From 00a6679d49d6361ce613eac3493b4181ca96e286 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 9 Sep 2026 09:06:02 +0000
Subject: [PATCH] chore: sync funkycommerce-headless from monorepo

Source: coded-letter/coded-letter-monorepo@4d30981f3726872e6d6f8f82f6ab2cdc80ad9000
---
 .monorepo-source.json      |  2 +-
 functions.php              |  2 +-
 inc/security-hardening.php | 29 ++++++++++++++++++++++++++---
 package-lock.json          |  4 ++--
 package.json               |  2 +-
 readme.txt                 |  7 ++++++-
 style.css                  |  2 +-
 7 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/.monorepo-source.json b/.monorepo-source.json
index d71c3c2..980b129 100644
--- a/.monorepo-source.json
+++ b/.monorepo-source.json
@@ -1,7 +1,7 @@
 {
   "productId": "funkycommerce-headless",
   "repository": "coded-letter/superfunky-theme",
-  "source": "coded-letter/coded-letter-monorepo@72869cdcaddca084be981b28722da7dd6b9e733f",
+  "source": "coded-letter/coded-letter-monorepo@4d30981f3726872e6d6f8f82f6ab2cdc80ad9000",
   "sourcePath": "workspace/backend/wordpress/themes/free/funkycommerce-headless",
   "installSlug": "funkycommerce-headless",
   "kind": "theme",
diff --git a/functions.php b/functions.php
index dee8d0e..1c65373 100644
--- a/functions.php
+++ b/functions.php
@@ -9,7 +9,7 @@
 	exit;
 }
 
-define( 'FUNKYCOMMERCE_HEADLESS_VERSION', '1.2.27' );
+define( 'FUNKYCOMMERCE_HEADLESS_VERSION', '1.2.28' );
 
 /**
  * Whether Superfunky Pro is active and licensed.
diff --git a/inc/security-hardening.php b/inc/security-hardening.php
index 4bfbc86..3778513 100644
--- a/inc/security-hardening.php
+++ b/inc/security-hardening.php
@@ -233,9 +233,32 @@ function funkycommerce_security_mark_content_scripts( $content, $post_type = ''
 		return $content;
 	}
 
-	$marked = preg_replace(
-		'/<script\b(?![^>]*\bdata-wp-block-html\s*=)([^>]*)>/i',
-		'<script data-wp-block-html="js"$1>',
+	$marked = preg_replace_callback(
+		'/<script\b([^>]*)>/i',
+		static function ( $matches ) {
+			$attributes    = $matches[1];
+			$inert_type    = 'text/funkycommerce-cms';
+			$original_type = '';
+
+			if ( preg_match( '/\s+type\s*=\s*(["\'])(.*?)\1/i', $attributes, $type_match ) ) {
+				$original_type = html_entity_decode( $type_match[2], ENT_QUOTES | ENT_HTML5, 'UTF-8' );
+				$attributes    = preg_replace( '/\s+type\s*=\s*(["\'])(.*?)\1/i', '', $attributes, 1 );
+				$attributes    = is_string( $attributes ) ? $attributes : $matches[1];
+			}
+
+			if ( ! preg_match( '/\bdata-wp-block-html\s*=/i', $attributes ) ) {
+				$attributes = ' data-wp-block-html="js"' . $attributes;
+			}
+			if (
+				$original_type
+				&& $inert_type !== strtolower( trim( $original_type ) )
+				&& ! preg_match( '/\bdata-wp-block-html-type\s*=/i', $attributes )
+			) {
+				$attributes .= ' data-wp-block-html-type="' . esc_attr( $original_type ) . '"';
+			}
+
+			return '<script type="' . $inert_type . '"' . $attributes . '>';
+		},
 		$content
 	);
 	return is_string( $marked ) ? $marked : $content;
diff --git a/package-lock.json b/package-lock.json
index a64bd10..3c48d1e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "funkycommerce-headless-theme",
-  "version": "1.2.27",
+  "version": "1.2.28",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "funkycommerce-headless-theme",
-      "version": "1.2.27",
+      "version": "1.2.28",
       "devDependencies": {
         "autoprefixer": "^10.4.20",
         "esbuild": "^0.28.2",
diff --git a/package.json b/package.json
index 6bc8c35..8aa7385 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "funkycommerce-headless-theme",
   "private": true,
-  "version": "1.2.27",
+  "version": "1.2.28",
   "description": "Tailwind/build tooling for the FunkyCommerce Headless WordPress theme's native frontend assets (block templates, template parts, loader, and Spotify slot).",
   "scripts": {
     "build:css": "tailwindcss -i ./assets/css/theme-source.css -o ./assets/dist/theme.css --minify",
diff --git a/readme.txt b/readme.txt
index fe26244..296b95a 100644
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Tags: headless, woocommerce, wpgraphql, full-site-editing
 Requires at least: 6.7
 Tested up to: 6.8
 Requires PHP: 7.4
-Stable tag: 1.2.27
+Stable tag: 1.2.28
 License: GPL-2.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -15,6 +15,11 @@ Control Center, the theme also ships a complete native WordPress rendering path
 "Native frontend theme" below) with accessible header/footer/navigation templates and
 core front/home/singular/archive/search/404 routes styled to match the storefront.
 
+== 1.2.28 highlights ==
+
+* Keeps trusted CMS scripts inert in server-rendered HTML until the storefront safely decodes and executes them.
+* Preserves explicit JavaScript types while preventing HTML entities from corrupting operators during artifact delivery.
+
 == 1.2.27 highlights ==
 
 * Discards queued regeneration work for obsolete storefront shells during atomic shell activation.
diff --git a/style.css b/style.css
index c2953b3..6315ccc 100644
--- a/style.css
+++ b/style.css
@@ -7,7 +7,7 @@ Description: A minimal, content-first block theme for polished WordPress preview
 Requires at least: 6.7
 Tested up to: 6.8
 Requires PHP: 7.4
-Version: 1.2.27
+Version: 1.2.28
 Update URI: https://github.com/coded-letter/superfunky-theme
 License: GPL-2.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html