Trac: Refresh the Trac front-end assets

[obenland]

Takes the style/trac/ and template changes from #734 ahead of it, with fixes on top, so these assets deploy once and #734 shrinks to its build tooling.

From #734: trac/*.js and wp-trac.css reformatted; the jinja2 shim retired, its rules folded into wp-trac.css (verified #banner, #footer, #tabs); trac-search.js removed, dead since r7275; .success() → .done(). Excludes the build tooling and trac/README.md, which documents scripts that only exist once #734 lands.

Markup construction. .text(), .attr() and .val() decode entities, so values read back out of the DOM are not safe to concatenate into markup. postPreviewHacks(), nonGardeners(), the closed-milestone notice and the attachment autocomplete now build nodes or escape. linkMentions()/linkGutenbergIssues() index their placeholder tokens, which a comment containing the literal __PLACEHOLDER__ could previously desynchronise. The two existing $( '<span />' ).text( … ).html() uses become a named escapeHtml(), element-content only.

Defects found along the way

• Style: Replace Grunt with @wordpress/scripts and modernize the build #734's textarea.trigger( 'focus' ) threw on a DOM element, silently breaking the PHP code block button.
• Toolbar rules and that button's anchor targeted Trac 1.0.9 ids; 1.6 uses class="trac-wikitoolbar-<type>", so icons rendered as empty boxes and the button was never inserted. Pre-existing.
• The jinja2 fold-in dropped #tab_keybindings and the non-gardener attachment-options rule. Both restored.
• Style: Replace Grunt with @wordpress/scripts and modernize the build #734 rekeyed addDynamicAssetCacheBuster() to scripts_version, arming a function that had never fired. $.loadStyleSheet de-dupes on exact href, so a second trac.css landed after wp-trac.css and Trac's rules won. Restored to v=.
• font: 700 → font-weight; handbook link to HTTPS.

Deployment: sandbox deploy of s.w.org/style/trac/, then bump scripts_version in both site_head.html and site_footer.html.

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

Refreshes Trac front-end assets (JS/CSS + Trac templates) by consolidating the former Jinja2-compat shim into the main assets, modernizing markup construction to avoid unsafe HTML string concatenation, and removing dead client code.

Changes:

• Refactors wp-trac.js to build DOM nodes / escape element content where needed, and adds several Trac UI/UX tweaks (auth links, notices, report/query behaviors).
• Updates wp-trac.css to absorb the removed compat stylesheet and modernizes selectors/values.
• Removes unused legacy assets (wp-trac-jinja-compat.*, trac-search.js) and updates template includes accordingly.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
wordpress.org/public_html/style/trac/wp-trac.js	Main Trac behavior script: refactors HTML construction/escaping, adds UI behaviors, removes reliance on compat shim.
wordpress.org/public_html/style/trac/wp-trac.css	Consolidates/modernizes Trac styling; absorbs compat CSS behavior and updates selectors/weights.
wordpress.org/public_html/style/trac/wp-trac-jinja-compat.js	Removed legacy Jinja2-compat client rewrite shim.
wordpress.org/public_html/style/trac/wp-trac-jinja-compat.css	Removed legacy Jinja2-compat stylesheet.
wordpress.org/public_html/style/trac/trac-security.js	Reformats and updates security-keyword gating UI on /newticket.
wordpress.org/public_html/style/trac/trac-search.js	Removed dead related-ticket search script.
trac.wordpress.org/templates/site_head.html	Stops loading removed compat CSS.
trac.wordpress.org/templates/site_footer.html	Stops loading removed compat JS and updates jQuery AJAX callback to .done().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (2)

wordpress.org/public_html/style/trac/wp-trac.css:433

• The removed wp-trac-jinja-compat.css previously hid both #tab_advanced and #tab_keybindings. If the intent is to keep the same Preferences tabs behavior ("#tabs carried over" in the PR description), #tab_keybindings should be hidden here as well.

/* Sessions are tied to WP.org logins; hide the anonymous "Advanced" session tab. */
#content.prefs #tabs #tab_advanced {
	display: none;
}

wordpress.org/public_html/style/trac/wp-trac.css:1671

• Missing comma at the end of this selector line causes the selector list to be parsed incorrectly, so the bbPress hover color rule won’t apply as intended.

body.bbpress #content.build h2.config :visited

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

wordpress.org/public_html/style/trac/trac-security.js:81

• has_overlap() intends to strip non-letter characters before splitting into words, but the character class /[^a-z|\s]/g accidentally allows the | character (because | is literal inside []). This can prevent detection when users paste payload-like strings containing | separators.

		has_overlap( str, arr ) {
			const words = str
					.toLowerCase()
					.replace( /[^a-z|\s]/g, '' )
					.split( ' ' ),
				overlap = this.intersect( words, arr );