chore: Bump the composer group with 4 updates

[dependabot]

Bumps the composer group with 4 updates: roots/wordpress, wp-plugin/gravity-forms-zero-spam, yard/brave-components and captainhook/hook-installer.

Updates roots/wordpress from 7.0.2 to 7.0.3

Release notes

Sourced from roots/wordpress's releases.

Version 7.0.3

Sourced from WordPress.org Documentation.

... (truncated)

Commits

• See full diff in compare view

Updates wp-plugin/gravity-forms-zero-spam from 1.10.0 to 1.10.1

Updates yard/brave-components from 1.7.1 to 1.7.3

Release notes

Sourced from yard/brave-components's releases.

v1.7.3

What's Changed

• fix: add token check to tolkie component by @​laravdiemen in yardinternet/brave-components#53

Full Changelog: yardinternet/brave-components@v1.7.2...v1.7.3

What's Changed

• fix: add token check to tolkie component by @​laravdiemen in yardinternet/brave-components#53

Full Changelog: yardinternet/brave-components@v1.7.2...v1.7.3

v1.7.2

What's Changed

• Refactor/readspeaker by @​FreakyWizard in yardinternet/brave-components#50
• fix: handle null Tolkie token configuration by @​mvdhoek1 in yardinternet/brave-components#52

New Contributors

• @​mvdhoek1 made their first contribution in yardinternet/brave-components#52

Full Changelog: yardinternet/brave-components@v1.7.1...v1.7.2

Changelog

Sourced from yard/brave-components's changelog.

[1.7.3] - 2026-07-31

• Fix: add token check to tolkie component

[1.7.2] - 2026-07-30

• Change: renamed config keys to snake_case (feedback_form_id, read_speaker.customer_id, read_speaker.read_id, read_speaker.automatically_add_to_h1), with backwards-compatible fallback to the old camelCase names
• Fix: handle null Tolkie token configuration
• Chore: add release GitHub workflow

Commits

• 159b43f fix: add token check to tolkie component
• 876dab4 chore: add release GitHub workflow
• 5eb57ea chore: introduce CHANGELOG
• afb2330 fix: handle null Tolkie token configuration
• aa93630 chore: read_speaker
• 2b0d378 chore: remove dd
• 23b8ba2 refactor: feedback_form_id
• 287ffaa refactor: the other vars
• 733cfcb refactor: automatically_add_to_h1 var notation.
• 911138c docs: extend Tolkie docs
• See full diff in compare view

Updates captainhook/hook-installer from 1.0.4 to 1.0.5

Release notes

Sourced from captainhook/hook-installer's releases.

1.0.5

What's Changed

• fix: resolve worktrees whose git directory is not named .git by @​CybotTM in captainhook-git/hook-installer#5

New Contributors

• @​CybotTM made their first contribution in captainhook-git/hook-installer#5

Full Changelog: captainhook-git/hook-installer@1.0.4...1.0.5

Commits

• b184beb Merge pull request #5 from CybotTM/fix/worktree-of-bare-repository
• 2d5d8c9 fix: resolve worktrees whose git directory is not named .git
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[yard-bot]

🔌 WordPress Plugin Changelogs

gravity-forms-zero-spam (v1.10.1)

View changelog

1.10.1 on August 6, 2026

• Fixed: Multi-page forms fetched an anti-spam token on every Next and Previous click, delaying page navigation on slow servers; the token is now only fetched on final submission and Save and Continue

1.10.0 on July 23, 2026

• Added: Shield silentCAPTCHA integration that uses Shield Security’s bot detection as an additional spam signal, with a global default and per-form override (thanks, Paul Goodchild!)
• Added: “Spam Check Order” settings – control the order the token check, Shield silentCAPTCHA, and AI Spam Review run in, and whether to stop checking once a submission is flagged as spam
• Fixed: A spam verdict from one check could be cleared when the submitter was logged in with entry-editing permissions
• API: Added gf_zero_spam_check_order filter to modify the order in which spam checks run

