@automattic/newspack-blocks 4.33.0 → 4.33.1

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## @automattic/newspack-blocks [4.33.1](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.33.0...newspack-blocks@4.33.1) (2026-09-21)
+
+
+### Bug Fixes
+
+* **iframe:** stop lazy-loaded embeds loading the page inside them ([#1115](https://github.com/Automattic/newspack-workspace/issues/1115)) ([bb97d4c](https://github.com/Automattic/newspack-workspace/commit/bb97d4c46864b3260f24b22690bb570eaf91e404))
+
 # @automattic/newspack-blocks [4.33.0](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.32.1...newspack-blocks@4.33.0) (2026-09-18)
 
 

package/dist/iframe/view.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-dom-ready'), 'version' => '0adcb9c939693718d723');
+<?php return array('dependencies' => array('wp-dom-ready'), 'version' => '99e53b29d2f8cbe6ee9e');

package/dist/iframe/view.js

@@ -1 +1 @@
-(()=>{"use strict";var e={n:t=>{var n=t&&t.__esModule?()=>t.default:()=>t;return e.d(n,{a:n}),n},d:(t,n)=>{for(var a in n)e.o(n,a)&&!e.o(t,a)&&Object.defineProperty(t,a,{enumerable:!0,get:n[a]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t)};const t=window.wp.domReady;e.n(t)()(()=>{Array.from(document.querySelectorAll(".wp-block-newspack-blocks-iframe iframe")).forEach(e=>{let t=0;const n=setInterval(()=>{!(e=>{const t=e.contentDocument;return null!==t&&"about:blank"===t.URL})(e)||t>=10?clearInterval(n):(t++,e.contentWindow.location.replace(e.src))},2e3);window.addEventListener("message",function(t){if(t.origin!==new URL(e.src).origin||e.contentWindow!==t.source)return;let n=0;t.data&&t.data.height&&("number"==typeof t.data.height?n=t.data.height:"string"==typeof t.data.height&&(n=Number(t.data.height))),!isNaN(n)&&n>0&&(e.parentElement&&"auto"!==e.parentElement.style.height&&(e.parentElement.style.height="auto"),e.style.height=n+"px")})})})})();
+(()=>{"use strict";var e={n:t=>{var n=t&&t.__esModule?()=>t.default:()=>t;return e.d(n,{a:n}),n},d:(t,n)=>{for(var r in n)e.o(n,r)&&!e.o(t,r)&&Object.defineProperty(t,r,{enumerable:!0,get:n[r]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t)};const t=window.wp.domReady;e.n(t)()(()=>{Array.from(document.querySelectorAll(".wp-block-newspack-blocks-iframe iframe")).forEach(e=>{let t=0;const n=setInterval(()=>{!(e=>Boolean(e.getAttribute("src")))(e)||!(e=>{const t=e.contentDocument;return null!==t&&"about:blank"===t.URL})(e)||t>=10?clearInterval(n):(t++,e.contentWindow.location.replace(e.src))},2e3);window.addEventListener("message",function(t){if(t.origin!==new URL(e.src).origin||e.contentWindow!==t.source)return;let n=0;t.data&&t.data.height&&("number"==typeof t.data.height?n=t.data.height:"string"==typeof t.data.height&&(n=Number(t.data.height))),!isNaN(n)&&n>0&&(e.parentElement&&"auto"!==e.parentElement.style.height&&(e.parentElement.style.height="auto"),e.style.height=n+"px")})})})})();

package/newspack-blocks.php

@@ -7,7 +7,7 @@
  * Author URI:      https://newspack.com/
  * Text Domain:     newspack-blocks
  * Domain Path:     /languages
- * Version:         4.33.0
+ * Version:         4.33.1
  *
  * @package         Newspack_Blocks
  */
@@ -15,7 +15,7 @@
 define( 'NEWSPACK_BLOCKS__PLUGIN_FILE', __FILE__ );
 define( 'NEWSPACK_BLOCKS__BLOCKS_DIRECTORY', 'dist/' );
 define( 'NEWSPACK_BLOCKS__PLUGIN_DIR', plugin_dir_path( NEWSPACK_BLOCKS__PLUGIN_FILE ) );
-define( 'NEWSPACK_BLOCKS__VERSION', '4.33.0' );
+define( 'NEWSPACK_BLOCKS__VERSION', '4.33.1' );
 
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks.php';
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks-api.php';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@automattic/newspack-blocks",
-	"version": "4.33.0",
+	"version": "4.33.1",
 	"author": "Automattic",
 	"description": "=== Newspack Blocks === Contributors: (this should be a list of wordpress.org userid's) Donate link: https://example.com/ Tags: comments, spam Requires at least: 4.5 Tested up to: 5.1.1 Stable tag: 0.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html",
 	"repository": {

package/src/blocks/iframe/view.js

@@ -26,6 +26,18 @@ const isStillBlank = iframe => {
 	return doc !== null && doc.URL === 'about:blank';
 };
 
