Update Jetpack plugin from 15.9.1 to 16.0

Author: bitpoke-bot

wp-content/plugins/jetpack/3rd-party/vaultpress.php

@@ -22,7 +22,7 @@ function jetpack_vaultpress_rewind_enabled_notice() {
 	deactivate_plugins( 'vaultpress/vaultpress.php' );
 
 	// Remove WP core notice that says that the plugin was activated.
-	unset( $_GET['activate'] ); // phpcs:ignore WordPress.Security.NonceVerification
+	unset( $_GET['activate'] );
 	$message = sprintf(
 		wp_kses(
 			/* Translators: variable is the full URL to the new dashboard */

wp-content/plugins/jetpack/CHANGELOG.md

@@ -2,14 +2,95 @@
 
 ### This is a list detailing changes for all Jetpack releases.
 
+## 16.0 - 2026-07-07
+### Enhancements
+- Add AI-powered "Generate/Improve with Jetpack" buttons to the Content Guidelines admin page. [#47959]
+- AI: Surface SEO Enhancer suggestions (SEO title and meta description) in the AI sidebar. [#50042]
+- AI Admin: Restructure MCP settings Read/Write pages to group tools by display group with collapsible per-group tool lists and a page-level Enable all toggle. [#50045]
+- AI Sidebar: Enable Optimize Title suggestions. [#49722]
+- Daily Writing Prompt: Load the Dashboard widget on connected self-hosted Jetpack sites. [#49491]
+- Donations Block: Render the block in emails with email-friendly CTA buttons. [#49963]
+- Forms: Warn admins and editors when a form isn't collecting responses (email and saving both off, no integration). [#49808]
+- Newsletter: Allow setting a custom description for the free tier and hiding it from the subscriber plan selector. [#49585]
+- Newsletter: Link to the site visibility settings from the Coming Soon notice in the pre-publish panel. [#50073]
+- Render the unified Jetpack admin header and footer on Akismet's admin pages. [#49593]
+- Subscriptions: Replace the Subscribers menu link with a transitional announcement page when the Newsletter modernization filter is enabled. [#49496]
+- Subscriptions Block: Customize the Subscribe modal heading site-wide via a new Newsletter setting. [#49171]
+- VideoPress: Add presentation to the player iframe allow list to enable casting from embeds. [#50215]
+- VideoPress: Make the VideoPress admin dashboard available in the Jetpack plugin (previously only in the standalone Jetpack VideoPress plugin). [#49696]
+
+### Bug fixes
+- AI Agent Access: Correct module references in Shortlinks and Related Posts ability descriptions. [#49957]
+- AI Assistant: Hide legacy block toolbar controls when Jetpack AI Sidebar content editing is enabled. [#49219]
+- AI Chat block: Stop prompting to enable Jetpack Search when the Search module is active in a non-Instant Search experience (Theme, Inline, or Embedded). [#49870]
+- Akismet: Hide the empty `#screen-meta-links` container so it no longer reserves a blank slot above the Jetpack header (notably on WordPress.com Simple sites). [#49658]
+- Akismet: Show the Akismet logo (instead of the Jetpack logo) in the unified admin header. [#49837]
+- Archives shortcode: Cap the `postbypost` type with a filterable default limit to prevent memory exhaustion on large sites. [#49927]
+- Blaze: Warn users with active campaigns before disabling the Blaze module. [#49610]
+- Content Guidelines AI: Place the suggestion badge to the left of the section chevron so chevrons stay aligned across sections with and without a badge. [#50083]
+- Content Guidelines AI: Wrap the per-section Save/Clear/Generate button row so the buttons no longer overlap on narrow screens. [#50101]
+- Crowdsignal shortcode: Render rating settings as data rather than building markup from them.
