From 8add03baca9068074b885fed83d386056dbb1789 Mon Sep 17 00:00:00 2001
From: Andrew Cockrell <1480054+acockrell@users.noreply.github.com>
Date: Sat, 20 Jun 2026 20:16:24 -0700
Subject: [PATCH] fix: WP 7.0 compat, correct CX ID URL encoding, block.json
 role

- rawurlencode CX ID in script URL (esc_attr is HTML attr context,
  not URL context)
- Pass null version for external Google CSE script to suppress
  spurious &ver= query param
- Add role:content to block.json so block remains editable inside
  contentOnly patterns (WP 7.0 default)
- Fix stale docblock referencing removed gpse/search-form block
- Bump readme.txt changelog to 1.2.6; sync README.md stable tag
---
 README.md                                | 2 +-
 gpse/includes/class-wp-gpse-blocks.php   | 7 ++-----
 gpse/includes/class-wp-gpse-frontend.php | 4 ++--
 gpse/readme.txt                          | 6 ++++++
 gpse/src/search-results/block.json       | 1 +
 5 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 81236dd..9b66a27 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@ Contributors: ACLabs
 Tags: search, google, gcse, programmable search, cse
 Requires at least: 6.4
 Tested up to: 7.0
-Stable tag: 1.2.3
+Stable tag: 1.2.5
 Requires PHP: 8.2
 License: AGPL v3 or later
 License URI: https://www.gnu.org/licenses/agpl-3.0.html
diff --git a/gpse/includes/class-wp-gpse-blocks.php b/gpse/includes/class-wp-gpse-blocks.php
index c676dd2..6ed33d7 100644
--- a/gpse/includes/class-wp-gpse-blocks.php
+++ b/gpse/includes/class-wp-gpse-blocks.php
@@ -30,11 +30,8 @@ public function init() {
 	/**
 	 * Register Gutenberg blocks.
 	 *
-	 * Registers two blocks using Block API v3:
-	 * - gpse/search-form: Google CSE search input box
-	 * - gpse/search-results: Google CSE search results display
-	 *
-	 * Both blocks use server-side rendering with dynamic callbacks.
+	 * Registers the gpse/search-results block using Block API v3 with
+	 * server-side rendering via dynamic callback.
 	 *
 	 * @since 1.1.0
 	 * @return void
diff --git a/gpse/includes/class-wp-gpse-frontend.php b/gpse/includes/class-wp-gpse-frontend.php
index 976c24d..7aca775 100644
--- a/gpse/includes/class-wp-gpse-frontend.php
+++ b/gpse/includes/class-wp-gpse-frontend.php
@@ -82,9 +82,9 @@ public function enqueue_google_script() {
 		if ( ! empty( $cx_id ) ) {
 			wp_enqueue_script(
 				'google-cse',
-				'https://cse.google.com/cse.js?cx=' . esc_attr( $cx_id ),
+				'https://cse.google.com/cse.js?cx=' . rawurlencode( $cx_id ),
 				array(),
-				GPSE_VERSION,
+				null,
 				array( 'strategy' => 'defer', 'in_footer' => true )
 			);
 		}
diff --git a/gpse/readme.txt b/gpse/readme.txt
index d5c2b19..49fa439 100644
--- a/gpse/readme.txt
+++ b/gpse/readme.txt
@@ -57,6 +57,12 @@ By using this plugin you agree to be bound by Google's Terms of Service and ackn
 
 == Changelog ==
 
+= 1.2.6 =
+* Confirmed compatibility with WordPress 7.0.
+* Fixed URL encoding of Google CSE CX ID (rawurlencode instead of esc_attr).
+* Removed spurious version query string from Google CSE script URL.
+* Added `role: content` to block.json for correct editability in WordPress 7.0 contentOnly patterns.
+
 = 1.2.5 =
 * Restrict Google CSE script, stylesheet, and init script to the configured results page only.
 * Add third-party service disclosure for Google Programmable Search Engine.
diff --git a/gpse/src/search-results/block.json b/gpse/src/search-results/block.json
index 5647b87..8a3db67 100644
--- a/gpse/src/search-results/block.json
+++ b/gpse/src/search-results/block.json
@@ -7,6 +7,7 @@
 	"category": "widgets",
 	"icon": "welcome-widgets-menus",
 	"description": "Google Programmable Search Engine results list.",
+	"role": "content",
 	"supports": {
 		"html": false,
 		"align": true