertTrue( class_exists( $classname ), $classname . ' is listed for autoloading but cannot be loaded.' );
+		}
+	}
+
+	/**
+	 * The class list the plugin passes through the `otter_blocks_autoloader` filter.
+	 *
+	 * @return array<int, string>
+	 */
+	private function get_listed_classnames() {
+		$listed = array();
+
+		add_filter(
+			'otter_blocks_autoloader',
+			function ( $classnames ) use ( &$listed ) {
+				$listed = $classnames;
+
+				return array(); // Nothing to instantiate; the list itself is what is under test.
+			},
+			0
+		);
+
+		( new Main() )->autoload_classes();
+
+		return $listed;
+	}
+}

From bde5087930146c80610ab500049f89fbb3335b26 Mon Sep 17 00:00:00 2001
From: lucadobrescu <soare.robert.daniel@protonmail.com>
Date: Tue, 18 Aug 2026 11:38:20 +0300
Subject: [PATCH 04/25] fix: Sabberworm dependency collision causes fatal
 during animation CSS parsing (#2958)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: fatal when another plugin loads a different php-css-parser release

Base_CSS::get_animation_css() parsed the animation stylesheet with the
bundled Sabberworm parser even when another plugin had already loaded
classes from a different release of it. Mixing the two fatals at
class-link time ("Declaration of CSSList::addComments... must be
compatible") and that error is not catchable, so a guard now verifies
every sentinel class resolves to Otter's own vendor directory before
anything parser-related loads — including the transient read, which
stores parser objects. When the guard fails, the full stock
otter-animation stylesheet is enqueued instead, matching the
optimize-off delivery path.

Adds an isolated-process PHPUnit regression test and a frontend e2e
spec covering both the foreign-parser fallback and the bundled-parser
optimized path.

Fixes #2942

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: serve the stock animation stylesheet from the frontend loader on parser collision

Copilot review: the get_animation_css() fallback enqueue was lost once
the generated post CSS was cached — later requests never reach the
parser path, and the cached CSS carries no animation rules. Move the
fallback delivery into Blocks_Animation::frontend_load(), which runs on
every request that renders an animated block, and cover a cached-CSS
reload in the e2e spec. Also delete the spec's probe posts in afterAll.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: reject any preloaded foreign Sabberworm symbol, not only the sentinels

Copilot review: the parser touches more classes than the three sentinels
(OutputFormat, DeclarationBlock, KeyFrame, and the cached object graph),
so a foreign copy of any of them slipped past the guard and still mixed
releases. has_own_css_parser() now first rejects every already-declared
class, interface, or trait under Sabberworm\CSS that does not resolve to
the bundled vendor directory — before the sentinel checks can autoload
anything — and only then resolves the sentinel entry points. The sandbox
gains an outputformat scenario covering a foreign non-sentinel class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: match foreign Sabberworm declarations case-insensitively

Copilot review (suppressed note): PHP class and namespace names are
case-insensitive, so a foreign symbol declared with different casing is
the same runtime class but slipped past the case-sensitive prefix scan.
Use stripos so every colliding declaration is rejected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: trim animation-CSS collision comments to the load-bearing why

Cut the verbose guard and preflight comments in Base_CSS and
Blocks_Animation down to the constraint a reader cannot infer: the
foreign-parser fatal is uncatchable, so the guard must run before any
parser class loads. Also correct the has_own_css_parser() docblock to
say it checks every loaded Sabberworm\CSS symbol, not only the ones the
parser touches.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: log when a foreign php-css-parser release disables animation CSS

The parser-collision guard silently served the stock animation stylesheet,
so a conflicting Sabberworm release looked like the optimization had stopped
working for no reason. Log the skip, mirroring the autoload-skip notice from
 #2956, so the cause is visible in the debug log.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Luca Dobrescu <luca.dobrescu@vertistudio.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 inc/class-base-css.php                        |  72 ++++++++++
 inc/class-blocks-animation.php                |   8 +-
 .../includes/foreign-sabberworm-interface.php |  22 +++
 .../mu-plugins/otter-e2e-bootstrap.php        |  52 +++++++
 .../e2e/blocks/sabberworm-collision.spec.js   | 131 ++++++++++++++++++
 src/blocks/test/e2e/fixtures.ts               |   8 ++
 src/blocks/test/e2e/playwright.config.js      |   5 +-
 tests/php/foreign-sabberworm-sandbox.php      |  92 ++++++++++++
 tests/test-animation-css.php                  |  93 +++++++++++++
 9 files changed, 481 insertions(+), 2 deletions(-)
 create mode 100644 packages/e2e-tests/mu-plugins/includes/foreign-sabberworm-interface.php
 create mode 100644 src/blocks/test/e2e/blocks/sabberworm-collision.spec.js
 create mode 100644 tests/php/foreign-sabberworm-sandbox.php
 create mode 100644 tests/test-animation-css.php

diff --git a/inc/class-base-css.php b/inc/class-base-css.php
index 8d804cc3b..0739628ba 100644
--- a/inc/class-base-css.php
+++ b/inc/class-base-css.php
@@ -384,6 +384,14 @@ public function get_animation_css( $blocks ) {
 			return $style;
 		}
 
+		if ( ! self::has_own_css_parser() ) {
+			// A foreign php-css-parser release is loaded; parsing now fatals
+			// uncatchably at class-link time (#2942). The frontend loader serves
+			// the stock stylesheet instead.
+			error_log( '[Otter Blocks] A conflicting Sabberworm php-css-parser release is loaded; skipping animation CSS optimization and serving the stock stylesheet instead.' ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+			return $style;
+		}
+
 		$prepared_classes = array( ':root' );
 
 		foreach ( $classes as $class ) {
@@ -445,6 +453,70 @@ public function get_animation_css( $blocks ) {
 		return $style;
 	}
 
+	/**
+	 * Check that every loaded Sabberworm\CSS symbol resolves to this plugin's copy.
+	 *
+	 * Another plugin can ship a different php-css-parser release under the same
+	 * namespace. Once any of its classes loads, loading the bundled counterparts
+	 * fatals at class-link time, and that error is not catchable.
+	 *
+	 * @return bool
+	 */
+	public static function has_own_css_parser() {
+		$own_vendor = wp_normalize_path( OTTER_BLOCKS_PATH . '/vendor/' );
+		$prefix     = 'Sabberworm\\CSS\\';
+
+		// Reject any foreign copy already in memory before the sentinel checks
+		// autoload a bundled class: the parser uses more classes than the
+		// sentinels, and one preloaded foreign symbol poisons the process.
+		$declared = array_merge( get_declared_classes(), get_declared_interfaces(), get_declared_traits() );
+
+		foreach ( $declared as $declared_name ) {
+			// PHP class names are case-insensitive; match a foreign copy in any casing.
+			if ( 0 !== stripos( $declared_name, $prefix ) ) {
+				continue;
+			}
+
+			if ( ! self::is_bundled_class( $declared_name, $own_vendor ) ) {
+				return false;
+			}
+		}
+
+		// Entry points nothing may have loaded yet: whichever autoloader resolves
+		// them must serve the bundled copy.
+		$sentinels = array(
+			'\Sabberworm\CSS\Parser',
+			'\Sabberworm\CSS\Comment\Commentable',
+			'\Sabberworm\CSS\Renderable',
+		);
+
+		foreach ( $sentinels as $sentinel ) {
+			if ( ! class_exists( $sentinel ) && ! interface_exists( $sentinel ) ) {
+				return false;
+			}
+
+			if ( ! self::is_bundled_class( $sentinel, $own_vendor ) ) {
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+	/**
+	 * Check that a class, interface, or trait was loaded from this plugin's vendor directory.
+	 *
+	 * @param string $name Fully qualified name.
+	 * @param string $own_vendor Normalized path of this plugin's vendor directory.
+	 * @return bool
+	 */
+	private static function is_bundled_class( $name, $own_vendor ) {
+		$reflection = new \ReflectionClass( $name );
+		$file       = $reflection->getFileName();
+
+		return false !== $file && 0 === strpos( wp_normalize_path( $file ), $own_vendor );
+	}
+
 	/**
 	 * Get Animation Classes
 	 *
diff --git a/inc/class-blocks-animation.php b/inc/class-blocks-animation.php
index 78181b08c..3bc12d174 100644
--- a/inc/class-blocks-animation.php
+++ b/inc/class-blocks-animation.php
@@ -172,7 +172,13 @@ public function frontend_load( $block_content, $block ) {
 		}
 
 		if ( ! self::$scripts_loaded['animation'] && strpos( $block_content, 'animated' ) ) {
-			if ( ! defined( 'OTTER_BLOCKS_VERSION' ) || ( defined( 'OTTER_BLOCKS_VERSION' ) && ! get_option( 'themeisle_blocks_settings_optimize_animations_css', true ) ) ) {
+			// Foreign-parser pages (#2942) cache post-CSS with no animation rules,
+			// so deliver the stock stylesheet here rather than via the parser path.
+			if (
+				! defined( 'OTTER_BLOCKS_VERSION' ) ||
+				! get_option( 'themeisle_blocks_settings_optimize_animations_css', true ) ||
+				! Base_CSS::has_own_css_parser()
+			) {
 				wp_enqueue_style( 'otter-animation' );
 			}
 
diff --git a/packages/e2e-tests/mu-plugins/includes/foreign-sabberworm-interface.php b/packages/e2e-tests/mu-plugins/includes/foreign-sabberworm-interface.php
new file mode 100644
index 000000000..308bace7c
--- /dev/null
+++ b/packages/e2e-tests/mu-plugins/includes/foreign-sabberworm-interface.php
@@ -0,0 +1,22 @@
+<?php
+/**
+ * Typed `Commentable` interface as shipped by php-css-parser 9.x.
+ *
+ * Lives in a subdirectory so WordPress does not auto-load it as an mu-plugin;
+ * otter-e2e-bootstrap.php requires it only while the foreign-Sabberworm
+ * scenario (issue #2942) is armed. Once defined, loading Otter's bundled
+ * untyped CSSList fatals at class-link time — exactly like a second plugin
+ * shipping a newer parser release.
+ *
+ * @package otter-blocks
+ */
+
+// phpcs:ignoreFile -- deliberately mirrors the upstream 9.x signatures.
+
+namespace Sabberworm\CSS\Comment;
+
+interface Commentable {
+	public function addComments( array $comments ): void;
+	public function getComments(): array;
+	public function setComments( array $comments ): void;
+}
diff --git a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
index 963058ec2..9344106be 100644
--- a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
+++ b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
@@ -115,6 +115,14 @@
  */
 const BROKEN_AUTOLOADER_OPTION = 'otter_e2e_broken_autoloader';
 
+/**
+ * When truthy, a typed php-css-parser 9.x `Commentable` interface is defined before
+ * any plugin loads, reproducing a second plugin shipping a different Sabberworm
+ * release (issue #2942). Otter must skip its animation-CSS optimization instead
+ * of fataling while loading its bundled untyped classes.
+ */
+const FOREIGN_SABBERWORM_OPTION = 'otter_e2e_foreign_sabberworm';
+
 /**
  * Form record post type, mirrored from \ThemeIsle\GutenbergBlocks\Plugins\Form_Submissions.
  */
@@ -835,6 +843,18 @@ function break_otter_autoloader( $classnames ) {
 
 add_filter( 'otter_blocks_autoloader', __NAMESPACE__ . '\\break_otter_autoloader' );
 
+// Foreign-Sabberworm scenario (issue #2942): define the typed 9.x interface before
+// any plugin code runs, like a competing plugin's autoloader would. The scenario
+// endpoints stay exempt so a spec can always disarm the flag, even against code
+// where the armed frontend fatals.
+if ( get_option( FOREIGN_SABBERWORM_OPTION, false ) ) {
+	$otter_e2e_request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
+
+	if ( false === strpos( $otter_e2e_request_uri, REST_NAMESPACE ) ) {
+		require __DIR__ . '/includes/foreign-sabberworm-interface.php';
+	}
+}
+
 add_filter( 'pre_wp_mail', __NAMESPACE__ . '\\stub_wp_mail_for_e2e', 10, 2 );
 add_filter( 'pre_http_request', __NAMESPACE__ . '\\stub_openai_http_for_e2e', 10, 3 );
 
@@ -1446,6 +1466,37 @@ function () {
 			)
 		);
 
+		register_rest_route(
+			REST_NAMESPACE,
+			'/sabberworm',
+			array(
+				'methods'             => \WP_REST_Server::CREATABLE,
+				'permission_callback' => __NAMESPACE__ . '\\require_admin',
+				'callback'            => function ( \WP_REST_Request $request ) {
+					$mode = $request->get_param( 'mode' );
+
+					if ( ! in_array( $mode, array( 'foreign', 'own' ), true ) ) {
+						return new \WP_Error(
+							'otter_e2e_invalid_sabberworm_mode',
+							'Mode must be "foreign" or "own".',
+							array( 'status' => 400 )
+						);
+					}
+
+					if ( 'foreign' === $mode ) {
+						update_option( FOREIGN_SABBERWORM_OPTION, true, false );
+					} else {
+						delete_option( FOREIGN_SABBERWORM_OPTION );
+					}
+
+					// Force the next frontend request through the parse path.
+					delete_transient( 'otter_animations_parsed' );
+
+					return rest_ensure_response( array( 'ok' => true ) );
+				},
+			)
+		);
+
 		register_rest_route(
 			REST_NAMESPACE,
 			'/widgets/seed',
@@ -1497,6 +1548,7 @@ function () {
 					delete_option( CAPTCHA_MODE_OPTION );
 					delete_option( OPENAI_STUB_OPTION );
 					delete_option( FS_BLOCKED_OPTION );
+					delete_option( FOREIGN_SABBERWORM_OPTION );
 					cleanup_form_records();
 					return rest_ensure_response( array( 'ok' => true ) );
 				},
diff --git a/src/blocks/test/e2e/blocks/sabberworm-collision.spec.js b/src/blocks/test/e2e/blocks/sabberworm-collision.spec.js
new file mode 100644
index 000000000..99f470a4f
--- /dev/null
+++ b/src/blocks/test/e2e/blocks/sabberworm-collision.spec.js
@@ -0,0 +1,131 @@
+/**
+ * Internal dependencies
+ */
+import { test, expect } from '../fixtures';
+
+/**
+ * Frontend animation-CSS coverage for https://github.com/Codeinwp/otter-blocks/issues/2942.
+ *
+ * When another plugin loads a different php-css-parser release, mixing its
+ * classes with Otter's bundled copy fatals at class-link time while
+ * Base_CSS::get_animation_css() parses the animation stylesheet. The scenario
+ * mu-plugin predefines the typed 9.x `Commentable` interface before plugins
+ * load; the page must still render, with the full stock animation stylesheet
+ * enqueued instead of the optimized inline subset — including on later
+ * requests served from the generated post-CSS cache, which carries no
+ * animation rules while the guard fails.
+ *
+ * Each test creates its own fresh post AFTER switching modes: the first
+ * singular view generates and caches the post CSS, and cached requests never
+ * reach the parser again.
+ *
+ * Serial project: flips a site-wide scenario flag that affects every request.
+ */
+
+// The Progress Bar makes the generated post CSS non-empty, so the second
+// request is served from the cached stylesheet file.
+const FOREIGN_POST_CONTENT = `<!-- wp:paragraph {"className":"animated fadeIn"} -->
+<p class="animated fadeIn">Animated collision probe</p>
+<!-- /wp:paragraph -->
+
+<!-- wp:themeisle-blocks/progress-bar {"id":"wp-block-themeisle-blocks-progress-bar-e2e2942","title":"Collision probe","percentage":75,"titleColor":"#123abc","height":36} -->
+<div id="wp-block-themeisle-blocks-progress-bar-e2e2942" class="wp-block-themeisle-blocks-progress-bar"><div class="wp-block-themeisle-blocks-progress-bar__title">Collision probe</div><div class="wp-block-themeisle-blocks-progress-bar__area"><div class="wp-block-themeisle-blocks-progress-bar__area__bar"></div></div></div>
+<!-- /wp:themeisle-blocks/progress-bar -->`;
+
+const OWN_POST_CONTENT = `<!-- wp:paragraph {"className":"animated fadeIn"} -->
+<p class="animated fadeIn">Animated collision probe</p>
+<!-- /wp:paragraph -->`;
+
+test.describe( 'Sabberworm collision fallback', () => {
+	const createdPosts = [];
+
+	const createProbePost = async( requestUtils, title, content ) => {
+		const post = await requestUtils.rest({
+			method: 'POST',
+			path: '/wp/v2/posts',
+			data: {
+				status: 'publish',
+				title,
+				content
+			}
+		});
+
+		createdPosts.push( post.id );
+
+		// Plain query form: independent of the permalink structure.
+		return `/?p=${ post.id }`;
+	};
+
+	test.afterAll( async({ requestUtils }) => {
+		await requestUtils.rest({
+			method: 'POST',
+			path: '/otter-e2e/v1/sabberworm',
+			data: { mode: 'own' }
+		});
+
+		// Only this spec's own posts — other specs run against the same site.
+		// Best-effort per post: one failed request must not orphan the rest.
+		while ( createdPosts.length ) {
+			const postId = createdPosts.pop();
+			try {
+				await requestUtils.rest({
+					method: 'DELETE',
+					path: `/wp/v2/posts/${ postId }`,
+					params: { force: true }
+				});
+			} catch ( error ) {
+				console.warn( `Could not delete post ${ postId }:`, error.message );
+			}
+		}
+	});
+
+	test( 'serves the full stylesheet when a foreign parser is loaded, also from the CSS cache', async({ page, otterUtils, requestUtils }) => {
+		await otterUtils.setSabberwormMode( 'foreign' );
+
+		try {
+			const postUrl = await createProbePost( requestUtils, 'Foreign parser probe', FOREIGN_POST_CONTENT );
+
+			const response = await page.goto( postUrl );
+
+			expect( response.status() ).toBe( 200 );
+
+			await expect( page.getByText( 'Animated collision probe' ) ).toBeVisible();
+
+			// Assert on the server response: the animation frontend script rewrites
+			// the block's classes in the live DOM once the animation plays.
+			const html = await response.text();
+			expect( html ).toContain( 'animated fadeIn' );
+			expect( html ).not.toContain( 'Fatal error' );
+			expect( html ).not.toContain( 'must be compatible' );
+
+			// The optimization is skipped, so the stock stylesheet carries the animations.
+			expect( html ).toContain( 'otter-animation-css' );
+			expect( html ).toMatch( /animation\/index\.css/ );
+
+			// The first request generated and cached the post CSS without animation
+			// rules; the fallback must survive requests served from that cache.
+			const cachedResponse = await page.goto( postUrl );
+			const cachedHtml = await cachedResponse.text();
+			expect( cachedHtml ).toContain( 'otter-animation-css' );
+			expect( cachedHtml ).not.toContain( 'Fatal error' );
+		} finally {
+			await otterUtils.setSabberwormMode( 'own' );
+		}
+	});
+
+	test( 'inlines the optimized animation CSS with the bundled parser', async({ page, otterUtils, requestUtils }) => {
+		await otterUtils.setSabberwormMode( 'own' );
+
+		const postUrl = await createProbePost( requestUtils, 'Bundled parser probe', OWN_POST_CONTENT );
+
+		const response = await page.goto( postUrl );
+
+		await expect( page.getByText( 'Animated collision probe' ) ).toBeVisible();
+
+		// The optimized subset is served: the fadeIn keyframe is present without
+		// the full stock stylesheet.
+		const html = await response.text();
+		expect( html ).toContain( '@keyframes fadeIn' );
+		expect( html ).not.toContain( 'otter-animation-css' );
+	});
+});
diff --git a/src/blocks/test/e2e/fixtures.ts b/src/blocks/test/e2e/fixtures.ts
index dd13ff773..374f22a75 100644
--- a/src/blocks/test/e2e/fixtures.ts
+++ b/src/blocks/test/e2e/fixtures.ts
@@ -70,6 +70,13 @@ export type OtterUtils = {
 	/** Remove the seeded widget, its CSS file/options, and the filesystem block. */
 	cleanupOtterWidget: () => Promise<unknown>;
 
+	/**
+	 * 'foreign' predefines a typed php-css-parser 9.x Commentable interface before
+	 * plugins load (issue #2942 scenario); 'own' restores the bundled parser.
+	 * Both modes clear the parsed-animations transient.
+	 */
+	setSabberwormMode: ( mode: 'foreign' | 'own' ) => Promise<unknown>;
+
 	/** All stored Submission Records with their Delivery Status meta. */
 	getFormRecords: () => Promise<FormRecord[]>;
 
@@ -105,6 +112,7 @@ export const test = base.extend<{ otterUtils: OtterUtils }>({
 			setFilesystemMode: ( mode ) => call( 'filesystem', { mode }),
 			seedOtterWidget: ( sidebar ) => call( 'widgets/seed', sidebar ? { sidebar } : undefined ),
 			cleanupOtterWidget: () => call( 'widgets/cleanup' ),
+			setSabberwormMode: ( mode ) => call( 'sabberworm', { mode }),
 			getFormRecords: () => call( 'form/records' ) as Promise<FormRecord[]>,
 			cleanupFormRecords: () => call( 'form/records/cleanup' )
 		});
diff --git a/src/blocks/test/e2e/playwright.config.js b/src/blocks/test/e2e/playwright.config.js
index 79ec41825..7e8340d59 100644
--- a/src/blocks/test/e2e/playwright.config.js
+++ b/src/blocks/test/e2e/playwright.config.js
@@ -63,7 +63,10 @@ const SERIAL_SPECS = [
 	'**/blocks/widgets-css-frontend.spec.js',
 
 	// Flips a site-wide flag that breaks Otter's autoloader for every request.
-	'**/blocks/autoloader-resilience.spec.js'
+	'**/blocks/autoloader-resilience.spec.js',
+
+	// Flips a site-wide flag that injects a foreign Sabberworm interface for every request.
+	'**/blocks/sabberworm-collision.spec.js'
 ];
 
 const config = defineConfig({
diff --git a/tests/php/foreign-sabberworm-sandbox.php b/tests/php/foreign-sabberworm-sandbox.php
new file mode 100644
index 000000000..21c32becd
--- /dev/null
+++ b/tests/php/foreign-sabberworm-sandbox.php
@@ -0,0 +1,92 @@
+<?php
+/**
+ * Standalone sandbox for the Sabberworm dependency-collision regression (issue #2942).
+ *
+ * Simulates another plugin having already loaded classes from a different
+ * php-css-parser release, which makes mixing in Otter's bundled copy fatal at
+ * class-link or call time. Base_CSS::get_animation_css() must detect the
+ * foreign copy and skip the optimization instead of parsing.
+ *
+ * Run in a separate PHP process (no WordPress loaded):
+ *   php foreign-sabberworm-sandbox.php [commentable|outputformat]
+ *
+ * - `commentable` (default): the typed 9.x `Commentable` interface is preloaded —
+ *   loading the bundled untyped `CSSList` then fatals at class-link time on
+ *   PHP 8.1+ with "Declaration of ... must be compatible ...".
+ * - `outputformat`: a foreign copy of the non-sentinel `OutputFormat` class is
+ *   preloaded — proving the guard rejects any foreign `Sabberworm\CSS` symbol,
+ *   not only its sentinels.
+ *
+ * @package gutenberg-blocks
+ */
+
+// phpcs:ignoreFile -- multi-namespace sandbox executed outside WordPress.
+
+namespace {
+	$GLOBALS['otter_sandbox_scenario'] = isset( $argv[1] ) ? $argv[1] : 'commentable';
+}
+
+namespace Sabberworm\CSS\Comment {
+	if ( 'commentable' === $GLOBALS['otter_sandbox_scenario'] ) {
+		// The typed interface shape shipped by php-css-parser 9.x.
+		interface Commentable {
+			public function addComments( array $comments ): void;
+			public function getComments(): array;
+			public function setComments( array $comments ): void;
+		}
+	}
+}
+
+namespace Sabberworm\CSS {
+	if ( 'outputformat' === $GLOBALS['otter_sandbox_scenario'] ) {
+		// A foreign copy of a class the parser uses but the guard's sentinels
+		// do not cover, as another plugin's autoloader would leave behind.
+		class OutputFormat {}
+	}
+}
+
+namespace {
+	error_reporting( E_ALL );
+
+	define( 'OTTER_BLOCKS_PATH', dirname( dirname( __DIR__ ) ) );
+	define( 'MONTH_IN_SECONDS', 30 * 24 * 60 * 60 );
+
+	function get_transient( $key ) { return false; }
+	function set_transient( $key, $value, $expiration ) { return true; }
+	function get_option( $key, $default_value = false ) { return $default_value; }
+	function add_action() {}
+	function add_filter() {}
+	function apply_filters( $tag, $value ) { return $value; }
+	function wp_normalize_path( $path ) { return str_replace( '\\', '/', $path ); }
+	function wp_enqueue_style( $handle ) {}
+
+	// Minimal autoloader for Otter's bundled parser only — mirrors the situation
+	// where Otter's Composer autoloader serves the remaining Sabberworm classes.
+	spl_autoload_register(
+		function ( $class ) {
+			$prefix = 'Sabberworm\\CSS\\';
+			if ( 0 !== strpos( $class, $prefix ) ) {
+				return;
+			}
+			$file = OTTER_BLOCKS_PATH . '/vendor/sabberworm/php-css-parser/src/' . str_replace( '\\', '/', substr( $class, strlen( $prefix ) ) ) . '.php';
+			if ( is_file( $file ) ) {
+				require $file;
+			}
+		}
+	);
+
+	require OTTER_BLOCKS_PATH . '/inc/class-base-css.php';
+
+	$base   = new \ThemeIsle\GutenbergBlocks\Base_CSS();
+	$blocks = array(
+		array(
+			'blockName' => 'core/paragraph',
+			'attrs'     => array( 'className' => 'animated fadeIn' ),
+		),
+	);
+
+	$css = $base->get_animation_css( $blocks );
+
+	echo 'CSS_LENGTH:' . strlen( (string) $css ) . "\n";
+	echo "REQUEST COMPLETED WITHOUT FATAL\n";
+}
diff --git a/tests/test-animation-css.php b/tests/test-animation-css.php
new file mode 100644
index 000000000..7bc8e236a
--- /dev/null
+++ b/tests/test-animation-css.php
@@ -0,0 +1,93 @@
+<?php
+/**
+ * Class Test_Animation_CSS
+ *
+ * @package gutenberg-blocks
+ */
+
+use ThemeIsle\GutenbergBlocks\Base_CSS;
+
+/**
+ * Animation-CSS parser collision tests.
+ *
+ * Regression coverage for https://github.com/Codeinwp/otter-blocks/issues/2942 —
+ * a frontend request fataled with a declaration-compatibility error when another
+ * plugin had loaded a different php-css-parser release before Otter parsed the
+ * animation stylesheet.
+ */
+class Test_Animation_CSS extends WP_UnitTestCase {
+
+	/**
+	 * A single animated block, as parse_blocks() would shape it.
+	 *
+	 * @return array<int, array<string, mixed>>
+	 */
+	private function animated_blocks() {
+		return array(
+			array(
+				'blockName' => 'core/paragraph',
+				'attrs'     => array( 'className' => 'animated fadeIn' ),
+			),
+		);
+	}
+
+	/**
+	 * With a foreign typed `Commentable` interface already loaded, parsing must be
+	 * skipped in favor of the stock stylesheet — not fatal at class-link time.
+	 *
+	 * The collision poisons every later Sabberworm use in the process, so the
+	 * scenario runs in a separate PHP process against a predefined 9.x interface.
+	 */
+	public function test_get_animation_css_falls_back_when_foreign_parser_is_loaded() {
+		$output = $this->run_sandbox( 'commentable' );
+
+		$this->assertStringContainsString( 'CSS_LENGTH:0', $output, 'The optimization should be skipped when a foreign parser is loaded: ' . $output );
+		$this->assertStringNotContainsString( 'must be compatible', $output );
+	}
+
+	/**
+	 * The guard must reject any preloaded foreign `Sabberworm\CSS` symbol, not
+	 * only its sentinel entry points — here a foreign `OutputFormat` class.
+	 */
+	public function test_get_animation_css_falls_back_when_foreign_non_sentinel_class_is_loaded() {
+		$output = $this->run_sandbox( 'outputformat' );
+
+		$this->assertStringContainsString( 'CSS_LENGTH:0', $output, 'The optimization should be skipped when any foreign Sabberworm class is loaded: ' . $output );
+	}
+
+	/**
+	 * Run the collision sandbox in a separate PHP process and assert it completes.
+	 *
+	 * @param string $scenario Sandbox scenario name.
+	 * @return string Combined process output.
+	 */
+	private function run_sandbox( $scenario ) {
+		$sandbox = __DIR__ . '/php/foreign-sabberworm-sandbox.php';
+
+		$command = escapeshellarg( PHP_BINARY ) . ' -d display_errors=1 ' . escapeshellarg( $sandbox ) . ' ' . escapeshellarg( $scenario ) . ' 2>&1';
+
+		exec( $command, $output, $exit_code ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.system_calls_exec
+
+		$output = implode( "\n", $output );
+
+		$this->assertSame( 0, $exit_code, 'The sandbox request fataled instead of degrading gracefully: ' . $output );
+		$this->assertStringContainsString( 'REQUEST COMPLETED WITHOUT FATAL', $output );
+
+		return $output;
+	}
+
+	/**
+	 * Sanity check: with only the bundled parser present, the guard passes and the
+	 * optimized subset is produced.
+	 */
+	public function test_get_animation_css_parses_with_bundled_parser() {
+		$this->assertTrue( Base_CSS::has_own_css_parser() );
+
+		delete_transient( 'otter_animations_parsed' );
+
+		$css = ( new Base_CSS() )->get_animation_css( $this->animated_blocks() );
+
+		$this->assertStringContainsString( 'fadeIn', $css );
+		$this->assertStringContainsString( '@keyframes', $css );
+	}
+}

From fdef3a8c6357d3a06a917196ef9d9f3fb4aa4163 Mon Sep 17 00:00:00 2001
From: Soare Robert Daniel <soare.robert.daniel@protonmail.com>
Date: Tue, 18 Aug 2026 15:02:38 +0300
Subject: [PATCH 05/25] fix: keep Meta Boxes pane open by default for
 WooCommerce Builder products (#2926)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: keep Meta Boxes pane open by default for WooCommerce Builder products

Since WP 6.7 the iframed post editor renders meta boxes in a bottom drawer
that is collapsed unless the user previously opened it. Otter 3.2.0 bumped
all blocks to apiVersion 3, which switched WooCommerce Builder product edit
screens to the iframed canvas, hiding the WooCommerce Product data panel
(price, inventory, etc.) behind the collapsed drawer.