+- Daily Writing Prompt: Defer the connection-readiness check to Dashboard setup to avoid a fatal error on Atomic sites. [#49525]
+- Donations Form: Prevent the editor from flickering when hovering the block as an inserter preview. [#49792]
+- Fix fatal error on My Jetpack when the current stable Jetpack plugin is active along with other Jetpack standalone plugins. [#49994]
+- Forms: Sign file download links with an expiring token so they work for any logged-in editor. [#49868]
+- JSON API: Ensure error responses always serialize an HTTP error status (>= 400), never a non-integer or a 2xx that clients could interpret as success. [#50077]
+- JSON API: Only default a missing or invalid error status to 400, and stop overwriting valid HTTP status codes below 400 that callers return via `WP_Error`. [#50173]
+- Memberships: Delegate the Payment Request API to the checkout iframe so Apple Pay, Google Pay, and Stripe Link can load and complete payments. [#49622]
+- Newsletter: Default the post access level to "everybody" when the stored meta is not a string, and sanitize non-string writes, so corrupt values can no longer cause a fatal error when rendering a post. [#50090]
+- Newsletter: Fix "Sorry, you are not allowed to do this" error for Contributors on the first Submit for Review when the Subscriptions module is active. [#49813]
+- Newsletter: When setting up paid subscriptions, only prompt for the steps that are actually missing (Stripe connection and/or a newsletter tier). [#49673]
+- Paid Content: Ensure paid subscribers on Atomic-hosted sites retain access to gated content. [#48857]
+- Paid Content Block: Prevent lockout after a subscription renewal. [#48008]
+- Podcast: Load the package outside Jetpack's connection-gated module loader so the podcast feed and dashboard keep working when the site is disconnected. [#49989]
+- Prevent Slideshow block crash when converting from Gallery. [#50035]
+- Social: Prevent errors in the post-publish sharing status panel from crashing the editor. [#49823]
+- Subscriptions: Prevent a duplicate Subscribers menu entry on WordPress.com (Atomic) sites. [#49675]
+- Tiled Gallery: Fix an infinite resize loop when the block is inside a Row or Stack block. [#50016]
+- Tiled Gallery: Keep the mosaic layout stable and split rows evenly between galleries when the block is inside a Row or Stack. [#50016]
+- Tiled Gallery: Prevent editor crash when transforming a core gallery block. [#50025]
+- Top Posts & Pages: Use the live post permalink so links reflect the current site URL. [#49802]
+- VideoPress: Fix the player overflowing the page on the non-iframe embed path. [#49716]
+- VideoPress: Load player scripts only once when a page contains multiple videos. [#49716]
+- WhatsApp Button block: Fix icon and text overlapping in RTL languages. [#49983]
+
+### Other changes <!-- Non-user-facing changes go here. This section will not be copied to readme.txt. -->
+- AI Sidebar: Gate the Generate Feedback suggestion behind the preview feature flag. [#49437]
+- AI Sidebar: Load the Agents Manager through the `jetpack-agents-manager` Composer package instead of a self-contained CDN loader. [#49603]
+- AI Sidebar: Source the AI Editorial Review flag only from `features.aiEditorialReview`; drop the redundant top-level `aiEditorialReviewEnabled` field. [#49971]
+- Akismet: Make the admin header/footer chrome registration idempotent so it can't render twice if wired from more than one entry point. [#49658]
+- Content Guidelines: Align the empty-state banner orbs on the same axis and reduce their size. [#49760]
