From 417cff4bdc7296047c5c6a377f6988e9f19ab0d3 Mon Sep 17 00:00:00 2001
From: Carlos Bravo <cbravobernal@git.wordpress.org>
Date: Thu, 29 Oct 2026 13:37:06 +0100
Subject: [PATCH 1/9] Block Bindings: Support `innerBlocks` bindings on the
 Group and Column blocks.

A block bindings source can now supply the inner blocks of a Group or Column block through `metadata.bindings.innerBlocks`. The value is serialized block markup, which replaces the block's own inner blocks before they render. An empty string leaves the block without inner blocks, and any other value keeps its own.

The markup is sanitized with `wp_kses_post()`, as bound rich text already is, and its custom CSS is removed. Supplied blocks can't bind their own inner blocks, so that sources can't expand each other forever. The editor isn't offered `innerBlocks` yet, as it doesn't render these bindings.

Backports WordPress/gutenberg#85568.

Fixes #66415.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/block-bindings.php            |   3 +
 src/wp-includes/block-editor.php              |   3 +-
 src/wp-includes/class-wp-block.php            | 153 +++++++++
 .../tests/block-bindings/innerBlocks.php      | 312 ++++++++++++++++++
 4 files changed, 470 insertions(+), 1 deletion(-)
 create mode 100644 tests/phpunit/tests/block-bindings/innerBlocks.php

diff --git a/src/wp-includes/block-bindings.php b/src/wp-includes/block-bindings.php
index 1250f92e99848..7809e05cd4185 100644
--- a/src/wp-includes/block-bindings.php
+++ b/src/wp-includes/block-bindings.php
@@ -138,6 +138,7 @@ function get_block_bindings_source( string $source_name ) {
  * @since 6.9.0
  * @since 7.1.0 Added support for the List Item block.
  * @since 7.2.0 Added support for the Icon block.
+ * @since 7.3.0 Added support for the inner blocks of the Group and Column blocks.
  *
  * @param string $block_type The block type whose supported attributes are being retrieved.
  * @return array The list of block attributes that are supported by block bindings.
@@ -153,6 +154,8 @@ function get_block_bindings_supported_attributes( $block_type ) {
 		'core/navigation-link'    => array( 'url' ),
 		'core/navigation-submenu' => array( 'url' ),
 		'core/icon'               => array( 'icon' ),
+		'core/group'              => array( 'innerBlocks' ),
+		'core/column'             => array( 'innerBlocks' ),
 	);
 
 	$supported_block_attributes =
diff --git a/src/wp-includes/block-editor.php b/src/wp-includes/block-editor.php
index 24bdd2f6db5db..a3d62db114e68 100644
--- a/src/wp-includes/block-editor.php
+++ b/src/wp-includes/block-editor.php
@@ -502,7 +502,8 @@ function get_block_editor_settings( array $custom_settings, $block_editor_contex
 
 	$editor_settings['__experimentalBlockBindingsSupportedAttributes'] = array();
 	foreach ( array_keys( WP_Block_Type_Registry::get_instance()->get_all_registered() ) as $block_type ) {
-		$supported_block_attributes = get_block_bindings_supported_attributes( $block_type );
+		// The editor doesn't render inner blocks bindings yet.
+		$supported_block_attributes = array_values( array_diff( get_block_bindings_supported_attributes( $block_type ), array( 'innerBlocks' ) ) );
 		if ( ! empty( $supported_block_attributes ) ) {
 			$editor_settings['__experimentalBlockBindingsSupportedAttributes'][ $block_type ] = $supported_block_attributes;
 		}
diff --git a/src/wp-includes/class-wp-block.php b/src/wp-includes/class-wp-block.php
index 8baf0f99bacde..6d82a1c13e947 100644
--- a/src/wp-includes/class-wp-block.php
+++ b/src/wp-includes/class-wp-block.php
@@ -273,6 +273,7 @@ public function __get( $name ) {
 	 * @since 6.5.0
 	 * @since 6.6.0 Handle the `__default` attribute for pattern overrides.
 	 * @since 6.7.0 Return any updated bindings metadata in the computed attributes.
+	 * @since 7.3.0 Replace the inner blocks of the block for an `innerBlocks` binding.
 	 *
 	 * @return array The computed block attributes for the provided block bindings.
 	 */
@@ -310,6 +311,10 @@ private function process_block_bindings() {
 			 * resulting array.
 			 */
 			foreach ( $supported_block_attributes as $attribute_name ) {
+				// Inner blocks are only bound explicitly.
+				if ( 'innerBlocks' === $attribute_name && ! isset( $bindings['innerBlocks'] ) ) {
+					continue;
+				}
 				// Retain any non-pattern override bindings that might be present.
 				$updated_bindings[ $attribute_name ] = $bindings[ $attribute_name ] ?? array( 'source' => 'core/pattern-overrides' );
 			}
@@ -351,6 +356,12 @@ private function process_block_bindings() {
 			$source_args  = ! empty( $block_binding['args'] ) && is_array( $block_binding['args'] ) ? $block_binding['args'] : array();
 			$source_value = $block_binding_source->get_value( $source_args, $this, $attribute_name );
 
+			// Inner blocks are blocks, not an attribute.
+			if ( 'innerBlocks' === $attribute_name ) {
+				$this->replace_inner_blocks( $source_value );
+				continue;
+			}
+
 			// If the value is not null, process the HTML based on the block and the attribute.
 			if ( ! is_null( $source_value ) ) {
 				$computed_attributes[ $attribute_name ] = $source_value;
@@ -360,6 +371,148 @@ private function process_block_bindings() {
 		return $computed_attributes;
 	}
 
