cloudinary · gabrielcld2 · Aug 13, 2026 · Jun 24, 2026 · Jun 26, 2026 · Jul 3, 2026
diff --git a/.eslintignore b/.eslintignore
diff --git a/.eslintrc.json b/.eslintrc.json
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+    target-branch: develop
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    target-branch: develop
+    groups:
+      wordpress:
+        patterns:
+          - "@wordpress/*"
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
@@ -0,0 +1,37 @@
+name: Build Docs
+
+on:
+  push:
+    branches:
+      - master
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  hookdocs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build docs
+        run: npm run build:docs
+
+      - name: Deploy to GitHub Pages
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./docs
diff --git a/.github/workflows/deploy-to-wp-org.yml b/.github/workflows/deploy-to-wp-org.yml
@@ -78,15 +78,21 @@ jobs:
       - name: Prepare build directory
         run: npx grunt prepare
 
+      # Read once so both the tag check and the deploy step use the exact same value, rather
+      # than letting the deploy action derive its own version from GITHUB_REF - that only works
+      # when triggered from a tag push, and yields a bogus value like "refs/heads/master" (which
+      # SVN then can't use as a tag path) on a workflow_dispatch run against a branch.
+      - name: Read plugin version
+        run: echo "PLUGIN_VERSION=$(cat .version | tr -d '[:space:]')" >> "$GITHUB_ENV"
+
       # Ensure the version in the .version file matches the tag of the release.
       # Skipped for manual runs, which may not be run against a release tag.
       - name: Verify version matches tag
         if: github.event_name == 'release'
         run: |
           TAG="${GITHUB_REF_NAME#v}"
-          FILE_VERSION=$(cat .version | tr -d '[:space:]')
-          if [ "$TAG" != "$FILE_VERSION" ]; then
-            echo "::error::Tag $TAG does not match .version $FILE_VERSION"
+          if [ "$TAG" != "$PLUGIN_VERSION" ]; then
+            echo "::error::Tag $TAG does not match .version $PLUGIN_VERSION"
             exit 1
           fi
 
@@ -102,10 +108,20 @@ jobs:
         env:
           BUILD_DIR: 'build'
           SLUG: 'cloudinary-image-management-and-manipulation-in-the-cloud-cdn'
+          VERSION: ${{ env.PLUGIN_VERSION }}
           # Use secrets to authenticate with WP.org.
           SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
           SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
 
+      # Makes the zip downloadable from the run's Artifacts panel regardless of trigger, so
+      # manual/dry-run dispatches can be inspected without publishing a release.
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.PLUGIN_VERSION }}.zip
+          path: ${{ steps.deploy.outputs.zip-path }}
+          retention-days: 7
+
       - name: Upload release asset
         if: github.event_name == 'release'
         uses: softprops/action-gh-release@v2

