Grouped merges for 5.3.8.

- Update `lodash` to the latest version `4.17.21`.
- Disable some attributes for rich text.
- Use hashed/deterministic moduleIDs in webpack config.

Props ellatrix, peterwilsoncc, get_dave, mcsf, talldanwp, youknowriad, desrosj, nerrad, gziolo.
Merges [50940-50941,50984-50985,51426] to the 5.3 branch.

git-svn-id: https://develop.svn.wordpress.org/branches/5.3@51755 602fd350-edb4-49c9-b593-d223f7449a82

package.json

@@ -72,42 +72,42 @@
 	"dependencies": {
 		"@babel/polyfill": "7.4.4",
 		"@wordpress/a11y": "2.5.1",
-		"@wordpress/annotations": "1.7.2",
+		"@wordpress/annotations": "1.7.3",
 		"@wordpress/api-fetch": "3.6.4",
 		"@wordpress/autop": "2.5.1",
 		"@wordpress/blob": "2.5.1",
-		"@wordpress/block-editor": "3.2.5",
+		"@wordpress/block-editor": "3.2.6",
-		"@wordpress/block-library": "2.9.9",
+		"@wordpress/block-library": "2.9.10",
 		"@wordpress/block-serialization-default-parser": "3.4.1",
-		"@wordpress/blocks": "6.7.2",
+		"@wordpress/blocks": "6.7.3",
-		"@wordpress/components": "8.3.2",
+		"@wordpress/components": "8.3.3",
 		"@wordpress/compose": "3.7.2",
 		"@wordpress/core-data": "2.7.5",
 		"@wordpress/data": "4.9.2",
 		"@wordpress/data-controls": "1.3.4",
 		"@wordpress/date": "3.5.0",
 		"@wordpress/deprecated": "2.6.1",
-		"@wordpress/dom": "2.5.2",
+		"@wordpress/dom": "2.5.3",
 		"@wordpress/dom-ready": "2.5.1",
-		"@wordpress/edit-post": "3.8.9",
+		"@wordpress/edit-post": "3.8.10",
-		"@wordpress/editor": "9.7.6",
+		"@wordpress/editor": "9.7.7",
 		"@wordpress/element": "2.8.2",
 		"@wordpress/escape-html": "1.5.1",
-		"@wordpress/format-library": "1.9.5",
+		"@wordpress/format-library": "1.9.6",
 		"@wordpress/hooks": "2.6.0",
 		"@wordpress/html-entities": "2.5.0",
 		"@wordpress/i18n": "3.6.1",
 		"@wordpress/is-shallow-equal": "1.6.1",
 		"@wordpress/keycodes": "2.6.2",
-		"@wordpress/list-reusable-blocks": "1.8.4",
+		"@wordpress/list-reusable-blocks": "1.8.5",
 		"@wordpress/media-utils": "1.2.4",
 		"@wordpress/notices": "1.8.2",
-		"@wordpress/nux": "3.7.2",
+		"@wordpress/nux": "3.7.3",
 		"@wordpress/plugins": "2.7.2",
 		"@wordpress/priority-queue": "1.3.1",
 		"@wordpress/redux-routine": "3.6.2",
-		"@wordpress/rich-text": "3.7.2",
+		"@wordpress/rich-text": "3.7.3",
-		"@wordpress/server-side-render": "1.3.4",
+		"@wordpress/server-side-render": "1.3.5",
 		"@wordpress/shortcode": "2.4.1",
 		"@wordpress/token-list": "1.6.1",
 		"@wordpress/url": "2.8.2",
@@ -123,7 +123,7 @@
 		"jquery-form": "4.2.1",
 		"jquery-hoverintent": "1.8.3",
 		"jquery-ui": "https://github.com/jquery/jquery-ui/archive/1.11.4.tar.gz",
-		"lodash": "4.17.15",
+		"lodash": "4.17.21",
 		"masonry-layout": "3.3.2",
 		"moment": "2.22.2",
 		"polyfill-library": "3.27.4",

src/wp-admin/about.php

@@ -51,6 +51,26 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 		<div class="about__section changelog">
 			<div class="column">
 				<h2><?php _e( 'Maintenance and Security Releases' ); ?></h2>
+				<p>
+					<?php
+					printf(
+						/* translators: %s: WordPress version number */
+						__( '<strong>Version %s</strong> addressed some security issues.' ),
+						'5.3.8'
+					);
+					?>
+					<?php
+					printf(
+						/* translators: %s: HelpHub URL */
+						__( 'For more information, see <a href="%s">the release notes</a>.' ),
+						sprintf(
+							/* translators: %s: WordPress version */
+							esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+							sanitize_title( '5.3.8' )
+						)
+					);
+					?>
+				</p>
 				<p>
 					<?php
 					printf(

src/wp-includes/script-loader.php

@@ -94,7 +94,7 @@ function wp_default_packages_vendor( &$scripts ) {
 		'react'                       => '16.9.0',
 		'react-dom'                   => '16.9.0',
 		'moment'                      => '2.22.2',
-		'lodash'                      => '4.17.15',
+		'lodash'                      => '4.17.21',
 		'wp-polyfill-fetch'           => '3.0.0',
 		'wp-polyfill-formdata'        => '3.0.12',
 		'wp-polyfill-node-contains'   => '3.26.0-0',

tools/webpack/packages.js

@@ -203,6 +203,9 @@ module.exports = function( env = { environment: 'production', watch: false, buil
 				},
 			],
 		},
+		optimization: {
+			moduleIds: mode === 'production' ? 'hashed' : 'named',
+		},
 		plugins: [
 			new DefinePlugin( {
 				// Inject the `GUTENBERG_PHASE` global, used for feature flagging.
@@ -262,7 +265,8 @@ module.exports = function( env = { environment: 'production', watch: false, buil
 		delete config.devtool;
 		config.mode = 'production';
 		config.optimization = {
-			minimize: false
+			minimize: false,
+			moduleIds: 'hashed',
 		};
 	}