1.9.0 on June 11, 2026

• Added: AI-powered spam review that flags likely spam the token check missed and recovers legitimate submissions it blocked by mistake, powered by an AI service (OpenAI, Anthropic, or Google Gemini) connected in WordPress 7.0+
• Fixed: Per-form links in the spam report email opened an empty Spam entries list, hiding spam received after the previous report

1.8.0 on April 16, 2026

• Added: Translations in 27 languages
• Fixed: Spam report emails could fail to send when the feature was first enabled

1.7.5 on April 9, 2026

• Fixed: Forms rendered in modals or other elements output via wp_footer (e.g., site-wide popups, slide-ins) were missing the spam prevention token, causing legitimate submissions to be flagged as spam

1.7.4 on April 2, 2026

• Added: “Anti-Spam Expiration” setting to control how long spam prevention tokens remain valid, accessible from Forms > Settings > Zero Spam
• Fixed: Email rejection settings and form editor scripts not loading when Gravity Forms No Conflict mode is enabled
• Fixed: Form submission failure (“Cannot read properties of undefined”) caused by the token fetch request failing unexpectedly

1.7.3 on March 24, 2026

• Improved: Extended token lifetime to 7 days and improved token fetching compatibility
• Fixed: Submissions from pages with multiple Gravity Forms were incorrectly marked as spam when the form wasn’t the first one on the page
• Added: gf_zero_spam_token_ttl and gf_zero_spam_fallback_token_ttl filters to adjust the lifetime of dynamically fetched and HTML-embedded fallback tokens respectively (default for both: 7 days)

1.7.2 on March 12, 2026

• Fixed: Forms with conditional logic could be invisible to visitors

1.7.1 on March 6, 2026

• Fixed: Fatal error on sites where AUTH_KEY or SECURE_AUTH_KEY constants are not defined in wp-config.php

1.7.0 on March 5, 2026

• Added: Stronger spam prevention using signed, time-limited tokens
• API: Added gf_zero_spam_client_ip filter to override the visitor IP used for rate limiting (useful for sites behind Cloudflare or load balancers)
• API: Added gf_zero_spam_rate_limit filter to adjust the maximum token requests allowed per IP per minute (default: 30)

1.6.0 on February 27, 2026

• Improved: Removed dependency on jQuery
• Fixed: “Prevent spam using Gravity Forms Zero Spam” toggle appeared twice in form settings

1.5.0 on February 26, 2026

This release requires PHP 7.4 or newer.

• Added: Email rejection ru

  [...truncated]

  View full changelog on WordPress.org

[github-actions]

Composer package changes

Prod Packages	Operation	Base	Target	Link	License
guzzlehttp/guzzle	Upgraded	7.15.2	7.15.3	Compare	MIT
guzzlehttp/promises	Upgraded	2.5.1	2.5.2	Compare	MIT
roots/wordpress	Upgraded	7.0.2	7.0.3	Compare	MIT, GPL-2.0-or-later
roots/wordpress-no-content	Upgraded	7.0.2	7.0.3	Compare	GPL-2.0-or-later
symfony/console	Upgraded	v6.4.42	v6.4.43	Compare	MIT
symfony/error-handler	Upgraded	v6.4.36	v6.4.43	Compare	MIT
symfony/event-dispatcher	Upgraded	v7.4.14	v7.4.15	Compare	MIT
symfony/http-foundation	Upgraded	v6.4.42	v6.4.43	Compare	MIT
symfony/http-kernel	Upgraded	v6.4.42	v6.4.43	Compare	MIT
symfony/mime	Upgraded	v6.4.41	v6.4.43	Compare	MIT
symfony/routing	Upgraded	v6.4.41	v6.4.43	Compare	MIT
symfony/string	Upgraded	v7.4.13	v7.4.15	Compare	MIT
symfony/var-dumper	Upgraded	v6.4.42	v6.4.43	Compare	MIT
wp-plugin/gravity-forms-zero-spam	Upgraded	1.10.0	1.10.1
yard/brave-components	Upgraded	v1.7.1	v1.7.3	Compare	MIT

Dev Packages	Operation	Base	Target	Link	License
captainhook/hook-installer	Upgraded	1.0.4	1.0.5	Compare	MIT