diff --git a/.gitignore b/.gitignore
@@ -61,3 +61,6 @@ package/dist
 
 # PHPStan result cache
 /.phpstan-cache/
+
+# Generated docs (published to gh-pages by workflow)
+/docs/
diff --git a/.hookdoc/layout.tmpl b/.hookdoc/layout.tmpl
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+	<meta charset="utf-8">
+	<title><?js= title ?> - Cloudinary Docs</title>
+
+	<script src="scripts/prettify/prettify.js"></script>
+	<script src="scripts/prettify/lang-css.js"></script>
+	<!--[if lt IE 9]>
+	<script src="//html5shiv.googlecode.com/svn/trunk/html5.js"></script>
+	<![endif]-->
+	<link type="text/css" rel="stylesheet" href="styles/prettify-tomorrow.css">
+	<link type="text/css" rel="stylesheet" href="styles/jsdoc-default.css">
+
+	<link
+			href="https://fonts.googleapis.com/css?family=IBM+Plex+Mono|IBM+Plex+Sans:300,400|Playfair+Display:900&display=swap"
+			rel="stylesheet">
+</head>
+
+<body>
+
+<div id="main">
+
+	<?js if (title !== 'Home') { ?>
+	<h1 class="page-title"><?js= title ?></h1>
+	<?js } ?>
+
+	<?js= content ?>
+</div>
+
+<nav>
+	<?js= this.nav ?>
+</nav>
+
+<br class="clear">
+
+<footer>
+	<a href="https://cloudinary.com/" target="_blank" rel="noopener noreferrer">Cloudinary</a> |
+	<a href="https://github.com/cloudinary/cloudinary_wordpress/" target="_blank" rel="noopener noreferrer">Cloudinary
+		on GitHub</a>
+</footer>
+
+<script> prettyPrint(); </script>
+<script src="scripts/linenumber.js"></script>
+</body>
+</html>
diff --git a/.wp-env/mu-plugins/analytics-capture.php b/.wp-env/mu-plugins/analytics-capture.php
@@ -0,0 +1,94 @@
+<?php
+/**
+ * Analytics egress capture — local/e2e dev helper mu-plugin.
+ *
+ * Intercepts outgoing requests to any Cloudinary analytics-api.cloudinary.com
+ * endpoint — the custom-events collector AND the older deactivation-reason
+ * collector, both on the same host — and appends each payload as a JSONL
+ * entry to a log file, so e2e tests and manual QA can assert on emitted
+ * events. The request is fully preempted with a synthetic response: earlier
+ * versions of this mu-plugin only logged the payload and let the request
+ * proceed, which meant every local/CI test run was quietly leaking synthetic
+ * events (and deactivation "feedback") into the real production collector.
+ *
+ * @package Cloudinary
+ */
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Returns the path to the capture log file.
+ *
+ * @return string
+ */
+function cld_analytics_capture_log_path() {
+	$upload = wp_upload_dir();
+
+	return $upload['basedir'] . '/analytics-capture.log';
+}
+
+add_filter( 'pre_http_request', 'cld_analytics_capture_intercept', 10, 3 );
+
+/**
+ * Logs outgoing analytics/deactivation-reason requests and preempts them
+ * with a synthetic success response, so nothing actually reaches the real
+ * collector during local dev or CI runs.
+ *
+ * @param false|array|WP_Error $preempt     Whether to preempt the request.
+ * @param array                $parsed_args Parsed request arguments.
+ * @param string               $url         The request URL.
+ *
+ * @return false|array|WP_Error
+ */
+function cld_analytics_capture_intercept( $preempt, $parsed_args, $url ) {
+	if ( false === strpos( $url, 'analytics-api.cloudinary.com' ) ) {
+		return $preempt;
+	}
+
+	$body    = isset( $parsed_args['body'] ) ? $parsed_args['body'] : '';
+	$decoded = json_decode( $body, true );
+
+	file_put_contents( // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents, WordPressVIPMinimum.Functions.RestrictedFunctions.file_ops_file_put_contents
+		cld_analytics_capture_log_path(),
+		wp_json_encode( null !== $decoded ? $decoded : $body ) . "\n",
+		FILE_APPEND | LOCK_EX
+	);
+
+	return array(
+		'headers'  => array(),
+		'body'     => '',
+		'response' => array(
+			'code'    => 200,
+			'message' => 'OK',
+		),
+		'cookies'  => array(),
+		'filename' => null,
+	);
+}
+
+/**
+ * Prints the captured analytics events, one JSON object per line.
+ *
+ * ## OPTIONS
+ *
+ * [--clear]
+ * : Empty the log after printing it.
+ *
+ * @param array $args       Positional arguments.
+ * @param array $assoc_args Associative arguments.
