Editor: Update packages for 6.1 Release Candidate 2.

Package updates for bug and regression fixes:
- `@wordpress/block-directory: 3.15.8`
- `@wordpress/block-editor: 10.0.7`
- `@wordpress/block-library: 7.14.8`
- `@wordpress/components: 21.0.6`
- `@wordpress/customize-widgets: 3.14.8`
- `@wordpress/edit-post: 6.14.8`
- `@wordpress/edit-site: 4.14.10`
- `@wordpress/edit-widgets: 4.14.8`
- `@wordpress/editor: 12.16.7`
- `@wordpress/format-library: 3.15.7`
- `@wordpress/interface: 4.16.6`
- `@wordpress/list-reusable-blocks: 3.15.6`
- `@wordpress/nux: 5.15.6`
- `@wordpress/preferences: 2.9.6`
- `@wordpress/reusable-blocks: 3.15.7`
- `@wordpress/server-side-render: 3.15.6`
- `@wordpress/widgets: 2.15.7`

Original PRs from Gutenberg repository:
- [WordPress/gutenberg#45041 #45041 Font Size Picker Hint: Fallback to font size `slug` if `name` is undefined]
- [WordPress/gutenberg#45045 #45045 Add: Missing output escaping on some blocks]
- [WordPress/gutenberg#44999 #44999 Escape comment author URL]
- [WordPress/gutenberg#44972 #44972 Navigator: restore focus only once per location]
- [WordPress/gutenberg#44858 #44858 Spacing Sizes Control: Try improving layout spacing]
- [WordPress/gutenberg#44878 #44878 Fix: Inspector is usable on the top level block even if it is content locked]
- [WordPress/gutenberg#44809 #44809 Fix list outdents on Enter in quote block]
- [WordPress/gutenberg#44864 #44864 List v2: fix selection when creating paragraph from empty list item]
- [WordPress/gutenberg#44853 #44853 Fix overflowing patterns]
- [WordPress/gutenberg#45050 #45050 Fix visibility of nested Group block appender]
- [WordPress/gutenberg#44887 #44887 wp-env: Use case insensitive regex when checking WP version string]

Follow-up to [54257], [54335], [54383], [54483], [54486], [54490].

Props bernhard-reiter, audrasjb.
See #56467.

git-svn-id: https://develop.svn.wordpress.org/trunk@54632 602fd350-edb4-49c9-b593-d223f7449a82