+	/**
+	 * Replaces the inner blocks of the block with the ones a block bindings
+	 * source supplies, before they render.
+	 *
+	 * The value is serialized block markup. An empty string leaves the block
+	 * without inner blocks. Any other value, like the plain text of a field,
+	 * leaves the block with its own inner blocks.
+	 *
+	 * @since 7.3.0
+	 *
+	 * @global WP_Embed $wp_embed WordPress Embed object.
+	 *
+	 * @param mixed $value The value of the source.
+	 */
+	private function replace_inner_blocks( $value ) {
+		global $wp_embed;
+
+		if ( '' !== $value && ! ( is_string( $value ) && '<!-- wp:' === substr( $value, strspn( $value, " \t\n\f\r" ), 8 ) ) ) {
+			return;
+		}
+
+		/*
+		 * The markup skips the filters that sanitize post content when it's saved,
+		 * and the user who supplied it may not be allowed unfiltered HTML. Like on
+		 * save, this also sanitizes the attributes of the blocks, through the
+		 * `pre_kses` filter.
+		 */
+		$markup = wp_kses_post( $value );
+		if ( $wp_embed instanceof WP_Embed ) {
+			$markup = $wp_embed->autoembed( $markup );
+		}
+		$blocks = self::prepare_bound_inner_blocks( parse_blocks( $markup ) );
+
+		$inner_content = self::get_inner_content_with_slots( $this->parsed_block['innerContent'] ?? null, count( $blocks ) );
+		if ( null === $inner_content ) {
+			return;
+		}
+
+		$this->parsed_block['innerBlocks']  = $blocks;
+		$this->parsed_block['innerContent'] = $inner_content;
+		$this->parsed_block['innerHTML']    = implode( '', array_filter( $inner_content, 'is_string' ) );
+		$this->refresh_parsed_block_dependents();
+		// The refresh keeps the previous inner blocks when there are none.
+		if ( empty( $blocks ) ) {
+			$this->inner_blocks = array();
+		}
+	}
+
+	/**
+	 * Prepares the blocks a block bindings source supplies, and their inner
+	 * blocks, to render.
+	 *
+	 * Removes their `innerBlocks` bindings: none of them gets its inner blocks
+	 * from a source, so that two sources whose values bind each other's can't
+	 * render forever.
+	 *
+	 * Also removes their custom CSS, which only users who can edit CSS may add:
+	 * whoever supplied the value is unknown.
+	 *
+	 * @since 7.3.0
+	 *
+	 * @param array[] $blocks The parsed blocks.
+	 * @return array[] The parsed blocks.
+	 */
+	private static function prepare_bound_inner_blocks( array $blocks ): array {
+		foreach ( $blocks as &$block ) {
+			if ( isset( $block['attrs']['style'] ) ) {
+				$block['attrs']['style'] = wp_strip_custom_css_from_style_array( $block['attrs']['style'] );
+				if ( empty( $block['attrs']['style'] ) ) {
+					unset( $block['attrs']['style'] );
+				}
+			}
+
+			if ( isset( $block['attrs']['metadata']['bindings']['innerBlocks'] ) ) {
+				unset( $block['attrs']['metadata']['bindings']['innerBlocks'] );
+				// Drop what's left empty, as the editor does.
+				if ( empty( $block['attrs']['metadata']['bindings'] ) ) {
+					unset( $block['attrs']['metadata']['bindings'] );
+				}
+				if ( empty( $block['attrs']['metadata'] ) ) {
+					unset( $block['attrs']['metadata'] );
+				}
+			}
+			$block['innerBlocks'] = self::prepare_bound_inner_blocks( $block['innerBlocks'] );
+		}
+		return $blocks;
+	}
+
+	/**
+	 * Returns the inner content of a block with slots for the given number of
+	 * inner blocks, where its own inner blocks were.
+	 *
+	 * @since 7.3.0
+	 *
+	 * @param array|null $inner_content The inner content of the block.
+	 * @param int        $count         The number of inner blocks.
+	 * @return array|null The inner content, or null if there's no element to put
+	 *                    the inner blocks in.
+	 */
+	private static function get_inner_content_with_slots( $inner_content, int $count ): ?array {
+		if ( ! is_array( $inner_content ) ) {
+			return null;
+		}
+
+		// Keeps the HTML around the block's own inner blocks as it is, and drops
+		// the HTML between them.
+		$slots = array_keys( $inner_content, null, true );
+		if ( $slots ) {
+			return array_merge(
+				array_slice( $inner_content, 0, $slots[0] ),
+				array_fill( 0, $count, null ),
+				array_slice( $inner_content, end( $slots ) + 1 )
+			);
+		}
+
+		/*
+		 * Without any, the block wraps them in one element, so they go before its
+		 * closer. Serializes the HTML token by token, as
+		 * `WP_HTML_Processor::serialize()` does, and starts the second part there.
+		 */
+		$processor = WP_HTML_Processor::create_fragment( implode( '', $inner_content ) );
+		if ( null === $processor ) {
+			return null;
+		}
+		$parts        = array( '', '' );
+		$part         = 0;
+		$closer_depth = null;
+		while ( $processor->next_token() ) {
+			if ( null === $closer_depth && '#tag' === $processor->get_token_type() && ! $processor->is_tag_closer() ) {
+				// A closer is visited at the depth of the element that contains it.
+				$closer_depth = $processor->get_current_depth() - 1;
+			} elseif ( 0 === $part && $processor->is_tag_closer() && $processor->get_current_depth() === $closer_depth ) {
+				$part = 1;
+			}
+			$parts[ $part ] .= $processor->serialize_token();
+		}
+		if ( 1 !== $part || null !== $processor->get_last_error() || $processor->paused_at_incomplete_token() ) {
+			return null;
+		}
+		return array_merge( array( $parts[0] ), array_fill( 0, $count, null ), array( $parts[1] ) );
+	}
+
 	/**
 	 * Depending on the block attribute name, replace its value in the HTML based on the value provided.
 	 *
diff --git a/tests/phpunit/tests/block-bindings/innerBlocks.php b/tests/phpunit/tests/block-bindings/innerBlocks.php
new file mode 100644
index 0000000000000..2ebecc14c0f7d
--- /dev/null
+++ b/tests/phpunit/tests/block-bindings/innerBlocks.php
@@ -0,0 +1,312 @@
+<?php
+/**
+ * Tests for the inner blocks bindings of the Group and Column blocks.
+ *
+ * @package WordPress
+ * @subpackage Blocks
+ * @since 7.3.0
+ *
+ * @group blocks
+ * @group block-bindings
+ *
+ * @covers WP_Block::process_block_bindings
+ * @covers WP_Block::replace_inner_blocks
+ */
+class Tests_Block_Bindings_InnerBlocks extends WP_UnitTestCase {
+
+	const SOURCE = 'test/inner-blocks';
+
+	/**
+	 * The value the test source returns for `innerBlocks`.
+	 *
+	 * @var mixed
+	 */
+	private $value;
+
+	public function set_up() {
+		parent::set_up();
+		$this->value = null;
+		register_block_bindings_source(
+			self::SOURCE,
+			array(
+				'label'              => 'Test',
+				'get_value_callback' => function ( $source_args, $block_instance, $attribute_name ) {
+					return 'innerBlocks' === $attribute_name ? $this->value : 'Bound text';
+				},
+			)
+		);
+	}
+
+	public function tear_down() {
+		unregister_block_bindings_source( self::SOURCE );
+		parent::tear_down();
+	}
+
+	/**
+	 * Renders a Group block with the given bindings and, by default, a
+	 * `Default` paragraph as its own inner blocks.
+	 *
+	 * @param array|null $bindings   The bindings of the Group block.
+	 * @param string     $inner_html The markup inside the Group's wrapper.
+	 * @return string The rendered block.
+	 */
+	private function render_group( $bindings = null, $inner_html = '<!-- wp:paragraph --><p>Default</p><!-- /wp:paragraph -->' ) {
+		$bindings = $bindings ?? array( 'innerBlocks' => array( 'source' => self::SOURCE ) );
+		$markup   = '<!-- wp:group {"metadata":{"bindings":' . wp_json_encode( $bindings ) . '}} -->';
+		$markup  .= '<div class="wp-block-group">' . $inner_html . '</div>';
+		$markup  .= '<!-- /wp:group -->';
+		$block    = new WP_Block( parse_blocks( $markup )[0] );
+		return $block->render();
+	}
+
+	/**
+	 * Returns the attributes the supplied blocks render with.
+	 *
+	 * @return array[] The attributes of each rendered block, in render order.
+	 */
+	private function render_group_and_get_supplied_attributes() {
+		$attributes = array();
+		$capture    = static function ( $parsed_block, $source_block, $parent_block ) use ( &$attributes ) {
+			if ( $parent_block ) {
+				$attributes[] = $parsed_block['attrs'];
+			}
+			return $parsed_block;
+		};
+		add_filter( 'render_block_data', $capture, 10, 3 );
+		$this->render_group();
+		remove_filter( 'render_block_data', $capture );
+		return $attributes;
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_replaces_inner_blocks() {
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph --><!-- wp:paragraph --><p>Two</p><!-- /wp:paragraph -->';
+		$output      = $this->render_group();
+		$this->assertMatchesRegularExpression( '#>One</p><p[^>]*>Two</p></div></div>$#', $output );
+		$this->assertStringNotContainsString( 'Default', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_may_start_with_whitespace() {
+		$this->value = "\n\t<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->";
+		$this->assertStringContainsString( '>One</p>', $this->render_group() );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_empty_value_removes_inner_blocks() {
+		$this->value = '';
+		$output      = $this->render_group();
+		$this->assertStringNotContainsString( '<p', $output );
+		$this->assertStringContainsString( 'wp-block-group', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_without_value_keeps_own_inner_blocks() {
+		$this->assertStringContainsString( '>Default</p>', $this->render_group() );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_plain_text_value_keeps_own_inner_blocks() {
+		$this->value = 'Plain text';
+		$output      = $this->render_group();
+		$this->assertStringContainsString( '>Default</p>', $output );
+		$this->assertStringNotContainsString( 'Plain text', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_does_not_become_an_attribute() {
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		$block       = new WP_Block( parse_blocks( '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/inner-blocks"}}}} --><div class="wp-block-group"></div><!-- /wp:group -->' )[0] );
+		$block->render();
+		$this->assertArrayNotHasKey( 'innerBlocks', $block->attributes );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_default_pattern_overrides_binding_does_not_bind_inner_blocks() {
+		$requested = array();
+		$record    = static function ( $value, $source_name, $source_args, $block_instance, $attribute_name ) use ( &$requested ) {
+			$requested[] = $attribute_name;
+			return $value;
+		};
+		add_filter( 'block_bindings_source_value', $record, 10, 5 );
+		$output = $this->render_group( array( '__default' => array( 'source' => 'core/pattern-overrides' ) ) );
+		remove_filter( 'block_bindings_source_value', $record );
+
+		$this->assertNotContains( 'innerBlocks', $requested );
+		$this->assertStringContainsString( '>Default</p>', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_is_sanitized() {
+		$this->value = '<!-- wp:html --><script>alert(1)</script><p>Safe</p><!-- /wp:html -->';
+		$output      = $this->render_group();
+		$this->assertStringNotContainsString( '<script>', $output );
+		$this->assertStringContainsString( '<p>Safe</p>', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_block_attributes_in_the_value_are_sanitized() {
+		$this->value = '<!-- wp:paragraph {"className":"<img src=x onerror=alert(1)>"} --><p>Safe</p><!-- /wp:paragraph -->';
+		$output      = $this->render_group();
+		$this->assertStringNotContainsString( 'onerror', $output );
+		$this->assertStringContainsString( '>Safe</p>', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_bindings_to_the_same_source_inside_the_value_are_ignored() {
+		// The supplied Group is bound to the same source, which would expand forever.
+		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>Nested own</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
+		$output      = $this->render_group();
+		$this->assertStringContainsString( '>Nested own</p>', $output );
+		$this->assertSame( 2, substr_count( $output, '<div class="wp-block-group">' ) );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_sources_binding_each_other_render_once() {
+		register_block_bindings_source(
+			'test/other-inner-blocks',
+			array(
+				'label'              => 'Test',
+				'get_value_callback' => static function () {
+					return '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>From other</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
+				},
+			)
+		);
+		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/other-inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>From test</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
+		$output      = $this->render_group();
+		unregister_block_bindings_source( 'test/other-inner-blocks' );
+
+		// The supplied Group keeps its own inner blocks instead of asking the other source.
+		$this->assertStringContainsString( '>From test</p>', $output );
+		$this->assertStringNotContainsString( 'From other', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_attribute_bindings_inside_the_value_are_kept() {
+		$this->value = '<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"test/inner-blocks"}}}} --><p>One</p><!-- /wp:paragraph -->';
+		$this->assertStringContainsString( '>Bound text</p>', $this->render_group() );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_removed_bindings_leave_no_empty_metadata() {
+		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/inner-blocks"}}}} --><div class="wp-block-group"></div><!-- /wp:group -->';
+		$attributes  = $this->render_group_and_get_supplied_attributes();
+		$this->assertArrayNotHasKey( 'metadata', $attributes[0] );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_custom_css_in_the_value_is_removed() {
+		$this->value = '<!-- wp:paragraph {"style":{"css":"color:red","color":{"text":"#00f"},":hover":{"css":"color:green"}}} --><p>Styled</p><!-- /wp:paragraph -->';
+		$attributes  = $this->render_group_and_get_supplied_attributes();
+		$this->assertSame( array( 'color' => array( 'text' => '#00f' ) ), $attributes[0]['style'] );
+		$this->assertStringNotContainsString( 'wp-custom-css-', $this->render_group() );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_nested_custom_css_in_the_value_is_removed() {
+		$this->value = '<!-- wp:group --><div class="wp-block-group"><!-- wp:paragraph {"style":{"@mobile":{":hover":{"css":"color:red"}}}} --><p>Styled</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
+		$output      = $this->render_group();
+		$this->assertStringNotContainsString( 'wp-custom-css-', $output );
+		$this->assertStringContainsString( '>Styled</p>', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_goes_where_the_own_inner_blocks_were() {
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		$output      = $this->render_group( null, '<!-- wp:paragraph --><p>Default</p><!-- /wp:paragraph --><span>Tail</span>' );
+		$this->assertMatchesRegularExpression( '#>One</p><span>Tail</span>#', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_goes_inside_the_inner_container_of_a_legacy_group() {
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		$output      = $this->render_group( null, '<div class="wp-block-group__inner-container"><!-- wp:paragraph --><p>Default</p><!-- /wp:paragraph --></div>' );
+		$this->assertMatchesRegularExpression( '#<div class="wp-block-group__inner-container[^"]*">\s*<p[^>]*>One</p>\s*</div></div>$#', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_goes_inside_an_empty_group() {
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		// Classic themes get an inner container from `wp_restore_group_inner_container()`.
+		$this->assertMatchesRegularExpression( '#^<div class="wp-block-group[^"]*">(<div class="wp-block-group__inner-container[^"]*">)?\s*<p[^>]*>One</p>\s*(</div>)?</div>$#', $this->render_group( null, '' ) );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_goes_before_the_closer_of_a_wrapper_with_unclosed_elements() {
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		$this->assertMatchesRegularExpression( '#<p>Tail</p><p[^>]*>One</p>\s*</div>#', $this->render_group( null, '<p>Tail' ) );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_is_skipped_without_markup_to_place_it_in() {
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		$output      = render_block(
+			array(
+				'blockName'   => 'core/group',
+				'attrs'       => array( 'metadata' => array( 'bindings' => array( 'innerBlocks' => array( 'source' => self::SOURCE ) ) ) ),
+				'innerBlocks' => array(),
+			)
+		);
+		$this->assertSame( '', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_column_supports_inner_blocks_bindings() {
+		$this->assertContains( 'innerBlocks', get_block_bindings_supported_attributes( 'core/column' ) );
+		$this->assertContains( 'innerBlocks', get_block_bindings_supported_attributes( 'core/group' ) );
+	}
+
+	/**
+	 * @ticket 66415
+	 *
+	 * @covers ::get_block_editor_settings
+	 */
+	public function test_editor_does_not_offer_inner_blocks_bindings() {
+		$settings = get_block_editor_settings( array(), new WP_Block_Editor_Context() );
+		$this->assertArrayNotHasKey( 'core/group', $settings['__experimentalBlockBindingsSupportedAttributes'] );
+		$this->assertArrayNotHasKey( 'core/column', $settings['__experimentalBlockBindingsSupportedAttributes'] );
+		$this->assertSame( array( 'content' ), $settings['__experimentalBlockBindingsSupportedAttributes']['core/paragraph'] );
+	}
+}