Default the drawer to open on builder-enabled product screens via the
preferences setDefaults API, which never overrides an explicit user choice.

Closes #2822

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: rescue Product data metabox from the side column + e2e coverage

The metabox Move-up/down arrows persist the order instantly and, at the
edge of an area, relocate a box into the adjacent area. From the block
editor (WooCommerce Builder products) one accidental click can strand
woocommerce-product-data in 'side', where it renders inside the ~280px
sidebar and its layout breaks. Correct it at read time via the
get_user_option_meta-box-order_product filter.

Adds Playwright coverage for the builder edit screen: drawer open by
default, side-area rescue, classic-editor scoping for non-builder
products, and explicit user preference winning over the new default.
WooCommerce (latest stable) joins .wp-env.json; the e2e bootstrap gains
product-creation and user-meta helpers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: address review, scope the rescue, and keep WooCommerce out of other suites

- Add the missing void return type that failed PHPStan.
- Scope restore_product_data_location() to builder-enabled products, so a
  layout saved on a classic product is left as the user arranged it.
- Add PHPUnit coverage for both guards: the inline meta-boxes-pane default
  (present for builder products, absent for plain products and non-product
  posts) and the metabox-order rescue.
- Mount WooCommerce as an inactive wp-env mapping from the copy composer
  already installs, and activate it only around the WooCommerce spec.
  Activating it for the whole environment changed editor load behavior and
  broke the performance suite.
- Reset the shared admin user's drawer preference and metabox order in
  beforeEach as well as afterEach, so the first test is not skewed by
  state left behind by an earlier run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: load a single WooCommerce copy in the PHPUnit bootstrap

Mounting WooCommerce at wp-content/plugins/woocommerce made the existing
activate_plugin() call in the bootstrap resolve — it had been a silent
no-op while that directory did not exist. activate_plugin() includes the
plugin file through plugin_sandbox_scrape(), so WooCommerce was loaded
via two different paths and PHP fataled on redeclaring the unguarded
WC() and wc_get_container() functions, failing the suite with exit 255
before any test ran.

Load the mounted copy when present so both includes resolve to the same
path, keeping the vendor copy as a fallback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: delete the products the WooCommerce spec creates

Each test published a product and teardown only reset user metadata, so a
reused wp-env gained four products per run and later product suites could
run against that residue.

Track the ids the spec creates and hard-delete exactly those in afterEach,
while WooCommerce is still active so its product lookup tables are cleaned
too. The endpoint ignores ids that are not products, so a stale id cannot
remove unrelated content.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: restore the script registry after the WooCommerce Builder test

Removing the dummy wp-edit-post handle in teardown left the shared
$wp_scripts registry without WordPress's own registration, so later tests
could fail depending on suite order. Discard the registry instead, which
makes the next wp_scripts() call rebuild every default registration.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: run the suites against current WooCommerce

The composer constraint is open but the lock still pinned 10.1.2 from a
year ago, so mounting the Composer copy meant neither the new regression
suite nor the PHPUnit bootstrap exercised current WooCommerce, and the
pin also contradicted the php-stubs/woocommerce-stubs ^10.8 requirement.

Refresh the lock to 10.9.4, the version the regression was reproduced on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Marius Cristea <marius.cristea@vertistudio.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pirate-bot <58979018+pirate-bot@users.noreply.github.com>
---
 .wp-env.json                                  |   3 +-
 composer.lock                                 |   6 +-
 .../mu-plugins/otter-e2e-bootstrap.php        | 105 ++++++++++++
 .../inc/plugins/class-woocommerce-builder.php |  59 +++++++
 .../e2e/blocks/woocommerce-builder.spec.js    | 145 +++++++++++++++++
 src/blocks/test/e2e/fixtures.ts               |  18 ++-
 src/blocks/test/e2e/playwright.config.js      |   3 +
 tests/bootstrap.php                           |  12 +-
 tests/test-woocommerce-builder.php            | 149 ++++++++++++++++++
 9 files changed, 494 insertions(+), 6 deletions(-)
 create mode 100644 src/blocks/test/e2e/blocks/woocommerce-builder.spec.js
 create mode 100644 tests/test-woocommerce-builder.php

diff --git a/.wp-env.json b/.wp-env.json
index baf5a856f..e9f3eebbc 100644
--- a/.wp-env.json
+++ b/.wp-env.json
@@ -20,7 +20,8 @@
   },
   "mappings": {
     "wp-content/mu-plugins": "./packages/e2e-tests/mu-plugins",
-    "wp-content/themes/raft": "https://downloads.wordpress.org/theme/raft.zip"
+    "wp-content/themes/raft": "https://downloads.wordpress.org/theme/raft.zip",
+    "wp-content/plugins/woocommerce": "./vendor/wp-content/plugins/woocommerce"
   },
   "lifecycleScripts": {
     "afterStart": "bash bin/e2e-tests.sh"
diff --git a/composer.lock b/composer.lock
index c3be5643a..f81925300 100644
--- a/composer.lock
+++ b/composer.lock
@@ -3113,15 +3113,15 @@
         },
         {
             "name": "wpackagist-plugin/woocommerce",
-            "version": "10.1.2",
+            "version": "10.9.4",
             "source": {
                 "type": "svn",
                 "url": "https://plugins.svn.wordpress.org/woocommerce/",
-                "reference": "tags/10.1.2"
+                "reference": "tags/10.9.4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://downloads.wordpress.org/plugin/woocommerce.10.1.2.zip"
+                "url": "https://downloads.wordpress.org/plugin/woocommerce.10.9.4.zip"
             },
             "require": {
                 "composer/installers": "^1.0 || ^2.0"
diff --git a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
index 9344106be..21321a40f 100644
--- a/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
+++ b/packages/e2e-tests/mu-plugins/otter-e2e-bootstrap.php
@@ -1438,6 +1438,111 @@ function () {
 			)
 		);
 
+		register_rest_route(
+			REST_NAMESPACE,
+			'/woo/product',
+			array(
+				'methods'             => \WP_REST_Server::CREATABLE,
+				'permission_callback' => __NAMESPACE__ . '\\require_admin',
+				'callback'            => function ( \WP_REST_Request $request ) {
+					if ( ! class_exists( 'WC_Product_Simple' ) ) {
+						return new \WP_Error(
+							'otter_e2e_no_woocommerce',
+							'WooCommerce is not active in the environment.',
+							array( 'status' => 500 )
+						);
+					}
+
+					// The spec activates WooCommerce right before this call; drop
+					// the redirect it schedules so it cannot hijack admin visits.
+					delete_transient( '_wc_activation_redirect' );
+
+					$product = new \WC_Product_Simple();
+					$product->set_name( $request->get_param( 'title' ) ? sanitize_text_field( $request->get_param( 'title' ) ) : 'E2E Product' );
+					$product->set_regular_price( '49.99' );
+					$product->set_status( 'publish' );
+					$id = $product->save();
+
+					if ( rest_sanitize_boolean( $request->get_param( 'builder' ) ) ) {
+						update_post_meta( $id, '_themeisle_gutenberg_woo_builder', true );
+					}
+
+					return rest_ensure_response( array( 'id' => $id ) );
+				},
+			)
+		);
+
+		register_rest_route(
+			REST_NAMESPACE,
+			'/woo/product/delete',
+			array(
+				'methods'             => \WP_REST_Server::CREATABLE,
+				'permission_callback' => __NAMESPACE__ . '\\require_admin',
+				'callback'            => function ( \WP_REST_Request $request ) {
+					$deleted = array();
+
+					foreach ( (array) $request->get_param( 'ids' ) as $id ) {
+						$id = absint( $id );
+
+						// Only ever remove products, so a stale id from a spec
+						// cannot delete unrelated content in a reused env.
+						if ( 0 === $id || 'product' !== get_post_type( $id ) ) {
+							continue;
+						}
+
+						wp_delete_post( $id, true );
+						$deleted[] = $id;
+					}
+
+					return rest_ensure_response( array( 'deleted' => $deleted ) );
+				},
+			)
+		);
+
+		register_rest_route(
+			REST_NAMESPACE,
+			'/user/meta-box-order',
+			array(
+				'methods'             => \WP_REST_Server::CREATABLE,
+				'permission_callback' => __NAMESPACE__ . '\\require_admin',
+				'callback'            => function ( \WP_REST_Request $request ) {
+					$order = $request->get_param( 'order' );
+
+					if ( ! is_array( $order ) || empty( $order ) ) {
+						delete_user_meta( get_current_user_id(), 'meta-box-order_product' );
+					} else {
+						update_user_meta( get_current_user_id(), 'meta-box-order_product', array_map( 'sanitize_text_field', $order ) );
+					}
+
+					return rest_ensure_response( array( 'ok' => true ) );
+				},
+			)
+		);
+
+		register_rest_route(
+			REST_NAMESPACE,
+			'/user/meta-boxes-pane/reset',
+			array(
+				'methods'             => \WP_REST_Server::CREATABLE,
+				'permission_callback' => __NAMESPACE__ . '\\require_admin',
+				'callback'            => function () {
+					$user_id     = get_current_user_id();
+					$meta_key    = $GLOBALS['wpdb']->get_blog_prefix() . 'persisted_preferences';
+					$preferences = get_user_meta( $user_id, $meta_key, true );
+
+					if ( is_array( $preferences ) && isset( $preferences['core/edit-post'] ) ) {
+						unset(
+							$preferences['core/edit-post']['metaBoxesMainIsOpen'],
+							$preferences['core/edit-post']['metaBoxesMainOpenHeight']
+						);
+						update_user_meta( $user_id, $meta_key, $preferences );
+					}
+
+					return rest_ensure_response( array( 'ok' => true ) );
+				},
+			)
+		);
+
 		register_rest_route(
 			REST_NAMESPACE,
 			'/filesystem',
diff --git a/plugins/otter-pro/inc/plugins/class-woocommerce-builder.php b/plugins/otter-pro/inc/plugins/class-woocommerce-builder.php
index cdfdf59e0..20b379015 100644
--- a/plugins/otter-pro/inc/plugins/class-woocommerce-builder.php
+++ b/plugins/otter-pro/inc/plugins/class-woocommerce-builder.php
@@ -30,6 +30,65 @@ public function init() {
 		add_filter( 'wc_get_template_part', array( $this, 'wc_get_template_part' ), 1000, 3 );
 		add_action( 'otter_blocks_woocommerce_content', 'the_content' );
 		add_filter( 'body_class', array( $this, 'add_body_class' ), 1000, 1 );
+		add_action( 'enqueue_block_editor_assets', array( $this, 'show_meta_boxes_pane' ) );
+		add_filter( 'get_user_option_meta-box-order_product', array( $this, 'restore_product_data_location' ) );
+	}
+
+	/**
+	 * Keep the Product data metabox out of the narrow side column.
+	 *
+	 * The metabox "Move up/down" arrows persist the order instantly and, at the
+	 * edge of an area, relocate a box into the adjacent area. From the block
+	 * editor (used by WooCommerce Builder products) one accidental click can
+	 * move WooCommerce's Product data box into "side", where it renders inside
+	 * the ~280px sidebar and its layout breaks. Correct it at read time; the
+	 * stored user option is left untouched.
+	 *
+	 * @param mixed $order Saved metabox order for the product screen.
+	 *
+	 * @access  public
+	 * @return  mixed
+	 */
+	public function restore_product_data_location( $order ) {
+		if ( ! boolval( get_post_meta( get_the_ID(), '_themeisle_gutenberg_woo_builder', true ) ) ) {
+			return $order;
+		}
+
+		if ( ! is_array( $order ) || ! isset( $order['side'] ) || false === strpos( $order['side'], 'woocommerce-product-data' ) ) {
+			return $order;
+		}
+
+		$side   = array_diff( explode( ',', $order['side'] ), array( 'woocommerce-product-data' ) );
+		$normal = empty( $order['normal'] ) ? array() : explode( ',', $order['normal'] );
+		array_unshift( $normal, 'woocommerce-product-data' );
+
+		$order['side']   = implode( ',', $side );
+		$order['normal'] = implode( ',', array_unique( $normal ) );
+
+		return $order;
+	}
+
+	/**
+	 * Keep the Meta Boxes pane open by default in the block editor.
+	 *
+	 * Since WP 6.7 the iframed post editor renders meta boxes inside a bottom
+	 * drawer that is collapsed unless the user opened it before. On builder
+	 * products that hides the WooCommerce Product data panel (price, inventory
+	 * etc.), so default the drawer to open. An explicit user preference is not
+	 * overridden, as setDefaults only applies to unset preferences.
+	 *
+	 * @access  public
+	 * @return  void
+	 */
+	public function show_meta_boxes_pane() {
+		if ( 'product' !== get_post_type() || ! boolval( get_post_meta( get_the_ID(), '_themeisle_gutenberg_woo_builder', true ) ) ) {
+			return;
+		}
+
+		wp_add_inline_script(
+			'wp-edit-post',
+			'window.wp && wp.data && wp.data.dispatch( "core/preferences" ).setDefaults( "core/edit-post", { metaBoxesMainIsOpen: true } );'
+		);
 	}
 
 	/**
diff --git a/src/blocks/test/e2e/blocks/woocommerce-builder.spec.js b/src/blocks/test/e2e/blocks/woocommerce-builder.spec.js
new file mode 100644
index 000000000..4ce4b3273
--- /dev/null
+++ b/src/blocks/test/e2e/blocks/woocommerce-builder.spec.js
@@ -0,0 +1,145 @@
+/**
+ * Internal dependencies
+ */
+import { test, expect } from '../fixtures';
+
+/**
+ * WooCommerce Builder forces the block editor for enabled products. Since
+ * WP 6.7 the iframed post editor renders meta boxes in a bottom drawer, so
+ * these tests pin the two guarantees that keep WooCommerce's Product data
+ * panel (price, inventory, …) reachable there:
+ *
+ * 1. the drawer defaults to open (an explicit user preference still wins);
+ * 2. a `meta-box-order_product` that strands the Product data box in the
+ *    "side" area (one accidental click on the metabox move arrows persists
+ *    that) is corrected back into the main area at render time.
+ */
+
+const PRODUCT_DATA = '#woocommerce-product-data';
+const META_BOXES_DRAWER = '.edit-post-meta-boxes-main';
+
+/**
+ * The Otter welcome tour pops on fresh profiles; close it if it appears.
+ *
+ * @param {import('@playwright/test').Page} page Playwright page.
+ */
+const dismissOtterTour = async( page ) => {
+	const guide = page.locator( '.components-guide' );
+	if ( await guide.isVisible({ timeout: 2000 }).catch( () => false ) ) {
+		await page.keyboard.press( 'Escape' );
+		await expect( guide ).toBeHidden();
+	}
+};
+
+test.describe( 'WooCommerce Builder product editor', () => {
+	// WooCommerce is mounted by wp-env but only activated around this spec —
+	// its editor integrations would change load behavior (and performance
+	// numbers) for every other suite. Serial project only.
+	test.beforeAll( async({ requestUtils }) => {
+		await requestUtils.activatePlugin( 'woocommerce' );
+	});
+
+	test.afterAll( async({ requestUtils }) => {
+		await requestUtils.deactivatePlugin( 'woocommerce' );
+	});
+
+	// A drawer preference or metabox order left by an earlier run would skew
+	// the first test as much as a later one, so reset on both sides.
+	const resetSharedUserState = async( otterUtils ) => {
+		await otterUtils.setProductMetaBoxOrder( null );
+		await otterUtils.resetMetaBoxesPane();
+	};
+
+	// wp-env is reused between runs, so every product a test publishes has to
+	// be removed again or they pile up and skew later product suites.
+	let createdProductIds = [];
+
+	const createProduct = async( otterUtils, args ) => {
+		const { id } = await otterUtils.createWooProduct( args );
+
+		createdProductIds.push( id );
+
+		return id;
+	};
+
+	test.beforeEach( async({ otterUtils }) => {
+		await resetSharedUserState( otterUtils );
+	});
+
+	// Runs while WooCommerce is still active (afterAll deactivates it), so the
+	// deletes also clear its product lookup tables.
+	test.afterEach( async({ otterUtils }) => {
+		await resetSharedUserState( otterUtils );
+
+		if ( createdProductIds.length ) {
+			await otterUtils.deleteWooProducts( createdProductIds );
+			createdProductIds = [];
+		}
+	});
+
+	test( 'builder products open in the block editor with the Product data panel visible', async({ admin, page, otterUtils }) => {
+		const id = await createProduct( otterUtils, { builder: true });
+
+		await admin.editPost( id );
+		await dismissOtterTour( page );
+
+		// Block editor is active for the builder product…
+		await expect( page.locator( 'body.block-editor-page' ) ).toHaveCount( 1 );
+
+		// …and the Product data metabox is visible without any interaction:
+		// the meta boxes drawer defaults to open on builder products.
+		await expect( page.locator( PRODUCT_DATA ) ).toBeVisible();
+		await expect( page.locator( `${ PRODUCT_DATA } input[name="_regular_price"]` ) ).toHaveValue( '49.99' );
+	});
+
+	test( 'Product data stranded in the side area is rescued into the drawer', async({ admin, page, otterUtils }) => {
+		const id = await createProduct( otterUtils, { builder: true });
+
+		// The corrupted layout one metabox arrow click can persist: Product
+		// data serialized into "side", which renders inside the ~280px
+		// sidebar where its layout breaks.
+		await otterUtils.setProductMetaBoxOrder({
+			normal: '',
+			advanced: 'commentsdiv,postexcerpt',
+			side: 'woocommerce-product-data,otter_woo_builder,woocommerce-product-images'
+		});
+
+		await admin.editPost( id );
+		await dismissOtterTour( page );
+
+		await expect( page.locator( `${ META_BOXES_DRAWER } ${ PRODUCT_DATA }` ) ).toBeVisible();
+		await expect( page.locator( `.interface-complementary-area ${ PRODUCT_DATA }` ) ).toHaveCount( 0 );
+	});
+
+	test( 'products without the builder keep the classic editor', async({ admin, page, otterUtils }) => {
+		const id = await createProduct( otterUtils, { builder: false });
+
+		await admin.visitAdminPage( 'post.php', `post=${ id }&action=edit` );
+
+		await expect( page.locator( 'body.block-editor-page' ) ).toHaveCount( 0 );
+		await expect( page.locator( PRODUCT_DATA ) ).toBeVisible();
+	});
+
+	test( 'an explicitly collapsed drawer stays collapsed (user preference wins)', async({ admin, page, otterUtils }) => {
+		const id = await createProduct( otterUtils, { builder: true });
+
+		await admin.editPost( id );
+		await dismissOtterTour( page );
+		await expect( page.locator( PRODUCT_DATA ) ).toBeVisible();
+
+		// Collapse the drawer — this persists the user preference, which
+		// setDefaults() must not override on the next load. Keyboard: the
+		// toggle's click point is covered by its drag-resize separator. The
+		// preference write is debounced, so hold for the REST flush before
+		// reloading.
+		await Promise.all([
+			page.waitForResponse( ( response ) => response.url().includes( '/wp/v2/users/me' ) ),
+			page.getByRole( 'button', { name: 'Meta Boxes' }).press( 'Enter' )
+		]);
+		await expect( page.locator( PRODUCT_DATA ) ).toBeHidden();
+
+		await admin.editPost( id );
+		await expect( page.locator( META_BOXES_DRAWER ) ).toBeVisible();
+		await expect( page.locator( PRODUCT_DATA ) ).toBeHidden();
+	});
+});
diff --git a/src/blocks/test/e2e/fixtures.ts b/src/blocks/test/e2e/fixtures.ts
index 374f22a75..9e590801e 100644
--- a/src/blocks/test/e2e/fixtures.ts
+++ b/src/blocks/test/e2e/fixtures.ts
@@ -82,6 +82,18 @@ export type OtterUtils = {
 
 	/** Hard-delete all Submission Records. */
 	cleanupFormRecords: () => Promise<unknown>;
+
+	/** Create a published simple WooCommerce product (price 49.99); `builder` also enables WooCommerce Builder on it. */
+	createWooProduct: ( args?: { title?: string; builder?: boolean } ) => Promise<{ id: number }>;
+
+	/** Hard-delete products created by a spec. Ids that are not products are ignored. */
+	deleteWooProducts: ( ids: number[] ) => Promise<unknown>;
+
+	/** Set the current user's product metabox order (`meta-box-order_product`); null/empty resets it. */
+	setProductMetaBoxOrder: ( order: Record<string, string> | null ) => Promise<unknown>;
+
+	/** Remove the current user's persisted meta-boxes-pane preferences (open state and height). */
+	resetMetaBoxesPane: () => Promise<unknown>;
 };
 
 export const test = base.extend<{ otterUtils: OtterUtils }>({
@@ -114,7 +126,11 @@ export const test = base.extend<{ otterUtils: OtterUtils }>({
 			cleanupOtterWidget: () => call( 'widgets/cleanup' ),
 			setSabberwormMode: ( mode ) => call( 'sabberworm', { mode }),
 			getFormRecords: () => call( 'form/records' ) as Promise<FormRecord[]>,
-			cleanupFormRecords: () => call( 'form/records/cleanup' )
+			cleanupFormRecords: () => call( 'form/records/cleanup' ),
+			createWooProduct: ( args ) => call( 'woo/product', args ?? {}) as Promise<{ id: number }>,
+			deleteWooProducts: ( ids ) => call( 'woo/product/delete', { ids }),
+			setProductMetaBoxOrder: ( order ) => call( 'user/meta-box-order', { order }),
+			resetMetaBoxesPane: () => call( 'user/meta-boxes-pane/reset' )
 		});
 	}
 });
diff --git a/src/blocks/test/e2e/playwright.config.js b/src/blocks/test/e2e/playwright.config.js
index 7e8340d59..04cc7bd68 100644
--- a/src/blocks/test/e2e/playwright.config.js
+++ b/src/blocks/test/e2e/playwright.config.js
@@ -59,6 +59,9 @@ const SERIAL_SPECS = [
 	// Flips the site-wide atomic-wind blocks option.
 	'**/blocks/atomic-wind-list-view.spec.js',
 
+	// Mutates the shared admin user's metabox order and editor preferences.
+	'**/blocks/woocommerce-builder.spec.js',
+
 	// Switches the active theme and mutates site-wide widget + filesystem state.
 	'**/blocks/widgets-css-frontend.spec.js',
 
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
index 51701404f..b5d4edc0a 100644
--- a/tests/bootstrap.php
+++ b/tests/bootstrap.php
@@ -20,7 +20,17 @@
 
 function _manually_load_plugin() {
 	require dirname( dirname( __FILE__ ) ) . '/otter-blocks.php';
-	require dirname( dirname( __FILE__ ) ) . '/vendor/wp-content/plugins/woocommerce/woocommerce.php';
+
+	/*
+	 * wp-env also mounts WooCommerce at wp-content/plugins/woocommerce (see
+	 * .wp-env.json). Prefer that copy so the activate_plugin() call below
+	 * resolves to the same file: woocommerce.php declares WC() and
+	 * wc_get_container() unguarded, so including it through two different
+	 * paths is a fatal redeclaration.
+	 */
+	$woocommerce = WP_PLUGIN_DIR . '/woocommerce/woocommerce.php';
+
+	require file_exists( $woocommerce ) ? $woocommerce : dirname( dirname( __FILE__ ) ) . '/vendor/wp-content/plugins/woocommerce/woocommerce.php';
 }
 
 tests_add_filter( 'muplugins_loaded', '_manually_load_plugin' );
diff --git a/tests/test-woocommerce-builder.php b/tests/test-woocommerce-builder.php
new file mode 100644
index 000000000..95fef5cae
--- /dev/null
+++ b/tests/test-woocommerce-builder.php
@@ -0,0 +1,149 @@
+<?php
+/**
+ * Class TestWooCommerceBuilder
+ *
+ * @package gutenberg-blocks
+ */
+
+use ThemeIsle\OtterPro\Plugins\WooCommerce_Builder;
+
+/**
+ * WooCommerce Builder Test Case.
+ *
+ * Covers the two guards that keep the WooCommerce Product data metabox
+ * reachable on builder products: the meta-boxes pane default and the
+ * metabox-order rescue (issue #2822).
+ */
+class TestWooCommerceBuilder extends WP_UnitTestCase {
+
+	/**
+	 * The WooCommerce Builder instance.
+	 *
+	 * @var WooCommerce_Builder
+	 */
+	protected $woo_builder;
+
+	/**
+	 * A product post with the builder enabled.
+	 *
+	 * @var int
+	 */
+	protected $builder_product_id;
+
+	/**
+	 * A product post without the builder.
+	 *
+	 * @var int
+	 */
+	protected $plain_product_id;
+
+	/**
+	 * The corrupted metabox order one move-arrow click can persist.
+	 *
+	 * @var array<string, string>
+	 */
+	protected $stranded_order = array(
+		'normal'   => '',
+		'advanced' => 'commentsdiv,postexcerpt',
+		'side'     => 'woocommerce-product-data,otter_woo_builder,woocommerce-product-images',
+	);
+
+	/**
+	 * Set up.
+	 */
+	public function set_up() {
+		parent::set_up();
+
+		$this->woo_builder = new WooCommerce_Builder();
+
+		// WooCommerce is loaded by tests/bootstrap.php and registers `product`.
+		// Register the editor script fresh so inline-data assertions are isolated.
+		wp_scripts()->remove( 'wp-edit-post' );
+		wp_scripts()->add( 'wp-edit-post', false );
+
+		$this->builder_product_id = self::factory()->post->create( array( 'post_type' => 'product' ) );
+		update_post_meta( $this->builder_product_id, '_themeisle_gutenberg_woo_builder', true );
+
+		$this->plain_product_id = self::factory()->post->create( array( 'post_type' => 'product' ) );
+	}
+
+	/**
+	 * Tear down.
+	 */
+	public function tear_down() {
+		/*
+		 * Discard the whole registry instead of just the dummy handle: it is
+		 * shared between tests, so removing the handle would leave it without
+		 * WordPress's own wp-edit-post registration and break later tests
+		 * depending on suite order. Nulling it makes the next wp_scripts()
+		 * call rebuild every default registration.
+		 */
+		$GLOBALS['wp_scripts'] = null;
+
+		parent::tear_down();
+	}
+
+	/**
+	 * The meta-boxes pane default is added for builder products only.
+	 */
+	public function test_meta_boxes_pane_default_added_for_builder_products() {
+		$GLOBALS['post'] = get_post( $this->builder_product_id );
+
+		$this->woo_builder->show_meta_boxes_pane();
+
+		$inline = wp_scripts()->get_data( 'wp-edit-post', 'after' );
+
+		$this->assertNotEmpty( $inline );
+		$this->assertStringContainsString( 'metaBoxesMainIsOpen', implode( '', $inline ) );
+	}
+
+	/**
+	 * No inline default for products without the builder or non-product posts.
+	 */
+	public function test_meta_boxes_pane_default_skipped_otherwise() {
+		$GLOBALS['post'] = get_post( $this->plain_product_id );
+		$this->woo_builder->show_meta_boxes_pane();
+
+		$GLOBALS['post'] = get_post( self::factory()->post->create() );
+		$this->woo_builder->show_meta_boxes_pane();
+
+		$this->assertFalse( wp_scripts()->get_data( 'wp-edit-post', 'after' ) );
+	}
+
+	/**
+	 * On builder products, Product data stranded in "side" moves back to "normal".
+	 */
+	public function test_product_data_rescued_from_side_on_builder_products() {
+		$GLOBALS['post'] = get_post( $this->builder_product_id );
+
+		$order = $this->woo_builder->restore_product_data_location( $this->stranded_order );
+
+		$this->assertStringNotContainsString( 'woocommerce-product-data', $order['side'] );
+		$this->assertSame( 'woocommerce-product-data', explode( ',', $order['normal'] )[0] );
+		$this->assertSame( 'otter_woo_builder,woocommerce-product-images', $order['side'] );
+	}
+
+	/**
+	 * Non-builder products keep whatever layout the user saved.
+	 */
+	public function test_saved_order_untouched_without_builder() {
+		$GLOBALS['post'] = get_post( $this->plain_product_id );
+
+		$this->assertSame( $this->stranded_order, $this->woo_builder->restore_product_data_location( $this->stranded_order ) );
+	}
+
+	/**
+	 * Orders that never stranded Product data pass through unchanged.
+	 */
+	public function test_clean_order_passes_through() {
+		$GLOBALS['post'] = get_post( $this->builder_product_id );
+
+		$clean = array(
+			'normal' => 'woocommerce-product-data',
+			'side'   => 'otter_woo_builder',
+		);
+
+		$this->assertSame( $clean, $this->woo_builder->restore_product_data_location( $clean ) );
+		$this->assertFalse( $this->woo_builder->restore_product_data_location( false ) );
+	}
+}

