[herewithme]

Summary

Security release. Merging into main triggers release.yml, which builds and pushes the 1.2.2 tag from .plugin-data.

release/1.2.2 was branched from main, which already contains the fix (#27, same branch as #25 on develop). This PR only bumps the version: main is still at 1.2.1, an existing tag, so the release workflow stopped after #27.

Content

• Security: the iframe allow attribute only keeps low-risk Permissions Policy features, without origin lists; allowpaymentrequest is no longer rendered (Security: iframe allow attribute lets contributors delegate sensitive browser permissions #24).
• Editor: the block preview is rendered on the server through BlockRenderer, with the same filtering as the front end. Adds @wordpress/server-side-render.

Version bump to 1.2.2

• .plugin-data
• blockparty-iframe.php: header and BLOCKPARTY_IFRAME_VERSION
• package.json / package-lock.json
• src/blockparty-iframe/block.json
• readme.txt: Stable tag and changelog
• .wordpress-org/blueprints/blueprint.json: ref
• languages/blockparty-iframe.pot
• CHANGELOG.md: [1.2.2] - 2026-11-11, plus the missing 1.2.1 and 1.2.2 release links

Test plan

• npx wp-scripts lint-js src: no errors
• phpcs blockparty-iframe.php: no errors
• npm run build: compiled, build/blockparty-iframe/block.json reports 1.2.2
• Tag 1.2.2 does not exist yet
• Fix tested in the block editor (WordPress 7.1.4, wp-env), see fix(security): restrict iframe allow policy to low-risk features #25
• After merge: tag 1.2.2 is created on the merge commit

🤖 Generated with Claude Code

---

Note

Low Risk
Diff is version and documentation updates only; no application logic changes in this PR.

Overview
Release 1.2.2 — this PR aligns all release metadata and docs with the 1.2.2 tag so the release workflow can publish; it does not introduce new runtime code in the diff.

Version strings move from 1.2.1 to 1.2.2 in .plugin-data, blockparty-iframe.php (header and BLOCKPARTY_IFRAME_VERSION), package.json / package-lock.json, src/blockparty-iframe/block.json, languages/blockparty-iframe.pot, WordPress.org Stable tag, and the Playground blueprint install ref.

CHANGELOG.md and readme.txt now ship the 1.2.2 notes (iframe allow allowlisting, dropping allowpaymentrequest, server-side editor preview) and add release links for 1.2.1 and 1.2.2.

^{Reviewed by Cursor Bugbot for commit 3563a95. Bugbot is set up for automated code reviews on this repo. Configure here.}