+- Content Guidelines AI: Fix the AI controls not appearing after recent Gutenberg Guidelines markup changes. [#47959]
+- Content Guidelines AI: Persist the empty-state dismissal (banner and upgrade notice) per-user across devices instead of in browser `localStorage`, and allow dismissing the upgrade notice from its close icon. [#49392]
+- Defer loading Boost Speed Score classes until a REST request or Boost lifecycle action fires, reducing the per-request PHP/opcache footprint. [#49806]
+- Defer the `wpcom/v2` Search and AI REST endpoint wrappers from loading their controller and helper classes until `rest_api_init`, so those classes are not loaded on front-end, cron, and login requests. [#49805]
+- Donations block: Update location of earnings link. [#50177]
+- Editor: Load the shared data stores through the externalized `jetpack-shared-stores` bundle to avoid duplicate store registration warnings. [#49494]
+- Fix `@wordpress/ui` 0.15 type errors in the mobile-app recommendation and the AI Assistant message icon. [#49800]
+- Heartbeat: Provide connection owner and XML-RPC error stats from the Connection package. [#49922]
+- Image Studio: Share the translation script handle with the Agents Manager package to avoid enqueuing the same file twice. [#50069]
+- JSON API: Require Jetpack 15.9 or later to dispatch the posts, users, site, and plugins endpoints over REST. [#49819]
+- Load block render code only when a block is present, and skip editor-only extensions on front-end requests, to reduce per-request PHP/opcache footprint. [#49807]
+- Media Summary: Allow callers to opt out of URL stripping via a new `preserve_urls` argument. [#49397]
+- Newsletter: Begin a staged rollout of the modernized Newsletter dashboard and WP Admin subscriber management, off by default. Opt in or out with the `rsm_jetpack_ui_modernization_newsletter` and `jetpack_wp_admin_subscriber_management_enabled` filters. [#49036]
+- Newsletter: Register the `description` field for the memberships endpoint to support paid tier descriptions. [#49413]
+- Newsletter widget: Stop building the bundle twice, keeping only the build that is actually loaded. [#50087]
+- Notifications: Let users opt into the v3 notifications panel via the `notifications=v3` query parameter. [#49514]
+- Performance: Reduce front-end PHP loaded for My Jetpack and Import on page views where they are not used. [#49936]
+- Performance: Register pure display blocks lazily on first render instead of on every front-end request, to reduce per-request PHP/opcache footprint. [#49840]
+- Performance: Skip loading the Stats and Stats Admin packages on plain front-end page views when the Stats module is off, to reduce the per-request PHP footprint. [#49839]
+- Podcast: Add a Jetpack module that loads the Podcast package, gated behind the default-off `jetpack_podcast_for_the_world` filter. [#49790]
+- Sync: Add test coverage for refreshing the plugin list callable when a plugin is deleted. [#49913]
+- Sync: Append an order's total (total, currency) to the synced `woocommerce_new_order` and `woocommerce_order_status_changed` actions when the order reaches a paid status, so WordPress.com can aggregate revenue. [#49689]
+- Update composer.lock for the Podcast package's new `jetpack-admin-ui` dependency. [#49918]
+- Update package dependencies. [#49273] [#49448] [#49492] [#49631] [#49638] [#49639] [#49691] [#49757] [#49793] [#49831] [#50097] [#50183]
+- Update the WooCommerce Analytics package to version 0.16.6. [#49686]
+
 ## 15.9.1 - 2026-06-24
 ### Bug fixes
 - Fix the Social admin page rendering blank, and restore the editor sharing panel, on WordPress 6.9. [#49859]
 
