Merge origin/canary into dependabot branch

Co-authored-by: josephfusco <6676674+josephfusco@users.noreply.github.com>

Author: Copilot

.changeset/blockset-cleanup-on-failed-extraction.md

@@ -0,0 +1,5 @@
+---
+"@faustwp/wordpress-plugin": patch
+---
+
+fix[faustwp]: clean up uploaded blockset zip when extraction fails

.changeset/cute-doors-argue.md

@@ -0,0 +1,5 @@
+---
+"@faustwp/wordpress-plugin": patch
+---
+
+fix[faustwp]: use home_url() in handle_generate_endpoint so Bedrock-style installs (where WordPress core lives under /wp/) match against the public REQUEST_URI

.changeset/funny-ravens-run.md

@@ -0,0 +1,5 @@
+---
+"@faustwp/wordpress-plugin": patch
+---
+
+fix[faustwp]: use hash_equals() for constant-time secret key comparison in REST and GraphQL permission callbacks

.changeset/handle-generate-home-url.md

@@ -26,6 +26,10 @@ jobs:
         uses: actions/checkout@v4
       - name: Set up Node.js
         uses: ./.github/actions/cache-restore
+        id: cache-node-modules
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
       - name: Check Linting
         run: npm run lint
   check_format:
@@ -37,5 +41,9 @@ jobs:
         uses: actions/checkout@v4
       - name: Set up Node.js
         uses: ./.github/actions/cache-restore
+        id: cache-node-modules
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
       - name: Check Formatting
         run: npm run test:format

.changeset/hash-equals-secret-comparison.md

@@ -54,11 +54,25 @@ jobs:
       # writing this they do not function as expected on GH actions
       - name: replace downloaded registry faust packages with local build
         run: |
+          mkdir -p e2e-app/node_modules/@faustwp
           rm -rf e2e-app/node_modules/@faustwp/cli
           rm -rf e2e-app/node_modules/@faustwp/core
           cp -r packages/faustwp-cli e2e-app/node_modules/@faustwp/cli
           cp -r packages/faustwp-core e2e-app/node_modules/@faustwp/core
-          chmod +x e2e-app/node_modules/.bin/faust
+          mkdir -p e2e-app/node_modules/.bin
+          ln -sf ../@faustwp/cli/dist/index.js e2e-app/node_modules/.bin/faust
+          chmod +x e2e-app/node_modules/@faustwp/cli/dist/index.js
+      # create-next-app's npm install may fail if @faustwp/* versions
+      # are not yet published. Point deps at local builds so npm install
+      # can resolve them and install all remaining dependencies.
+      # --install-links copies packages instead of symlinking, avoiding
+      # duplicate React instances from split module resolution.
+      - name: install e2e-app dependencies
+        working-directory: e2e-app
+        run: |
+          npm pkg set "dependencies.@faustwp/cli=file:../packages/faustwp-cli"
+          npm pkg set "dependencies.@faustwp/core=file:../packages/faustwp-core"
+          npm install --install-links
       - name: copy env
         working-directory: e2e-app
         run: |

.changeset/silly-owls-clean.md

@@ -40,8 +40,11 @@ jobs:
       - name: Install Dependencies
         run: npm ci
 
+      - name: Install legacy npm first, as a workaround for https://github.com/nodejs/node/issues/62425
+        run: npm install -g npm@10.9.8
+
       - name: Upgrade npm for OIDC support
-        run: npm install -g npm@^11.5.1
+        run: npm install -g npm@11.13.0
 
       - name: Verify OIDC token availability
         run: |
@@ -63,4 +66,4 @@ jobs:
 
       - name: Push tags
         if: inputs.push-tags
-        run: git push --follow-tags
+        run: git push origin --tags

.github/workflows/check-packages.yml

@@ -22,7 +22,7 @@ Faust.js is a toolkit for building Next.js applications for headless WordPress s
 
 ## System Requirements
 
-- Node.js v16.0.0 or newer (v16.8.0 when using Next.js 13 and v18.17 when using Next.js 14).
+- Node.js v18 or newer. npm v8 or newer.
 - MacOS, Windows (including WSL), and Linux are supported.
 
 ## Documentation