+ */
+function cld_analytics_capture_wpcli_command( $args, $assoc_args ) {
+	$log_file = cld_analytics_capture_log_path();
+
+	if ( file_exists( $log_file ) ) {
+		WP_CLI::line( file_get_contents( $log_file ) ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents, WordPressVIPMinimum.Performance.FetchingRemoteData.FileGetContentsUnknown
+	}
+
+	if ( isset( $assoc_args['clear'] ) ) {
+		file_put_contents( $log_file, '' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents, WordPressVIPMinimum.Functions.RestrictedFunctions.file_ops_file_put_contents
+	}
+}
+
+if ( defined( 'WP_CLI' ) && WP_CLI ) {
+	WP_CLI::add_command( 'cloudinary analytics-events', 'cld_analytics_capture_wpcli_command' );
+}
diff --git a/css/cloudinary.css b/css/cloudinary.css
diff --git a/css/gallery-ui.css b/css/gallery-ui.css
diff --git a/eslint.config.js b/eslint.config.js
@@ -0,0 +1,74 @@
+const globals = require( 'globals' );
+const wpPlugin = require( '@wordpress/eslint-plugin' );
+
+// eslint-import-resolver-typescript v4+ is incompatible with eslint-plugin-import
+// (throws "invalid interface loaded as resolver"), and this project has no TypeScript
+// anyway, so strip the typescript resolver that @wordpress/eslint-plugin configures.
+const recommended = wpPlugin.configs.recommended.map( ( config ) => {
+	if ( ! config.settings || ! config.settings[ 'import/resolver' ] ) {
+		return config;
+	}
+	const { typescript, ...resolver } = config.settings[ 'import/resolver' ];
+	return {
+		...config,
+		settings: {
+			...config.settings,
+			'import/resolver': resolver,
+		},
+	};
+} );
+
+module.exports = [
+	{
+		ignores: [
+			'**/build/**',
+			'**/built/**',
+			'**/node_modules/**',
+			'**/vendor/**',
+			'js/**',
+			'**/*.min.js',
+			// Vendored third-party library (https://github.com/kallookoo/wp-color-picker-alpha).
+			'src/js/wp-color-picker-alpha.js',
+		],
+	},
+	...recommended,
+	{
+		settings: {
+			'import/resolver': {
+				node: true,
+			},
+		},
+		languageOptions: {
+			globals: {
+				...globals.browser,
+				cloudinary: 'readonly',
+				jQuery: 'readonly',
+				$: 'readonly',
+				CLDN: 'readonly',
+				CLDLB: 'readonly',
+				CLD_GLOBAL_TRANSFORMATIONS: 'readonly',
+				samplePlayer: 'readonly',
+				CLDCACHE: 'readonly',
+				cldData: 'readonly',
+				CLD_METADATA: 'readonly',
+				CLDASSETS: 'readonly',
+			},
+		},
+		rules: {
+			'no-alert': 'off',
+			'no-console': 'off',
+			'no-unused-vars': 'off',
+			'no-nested-ternary': 'off',
+			'jsx-a11y/click-events-have-key-events': 'off',
+			'react-hooks/rules-of-hooks': 'error',
+			'react-hooks/exhaustive-deps': 'warn',
+			'@wordpress/no-global-event-listener': 'off',
+			// CLD_Deactivate is a wp_localize_script object name (php/class-deactivation.php);
+			// renaming it would require a matching PHP-side change.
+			camelcase: [
+				'error',
+				{ properties: 'never', allow: [ '^CLD_Deactivate$' ] },
+			],
+		},
+	},
+];
diff --git a/hookdoc-conf.json b/hookdoc-conf.json
@@ -0,0 +1,19 @@
+{
+  "opts": {
+    "destination": "docs",
+    "template": "node_modules/wp-hookdoc/template",
+    "recurse": true,
+    "readme": "./README.md"
+  },
+  "source": {
+    "includePattern": ".+\\.(php|inc)?$"
+  },
+  "plugins": [
+    "node_modules/wp-hookdoc/plugin"
+  ],
+  "templates": {
+    "default": {
+      "layoutFile": ".hookdoc/layout.tmpl"
+    }
+  }
+}
diff --git a/js/asset-edit.js b/js/asset-edit.js
diff --git a/js/asset-manager.js b/js/asset-manager.js
diff --git a/js/block-editor.asset.php b/js/block-editor.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-api-fetch', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => 'aab7b2e0606348e43cc2');
+<?php return array('dependencies' => array('wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '58afb0a9ee7fa6faecd7');
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		<?php return array('dependencies' => array('wp-api-fetch', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => 'aab7b2e0606348e43cc2');
		<?php return array('dependencies' => array('wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '58afb0a9ee7fa6faecd7');