From 818d554ebf92a21c648d79253ed9e556968cb2e6 Mon Sep 17 00:00:00 2001
From: Carlos Bravo <cbravobernal@git.wordpress.org>
Date: Thu, 29 Oct 2026 16:09:27 +0100
Subject: [PATCH 2/9] Block Bindings: Keep `$inner_blocks` a `WP_Block_List`
 when a binding has no blocks.

The property is declared as a `WP_Block_List`, so assigning an empty array
fails PHPStan's `assign.propertyType` check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/class-wp-block.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/class-wp-block.php b/src/wp-includes/class-wp-block.php
index 6d82a1c13e947..c30fa6a273622 100644
--- a/src/wp-includes/class-wp-block.php
+++ b/src/wp-includes/class-wp-block.php
@@ -415,7 +415,7 @@ private function replace_inner_blocks( $value ) {
 		$this->refresh_parsed_block_dependents();
 		// The refresh keeps the previous inner blocks when there are none.
 		if ( empty( $blocks ) ) {
-			$this->inner_blocks = array();
+			$this->inner_blocks = new WP_Block_List( array() );
 		}
 	}
 

From 253c907c421ed397ef42431c54ea8e4fabf6056a Mon Sep 17 00:00:00 2001
From: Carlos Bravo <cbravobernal@git.wordpress.org>
Date: Thu, 29 Oct 2026 16:34:30 +0100
Subject: [PATCH 3/9] Block Bindings: Render `[embed]` shortcodes in bound
 inner blocks.

Bound inner blocks render inside `do_blocks()`, after `WP_Embed` has run its
`[embed]` shortcode on the content, like the synced pattern block does for
its own content.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/class-wp-block.php               |  1 +
 .../phpunit/tests/block-bindings/innerBlocks.php | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/src/wp-includes/class-wp-block.php b/src/wp-includes/class-wp-block.php
index c30fa6a273622..3f7f6ae268a68 100644
--- a/src/wp-includes/class-wp-block.php
+++ b/src/wp-includes/class-wp-block.php
@@ -400,6 +400,7 @@ private function replace_inner_blocks( $value ) {
 		 */
 		$markup = wp_kses_post( $value );
 		if ( $wp_embed instanceof WP_Embed ) {
+			$markup = $wp_embed->run_shortcode( $markup );
 			$markup = $wp_embed->autoembed( $markup );
 		}
 		$blocks = self::prepare_bound_inner_blocks( parse_blocks( $markup ) );
diff --git a/tests/phpunit/tests/block-bindings/innerBlocks.php b/tests/phpunit/tests/block-bindings/innerBlocks.php
index 2ebecc14c0f7d..69504d2524419 100644
--- a/tests/phpunit/tests/block-bindings/innerBlocks.php
+++ b/tests/phpunit/tests/block-bindings/innerBlocks.php
@@ -309,4 +309,20 @@ public function test_editor_does_not_offer_inner_blocks_bindings() {
 		$this->assertArrayNotHasKey( 'core/column', $settings['__experimentalBlockBindingsSupportedAttributes'] );
 		$this->assertSame( array( 'content' ), $settings['__experimentalBlockBindingsSupportedAttributes']['core/paragraph'] );
 	}
+
+	public function test_embeds_in_the_value_are_rendered() {
+		wp_embed_register_handler(
+			'test-inner-blocks',
+			'#https://example\.org/video/(\w+)#',
+			static function ( $matches ) {
+				return '<span class="test-embed">' . $matches[1] . '</span>';
+			}
+		);
+		$this->value = '<!-- wp:paragraph --><p>[embed]https://example.org/video/one[/embed]</p><!-- /wp:paragraph --><!-- wp:paragraph --><p>https://example.org/video/two</p><!-- /wp:paragraph -->';
+		$output      = $this->render_group();
+		wp_embed_unregister_handler( 'test-inner-blocks' );
+
+		$this->assertStringContainsString( '<span class="test-embed">one</span>', $output );
+		$this->assertStringContainsString( '<span class="test-embed">two</span>', $output );
+	}
 }

From 9200865308cfaab2ec9503c7f2983706d10a0b17 Mon Sep 17 00:00:00 2001
From: Carlos Bravo <cbravobernal@git.wordpress.org>
Date: Fri, 30 Oct 2026 13:50:39 +0100
Subject: [PATCH 4/9] Block Bindings: Split the inner blocks bindings into
 named methods.

Moves the explanations into docblocks, and tests that the embeds of the
value survive sanitizing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/wp-includes/block-editor.php              |   3 +-
 src/wp-includes/class-wp-block.php            | 155 +++++++++++-------
 .../tests/block-bindings/innerBlocks.php      |  11 +-
 3 files changed, 107 insertions(+), 62 deletions(-)

diff --git a/src/wp-includes/block-editor.php b/src/wp-includes/block-editor.php
index a3d62db114e68..caf4d7d38db59 100644
--- a/src/wp-includes/block-editor.php
+++ b/src/wp-includes/block-editor.php
@@ -485,6 +485,8 @@ function wp_get_post_content_block_attributes() {
  * Returns the contextualized block editor settings for a selected editor context.
  *
  * @since 5.8.0
+ * @since 7.3.0 Leaves `innerBlocks` out of the attributes that block bindings support,
+ *              as the editor doesn't render its bindings yet.
  *
  * @param array                   $custom_settings      Custom settings to use with the given editor type.
  * @param WP_Block_Editor_Context $block_editor_context The current block editor context.
@@ -502,7 +504,6 @@ function get_block_editor_settings( array $custom_settings, $block_editor_contex
 
 	$editor_settings['__experimentalBlockBindingsSupportedAttributes'] = array();
 	foreach ( array_keys( WP_Block_Type_Registry::get_instance()->get_all_registered() ) as $block_type ) {
-		// The editor doesn't render inner blocks bindings yet.
 		$supported_block_attributes = array_values( array_diff( get_block_bindings_supported_attributes( $block_type ), array( 'innerBlocks' ) ) );
 		if ( ! empty( $supported_block_attributes ) ) {
 			$editor_settings['__experimentalBlockBindingsSupportedAttributes'][ $block_type ] = $supported_block_attributes;
diff --git a/src/wp-includes/class-wp-block.php b/src/wp-includes/class-wp-block.php
index 3f7f6ae268a68..5aca12dc62186 100644
--- a/src/wp-includes/class-wp-block.php
+++ b/src/wp-includes/class-wp-block.php
@@ -273,7 +273,8 @@ public function __get( $name ) {
 	 * @since 6.5.0
 	 * @since 6.6.0 Handle the `__default` attribute for pattern overrides.
 	 * @since 6.7.0 Return any updated bindings metadata in the computed attributes.
-	 * @since 7.3.0 Replace the inner blocks of the block for an `innerBlocks` binding.
+	 * @since 7.3.0 Replace the inner blocks of the block for an `innerBlocks` binding,
+	 *              which the `__default` binding doesn't add.
 	 *
 	 * @return array The computed block attributes for the provided block bindings.
 	 */
@@ -311,7 +312,6 @@ private function process_block_bindings() {
 			 * resulting array.
 			 */
 			foreach ( $supported_block_attributes as $attribute_name ) {
-				// Inner blocks are only bound explicitly.
 				if ( 'innerBlocks' === $attribute_name && ! isset( $bindings['innerBlocks'] ) ) {
 					continue;
 				}
@@ -356,7 +356,6 @@ private function process_block_bindings() {
 			$source_args  = ! empty( $block_binding['args'] ) && is_array( $block_binding['args'] ) ? $block_binding['args'] : array();
 			$source_value = $block_binding_source->get_value( $source_args, $this, $attribute_name );
 
-			// Inner blocks are blocks, not an attribute.
 			if ( 'innerBlocks' === $attribute_name ) {
 				$this->replace_inner_blocks( $source_value );
 				continue;
@@ -375,36 +374,16 @@ private function process_block_bindings() {
 	 * Replaces the inner blocks of the block with the ones a block bindings
 	 * source supplies, before they render.
 	 *
-	 * The value is serialized block markup. An empty string leaves the block
-	 * without inner blocks. Any other value, like the plain text of a field,
-	 * leaves the block with its own inner blocks.
-	 *
 	 * @since 7.3.0
 	 *
-	 * @global WP_Embed $wp_embed WordPress Embed object.
-	 *
 	 * @param mixed $value The value of the source.
 	 */
 	private function replace_inner_blocks( $value ) {
-		global $wp_embed;
-
-		if ( '' !== $value && ! ( is_string( $value ) && '<!-- wp:' === substr( $value, strspn( $value, " \t\n\f\r" ), 8 ) ) ) {
+		if ( ! self::is_inner_blocks_value( $value ) ) {
 			return;
 		}
 