package.json

@@ -81,56 +81,56 @@
 		"@wordpress/api-fetch": "6.14.1",
 		"@wordpress/autop": "3.17.1",
 		"@wordpress/blob": "3.17.1",
-		"@wordpress/block-directory": "3.15.7",
-		"@wordpress/block-editor": "10.0.6",
-		"@wordpress/block-library": "7.14.7",
+		"@wordpress/block-directory": "3.15.8",
+		"@wordpress/block-editor": "10.0.7",
+		"@wordpress/block-library": "7.14.8",
 		"@wordpress/block-serialization-default-parser": "4.17.1",
 		"@wordpress/blocks": "11.16.4",
-		"@wordpress/components": "21.0.5",
+		"@wordpress/components": "21.0.6",
 		"@wordpress/compose": "5.15.2",
 		"@wordpress/core-data": "5.0.4",
-		"@wordpress/customize-widgets": "3.14.7",
+		"@wordpress/customize-widgets": "3.14.8",
 		"@wordpress/data": "7.1.3",
 		"@wordpress/data-controls": "2.17.3",
 		"@wordpress/date": "4.17.1",
 		"@wordpress/deprecated": "3.17.1",
 		"@wordpress/dom": "3.17.2",
 		"@wordpress/dom-ready": "3.17.1",
-		"@wordpress/edit-post": "6.14.7",
-		"@wordpress/edit-site": "4.14.9",
-		"@wordpress/edit-widgets": "4.14.7",
-		"@wordpress/editor": "12.16.6",
+		"@wordpress/edit-post": "6.14.8",
+		"@wordpress/edit-site": "4.14.10",
+		"@wordpress/edit-widgets": "4.14.8",
+		"@wordpress/editor": "12.16.7",
 		"@wordpress/element": "4.15.1",
 		"@wordpress/escape-html": "2.17.1",
-		"@wordpress/format-library": "3.15.6",
+		"@wordpress/format-library": "3.15.7",
 		"@wordpress/hooks": "3.17.1",
 		"@wordpress/html-entities": "3.17.1",
 		"@wordpress/i18n": "4.17.1",
 		"@wordpress/icons": "9.8.1",
-		"@wordpress/interface": "4.16.5",
+		"@wordpress/interface": "4.16.6",
 		"@wordpress/is-shallow-equal": "4.17.1",
 		"@wordpress/keyboard-shortcuts": "3.15.3",
 		"@wordpress/keycodes": "3.17.1",
-		"@wordpress/list-reusable-blocks": "3.15.5",
+		"@wordpress/list-reusable-blocks": "3.15.6",
 		"@wordpress/media-utils": "4.8.1",
 		"@wordpress/notices": "3.17.3",
-		"@wordpress/nux": "5.15.5",
+		"@wordpress/nux": "5.15.6",
 		"@wordpress/plugins": "4.15.2",
-		"@wordpress/preferences": "2.9.5",
+		"@wordpress/preferences": "2.9.6",
 		"@wordpress/preferences-persistence": "1.9.1",
 		"@wordpress/primitives": "3.15.1",
 		"@wordpress/priority-queue": "2.17.2",
 		"@wordpress/redux-routine": "4.17.1",
-		"@wordpress/reusable-blocks": "3.15.6",
+		"@wordpress/reusable-blocks": "3.15.7",
 		"@wordpress/rich-text": "5.15.3",
-		"@wordpress/server-side-render": "3.15.5",
+		"@wordpress/server-side-render": "3.15.6",
 		"@wordpress/shortcode": "3.17.1",
 		"@wordpress/style-engine": "1.0.3",
 		"@wordpress/token-list": "2.17.1",
 		"@wordpress/url": "3.18.1",
 		"@wordpress/viewport": "4.15.3",
 		"@wordpress/warning": "2.17.1",
-		"@wordpress/widgets": "2.15.6",
+		"@wordpress/widgets": "2.15.7",
 		"@wordpress/wordcount": "3.17.1",
 		"backbone": "1.4.1",
 		"clipboard": "2.0.11",

src/wp-includes/blocks/avatar.php

@@ -127,7 +127,7 @@ function render_block_core_avatar( $attributes, $content, $block ) {
 			$label = 'aria-label="' . sprintf( esc_attr__( '(%s website link, opens in a new tab)' ), $comment->comment_author ) . '"';
 		}
 		// translators: %1$s: Comment Author website link. %2$s: Link target. %3$s Aria label. %4$s Avatar image.
-		$avatar_block = sprintf( '<a href="%1$s" target="%2$s" %3$s class="wp-block-avatar__link">%4$s</a>', $comment->comment_author_url, esc_attr( $attributes['linkTarget'] ), $label, $avatar_block );
+		$avatar_block = sprintf( '<a href="%1$s" target="%2$s" %3$s class="wp-block-avatar__link">%4$s</a>', esc_url( $comment->comment_author_url ), esc_attr( $attributes['linkTarget'] ), $label, $avatar_block );
 	}
 	return sprintf( '<div %1s>%2s</div>', $wrapper_attributes, $avatar_block );
 }

src/wp-includes/blocks/legacy-widget.php

@@ -34,7 +34,7 @@ function render_block_core_legacy_widget( $attributes ) {
 
 	if ( isset( $attributes['instance']['encoded'], $attributes['instance']['hash'] ) ) {
 		$serialized_instance = base64_decode( $attributes['instance']['encoded'] );
-		if ( wp_hash( $serialized_instance ) !== $attributes['instance']['hash'] ) {
+		if ( ! hash_equals( wp_hash( $serialized_instance ), (string) $attributes['instance']['hash'] ) ) {
 			return '';
 		}
 		$instance = unserialize( $serialized_instance );

src/wp-includes/blocks/navigation.php

@@ -646,7 +646,7 @@ function render_block_core_navigation( $attributes, $content, $block ) {
 		$toggle_aria_label_close,
 		esc_attr( implode( ' ', $responsive_container_classes ) ),
 		esc_attr( implode( ' ', $open_button_classes ) ),
-		safecss_filter_attr( $colors['overlay_inline_styles'] ),
+		esc_attr( safecss_filter_attr( $colors['overlay_inline_styles'] ) ),
 		__( 'Menu' ),
 		$toggle_button_content,
 		$toggle_close_button_content

