Backport: ACF 6.8.6 changes

[ockham]

Description

Ports the ACF 6.8.6 point release (2026-07-14) into SCF. Upstream range: ACF 6.8.5 → 6.8.6 (ACF 6.8.5 was verified to be fully covered already by earlier SCF work: #462, #467, #491 and related commits).

All seven changelog fixes from upstream are included:

• Location rules: guard against missing rule value/operator keys to avoid PHP warnings on page load (includes/locations/*). Ported from the free ACF repo (canonical for non-Pro files).
• WP 7.0+ field appearance: add acf-admin-7-0 body class and port the improved URL/Number/Select field CSS. SCF's sass entries are flattened, so the CSS went into acf-input.scss using upstream's compiled output. The .acf-url icon hunk was skipped — already fixed by #499 UI: Align URL Field Globe Icon Inside the URL Input Box. #500.
• Blocks auto inline editing: only substitute placeholder values for fields fetched against the block's own post id, and save/restore the render context so nested block renders don't clobber the parent (includes/blocks-auto-inline-editing.php; the stale, unloaded pro/ copy is untouched).
• WooCommerce HPOS compatibility mode: register acf/form-post/skip_save so save_order() stays the single save entry-point and the backfill-triggered save_post no longer consumes the ACF nonce. Adapted to cover all registered order types via wc_get_order_types(), matching SCF's existing multi-order-type support.
• Validation JS: scope submit-click validation to the button's own form so unrelated UI (e.g. the Classic Editor link inserter) no longer triggers premature validation of a Link field; use validity.valid instead of checkValidity() to avoid dispatching native invalid events.
• Blocks V2/V3: don't crash on attribute values that merely start with [ or { (e.g. oEmbed titles) — JSON.parse is now try/caught in both the V2 parser (_acf-blocks.js) and V3 (jsx-parser.js). Two jsx-parser tests asserting the old throwing behavior were updated.
• Blocks V3: deserialize Google Map field values after acf.serialize() so they aren't double-encoded in block attributes (block-edit.js).
• DOMPurify: bump 3.3.0 → 3.4.11 to match upstream's bundled upgrade.

The two block fixes only ship minified upstream; both bundle versions were pretty-printed and diffed (a string-literal set comparison confirmed these were the only substantive changes), then implemented in maintainable source — no decompiled output was pasted.

Intentionally not ported: the ACF email opt-in marketing banner (admin page, view, JS, CSS, images — collects emails for ACF's newsletter, not applicable to SCF), readme/version bumps, and lang/** translation churn (SCF has its own translation workflow).

Testing

• php -l clean on all changed PHP files; npm run build passes (DOMPurify 3.4.11 bundles cleanly)
• phpcs-changed pre-commit hook passes; no new PHPStan or ESLint findings vs trunk (ESLint count actually drops by 3)
• PHPUnit: 2845 tests, 21611 assertions, all passing
• Jest: 951 tests, all passing
• E2E (local wp-env): 249/253 passed; the 4 failures (post-type-admin.spec.ts ×3, block-bindings-site-editor.spec.ts ×1) reproduce identically on trunk and are unrelated to this PR

Use of AI Tools

This PR was created with assistance from Claude Code (Anthropic).

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props bernhard-reiter.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.