-		/*
-		 * The markup skips the filters that sanitize post content when it's saved,
-		 * and the user who supplied it may not be allowed unfiltered HTML. Like on
-		 * save, this also sanitizes the attributes of the blocks, through the
-		 * `pre_kses` filter.
-		 */
-		$markup = wp_kses_post( $value );
-		if ( $wp_embed instanceof WP_Embed ) {
-			$markup = $wp_embed->run_shortcode( $markup );
-			$markup = $wp_embed->autoembed( $markup );
-		}
-		$blocks = self::prepare_bound_inner_blocks( parse_blocks( $markup ) );
-
+		$blocks        = self::parse_bound_inner_blocks( $value );
 		$inner_content = self::get_inner_content_with_slots( $this->parsed_block['innerContent'] ?? null, count( $blocks ) );
 		if ( null === $inner_content ) {
 			return;
@@ -413,11 +392,52 @@ private function replace_inner_blocks( $value ) {
 		$this->parsed_block['innerBlocks']  = $blocks;
 		$this->parsed_block['innerContent'] = $inner_content;
 		$this->parsed_block['innerHTML']    = implode( '', array_filter( $inner_content, 'is_string' ) );
+		$this->inner_blocks                 = new WP_Block_List( array() );
 		$this->refresh_parsed_block_dependents();
-		// The refresh keeps the previous inner blocks when there are none.
-		if ( empty( $blocks ) ) {
-			$this->inner_blocks = new WP_Block_List( array() );
+	}
+
+	/**
+	 * Determines whether the value of a block bindings source supplies inner
+	 * blocks.
+	 *
+	 * Serialized block markup supplies them, and an empty string supplies none.
+	 * Any other value, like the plain text of a field, leaves the block with its
+	 * own inner blocks.
+	 *
+	 * @since 7.3.0
+	 *
+	 * @param mixed $value The value of the source.
+	 * @return bool Whether the value supplies inner blocks.
+	 */
+	private static function is_inner_blocks_value( $value ): bool {
+		return '' === $value || ( is_string( $value ) && str_starts_with( ltrim( $value, " \t\n\f\r" ), '<!-- wp:' ) );
+	}
+
+	/**
+	 * Parses the inner blocks a block bindings source supplies.
+	 *
+	 * The markup never went through the filters that sanitize post content on
+	 * save, and the user who supplied it may not be allowed unfiltered HTML, so
+	 * it is sanitized as on save, attributes of its blocks included. Its embeds
+	 * are expanded as the embeds of the content were, before its blocks render.
+	 *
+	 * @since 7.3.0
+	 *
+	 * @global WP_Embed $wp_embed WordPress Embed object.
+	 *
+	 * @param string $markup The serialized blocks.
+	 * @return array[] The parsed blocks.
+	 */
+	private static function parse_bound_inner_blocks( string $markup ): array {
+		global $wp_embed;
+
+		$markup = wp_kses_post( $markup );
+		if ( $wp_embed instanceof WP_Embed ) {
+			$markup = $wp_embed->run_shortcode( $markup );
+			$markup = $wp_embed->autoembed( $markup );
 		}
+
+		return self::prepare_bound_inner_blocks( parse_blocks( $markup ) );
 	}
 
 	/**
@@ -426,7 +446,8 @@ private function replace_inner_blocks( $value ) {
 	 *
 	 * Removes their `innerBlocks` bindings: none of them gets its inner blocks
 	 * from a source, so that two sources whose values bind each other's can't
-	 * render forever.
+	 * render forever. Removes the bindings and metadata this leaves empty, as
+	 * the editor does.
 	 *
 	 * Also removes their custom CSS, which only users who can edit CSS may add:
 	 * whoever supplied the value is unknown.
@@ -447,7 +468,6 @@ private static function prepare_bound_inner_blocks( array $blocks ): array {
 
 			if ( isset( $block['attrs']['metadata']['bindings']['innerBlocks'] ) ) {
 				unset( $block['attrs']['metadata']['bindings']['innerBlocks'] );
-				// Drop what's left empty, as the editor does.
 				if ( empty( $block['attrs']['metadata']['bindings'] ) ) {
 					unset( $block['attrs']['metadata']['bindings'] );
 				}
@@ -462,7 +482,11 @@ private static function prepare_bound_inner_blocks( array $blocks ): array {
 
 	/**
 	 * Returns the inner content of a block with slots for the given number of
-	 * inner blocks, where its own inner blocks were.
+	 * inner blocks.
+	 *
+	 * The slots replace the block's own inner blocks and the HTML between them.
+	 * A block without inner blocks gets them before the closing tag of the
+	 * element that wraps its content.
 	 *
 	 * @since 7.3.0
 	 *
@@ -476,42 +500,59 @@ private static function get_inner_content_with_slots( $inner_content, int $count
 			return null;
 		}
 
-		// Keeps the HTML around the block's own inner blocks as it is, and drops
-		// the HTML between them.
-		$slots = array_keys( $inner_content, null, true );
-		if ( $slots ) {
-			return array_merge(
-				array_slice( $inner_content, 0, $slots[0] ),
-				array_fill( 0, $count, null ),
-				array_slice( $inner_content, end( $slots ) + 1 )
-			);
+		$slots     = array_fill( 0, $count, null );
+		$own_slots = array_keys( $inner_content, null, true );
+		if ( $own_slots ) {
+			$before_first_slot = array_slice( $inner_content, 0, $own_slots[0] );
+			$after_last_slot   = array_slice( $inner_content, end( $own_slots ) + 1 );
+			return array_merge( $before_first_slot, $slots, $after_last_slot );
 		}
 
-		/*
-		 * Without any, the block wraps them in one element, so they go before its
-		 * closer. Serializes the HTML token by token, as
-		 * `WP_HTML_Processor::serialize()` does, and starts the second part there.
-		 */
-		$processor = WP_HTML_Processor::create_fragment( implode( '', $inner_content ) );
+		$wrapper_parts = self::split_at_wrapper_closer( implode( '', $inner_content ) );
+		if ( null === $wrapper_parts ) {
+			return null;
+		}
+		return array_merge( array( $wrapper_parts[0] ), $slots, array( $wrapper_parts[1] ) );
+	}
+
+	/**
+	 * Splits the HTML of an element that wraps a block's content before the
+	 * element's closing tag.
+	 *
+	 * @since 7.3.0
+	 *
+	 * @param string $html The HTML of the wrapper element.
+	 * @return string[]|null The HTML before the closing tag and the HTML from it,
+	 *                       or null if the HTML has no wrapper element to split.
+	 */
+	private static function split_at_wrapper_closer( string $html ): ?array {
+		$processor = WP_HTML_Processor::create_fragment( $html );
 		if ( null === $processor ) {
 			return null;
 		}
-		$parts        = array( '', '' );
-		$part         = 0;
-		$closer_depth = null;
+
+		$before                = '';
+		$after                 = '';
+		$depth_outside_wrapper = null;
+		$is_at_wrapper_closer  = false;
 		while ( $processor->next_token() ) {
-			if ( null === $closer_depth && '#tag' === $processor->get_token_type() && ! $processor->is_tag_closer() ) {
-				// A closer is visited at the depth of the element that contains it.
-				$closer_depth = $processor->get_current_depth() - 1;
-			} elseif ( 0 === $part && $processor->is_tag_closer() && $processor->get_current_depth() === $closer_depth ) {
-				$part = 1;
+			if ( null === $depth_outside_wrapper && '#tag' === $processor->get_token_type() && ! $processor->is_tag_closer() ) {
+				$depth_outside_wrapper = $processor->get_current_depth() - 1;
+			} elseif ( $processor->is_tag_closer() && $processor->get_current_depth() === $depth_outside_wrapper ) {
+				$is_at_wrapper_closer = true;
+			}
+
+			if ( $is_at_wrapper_closer ) {
+				$after .= $processor->serialize_token();
+			} else {
+				$before .= $processor->serialize_token();
 			}
-			$parts[ $part ] .= $processor->serialize_token();
 		}
-		if ( 1 !== $part || null !== $processor->get_last_error() || $processor->paused_at_incomplete_token() ) {
+
+		if ( ! $is_at_wrapper_closer || null !== $processor->get_last_error() || $processor->paused_at_incomplete_token() ) {
 			return null;
 		}
-		return array_merge( array( $parts[0] ), array_fill( 0, $count, null ), array( $parts[1] ) );
+		return array( $before, $after );
 	}
 
 	/**
diff --git a/tests/phpunit/tests/block-bindings/innerBlocks.php b/tests/phpunit/tests/block-bindings/innerBlocks.php
index 69504d2524419..d859022f2b7b7 100644
--- a/tests/phpunit/tests/block-bindings/innerBlocks.php
+++ b/tests/phpunit/tests/block-bindings/innerBlocks.php
@@ -164,7 +164,7 @@ public function test_value_is_sanitized() {
 	 * @ticket 66415
 	 */
 	public function test_block_attributes_in_the_value_are_sanitized() {
-		$this->value = '<!-- wp:paragraph {"className":"<img src=x onerror=alert(1)>"} --><p>Safe</p><!-- /wp:paragraph -->';
+		$this->value = '<!-- wp:paragraph {"className":"\u003cimg src=x onerror=alert(1)\u003e"} --><p>Safe</p><!-- /wp:paragraph -->';
 		$output      = $this->render_group();
 		$this->assertStringNotContainsString( 'onerror', $output );
 		$this->assertStringContainsString( '>Safe</p>', $output );
@@ -310,19 +310,22 @@ public function test_editor_does_not_offer_inner_blocks_bindings() {
 		$this->assertSame( array( 'content' ), $settings['__experimentalBlockBindingsSupportedAttributes']['core/paragraph'] );
 	}
 
+	/**
+	 * @ticket 66415
+	 */
 	public function test_embeds_in_the_value_are_rendered() {
 		wp_embed_register_handler(
 			'test-inner-blocks',
 			'#https://example\.org/video/(\w+)#',
 			static function ( $matches ) {
-				return '<span class="test-embed">' . $matches[1] . '</span>';
+				return '<iframe class="test-embed" src="https://example.org/embed/' . $matches[1] . '"></iframe>';
 			}
 		);
 		$this->value = '<!-- wp:paragraph --><p>[embed]https://example.org/video/one[/embed]</p><!-- /wp:paragraph --><!-- wp:paragraph --><p>https://example.org/video/two</p><!-- /wp:paragraph -->';
 		$output      = $this->render_group();
 		wp_embed_unregister_handler( 'test-inner-blocks' );
 