From f7a2f39cd5ca71220cee1b78689ebff1f8bbee78 Mon Sep 17 00:00:00 2001
From: girishpanchal30 <girish@krishaweb.com>
Date: Wed, 19 Aug 2026 11:33:15 +0530
Subject: [PATCH 06/25] fix: validate Stripe price ID before checkout

---
 inc/render/class-stripe-checkout-block.php | 109 ++++++++++-
 tests/test-stripe-checkout-block.php       | 200 +++++++++++++++++++++
 2 files changed, 303 insertions(+), 6 deletions(-)
 create mode 100644 tests/test-stripe-checkout-block.php

diff --git a/inc/render/class-stripe-checkout-block.php b/inc/render/class-stripe-checkout-block.php
index 64efbf819..924da835c 100644
--- a/inc/render/class-stripe-checkout-block.php
+++ b/inc/render/class-stripe-checkout-block.php
@@ -57,7 +57,6 @@ public function watch_checkout() {
 		$product_id = isset( $_GET['product_id'] ) ? sanitize_text_field( wp_unslash( $_GET['product_id'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 		$price_id   = isset( $_GET['price_id'] ) ? sanitize_text_field( wp_unslash( $_GET['price_id'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 		$url        = isset( $_GET['url'] ) ? sanitize_text_field( wp_unslash( $_GET['url'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-		$mode       = isset( $_GET['mode'] ) ? sanitize_text_field( wp_unslash( $_GET['mode'] ) ) : 'payment'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 
 		if ( empty( $product_id ) || empty( $price_id ) || empty( $url ) ) {
 			return sprintf(
@@ -66,12 +65,21 @@ public function watch_checkout() {
 			);
 		}
 
+		$post_id = $this->get_post_id_for_checkout( $product_id, $price_id, $url );
+
+		if ( 0 === $post_id ) {
+			return sprintf(
+				'<div class="wp-block-themeisle-blocks-stripe-checkout"><div class="o-stripe-checkout">%s</div></div>',
+				__( 'An error occurred! Could not retrieve the product information!', 'otter-blocks' )
+			);
+		}
+
 		$permalink = add_query_arg(
 			array(
 				'stripe_session_id' => '{CHECKOUT_SESSION_ID}',
 				'product_id'        => $product_id,
 			),
-			$url
+			get_permalink( $post_id )
 		);
 	
 		$session = $this->stripe_api->create_request(
@@ -85,7 +93,7 @@ public function watch_checkout() {
 						'quantity' => 1,
 					),
 				),
-				'mode'        => $mode,
+				'mode'        => $this->get_mode_for_price( $price_id ),
 			)
 		);
 
@@ -165,15 +173,12 @@ public function render( $attributes ) {
 		$details_markup .= '<h5>' . $currency . $amount . '</h5>';
 		$details_markup .= '</div>';
 
-		$mode = 'recurring' === $price['type'] ? 'subscription' : 'payment';
-
 		$session_url = add_query_arg(
 			array(
 				'action'     => 'buy_stripe',
 				'product_id' => $attributes['product'],
 				'price_id'   => $attributes['price'],
 				'url'        => get_permalink(),
-				'mode'       => $mode,
 			),
 			get_permalink()
 		);
@@ -188,6 +193,98 @@ public function render( $attributes ) {
 		);
 	}
 
+	/**
+	 * Get the ID of the post that offers the given product/price pair.
+	 *
+	 * @param string $product_id Stripe product ID.
+	 * @param string $price_id Stripe price ID.
+	 * @param string $url URL of the page holding the checkout block.
+	 * @return int Post ID, or 0 when the pair is not offered there.
+	 */
+	private function get_post_id_for_checkout( $product_id, $price_id, $url ) {
+		if ( function_exists( 'wpcom_vip_url_to_postid' ) ) {
+			$post_id = wpcom_vip_url_to_postid( $url );
+		} else {
+			$post_id = url_to_postid( $url ); // phpcs:ignore WordPressVIPMinimum.Functions.RestrictedFunctions.url_to_postid_url_to_postid
+		}
+
+		if ( 0 === $post_id ) {
+			return 0;
+		}
+
+		$post = get_post( $post_id );
+
+		if ( ! $post instanceof \WP_Post ) {
+			return 0;
+		}
+
+		if ( 'publish' !== $post->post_status && ! current_user_can( 'read_post', $post_id ) ) {
+			return 0;
+		}
+
+		return $this->blocks_have_checkout( parse_blocks( $post->post_content ), $product_id, $price_id ) ? $post_id : 0;
+	}
+
+	/**
+	 * Check whether a block tree contains a Stripe Checkout block for the given product/price pair.
+	 *
+	 * @param array<int, array<string, mixed>> $blocks Parsed blocks.
+	 * @param string                           $product_id Stripe product ID.
+	 * @param string                           $price_id Stripe price ID.
+	 * @param int                              $depth Current recursion depth.
+	 * @return bool
+	 */
+	private function blocks_have_checkout( $blocks, $product_id, $price_id, $depth = 0 ) {
+		if ( 10 < $depth ) {
+			return false;
+		}
+
+		foreach ( $blocks as $block ) {
+			if ( ! isset( $block['blockName'] ) ) {
+				continue;
+			}
+
+			if ( 'themeisle-blocks/stripe-checkout' === $block['blockName'] ) {
+				$attrs = isset( $block['attrs'] ) ? $block['attrs'] : array();
+
+				if ( isset( $attrs['product'], $attrs['price'] ) && $product_id === $attrs['product'] && $price_id === $attrs['price'] ) {
+					return true;
+				}
+			}
+
+			// Synced patterns keep their content in a separate post.
+			if ( 'core/block' === $block['blockName'] && isset( $block['attrs']['ref'] ) ) {
+				$reusable = get_post( (int) $block['attrs']['ref'] );
+
+				if ( $reusable instanceof \WP_Post && $this->blocks_have_checkout( parse_blocks( $reusable->post_content ), $product_id, $price_id, $depth + 1 ) ) {
+					return true;
+				}
+			}
+
+			if ( ! empty( $block['innerBlocks'] ) && $this->blocks_have_checkout( $block['innerBlocks'], $product_id, $price_id, $depth + 1 ) ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Get the checkout session mode for a price.
+	 *
+	 * @param string $price_id Stripe price ID.
+	 * @return string
+	 */
+	private function get_mode_for_price( $price_id ) {
+		$price = $this->stripe_api->create_request( 'price', $price_id );
+
+		if ( is_wp_error( $price ) || ! isset( $price['type'] ) ) {
+			return 'payment';
+		}
+
+		return 'recurring' === $price['type'] ? 'subscription' : 'payment';
+	}
+
 	/**
 	 * Format the error message.
 	 *
diff --git a/tests/test-stripe-checkout-block.php b/tests/test-stripe-checkout-block.php
new file mode 100644
index 000000000..dd5a062a0
--- /dev/null
+++ b/tests/test-stripe-checkout-block.php
@@ -0,0 +1,200 @@
+<?php
+/**
+ * Class TestStripeCheckoutBlock
+ *
+ * @package otter-blocks
+ */
+
+use ThemeIsle\GutenbergBlocks\Render\Stripe_Checkout_Block;
+use ThemeIsle\GutenbergBlocks\Tests\StripeHttpClientMock;
+
+/**
+ * Stripe Checkout block test case.
+ */
+class TestStripeCheckoutBlock extends WP_UnitTestCase {
+
+	/**
+	 * The block instance.
+	 *
+	 * @var Stripe_Checkout_Block
+	 */
+	private $block;
+
+	/**
+	 * ID of the post holding the checkout block.
+	 *
+	 * @var int
+	 */
+	private $post_id;
+
+	/**
+	 * Set up the test.
+	 */
+	public function set_up() {
+		parent::set_up();
+
+		update_option( 'themeisle_stripe_api_key', 'sk_test' );
+		\Stripe\ApiRequestor::setHttpClient( new StripeHttpClientMock() );
+
+		$this->block = new Stripe_Checkout_Block();
+
+		$this->post_id = $this->factory()->post->create(
+			array(
+				'post_status'  => 'publish',
+				'post_content' => '<!-- wp:themeisle-blocks/stripe-checkout {"product":"prod_1","price":"price_1"} /-->',
+			)
+		);
+
+		// wp_safe_redirect() would end the request, so turn the redirect into an exception.
+		add_filter( 'wp_redirect', array( $this, 'throw_on_redirect' ) );
+	}
+
+	/**
+	 * Tear down the test.
+	 */
+	public function tear_down() {
+		remove_filter( 'wp_redirect', array( $this, 'throw_on_redirect' ) );
+		unset( $_GET['action'], $_GET['product_id'], $_GET['price_id'], $_GET['url'] );
+
+		parent::tear_down();
+	}
+
+	/**
+	 * Turn a redirect into an exception carrying the location.
+	 *
+	 * @param string $location Redirect location.
+	 * @throws Exception Always.
+	 */
+	public function throw_on_redirect( $location ) {
+		throw new Exception( $location );
+	}
+
+	/**
+	 * Run the checkout watcher with the given request parameters.
+	 *
+	 * @param array $params Request parameters.
+	 * @return string Redirect location, or '' when no session was created.
+	 */
+	private function run_checkout( $params ) {
+		$_GET = array_merge( array( 'action' => 'buy_stripe' ), $params );
+
+		try {
+			$this->block->watch_checkout();
+		} catch ( Exception $e ) {
+			return $e->getMessage();
+		}
+
+		return '';
+	}
+
+	/**
+	 * A price configured in the block on the page creates a session.
+	 */
+	public function test_configured_price_creates_session() {
+		$location = $this->run_checkout(
+			array(
+				'product_id' => 'prod_1',
+				'price_id'   => 'price_1',
+				'url'        => get_permalink( $this->post_id ),
+			)
+		);
+
+		$this->assertStringContainsString( 'checkout.stripe.com', $location );
+	}
+
+	/**
+	 * A price that is not configured in the block is rejected.
+	 */
+	public function test_arbitrary_price_is_rejected() {
+		$location = $this->run_checkout(
+			array(
+				'product_id' => 'prod_1',
+				'price_id'   => 'price_cheap',
+				'url'        => get_permalink( $this->post_id ),
+			)
+		);
+
+		$this->assertSame( '', $location );
+	}
+
+	/**
+	 * A product that is not configured in the block is rejected.
+	 */
+	public function test_arbitrary_product_is_rejected() {
+		$location = $this->run_checkout(
+			array(
+				'product_id' => 'prod_2',
+				'price_id'   => 'price_1',
+				'url'        => get_permalink( $this->post_id ),
+			)
+		);
+
+		$this->assertSame( '', $location );
+	}
+
+	/**
+	 * A page without a checkout block for the pair is rejected.
+	 */
+	public function test_unrelated_page_is_rejected() {
+		$other_id = $this->factory()->post->create(
+			array(
+				'post_status'  => 'publish',
+				'post_content' => 'Nothing to buy here.',
+			)
+		);
+
+		$location = $this->run_checkout(
+			array(
+				'product_id' => 'prod_1',
+				'price_id'   => 'price_1',
+				'url'        => get_permalink( $other_id ),
+			)
+		);
+
+		$this->assertSame( '', $location );
+	}
+
+	/**
+	 * A draft page is not a valid checkout source for visitors.
+	 */
+	public function test_draft_page_is_rejected_for_visitors() {
+		wp_update_post(
+			array(
+				'ID'          => $this->post_id,
+				'post_status' => 'draft',
+			)
+		);
+
+		$location = $this->run_checkout(
+			array(
+				'product_id' => 'prod_1',
+				'price_id'   => 'price_1',
+				'url'        => add_query_arg( 'p', $this->post_id, home_url( '/' ) ),
+			)
+		);
+
+		$this->assertSame( '', $location );
+	}
+
+	/**
+	 * A block nested inside a container is still a valid checkout source.
+	 */
+	public function test_nested_block_is_accepted() {
+		$nested_id = $this->factory()->post->create(
+			array(
+				'post_status'  => 'publish',
+				'post_content' => '<!-- wp:group --><div class="wp-block-group"><!-- wp:themeisle-blocks/stripe-checkout {"product":"prod_1","price":"price_1"} /--></div><!-- /wp:group -->',
+			)
+		);
+
+		$location = $this->run_checkout(
+			array(
+				'product_id' => 'prod_1',
+				'price_id'   => 'price_1',
+				'url'        => get_permalink( $nested_id ),
+			)
+		);
+
+		$this->assertStringContainsString( 'checkout.stripe.com', $location );
+	}
+}

From 0e68fcb51725fc292c2cf692be29dcd427190cde Mon Sep 17 00:00:00 2001
From: girishpanchal30 <girish@krishaweb.com>
Date: Wed, 19 Aug 2026 12:13:26 +0530
Subject: [PATCH 07/25] fix: improve block traversal to prevent reference
 cycles

---
 inc/render/class-stripe-checkout-block.php | 29 ++++++++++++----------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/inc/render/class-stripe-checkout-block.php b/inc/render/class-stripe-checkout-block.php
index 924da835c..95ebeba1b 100644
--- a/inc/render/class-stripe-checkout-block.php
+++ b/inc/render/class-stripe-checkout-block.php
@@ -56,7 +56,7 @@ public function watch_checkout() {
 
 		$product_id = isset( $_GET['product_id'] ) ? sanitize_text_field( wp_unslash( $_GET['product_id'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 		$price_id   = isset( $_GET['price_id'] ) ? sanitize_text_field( wp_unslash( $_GET['price_id'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-		$url        = isset( $_GET['url'] ) ? sanitize_text_field( wp_unslash( $_GET['url'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		$url        = isset( $_GET['url'] ) ? sanitize_url( wp_unslash( $_GET['url'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 
 		if ( empty( $product_id ) || empty( $price_id ) || empty( $url ) ) {
 			return sprintf(
@@ -222,7 +222,9 @@ private function get_post_id_for_checkout( $product_id, $price_id, $url ) {
 			return 0;
 		}
 
-		return $this->blocks_have_checkout( parse_blocks( $post->post_content ), $product_id, $price_id ) ? $post_id : 0;
+		$visited = array( $post_id => true );
+
+		return $this->blocks_have_checkout( parse_blocks( $post->post_content ), $product_id, $price_id, $visited ) ? $post_id : 0;
 	}
 
 	/**
@@ -231,14 +233,10 @@ private function get_post_id_for_checkout( $product_id, $price_id, $url ) {
 	 * @param array<int, array<string, mixed>> $blocks Parsed blocks.
 	 * @param string                           $product_id Stripe product ID.
 	 * @param string                           $price_id Stripe price ID.
-	 * @param int                              $depth Current recursion depth.
+	 * @param array<int, bool>                 $visited Reusable block IDs already traversed.
 	 * @return bool
 	 */
-	private function blocks_have_checkout( $blocks, $product_id, $price_id, $depth = 0 ) {
-		if ( 10 < $depth ) {
-			return false;
-		}
-
+	private function blocks_have_checkout( $blocks, $product_id, $price_id, &$visited = array() ) {
 		foreach ( $blocks as $block ) {
 			if ( ! isset( $block['blockName'] ) ) {
 				continue;
@@ -252,16 +250,21 @@ private function blocks_have_checkout( $blocks, $product_id, $price_id, $depth =
 				}
 			}
 
-			// Synced patterns keep their content in a separate post.
+			// Synced patterns keep their content in a separate post; guard against reference cycles.
 			if ( 'core/block' === $block['blockName'] && isset( $block['attrs']['ref'] ) ) {
-				$reusable = get_post( (int) $block['attrs']['ref'] );
+				$ref = (int) $block['attrs']['ref'];
 
-				if ( $reusable instanceof \WP_Post && $this->blocks_have_checkout( parse_blocks( $reusable->post_content ), $product_id, $price_id, $depth + 1 ) ) {
-					return true;
+				if ( ! isset( $visited[ $ref ] ) ) {
+					$visited[ $ref ] = true;
+					$reusable        = get_post( $ref );
+
+					if ( $reusable instanceof \WP_Post && $this->blocks_have_checkout( parse_blocks( $reusable->post_content ), $product_id, $price_id, $visited ) ) {
+						return true;
+					}
 				}
 			}
 
-			if ( ! empty( $block['innerBlocks'] ) && $this->blocks_have_checkout( $block['innerBlocks'], $product_id, $price_id, $depth + 1 ) ) {
+			if ( ! empty( $block['innerBlocks'] ) && $this->blocks_have_checkout( $block['innerBlocks'], $product_id, $price_id, $visited ) ) {
 				return true;
 			}
 		}

From 9dc22740ed9519c8b378c2619336a47651ce66d4 Mon Sep 17 00:00:00 2001
From: girishpanchal30 <girish@krishaweb.com>
Date: Wed, 19 Aug 2026 12:55:01 +0530
Subject: [PATCH 08/25] fix: implement caching for Stripe price mode

---
 inc/render/class-stripe-checkout-block.php | 20 +++++++++-
 tests/stripe-http-client-mock.php          | 14 +++++++
 tests/test-stripe-checkout-block.php       | 43 ++++++++++++++++++++++
 3 files changed, 76 insertions(+), 1 deletion(-)

diff --git a/inc/render/class-stripe-checkout-block.php b/inc/render/class-stripe-checkout-block.php
index 95ebeba1b..84bd1edbf 100644
--- a/inc/render/class-stripe-checkout-block.php
+++ b/inc/render/class-stripe-checkout-block.php
@@ -15,6 +15,13 @@
  * Class Stripe_Checkout_Block
  */
 class Stripe_Checkout_Block {
+	/**
+	 * Transient prefix for the cached checkout mode of a price.
+	 *
+	 * @var string
+	 */
+	const PRICE_MODE_CACHE_PREFIX = 'otter_stripe_price_mode_';
+
 	/**
 	 * Stripe API instance.
 	 * 
@@ -279,13 +286,24 @@ private function blocks_have_checkout( $blocks, $product_id, $price_id, &$visite
 	 * @return string
 	 */
 	private function get_mode_for_price( $price_id ) {
+		$cache_key = self::PRICE_MODE_CACHE_PREFIX . md5( $price_id );
+		$cached    = get_transient( $cache_key );
+
+		if ( 'payment' === $cached || 'subscription' === $cached ) {
+			return $cached;
+		}
+
 		$price = $this->stripe_api->create_request( 'price', $price_id );
 
 		if ( is_wp_error( $price ) || ! isset( $price['type'] ) ) {
 			return 'payment';
 		}
 
-		return 'recurring' === $price['type'] ? 'subscription' : 'payment';
+		$mode = 'recurring' === $price['type'] ? 'subscription' : 'payment';
+
+		set_transient( $cache_key, $mode, WEEK_IN_SECONDS );
+
+		return $mode;
 	}
 
 	/**
diff --git a/tests/stripe-http-client-mock.php b/tests/stripe-http-client-mock.php
index 1f170fd90..95ddc3a14 100644
--- a/tests/stripe-http-client-mock.php
+++ b/tests/stripe-http-client-mock.php
@@ -11,11 +11,25 @@
 
 class StripeHttpClientMock implements ClientInterface
 {
+	/**
+	 * Paths requested since the last reset, so tests can assert on API usage.
+	 *
+	 * @var array
+	 */
+	public static $request_paths = array();
+
+	public static function reset_request_paths()
+	{
+		self::$request_paths = array();
+	}
+
 	public function request($method, $absUrl, $headers, $params, $hasFile)
 	{
 		$urlParts = parse_url($absUrl);
 		$path = $urlParts['path'];
 
+		self::$request_paths[] = $path;
+
 		if ($path === '/v1/products') {
 			return array($this->mockProductsList(), 200, null);
 		}
diff --git a/tests/test-stripe-checkout-block.php b/tests/test-stripe-checkout-block.php
index dd5a062a0..9cba6d8dd 100644
--- a/tests/test-stripe-checkout-block.php
+++ b/tests/test-stripe-checkout-block.php
@@ -27,12 +27,21 @@ class TestStripeCheckoutBlock extends WP_UnitTestCase {
 	 */
 	private $post_id;
 
+	/**
+	 * Value of the Stripe API key option before the test.
+	 *
+	 * @var mixed
+	 */
+	private $previous_api_key;
+
 	/**
 	 * Set up the test.
 	 */
 	public function set_up() {
 		parent::set_up();
 
+		$this->previous_api_key = get_option( 'themeisle_stripe_api_key' );
+
 		update_option( 'themeisle_stripe_api_key', 'sk_test' );
 		\Stripe\ApiRequestor::setHttpClient( new StripeHttpClientMock() );
 
@@ -56,6 +65,17 @@ public function tear_down() {
 		remove_filter( 'wp_redirect', array( $this, 'throw_on_redirect' ) );
 		unset( $_GET['action'], $_GET['product_id'], $_GET['price_id'], $_GET['url'] );
 
+		delete_transient( Stripe_Checkout_Block::PRICE_MODE_CACHE_PREFIX . md5( 'price_1' ) );
+
+		if ( false === $this->previous_api_key ) {
+			delete_option( 'themeisle_stripe_api_key' );
+		} else {
+			update_option( 'themeisle_stripe_api_key', $this->previous_api_key );
+		}
+
+		// The library falls back to this client when none is set, so it is the default to restore.
+		\Stripe\ApiRequestor::setHttpClient( \Stripe\HttpClient\CurlClient::instance() );
+
 		parent::tear_down();
 	}
 
@@ -102,6 +122,29 @@ public function test_configured_price_creates_session() {
 		$this->assertStringContainsString( 'checkout.stripe.com', $location );
 	}
 
+	/**
+	 * The checkout mode is derived from the price and then served from cache.
+	 */
+	public function test_price_mode_is_cached() {
+		$args = array(
+			'product_id' => 'prod_1',
+			'price_id'   => 'price_1',
+			'url'        => get_permalink( $this->post_id ),
+		);
+
+		StripeHttpClientMock::reset_request_paths();
+		$this->run_checkout( $args );
+
+		$this->assertContains( '/v1/prices/price_1', StripeHttpClientMock::$request_paths );
+		$this->assertSame( 'payment', get_transient( Stripe_Checkout_Block::PRICE_MODE_CACHE_PREFIX . md5( 'price_1' ) ) );
+
+		StripeHttpClientMock::reset_request_paths();
+		$location = $this->run_checkout( $args );
+
+		$this->assertNotContains( '/v1/prices/price_1', StripeHttpClientMock::$request_paths );
+		$this->assertStringContainsString( 'checkout.stripe.com', $location );
+	}
+
 	/**
 	 * A price that is not configured in the block is rejected.
 	 */

From ac0fc732d351ebb6c460dc9bca98c8244bd014d0 Mon Sep 17 00:00:00 2001
From: girishpanchal30 <girish@krishaweb.com>
Date: Thu, 20 Aug 2026 10:38:11 +0530
Subject: [PATCH 09/25] fix: enhance Stripe Checkout block with token
 validation

---
 inc/render/class-stripe-checkout-block.php |  96 +++--------
 tests/stripe-http-client-mock.php          |  19 +++
 tests/test-stripe-checkout-block.php       | 179 +++++++++++----------
 3 files changed, 143 insertions(+), 151 deletions(-)

diff --git a/inc/render/class-stripe-checkout-block.php b/inc/render/class-stripe-checkout-block.php
index 84bd1edbf..b456ccb72 100644
--- a/inc/render/class-stripe-checkout-block.php
+++ b/inc/render/class-stripe-checkout-block.php
@@ -64,6 +64,7 @@ public function watch_checkout() {
 		$product_id = isset( $_GET['product_id'] ) ? sanitize_text_field( wp_unslash( $_GET['product_id'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 		$price_id   = isset( $_GET['price_id'] ) ? sanitize_text_field( wp_unslash( $_GET['price_id'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 		$url        = isset( $_GET['url'] ) ? sanitize_url( wp_unslash( $_GET['url'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		$token      = isset( $_GET['token'] ) ? sanitize_text_field( wp_unslash( $_GET['token'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 
 		if ( empty( $product_id ) || empty( $price_id ) || empty( $url ) ) {
 			return sprintf(
@@ -72,9 +73,7 @@ public function watch_checkout() {
 			);
 		}
 
-		$post_id = $this->get_post_id_for_checkout( $product_id, $price_id, $url );
-
-		if ( 0 === $post_id ) {
+		if ( ! hash_equals( self::get_checkout_token( $product_id, $price_id ), $token ) ) {
 			return sprintf(
 				'<div class="wp-block-themeisle-blocks-stripe-checkout"><div class="o-stripe-checkout">%s</div></div>',
 				__( 'An error occurred! Could not retrieve the product information!', 'otter-blocks' )
@@ -86,7 +85,7 @@ public function watch_checkout() {
 				'stripe_session_id' => '{CHECKOUT_SESSION_ID}',
 				'product_id'        => $product_id,
 			),
-			get_permalink( $post_id )
+			$this->get_return_url( $url )
 		);
 	
 		$session = $this->stripe_api->create_request(
@@ -180,14 +179,22 @@ public function render( $attributes ) {
 		$details_markup .= '<h5>' . $currency . $amount . '</h5>';
 		$details_markup .= '</div>';
 
