@automattic/newspack-blocks 4.27.1-hotfix-remove-hidden-checkout-fields.3 → 4.27.1

package/CHANGELOG.md

@@ -1,9 +1,9 @@
-## @automattic/newspack-blocks [4.27.1-hotfix-remove-hidden-checkout-fields.3](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.27.1-hotfix-remove-hidden-checkout-fields.2...newspack-blocks@4.27.1-hotfix-remove-hidden-checkout-fields.3) (2026-07-10)
+## @automattic/newspack-blocks [4.27.1](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.27.0...newspack-blocks@4.27.1) (2026-07-14)
 
 
 ### Bug Fixes
 
-* **blocks:** scope billing fields enforcement to modal checkout ([00dca75](https://github.com/Automattic/newspack-workspace/commit/00dca7576c63715825cba7adf92429fa8a01c0f7))
+* **blocks:** fix express checkout address validation in modal checkout ([#597](https://github.com/Automattic/newspack-workspace/issues/597)) ([09e001f](https://github.com/Automattic/newspack-workspace/commit/09e001fb8333ae9ab5f7d03c894e9bbeefe3144c))
 
 # @automattic/newspack-blocks [4.27.0](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.26.8...newspack-blocks@4.27.0) (2026-07-08)
 

package/includes/class-modal-checkout.php

@@ -1405,6 +1405,11 @@ final class Modal_Checkout {
 	 * is scrubbed. Runs on rest_pre_dispatch because the validation happens
 	 * during dispatch.
 	 *
+	 * The shipping address is intentionally out of scope. Carts that need a
+	 * shipping address bail below, and wallets return only billing contact when
+	 * shipping is not requested, so a virtual-cart request carries no shipping
+	 * address to scrub.
+	 *
 	 * Scoped to requests originating from the modal checkout, so any Store API
 	 * checkout outside the modal (e.g. the blocks checkout page or express
 	 * buttons on product pages) keeps stock behavior.
@@ -1477,7 +1482,14 @@ final class Modal_Checkout {
 	private static function is_modal_checkout_referer() {
 		$referer = isset( $_SERVER['HTTP_REFERER'] ) ? esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 
-		return false !== strpos( $referer, 'modal_checkout=1' );
+		if ( ! $referer ) {
+			return false;
+		}
+
+		$query_string = \wp_parse_url( $referer, PHP_URL_QUERY );
+		\wp_parse_str( (string) $query_string, $query_params );
+
+		return ! empty( $query_params['modal_checkout'] );
 	}
 
 	/**
@@ -1494,6 +1506,7 @@ final class Modal_Checkout {
 		if (
 			! in_array( 'billing_state', $billing_fields, true ) &&
 			! empty( $address['state'] ) &&
+			is_string( $address['state'] ) &&
 			$country
 		) {
 			$states = \WC()->countries->get_states( $country );
@@ -1511,6 +1524,7 @@ final class Modal_Checkout {
 		if (
 			! in_array( 'billing_postcode', $billing_fields, true ) &&
 			! empty( $address['postcode'] ) &&
+			is_string( $address['postcode'] ) &&
 			! \WC_Validation::is_postcode( $address['postcode'], $country )
 		) {
 			$address['postcode'] = '';

package/newspack-blocks.php

@@ -7,7 +7,7 @@
  * Author URI:      https://newspack.com/
  * Text Domain:     newspack-blocks
  * Domain Path:     /languages
- * Version:         4.27.1-hotfix-remove-hidden-checkout-fields.3
+ * Version:         4.27.1
  *
  * @package         Newspack_Blocks
  */
@@ -15,7 +15,7 @@
 define( 'NEWSPACK_BLOCKS__PLUGIN_FILE', __FILE__ );
 define( 'NEWSPACK_BLOCKS__BLOCKS_DIRECTORY', 'dist/' );
 define( 'NEWSPACK_BLOCKS__PLUGIN_DIR', plugin_dir_path( NEWSPACK_BLOCKS__PLUGIN_FILE ) );
-define( 'NEWSPACK_BLOCKS__VERSION', '4.27.1-hotfix-remove-hidden-checkout-fields.3' );
+define( 'NEWSPACK_BLOCKS__VERSION', '4.27.1' );
 
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks.php';
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks-api.php';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@automattic/newspack-blocks",
-	"version": "4.27.1-hotfix-remove-hidden-checkout-fields.3",
+	"version": "4.27.1",
 	"author": "Automattic",
 	"description": "=== Newspack Blocks === Contributors: (this should be a list of wordpress.org userid's) Donate link: https://example.com/ Tags: comments, spam Requires at least: 4.5 Tested up to: 5.1.1 Stable tag: 0.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html",
 	"repository": {

package/vendor/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => 'automattic/newspack-blocks',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => '00dca7576c63715825cba7adf92429fa8a01c0f7',
+        'reference' => '09e001fb8333ae9ab5f7d03c894e9bbeefe3144c',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'automattic/newspack-blocks' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => '00dca7576c63715825cba7adf92429fa8a01c0f7',
+            'reference' => '09e001fb8333ae9ab5f7d03c894e9bbeefe3144c',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),