src/wp-includes/blocks/rss.php

@@ -20,7 +20,7 @@ function render_block_core_rss( $attributes ) {
 	$rss = fetch_feed( $attributes['feedURL'] );
 
 	if ( is_wp_error( $rss ) ) {
-		return '<div class="components-placeholder"><div class="notice notice-error"><strong>' . __( 'RSS Error:' ) . '</strong> ' . $rss->get_error_message() . '</div></div>';
+		return '<div class="components-placeholder"><div class="notice notice-error"><strong>' . __( 'RSS Error:' ) . '</strong> ' . esc_html( $rss->get_error_message() ) . '</div></div>';
 	}
 
 	if ( ! $rss->get_item_quantity() ) {
@@ -48,8 +48,8 @@ function render_block_core_rss( $attributes ) {
 			if ( $date ) {
 				$date = sprintf(
 					'<time datetime="%1$s" class="wp-block-rss__item-publish-date">%2$s</time> ',
-					date_i18n( get_option( 'c' ), $date ),
-					date_i18n( get_option( 'date_format' ), $date )
+					esc_attr( date_i18n( get_option( 'c' ), $date ) ),
+					esc_attr( date_i18n( get_option( 'date_format' ), $date ) )
 				);
 			}
 		}

src/wp-includes/blocks/search.php

@@ -367,12 +367,12 @@ function styles_for_block_core_search( $attributes ) {
 	// Add color styles.
 	$has_text_color = ! empty( $attributes['style']['color']['text'] );
 	if ( $has_text_color ) {
-		$button_styles[] = sprintf( 'color: %s;', esc_attr( $attributes['style']['color']['text'] ) );
+		$button_styles[] = sprintf( 'color: %s;', $attributes['style']['color']['text'] );
 	}
 
 	$has_background_color = ! empty( $attributes['style']['color']['background'] );
 	if ( $has_background_color ) {
-		$button_styles[] = sprintf( 'background-color: %s;', esc_attr( $attributes['style']['color']['background'] ) );
+		$button_styles[] = sprintf( 'background-color: %s;', $attributes['style']['color']['background'] );
 	}
 
 	$has_custom_gradient = ! empty( $attributes['style']['color']['gradient'] );
@@ -399,9 +399,9 @@ function styles_for_block_core_search( $attributes ) {
 	}
 
 	return array(
-		'input'   => ! empty( $input_styles ) ? sprintf( ' style="%s"', safecss_filter_attr( implode( ' ', $input_styles ) ) ) : '',
-		'button'  => ! empty( $button_styles ) ? sprintf( ' style="%s"', safecss_filter_attr( implode( ' ', $button_styles ) ) ) : '',
-		'wrapper' => ! empty( $wrapper_styles ) ? sprintf( ' style="%s"', safecss_filter_attr( implode( ' ', $wrapper_styles ) ) ) : '',
+		'input'   => ! empty( $input_styles ) ? sprintf( ' style="%s"', esc_attr( safecss_filter_attr( implode( ' ', $input_styles ) ) ) ) : '',
+		'button'  => ! empty( $button_styles ) ? sprintf( ' style="%s"', esc_attr( safecss_filter_attr( implode( ' ', $button_styles ) ) ) ) : '',
+		'wrapper' => ! empty( $wrapper_styles ) ? sprintf( ' style="%s"', esc_attr( safecss_filter_attr( implode( ' ', $wrapper_styles ) ) ) ) : '',
 		'label'   => ! empty( $label_styles ) ? sprintf( ' style="%s"', esc_attr( safecss_filter_attr( implode( ' ', $label_styles ) ) ) ) : '',
 	);
 }

src/wp-includes/blocks/widget-group.php

@@ -28,7 +28,7 @@ function render_block_core_widget_group( $attributes, $content, $block ) {
 	$html = '';
 
 	if ( ! empty( $attributes['title'] ) ) {
-		$html .= $before_title . $attributes['title'] . $after_title;
+		$html .= $before_title . esc_html( $attributes['title'] ) . $after_title;
 	}
 
 	$html .= '<div class="wp-widget-group__inner-blocks">';