+		// A widget area or an FSE template has no permalink of its own, so fall back to the current URL.
+		$return_url = get_permalink();
+
+		if ( ! is_string( $return_url ) || '' === $return_url ) {
+			$return_url = home_url( add_query_arg( array() ) );
+		}
+
 		$session_url = add_query_arg(
 			array(
 				'action'     => 'buy_stripe',
 				'product_id' => $attributes['product'],
 				'price_id'   => $attributes['price'],
-				'url'        => get_permalink(),
+				'url'        => $return_url,
+				'token'      => self::get_checkout_token( $attributes['product'], $attributes['price'] ),
 			),
-			get_permalink()
+			$return_url
 		);
 
 		$button_markup = '<a href="' . esc_url( $session_url ) . '">' . __( 'Checkout', 'otter-blocks' ) . '</a>';
@@ -201,82 +208,31 @@ public function render( $attributes ) {
 	}
 
 	/**
-	 * Get the ID of the post that offers the given product/price pair.
+	 * Sign a product/price pair so the checkout can verify it was offered by a block.
 	 *
 	 * @param string $product_id Stripe product ID.
 	 * @param string $price_id Stripe price ID.
-	 * @param string $url URL of the page holding the checkout block.
-	 * @return int Post ID, or 0 when the pair is not offered there.
+	 * @return string
 	 */
-	private function get_post_id_for_checkout( $product_id, $price_id, $url ) {
-		if ( function_exists( 'wpcom_vip_url_to_postid' ) ) {
-			$post_id = wpcom_vip_url_to_postid( $url );
-		} else {
-			$post_id = url_to_postid( $url ); // phpcs:ignore WordPressVIPMinimum.Functions.RestrictedFunctions.url_to_postid_url_to_postid
-		}
-
-		if ( 0 === $post_id ) {
-			return 0;
-		}
-
-		$post = get_post( $post_id );
-
-		if ( ! $post instanceof \WP_Post ) {
-			return 0;
-		}
-
-		if ( 'publish' !== $post->post_status && ! current_user_can( 'read_post', $post_id ) ) {
-			return 0;
-		}
-
-		$visited = array( $post_id => true );
-
-		return $this->blocks_have_checkout( parse_blocks( $post->post_content ), $product_id, $price_id, $visited ) ? $post_id : 0;
+	public static function get_checkout_token( $product_id, $price_id ) {
+		return hash_hmac( 'sha256', $product_id . '|' . $price_id, wp_salt( 'otter_stripe' ) );
 	}
 
 	/**
-	 * Check whether a block tree contains a Stripe Checkout block for the given product/price pair.
+	 * Get the URL Stripe returns the buyer to, restricted to this site.
 	 *
-	 * @param array<int, array<string, mixed>> $blocks Parsed blocks.
-	 * @param string                           $product_id Stripe product ID.
-	 * @param string                           $price_id Stripe price ID.
-	 * @param array<int, bool>                 $visited Reusable block IDs already traversed.
-	 * @return bool
+	 * @param string $url Requested return URL.
+	 * @return string
 	 */
-	private function blocks_have_checkout( $blocks, $product_id, $price_id, &$visited = array() ) {
-		foreach ( $blocks as $block ) {
-			if ( ! isset( $block['blockName'] ) ) {
-				continue;
-			}
-
-			if ( 'themeisle-blocks/stripe-checkout' === $block['blockName'] ) {
-				$attrs = isset( $block['attrs'] ) ? $block['attrs'] : array();
-
-				if ( isset( $attrs['product'], $attrs['price'] ) && $product_id === $attrs['product'] && $price_id === $attrs['price'] ) {
-					return true;
-				}
-			}
+	private function get_return_url( $url ) {
+		$host = wp_parse_url( $url, PHP_URL_HOST );
+		$home = wp_parse_url( home_url(), PHP_URL_HOST );
 
-			// Synced patterns keep their content in a separate post; guard against reference cycles.
-			if ( 'core/block' === $block['blockName'] && isset( $block['attrs']['ref'] ) ) {
-				$ref = (int) $block['attrs']['ref'];
-
-				if ( ! isset( $visited[ $ref ] ) ) {
-					$visited[ $ref ] = true;
-					$reusable        = get_post( $ref );
-
-					if ( $reusable instanceof \WP_Post && $this->blocks_have_checkout( parse_blocks( $reusable->post_content ), $product_id, $price_id, $visited ) ) {
-						return true;
-					}
-				}
-			}
-
-			if ( ! empty( $block['innerBlocks'] ) && $this->blocks_have_checkout( $block['innerBlocks'], $product_id, $price_id, $visited ) ) {
-				return true;
-			}
+		if ( $home !== $host ) {
+			return home_url( '/' );
 		}
 
-		return false;
+		return $url;
 	}
 
 	/**
diff --git a/tests/stripe-http-client-mock.php b/tests/stripe-http-client-mock.php
index 95ddc3a14..639692503 100644
--- a/tests/stripe-http-client-mock.php
+++ b/tests/stripe-http-client-mock.php
@@ -18,17 +18,35 @@ class StripeHttpClientMock implements ClientInterface
 	 */
 	public static $request_paths = array();
 
+	/**
+	 * Parameters of the requests made since the last reset, keyed by path.
+	 *
+	 * @var array
+	 */
+	public static $request_params = array();
+
 	public static function reset_request_paths()
 	{
 		self::$request_paths = array();
 	}
 
+	public static function reset_request_params()
+	{
+		self::$request_params = array();
+	}
+
+	public static function get_params_for($path)
+	{
+		return isset(self::$request_params[$path]) ? self::$request_params[$path] : array();
+	}
+
 	public function request($method, $absUrl, $headers, $params, $hasFile)
 	{
 		$urlParts = parse_url($absUrl);
 		$path = $urlParts['path'];
 
 		self::$request_paths[] = $path;
+		self::$request_params[$path] = $params;
 
 		if ($path === '/v1/products') {
 			return array($this->mockProductsList(), 200, null);
@@ -115,6 +133,7 @@ private function mockSingleProduct()
 				'price' => 1200,
 				'currency' => 'USD',
 				'active' => true,
+				'images' => [],
 				'object' => 'product'
 			]
 		);
diff --git a/tests/test-stripe-checkout-block.php b/tests/test-stripe-checkout-block.php
index 9cba6d8dd..36f7efea4 100644
--- a/tests/test-stripe-checkout-block.php
+++ b/tests/test-stripe-checkout-block.php
@@ -63,7 +63,7 @@ public function set_up() {
 	 */
 	public function tear_down() {
 		remove_filter( 'wp_redirect', array( $this, 'throw_on_redirect' ) );
-		unset( $_GET['action'], $_GET['product_id'], $_GET['price_id'], $_GET['url'] );
+		unset( $_GET['action'], $_GET['product_id'], $_GET['price_id'], $_GET['url'], $_GET['token'] );
 
 		delete_transient( Stripe_Checkout_Block::PRICE_MODE_CACHE_PREFIX . md5( 'price_1' ) );
 
@@ -89,6 +89,24 @@ public function throw_on_redirect( $location ) {
 		throw new Exception( $location );
 	}
 
+	/**
+	 * Build the request parameters a rendered block would produce, with overrides applied.
+	 *
+	 * @param array $overrides Parameters to override.
+	 * @return array
+	 */
+	private function checkout_params( $overrides = array() ) {
+		return array_merge(
+			array(
+				'product_id' => 'prod_1',
+				'price_id'   => 'price_1',
+				'url'        => get_permalink( $this->post_id ),
+				'token'      => Stripe_Checkout_Block::get_checkout_token( 'prod_1', 'price_1' ),
+			),
+			$overrides
+		);
+	}
+
 	/**
 	 * Run the checkout watcher with the given request parameters.
 	 *
@@ -108,111 +126,98 @@ private function run_checkout( $params ) {
 	}
 
 	/**
-	 * A price configured in the block on the page creates a session.
+	 * A pair signed by a rendered block creates a session.
 	 */
-	public function test_configured_price_creates_session() {
-		$location = $this->run_checkout(
-			array(
-				'product_id' => 'prod_1',
-				'price_id'   => 'price_1',
-				'url'        => get_permalink( $this->post_id ),
-			)
-		);
+	public function test_signed_pair_creates_session() {
+		$location = $this->run_checkout( $this->checkout_params() );
 
 		$this->assertStringContainsString( 'checkout.stripe.com', $location );
 	}
 
 	/**
-	 * The checkout mode is derived from the price and then served from cache.
+	 * The token emitted by the rendered block is accepted as-is.
 	 */
-	public function test_price_mode_is_cached() {
-		$args = array(
-			'product_id' => 'prod_1',
-			'price_id'   => 'price_1',
-			'url'        => get_permalink( $this->post_id ),
+	public function test_token_from_rendered_block_is_accepted() {
+		$markup = $this->block->render(
+			array(
+				'product' => 'prod_1',
+				'price'   => 'price_1',
+			)
 		);
 
-		StripeHttpClientMock::reset_request_paths();
-		$this->run_checkout( $args );
+		preg_match( '/token=([a-f0-9]+)/', html_entity_decode( $markup ), $matches );
 
-		$this->assertContains( '/v1/prices/price_1', StripeHttpClientMock::$request_paths );
-		$this->assertSame( 'payment', get_transient( Stripe_Checkout_Block::PRICE_MODE_CACHE_PREFIX . md5( 'price_1' ) ) );
+		$this->assertNotEmpty( $matches, 'The buy link should carry a token.' );
 
-		StripeHttpClientMock::reset_request_paths();
-		$location = $this->run_checkout( $args );
+		$location = $this->run_checkout( $this->checkout_params( array( 'token' => $matches[1] ) ) );
 
-		$this->assertNotContains( '/v1/prices/price_1', StripeHttpClientMock::$request_paths );
 		$this->assertStringContainsString( 'checkout.stripe.com', $location );
 	}
 
 	/**
-	 * A price that is not configured in the block is rejected.
+	 * A block outside post content still works, because the token does not depend on placement.
 	 */
-	public function test_arbitrary_price_is_rejected() {
-		$location = $this->run_checkout(
+	public function test_widget_placement_is_accepted() {
+		$widget_only_id = $this->factory()->post->create(
 			array(
-				'product_id' => 'prod_1',
-				'price_id'   => 'price_cheap',
-				'url'        => get_permalink( $this->post_id ),
+				'post_status'  => 'publish',
+				'post_content' => 'The checkout block lives in a widget area, not here.',
 			)
 		);
 
-		$this->assertSame( '', $location );
+		$location = $this->run_checkout( $this->checkout_params( array( 'url' => get_permalink( $widget_only_id ) ) ) );
+
+		$this->assertStringContainsString( 'checkout.stripe.com', $location );
 	}
 
 	/**
-	 * A product that is not configured in the block is rejected.
+	 * A non-singular URL that resolves to no post is still a valid return URL.
 	 */
-	public function test_arbitrary_product_is_rejected() {
-		$location = $this->run_checkout(
-			array(
-				'product_id' => 'prod_2',
-				'price_id'   => 'price_1',
-				'url'        => get_permalink( $this->post_id ),
-			)
-		);
+	public function test_archive_url_is_accepted() {
+		$location = $this->run_checkout( $this->checkout_params( array( 'url' => home_url( '/2026/08/' ) ) ) );
+
+		$this->assertStringContainsString( 'checkout.stripe.com', $location );
+	}
+
+	/**
+	 * A request without a token is rejected.
+	 */
+	public function test_missing_token_is_rejected() {
+		$location = $this->run_checkout( $this->checkout_params( array( 'token' => '' ) ) );
 
 		$this->assertSame( '', $location );
 	}
 
 	/**
-	 * A page without a checkout block for the pair is rejected.
+	 * A price swapped in while keeping the token of another pair is rejected.
 	 */
-	public function test_unrelated_page_is_rejected() {
-		$other_id = $this->factory()->post->create(
-			array(
-				'post_status'  => 'publish',
-				'post_content' => 'Nothing to buy here.',
-			)
-		);
+	public function test_substituted_price_is_rejected() {
+		$location = $this->run_checkout( $this->checkout_params( array( 'price_id' => 'price_cheap' ) ) );
 
-		$location = $this->run_checkout(
-			array(
-				'product_id' => 'prod_1',
-				'price_id'   => 'price_1',
-				'url'        => get_permalink( $other_id ),
-			)
-		);
+		$this->assertSame( '', $location );
+	}
+
+	/**
+	 * A product swapped in while keeping the token of another pair is rejected.
+	 */
+	public function test_substituted_product_is_rejected() {
+		$location = $this->run_checkout( $this->checkout_params( array( 'product_id' => 'prod_2' ) ) );
 
 		$this->assertSame( '', $location );
 	}
 
 	/**
-	 * A draft page is not a valid checkout source for visitors.
+	 * A token that was not derived from the site salt is rejected.
 	 */
-	public function test_draft_page_is_rejected_for_visitors() {
-		wp_update_post(
-			array(
-				'ID'          => $this->post_id,
-				'post_status' => 'draft',
-			)
-		);
+	public function test_forged_token_is_rejected() {
+		$forged = hash_hmac( 'sha256', 'prod_1|price_cheap', 'guessed-salt' );
 
 		$location = $this->run_checkout(
-			array(
-				'product_id' => 'prod_1',
-				'price_id'   => 'price_1',
-				'url'        => add_query_arg( 'p', $this->post_id, home_url( '/' ) ),
+			$this->checkout_params(
+				array(
+					'price_id' => 'price_cheap',
+					'token'    => $forged,
+				)
 			)
 		);
 
@@ -220,24 +225,36 @@ public function test_draft_page_is_rejected_for_visitors() {
 	}
 
 	/**
-	 * A block nested inside a container is still a valid checkout source.
+	 * An off-site return URL is replaced with this site's home URL.
 	 */
-	public function test_nested_block_is_accepted() {
-		$nested_id = $this->factory()->post->create(
-			array(
-				'post_status'  => 'publish',
-				'post_content' => '<!-- wp:group --><div class="wp-block-group"><!-- wp:themeisle-blocks/stripe-checkout {"product":"prod_1","price":"price_1"} /--></div><!-- /wp:group -->',
-			)
-		);
+	public function test_offsite_return_url_is_replaced() {
+		StripeHttpClientMock::reset_request_params();
 
-		$location = $this->run_checkout(
-			array(
-				'product_id' => 'prod_1',
-				'price_id'   => 'price_1',
-				'url'        => get_permalink( $nested_id ),
-			)
-		);
+		$this->run_checkout( $this->checkout_params( array( 'url' => 'https://evil.example.net/collect' ) ) );
+
+		$params = StripeHttpClientMock::get_params_for( '/v1/checkout/sessions' );
+
+		$this->assertNotEmpty( $params );
+		$this->assertStringStartsWith( home_url(), $params['success_url'] );
+		$this->assertStringStartsWith( home_url(), $params['cancel_url'] );
+	}
 
+	/**
+	 * The checkout mode is derived from the price and then served from cache.
+	 */
+	public function test_price_mode_is_cached() {
+		$params = $this->checkout_params();
+
+		StripeHttpClientMock::reset_request_paths();
+		$this->run_checkout( $params );
+
+		$this->assertContains( '/v1/prices/price_1', StripeHttpClientMock::$request_paths );
+		$this->assertSame( 'payment', get_transient( Stripe_Checkout_Block::PRICE_MODE_CACHE_PREFIX . md5( 'price_1' ) ) );
+
+		StripeHttpClientMock::reset_request_paths();
+		$location = $this->run_checkout( $params );
+
+		$this->assertNotContains( '/v1/prices/price_1', StripeHttpClientMock::$request_paths );
 		$this->assertStringContainsString( 'checkout.stripe.com', $location );
 	}
 }

From 4533331992d177992e9f0206c8f06e6e36676120 Mon Sep 17 00:00:00 2001
From: girishpanchal30 <girish@krishaweb.com>
Date: Thu, 20 Aug 2026 11:32:59 +0530
Subject: [PATCH 10/25] fix: e2e test

---
 src/blocks/test/e2e/blocks/tabs.spec.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/blocks/test/e2e/blocks/tabs.spec.js b/src/blocks/test/e2e/blocks/tabs.spec.js
index ff339c946..207b10eaa 100644
--- a/src/blocks/test/e2e/blocks/tabs.spec.js
+++ b/src/blocks/test/e2e/blocks/tabs.spec.js
@@ -13,13 +13,13 @@ test.describe( 'Tabs Block', () => {
 		await admin.createNewPost();
 	});
 
-	test( 'can be created by typing "/tabs"', async({ editor, page }) => {
+	test( 'can be created by typing "/themeisle-tabs"', async({ editor, page }) => {
 
 		// Create a Progress Block with the slash block shortcut.
 		await insertBlockBySlash({
 			editor,
 			page,
-			shortcut: '/tabs',
+			shortcut: '/themeisle-tabs',
 			blockName: 'themeisle-blocks/tabs'
 		});
 	});

From 9be3adcf9e13532424cf482826482ef684bde210 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20S=C3=B6lve?= <johan.solve@gmail.com>
Date: Fri, 21 Aug 2026 12:02:01 +0200
Subject: [PATCH 11/25] fix: translate the form response defaults on the
 frontend

The success and error defaults in Form_Response_Data were raw strings, and
that value is what the frontend renders, so a non-English site always saw
"Success". The editor preview uses __() for the same string, which is why
the two disagreed. Both strings already exist in the catalogs.

The frontend fallback for the same message was hardcoded too. It now reads
the localized string, and the label for the submission field reads the
'submission' key that PHP actually sends, rather than 'form-submission',
which never matched and so always fell back to English.
---
 inc/class-registration.php                  | 1 +
 inc/integrations/api/form-response-data.php | 4 ++--
 src/blocks/frontend/form/index.js           | 6 +++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/inc/class-registration.php b/inc/class-registration.php
index fff5da32a..5df6f6901 100644
--- a/inc/class-registration.php
+++ b/inc/class-registration.php
@@ -633,6 +633,7 @@ function () {
 					'nonce'              => wp_create_nonce( 'wp_rest' ),
 					'messages'           => array(
 						'submission'           => __( 'Form submission from', 'otter-blocks' ),
+						'success'              => __( 'Success', 'otter-blocks' ),
 						'captcha-not-loaded'   => __( 'Captcha is not loaded. Please check your browser plugins to allow it.', 'otter-blocks' ),
 						'check-captcha'        => __( 'Please check the captcha.', 'otter-blocks' ),
 						'invalid-email'        => __( 'The email address is invalid!', 'otter-blocks' ),
diff --git a/inc/integrations/api/form-response-data.php b/inc/integrations/api/form-response-data.php
index e696dc223..f9e678ae5 100644
--- a/inc/integrations/api/form-response-data.php
+++ b/inc/integrations/api/form-response-data.php
@@ -105,8 +105,8 @@ public function __construct() {
 		$this->response['success']       = false;
 		$this->response['reasons']       = array();
 		$this->response['code']          = self::SUCCESS_EMAIL_SEND;
-		$this->response['displayError']  = 'Error. Please try again.';
-		$this->response['submitMessage'] = 'Success';
+		$this->response['displayError']  = __( 'Error. Please try again.', 'otter-blocks' );
+		$this->response['submitMessage'] = __( 'Success', 'otter-blocks' );
 	}
 
 	/**
diff --git a/src/blocks/frontend/form/index.js b/src/blocks/frontend/form/index.js
index 18dc5c5d1..930d57ce0 100644
--- a/src/blocks/frontend/form/index.js
+++ b/src/blocks/frontend/form/index.js
@@ -59,7 +59,7 @@ const extractFormFields = async( form ) => {
 
 
 	/** @type {Array.<import('./types').FormFieldData>} */
-	const formFieldsData = [{ label: window?.themeisleGutenbergForm?.messages['form-submission'] || 'Form submission from', value: window.location.href, metadata: { position: 0 }}];
+	const formFieldsData = [{ label: window?.themeisleGutenbergForm?.messages?.submission || 'Form submission from', value: window.location.href, metadata: { position: 0 }}];
 
 	/**
 	 * All input fields that belong to the current form. Fields from inner forms are removed.
@@ -488,7 +488,7 @@ const collectAndSendInputFormData = async( form, btn, displayMsg ) => {
 						return;
 					}
 
-					const msg = res?.submitMessage ? res.submitMessage :  'Success';
+					const msg = res?.submitMessage ? res.submitMessage : ( window?.themeisleGutenbergForm?.messages?.success || 'Success' );
 					displayMsg.setMsg( msg ).show();
 
 					form?.querySelector( 'form' )?.reset();
@@ -573,7 +573,7 @@ domReady( () => {
 			spinner.show();
 
 			handleAfterSubmit( confirmRecord(), displayMsg, ( res, displayMsg ) => {
-				const msg = res?.submitMessage ? res.submitMessage :  'Success';
+				const msg = res?.submitMessage ? res.submitMessage : ( window?.themeisleGutenbergForm?.messages?.success || 'Success' );
 				displayMsg.setMsg( msg ).show();
 
 				if ( 0 < res?.redirectLink?.length ) {

From 265371cffcc8c2c5727aeccf2217bbd7e6583510 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 24 Aug 2026 15:01:10 +0300
Subject: [PATCH 12/25] build(deps-dev): bump wp-coding-standards/wpcs from
 3.2.0 to 3.4.1 (#2936)

Bumps [wp-coding-standards/wpcs](https://github.com/WordPress/WordPress-Coding-Standards) from 3.2.0 to 3.4.1.
- [Release notes](https://github.com/WordPress/WordPress-Coding-Standards/releases)
- [Changelog](https://github.com/WordPress/WordPress-Coding-Standards/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/WordPress/WordPress-Coding-Standards/compare/3.2.0...3.4.1)

---
updated-dependencies:
- dependency-name: wp-coding-standards/wpcs
  dependency-version: 3.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 composer.lock | 52 +++++++++++++++++++++++++--------------------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/composer.lock b/composer.lock
index f81925300..6e748911c 100644
--- a/composer.lock
+++ b/composer.lock
@@ -1202,27 +1202,27 @@
         },
         {
             "name": "phpcsstandards/phpcsextra",
-            "version": "1.4.0",
+            "version": "1.5.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PHPCSStandards/PHPCSExtra.git",
-                "reference": "fa4b8d051e278072928e32d817456a7fdb57b6ca"
+                "reference": "39467533fdb742446d68c1d10ac33d625ee0311c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSExtra/zipball/fa4b8d051e278072928e32d817456a7fdb57b6ca",
-                "reference": "fa4b8d051e278072928e32d817456a7fdb57b6ca",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSExtra/zipball/39467533fdb742446d68c1d10ac33d625ee0311c",
+                "reference": "39467533fdb742446d68c1d10ac33d625ee0311c",
                 "shasum": ""
             },
             "require": {
                 "php": ">=5.4",
-                "phpcsstandards/phpcsutils": "^1.1.0",
-                "squizlabs/php_codesniffer": "^3.13.0 || ^4.0"
+                "phpcsstandards/phpcsutils": "^1.2.3",
+                "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1"
             },
             "require-dev": {
                 "php-parallel-lint/php-console-highlighter": "^1.0",
                 "php-parallel-lint/php-parallel-lint": "^1.4.0",
-                "phpcsstandards/phpcsdevcs": "^1.1.6",
+                "phpcsstandards/phpcsdevcs": "^1.2.0",
                 "phpcsstandards/phpcsdevtools": "^1.2.1",
                 "phpunit/phpunit": "^4.5 || ^5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.3.4"
             },
@@ -1280,32 +1280,32 @@
                     "type": "thanks_dev"
                 }
             ],
-            "time": "2025-06-14T07:40:39+00:00"
+            "time": "2026-07-27T11:13:17+00:00"
         },
         {
             "name": "phpcsstandards/phpcsutils",
-            "version": "1.1.1",
+            "version": "1.2.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PHPCSStandards/PHPCSUtils.git",
-                "reference": "f7eb16f2fa4237d5db9e8fed8050239bee17a9bd"
+                "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/f7eb16f2fa4237d5db9e8fed8050239bee17a9bd",
-                "reference": "f7eb16f2fa4237d5db9e8fed8050239bee17a9bd",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/5f35d9408c54d7b529501f3c688b6eae562aea1f",
+                "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f",
                 "shasum": ""
             },
             "require": {
                 "dealerdirect/phpcodesniffer-composer-installer": "^0.4.1 || ^0.5 || ^0.6.2 || ^0.7 || ^1.0",
                 "php": ">=5.4",
-                "squizlabs/php_codesniffer": "^3.13.0 || ^4.0"
+                "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1"
             },
             "require-dev": {
                 "ext-filter": "*",
                 "php-parallel-lint/php-console-highlighter": "^1.0",
                 "php-parallel-lint/php-parallel-lint": "^1.4.0",
-                "phpcsstandards/phpcsdevcs": "^1.1.6",
+                "phpcsstandards/phpcsdevcs": "^1.2.0",
                 "yoast/phpunit-polyfills": "^1.1.0 || ^2.0.0 || ^3.0.0"
             },
             "type": "phpcodesniffer-standard",
@@ -1373,7 +1373,7 @@
                     "type": "thanks_dev"
                 }
             ],
-            "time": "2025-08-10T01:04:45+00:00"
+            "time": "2026-07-27T10:28:41+00:00"
         },
         {
             "name": "phpstan/phpstan",
@@ -3047,16 +3047,16 @@
         },
         {
             "name": "wp-coding-standards/wpcs",
-            "version": "3.2.0",
+            "version": "3.4.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/WordPress/WordPress-Coding-Standards.git",
-                "reference": "d2421de7cec3274ae622c22c744de9a62c7925af"
+                "reference": "ec2ff942335f33683a5957a85d138753876a05cf"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/WordPress/WordPress-Coding-Standards/zipball/d2421de7cec3274ae622c22c744de9a62c7925af",
-                "reference": "d2421de7cec3274ae622c22c744de9a62c7925af",
+                "url": "https://api.github.com/repos/WordPress/WordPress-Coding-Standards/zipball/ec2ff942335f33683a5957a85d138753876a05cf",
+                "reference": "ec2ff942335f33683a5957a85d138753876a05cf",
                 "shasum": ""
             },
             "require": {
@@ -3064,17 +3064,17 @@
                 "ext-libxml": "*",
                 "ext-tokenizer": "*",
                 "ext-xmlreader": "*",
-                "php": ">=5.4",
-                "phpcsstandards/phpcsextra": "^1.4.0",
-                "phpcsstandards/phpcsutils": "^1.1.0",
-                "squizlabs/php_codesniffer": "^3.13.0"
+                "php": ">=7.2",
+                "phpcsstandards/phpcsextra": "^1.5.1",
+                "phpcsstandards/phpcsutils": "^1.2.3",
+                "squizlabs/php_codesniffer": "^3.13.5"
             },
             "require-dev": {
                 "php-parallel-lint/php-console-highlighter": "^1.0.0",
                 "php-parallel-lint/php-parallel-lint": "^1.4.0",
-                "phpcompatibility/php-compatibility": "^9.0",
+                "phpcompatibility/php-compatibility": "^10.0.0@dev",
                 "phpcsstandards/phpcsdevtools": "^1.2.0",
-                "phpunit/phpunit": "^4.0 || ^5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.0"
+                "phpunit/phpunit": "^8.0 || ^9.0"
             },
             "suggest": {
                 "ext-iconv": "For improved results",
@@ -3109,7 +3109,7 @@
                     "type": "custom"
                 }
             ],
-            "time": "2025-07-24T20:08:31+00:00"
+            "time": "2026-07-27T11:53:23+00:00"
         },
         {
             "name": "wpackagist-plugin/woocommerce",

From 4a871c3245776208c0de736bb469fe71a4dfe6f0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 24 Aug 2026 15:01:15 +0300
Subject: [PATCH 13/25] build(deps-dev): bump php-stubs/woocommerce-stubs from
 10.9.1 to 10.9.4 (#2933)

Bumps [php-stubs/woocommerce-stubs](https://github.com/php-stubs/woocommerce-stubs) from 10.9.1 to 10.9.4.
- [Commits](https://github.com/php-stubs/woocommerce-stubs/compare/v10.9.1...v10.9.4)