 ## 15.9 - 2026-06-09
-### Major Enhancements
-- General: Update minimum WordPress version to 6.9. [#49021]
-
 ### Enhancements
 - Abilities API: Register Shortlinks support for the WP.me Shortlinks module on WordPress 6.9+. [#48334]
 - Admin Menu: Add sidebar redesign fields, group metadata, and saved layout data to the `/wpcom/v2/admin-menu` endpoint when the public `wp-admin-sidebar` plugin is loaded. [#48715]
@@ -41,9 +122,10 @@
 
 ### Improved compatibility
 - ActivityPub: Allow Jetpack-signed admin requests to reach the inbox, proxy, and outbox client-to-server endpoints used by the connected site's WordPress.com Reader, without an OAuth bearer. [#48812]
+- General: Update minimum WordPress version to 6.9. [#49021]
 - Migrate Status indicator to @wordpress/ui Text. [#48711]
 - Resolve WPDS design tokens in the legacy settings dashboard CSS. [#48750]
-- Settings And AI Pages: Replace the `.admin-ui-page` selector hook with the stable `.jp-admin-page__page` className passed through by AdminPage, restoring page-specific layout overrides. [#48410]
+- Settings and AI Pages: Replace the `.admin-ui-page` selector hook with the stable `.jp-admin-page__page` className passed through by AdminPage, restoring page-specific layout overrides. [#48410]
 
 ### Bug fixes
 - AI: Fix broken external links (Claude settings and agent documentation) in the MCP quick setup. [#49453]
@@ -118,11 +200,7 @@
 - Tests: drop a Related Posts ability assertion that fails on CI. [#48335]
 - Update composer.lock files. [#49415]
 - Updated WooCommerce Analytics package to version 0.16.5. [#49329]
-- Update package dependencies. [#48329] [#48405] [#49012]
-- Update package dependencies. [#48404] [#49218]
-- Update package dependencies. [#48683] [#48695]
-- Update package dependencies. [#48689]
-- Update package dependencies. [#49425] [#49379]
+- Update package dependencies. [#48329] [#48405] [#49012] [#48404] [#49218] [#48683] [#48695] [#48689] [#49425] [#49379]
 - Verification Tools: remove trailing slash from meta void elements to conform with the HTML spec. [#48869]
 - Widgets: Prevent a PHP error when Display Posts data is malformed. [#49295]
 

wp-content/plugins/jetpack/_inc/blocks/components.js.LICENSE.txt

@@ -35,6 +35,16 @@
  * LICENSE file in the root directory of this source tree.
  */
 
+/**
+ * @license React
+ * react-is.production.min.js
+ *
+ * Copyright (c) Facebook, Inc. and its affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
 /**
  * @license React
  * react-jsx-runtime.production.min.js

wp-content/plugins/jetpack/_inc/blocks/donations/view.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-dom-ready', 'wp-polyfill', 'wp-url'), 'version' => '33d2f20f01686d456c45');
+<?php return array('dependencies' => array('wp-dom-ready', 'wp-polyfill', 'wp-url'), 'version' => 'ae8fd70e7388b8744bec');

wp-content/plugins/jetpack/_inc/blocks/donations/view.js

@@ -1 +1 @@
-<?php return array('dependencies' => array('jetpack-connection', 'jetpack-script-data', 'lodash', 'react', 'react-jsx-runtime', 'wp-a11y', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-block-serialization-default-parser', 'wp-blocks', 'wp-commands', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-token-list', 'wp-url', 'wp-viewport', 'wp-wordcount'), 'version' => '9de4593daaf2bd2950da');
+<?php return array('dependencies' => array('jetpack-connection', 'jetpack-script-data', 'jetpack-shared-stores', 'lodash', 'react', 'react-jsx-runtime', 'wp-a11y', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-block-serialization-default-parser', 'wp-blocks', 'wp-commands', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-token-list', 'wp-url', 'wp-viewport', 'wp-wordcount'), 'version' => '60aac596ce5754ce4799');

wp-content/plugins/jetpack/_inc/blocks/editor-beta.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('jetpack-connection', 'jetpack-script-data', 'lodash', 'react', 'react-jsx-runtime', 'wp-a11y', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-block-serialization-default-parser', 'wp-blocks', 'wp-commands', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-token-list', 'wp-url', 'wp-viewport', 'wp-wordcount'), 'version' => 'b328d003f1255a6304cc');
+<?php return array('dependencies' => array('jetpack-connection', 'jetpack-script-data', 'jetpack-shared-stores', 'lodash', 'react', 'react-jsx-runtime', 'wp-a11y', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-block-serialization-default-parser', 'wp-blocks', 'wp-commands', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-token-list', 'wp-url', 'wp-viewport', 'wp-wordcount'), 'version' => '2b054cca5ecc6a0a1b23');