+/**
+ * Whether the frame has an address of its own to retry. A lazy loader can hold it
+ * back until the frame nears the viewport (perfmatters moves it to data-src). With
+ * no src, iframe.src is '', which location.replace() resolves to this page, and an
+ * empty src attribute reads back as this page's URL. Either way a retry would load
+ * the page inside its own frame, where this script runs again on the copy's frames.
+ *
+ * @param {HTMLIFrameElement} iframe The iframe.
+ * @return {boolean} Whether the frame has a src to load.
+ */
+const hasOwnSrc = iframe => Boolean( iframe.getAttribute( 'src' ) );
+
 /**
  * Re-navigations before giving up on a frame that never loads. A 204 resolves in a
  * retry or two; without a bound, a permanently blank embed keeps requesting for as
@@ -39,10 +51,11 @@ domReady( () => {
 		// Don't wait for the load event: it may have fired before this script ran
 		// (delayed JS). Navigate with location.replace(), since resetting src on a
 		// loaded frame adds a history entry and makes readers press Back twice
-		// (NPPM-3180).
+		// (NPPM-3180). The src check runs on each tick rather than once here, so a
+		// frame a lazy loader fills in before the first tick still gets its retries.
 		let attempts = 0;
 		const retry = setInterval( () => {
-			if ( ! isStillBlank( iframe ) || attempts >= MAX_RETRIES ) {
+			if ( ! hasOwnSrc( iframe ) || ! isStillBlank( iframe ) || attempts >= MAX_RETRIES ) {
 				clearInterval( retry );
 				return;
 			}

package/src/blocks/iframe/view.test.js

@@ -1,6 +1,7 @@
 /**
  * The iframe block's retry (NPPM-3180) must leave a frame that already holds a
- * document alone, and must never reset `src`, which adds a history entry.
+ * document alone, must never reset `src`, which adds a history entry, and must
+ * never navigate a frame with no src of its own, which would load the page inside it.
  */
 
 const SRC = 'https://embed.example.test/widget';
@@ -14,10 +15,12 @@ const SRC = 'https://embed.example.test/widget';
  *                                      null once a cross-origin document has loaded.
  *                                      A detached frame reports null, as does its
  *                                      contentWindow.
+ * @param {string}      attributes      The frame's markup attributes. A lazy loader may have
+ *                                      moved the address out of src.
  * @return {Object} The iframe, its state holder, and the `replace` and `setSrc` spies.
  */
-function renderIframe( contentDocument ) {
-	document.body.innerHTML = `<figure class="wp-block-newspack-blocks-iframe"><div class="wp-block-embed__wrapper"><iframe src="${ SRC }"></iframe></div></figure>`;
+function renderIframe( contentDocument, attributes = `src="${ SRC }"` ) {
+	document.body.innerHTML = `<figure class="wp-block-newspack-blocks-iframe"><div class="wp-block-embed__wrapper"><iframe ${ attributes }></iframe></div></figure>`;
 	const iframe = document.querySelector( 'iframe' );
 	const state = { contentDocument };
 	const replace = jest.fn();
@@ -25,7 +28,12 @@ function renderIframe( contentDocument ) {
 	const contentWindow = { location: { replace } };
 	Object.defineProperty( iframe, 'contentDocument', { configurable: true, get: () => ( iframe.isConnected ? state.contentDocument : null ) } );
 	Object.defineProperty( iframe, 'contentWindow', { configurable: true, get: () => ( iframe.isConnected ? contentWindow : null ) } );
-	Object.defineProperty( iframe, 'src', { configurable: true, get: () => SRC, set: setSrc } );
+	// Read src back as a browser does: '' with no attribute, otherwise the value resolved against the page.
+	Object.defineProperty( iframe, 'src', {
+		configurable: true,
+		get: () => ( iframe.hasAttribute( 'src' ) ? new URL( iframe.getAttribute( 'src' ), document.baseURI ).href : '' ),
+		set: setSrc,
+	} );
 	jest.isolateModules( () => require( './view' ) );
 	return { iframe, state, replace, setSrc };
 }
@@ -73,6 +81,26 @@ describe( 'iframe block view script', () => {
 		expect( setSrc ).not.toHaveBeenCalled();
 	} );
 
+	it.each( [
+		// perfmatters' markup: the address waits in data-src until the frame nears the viewport.
+		[ 'no src', `class="perfmatters-lazy" data-src="${ SRC }"` ],
+		[ 'an empty src', 'src=""' ],
+	] )( 'never navigates a blank frame with %s, which would load this page inside it', ( _, attributes ) => {
+		const { replace, setSrc } = renderIframe( { URL: 'about:blank' }, attributes );
+		jest.advanceTimersByTime( 20000 );
+		expect( replace ).not.toHaveBeenCalled();
+		expect( setSrc ).not.toHaveBeenCalled();
+		expect( jest.getTimerCount() ).toBe( 0 );
+	} );
+
+	it( 'retries a lazy-loaded frame that has its src by the first check', () => {
+		const { iframe, replace } = renderIframe( { URL: 'about:blank' }, `class="perfmatters-lazy" data-src="${ SRC }"` );
+		// The lazy loader copies data-src into src as the frame nears the viewport.
+		iframe.setAttribute( 'src', SRC );
+		jest.advanceTimersByTime( 2000 );
+		expect( replace ).toHaveBeenCalledWith( SRC );
+	} );
+
 	it( 'gives up after 10 attempts on a frame that never loads', () => {
 		const { replace } = renderIframe( { URL: 'about:blank' } );
 		jest.advanceTimersByTime( 20000 );

package/vendor/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => 'automattic/newspack-blocks',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => 'f5456bae41f1968ab4928044aa8c079c93a4ea82',
+        'reference' => 'bb97d4c46864b3260f24b22690bb570eaf91e404',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'automattic/newspack-blocks' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => 'f5456bae41f1968ab4928044aa8c079c93a4ea82',
+            'reference' => 'bb97d4c46864b3260f24b22690bb570eaf91e404',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),