---
updated-dependencies:
- dependency-name: php-stubs/woocommerce-stubs
  dependency-version: 10.9.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 composer.lock | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/composer.lock b/composer.lock
index 6e748911c..6c06a3400 100644
--- a/composer.lock
+++ b/composer.lock
@@ -1044,24 +1044,24 @@
         },
         {
             "name": "php-stubs/woocommerce-stubs",
-            "version": "v10.9.1",
+            "version": "v10.9.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/php-stubs/woocommerce-stubs.git",
-                "reference": "e6d583b9fa05b3f5ff67f86c939b45a0c35b8444"
+                "reference": "a569e43283b86178628beb7aa22cc34b4076b435"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/php-stubs/woocommerce-stubs/zipball/e6d583b9fa05b3f5ff67f86c939b45a0c35b8444",
-                "reference": "e6d583b9fa05b3f5ff67f86c939b45a0c35b8444",
+                "url": "https://api.github.com/repos/php-stubs/woocommerce-stubs/zipball/a569e43283b86178628beb7aa22cc34b4076b435",
+                "reference": "a569e43283b86178628beb7aa22cc34b4076b435",
                 "shasum": ""
             },
             "require": {
-                "php-stubs/wordpress-stubs": "^5.3 || ^6.0"
+                "php-stubs/wordpress-stubs": "^5.3 || ^6.0 || ^7.0"
             },
             "require-dev": {
                 "php": "~7.1 || ~8.0",
-                "php-stubs/generator": "^0.8.0"
+                "php-stubs/generator": "^0.9.0"
             },
             "suggest": {
                 "symfony/polyfill-php73": "Symfony polyfill backporting some PHP 7.3+ features to lower PHP versions",
@@ -1082,9 +1082,9 @@
             ],
             "support": {
                 "issues": "https://github.com/php-stubs/woocommerce-stubs/issues",
-                "source": "https://github.com/php-stubs/woocommerce-stubs/tree/v10.9.1"
+                "source": "https://github.com/php-stubs/woocommerce-stubs/tree/v10.9.4"
             },
-            "time": "2026-06-25T10:47:57+00:00"
+            "time": "2026-07-16T18:17:41+00:00"
         },
         {
             "name": "php-stubs/wordpress-stubs",

From 7bddd887226c47a036b7f96775a2a2bb5d043b12 Mon Sep 17 00:00:00 2001
From: Girish Panchal <79647963+girishpanchal30@users.noreply.github.com>
Date: Thu, 27 Aug 2026 17:32:15 +0530
Subject: [PATCH 14/25] Improved Atomic Wind Blocks CSS scoping (#2997)

* fix: improve Atomic Wind Blocks CSS scoping

* fix: add tests for CSS scoping

* fix: enhance Atomic Wind CSS scoping

* fix: enhance CSS scoping for document root selectors
---
 .github/workflows/test-js.yml                 |   4 +
 inc/plugins/class-atomic-wind-blocks.php      |  31 +-
 .../tailwind/generator-frontend.js            |   3 +-
 src/atomic-wind/tailwind/generator.js         | 160 +-------
 src/atomic-wind/tailwind/scope-css.js         | 385 ++++++++++++++++++
 .../tailwind/test/scope-css.test.js           | 185 +++++++++
 .../e2e/blocks/atomic-wind-css-scope.spec.js  |  89 ++++
 src/blocks/test/e2e/playwright.config.js      |   1 +
 tests/test-atomic-wind-blocks.php             |  69 +++-
 9 files changed, 757 insertions(+), 170 deletions(-)
 create mode 100644 src/atomic-wind/tailwind/scope-css.js
 create mode 100644 src/atomic-wind/tailwind/test/scope-css.test.js
 create mode 100644 src/blocks/test/e2e/blocks/atomic-wind-css-scope.spec.js

diff --git a/.github/workflows/test-js.yml b/.github/workflows/test-js.yml
index f6d6c710e..9a713c00f 100644
--- a/.github/workflows/test-js.yml
+++ b/.github/workflows/test-js.yml
@@ -27,3 +27,7 @@ jobs:
           npm run lint
         env:
           CI: true
+      - name: Run unit tests
+        run: npm run test:unit
+        env:
+          CI: true
diff --git a/inc/plugins/class-atomic-wind-blocks.php b/inc/plugins/class-atomic-wind-blocks.php
index 1ac4cd425..db9815003 100644
--- a/inc/plugins/class-atomic-wind-blocks.php
+++ b/inc/plugins/class-atomic-wind-blocks.php
@@ -15,6 +15,13 @@
  */
 class Atomic_Wind_Blocks {
 
+	/**
+	 * CSS version for the Atomic Wind blocks.
+	 *
+	 * @var string
+	 */
+	const ATOMIC_WIND_CSS_VERSION = '1.0.0';
+
 	/**
 	 * Whether we are currently inside a query loop render.
 	 *
@@ -326,7 +333,7 @@ public function output_singular_css() {
 		$this->expected[ $queried->ID ] = substr_count( $queried->post_content, '<!-- wp:atomic-wind/' );
 		wp_enqueue_style( 'atomic-wind-base' );
 
-		$cached_css = get_post_meta( $queried->ID, '_atomic_wind_css', true );
+		$cached_css = $this->get_cached_css( $queried->ID );
 
 		if ( ! $cached_css ) {
 			$this->enqueue_generator();
@@ -353,7 +360,7 @@ public function maybe_enqueue_style_builder() {
 
 		if ( ! $queried instanceof \WP_Post
 			|| ! $this->post_has_atomic_wind_blocks( $queried )
-			|| get_post_meta( $queried->ID, '_atomic_wind_css', true )
+			|| $this->get_cached_css( $queried->ID )
 			|| ! current_user_can( 'edit_post', $queried->ID ) ) {
 			return;
 		}
@@ -435,7 +442,7 @@ public function output_late_css() {
 				if ( $post instanceof \WP_Post && $this->post_has_atomic_wind_blocks( $post ) ) {
 					$this->expected[ $id ] = substr_count( $post->post_content, '<!-- wp:atomic-wind/' );
 
-					$cached_css = get_post_meta( $id, '_atomic_wind_css', true );
+					$cached_css = $this->get_cached_css( $id );
 
 					if ( $cached_css ) {
 						$hash = md5( $cached_css );
@@ -507,10 +514,27 @@ public function rest_save_style( \WP_REST_Request $request ) {
 		$css     = $request->get_param( 'css' );
 
 		$success = update_post_meta( $post_id, '_atomic_wind_css', wp_slash( $css ) );
+		update_post_meta( $post_id, '_atomic_wind_css_version', self::ATOMIC_WIND_CSS_VERSION );
 
 		return new \WP_REST_Response( array( 'success' => $success ), 200 );
 	}
 
+	/**
+	 * Read cached CSS, ignoring stylesheets built by an older generator.
+	 *
+	 * @param int $post_id Post ID.
+	 * @return string
+	 */
+	private function get_cached_css( $post_id ) {
+		if ( self::ATOMIC_WIND_CSS_VERSION !== get_post_meta( $post_id, '_atomic_wind_css_version', true ) ) {
+			return '';
+		}
+
+		$css = get_post_meta( $post_id, '_atomic_wind_css', true );
+
+		return is_string( $css ) ? $css : '';
+	}
+
 	/**
 	 * REST permission callback for the style endpoint.
 	 *
@@ -534,6 +558,7 @@ public function rest_save_style_permissions( \WP_REST_Request $request ) {
 	 */
 	public function clear_cached_css( $post_id ) {
 		delete_post_meta( $post_id, '_atomic_wind_css' );
+		delete_post_meta( $post_id, '_atomic_wind_css_version' );
 	}
 
 	/**
diff --git a/src/atomic-wind/tailwind/generator-frontend.js b/src/atomic-wind/tailwind/generator-frontend.js
index 3417512af..b87065272 100644
--- a/src/atomic-wind/tailwind/generator-frontend.js
+++ b/src/atomic-wind/tailwind/generator-frontend.js
@@ -4,6 +4,7 @@ import indexCSS from 'tailwindcss/index.css';
 import preflightCSS from 'tailwindcss/preflight.css';
 import themeCSS from 'tailwindcss/theme.css';
 import utilitiesCSS from 'tailwindcss/utilities.css';
+import { scopeToAtomicWind } from './scope-css';
 
 const assets = {
 	index: indexCSS,
@@ -71,7 +72,7 @@ async function build( kind ) {
 		return;
 	}
 
-	sheet.textContent = compiler.build( Array.from( newClasses ) );
+	sheet.textContent = scopeToAtomicWind( compiler.build( Array.from( newClasses ) ) );
 }
 
 function rebuild( kind ) {
diff --git a/src/atomic-wind/tailwind/generator.js b/src/atomic-wind/tailwind/generator.js
index fdc601ec3..a044c8212 100644
--- a/src/atomic-wind/tailwind/generator.js
+++ b/src/atomic-wind/tailwind/generator.js
@@ -4,6 +4,7 @@ import indexCSS from 'tailwindcss/index.css';
 import preflightCSS from 'tailwindcss/preflight.css';
 import themeCSS from 'tailwindcss/theme.css';
 import utilitiesCSS from 'tailwindcss/utilities.css';
+import { prefixCss, scopeToAtomicWind } from './scope-css';
 
 const assets = {
 	index: indexCSS,
@@ -87,157 +88,6 @@ function resolveEditorContext() {
 	return null;
 }
 
-function splitSelectorList( selectorText ) {
-	const selectors = [];
-	let current = '';
-	let parenDepth = 0;
-	let bracketDepth = 0;
-	let braceDepth = 0;
-	let inSingleQuote = false;
-	let inDoubleQuote = false;
-	let escaped = false;
-
-	for ( const char of selectorText ) {
-		if ( escaped ) {
-			current += char;
-			escaped = false;
-			continue;
-		}
-
-		if ( '\\' === char ) {
-			current += char;
-			escaped = true;
-			continue;
-		}
-
-		if ( '\'' === char && ! inDoubleQuote ) {
-			inSingleQuote = ! inSingleQuote;
-			current += char;
-			continue;
-		}
-
-		if ( '"' === char && ! inSingleQuote ) {
-			inDoubleQuote = ! inDoubleQuote;
-			current += char;
-			continue;
-		}
-
-		if ( inSingleQuote || inDoubleQuote ) {
-			current += char;
-			continue;
-		}
-
-		if ( '(' === char ) {
-			parenDepth++;
-			current += char;
-			continue;
-		}
-		if ( ')' === char ) {
-			parenDepth = Math.max( 0, parenDepth - 1 );
-			current += char;
-			continue;
-		}
-
-		if ( '[' === char ) {
-			bracketDepth++;
-			current += char;
-			continue;
-		}
-		if ( ']' === char ) {
-			bracketDepth = Math.max( 0, bracketDepth - 1 );
-			current += char;
-			continue;
-		}
-
-		if ( '{' === char ) {
-			braceDepth++;
-			current += char;
-			continue;
-		}
-		if ( '}' === char ) {
-			braceDepth = Math.max( 0, braceDepth - 1 );
-			current += char;
-			continue;
-		}
-
-		if ( ',' === char && 0 === parenDepth && 0 === bracketDepth && 0 === braceDepth ) {
-			selectors.push( current.trim() );
-			current = '';
-			continue;
-		}
-
-		current += char;
-	}
-
-	if ( current.trim() ) {
-		selectors.push( current.trim() );
-	}
-
-	return selectors;
-}
-
-function prefixSelectorList( selectorText, scopeSelector ) {
-	return splitSelectorList( selectorText )
-		.map( ( selector ) => {
-			if ( /^(:root|:host|html|body)(\b|$|:|\.|#|\[)/.test( selector ) ) {
-				return scopeSelector;
-			}
-
-			return `${scopeSelector} ${selector}`;
-		} )
-		.join( ', ' );
-}
-
-function scopeRuleCss( rule, scopeSelector ) {
-	if ( CSSRule.STYLE_RULE === rule.type ) {
-		const open = rule.cssText.indexOf( '{' );
-		if ( -1 === open ) {
-			return rule.cssText;
-		}
-
-		const prefixedSelector = prefixSelectorList( rule.selectorText, scopeSelector );
-		const body = rule.cssText.slice( open );
-		return `${prefixedSelector}${body}`;
-	}
-
-	if (
-		CSSRule.FONT_FACE_RULE === rule.type ||
-		CSSRule.KEYFRAMES_RULE === rule.type ||
-		( 'PROPERTY_RULE' in CSSRule && CSSRule.PROPERTY_RULE === rule.type )
-	) {
-		return rule.cssText;
-	}
-
-	if ( rule.cssRules && rule.cssRules.length > 0 ) {
-		const open = rule.cssText.indexOf( '{' );
-		const close = rule.cssText.lastIndexOf( '}' );
-		if ( -1 !== open && -1 !== close ) {
-			return `${rule.cssText.slice( 0, open + 1 )}${scopeCssRules( rule.cssRules, scopeSelector )}}`;
-		}
-	}
-
-	return rule.cssText;
-}
-
-function scopeCssRules( rules, scopeSelector ) {
-	return Array.from( rules ).map( ( rule ) => scopeRuleCss( rule, scopeSelector ) ).join( '' );
-}
-
-function scopeGeneratedCss( css, scopeSelector ) {
-	if ( ! css || ! scopeSelector ) {
-		return css;
-	}
-
-	try {
-		const parsed = new CSSStyleSheet();
-		parsed.replaceSync( css );
-		return scopeCssRules( parsed.cssRules, scopeSelector );
-	} catch ( error ) {
-		console.error( error );
-		return css;
-	}
-}
-
 function attachObserver( root ) {
 	if ( observer ) {
 		observer.disconnect();
@@ -369,14 +219,14 @@ async function build( kind ) {
 		return;
 	}
 
-	const generated = compiler.build( Array.from( newClasses ) );
-	const scopedCss = activeScopeSelector ? scopeGeneratedCss( generated, activeScopeSelector ) : generated;
+	const generated = scopeToAtomicWind( compiler.build( Array.from( newClasses ) ) );
+	const scopedCss = activeScopeSelector ? prefixCss( generated, activeScopeSelector ) : generated;
 	ensureStyleTag( activeDocument );
 	sheet.textContent = scopedCss;
 }
 
 // Lets other editor features (the Design Library pattern previews) generate
-// unscoped Tailwind CSS for an arbitrary class list. Kept separate from the
+// Tailwind CSS for an arbitrary class list. Kept separate from the
 // canvas compiler: it must not pollute the canvas sheet, and canvas full
 // rebuilds reset that compiler, which would drop classes fed in here. The
 // compiler is cumulative — each call returns the full stylesheet for every
@@ -392,7 +242,7 @@ window.atomicWindGenerateCss = async ( classNames ) => {
 	}
 
 	const instance = await apiCompiler;
-	return instance.build( Array.from( new Set( classNames ) ) );
+	return scopeToAtomicWind( instance.build( Array.from( new Set( classNames ) ) ) );
 };
 
 function rebuild( kind ) {
diff --git a/src/atomic-wind/tailwind/scope-css.js b/src/atomic-wind/tailwind/scope-css.js
new file mode 100644
index 000000000..11564efbd
--- /dev/null
+++ b/src/atomic-wind/tailwind/scope-css.js
@@ -0,0 +1,385 @@
+/**
+ * Selector rewriting for the generated Tailwind stylesheet.
+ *
+ * Tailwind ships preflight, whose rules target bare HTML elements (`h1`,
+ * `button`, `img`, `*`). Injected as-is they reset the whole document and win
+ * over the theme's own element styles, so every element-anchored rule is
+ * confined to the Atomic Wind block subtree. Class-anchored rules (the
+ * utilities) stay global — they only match our generated markup anyway.
+ */
+
+const ATOMIC_ROOT = '[class*="wp-block-atomic-wind-"]';
+const ATOMIC_MATCH = `:where(${ ATOMIC_ROOT }, ${ ATOMIC_ROOT } *)`;
+// Zero specificity, so a theme rule aimed at the block wrapper still wins.
+const ATOMIC_SELF = `:where(${ ATOMIC_ROOT })`;
+
+// At-rules whose bodies are not selector lists and must be emitted verbatim.
+const OPAQUE_AT_RULE = /^@(-[a-z]+-)?(keyframes|font-face|property|counter-style|font-feature-values|font-palette-values|page|viewport|charset|import|namespace)\b/i;
+
+// Document-level subjects: they carry inherited defaults, not element resets.
+const ROOT_SELECTOR = /^(:root|:host|html|body)$/;
+
+const ROOT_PREFIX = /^(:root|:host|html|body)(?=$|[\s>+~])/;
+
+const LEGACY_PSEUDO_ELEMENT = /^:(before|after|first-line|first-letter)\b/i;
+
+const COMBINATOR = /[\s>+~]/;
+
+/**
+ * Mark every character that sits outside brackets, parentheses and strings.
+ *
+ * @param {string} text Selector or prelude text.
+ * @return {boolean[]} Per-character top-level flags.
+ */
+function topLevelMask( text ) {
+	const mask = new Array( text.length ).fill( false );
+	let depth = 0;
+	let quote = '';
+	let escaped = false;
+
+	for ( let i = 0; i < text.length; i++ ) {
+		const char = text[ i ];
+
+		if ( escaped ) {
+			escaped = false;
+			continue;
+		}
+
+		if ( '\\' === char ) {
+			escaped = true;
+			continue;
+		}
+
+		if ( quote ) {
+			if ( char === quote ) {
+				quote = '';
+			}
+			continue;
+		}
+
+		if ( '"' === char || '\'' === char ) {
+			quote = char;
+			continue;
+		}
+
+		if ( '(' === char || '[' === char || '{' === char ) {
+			mask[ i ] = 0 === depth;
+			depth++;
+			continue;
+		}
+
+		if ( ')' === char || ']' === char || '}' === char ) {
+			depth = Math.max( 0, depth - 1 );
+			mask[ i ] = 0 === depth;
+			continue;
+		}
+
+		mask[ i ] = 0 === depth;
+	}
+
+	return mask;
+}
+
+/**
+ * Split a comma-separated selector list, ignoring commas nested in `:is()` & co.
+ *
+ * @param {string} selectorText Selector list.
+ * @return {string[]} Individual selectors.
+ */
+export function splitSelectorList( selectorText ) {
+	const mask = topLevelMask( selectorText );
+	const selectors = [];
+	let start = 0;
+
+	for ( let i = 0; i < selectorText.length; i++ ) {
+		if ( ',' === selectorText[ i ] && mask[ i ] ) {
+			selectors.push( selectorText.slice( start, i ).trim() );
+			start = i + 1;
+		}
+	}
+
+	selectors.push( selectorText.slice( start ).trim() );
+
+	return selectors.filter( Boolean );
+}
+
+/**
+ * Locate the start of the subject compound (everything after the last combinator).
+ *
+ * @param {string} selector Single selector.
+ * @return {number} Index the subject compound starts at.
+ */
+function subjectStart( selector ) {
+	const mask = topLevelMask( selector );
+	let start = 0;
+
+	for ( let i = 0; i < selector.length; i++ ) {
+		if ( mask[ i ] && COMBINATOR.test( selector[ i ] ) ) {
+			start = i + 1;
+		}
+	}
+
+	return start;
+}
+
+/**
+ * Find where the subject's pseudo-element suffix begins.
+ *
+ * @param {string} subject Subject compound.
+ * @return {number} Index of the pseudo-element, or -1.
+ */
+function pseudoElementStart( subject ) {
+	const mask = topLevelMask( subject );
+
+	for ( let i = 0; i < subject.length; i++ ) {
+		if ( ! mask[ i ] || ':' !== subject[ i ] ) {
+			continue;
+		}
+
+		if ( ':' === subject[ i + 1 ] || LEGACY_PSEUDO_ELEMENT.test( subject.slice( i ) ) ) {
+			return i;
+		}
+	}
+
+	return -1;
+}
+
+/**
+ * Whether the subject is already anchored to a class or id.
+ *
+ * Those are the generated utilities; attribute-only subjects (`[hidden]`) still
+ * match theme markup, so they get scoped like bare elements do.
+ *
+ * @param {string} subject Subject compound.
+ * @return {boolean} True when the rule cannot leak onto theme markup.
+ */
+function isAnchored( subject ) {
+	const mask = topLevelMask( subject );
+
+	for ( let i = 0; i < subject.length; i++ ) {
+		if ( mask[ i ] && ( '.' === subject[ i ] || '#' === subject[ i ] ) ) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
+/**
+ * Confine one selector to the Atomic Wind subtree when it targets bare elements.
+ *
+ * @param {string} selector Single selector.
+ * @return {string} Scoped selector.
+ */
+function scopeSelectorToBlocks( selector ) {
+	const start = subjectStart( selector );
+	const subject = selector.slice( start );
+
+	if ( 0 === start && ROOT_SELECTOR.test( subject ) ) {
+		return ATOMIC_SELF;
+	}
+
+	if ( isAnchored( subject ) ) {
+		return selector;
+	}
+
+	const prefix = selector.slice( 0, start );
+	const pseudo = pseudoElementStart( subject );
+	const base = -1 === pseudo ? subject : subject.slice( 0, pseudo );
+	const suffix = -1 === pseudo ? '' : subject.slice( pseudo );
+
+	return `${ prefix }${ base || '*' }${ ATOMIC_MATCH }${ suffix }`;
+}
+
+/**
+ * Index of the `}` closing the block opened at `open`.
+ *
+ * @param {string} css  Stylesheet text.
+ * @param {number} open Index of the opening brace.
+ * @return {number} Index of the matching brace, or -1 when unterminated.
+ */
+function blockEnd( css, open ) {
+	let depth = 0;
+	let quote = '';
+	let escaped = false;
+
+	for ( let i = open; i < css.length; i++ ) {
+		const char = css[ i ];
+
+		if ( escaped ) {
+			escaped = false;
+			continue;
+		}
+
+		if ( '\\' === char ) {
+			escaped = true;
+			continue;
+		}
+
+		if ( quote ) {
+			if ( char === quote ) {
+				quote = '';
+			}
+			continue;
+		}
+
+		if ( '/' === char && '*' === css[ i + 1 ] ) {
+			const end = css.indexOf( '*/', i + 2 );
+			i = -1 === end ? css.length : end + 1;
+			continue;
+		}
+
+		if ( '"' === char || '\'' === char ) {
+			quote = char;
+			continue;
+		}
+
+		if ( '{' === char ) {
+			depth++;
+			continue;
+		}
+
+		if ( '}' === char ) {
+			depth--;
+			if ( 0 === depth ) {
+				return i;
+			}
+		}
+	}
+
+	return -1;
+}
+
+/**
+ * Rewrite every style-rule selector in a stylesheet.
+ *
+ * A falsy return from `transform` drops the rule.
+ *
+ * @param {string}   css       Stylesheet text.
+ * @param {Function} transform Receives the selector list and the declaration block.
+ * @return {string} Rewritten stylesheet.
+ */
+export function transformCssSelectors( css, transform ) {
+	let out = '';
+	let prelude = '';
+	let i = 0;
+
+	while ( i < css.length ) {
+		const char = css[ i ];
+
+		if ( '/' === char && '*' === css[ i + 1 ] ) {
+			const end = css.indexOf( '*/', i + 2 );
+			i = -1 === end ? css.length : end + 2;
+			continue;
+		}
+
+		if ( '\\' === char ) {
+			prelude += css.slice( i, i + 2 );
+			i += 2;
+			continue;
+		}
+
+		if ( '"' === char || '\'' === char ) {
+			let end = i + 1;
+			while ( end < css.length ) {
+				if ( '\\' === css[ end ] ) {
+					end += 2;
+					continue;
+				}
+				if ( css[ end ] === char ) {
+					end++;
+					break;
+				}
+				end++;
+			}
+			prelude += css.slice( i, end );
+			i = end;
+			continue;
+		}
+
+		if ( '{' === char ) {
+			const end = blockEnd( css, i );
+			const close = -1 === end ? css.length : end;
+			const body = css.slice( i + 1, close );
+			const trimmed = prelude.trim();
+
+			if ( trimmed.startsWith( '@' ) ) {
+				const inner = OPAQUE_AT_RULE.test( trimmed ) ? body : transformCssSelectors( body, transform );
+				out += `${ trimmed }{${ inner }}`;
+			} else {
+				const selector = transform( trimmed, body );
+				if ( selector ) {
+					out += `${ selector }{${ body }}`;
+				}
+			}
+
+			prelude = '';
+			i = close + 1;
+			continue;
+		}
+
+		if ( ';' === char ) {
+			out += `${ prelude.trim() };`;
+			prelude = '';
+			i++;
+			continue;
+		}
+
+		if ( '}' === char ) {
+			i++;
+			continue;
+		}
+
+		prelude += char;
+		i++;
+	}
+
+	return out + prelude.trim();
+}
+
+/**
+ * Keep Tailwind's element resets and variables inside Atomic Wind blocks.
+ *
+ * @param {string} css Generated stylesheet.
+ * @return {string} Scoped stylesheet.
+ */
+export function scopeToAtomicWind( css ) {
+	if ( ! css ) {
+		return css;
+	}
+
+	return transformCssSelectors( css, ( selectorText ) => {
+		const scoped = splitSelectorList( selectorText ).map( scopeSelectorToBlocks );
+
+		return Array.from( new Set( scoped ) ).join( ', ' );
+	} );
+}
+
+/**
+ * Prefix every selector with a container scope (used for the editor canvas).
+ *
+ * @param {string} css           Generated stylesheet.
+ * @param {string} scopeSelector Container selector.
+ * @return {string} Prefixed stylesheet.
+ */
+export function prefixCss( css, scopeSelector ) {
+	if ( ! css || ! scopeSelector ) {
+		return css;
+	}
+
+	return transformCssSelectors( css, ( selectorText ) =>
+		splitSelectorList( selectorText )
+			.map( ( selector ) => {
+				// The container stands in for the document root, so substitute it
+				// for a leading root compound rather than prepending.
+				const rooted = selector.match( ROOT_PREFIX );
+
+				if ( rooted ) {
+					return `${ scopeSelector }${ selector.slice( rooted[ 0 ].length ) }`;
+				}
+
+				return `${ scopeSelector } ${ selector }`;
+			} )
+			.join( ', ' )
+	);
+}
diff --git a/src/atomic-wind/tailwind/test/scope-css.test.js b/src/atomic-wind/tailwind/test/scope-css.test.js
new file mode 100644
index 000000000..f19b7d87e
--- /dev/null
+++ b/src/atomic-wind/tailwind/test/scope-css.test.js
@@ -0,0 +1,185 @@
+import { prefixCss, scopeToAtomicWind, splitSelectorList } from '../scope-css';
+
+const MATCH = ':where([class*="wp-block-atomic-wind-"], [class*="wp-block-atomic-wind-"] *)';
+const SELF = ':where([class*="wp-block-atomic-wind-"])';
+
+describe( 'splitSelectorList', () => {
+	it( 'ignores commas nested in functional pseudo-classes and strings', () => {
+		expect( splitSelectorList( 'a:is(b, c), d[title="x, y"], e' ) ).toEqual( [
+			'a:is(b, c)',
+			'd[title="x, y"]',
+			'e',
+		] );
+	} );
+} );
+
+describe( 'scopeToAtomicWind', () => {
+	it( 'confines element resets to the block subtree', () => {
+		expect( scopeToAtomicWind( 'h1, h2 { font-size: inherit; }' ) ).toBe(
+			`h1${ MATCH }, h2${ MATCH }{ font-size: inherit; }`
+		);
+	} );
+
+	it( 'leaves utility rules global', () => {
+		const css = '.flex{display:flex}#id{color:red}';
+		expect( scopeToAtomicWind( css ) ).toBe( css );
+	} );
+
+	it( 'scopes the subject compound only, keeping ancestors intact', () => {
+		expect( scopeToAtomicWind( ':where(select:is([multiple])) optgroup{font-weight:bolder}' ) ).toBe(
+			`:where(select:is([multiple])) optgroup${ MATCH }{font-weight:bolder}`
+		);
+	} );
+
+	it( 'keeps the pseudo-element last and qualifies bare ones with a universal', () => {
+		expect( scopeToAtomicWind( '::placeholder, h1::before, p:first-line{opacity:1}' ) ).toBe(
+			`*${ MATCH }::placeholder, h1${ MATCH }::before, p${ MATCH }:first-line{opacity:1}`
+		);
+	} );
+
+	it( 'scopes attribute-anchored rules, which still match theme markup', () => {
+		expect( scopeToAtomicWind( '[hidden]{display:none !important}' ) ).toBe(
+			`[hidden]${ MATCH }{display:none !important}`
+		);
+	} );
+
+	it( 'moves document-level styling onto the block wrapper', () => {
+		expect( scopeToAtomicWind( 'html, :host{line-height:1.5;tab-size:4}' ) ).toBe(
+			`${ SELF }{line-height:1.5;tab-size:4}`
+		);
+	} );
+
+	it( 'moves theme variables onto the block wrapper so they cannot shadow theme ones', () => {
+		expect( scopeToAtomicWind( ':root, :host{--spacing:0.25rem;--text-lg:1.125rem}' ) ).toBe(
+			`${ SELF }{--spacing:0.25rem;--text-lg:1.125rem}`
+		);
+	} );
+
+	it( 'scopes the universal custom-property initializers', () => {
+		expect( scopeToAtomicWind( '*, ::before, ::backdrop{--tw-content:""}' ) ).toBe(
+			`*${ MATCH }, *${ MATCH }::before, *${ MATCH }::backdrop{--tw-content:""}`
+		);
+	} );
+
+	it( 'keeps a document root used as an ancestor, scoping its subject instead', () => {
+		// `[body_&]:text-red-500` and friends put a root in front of the real
+		// subject; collapsing the whole selector would drop that subject and
+		// apply the declarations to every block wrapper.
+		expect( scopeToAtomicWind( 'body .\\[body_\\&\\]\\:text-red-500{color:red}' ) ).toBe(
+			'body .\\[body_\\&\\]\\:text-red-500{color:red}'
+		);
+
+		expect( scopeToAtomicWind( 'html figure{margin:0}' ) ).toBe(
+			`html figure${ MATCH }{margin:0}`
+		);
+	} );
+
+	it( 'recurses into conditional at-rules', () => {
+		expect( scopeToAtomicWind( '@layer base{@media (width >= 48rem){img{display:block}}}' ) ).toBe(
+			`@layer base{@media (width >= 48rem){img${ MATCH }{display:block}}}`
+		);
+	} );
+
+	it( 'emits keyframes, @property and @import verbatim', () => {
+		const css = '@import "x.css";@property --tw-x{syntax:"*";inherits:false}@keyframes spin{from{transform:rotate(0)}to{transform:rotate(1turn)}}';
+		expect( scopeToAtomicWind( css ) ).toBe( css );
+	} );
+
+	it( 'leaves nested selectors inside a utility rule untouched', () => {
+		const css = '.space-y-4{:where(& > :not(:last-child)){margin-block-start:0}}.hover\\:underline{&:hover{text-decoration:underline}}';
+		expect( scopeToAtomicWind( css ) ).toBe( css );
+	} );
+
+	it( 'keeps escaped arbitrary-value selectors intact and keeps scoping after them', () => {
+		// Tailwind escapes the quotes in `after:content-["it's"]`, leaving a lone
+		// apostrophe. Reading it as a string opener used to swallow the rest of
+		// the stylesheet, silently leaking every element rule that followed.
+		const utility = '.after\\:content-\\[\\"it\\\'s\\"\\]';
+		const css = `${ utility }{--tw-content:"it's"}h1{font-size:inherit}`;
+
+		expect( scopeToAtomicWind( css ) ).toBe(
+			`${ utility }{--tw-content:"it's"}h1${ MATCH }{font-size:inherit}`
+		);
+	} );
+
+	it( 'does not split selectors on escaped commas', () => {
+		const utility = '.grid-cols-\\[repeat\\(2\\,minmax\\(0\\,1fr\\)\\)\\]';
+		const css = `${ utility }{grid-template-columns:repeat(2,minmax(0,1fr))}`;
+
+		expect( scopeToAtomicWind( css ) ).toBe( css );
+	} );
+
+	it( 'handles a Tailwind-shaped stylesheet layer by layer', () => {
+		const css = [
+			'@layer properties;@layer theme, base, components, utilities;',
+			'@layer theme{:root, :host{--spacing:0.25rem}}',
+			'@layer base{*, ::before{box-sizing:border-box;margin:0}',
+			'html, :host{line-height:1.5}',
+			'ul, menu{list-style:none}',
+			'input:where([type="button"])::file-selector-button{appearance:button}}',
+			'@layer utilities{.flex{display:flex !important}',
+			'.hover\\:underline{&:hover{@media (hover: hover){text-decoration:underline !important}}}}',
+			'@property --tw-content{syntax:"*";initial-value:"";inherits:false}',
+		].join( '' );
+
+		const out = scopeToAtomicWind( css );
+
+		// Layer statements, theme variables, utilities and @property pass through.
+		expect( out ).toContain( '@layer properties;@layer theme, base, components, utilities;' );
+		expect( out ).toContain( `@layer theme{${ SELF }{--spacing:0.25rem}}` );
+		expect( out ).toContain( '.flex{display:flex !important}' );
+		expect( out ).toContain( '.hover\\:underline{&:hover{@media (hover: hover){text-decoration:underline !important}}}' );
+		expect( out ).toContain( '@property --tw-content{syntax:"*";initial-value:"";inherits:false}' );
+
+		// Every base-layer rule is confined to the blocks.
+		expect( out ).toContain( `*${ MATCH }, *${ MATCH }::before{box-sizing:border-box;margin:0}` );
+		expect( out ).toContain( `${ SELF }{line-height:1.5}` );
+		expect( out ).toContain( `ul${ MATCH }, menu${ MATCH }{list-style:none}` );
+		expect( out ).toContain( `input:where([type="button"])${ MATCH }::file-selector-button{appearance:button}` );
+
+		// No bare element selector survives at the start of a rule.
+		expect( out ).not.toMatch( /(^|[{};])\s*(html|ul|menu|input)\s*[,{]/ );
+	} );
+
+	it( 'is a no-op on empty input', () => {
+		expect( scopeToAtomicWind( '' ) ).toBe( '' );
+	} );
+} );
+
+describe( 'prefixCss', () => {
+	it( 'prefixes selectors and collapses document-level ones onto the scope', () => {
+		expect( prefixCss( 'h1{color:red}html{tab-size:4}', ':where(.editor-styles-wrapper)' ) ).toBe(
+			':where(.editor-styles-wrapper) h1{color:red}:where(.editor-styles-wrapper){tab-size:4}'
+		);
+	} );
+
+	it( 'substitutes the scope for a leading document root, keeping the descendant', () => {
+		// The container is itself inside `body`, so prepending would produce
+		// `:where(.editor-styles-wrapper) body .utility` — unsatisfiable.
+		expect( prefixCss( 'body .utility{color:red}', ':where(.editor-styles-wrapper)' ) ).toBe(
+			':where(.editor-styles-wrapper) .utility{color:red}'
+		);
+
+		expect( prefixCss( 'html figure:where(x){margin:0}', ':where(.editor-styles-wrapper)' ) ).toBe(
+			':where(.editor-styles-wrapper) figure:where(x){margin:0}'
+		);
+	} );
+
+	it( 'keeps the combinator when substituting the scope', () => {
+		expect( prefixCss( 'body > .utility{color:red}', ':where(.editor-styles-wrapper)' ) ).toBe(
+			':where(.editor-styles-wrapper) > .utility{color:red}'
+		);
+	} );
+
+	it( 'prefixes an already-scoped stylesheet without touching escaped utilities', () => {
+		const utility = '.hover\\:bg-\\[\\#C65D07\\]';
+
+		expect( prefixCss( `${ utility }{background:#C65D07}`, ':where(.editor-styles-wrapper)' ) ).toBe(
+			`:where(.editor-styles-wrapper) ${ utility }{background:#C65D07}`
+		);
+	} );
+
+	it( 'returns the stylesheet untouched without a scope selector', () => {
+		expect( prefixCss( 'h1{color:red}', '' ) ).toBe( 'h1{color:red}' );
+	} );
+} );
diff --git a/src/blocks/test/e2e/blocks/atomic-wind-css-scope.spec.js b/src/blocks/test/e2e/blocks/atomic-wind-css-scope.spec.js
new file mode 100644
index 000000000..b52887233
--- /dev/null
+++ b/src/blocks/test/e2e/blocks/atomic-wind-css-scope.spec.js
@@ -0,0 +1,89 @@
+/**
+ * Internal dependencies
+ */
+import { test, expect } from '../fixtures';
+import { setAtomicWind } from '../helpers/design-library';
+import { publishAndViewPost } from '../helpers/editor';
+
+/**
+ * The generated Tailwind stylesheet carries preflight, whose rules target bare
+ * HTML elements, and a theme layer defining variables such as `--spacing`. It
+ * is injected into the document head, so both must only reach markup inside
+ * Atomic Wind blocks — theme markup elsewhere keeps its own element styling and
+ * its own variables.
+ */
+test.describe( 'Atomic Wind Tailwind CSS scope', () => {
+	test.beforeEach( async({ otterUtils, admin }) => {
+		await setAtomicWind( otterUtils, true );
+		await admin.createNewPost();
+	});
+
+	test.afterAll( async({ otterUtils }) => {
+		await setAtomicWind( otterUtils, false );
+	});
+
+	test( 'resets elements inside the block without touching theme markup', async({ editor, page }) => {
+		await editor.insertBlock({
+			name: 'core/list',
+			attributes: { className: 'theme-list' },
+			innerBlocks: [
+				{ name: 'core/list-item', attributes: { content: 'Theme item' } }
+			]
+		});
+
+		await editor.insertBlock({
+			name: 'atomic-wind/box',
+			attributes: { className: 'flex mt-4 p-8' },
+			innerBlocks: [
+				{
+					name: 'core/list',
+					attributes: { className: 'block-list' },
+					innerBlocks: [
+						{ name: 'core/list-item', attributes: { content: 'Block item' } }
+					]
+				}
+			]
+		});
+
+		await publishAndViewPost({ editor, page });
+
+		const box = page.locator( '.wp-block-atomic-wind-box' );
+
+		// The utility landing proves the stylesheet reached the page at all,
+		// so the assertions below cannot pass on a missing stylesheet.
+		await expect( box ).toHaveCSS( 'display', 'flex' );
+
+		// `mt-4`/`p-8` resolve through `var(--spacing)`, which is defined on the
+		// block wrapper rather than at `:root`. Zero values here would mean the
+		// variables no longer reach the utilities.
+		await expect( box ).toHaveCSS( 'margin-top', '16px' );
+		await expect( box ).toHaveCSS( 'padding', '32px' );
+
+		await expect( page.locator( 'ul.block-list' ) ).toHaveCSS( 'list-style-type', 'none' );
+		await expect( page.locator( 'ul.theme-list' ) ).toHaveCSS( 'list-style-type', 'disc' );
+	});
+
+	test( 'keeps Tailwind theme variables out of the document root', async({ editor, page }) => {
+		// `mt-4` is what pulls `--spacing` into the theme layer; without a
+		// variable-consuming utility the stylesheet defines none and the
+		// assertion below would hold either way.
+		await editor.insertBlock({
+			name: 'atomic-wind/box',
+			attributes: { className: 'flex mt-4' }
+		});
+
+		await publishAndViewPost({ editor, page });
+
+		await expect( page.locator( '.wp-block-atomic-wind-box' ) ).toHaveCSS( 'display', 'flex' );
+
+		const [ rootSpacing, blockSpacing ] = await page.evaluate( () => [
+			getComputedStyle( document.documentElement ).getPropertyValue( '--spacing' ).trim(),
+			getComputedStyle( document.querySelector( '.wp-block-atomic-wind-box' ) )
+				.getPropertyValue( '--spacing' )
+				.trim()
+		] );
+
+		expect( rootSpacing ).toBe( '' );
+		expect( blockSpacing ).toBe( '0.25rem' );
+	});
+});
diff --git a/src/blocks/test/e2e/playwright.config.js b/src/blocks/test/e2e/playwright.config.js
index 04cc7bd68..e9458d047 100644
--- a/src/blocks/test/e2e/playwright.config.js
+++ b/src/blocks/test/e2e/playwright.config.js
@@ -58,6 +58,7 @@ const SERIAL_SPECS = [
 
