Commit b0d4f0b83b for wordpress.org

commit b0d4f0b83bfc605ecc986519daac22bf3ccb3605
Author: westonruter <westonruter@git.wordpress.org>
Date:   Wed Sep 23 20:32:49 2026 +0000

    Administration: Use script helper for update count JS.

    Both variants of the inline script printed by `WP_Upgrader_Skin::decrement_update_count()` now go through `wp_print_inline_script_tag()` instead of raw `SCRIPT` markup, so `wp_inline_script_attributes` can attach a per-request nonce to them. This covers the plugin, theme, and translation update screens, including the bulk updates run in an iframe when `IFRAME_REQUEST` is defined.

    The update type is now passed to the script as a `wp_json_encode()` argument using `JSON_HEX_TAG | JSON_UNESCAPED_SLASHES` rather than being concatenated into the JavaScript string. The obsolete `window.postMessage && JSON` feature check in the iframe variant is removed, as both are universally supported.

    Developed in https://github.com/WordPress/wordpress-develop/pull/13653.
    Follow-up to r27280, r29357, r57148, r63481.

    Props sjackson0109, westonruter.
    See #59446, #59444.

    Built from https://develop.svn.wordpress.org/trunk@63902


    git-svn-id: http://core.svn.wordpress.org/trunk@63071 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-admin/includes/class-wp-upgrader-skin.php b/wp-admin/includes/class-wp-upgrader-skin.php
index 831da3aeba..89fde5fc44 100644
--- a/wp-admin/includes/class-wp-upgrader-skin.php
+++ b/wp-admin/includes/class-wp-upgrader-skin.php
@@ -235,6 +235,8 @@ class WP_Upgrader_Skin {
 	 * Outputs JavaScript that calls function to decrement the update counts.
 	 *
 	 * @since 3.9.0
+	 * @since 7.2.0 Prints the script through wp_print_inline_script_tag() so it can carry
+	 *              attributes, such as a per-request nonce, added via wp_inline_script_attributes.
 	 *
 	 * @param string $type Type of update count to decrement. Likely values include 'plugin',
 	 *                     'theme', 'translation', etc.
@@ -245,27 +247,37 @@ class WP_Upgrader_Skin {
 		}

 		if ( defined( 'IFRAME_REQUEST' ) ) {
-			echo '<script>
-					if ( window.postMessage && JSON ) {
-						window.parent.postMessage(
-							JSON.stringify( {
-								action: "decrementUpdateCount",
-								upgradeType: "' . $type . '"
-							} ),
-							window.location.protocol + "//" + window.location.hostname
-								+ ( "" !== window.location.port ? ":" + window.location.port : "" )
-						);
-					}
-				</script>';
+			// language=JavaScript
+			$js_function = <<<'JAVASCRIPT'
+				( upgradeType ) => {
+					window.parent.postMessage(
+						JSON.stringify( {
+							action: "decrementUpdateCount",
+							upgradeType
+						} ),
+						window.location.protocol + "//" + window.location.hostname
+							+ ( "" !== window.location.port ? ":" + window.location.port : "" )
+					);
+				}
+				JAVASCRIPT;
 		} else {
-			echo '<script>
-					(function( wp ) {
-						if ( wp && wp.updates && wp.updates.decrementCount ) {
-							wp.updates.decrementCount( "' . $type . '" );
-						}
-					})( window.wp );
-				</script>';
+			$js_function = <<<'JS'
+				( upgradeType ) => {
+					const wp = window.wp;
+					if ( wp && wp.updates && wp.updates.decrementCount ) {
+						wp.updates.decrementCount( upgradeType );
+					}
+				}
+				JS;
 		}
+
+		wp_print_inline_script_tag(
+			sprintf(
+				'( %s )( %s );',
+				$js_function,
+				wp_json_encode( $type, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
+			)
+		);
 	}

 	/**
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 96b75ca898..354ef92de1 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63901';
+$wp_version = '7.2-alpha-63902';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.