-		$this->assertStringContainsString( '<span class="test-embed">one</span>', $output );
-		$this->assertStringContainsString( '<span class="test-embed">two</span>', $output );
+		$this->assertStringContainsString( '<iframe class="test-embed" src="https://example.org/embed/one"></iframe>', $output );
+		$this->assertStringContainsString( '<iframe class="test-embed" src="https://example.org/embed/two"></iframe>', $output );
 	}
 }

From 14c554dbc0ff9f55d018441278a7f7fd63ab75bd Mon Sep 17 00:00:00 2001
From: Carlos Bravo <cbravobernal@git.wordpress.org>
Date: Fri, 30 Oct 2026 13:53:46 +0100
Subject: [PATCH 5/9] Block Bindings: Use block comments in the inner blocks
 bindings tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/phpunit/tests/block-bindings/innerBlocks.php | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tests/phpunit/tests/block-bindings/innerBlocks.php b/tests/phpunit/tests/block-bindings/innerBlocks.php
index d859022f2b7b7..1edba7a927640 100644
--- a/tests/phpunit/tests/block-bindings/innerBlocks.php
+++ b/tests/phpunit/tests/block-bindings/innerBlocks.php
@@ -174,7 +174,9 @@ public function test_block_attributes_in_the_value_are_sanitized() {
 	 * @ticket 66415
 	 */
 	public function test_bindings_to_the_same_source_inside_the_value_are_ignored() {
-		// The supplied Group is bound to the same source, which would expand forever.
+		/*
+		 * The supplied Group is bound to the same source, which would expand forever.
+		 */
 		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>Nested own</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
 		$output      = $this->render_group();
 		$this->assertStringContainsString( '>Nested own</p>', $output );
@@ -198,7 +200,9 @@ public function test_sources_binding_each_other_render_once() {
 		$output      = $this->render_group();
 		unregister_block_bindings_source( 'test/other-inner-blocks' );
 
-		// The supplied Group keeps its own inner blocks instead of asking the other source.
+		/*
+		 * The supplied Group keeps its own inner blocks instead of asking the other source.
+		 */
 		$this->assertStringContainsString( '>From test</p>', $output );
 		$this->assertStringNotContainsString( 'From other', $output );
 	}
@@ -263,7 +267,9 @@ public function test_value_goes_inside_the_inner_container_of_a_legacy_group() {
 	 */
 	public function test_value_goes_inside_an_empty_group() {
 		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
-		// Classic themes get an inner container from `wp_restore_group_inner_container()`.
+		/*
+		 * Classic themes get an inner container from `wp_restore_group_inner_container()`.
+		 */
 		$this->assertMatchesRegularExpression( '#^<div class="wp-block-group[^"]*">(<div class="wp-block-group__inner-container[^"]*">)?\s*<p[^>]*>One</p>\s*(</div>)?</div>$#', $this->render_group( null, '' ) );
 	}
 

From c7e29523c18eae77fa9c8e3ae30e55b74d24ab64 Mon Sep 17 00:00:00 2001
From: Carlos Bravo <cbravobernal@git.wordpress.org>
Date: Fri, 30 Oct 2026 16:16:45 +0100
Subject: [PATCH 6/9] Block Bindings: Remove inline comments from the inner
 blocks bindings tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/phpunit/tests/block-bindings/innerBlocks.php | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/tests/phpunit/tests/block-bindings/innerBlocks.php b/tests/phpunit/tests/block-bindings/innerBlocks.php
index 1edba7a927640..237c3b36ca640 100644
--- a/tests/phpunit/tests/block-bindings/innerBlocks.php
+++ b/tests/phpunit/tests/block-bindings/innerBlocks.php
@@ -174,9 +174,6 @@ public function test_block_attributes_in_the_value_are_sanitized() {
 	 * @ticket 66415
 	 */
 	public function test_bindings_to_the_same_source_inside_the_value_are_ignored() {
-		/*
-		 * The supplied Group is bound to the same source, which would expand forever.
-		 */
 		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>Nested own</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
 		$output      = $this->render_group();
 		$this->assertStringContainsString( '>Nested own</p>', $output );
@@ -199,10 +196,6 @@ public function test_sources_binding_each_other_render_once() {
 		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/other-inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>From test</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
 		$output      = $this->render_group();
 		unregister_block_bindings_source( 'test/other-inner-blocks' );
-
-		/*
-		 * The supplied Group keeps its own inner blocks instead of asking the other source.
-		 */
 		$this->assertStringContainsString( '>From test</p>', $output );
 		$this->assertStringNotContainsString( 'From other', $output );
 	}
@@ -267,9 +260,6 @@ public function test_value_goes_inside_the_inner_container_of_a_legacy_group() {
 	 */
 	public function test_value_goes_inside_an_empty_group() {
 		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
-		/*
-		 * Classic themes get an inner container from `wp_restore_group_inner_container()`.
-		 */
 		$this->assertMatchesRegularExpression( '#^<div class="wp-block-group[^"]*">(<div class="wp-block-group__inner-container[^"]*">)?\s*<p[^>]*>One</p>\s*(</div>)?</div>$#', $this->render_group( null, '' ) );
 	}
 

From d4819c0da6186168401b8f4542ae4a5494278c07 Mon Sep 17 00:00:00 2001
From: Carlos Bravo <cbravobernal@git.wordpress.org>
Date: Tue, 10 Nov 2026 11:57:05 +0100
Subject: [PATCH 7/9] Block Bindings: Skip only innerBlocks bindings that
 repeat a rendering request, and let trusted sources skip kses.

Ports the latest changes of the Gutenberg PR:

- A value is block markup when the first delimiter WP_Block_Processor
  finds, after whitespace-only HTML, opens a block, which matches what
  parse_blocks() reads as a block.
- Instead of removing the innerBlocks bindings of every supplied block,
  a binding is skipped, without asking its source, only while the inner
  blocks a source supplied for the same request render: the same source,
  arguments, and the context the source uses. Sources whose values bind
  each other's, directly or through content that loads as it renders,
  still can't render forever, and nested bindings that ask something
  else resolve.
- The `block_bindings_sanitize_inner_blocks` filter lets a source whose
  markup comes from trusted code keep it as supplied. Custom CSS is
  removed either way.
- The tests no longer assert with regular expressions.

See https://github.com/WordPress/gutenberg/pull/85568.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/wp-includes/class-wp-block.php            | 158 +++++++--
 .../tests/block-bindings/innerBlocks.php      | 305 ++++++++++++++++--
 2 files changed, 413 insertions(+), 50 deletions(-)

diff --git a/src/wp-includes/class-wp-block.php b/src/wp-includes/class-wp-block.php
index 5aca12dc62186..3318e46f29de1 100644
--- a/src/wp-includes/class-wp-block.php
+++ b/src/wp-includes/class-wp-block.php
@@ -65,6 +65,15 @@ class WP_Block {
 	 */
 	protected $registry;
 
+	/**
+	 * The blocks whose inner blocks a block bindings source supplied are
+	 * rendering, outermost first, each with the request it made to the source.
+	 *
+	 * @since 7.3.0
+	 * @var array[]
+	 */
+	private static $rendering_inner_blocks = array();
+
 	/**
 	 * List of inner blocks (of this same class)
 	 *
@@ -353,14 +362,15 @@ private function process_block_bindings() {
 				}
 			}
 
-			$source_args  = ! empty( $block_binding['args'] ) && is_array( $block_binding['args'] ) ? $block_binding['args'] : array();
-			$source_value = $block_binding_source->get_value( $source_args, $this, $attribute_name );
+			$source_args = ! empty( $block_binding['args'] ) && is_array( $block_binding['args'] ) ? $block_binding['args'] : array();
 
 			if ( 'innerBlocks' === $attribute_name ) {
-				$this->replace_inner_blocks( $source_value );
+				$this->replace_inner_blocks( $block_binding_source, $source_args );
 				continue;
 			}
 
+			$source_value = $block_binding_source->get_value( $source_args, $this, $attribute_name );
+
 			// If the value is not null, process the HTML based on the block and the attribute.
 			if ( ! is_null( $source_value ) ) {
 				$computed_attributes[ $attribute_name ] = $source_value;
@@ -374,16 +384,32 @@ private function process_block_bindings() {
 	 * Replaces the inner blocks of the block with the ones a block bindings
 	 * source supplies, before they render.
 	 *
+	 * Not while the inner blocks the source supplied for the same request
+	 * render: the block then keeps its own inner blocks, and the source isn't
+	 * asked. This way sources whose values bind each other's, directly or
+	 * through content that loads as it renders, like the menu of a Navigation
+	 * block, can't render forever. Bindings that ask a source something else
+	 * still resolve, inside supplied inner blocks too.
+	 *
 	 * @since 7.3.0
 	 *
-	 * @param mixed $value The value of the source.
+	 * @param WP_Block_Bindings_Source $source      The source of the binding.
+	 * @param array                    $source_args The arguments of the binding.
 	 */
-	private function replace_inner_blocks( $value ) {
+	private function replace_inner_blocks( WP_Block_Bindings_Source $source, array $source_args ) {
+		$request = $this->get_inner_blocks_request( $source, $source_args );
+		foreach ( self::$rendering_inner_blocks as $rendering ) {
+			if ( $rendering['request'] === $request ) {
+				return;
+			}
+		}
+
+		$value = $source->get_value( $source_args, $this, 'innerBlocks' );
 		if ( ! self::is_inner_blocks_value( $value ) ) {
 			return;
 		}
 