 	// Flips the site-wide atomic-wind blocks option.
 	'**/blocks/atomic-wind-list-view.spec.js',
+	'**/blocks/atomic-wind-css-scope.spec.js',
 
 	// Mutates the shared admin user's metabox order and editor preferences.
 	'**/blocks/woocommerce-builder.spec.js',
diff --git a/tests/test-atomic-wind-blocks.php b/tests/test-atomic-wind-blocks.php
index 0c85a50bc..024fde399 100644
--- a/tests/test-atomic-wind-blocks.php
+++ b/tests/test-atomic-wind-blocks.php
@@ -1137,6 +1137,17 @@ private function make_atomic_wind_post( $classes ) {
 		);
 	}
 
+	/**
+	 * Helper: set cached CSS for a post.
+	 *
+	 * @param int    $post_id Post ID.
+	 * @param string $css CSS string.
+	 */
+	private function set_cached_css( $post_id, $css ) {
+		update_post_meta( $post_id, '_atomic_wind_css', $css );
+		update_post_meta( $post_id, '_atomic_wind_css_version', Atomic_Wind_Blocks::ATOMIC_WIND_CSS_VERSION );
+	}
+
 	// -------------------------------------------------------
 	// Save-time CSS warm (hidden-iframe render)
 	// -------------------------------------------------------
@@ -1288,8 +1299,8 @@ public function test_output_late_css_inlines_multiple_rendered_posts() {
 
 		$a = $this->make_atomic_wind_post( 'flex' );
 		$b = $this->make_atomic_wind_post( 'grid' );
-		update_post_meta( $a, '_atomic_wind_css', '.flex{display:flex}' );
-		update_post_meta( $b, '_atomic_wind_css', '.grid{display:grid}' );
+		$this->set_cached_css( $a, '.flex{display:flex}' );
+		$this->set_cached_css( $b, '.grid{display:grid}' );
 
 		global $post;
 		$post = get_post( $a );
@@ -1316,8 +1327,8 @@ public function test_output_late_css_dedupes_identical_blobs() {
 
 		$a = $this->make_atomic_wind_post( 'flex' );
 		$b = $this->make_atomic_wind_post( 'flex' );
-		update_post_meta( $a, '_atomic_wind_css', '.flex{display:flex}' );
-		update_post_meta( $b, '_atomic_wind_css', '.flex{display:flex}' );
+		$this->set_cached_css( $a, '.flex{display:flex}' );
+		$this->set_cached_css( $b, '.flex{display:flex}' );
 
 		global $post;
 		$post = get_post( $a );
@@ -1341,7 +1352,7 @@ public function test_frontend_css_is_not_enqueued_until_a_block_renders() {
 		$this->reset_style_globals();
 
 		$post_id = $this->make_atomic_wind_post( 'flex' );
-		update_post_meta( $post_id, '_atomic_wind_css', '.flex{display:flex}' );
+		$this->set_cached_css( $post_id, '.flex{display:flex}' );
 
 		$GLOBALS['wp_query']->posts = array( get_post( $post_id ) );
 
@@ -1358,7 +1369,7 @@ public function test_output_late_css_inlines_tracked_post_and_skips_generator()
 		$this->instance->enqueue_base_css();
 
 		$late = $this->make_atomic_wind_post( 'flex' );
-		update_post_meta( $late, '_atomic_wind_css', '.late{color:blue}' );
+		$this->set_cached_css( $late, '.late{color:blue}' );
 
 		global $post;
 		$post = get_post( $late );
@@ -1384,7 +1395,7 @@ public function test_output_late_css_collects_blocks_rendered_by_normal_footer_c
 		update_option( 'themeisle_blocks_settings_atomic_wind_blocks', true );
 
 		$late = $this->make_atomic_wind_post( 'flex' );
-		update_post_meta( $late, '_atomic_wind_css', '.footer-callback{color:purple}' );
+		$this->set_cached_css( $late, '.footer-callback{color:purple}' );
 
 		global $post;
 		$post = get_post( $late );
@@ -1414,7 +1425,7 @@ public function test_output_late_css_falls_back_to_generator_when_counts_exceed(
 		$this->reset_in_query( false );
 
 		$late = $this->make_atomic_wind_post( 'flex' );
-		update_post_meta( $late, '_atomic_wind_css', '.late{color:blue}' );
+		$this->set_cached_css( $late, '.late{color:blue}' );
 
 		global $post;
 		$post = get_post( $late );
@@ -1435,7 +1446,7 @@ public function test_output_singular_css_inlines_queried_post_in_head() {
 		$this->reset_style_globals();
 
 		$singular = $this->make_atomic_wind_post( 'flex' );
-		update_post_meta( $singular, '_atomic_wind_css', '.flex{display:flex}' );
+		$this->set_cached_css( $singular, '.flex{display:flex}' );
 
 		$this->go_to( get_permalink( $singular ) );
 		$this->instance->enqueue_base_css();
@@ -1458,11 +1469,47 @@ public function test_output_singular_css_enqueues_generator_without_cache() {
 		$this->assertTrue( wp_script_is( 'atomic-wind-tailwind-generator', 'enqueued' ) );
 	}
 
+	public function test_output_singular_css_regenerates_css_from_an_older_generator() {
+		$this->reset_style_globals();
+
+		$singular = $this->make_atomic_wind_post( 'flex' );
+		// Stylesheet cached before the resets were scoped to Atomic Wind blocks.
+		update_post_meta( $singular, '_atomic_wind_css', 'h1{font-size:inherit}' );
+
+		$this->go_to( get_permalink( $singular ) );
+		$this->instance->output_singular_css();
+
+		$this->assertSame( '', $this->inline_style_for( 'atomic-wind-tailwind' ) );
+		$this->assertTrue( wp_script_is( 'atomic-wind-tailwind-generator', 'enqueued' ) );
+	}
+
+	public function test_rest_save_style_stamps_the_generator_version() {
+		$request = new WP_REST_Request( 'POST', '/otter/v1/atomic-wind/style' );
+		$request->set_param( 'postId', $this->post_id );
+		$request->set_param( 'css', '.flex{display:flex}' );
+
+		$this->instance->rest_save_style( $request );
+
+		$this->assertSame(
+			Atomic_Wind_Blocks::ATOMIC_WIND_CSS_VERSION,
+			get_post_meta( $this->post_id, '_atomic_wind_css_version', true )
+		);
+	}
+
+	public function test_clear_cached_css_drops_the_version_stamp() {
+		$post_id = $this->make_atomic_wind_post( 'flex' );
+		$this->set_cached_css( $post_id, '.flex{display:flex}' );
+
+		$this->instance->clear_cached_css( $post_id );
+
+		$this->assertSame( '', get_post_meta( $post_id, '_atomic_wind_css_version', true ) );
+	}
+
 	public function test_output_singular_css_noop_on_non_singular_views() {
 		$this->reset_style_globals();
 
 		$listed = $this->make_atomic_wind_post( 'flex' );
-		update_post_meta( $listed, '_atomic_wind_css', '.flex{display:flex}' );
+		$this->set_cached_css( $listed, '.flex{display:flex}' );
 
 		$this->go_to( home_url( '/' ) );
 		$this->instance->output_singular_css();
@@ -1476,7 +1523,7 @@ public function test_output_late_css_skips_post_already_inlined_at_head() {
 		$this->reset_in_query( false );
 
 		$singular = $this->make_atomic_wind_post( 'flex' );
-		update_post_meta( $singular, '_atomic_wind_css', '.flex{display:flex}' );
+		$this->set_cached_css( $singular, '.flex{display:flex}' );
 
 		$this->go_to( get_permalink( $singular ) );
 		$this->instance->output_singular_css();

From a17d8700d77cf73fe1efcef2cd01c95df52034e0 Mon Sep 17 00:00:00 2001
From: Girish Panchal <79647963+girishpanchal30@users.noreply.github.com>
Date: Sat, 29 Aug 2026 13:31:00 +0530
Subject: [PATCH 15/25] Enhanced license validation (#2999)

* fix: enhance license validation

* fix: improve license validation
---
 .../inc/server/class-dashboard-server.php     |  48 ++-
 tests/test-dashboard-server-license.php       | 314 ++++++++++++++++++
 2 files changed, 361 insertions(+), 1 deletion(-)
 create mode 100644 tests/test-dashboard-server-license.php

diff --git a/plugins/otter-pro/inc/server/class-dashboard-server.php b/plugins/otter-pro/inc/server/class-dashboard-server.php
index df505f61e..e55b763ea 100644
--- a/plugins/otter-pro/inc/server/class-dashboard-server.php
+++ b/plugins/otter-pro/inc/server/class-dashboard-server.php
@@ -35,6 +35,20 @@ class Dashboard_Server {
 	 */
 	public $version = 'v1';
 
+	/**
+	 * Neve price IDs that bundle Otter Pro.
+	 *
+	 * @var int[]
+	 */
+	const VALID_NEVE_PLANS = array( 5, 6, 9, 14, 17, 20, 23, 27, 28, 29 );
+
+	/**
+	 * License statuses describing a key that does cover Otter Pro but cannot be used right now.
+	 *
+	 * @var string[]
+	 */
+	const NON_PLAN_LICENSE_STATUSES = array( 'expired', 'active_expired', 'revoked', 'site_inactive', 'no_activations_left', 'not_active' );
+
 	/**
 	 * Initialize the class
 	 */
@@ -141,11 +155,21 @@ public function toggle_license( $request ) {
 		}
 
 		$response = apply_filters( 'themeisle_sdk_license_process_otter', $fields['key'], $fields['action'] );
+		$plan     = (int) apply_filters( 'product_otter_license_plan', 0 );
 
 		if ( is_wp_error( $response ) ) {
+			$message = $response->get_error_message();
+			if (
+				'activate' === $fields['action'] &&
+				'themeisle-license-invalid' === $response->get_error_code() &&
+				$this->is_ineligible_plan( $plan )
+			) {
+				$message = __( 'Entered license key does not include Otter Pro.', 'otter-pro' );
+			}
+
 			return new \WP_REST_Response(
 				array(
-					'message' => $response->get_error_message(),
+					'message' => $message,
 					'success' => false,
 				)
 			);
@@ -164,6 +188,28 @@ public function toggle_license( $request ) {
 		);
 	}
 
