[ekamran]

wp_parse_widget_id() anchored its pattern with $, which also matches before a final newline, so "text-1\n" was parsed as the Text widget text-1. Creating a widget through POST /wp/v2/widgets with that ID saved the new settings to text-1 and added "text-1\n" to the sidebar, and then returned a 500 error.

WP_REST_Widgets_Controller::update_item() also let an ID that matches no registered widget through when the widget is in no sidebar, so PUT /wp/v2/widgets/{id} with only a sidebar parameter added that ID to the sidebar before returning a 500 error. Fixing only the parser would send "text-1\n" down this path, so both are fixed here.

Trac ticket: https://core.trac.wordpress.org/ticket/66434

What changes

• wp_parse_widget_id() anchors its pattern with \z, so an ID that ends in a newline is no longer split into a base and a number.
• update_item() returns the existing 404 rest_widget_not_found error when the widget is in no sidebar and its ID is not in $wp_registered_widgets. Registered widgets that are not WP_Widget objects can still be updated without a sidebar, as test_create_item_legacy_widget covers.

Testing

• 4 new tests: test_does_not_parse_number_before_trailing_newline, test_create_item_rejects_id_with_trailing_newline, test_update_item_unknown_id_returns_404 and test_update_item_rejects_id_with_trailing_newline.
• On trunk, the first 3 fail. The fourth passes on trunk and fails when only the parser is fixed, which is the case it guards. With only the update_item() change, the parser and create tests fail.
• Locally with PHP 8.3 and MySQL 9.7: the REST widgets, sidebars and widget types controller tests and Tests_Widgets pass (507 tests) on single site and multisite, and the customize group passes (243 tests). PHPCS reports nothing on the changed files.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code and Codex
Used for: Investigation, code, tests, local testing and PR wording. I reviewed the reasoning, the code and the test results, and I take responsibility for the contribution.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props ekamran.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.