-		$blocks        = self::parse_bound_inner_blocks( $value );
+		$blocks        = $this->parse_bound_inner_blocks( $value, $source, $source_args );
 		$inner_content = self::get_inner_content_with_slots( $this->parsed_block['innerContent'] ?? null, count( $blocks ) );
 		if ( null === $inner_content ) {
 			return;
@@ -394,6 +420,54 @@ private function replace_inner_blocks( $value ) {
 		$this->parsed_block['innerHTML']    = implode( '', array_filter( $inner_content, 'is_string' ) );
 		$this->inner_blocks                 = new WP_Block_List( array() );
 		$this->refresh_parsed_block_dependents();
+
+		self::$rendering_inner_blocks[] = array(
+			'block'   => $this,
+			'request' => $request,
+		);
+	}
+
+	/**
+	 * Returns what the block asks its block bindings source for `innerBlocks`:
+	 * the source, the arguments of the binding, and the context the source
+	 * uses.
+	 *
+	 * Two blocks with the same request get the same inner blocks from the
+	 * source.
+	 *
+	 * @since 7.3.0
+	 *
+	 * @param WP_Block_Bindings_Source $source      The source of the binding.
+	 * @param array                    $source_args The arguments of the binding.
+	 * @return array The request.
+	 */
+	private function get_inner_blocks_request( WP_Block_Bindings_Source $source, array $source_args ): array {
+		$context = array();
+		foreach ( (array) $source->uses_context as $context_name ) {
+			if ( array_key_exists( $context_name, $this->context ) ) {
+				$context[ $context_name ] = $this->context[ $context_name ];
+			}
+		}
+		return array( $source->name, $source_args, $context );
+	}
+
+	/**
+	 * Stops tracking the block, once it has rendered, if the inner blocks a
+	 * source supplied for it were rendering.
+	 *
+	 * The blocks still rendering inside it, if any, stopped with it: a block
+	 * that doesn't finish rendering, because of an exception, never gets here,
+	 * so they are forgotten along with it.
+	 *
+	 * @since 7.3.0
+	 */
+	private function forget_rendered_inner_blocks() {
+		foreach ( self::$rendering_inner_blocks as $index => $rendering ) {
+			if ( $rendering['block'] === $this ) {
+				self::$rendering_inner_blocks = array_slice( self::$rendering_inner_blocks, 0, $index );
+				return;
+			}
+		}
 	}
 
 	/**
@@ -401,8 +475,9 @@ private function replace_inner_blocks( $value ) {
 	 * blocks.
 	 *
 	 * Serialized block markup supplies them, and an empty string supplies none.
-	 * Any other value, like the plain text of a field, leaves the block with its
-	 * own inner blocks.
+	 * Markup supplies them when the first block delimiter the block parser
+	 * finds, after any whitespace, opens a block. Any other value, like the
+	 * plain text of a field, leaves the block with its own inner blocks.
 	 *
 	 * @since 7.3.0
 	 *
@@ -410,7 +485,21 @@ private function replace_inner_blocks( $value ) {
 	 * @return bool Whether the value supplies inner blocks.
 	 */
 	private static function is_inner_blocks_value( $value ): bool {
-		return '' === $value || ( is_string( $value ) && str_starts_with( ltrim( $value, " \t\n\f\r" ), '<!-- wp:' ) );
+		if ( '' === $value ) {
+			return true;
+		}
+		if ( ! is_string( $value ) ) {
+			return false;
+		}
+
+		$processor = new WP_Block_Processor( $value );
+		while ( $processor->next_token() ) {
+			if ( $processor->is_html() && ! $processor->is_non_whitespace_html() ) {
+				continue;
+			}
+			return ! $processor->is_html() && $processor->opens_block();
+		}
+		return false;
 	}
 
 	/**
@@ -418,20 +507,43 @@ private static function is_inner_blocks_value( $value ): bool {
 	 *
 	 * The markup never went through the filters that sanitize post content on
 	 * save, and the user who supplied it may not be allowed unfiltered HTML, so
-	 * it is sanitized as on save, attributes of its blocks included. Its embeds
-	 * are expanded as the embeds of the content were, before its blocks render.
+	 * by default it is sanitized as on save, attributes of its blocks included.
+	 * Its embeds are expanded as the embeds of the content were, before its
+	 * blocks render.
 	 *
 	 * @since 7.3.0
 	 *
 	 * @global WP_Embed $wp_embed WordPress Embed object.
 	 *
-	 * @param string $markup The serialized blocks.
+	 * @param string                   $markup      The serialized blocks.
+	 * @param WP_Block_Bindings_Source $source      The source of the binding.
+	 * @param array                    $source_args The arguments of the binding.
 	 * @return array[] The parsed blocks.
 	 */
-	private static function parse_bound_inner_blocks( string $markup ): array {
+	private function parse_bound_inner_blocks( string $markup, WP_Block_Bindings_Source $source, array $source_args ): array {
 		global $wp_embed;
 
-		$markup = wp_kses_post( $markup );
+		/**
+		 * Filters whether the inner blocks a block bindings source supplies are
+		 * sanitized before they render.
+		 *
+		 * By default the markup is sanitized as the post content of a user
+		 * without the `unfiltered_html` capability, since the user who supplied
+		 * it is unknown: `wp_kses_post()` removes the HTML that user may not
+		 * publish, in the attributes of the blocks included. A source whose
+		 * markup comes from trusted code, not from users, may keep it as
+		 * supplied. Custom CSS is removed from the blocks either way.
+		 *
+		 * @since 7.3.0
+		 *
+		 * @param bool     $sanitize       Whether to sanitize the markup. Default true.
+		 * @param string   $source_name    The name of the source.
+		 * @param array    $source_args    The arguments of the binding.
+		 * @param WP_Block $block_instance The block whose inner blocks the source supplies.
+		 */
+		if ( apply_filters( 'block_bindings_sanitize_inner_blocks', true, $source->name, $source_args, $this ) ) {
+			$markup = wp_kses_post( $markup );
+		}
 		if ( $wp_embed instanceof WP_Embed ) {
 			$markup = $wp_embed->run_shortcode( $markup );
 			$markup = $wp_embed->autoembed( $markup );
@@ -444,12 +556,7 @@ private static function parse_bound_inner_blocks( string $markup ): array {
 	 * Prepares the blocks a block bindings source supplies, and their inner
 	 * blocks, to render.
 	 *
-	 * Removes their `innerBlocks` bindings: none of them gets its inner blocks
-	 * from a source, so that two sources whose values bind each other's can't
-	 * render forever. Removes the bindings and metadata this leaves empty, as
-	 * the editor does.
-	 *
-	 * Also removes their custom CSS, which only users who can edit CSS may add:
+	 * Removes their custom CSS, which only users who can edit CSS may add:
 	 * whoever supplied the value is unknown.
 	 *
 	 * @since 7.3.0
@@ -466,15 +573,6 @@ private static function prepare_bound_inner_blocks( array $blocks ): array {
 				}
 			}
 
-			if ( isset( $block['attrs']['metadata']['bindings']['innerBlocks'] ) ) {
-				unset( $block['attrs']['metadata']['bindings']['innerBlocks'] );
-				if ( empty( $block['attrs']['metadata']['bindings'] ) ) {
-					unset( $block['attrs']['metadata']['bindings'] );
-				}
-				if ( empty( $block['attrs']['metadata'] ) ) {
-					unset( $block['attrs']['metadata'] );
-				}
-			}
 			$block['innerBlocks'] = self::prepare_bound_inner_blocks( $block['innerBlocks'] );
 		}
 		return $blocks;
@@ -899,6 +997,8 @@ public function render( $options = array() ) {
 			}
 		}
 
+		$this->forget_rendered_inner_blocks();
+
 		/**
 		 * Filters the content of a single block.
 		 *
diff --git a/tests/phpunit/tests/block-bindings/innerBlocks.php b/tests/phpunit/tests/block-bindings/innerBlocks.php
index 237c3b36ca640..39f4a9e56933f 100644
--- a/tests/phpunit/tests/block-bindings/innerBlocks.php
+++ b/tests/phpunit/tests/block-bindings/innerBlocks.php
@@ -17,21 +17,34 @@ class Tests_Block_Bindings_InnerBlocks extends WP_UnitTestCase {
 	const SOURCE = 'test/inner-blocks';
 
 	/**
-	 * The value the test source returns for `innerBlocks`.
+	 * The value the test source returns for `innerBlocks`, or a callable that
+	 * returns it from the arguments of the binding and the block instance.
 	 *
 	 * @var mixed
 	 */
 	private $value;
 
+	/**
+	 * The number of times the test source supplied `innerBlocks`.
+	 *
+	 * @var int
+	 */
+	private $inner_blocks_calls;
+
 	public function set_up() {
 		parent::set_up();
-		$this->value = null;
+		$this->value              = null;
+		$this->inner_blocks_calls = 0;
 		register_block_bindings_source(
 			self::SOURCE,
 			array(
 				'label'              => 'Test',
 				'get_value_callback' => function ( $source_args, $block_instance, $attribute_name ) {
-					return 'innerBlocks' === $attribute_name ? $this->value : 'Bound text';
+					if ( 'innerBlocks' !== $attribute_name ) {
+						return 'Bound text';
+					}
+					++$this->inner_blocks_calls;
+					return $this->value instanceof Closure ? call_user_func( $this->value, $source_args, $block_instance ) : $this->value;
 				},
 			)
 		);
@@ -59,6 +72,22 @@ private function render_group( $bindings = null, $inner_html = '<!-- wp:paragrap
 		return $block->render();
 	}
 
+	/**
+	 * Returns the markup of a Group block bound to the test source, with a
+	 * paragraph of its own.
+	 *
+	 * @param array  $args The arguments of the binding.
+	 * @param string $own  The text of the Group's own paragraph.
+	 * @return string The markup.
+	 */
+	private function bound_group_markup( $args = array(), $own = 'Nested own' ) {
+		$binding = array( 'source' => self::SOURCE );
+		if ( $args ) {
+			$binding['args'] = $args;
+		}
+		return '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":' . wp_json_encode( $binding ) . '}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>' . $own . '</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
+	}
+
 	/**
 	 * Returns the attributes the supplied blocks render with.
 	 *
@@ -84,7 +113,8 @@ private function render_group_and_get_supplied_attributes() {
 	public function test_value_replaces_inner_blocks() {
 		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph --><!-- wp:paragraph --><p>Two</p><!-- /wp:paragraph -->';
 		$output      = $this->render_group();
-		$this->assertMatchesRegularExpression( '#>One</p><p[^>]*>Two</p></div></div>$#', $output );
+		$this->assertStringContainsString( '>One</p><p', $output );
+		$this->assertStringContainsString( '>Two</p></div>', $output );
 		$this->assertStringNotContainsString( 'Default', $output );
 	}
 
@@ -96,6 +126,44 @@ public function test_value_may_start_with_whitespace() {
 		$this->assertStringContainsString( '>One</p>', $this->render_group() );
 	}
 