+	/**
+	 * Whether the stored license data proves the key belongs to a plan without Otter Pro.
+	 *
+	 * @param int $plan Price ID reported for the stored license.
+	 * @return bool
+	 */
+	private function is_ineligible_plan( $plan ) {
+		$license_data = License::get_license_data();
+
+		if ( ! is_object( $license_data ) || ! isset( $license_data->price_id ) ) {
+			return false;
+		}
+
+		$status = isset( $license_data->license ) ? $license_data->license : '';
+
+		if ( in_array( $status, self::NON_PLAN_LICENSE_STATUSES, true ) ) {
+			return false;
+		}
+
+		return ! in_array( $plan, self::VALID_NEVE_PLANS, true );
+	}
+
 	/**
 	 * The instance method for the static class.
 	 * Defines and returns the instance of the static class.
diff --git a/tests/test-dashboard-server-license.php b/tests/test-dashboard-server-license.php
new file mode 100644
index 000000000..2507acc83
--- /dev/null
+++ b/tests/test-dashboard-server-license.php
@@ -0,0 +1,314 @@
+<?php
+/**
+ * Class Dashboard_Server_License
+ *
+ * @package gutenberg-blocks
+ */
+
+use ThemeIsle\OtterPro\Plugins\License;
+use ThemeIsle\OtterPro\Server\Dashboard_Server;
+
+/**
+ * Tests for the license error messages returned by otter/v1/toggle_license.
+ */
+class Test_Dashboard_Server_License extends WP_UnitTestCase {
+
+	/**
+	 * The message the SDK returns for a license the store rejected.
+	 */
+	const SDK_INVALID_MESSAGE = 'ERROR: Invalid license provided.';
+
+	/**
+	 * Option the SDK writes the store's answer to, derived from the plugin dir.
+	 */
+	const LICENSE_DATA_OPTION = 'otter_pro_license_data';
+
+	/**
+	 * The message the dashboard should show for a plan mismatch.
+	 */
+	const PLAN_MISMATCH_MESSAGE = 'Entered license key does not include Otter Pro.';
+
+	/**
+	 * Instance under test.
+	 *
+	 * @var Dashboard_Server
+	 */
+	private $server;
+
+	/**
+	 * Define the Otter Pro basefile the success path needs.
+	 *
+	 * The suite never boots otter-pro (development.php bails because WPINC is
+	 * not defined when Composer loads it), so the constant License reads for the
+	 * license option name is missing. Point it at the real plugin file.
+	 */
+	public static function set_up_before_class() {
+		parent::set_up_before_class();
+
+		if ( ! defined( 'OTTER_PRO_BASEFILE' ) ) {
+			define( 'OTTER_PRO_BASEFILE', dirname( __DIR__ ) . '/plugins/otter-pro/otter-pro.php' );
+		}
+	}
+
+	/**
+	 * Set up test environment.
+	 *
+	 * The server is built directly instead of through instance(): init() would
+	 * register an otter_dashboard_data filter that reads OTTER_PRO_VERSION,
+	 * which is not defined in the test suite.
+	 */
+	public function set_up() {
+		parent::set_up();
+		$this->server = new Dashboard_Server();
+		delete_option( self::LICENSE_DATA_OPTION );
+	}
+
+	/**
+	 * Make the SDK license process return the given value.
+	 *
+	 * @param mixed $result Value the filter should return.
+	 */
+	private function mock_license_process( $result ) {
+		remove_all_filters( 'themeisle_sdk_license_process_otter' );
+		add_filter(
+			'themeisle_sdk_license_process_otter',
+			function () use ( $result ) {
+				return $result;
+			}
+		);
+	}
+
+	/**
+	 * Make the stored license plan resolve to the given price ID.
+	 *
+	 * @param int|string $plan Price ID.
+	 */
+	private function mock_license_plan( $plan ) {
+		remove_all_filters( 'product_otter_license_plan' );
+		add_filter(
+			'product_otter_license_plan',
+			function () use ( $plan ) {
+				return $plan;
+			}
+		);
+	}
+
+	/**
+	 * Mirror what the SDK stores after the store answers an activation.
+	 *
+	 * do_license_process() writes the response to the license data option before
+	 * it returns the WP_Error, and the plan filter reports price_id from that
+	 * same option, falling back to -1 when the response carried none.
+	 *
+	 * @param string   $status   License status returned by the store.
+	 * @param int|null $price_id Price ID returned by the store, null if absent.
+	 */
+	private function mock_store_response( $status, $price_id = null ) {
+		$data = array(
+			'license' => $status,
+			'key'     => 'a-license-key',
+		);
+
+		if ( null !== $price_id ) {
+			$data['price_id'] = $price_id;
+		}
+
+		update_option( self::LICENSE_DATA_OPTION, (object) $data );
+		$this->mock_license_plan( null === $price_id ? -1 : $price_id );
+	}
+
+	/**
+	 * Run toggle_license and return the response payload.
+	 *
+	 * @param array $body JSON body.
+	 *
+	 * @return array
+	 */
+	private function toggle( $body ) {
+		$request = new WP_REST_Request( 'POST', '/otter/v1/toggle_license' );
+		$request->set_header( 'content-type', 'application/json' );
+		$request->set_body( wp_json_encode( $body ) );
+
+		$response = $this->server->toggle_license( $request );
+
+		$this->assertInstanceOf( 'WP_REST_Response', $response );
+
+		return $response->get_data();
+	}
+
+	/**
+	 * Activate with the given key and return the response payload.
+	 *
+	 * @param string $key License key.
+	 *
+	 * @return array
+	 */
+	private function activate( $key = 'neve-personal-license-key' ) {
+		return $this->toggle(
+			array(
+				'action' => 'activate',
+				'key'    => $key,
+			)
+		);
+	}
+
+	/**
+	 * A key the store answered for with a plan outside the allow list does not
+	 * include Otter Pro, so the generic SDK error is replaced by the reason.
+	 *
+	 * 1 and 2 are Neve Personal; 7, 12 and 30 are higher Neve tiers that still
+	 * exclude Otter Pro.
+	 */
+	public function test_activation_with_an_unsupported_plan_reports_the_plan_mismatch() {
+		$this->mock_license_process( new WP_Error( 'themeisle-license-invalid', self::SDK_INVALID_MESSAGE ) );
+
+		foreach ( array( 1, 2, 7, 12, 30 ) as $plan ) {
+			$this->assertNotContains( $plan, Dashboard_Server::VALID_NEVE_PLANS, "Plan {$plan} is a fixture for an unsupported plan" );
+
+			$this->mock_store_response( 'invalid', $plan );
+
+			$data = $this->activate();
+
+			$this->assertFalse( $data['success'], "Activation should fail for plan {$plan}" );
+			$this->assertSame( self::PLAN_MISMATCH_MESSAGE, $data['message'], "Plan {$plan} should report the plan mismatch, not the generic SDK error" );
+		}
+	}
+
+	/**
+	 * Plans that do bundle Otter Pro keep the SDK message: a rejected key on an
+	 * agency plan is not a plan problem.
+	 */
+	public function test_activation_with_a_supported_plan_keeps_the_sdk_message() {
+		$this->mock_license_process( new WP_Error( 'themeisle-license-invalid', self::SDK_INVALID_MESSAGE ) );
+
+		$this->assertNotEmpty( Dashboard_Server::VALID_NEVE_PLANS, 'The supported plan list should not be empty' );
+
+		foreach ( Dashboard_Server::VALID_NEVE_PLANS as $plan ) {
+			$this->mock_store_response( 'invalid', $plan );
+
+			$data = $this->activate( 'some-agency-license-key' );
+
+			$this->assertFalse( $data['success'] );
+			$this->assertSame( self::SDK_INVALID_MESSAGE, $data['message'], "Plan {$plan} bundles Otter Pro, so the SDK message should be kept" );
+		}
+	}
+
+	/**
+	 * A key that does cover Otter Pro but is expired, revoked or out of
+	 * activations is rejected with the same themeisle-license-invalid code. Its
+	 * plan is not the problem, so the SDK message must survive.
+	 *
+	 * Price ID 1 is deliberate: it is a standalone Otter plan per
+	 * License::$plans_map and is absent from VALID_NEVE_PLANS, so the plan check
+	 * alone would misreport every one of these as a plan mismatch.
+	 */
+	public function test_unusable_but_eligible_key_keeps_the_sdk_message() {
+		$this->mock_license_process( new WP_Error( 'themeisle-license-invalid', self::SDK_INVALID_MESSAGE ) );
+
+		foreach ( Dashboard_Server::NON_PLAN_LICENSE_STATUSES as $status ) {
+			foreach ( array_keys( License::$plans_map ) as $plan ) {
+				$this->mock_store_response( $status, $plan );
+
+				$data = $this->activate( 'an-otter-standalone-key' );
+
+				$this->assertFalse( $data['success'] );
+				$this->assertSame( self::SDK_INVALID_MESSAGE, $data['message'], "A {$status} key on Otter plan {$plan} is not a plan mismatch" );
+			}
+		}
+	}
+
+	/**
+	 * A key the store did not recognise comes back without a price ID, so the
+	 * plan filter reports -1. That is not evidence of anything and must not be
+	 * rewritten.
+	 */
+	public function test_unrecognised_key_without_a_price_id_keeps_the_sdk_message() {
+		$this->mock_license_process( new WP_Error( 'themeisle-license-invalid', self::SDK_INVALID_MESSAGE ) );
+
+		foreach ( array( 'invalid', 'missing', 'item_name_mismatch' ) as $status ) {
+			$this->mock_store_response( $status );
+
+			$data = $this->activate( 'a-made-up-key' );
+
+			$this->assertFalse( $data['success'] );
+			$this->assertSame( self::SDK_INVALID_MESSAGE, $data['message'], "A {$status} key with no price ID should keep the SDK message" );
+		}
+	}
+
+	/**
+	 * Only the store's rejection can be caused by a plan mismatch. Every other
+	 * failure is reported as the SDK worded it, even while an unsupported plan
+	 * is stored from an earlier key.
+	 */
+	public function test_only_the_invalid_license_error_is_rewritten() {
+		$this->mock_store_response( 'invalid', 1 );
+
+		$codes = array(
+			'themeisle-license-500'            => 'ERROR: Failed to connect to the license service.',
+			'themeisle-license-404'            => 'ERROR: Failed to validate license. Please try again in one minute.',
+			'themeisle-license-invalid-format' => 'Invalid license.',
+			'themeisle-license-already-active' => 'License is already active.',
+		);
+
+		foreach ( $codes as $code => $message ) {
+			$this->mock_license_process( new WP_Error( $code, $message ) );
+
+			$data = $this->activate();
+
+			$this->assertFalse( $data['success'] );
+			$this->assertSame( $message, $data['message'], "Error {$code} is not a plan mismatch and should be reported as-is" );
+		}
+	}
+
+	/**
+	 * The rewrite is gated on the activate action, so deactivation failures are
+	 * never reported as a plan mismatch.
+	 */
+	public function test_deactivation_keeps_the_sdk_message() {
+		$this->mock_store_response( 'invalid', 1 );
+
+		$errors = array(
+			'themeisle-license-already-deactivate' => 'License not active.',
+			'themeisle-license-invalid'            => self::SDK_INVALID_MESSAGE,
+		);
+
+		foreach ( $errors as $code => $message ) {
+			$this->mock_license_process( new WP_Error( $code, $message ) );
+
+			$data = $this->toggle( array( 'action' => 'deactivate' ) );
+
+			$this->assertFalse( $data['success'] );
+			$this->assertSame( $message, $data['message'], "Deactivation error {$code} should be reported as-is" );
+		}
+	}
+
+	/**
+	 * A successful toggle is unaffected by the stored plan: the rewrite is gated
+	 * on the SDK returning a WP_Error.
+	 */
+	public function test_successful_toggle_is_not_rewritten() {
+		$this->mock_license_process( true );
+		$this->mock_store_response( 'invalid', 1 );
+
+		$data = $this->activate( 'a-valid-license-key' );
+
+		$this->assertTrue( $data['success'] );
+		$this->assertSame( 'Activated.', $data['message'] );
+		$this->assertArrayHasKey( 'license', $data );
+	}
+
+	/**
+	 * A malformed payload is rejected before the SDK is called.
+	 */
+	public function test_invalid_action_payload_is_rejected() {
+		$this->mock_license_process( new WP_Error( 'themeisle-license-invalid', self::SDK_INVALID_MESSAGE ) );
+		$this->mock_store_response( 'invalid', 1 );
+
+		foreach ( array( array(), array( 'action' => 'activate' ) ) as $body ) {
+			$data = $this->toggle( $body );
+
+			$this->assertFalse( $data['success'] );
+			$this->assertSame( 'Invalid Action. Please refresh the page and try again.', $data['message'] );
+		}
+	}
+}

From 4b8418f92041d7f5adca915b8c9a8a026eacfeff Mon Sep 17 00:00:00 2001
From: Girish Panchal <79647963+girishpanchal30@users.noreply.github.com>
Date: Sat, 29 Aug 2026 14:31:00 +0530
Subject: [PATCH 16/25] Enhanced block registration to handle instantiation
 failures (#3003)

* fix: enhance block registration to handle instantiation failures

* fix: phpstan
---
 inc/class-registration.php  |  88 ++++++++++++++++++++-----
 phpstan-baseline.neon       |   6 --
 tests/test-registration.php | 124 +++++++++++++++++++++++++++++++++++-
 3 files changed, 194 insertions(+), 24 deletions(-)

diff --git a/inc/class-registration.php b/inc/class-registration.php
index 5df6f6901..b7acfd6e9 100644
--- a/inc/class-registration.php
+++ b/inc/class-registration.php
@@ -969,26 +969,80 @@ public function register_blocks() {
 				);
 			}
 
-			if ( isset( $dynamic_blocks[ $block ] ) && class_exists( $dynamic_blocks[ $block ] ) ) {
-				$classname = $dynamic_blocks[ $block ];
-				$renderer  = new $classname();
-
-				if ( method_exists( $renderer, 'render' ) ) {
-					register_block_type_from_metadata(
-						$metadata_file,
-						array(
-							'render_callback' => array( $renderer, 'render' ),
-						)
-					);
-
-					continue;
-				}
+			$renderer = isset( $dynamic_blocks[ $block ] ) ? self::instantiate_safely( $dynamic_blocks[ $block ] ) : null;
+
+			if ( null !== $renderer && method_exists( $renderer, 'render' ) ) {
+				register_block_type_from_metadata(
+					$metadata_file,
+					array(
+						'render_callback' => array( $renderer, 'render' ),
+					)
+				);
+
+				continue;
 			}
 
 			register_block_type_from_metadata( $metadata_file );
 		}
 	}
 
+	/**
+	 * Instantiate a class without ever fataling the request.
+	 *
+	 * @param mixed $classname Class name to instantiate.
+	 * @return object|null The instance, or null when it cannot be built.
+	 */
+	private static function instantiate_safely( $classname ) {
+		if ( ! is_string( $classname ) || '' === trim( $classname ) ) {
+			self::log_skipped_class( $classname, 'is not a class name' );
+
+			return null;
+		}
+
+		try {
+			// An autoloader can throw or fatal on its own; keep it inside the try.
+			if ( ! class_exists( $classname ) ) {
+				self::log_skipped_class( $classname, 'could not be loaded' );
+
+				return null;
+			}
+
+			$reflection = new \ReflectionClass( $classname );
+
+			if ( ! $reflection->isInstantiable() ) {
+				self::log_skipped_class( $classname, 'is not instantiable' );
+
+				return null;
+			}
+
+			$constructor = $reflection->getConstructor();
+
+			if ( null !== $constructor && $constructor->getNumberOfRequiredParameters() > 0 ) {
+				self::log_skipped_class( $classname, 'requires constructor arguments' );
+
+				return null;
+			}
+
+			return $reflection->newInstance();
+		} catch ( \Throwable $e ) {
+			// Covers Error too: a missing dependency inside the constructor.
+			self::log_skipped_class( $classname, 'threw while being instantiated: ' . $e->getMessage() );
+
+			return null;
+		}
+	}
+
+	/**
+	 * Log a class the plugin had to skip.
+	 *
+	 * @param mixed  $classname Class name, or whatever was given in its place.
+	 * @param string $reason    Why it was skipped.
+	 * @return void
+	 */
+	private static function log_skipped_class( $classname, $reason ) {
+		error_log( '[Otter Blocks] Skipped ' . ( is_string( $classname ) ? $classname : gettype( $classname ) ) . ': ' . $reason . '.' ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+	}
+
 	/**
 	 * Initialize AMP blocks.
 	 *
@@ -1003,10 +1057,10 @@ public function init_amp_blocks() {
 		);
 
 		foreach ( $classnames as $classname ) {
-			$classname = new $classname();
+			$instance = self::instantiate_safely( $classname );
 
-			if ( method_exists( $classname, 'instance' ) ) {
-				$classname->instance();
+			if ( null !== $instance && method_exists( $instance, 'instance' ) ) {
+				$instance->instance();
 			}
 		}
 	}
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
index 07f689482..c1ba7b1a4 100644
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -420,12 +420,6 @@ parameters:
 			count: 1
 			path: inc/class-pro.php
 
-		-
-			rawMessage: 'Call to function method_exists() with ThemeIsle\GutenbergBlocks\Render\AMP\Circle_Counter_Block|ThemeIsle\GutenbergBlocks\Render\AMP\Lottie_Block|ThemeIsle\GutenbergBlocks\Render\AMP\Slider_Block and ''instance'' will always evaluate to true.'
-			identifier: function.alreadyNarrowedType
-			count: 1
-			path: inc/class-registration.php
-
 		-
 			rawMessage: 'Method ThemeIsle\GutenbergBlocks\Registration::block_categories() has parameter $categories with no value type specified in iterable type array.'
 			identifier: missingType.iterableValue
diff --git a/tests/test-registration.php b/tests/test-registration.php
index d12b2983c..6ba0709c6 100644
--- a/tests/test-registration.php
+++ b/tests/test-registration.php
@@ -7,6 +7,73 @@
 
 use ThemeIsle\GutenbergBlocks\Registration;
 
+/**
+ * Renderer whose constructor touches a class that is absent from the deployed
+ * artifact: `class_exists()` on the renderer passes, `new` fatals.
+ */
+class Otter_Renderer_With_Missing_Dependency {
+	/**
+	 * Constructor.
+	 */
+	public function __construct() {
+		new Otter_Dependency_That_Does_Not_Exist();
+	}
+
+	/**
+	 * Render the block.
+	 *
+	 * @param array $attributes Block attributes.
+	 * @return string
+	 */
+	public function render( $attributes ) {
+		return '';
+	}
+}
+
+/**
+ * Renderer that cannot be instantiated: a singleton with a private constructor.
+ */
+class Otter_Renderer_With_Private_Constructor {
+	/**
+	 * Constructor.
+	 */
+	private function __construct() {
+	}
+
+	/**
+	 * Render the block.
+	 *
+	 * @param array $attributes Block attributes.
+	 * @return string
+	 */
+	public function render( $attributes ) {
+		return '';
+	}
+}
+
+/**
+ * Renderer whose constructor takes a required argument.
+ */
+class Otter_Renderer_Requiring_Arguments {
+	/**
+	 * Constructor.
+	 *
+	 * @param string $required Required dependency.
+	 */
+	public function __construct( $required ) {
+	}
+
+	/**
+	 * Render the block.
+	 *
+	 * @param array $attributes Block attributes.
+	 * @return string
+	 */
+	public function render( $attributes ) {
+		return '';
+	}
+}
+
 /**
  * Editor localization tests: the global defaults handed to the editor must
  * always be an object, or every block's Edit component crashes on null.
@@ -87,7 +154,7 @@ public function test_editor_global_defaults_is_object_when_option_is_missing() {
 	 * bootstrap, so the plugin's blocks are unregistered first to keep this a
 	 * clean registration instead of "already registered" notices.
 	 *
-	 * @param string $classname                Renderer class to map form-captcha to.
+	 * @param mixed  $classname                Renderer class to map form-captcha to.
 	 * @param string $expected_include_failure Path whose failed include is expected, or empty if no include failure is expected.
 	 * @return void
 	 */
@@ -244,4 +311,59 @@ public function test_register_blocks_survives_dynamic_renderer_class_whose_file_
 		$this->assertFalse( class_exists( $class, false ), 'The renderer class must not have been defined.' );
 		$this->assertCaptchaRegisteredWithoutRenderer();
 	}
+
+	/**
+	 * The renderer class loads, but its constructor references a class that is
+	 * missing — the reported "class not found" fatal. Registration must fall back
+	 * instead of taking the request down.
+	 */
+	public function test_register_blocks_survives_renderer_whose_constructor_hits_a_missing_class() {
+		$this->register_blocks_with_captcha_renderer( 'Otter_Renderer_With_Missing_Dependency' );
+
+		$this->assertCaptchaRegisteredWithoutRenderer();
+	}
+
+	/**
+	 * A loadable but uninstantiable renderer (abstract class, or a singleton with
+	 * a private constructor) must degrade too.
+	 */
+	public function test_register_blocks_survives_uninstantiable_renderer() {
+		$this->register_blocks_with_captcha_renderer( 'Otter_Renderer_With_Private_Constructor' );
+
+		$this->assertCaptchaRegisteredWithoutRenderer();
+	}
+
+	/**
+	 * A renderer whose constructor requires arguments cannot be built with `new`.
+	 */
+	public function test_register_blocks_survives_renderer_requiring_constructor_arguments() {
+		$this->register_blocks_with_captcha_renderer( 'Otter_Renderer_Requiring_Arguments' );
+
+		$this->assertCaptchaRegisteredWithoutRenderer();
+	}
+
+	/**
+	 * A non-string entry injected through the filter must not reach
+	 * `class_exists()`, which throws a TypeError on those in PHP 8.
+	 */
+	public function test_register_blocks_survives_non_string_renderer_entry() {
+		$this->register_blocks_with_captcha_renderer( array( 'Otter_Renderer_With_Private_Constructor' ) );
+
+		$this->assertCaptchaRegisteredWithoutRenderer();
+	}
+
+	/**
+	 * The AMP list has no filter to inject through, so the guard there is covered
+	 * by running it: it must complete, and every class it ships must still be
+	 * loadable, which is what a stale classmap would break.
+	 */
+	public function test_init_amp_blocks_completes_and_ships_loadable_classes() {
+		( new Registration() )->init_amp_blocks();
+
+		foreach ( array( 'Circle_Counter_Block', 'Lottie_Block', 'Slider_Block' ) as $short ) {
+			$classname = '\\ThemeIsle\\GutenbergBlocks\\Render\\AMP\\' . $short;
+
+			$this->assertTrue( class_exists( $classname ), $classname . ' is registered as an AMP block but cannot be loaded.' );
+		}
+	}
 }

From 0cdc9d5087779461c0be40d00df28b414a54893e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 15:01:57 +0300
Subject: [PATCH 17/25] build(deps): bump codeinwp/themeisle-sdk in
 /plugins/blocks-css (#3016)

Bumps [codeinwp/themeisle-sdk](https://github.com/Codeinwp/themeisle-sdk) from 3.3.58 to 3.3.61.
- [Release notes](https://github.com/Codeinwp/themeisle-sdk/releases)
- [Changelog](https://github.com/Codeinwp/themeisle-sdk/blob/v3.3.61/CHANGELOG.md)
- [Commits](https://github.com/Codeinwp/themeisle-sdk/compare/v3.3.58...v3.3.61)

---
updated-dependencies:
- dependency-name: codeinwp/themeisle-sdk
  dependency-version: 3.3.61
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 plugins/blocks-css/composer.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/plugins/blocks-css/composer.lock b/plugins/blocks-css/composer.lock
index c2a3c2df6..e61f91b1d 100644
--- a/plugins/blocks-css/composer.lock
+++ b/plugins/blocks-css/composer.lock
@@ -8,16 +8,16 @@
     "packages": [
         {
             "name": "codeinwp/themeisle-sdk",
-            "version": "3.3.58",
+            "version": "3.3.61",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Codeinwp/themeisle-sdk.git",
-                "reference": "d6807c0b7308e323bd77cced667dee3f2d5e6a82"
+                "reference": "9fe698b52dec768a0dd8b500fb51efe40962ee99"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/d6807c0b7308e323bd77cced667dee3f2d5e6a82",
-                "reference": "d6807c0b7308e323bd77cced667dee3f2d5e6a82",
+                "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/9fe698b52dec768a0dd8b500fb51efe40962ee99",
+                "reference": "9fe698b52dec768a0dd8b500fb51efe40962ee99",
                 "shasum": ""
             },
             "require-dev": {
@@ -43,9 +43,9 @@
             ],
             "support": {
                 "issues": "https://github.com/Codeinwp/themeisle-sdk/issues",
-                "source": "https://github.com/Codeinwp/themeisle-sdk/tree/v3.3.58"
+                "source": "https://github.com/Codeinwp/themeisle-sdk/tree/v3.3.61"
             },
-            "time": "2026-07-29T08:38:52+00:00"
+            "time": "2026-08-24T15:59:27+00:00"
         }
     ],
     "packages-dev": [],

From 2b57a464249426e638baecc20086efad792a4f1c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 15:02:01 +0300
Subject: [PATCH 18/25] build(deps): bump codeinwp/themeisle-sdk in
 /plugins/blocks-animation (#3015)

Bumps [codeinwp/themeisle-sdk](https://github.com/Codeinwp/themeisle-sdk) from 3.3.58 to 3.3.61.
- [Release notes](https://github.com/Codeinwp/themeisle-sdk/releases)
- [Changelog](https://github.com/Codeinwp/themeisle-sdk/blob/v3.3.61/CHANGELOG.md)
- [Commits](https://github.com/Codeinwp/themeisle-sdk/compare/v3.3.58...v3.3.61)

---
updated-dependencies:
- dependency-name: codeinwp/themeisle-sdk
  dependency-version: 3.3.61
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 plugins/blocks-animation/composer.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/plugins/blocks-animation/composer.lock b/plugins/blocks-animation/composer.lock
index d03d95990..e4c2804b4 100644
--- a/plugins/blocks-animation/composer.lock
+++ b/plugins/blocks-animation/composer.lock
@@ -8,16 +8,16 @@
     "packages": [
         {
             "name": "codeinwp/themeisle-sdk",
-            "version": "3.3.58",
+            "version": "3.3.61",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Codeinwp/themeisle-sdk.git",
-                "reference": "d6807c0b7308e323bd77cced667dee3f2d5e6a82"
+                "reference": "9fe698b52dec768a0dd8b500fb51efe40962ee99"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/d6807c0b7308e323bd77cced667dee3f2d5e6a82",
-                "reference": "d6807c0b7308e323bd77cced667dee3f2d5e6a82",
+                "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/9fe698b52dec768a0dd8b500fb51efe40962ee99",
+                "reference": "9fe698b52dec768a0dd8b500fb51efe40962ee99",
                 "shasum": ""
             },
             "require-dev": {
@@ -43,9 +43,9 @@
             ],
             "support": {
                 "issues": "https://github.com/Codeinwp/themeisle-sdk/issues",
-                "source": "https://github.com/Codeinwp/themeisle-sdk/tree/v3.3.58"
+                "source": "https://github.com/Codeinwp/themeisle-sdk/tree/v3.3.61"
             },
-            "time": "2026-07-29T08:38:52+00:00"
+            "time": "2026-08-24T15:59:27+00:00"
         }
     ],
     "packages-dev": [],

From 8163e0763e090df75feb60853972459444ce39eb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 15:02:05 +0300
Subject: [PATCH 19/25] build(deps): bump codeinwp/themeisle-sdk from 3.3.58 to
 3.3.61 (#3012)

Bumps [codeinwp/themeisle-sdk](https://github.com/Codeinwp/themeisle-sdk) from 3.3.58 to 3.3.61.
- [Release notes](https://github.com/Codeinwp/themeisle-sdk/releases)
- [Changelog](https://github.com/Codeinwp/themeisle-sdk/blob/v3.3.61/CHANGELOG.md)
- [Commits](https://github.com/Codeinwp/themeisle-sdk/compare/v3.3.58...v3.3.61)

---
updated-dependencies:
- dependency-name: codeinwp/themeisle-sdk
  dependency-version: 3.3.61
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 composer.lock | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/composer.lock b/composer.lock
index 6c06a3400..42da7db0e 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,20 +4,20 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "556f279ce85f25f708f60329f1f7067c",
+    "content-hash": "9b63bd5e193bb738744572f6e4e7ab1d",
     "packages": [
         {
             "name": "codeinwp/themeisle-sdk",
-            "version": "3.3.58",
+            "version": "3.3.61",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Codeinwp/themeisle-sdk.git",
-                "reference": "d6807c0b7308e323bd77cced667dee3f2d5e6a82"
+                "reference": "9fe698b52dec768a0dd8b500fb51efe40962ee99"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/d6807c0b7308e323bd77cced667dee3f2d5e6a82",
-                "reference": "d6807c0b7308e323bd77cced667dee3f2d5e6a82",
+                "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/9fe698b52dec768a0dd8b500fb51efe40962ee99",
+                "reference": "9fe698b52dec768a0dd8b500fb51efe40962ee99",
                 "shasum": ""
             },
             "require-dev": {
@@ -43,9 +43,9 @@
             ],
             "support": {
                 "issues": "https://github.com/Codeinwp/themeisle-sdk/issues",
-                "source": "https://github.com/Codeinwp/themeisle-sdk/tree/v3.3.58"
+                "source": "https://github.com/Codeinwp/themeisle-sdk/tree/v3.3.61"
             },
-            "time": "2026-07-29T08:38:52+00:00"
+            "time": "2026-08-24T15:59:27+00:00"
         },
         {
             "name": "enshrined/svg-sanitize",

From ee3148b42339505e32cec34901f275b9ae2c69f1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 21:01:02 +0300
Subject: [PATCH 20/25] build(deps-dev): bump php-stubs/woocommerce-stubs from
 10.9.4 to 11.0.0 (#3009)

Bumps [php-stubs/woocommerce-stubs](https://github.com/php-stubs/woocommerce-stubs) from 10.9.4 to 11.0.0.
- [Commits](https://github.com/php-stubs/woocommerce-stubs/compare/v10.9.4...v11.0.0)

---
updated-dependencies:
- dependency-name: php-stubs/woocommerce-stubs
  dependency-version: 11.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 composer.json |  2 +-
 composer.lock | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/composer.json b/composer.json
index 6e11b3148..e1e5fb532 100644
--- a/composer.json
+++ b/composer.json
@@ -20,7 +20,7 @@
 		"phpunit/phpunit": "9.6.5",
 		"yoast/phpunit-polyfills": "^4.0",
 		"phpstan/phpstan": "^2.1",
-		"php-stubs/woocommerce-stubs": "^10.8",
+		"php-stubs/woocommerce-stubs": "^11.0",
 		"php-stubs/acf-pro-stubs": "^6.8",
 		"wpackagist-plugin/woocommerce": "*",
 		"automattic/vipwpcs": "^3.0",
diff --git a/composer.lock b/composer.lock
index 42da7db0e..439b236c2 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "9b63bd5e193bb738744572f6e4e7ab1d",
+    "content-hash": "5a247aa373965f7dae85a8a3c4b3cb01",
     "packages": [
         {
             "name": "codeinwp/themeisle-sdk",
@@ -1044,16 +1044,16 @@
         },
         {
             "name": "php-stubs/woocommerce-stubs",
-            "version": "v10.9.4",
+            "version": "v11.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/php-stubs/woocommerce-stubs.git",
-                "reference": "a569e43283b86178628beb7aa22cc34b4076b435"
+                "reference": "923dd29055713886efd7f85ea2510b9c6955a714"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/php-stubs/woocommerce-stubs/zipball/a569e43283b86178628beb7aa22cc34b4076b435",
-                "reference": "a569e43283b86178628beb7aa22cc34b4076b435",
+                "url": "https://api.github.com/repos/php-stubs/woocommerce-stubs/zipball/923dd29055713886efd7f85ea2510b9c6955a714",
+                "reference": "923dd29055713886efd7f85ea2510b9c6955a714",
                 "shasum": ""
             },
             "require": {
@@ -1082,9 +1082,9 @@
             ],
             "support": {
                 "issues": "https://github.com/php-stubs/woocommerce-stubs/issues",
-                "source": "https://github.com/php-stubs/woocommerce-stubs/tree/v10.9.4"
+                "source": "https://github.com/php-stubs/woocommerce-stubs/tree/v11.0.0"
             },
-            "time": "2026-07-16T18:17:41+00:00"
+            "time": "2026-08-04T19:31:58+00:00"
         },
         {
             "name": "php-stubs/wordpress-stubs",

From 191d52403f8a22a7a82639d21b633da75b8a804c Mon Sep 17 00:00:00 2001
From: Girish Panchal <79647963+girishpanchal30@users.noreply.github.com>
Date: Tue, 1 Sep 2026 18:31:20 +0530
Subject: [PATCH 21/25] fix: class name handling for blocks to support array
 inputs (#3002)

---
 inc/class-base-css.php                        |   8 +-
 inc/class-registration.php                    |  36 +++-
 inc/css/blocks/class-posts-css.php            |   4 +-
 inc/render/class-posts-grid-block.php         |   6 +-
 .../inc/render/class-modal-block.php          |   7 +-
 tests/php/foreign-sabberworm-sandbox.php      |   2 +
 tests/test-block-class-name.php               | 156 ++++++++++++++++++
 7 files changed, 207 insertions(+), 12 deletions(-)
 create mode 100644 tests/test-block-class-name.php

diff --git a/inc/class-base-css.php b/inc/class-base-css.php
index 0739628ba..aa16c163e 100644
--- a/inc/class-base-css.php
+++ b/inc/class-base-css.php
@@ -683,10 +683,10 @@ public function get_animation_classes( $blocks ) {
 		);
 
 		foreach ( $blocks as $block ) {
-			if ( isset( $block['attrs']['className'] ) && ! empty( $block['attrs']['className'] ) ) {
-				if ( preg_match( '/\banimated\b/', $block['attrs']['className'] ) ) {
-					$classes = array_merge( $classes, explode( ' ', trim( $block['attrs']['className'] ) ) );
-				}
+			$block_classes = Registration::get_class_name( isset( $block['attrs'] ) ? $block['attrs'] : array() );
+
+			if ( ! empty( $block_classes ) && preg_match( '/\banimated\b/', $block_classes ) ) {
+				$classes = array_merge( $classes, explode( ' ', trim( $block_classes ) ) );
 			}
 
 			if ( isset( $block['innerBlocks'] ) && ! empty( $block['innerBlocks'] ) && is_array( $block['innerBlocks'] ) ) {
diff --git a/inc/class-registration.php b/inc/class-registration.php
index b7acfd6e9..81761e891 100644
--- a/inc/class-registration.php
+++ b/inc/class-registration.php
@@ -97,6 +97,38 @@ public static function get_editor_global_defaults() {
 		return is_object( $defaults ) ? $defaults : new \stdClass();
 	}
 
