Commit b98b3d5f94 for wordpress.org

commit b98b3d5f943fbf6bde6c2d52d4e7be6a802e9979
Author: lancewillett <lancewillett@git.wordpress.org>
Date:   Wed Nov 4 21:37:58 2026 +0000

    KSES: Clarify that `valid_unicode()` checks XML Char ranges.

    `valid_unicode()` follows the XML `Char` production rather than checking whether a code point is valid Unicode. It rejects C0 controls other than tab, line feed, and carriage return, along with surrogates and U+FFFE and U+FFFF. Update its docblock to say so, and point callers to the newer Unicode and UTF-8 helpers, such as `wp_is_valid_utf8()`.

    Add rejected test cases for U+000B and U+001F, which guard the boundary below U+0020, and rename the test and its data provider to describe XML `Char` acceptance.

    Follow-up to [64770].

    Developed in: https://github.com/WordPress/wordpress-develop/pull/15105

    Props shailu25, dmsnell.
    Fixes #66483. See #65819.

    Built from https://develop.svn.wordpress.org/trunk@65268


    git-svn-id: http://core.svn.wordpress.org/trunk@64417 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/kses.php b/wp-includes/kses.php
index aee33b474a..f2195e2f33 100644
--- a/wp-includes/kses.php
+++ b/wp-includes/kses.php
@@ -3403,9 +3403,15 @@ function wp_kses_normalize_entities3( $matches ) {
 }

 /**
- * Determines if a Unicode codepoint is valid.
+ * Determines whether a code point is allowed by the XML Char production.
  *
- * The definition of a valid Unicode codepoint is taken from the XML definition:
+ * Despite its name, this helper does not report whether a code point is valid
+ * Unicode. It follows the XML Char production: C0 controls other than
+ * HT/LF/CR are rejected even though they are valid Unicode (for example
+ * U+0008 BACKSPACE), as are surrogates and U+FFFE/U+FFFF.
+ *
+ * Prefer the newer Unicode/UTF-8 helpers (for example {@see wp_is_valid_utf8()})
+ * rather than extending call sites here.
  *
  * > Characters
  * >
@@ -3419,8 +3425,8 @@ function wp_kses_normalize_entities3( $matches ) {
  *
  * @link https://www.w3.org/TR/xml/#charsets
  *
- * @param int $i Unicode codepoint.
- * @return bool Whether or not the codepoint is a valid Unicode codepoint.
+ * @param int $i Code point to check.
+ * @return bool Whether the code point is allowed by the XML Char production.
  */
 function valid_unicode( $i ) {
 	$i = (int) $i;
diff --git a/wp-includes/version.php b/wp-includes/version.php
index ccce4a8168..32fefc9b23 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta4-65267';
+$wp_version = '7.2-beta4-65268';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.