+	/**
+	 * @ticket 66415
+	 *
+	 * @dataProvider data_whitespace_after_the_delimiter_opener
+	 *
+	 * @param string $whitespace The whitespace between `<!--` and `wp:`.
+	 */
+	public function test_value_may_have_any_whitespace_after_the_delimiter_opener( $whitespace ) {
+		$this->value = "<!--{$whitespace}wp:paragraph --><p>One</p><!-- /wp:paragraph -->";
+		$output      = $this->render_group();
+		$this->assertStringContainsString( '>One</p>', $output );
+		$this->assertStringNotContainsString( 'Default', $output );
+	}
+
+	public function data_whitespace_after_the_delimiter_opener() {
+		return array(
+			'space'   => array( ' ' ),
+			'tab'     => array( "\t" ),
+			'newline' => array( "\n" ),
+		);
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_whitespace_value_keeps_own_inner_blocks() {
+		$this->value = " \n\t";
+		$this->assertStringContainsString( '>Default</p>', $this->render_group() );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_starting_with_a_closer_keeps_own_inner_blocks() {
+		$this->value = '<!-- /wp:paragraph --><!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		$this->assertStringContainsString( '>Default</p>', $this->render_group() );
+	}
+
 	/**
 	 * @ticket 66415
 	 */
@@ -164,20 +232,59 @@ public function test_value_is_sanitized() {
 	 * @ticket 66415
 	 */
 	public function test_block_attributes_in_the_value_are_sanitized() {
-		$this->value = '<!-- wp:paragraph {"className":"\u003cimg src=x onerror=alert(1)\u003e"} --><p>Safe</p><!-- /wp:paragraph -->';
+		$this->value = '<!-- wp:paragraph {"className":"<img src=x onerror=alert(1)>"} --><p>Safe</p><!-- /wp:paragraph -->';
 		$output      = $this->render_group();
 		$this->assertStringNotContainsString( 'onerror', $output );
 		$this->assertStringContainsString( '>Safe</p>', $output );
 	}
 
+	/**
+	 * @ticket 66415
+	 */
+	public function test_value_of_a_trusted_source_is_not_sanitized() {
+		$this->value = '<!-- wp:html --><svg><circle r="1"></circle></svg><!-- /wp:html -->';
+		$trusted     = array();
+		$trust       = static function ( $sanitize, $source_name, $source_args, $block_instance ) use ( &$trusted ) {
+			$trusted[] = array( $source_name, $source_args, $block_instance->name );
+			return false;
+		};
+		add_filter( 'block_bindings_sanitize_inner_blocks', $trust, 10, 4 );
+		$output = $this->render_group(
+			array(
+				'innerBlocks' => array(
+					'source' => self::SOURCE,
+					'args'   => array( 'key' => 'chart' ),
+				),
+			)
+		);
+		remove_filter( 'block_bindings_sanitize_inner_blocks', $trust );
+
+		$this->assertStringContainsString( '<svg><circle r="1"></circle></svg>', $output );
+		$this->assertSame( array( array( self::SOURCE, array( 'key' => 'chart' ), 'core/group' ) ), $trusted );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_custom_css_in_the_value_of_a_trusted_source_is_removed() {
+		$this->value = '<!-- wp:paragraph {"style":{"css":"color:red"}} --><p>Styled</p><!-- /wp:paragraph -->';
+		add_filter( 'block_bindings_sanitize_inner_blocks', '__return_false' );
+		$output = $this->render_group();
+		remove_filter( 'block_bindings_sanitize_inner_blocks', '__return_false' );
+
+		$this->assertStringNotContainsString( 'wp-custom-css-', $output );
+		$this->assertStringContainsString( '>Styled</p>', $output );
+	}
+
 	/**
 	 * @ticket 66415
 	 */
 	public function test_bindings_to_the_same_source_inside_the_value_are_ignored() {
-		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>Nested own</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
+		$this->value = $this->bound_group_markup();
 		$output      = $this->render_group();
 		$this->assertStringContainsString( '>Nested own</p>', $output );
 		$this->assertSame( 2, substr_count( $output, '<div class="wp-block-group">' ) );
+		$this->assertSame( 1, $this->inner_blocks_calls );
 	}
 
 	/**
@@ -188,33 +295,183 @@ public function test_sources_binding_each_other_render_once() {
 			'test/other-inner-blocks',
 			array(
 				'label'              => 'Test',
-				'get_value_callback' => static function () {
-					return '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>From other</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
+				'get_value_callback' => function () {
+					return $this->bound_group_markup( array(), 'From other' );
 				},
 			)
 		);
 		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/other-inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>From test</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
 		$output      = $this->render_group();
 		unregister_block_bindings_source( 'test/other-inner-blocks' );
-		$this->assertStringContainsString( '>From test</p>', $output );
-		$this->assertStringNotContainsString( 'From other', $output );
+		$this->assertStringContainsString( '>From other</p>', $output );
+		$this->assertStringNotContainsString( 'From test', $output );
+		$this->assertStringNotContainsString( 'Default', $output );
 	}
 
 	/**
 	 * @ticket 66415
 	 */
-	public function test_attribute_bindings_inside_the_value_are_kept() {
-		$this->value = '<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"test/inner-blocks"}}}} --><p>One</p><!-- /wp:paragraph -->';
-		$this->assertStringContainsString( '>Bound text</p>', $this->render_group() );
+	public function test_bindings_to_another_source_inside_the_value_resolve() {
+		register_block_bindings_source(
+			'test/other-inner-blocks',
+			array(
+				'label'              => 'Test',
+				'get_value_callback' => static function () {
+					return '<!-- wp:paragraph --><p>From other</p><!-- /wp:paragraph -->';
+				},
+			)
+		);
+		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/other-inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>Nested own</p><!-- /wp:paragraph --></div><!-- /wp:group -->';
+		$output      = $this->render_group();
+		unregister_block_bindings_source( 'test/other-inner-blocks' );
+		$this->assertStringContainsString( '>From other</p>', $output );
+		$this->assertStringNotContainsString( 'Nested own', $output );
 	}
 
 	/**
 	 * @ticket 66415
 	 */
-	public function test_removed_bindings_leave_no_empty_metadata() {
-		$this->value = '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/inner-blocks"}}}} --><div class="wp-block-group"></div><!-- /wp:group -->';
-		$attributes  = $this->render_group_and_get_supplied_attributes();
-		$this->assertArrayNotHasKey( 'metadata', $attributes[0] );
+	public function test_bindings_with_other_arguments_inside_the_value_resolve() {
+		$this->value = function ( $source_args ) {
+			$level = $source_args['level'] ?? 1;
+			if ( $level < 3 ) {
+				return $this->bound_group_markup( array( 'level' => $level + 1 ), "Level {$level} own" );
+			}
+			return '<!-- wp:paragraph --><p>Level 3</p><!-- /wp:paragraph -->';
+		};
+		$output      = $this->render_group();
+		$this->assertStringContainsString( '>Level 3</p>', $output );
+		$this->assertStringNotContainsString( 'own', $output );
+		$this->assertSame( 3, $this->inner_blocks_calls );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_bindings_with_other_context_inside_the_value_resolve() {
+		register_block_type(
+			'test/provides-post',
+			array(
+				'attributes'       => array( 'id' => array( 'type' => 'integer' ) ),
+				'provides_context' => array( 'postId' => 'id' ),
+			)
+		);
+		register_block_bindings_source(
+			'test/post-inner-blocks',
+			array(
+				'label'              => 'Test',
+				'uses_context'       => array( 'postId' ),
+				'get_value_callback' => static function ( $source_args, $block_instance ) {
+					if ( 1 === $block_instance->context['postId'] ) {
+						return '<!-- wp:test/provides-post {"id":2} --><!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/post-inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>Nested own</p><!-- /wp:paragraph --></div><!-- /wp:group --><!-- /wp:test/provides-post -->';
+					}
+					return '<!-- wp:paragraph --><p>Post ' . $block_instance->context['postId'] . '</p><!-- /wp:paragraph -->';
+				},
+			)
+		);
+		$output = do_blocks( '<!-- wp:test/provides-post {"id":1} --><!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"test/post-inner-blocks"}}}} --><div class="wp-block-group"><!-- wp:paragraph --><p>Default</p><!-- /wp:paragraph --></div><!-- /wp:group --><!-- /wp:test/provides-post -->' );
+		unregister_block_bindings_source( 'test/post-inner-blocks' );
+		unregister_block_type( 'test/provides-post' );
+
+		$this->assertStringContainsString( '>Post 2</p>', $output );
+		$this->assertStringNotContainsString( 'Nested own', $output );
+		$this->assertStringNotContainsString( 'Default', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_bindings_inside_content_loaded_by_the_value_are_ignored() {
+		register_block_type(
+			'test/loads-content',
+			array(
+				'render_callback' => function () {
+					return do_blocks( $this->bound_group_markup( array(), 'Loaded own' ) );
+				},
+			)
+		);
+		$this->value = '<!-- wp:test/loads-content /-->';
+		$output      = $this->render_group();
+		unregister_block_type( 'test/loads-content' );
+
+		$this->assertSame( 1, $this->inner_blocks_calls );
+		$this->assertSame( 1, substr_count( $output, 'Loaded own' ) );
+		$this->assertStringNotContainsString( 'Default', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_sibling_bindings_each_resolve() {
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		$group       = $this->bound_group_markup( array(), 'Default' );
+		$output      = do_blocks( $group . $group );
+
+		$this->assertSame( 2, $this->inner_blocks_calls );
+		$this->assertSame( 2, substr_count( $output, '>One</p>' ) );
+		$this->assertStringNotContainsString( 'Default', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_bindings_resolve_again_after_supplied_inner_blocks_render() {
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		$this->render_group();
+		$this->assertStringContainsString( '>One</p>', $this->render_group() );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_blocks_that_stop_rendering_inside_a_host_are_forgotten_with_it() {
+		register_block_type(
+			'test/throws',
+			array(
+				'render_callback' => static function () {
+					throw new Exception( 'Stopped' );
+				},
+			)
+		);
+		register_block_type(
+			'test/catches',
+			array(
+				'render_callback' => function () {
+					try {
+						return do_blocks( $this->bound_group_markup( array( 'part' => 'inner' ) ) );
+					} catch ( Exception $exception ) {
+						return $exception->getMessage();
+					}
+				},
+			)
+		);
+		$this->value = static function ( $source_args ) {
+			return 'inner' === ( $source_args['part'] ?? '' ) ? '<!-- wp:test/throws /-->' : '<!-- wp:test/catches /-->';
+		};
+		$output      = $this->render_group();
+		$this->assertStringContainsString( 'Stopped', $output );
+
+		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
+		$output      = $this->render_group(
+			array(
+				'innerBlocks' => array(
+					'source' => self::SOURCE,
+					'args'   => array( 'part' => 'inner' ),
+				),
+			)
+		);
+		unregister_block_type( 'test/throws' );
+		unregister_block_type( 'test/catches' );
+
+		$this->assertStringContainsString( '>One</p>', $output );
+	}
+
+	/**
+	 * @ticket 66415
+	 */
+	public function test_attribute_bindings_inside_the_value_are_kept() {
+		$this->value = '<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"test/inner-blocks"}}}} --><p>One</p><!-- /wp:paragraph -->';
+		$this->assertStringContainsString( '>Bound text</p>', $this->render_group() );
 	}
 
