release(core): 0.15.11 - custom block colours, security updates

docs/src/compatibility-matrix.md

@@ -4,6 +4,7 @@
 
 | starterVersion | themeVersion | coreVersion | configsVersion | setupCliVersion | php | node |
 | --- | --- | --- | --- | --- | --- | --- |
+| 2.1.9 | 2.1.9 | 0.15.11 | 1.1.1 | 1.4.0 | >=8.3 | >=24 |
 | 2.1.9 | 2.1.9 | 0.15.10 | 1.1.1 | 1.4.0 | >=8.3 | >=24 |
 | 2.1.8 | 2.1.8 | 0.15.10 | 1.1.1 | 1.4.0 | >=8.3 | >=24 |
 | 2.1.7 | 2.1.7 | 0.15.10 | 1.1.1 | 1.4.0 | >=8.3 | >=24 |

packages/webentor-core/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Webentor Core Changelog
 
+## 0.15.11
+
+- **Custom block colours render on the frontend.** Custom (`style.color.*`) picks were dropped
+  because Blade views only print palette classes. Core now adds them as inline `style` on the
+  block's outer element via `wp_apply_colors_support()`, which respects `supports.color`.
+- **Security updates** (dev and build tooling only): phpcs 3.13.6, Vite 8.3.7, Tailwind 4.3.5 and
+  patched transitive deps. Advisories that need an upstream major (minimatch, uuid, glob, deepmerge) stay open.
+- A transparent patch within `^0.15`: `pnpm up @webikon/webentor-core` and
+  `composer update webikon/webentor-core`.
+
 ## 0.15.10
 
 - **WordPress 7.1 components.** The Query Loop taxonomy filter hides the `FormTokenField`

packages/webentor-core/app/blocks-init.php

@@ -276,6 +276,8 @@ function render_block_blade($block, $parent_block = null, $attributes = null)
          * @param array    $block         The full block, including name and attributes.
          * @param WP_Block $instance      The block instance.
          */
+        $block_content = apply_custom_colors_to_block($block_content, $block, $block->attributes);
+
         $block_content = apply_filters('render_blade_block', $block_content, $block->parsed_block, $block);
 
         /**
@@ -361,6 +363,8 @@ function render_inner_block_blade($block, $parent_block = null)
          * @param array    $block         The full block, including name and attributes.
          * @param WP_Block $instance      The block instance.
          */
+        $block_content = apply_custom_colors_to_block($block_content, $block, $block->attributes);
+
         $block_content = apply_filters('render_blade_block', $block_content, $block->parsed_block, $block);
 
         /**
@@ -384,6 +388,43 @@ function render_inner_block_blade($block, $parent_block = null)
     }
 }
 
+/**
+ * Apply custom (non-palette) colors from `style.color` as inline style on the block's outer element.
+ * Blade views only print slug-based color classes, so without this custom hex picks are dropped on the frontend.
+ *
+ * @param  mixed     $block_content
+ * @param  \WP_Block $block
+ * @param  array     $attributes
+ * @return mixed
+ */
+function apply_custom_colors_to_block($block_content, $block, $attributes)
+{
+    if (empty($attributes['style']['color']) || !$block->block_type) {
+        return $block_content;
+    }
+
+    // Core's color support: respects supports.color (incl. per-key + skipSerialization) and sanitizes.
+    // Preset slugs come back as classes only (which our views already print), so `style` is custom values only.
+    $css = wp_apply_colors_support($block->block_type, $attributes)['style'] ?? '';
+    if ($css === '') {
+        return $block_content;
+    }
+
+    // Blade returns a View object; render it so the tag processor can edit it
+    $processor = new \WP_HTML_Tag_Processor((string) $block_content);
+    if (!$processor->next_tag()) {
+        return $block_content;
+    }
+
+    $existing = trim((string) $processor->get_attribute('style'));
+    if ($existing !== '' && !str_ends_with($existing, ';')) {
+        $existing .= ';';
+    }
+    $processor->set_attribute('style', $existing . $css);
+
+    return $processor->get_updated_html();
+}
+
 /**
  * Build Tabs navigation based on child blocks titles.
  *

packages/webentor-core/composer.json

@@ -1,6 +1,6 @@
 {
   "name": "webikon/webentor-core",
-  "version": "0.15.10",
+  "version": "0.15.11",
   "license": "MIT",
   "description": "Webentor Core package",
   "homepage": "https://webikon.sk",

packages/webentor-core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@webikon/webentor-core",
   "homepage": "https://webikon.sk",
-  "version": "0.15.10",
+  "version": "0.15.11",
   "description": "Core functionality and useful utilities for Webentor Stack",
   "license": "MIT",
   "author": "Webikon s.r.o.",