+	/**
+	 * Get the `className` attribute of a block as a string.
+	 *
+	 * @param mixed $attributes Block attributes.
+	 * @return string
+	 */
+	public static function get_class_name( $attributes ) {
+		if ( ! is_array( $attributes ) || ! isset( $attributes['className'] ) ) {
+			return '';
+		}
+
+		$class_name = $attributes['className'];
+
+		if ( is_array( $class_name ) ) {
+			// Flatten nested arrays and drop anything that is not printable.
+			$flat = array();
+
+			array_walk_recursive(
+				$class_name,
+				function ( $value ) use ( &$flat ) {
+					if ( is_scalar( $value ) ) {
+						$flat[] = (string) $value;
+					}
+				}
+			);
+
+			return implode( ' ', $flat );
+		}
+
+		return is_scalar( $class_name ) ? (string) $class_name : '';
+	}
+
 	/**
 	 * Initialize the class
 	 */
@@ -1130,7 +1162,7 @@ public function subscribe_fa( $block_content, $block ) {
 		$has_navigation_block = \WP_Block_Type_Registry::get_instance()->is_registered( 'core/navigation' );
 
 		if ( $has_navigation_block && ( 'core/navigation-link' === $block['blockName'] || 'core/navigation-submenu' === $block['blockName'] ) ) {
-			if ( isset( $block['attrs']['className'] ) && strpos( $block['attrs']['className'], 'fa-' ) !== false ) {
+			if ( strpos( self::get_class_name( isset( $block['attrs'] ) ? $block['attrs'] : array() ), 'fa-' ) !== false ) {
 				self::$is_fa_loaded = true;
 
 				// See the src/blocks/plugins/menu-icons/inline.css file for where this comes from.
@@ -1172,7 +1204,7 @@ public function load_sticky( $block_content, $block ) {
 			return $block_content;
 		}
 
-		if ( isset( $block['attrs']['className'] ) && false !== strpos( $block['attrs']['className'], 'o-sticky' ) ) {
+		if ( false !== strpos( self::get_class_name( isset( $block['attrs'] ) ? $block['attrs'] : array() ), 'o-sticky' ) ) {
 			$asset_file = include OTTER_BLOCKS_PATH . '/build/blocks/sticky.asset.php';
 			wp_enqueue_script(
 				'otter-sticky',
diff --git a/inc/css/blocks/class-posts-css.php b/inc/css/blocks/class-posts-css.php
index 19da67532..5e09dab5c 100644
--- a/inc/css/blocks/class-posts-css.php
+++ b/inc/css/blocks/class-posts-css.php
@@ -8,6 +8,7 @@
 namespace ThemeIsle\GutenbergBlocks\CSS\Blocks;
 
 use ThemeIsle\GutenbergBlocks\Base_CSS;
+use ThemeIsle\GutenbergBlocks\Registration;
 
 use ThemeIsle\GutenbergBlocks\CSS\CSS_Utility;
 
@@ -429,8 +430,7 @@ function ( $position, $css_variable ) {
 							return $value[ $position ];
 						},
 						'condition' => function ( $attrs ) {
-							// @phpstan-ignore-next-line
-							return isset( $attrs['className'] ) && strpos( $attrs['className'], 'is-style-tiled' ) !== false;
+							return strpos( Registration::get_class_name( $attrs ), 'is-style-tiled' ) !== false;
 						},
 					);
 				},
diff --git a/inc/render/class-posts-grid-block.php b/inc/render/class-posts-grid-block.php
index da6b61d48..4e1afe4f1 100644
--- a/inc/render/class-posts-grid-block.php
+++ b/inc/render/class-posts-grid-block.php
@@ -7,6 +7,8 @@
 
 namespace ThemeIsle\GutenbergBlocks\Render;
 
+use ThemeIsle\GutenbergBlocks\Registration;
+
 /**
  * Class Posts_Grid_Block
  */
@@ -26,7 +28,7 @@ public function render( $attributes ) {
 		add_filter( 'wp_img_tag_add_auto_sizes', '__return_false' );
 		$has_pagination = isset( $attributes['hasPagination'] ) && $attributes['hasPagination'];
 		$page_number    = 1;
-		$is_tiled       = isset( $attributes['className'] ) && false !== strpos( $attributes['className'], 'is-style-tiled' );
+		$is_tiled       = false !== strpos( Registration::get_class_name( $attributes ), 'is-style-tiled' );
 
 		if ( $has_pagination ) {
 			if ( ! empty( get_query_var( 'page' ) ) || ! empty( get_query_var( 'paged' ) ) ) {
@@ -301,7 +303,7 @@ protected function render_featured_post( $post, $attributes ) {
 		$image_alt = get_post_meta( $thumb_id, '_wp_attachment_image_alt', true );
 		$style     = '';
 		$image_url = wp_get_attachment_image_src( $thumb_id, $size );
-		$is_tiled  = isset( $attributes['className'] ) && false !== strpos( $attributes['className'], 'is-style-tiled' );
+		$is_tiled  = false !== strpos( Registration::get_class_name( $attributes ), 'is-style-tiled' );
 
 		if ( ! $image_alt ) {
 			$image_alt = get_the_title( $id );
diff --git a/plugins/otter-pro/inc/render/class-modal-block.php b/plugins/otter-pro/inc/render/class-modal-block.php
index 609337978..5fac80cf8 100644
--- a/plugins/otter-pro/inc/render/class-modal-block.php
+++ b/plugins/otter-pro/inc/render/class-modal-block.php
@@ -8,6 +8,7 @@
 namespace ThemeIsle\OtterPro\Render;
 
 use ThemeIsle\OtterPro\Plugins\License;
+use ThemeIsle\GutenbergBlocks\Registration;
 
 /**
  * Class Modal_CSS.
@@ -45,8 +46,10 @@ public function render( $attributes, $content, $block ) {
 
 		$classes = array( 'wp-block-themeisle-blocks-modal', 'is-active', 'is-front' );
 
-		if ( ! empty( $attributes['className'] ) ) {
-			$classes[] = esc_attr( $attributes['className'] );
+		$class_name = Registration::get_class_name( $attributes );
+
+		if ( ! empty( $class_name ) ) {
+			$classes[] = esc_attr( $class_name );
 		}
 
 		if ( ! empty( $attributes['closeButtonType'] ) && 'outside' === $attributes['closeButtonType'] ) {
diff --git a/tests/php/foreign-sabberworm-sandbox.php b/tests/php/foreign-sabberworm-sandbox.php
index 21c32becd..a3c0dde6e 100644
--- a/tests/php/foreign-sabberworm-sandbox.php
+++ b/tests/php/foreign-sabberworm-sandbox.php
@@ -75,6 +75,8 @@ function ( $class ) {
 		}
 	);
 
+	// Base_CSS reads block class names through Registration::get_class_name().
+	require OTTER_BLOCKS_PATH . '/inc/class-registration.php';
 	require OTTER_BLOCKS_PATH . '/inc/class-base-css.php';
 
 	$base   = new \ThemeIsle\GutenbergBlocks\Base_CSS();
diff --git a/tests/test-block-class-name.php b/tests/test-block-class-name.php
new file mode 100644
index 000000000..0e4333f4c
--- /dev/null
+++ b/tests/test-block-class-name.php
@@ -0,0 +1,156 @@
+<?php
+/**
+ * Class Test_Block_Class_Name
+ *
+ * @package gutenberg-blocks
+ */
+
+use ThemeIsle\GutenbergBlocks\Base_CSS;
+use ThemeIsle\GutenbergBlocks\Registration;
+use ThemeIsle\GutenbergBlocks\Render\Posts_Grid_Block;
+
+/**
+ * An array `className` attribute must not fatal the render/asset paths that
+ * search it with string functions.
+ */
+class Test_Block_Class_Name extends WP_UnitTestCase {
+
+	/**
+	 * Static asset flags mutated by the paths under test, restored in teardown.
+	 *
+	 * @var array<string, bool>
+	 */
+	private $saved_flags = array();
+
+	/**
+	 * Set up test environment.
+	 */
+	public function set_up() {
+		parent::set_up();
+
+		$this->saved_flags = array(
+			'is_fa_loaded' => Registration::$is_fa_loaded,
+			'sticky'       => Registration::$scripts_loaded['sticky'],
+		);
+	}
+
+	/**
+	 * Tear down test environment.
+	 */
+	public function tear_down() {
+		Registration::$is_fa_loaded                = $this->saved_flags['is_fa_loaded'];
+		Registration::$scripts_loaded['sticky']    = $this->saved_flags['sticky'];
+
+		wp_dequeue_script( 'otter-sticky' );
+		wp_deregister_script( 'otter-sticky' );
+
+		parent::tear_down();
+	}
+
+	/**
+	 * A string `className` is returned untouched.
+	 */
+	public function test_get_class_name_returns_string_attribute() {
+		$this->assertSame( 'is-style-tiled o-sticky', Registration::get_class_name( array( 'className' => 'is-style-tiled o-sticky' ) ) );
+	}
+
+	/**
+	 * An array `className` is flattened to a space separated list.
+	 */
+	public function test_get_class_name_flattens_array_attribute() {
+		$this->assertSame(
+			'fa-solid fa-star extra',
+			Registration::get_class_name( array( 'className' => array( 'fa-solid', array( 'fa-star' ), 'extra' ) ) )
+		);
+	}
+
+	/**
+	 * Missing, empty and non-printable values fall back to an empty string.
+	 */
+	public function test_get_class_name_returns_empty_string_for_unusable_values() {
+		$this->assertSame( '', Registration::get_class_name( array() ) );
+		$this->assertSame( '', Registration::get_class_name( 'not-an-array' ) );
+		$this->assertSame( '', Registration::get_class_name( array( 'className' => array() ) ) );
+		$this->assertSame( '', Registration::get_class_name( array( 'className' => new stdClass() ) ) );
+		$this->assertSame( '', Registration::get_class_name( array( 'className' => array( new stdClass() ) ) ) );
+	}
+
+	/**
+	 * The Font Awesome subscriber must read an array `className` without fataling.
+	 */
+	public function test_subscribe_fa_handles_array_class_name() {
+		Registration::$is_fa_loaded = false;
+
+		$block = array(
+			'blockName' => 'core/navigation-link',
+			'attrs'     => array( 'className' => array( 'fa-solid', 'fa-star' ) ),
+		);
+
+		$this->assertSame( 'content', Registration::instance()->subscribe_fa( 'content', $block ) );
+
+		if ( \WP_Block_Type_Registry::get_instance()->is_registered( 'core/navigation' ) ) {
+			$this->assertTrue( Registration::$is_fa_loaded, 'The array class list contains fa-, so FA must be flagged as needed.' );
+		}
+	}
+
+	/**
+	 * The sticky subscriber must read an array `className` without fataling.
+	 */
+	public function test_load_sticky_handles_array_class_name() {
+		Registration::$scripts_loaded['sticky'] = false;
+
+		$block = array(
+			'blockName' => 'core/group',
+			'attrs'     => array( 'className' => array( 'o-sticky', 'o-sticky-pos-top' ) ),
+		);
+
+		$this->assertSame( 'content', Registration::instance()->load_sticky( 'content', $block ) );
+		$this->assertTrue( wp_script_is( 'otter-sticky', 'enqueued' ) );
+	}
+
+	/**
+	 * Animation class collection must read an array `className` without fataling.
+	 */
+	public function test_get_animation_classes_handles_array_class_name() {
+		$base_css = new Base_CSS();
+
+		$blocks = array(
+			array(
+				'blockName' => 'core/paragraph',
+				'attrs'     => array( 'className' => array( 'animated', 'fadeIn' ) ),
+			),
+		);
+
+		$this->assertSame( array( 'animated', 'fadeIn' ), array_values( $base_css->get_animation_classes( $blocks ) ) );
+	}
+
+	/**
+	 * The posts block must render with an array `className` instead of fataling.
+	 */
+	public function test_posts_grid_block_renders_with_array_class_name() {
+		$this->factory()->post->create( array( 'post_title' => 'Otter array className' ) );
+
+		WP_Block_Supports::init();
+		WP_Block_Supports::$block_to_render = array( 'blockName' => 'themeisle-blocks/posts-grid' );
+
+		$render = new Posts_Grid_Block();
+		$output = $render->render(
+			array(
+				'id'           => 'wp-block-themeisle-blocks-posts-grid-a94bab18',
+				'className'    => array( 'is-style-tiled', 'custom' ),
+				'columns'      => 2,
+				'style'        => 'grid',
+				'postTypes'    => array(),
+				'template'     => array( 'title' ),
+				'postsToShow'  => 1,
+				'order'        => 'desc',
+				'orderBy'      => 'date',
+				'offset'       => 0,
+				'displayTitle' => true,
+				'titleTag'     => 'h5',
+			)
+		);
+
+		$this->assertStringContainsString( 'Otter array className', $output );
+	}
+}

From 5ccc4d2cbea4fdfd4abb328c5a07d0205df41062 Mon Sep 17 00:00:00 2001
From: Girish Panchal <79647963+girishpanchal30@users.noreply.github.com>
Date: Tue, 1 Sep 2026 20:31:58 +0530
Subject: [PATCH 22/25] Updated styles for responsive visibility (#3024)

* fix: update styles for responsive visibility

* fix: improve responsive visibility handling
---
 inc/class-registration.php                    |  2 +-
 .../atomic-wind-hide-conditions.spec.js       | 90 +++++++++++++++++++
 src/blocks/test/e2e/playwright.config.js      |  1 +
 3 files changed, 92 insertions(+), 1 deletion(-)
 create mode 100644 src/blocks/test/e2e/blocks/atomic-wind-hide-conditions.spec.js

diff --git a/inc/class-registration.php b/inc/class-registration.php
index 81761e891..5ae5a2b0d 100644
--- a/inc/class-registration.php
+++ b/inc/class-registration.php
@@ -1283,7 +1283,7 @@ public function load_condition_hide_on_styles( $block_content, $block ) {
 	 * @access public
 	 */
 	public static function condition_hide_on_style() {
-		echo '<style id="o-condition-hide-inline-css">@media (max-width:768px){.o-hide-on-mobile{display:none!important}}@media (min-width:769px) and (max-width:1024px){.o-hide-on-tablet{display:none!important}}@media (min-width:1025px){.o-hide-on-desktop{display:none!important}}</style>';
+		echo '<style id="o-condition-hide-inline-css">@layer theme, base, components, utilities;@media (max-width:768px){@layer utilities{.o-hide-on-mobile:is(.o-hide-on-mobile,#_){display:none!important}}}@media (min-width:769px) and (max-width:1024px){@layer utilities{.o-hide-on-tablet:is(.o-hide-on-tablet,#_){display:none!important}}}@media (min-width:1025px){@layer utilities{.o-hide-on-desktop:is(.o-hide-on-desktop,#_){display:none!important}}}</style>';
 	}
 
 	/**
diff --git a/src/blocks/test/e2e/blocks/atomic-wind-hide-conditions.spec.js b/src/blocks/test/e2e/blocks/atomic-wind-hide-conditions.spec.js
new file mode 100644
index 000000000..d28873609
--- /dev/null
+++ b/src/blocks/test/e2e/blocks/atomic-wind-hide-conditions.spec.js
@@ -0,0 +1,90 @@
+/**
+ * Internal dependencies
+ */
+import { test, expect } from '../fixtures';
+import { setAtomicWind } from '../helpers/design-library';
+import { publishAndViewPost } from '../helpers/editor';
+
+/**
+ * Atomic Wind compiles Tailwind in important mode, so a `flex` utility lands as
+ * `display:flex!important`. The "Hide on" screen-size condition is also
+ * `!important`, so unless its rules outrank the utilities the block stays
+ * visible on the device it was hidden for, depending on which stylesheet the
+ * page happened to print last.
+ */
+const MOBILE = { width: 375, height: 700 };
+const TABLET = { width: 900, height: 700 };
+const DESKTOP = { width: 1280, height: 700 };
+
+const insertHiddenBox = ( editor, screenSizes ) =>
+	editor.insertBlock({
+		name: 'atomic-wind/box',
+		attributes: {
+			className: 'flex gap-4 p-8',
+			otterConditions: [
+				[
+					{
+						type: 'screenSize',
+						screen_sizes: screenSizes
+					}
+				]
+			]
+		},
+		innerBlocks: [
+			{ name: 'core/paragraph', attributes: { content: 'Boxed content' }}
+		]
+	});
+
+test.describe( 'Atomic Wind hide on screen size', () => {
+	test.beforeEach( async({ otterUtils, admin }) => {
+		await setAtomicWind( otterUtils, true );
+		await admin.createNewPost();
+	});
+
+	test.afterAll( async({ otterUtils }) => {
+		await setAtomicWind( otterUtils, false );
+	});
+
+	test( 'hiding on mobile beats the flex utility', async({ editor, page }) => {
+		await insertHiddenBox( editor, [ 'mobile' ] );
+		await publishAndViewPost({ editor, page });
+
+		const box = page.locator( '.wp-block-atomic-wind-box' );
+
+		await expect( box ).toHaveClass( /o-hide-on-mobile/ );
+
+		// Outside the hidden range the utility must still apply, so a passing
+		// hidden assertion cannot come from a stylesheet that never loaded.
+		await page.setViewportSize( TABLET );
+		await expect( box ).toHaveCSS( 'display', 'flex' );
+
+		await page.setViewportSize( MOBILE );
+		await expect( box ).toHaveCSS( 'display', 'none' );
+	});
+
+	test( 'hiding on tablet beats the flex utility', async({ editor, page }) => {
+		await insertHiddenBox( editor, [ 'tablet' ] );
+		await publishAndViewPost({ editor, page });
+		const box = page.locator( '.wp-block-atomic-wind-box' );
+		await expect( box ).toHaveClass( /o-hide-on-tablet/ );
+		await page.setViewportSize( MOBILE );
+		await expect( box ).toHaveCSS( 'display', 'flex' );
+		await page.setViewportSize( TABLET );
+		await expect( box ).toHaveCSS( 'display', 'none' );
+	});
+
+	test( 'hiding on desktop beats the flex utility', async({ editor, page }) => {
+		await insertHiddenBox( editor, [ 'desktop' ] );
+		await publishAndViewPost({ editor, page });
+
+		const box = page.locator( '.wp-block-atomic-wind-box' );
+
+		await expect( box ).toHaveClass( /o-hide-on-desktop/ );
+
+		await page.setViewportSize( MOBILE );
+		await expect( box ).toHaveCSS( 'display', 'flex' );
+
+		await page.setViewportSize( DESKTOP );
+		await expect( box ).toHaveCSS( 'display', 'none' );
+	});
+});
diff --git a/src/blocks/test/e2e/playwright.config.js b/src/blocks/test/e2e/playwright.config.js
index e9458d047..1e8d3105b 100644
--- a/src/blocks/test/e2e/playwright.config.js
+++ b/src/blocks/test/e2e/playwright.config.js
@@ -59,6 +59,7 @@ const SERIAL_SPECS = [
 	// Flips the site-wide atomic-wind blocks option.
 	'**/blocks/atomic-wind-list-view.spec.js',
 	'**/blocks/atomic-wind-css-scope.spec.js',
+	'**/blocks/atomic-wind-hide-conditions.spec.js',
 
 	// Mutates the shared admin user's metabox order and editor preferences.
 	'**/blocks/woocommerce-builder.spec.js',

From 30fe4398a0f01b9139fa0bdee3e00e5e55b5bb23 Mon Sep 17 00:00:00 2001
From: Marius Cristea <marius.cristea@vertistudio.com>
Date: Wed, 2 Sep 2026 13:18:29 +0300
Subject: [PATCH 23/25] ci: skip PR-comment job on Dependabot PRs (no secrets,
 always fails)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/create-build-url.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/create-build-url.yml b/.github/workflows/create-build-url.yml
index 69ef9497f..52afbc225 100644
--- a/.github/workflows/create-build-url.yml
+++ b/.github/workflows/create-build-url.yml
@@ -55,7 +55,7 @@ jobs:
 
   comment-on-pr:
     name: Comment on PR with links to plugin ZIPs
-    if: ${{ github.head_ref && github.head_ref != null }}
+    if: ${{ github.head_ref && github.head_ref != null && github.actor != 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     needs: dev-zip
     env:

From 74da395509303820e872b3d1f6994feae253a539 Mon Sep 17 00:00:00 2001
From: Marius Cristea <marius.cristea@vertistudio.com>
Date: Wed, 2 Sep 2026 13:24:35 +0300
Subject: [PATCH 24/25] ci: revert Dependabot gate on PR-comment job (org
 Dependabot secret covers this repo) [skip ci]

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/create-build-url.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/create-build-url.yml b/.github/workflows/create-build-url.yml
index 52afbc225..69ef9497f 100644
--- a/.github/workflows/create-build-url.yml
+++ b/.github/workflows/create-build-url.yml
@@ -55,7 +55,7 @@ jobs:
 
   comment-on-pr:
     name: Comment on PR with links to plugin ZIPs
-    if: ${{ github.head_ref && github.head_ref != null && github.actor != 'dependabot[bot]' }}
+    if: ${{ github.head_ref && github.head_ref != null }}
     runs-on: ubuntu-latest
     needs: dev-zip
     env:

From 73b3c5a4447cdcea4e638e320d1864f933654c71 Mon Sep 17 00:00:00 2001
From: Girish Panchal <79647963+girishpanchal30@users.noreply.github.com>
Date: Thu, 3 Sep 2026 00:31:12 +0530
Subject: [PATCH 25/25] Improved SVG metadata generation (#3022)

* fix: improve SVG metadata generation

* fix: function documentation

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 inc/class-main.php        |  20 ++++++-
 tests/test-svg-upload.php | 116 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 135 insertions(+), 1 deletion(-)

diff --git a/inc/class-main.php b/inc/class-main.php
index 39d1aed7d..ca415d8a3 100644
--- a/inc/class-main.php
+++ b/inc/class-main.php
@@ -529,11 +529,29 @@ public function generate_svg_attachment_metadata( $metadata, $attachment_id ) {
 		}
 
 		$svg_path = get_attached_file( $attachment_id );
+
+		if ( empty( $svg_path ) || ! file_exists( $svg_path ) || ! is_readable( $svg_path ) ) {
+			return $metadata;
+		}
+
 		$filename = basename( $svg_path );
 
-		$svg        = simplexml_load_file( $svg_path );
+		// Keep malformed SVG errors internal instead of emitting PHP warnings.
+		$previous_state = libxml_use_internal_errors( true );
+		$svg            = simplexml_load_file( $svg_path );
+		libxml_clear_errors();
+		libxml_use_internal_errors( $previous_state );
+
+		if ( false === $svg ) {
+			return $metadata;
+		}
+
 		$attributes = $svg->attributes();
 
+		if ( ! isset( $attributes->width, $attributes->height ) ) {
+			return $metadata;
+		}
+
 		// Update metadata with SVG dimensions.
 		$metadata['width']  = intval( (string) $attributes->width );
 		$metadata['height'] = intval( (string) $attributes->height );
diff --git a/tests/test-svg-upload.php b/tests/test-svg-upload.php
index 4f176a747..314df2c92 100644
--- a/tests/test-svg-upload.php
+++ b/tests/test-svg-upload.php
@@ -209,4 +209,120 @@ public function test_used_css_properties_returns_default_when_input_is_not_array
 		$this->assertContains( 'border-radius', $result );
 		$this->assertContains( 'transform', $result );
 	}
+
+	/**
+	 * Create an SVG attachment post for the supplied file path.
+	 *
+	 * @param string $file Attached file path to store, may be empty.
+	 * @return int
+	 */
+	private function create_svg_attachment( $file ) {
+		$attachment_id = $this->factory()->attachment->create_object(
+			array(
+				'file'           => $file,
+				'post_mime_type' => 'image/svg+xml',
+			)
+		);
+
+		return $attachment_id;
+	}
+
+	/**
+	 * A missing SVG file must not fatal, and metadata is returned untouched.
+	 */
+	public function test_generate_svg_attachment_metadata_with_missing_file() {
+		$main          = new ThemeIsle\GutenbergBlocks\Main();
+		$attachment_id = $this->create_svg_attachment( '/does/not/exist/missing.svg' );
+		$metadata      = array( 'sizes' => array() );
+
+		$result = $main->generate_svg_attachment_metadata( $metadata, $attachment_id );
+
+		$this->assertSame( $metadata, $result );
+
+		wp_delete_attachment( $attachment_id, true );
+	}
+
+	/**
+	 * get_attached_file() returning false must not fatal.
+	 */
+	public function test_generate_svg_attachment_metadata_when_attached_file_is_false() {
+		$main          = new ThemeIsle\GutenbergBlocks\Main();
+		$attachment_id = $this->create_svg_attachment( '' );
+		$metadata      = array( 'sizes' => array() );
+
+		$force_false = '__return_false';
+		add_filter( 'get_attached_file', $force_false );
+
+		$result = $main->generate_svg_attachment_metadata( $metadata, $attachment_id );
+
+		remove_filter( 'get_attached_file', $force_false );
+
+		$this->assertSame( $metadata, $result );
+
+		wp_delete_attachment( $attachment_id, true );
+	}
+
+	/**
+	 * A file that is not valid XML must not fatal.
+	 */
+	public function test_generate_svg_attachment_metadata_with_malformed_svg() {
+		$main      = new ThemeIsle\GutenbergBlocks\Main();
+		$svg_path  = wp_tempnam( 'broken.svg' );
+		file_put_contents( $svg_path, '<svg width="10" height="10">' );
+
+		$attachment_id = $this->create_svg_attachment( $svg_path );
+		$metadata      = array( 'sizes' => array() );
+
+		$result = $main->generate_svg_attachment_metadata( $metadata, $attachment_id );
+
+		$this->assertSame( $metadata, $result );
+
+		wp_delete_attachment( $attachment_id, true );
+		if ( file_exists( $svg_path ) ) {
+			unlink( $svg_path );
+		}
+	}
+
+	/**
+	 * A valid SVG still gets its dimensions filled in.
+	 */
+	public function test_generate_svg_attachment_metadata_with_valid_svg() {
+		$main     = new ThemeIsle\GutenbergBlocks\Main();
+		$svg_path = wp_tempnam( 'valid.svg' );
+		file_put_contents( $svg_path, '<svg xmlns="http://www.w3.org/2000/svg" width="24" height="42"></svg>' );
+
+		$attachment_id = $this->create_svg_attachment( $svg_path );
+
+		$result = $main->generate_svg_attachment_metadata( array( 'sizes' => array() ), $attachment_id );
+
+		$this->assertSame( 24, $result['width'] );
+		$this->assertSame( 42, $result['height'] );
+		$this->assertSame( basename( $svg_path ), $result['file'] );
+
+		wp_delete_attachment( $attachment_id, true );
+		if ( file_exists( $svg_path ) ) {
+			unlink( $svg_path );
+		}
+	}
+
+	/**
+	 * An SVG without width/height attributes must not produce zeroed dimensions.
+	 */
+	public function test_generate_svg_attachment_metadata_without_dimension_attributes() {
+		$main     = new ThemeIsle\GutenbergBlocks\Main();
+		$svg_path = wp_tempnam( 'no-dimensions.svg' );
+		file_put_contents( $svg_path, '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 42"></svg>' );
+
+		$attachment_id = $this->create_svg_attachment( $svg_path );
+		$metadata      = array( 'sizes' => array() );
+
+		$result = $main->generate_svg_attachment_metadata( $metadata, $attachment_id );
+
+		$this->assertSame( $metadata, $result );
+
+		wp_delete_attachment( $attachment_id, true );
+		if ( file_exists( $svg_path ) ) {
+			unlink( $svg_path );
+		}
+	}
 }