 	/**
@@ -243,7 +500,7 @@ public function test_nested_custom_css_in_the_value_is_removed() {
 	public function test_value_goes_where_the_own_inner_blocks_were() {
 		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
 		$output      = $this->render_group( null, '<!-- wp:paragraph --><p>Default</p><!-- /wp:paragraph --><span>Tail</span>' );
-		$this->assertMatchesRegularExpression( '#>One</p><span>Tail</span>#', $output );
+		$this->assertStringContainsString( '>One</p><span>Tail</span>', $output );
 	}
 
 	/**
@@ -252,7 +509,8 @@ public function test_value_goes_where_the_own_inner_blocks_were() {
 	public function test_value_goes_inside_the_inner_container_of_a_legacy_group() {
 		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
 		$output      = $this->render_group( null, '<div class="wp-block-group__inner-container"><!-- wp:paragraph --><p>Default</p><!-- /wp:paragraph --></div>' );
-		$this->assertMatchesRegularExpression( '#<div class="wp-block-group__inner-container[^"]*">\s*<p[^>]*>One</p>\s*</div></div>$#', $output );
+		$this->assertSame( 1, substr_count( $output, 'wp-block-group__inner-container' ) );
+		$this->assertStringEndsWith( '>One</p></div></div>', $output );
 	}
 
 	/**
@@ -260,7 +518,10 @@ public function test_value_goes_inside_the_inner_container_of_a_legacy_group() {
 	 */
 	public function test_value_goes_inside_an_empty_group() {
 		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
-		$this->assertMatchesRegularExpression( '#^<div class="wp-block-group[^"]*">(<div class="wp-block-group__inner-container[^"]*">)?\s*<p[^>]*>One</p>\s*(</div>)?</div>$#', $this->render_group( null, '' ) );
+		$output      = $this->render_group( null, '' );
+		$this->assertStringStartsWith( '<div class="wp-block-group', $output );
+		$this->assertStringContainsString( '>One</p></div>', $output );
+		$this->assertSame( 1, substr_count( $output, '<p' ) );
 	}
 
 	/**
@@ -268,7 +529,9 @@ public function test_value_goes_inside_an_empty_group() {
 	 */
 	public function test_value_goes_before_the_closer_of_a_wrapper_with_unclosed_elements() {
 		$this->value = '<!-- wp:paragraph --><p>One</p><!-- /wp:paragraph -->';
-		$this->assertMatchesRegularExpression( '#<p>Tail</p><p[^>]*>One</p>\s*</div>#', $this->render_group( null, '<p>Tail' ) );
+		$output      = $this->render_group( null, '<p>Tail' );
+		$this->assertStringContainsString( '<p>Tail</p><p', $output );
+		$this->assertStringContainsString( '>One</p></div>', $output );
 	}
 
 	/**

From cc235e1b2f7b97eb10a4aa35b4afc71faa2afdd4 Mon Sep 17 00:00:00 2001
From: Carlos Bravo <cbravobernal@git.wordpress.org>
Date: Tue, 10 Nov 2026 18:39:46 +0100
Subject: [PATCH 8/9] Block Bindings: Keep inner blocks bindings from crashing
 on an empty value, and key requests by attributes too.

A block whose inner content held only block slots, with no wrapper
markup, crashed when its source supplied no inner blocks: the empty inner
content never reached the block instance, which rendered its old slots
against an empty list of inner blocks. The instance now gets its inner
content and HTML directly.

The request a binding is skipped for also includes the attributes of the
block, since a source may read them, like the pattern overrides source
reads the name of the block.

Co-Authored-By: Claude Mythos 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MCeAiscBeSgrKjrPgYBr1b
---
 src/wp-includes/class-wp-block.php                 | 12 +++++++++---
 tests/phpunit/tests/block-bindings/innerBlocks.php | 13 +++++++++++++
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/class-wp-block.php b/src/wp-includes/class-wp-block.php
index 3318e46f29de1..cd975fd1d777a 100644
--- a/src/wp-includes/class-wp-block.php
+++ b/src/wp-includes/class-wp-block.php
@@ -419,6 +419,8 @@ private function replace_inner_blocks( WP_Block_Bindings_Source $source, array $
 		$this->parsed_block['innerContent'] = $inner_content;
 		$this->parsed_block['innerHTML']    = implode( '', array_filter( $inner_content, 'is_string' ) );
 		$this->inner_blocks                 = new WP_Block_List( array() );
+		$this->inner_content                = $inner_content;
+		$this->inner_html                   = $this->parsed_block['innerHTML'];
 		$this->refresh_parsed_block_dependents();
 
 		self::$rendering_inner_blocks[] = array(
@@ -429,8 +431,8 @@ private function replace_inner_blocks( WP_Block_Bindings_Source $source, array $
 
 	/**
 	 * Returns what the block asks its block bindings source for `innerBlocks`:
-	 * the source, the arguments of the binding, and the context the source
-	 * uses.
+	 * the source, the arguments of the binding, the context the source uses,
+	 * and the attributes of the block.
 	 *
 	 * Two blocks with the same request get the same inner blocks from the
 	 * source.
@@ -448,7 +450,7 @@ private function get_inner_blocks_request( WP_Block_Bindings_Source $source, arr
 				$context[ $context_name ] = $this->context[ $context_name ];
 			}
 		}
-		return array( $source->name, $source_args, $context );
+		return array( $source->name, $source_args, $context, $this->attributes );
 	}
 
 	/**
@@ -534,6 +536,10 @@ private function parse_bound_inner_blocks( string $markup, WP_Block_Bindings_Sou
 		 * markup comes from trusted code, not from users, may keep it as
 		 * supplied. Custom CSS is removed from the blocks either way.
 		 *
+		 * Sanitizing keeps the block delimiters that `serialize_blocks()`
+		 * writes, which escapes the characters `wp_kses_post()` rewrites
+		 * inside comments.
+		 *
 		 * @since 7.3.0
 		 *
 		 * @param bool     $sanitize       Whether to sanitize the markup. Default true.
diff --git a/tests/phpunit/tests/block-bindings/innerBlocks.php b/tests/phpunit/tests/block-bindings/innerBlocks.php
index 39f4a9e56933f..dcc4cd7de7de3 100644
--- a/tests/phpunit/tests/block-bindings/innerBlocks.php
+++ b/tests/phpunit/tests/block-bindings/innerBlocks.php
@@ -177,6 +177,12 @@ public function test_empty_value_removes_inner_blocks() {
 	/**
 	 * @ticket 66415
 	 */
+	public function test_empty_value_removes_inner_blocks_without_wrapper_markup() {
+		$this->value = '';
+		$output      = render_block( parse_blocks( '<!-- wp:group {"metadata":{"bindings":{"innerBlocks":{"source":"' . self::SOURCE . '"}}}} --><!-- wp:paragraph --><p>Default</p><!-- /wp:paragraph --><!-- /wp:group -->' )[0] );
+		$this->assertSame( '', $output );
+	}
+
 	public function test_without_value_keeps_own_inner_blocks() {
 		$this->assertStringContainsString( '>Default</p>', $this->render_group() );
 	}
@@ -348,6 +354,13 @@ public function test_bindings_with_other_arguments_inside_the_value_resolve() {
 	/**
 	 * @ticket 66415
 	 */
+	public function test_bindings_with_other_attributes_inside_the_value_resolve() {
+		$this->value = '<!-- wp:group {"tagName":"section","metadata":{"bindings":{"innerBlocks":{"source":"' . self::SOURCE . '"}}}} --><section class="wp-block-group"><!-- wp:paragraph --><p>Nested own</p><!-- /wp:paragraph --></section><!-- /wp:group -->';
+		$output      = $this->render_group();
+		$this->assertSame( 2, substr_count( $output, '<section class="wp-block-group">' ) );
+		$this->assertSame( 1, substr_count( $output, 'Nested own' ) );
+	}
+
 	public function test_bindings_with_other_context_inside_the_value_resolve() {
 		register_block_type(
 			'test/provides-post',

From fba872e9d1de9f5dd385a5f07a85cc943fc5d618 Mon Sep 17 00:00:00 2001
From: Carlos Bravo <cbravobernal@git.wordpress.org>
Date: Tue, 10 Nov 2026 19:16:50 +0100
Subject: [PATCH 9/9] Block Bindings: Assert that the default pattern overrides
 binding renders a Group unchanged.

Co-Authored-By: Claude Mythos 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MCeAiscBeSgrKjrPgYBr1b
---
 tests/phpunit/tests/block-bindings/innerBlocks.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/phpunit/tests/block-bindings/innerBlocks.php b/tests/phpunit/tests/block-bindings/innerBlocks.php
index dcc4cd7de7de3..bbb4c5adaf52b 100644
--- a/tests/phpunit/tests/block-bindings/innerBlocks.php
+++ b/tests/phpunit/tests/block-bindings/innerBlocks.php
@@ -221,7 +221,7 @@ public function test_default_pattern_overrides_binding_does_not_bind_inner_block
 		remove_filter( 'block_bindings_source_value', $record );
 
 		$this->assertNotContains( 'innerBlocks', $requested );
-		$this->assertStringContainsString( '>Default</p>', $output );
+		$this->assertSame( $this->render_group( array() ), $output );
 	}
 
 	/**