(ACF) Advanced Custom Fields Pro 6.8.10

* Security - ACF now validates that uploaded PDF files begin with the standard `%PDF-` header before further processing, rejecting files that do not match the expected format
* Security - The Relationship, Post Object, Image, Gallery, and File fields now enforce WordPress read permissions on referenced posts and attachments when returned in REST API responses
* Security - ACF now verifies both preview context and the caller's edit capability before substituting revision data when field values are retrieved for a post
* Security - The `_acf_form` token used by frontend forms now expires and is bound to its issuing render, and `acf_encrypt()` / `acf_decrypt()` gain an optional `$context` argument for domain separation between token uses
* Security - ACF now consistently runs field validation on frontend form submissions containing field data, ensuring required-field checks and custom `acf/validate_value` filters cannot be circumvented
* Security - ACF's REST API schema no longer discloses per-object field-group configuration in OPTIONS requests to callers who lack read permission on the target object
* Security - The User field AJAX endpoint now validates that the request nonce was created for a User field

* [View Release Post](https://www.advancedcustomfields.com/blog/acf-6-8-9-released/)
* Enhancement - ACF Blocks registered via `acf_register_block_type()` or `block.json` without an explicit version now default to v3 on WordPress 7.1 or later. Blocks that specify a version continue to use the version they declare, and the default can be customized via the `acf/blocks/default_block_version` filter
* Enhancement - ACF Blocks v3 now supports a `renderPreview` option in `block.json`. Setting `"renderPreview": false` shows a placeholder with the block's icon, title, and an "Edit Block" button in the editor instead of rendering the block's template as a live preview. The block continues to render normally on the front-end, and legacy v2 blocks combining `"mode": "edit"` with `"supports": { "mode": false }` are automatically migrated when upgraded to v3
* Fix - Inline editable fields in ACF Blocks V3 no longer require a second click before they can be edited
* Fix - Radio buttons now appear correctly in ACF admin screens
* Fix - Image and Gallery fields no longer reject SVG uploads when the Safe SVG plugin is active

* Fix - Image and Gallery fields no longer reject SVG files

* Fix - Google Maps field values are no longer double-encoded when saved in an ACF block
* Fix - Inserting a Link field value in the Classic Editor no longer triggers validation for other required fields before the post is saved
* Fix - Auto Inline Editing blocks no longer return truthy placeholder strings for empty field values fetched from a different post inside the block render template
* Fix - ACF Blocks (V2 and V3) no longer crash when rendering an oEmbed field whose title begins with `[` or `{`
* Fix - Field group location rules without a location value no longer cause PHP warnings on page load
* Fix - The appearance of the URL, Number, and Select fields has been improved on WordPress 7.0+
* Fix - ACF fields now save on WooCommerce orders when using HPOS in compatibility mode

* Security - ACF PRO's save handler for WooCommerce order fields now verifies security nonces and only attaches on the order edit screen, preventing unauthenticated field value updates for stores utilizing HPOS
* Security - The Flexible Content "Rename Layout" modal no longer allows for the execution of a potential stored XSS vulnerability
* Security - A default limit of 1000 has been applied to user-contributed choices for Checkbox, Radio, and Select fields to improve security, with a new `acf/fields/max_appended_choices` filter available for customization
* Security - Special characters within LIKE patterns are now fully escaped in `wp_options` queries via `$wpdb->esc_like()`

* Security - ACF AJAX field handlers now validate that the request nonce was created for the expected field type
* Enhancement - ACF PRO now satisfies plugin dependencies declared against `advanced-custom-fields`, so plugins requiring ACF can activate when only ACF PRO is installed
* Enhancement - `acf_inline_toolbar_editing_attrs()` now accepts a `return_array` argument that returns the attributes as an escaped array suitable for use with `wp_get_attachment_image()`
* Fix - `acf_form()` with `'post_id' => 'new_post'` and a `fields` list of field names no longer fatal errors when `acf_form_head()` runs before WordPress's main query is built
* Fix - Multiple `acf_form()` calls wrapped inside a single outer `<form>` tag with one submit button no longer silently drop field values, `post_title`, or `post_content` from the non-last forms
* Fix - Duplicating a V3 block with identical attributes no longer displays corrupted preview content in the duplicate
* Fix - Switching between tabs containing WYSIWYG fields no longer leaves the admin menu pinned against a shorter page, which could lock page scroll

Advanced Custom Fields PRO 6.8.3
* Security - The oEmbed field's AJAX preview no longer performs URL discovery for users without the `edit_posts` capability.

* Security - ACF frontend forms (`acf_form()`) now respect the `post_title` and `post_content` form configuration options when processing submissions, ensuring those values are only saved when the form is configured to accept them. Thanks to Sarawut Poolkhet (MisterHelloz) for the responsible disclosure.
* Security - ACF frontend forms (`acf_form()`) now only save values for fields assigned to the form via the `fields` or `field_groups` parameters, or via the form's location rules

* Security - ACF now correctly checks user permissions before running database upgrades on a specific site in a multisite network
* New - A `wp.data` store (`acf/fields`) is now available in ACF PRO for reading and writing ACF field values from JavaScript, which can be enabled via a new `acf/settings/enable_datastore` filter (requires WordPress 6.7 or later).
* New - ACF PRO block bindings now support live preview and editing in the block editor, when both the datastore and the `enable_block_bindings` setting are enabled.
* New - ACF PRO can now save metabox field values via Gutenberg's native REST flow with full revision and autosave support when using the datastore.
* New - ACF PRO Blocks can now define their field group inline via an `acf.fields` array in `block.json`, or via a `fields` argument in `acf_register_block_type()`, with field keys auto-generated and scoped to the block
* Fix - Repeater and Flexible Content row helpers no longer trigger a PHP 8.x `TypeError` when `row_index_offset` or the active loop index is non-numeric
* Fix - V3 Blocks with `hideFieldsInSidebar` enabled no longer show fields in the sidebar after the inline toolbar popover is closed
* Fix - Scrollbars no longer appear under the tabs in field groups containing many tabs
* Fix - The `acf/delete-{taxonomy}` ability no longer returns a 501 error when called without an explicit `force` argument, as terms cannot be trashed
* Fix - The `prepare_field_for_ability_import` filter is now correctly removed after each Abilities field group import, preventing subsequent imports in the same request from having values corrupted

* Fix - V3 blocks with WYSIWYG fields no longer enqueue TinyMCE editor assets on the frontend
* Fix - V3 blocks with identical attributes and different InnerBlocks content no longer return cached output from the first block on the frontend