diff --git a/package.json b/package.json
index 9aa478d95a387..f4c110c5dacec 100644
--- a/package.json
+++ b/package.json
@@ -7,7 +7,7 @@
 		"url": "https://develop.svn.wordpress.org/trunk"
 	},
 	"gutenberg": {
-		"ref": "7a11a53377a95cba4d3786d71cadd4c2f0c5ac52"
+		"ref": "b441348bb7e05af351c250b74283f253acaf9138"
 	},
 	"engines": {
 		"node": ">=20.10.0",
diff --git a/src/wp-admin/edit-form-blocks.php b/src/wp-admin/edit-form-blocks.php
index d0f2000fdce17..2237fc69ce293 100644
--- a/src/wp-admin/edit-form-blocks.php
+++ b/src/wp-admin/edit-form-blocks.php
@@ -92,6 +92,12 @@ static function ( $classes ) {
 			'description',
 			'gmt_offset',
 			'home',
+			'image_sizes',
+			'image_size_threshold',
+			'image_output_formats',
+			'jpeg_interlaced',
+			'png_interlaced',
+			'gif_interlaced',
 			'name',
 			'site_icon',
 			'site_icon_url',
diff --git a/src/wp-admin/site-editor.php b/src/wp-admin/site-editor.php
index 1c8e8b525459b..9a8268c3392d7 100644
--- a/src/wp-admin/site-editor.php
+++ b/src/wp-admin/site-editor.php
@@ -218,6 +218,12 @@ static function ( $classes ) {
 			'description',
 			'gmt_offset',
 			'home',
+			'image_sizes',
+			'image_size_threshold',
+			'image_output_formats',
+			'jpeg_interlaced',
+			'png_interlaced',
+			'gif_interlaced',
 			'name',
 			'site_icon',
 			'site_icon_url',
diff --git a/src/wp-includes/default-filters.php b/src/wp-includes/default-filters.php
index 301b846343ee2..2291c92134641 100644
--- a/src/wp-includes/default-filters.php
+++ b/src/wp-includes/default-filters.php
@@ -675,6 +675,13 @@
 add_action( 'plugins_loaded', '_wp_add_additional_image_sizes', 0 );
 add_filter( 'plupload_default_settings', 'wp_show_heic_upload_error' );
 
+// Client-side media processing.
+add_action( 'admin_init', 'wp_set_client_side_media_processing_flag' );
+// Cross-origin isolation for client-side media processing.
+add_action( 'load-post.php', 'wp_set_up_cross_origin_isolation' );
+add_action( 'load-post-new.php', 'wp_set_up_cross_origin_isolation' );
+add_action( 'load-site-editor.php', 'wp_set_up_cross_origin_isolation' );
+add_action( 'load-widgets.php', 'wp_set_up_cross_origin_isolation' );
 // Nav menu.
 add_filter( 'nav_menu_item_id', '_nav_menu_item_id_use_once', 10, 2 );
 add_filter( 'nav_menu_css_class', 'wp_nav_menu_remove_menu_item_has_children_class', 10, 4 );
diff --git a/src/wp-includes/media-template.php b/src/wp-includes/media-template.php
index 80399acd8ce0a..7a8ec1a07056a 100644
--- a/src/wp-includes/media-template.php
+++ b/src/wp-includes/media-template.php
@@ -156,6 +156,12 @@ class="wp-video-shortcode {{ classes.join( ' ' ) }}"
 function wp_print_media_templates() {
 	$class = 'media-modal wp-core-ui';
 
+	$is_cross_origin_isolation_enabled = wp_is_client_side_media_processing_enabled();
+
+	if ( $is_cross_origin_isolation_enabled ) {
+		ob_start();
+	}
+
 	$alt_text_description = sprintf(
 		/* translators: 1: Link to tutorial, 2: Additional link attributes, 3: Accessibility text. */
 		__( '<a href="%1$s" %2$s>Learn how to describe the purpose of the image%3$s</a>. Leave empty if the image is purely decorative.' ),
@@ -1582,4 +1588,42 @@ function wp_print_media_templates() {
 	 * @since 3.5.0
 	 */
 	do_action( 'print_media_templates' );
+
+	if ( $is_cross_origin_isolation_enabled ) {
+		$html = (string) ob_get_clean();
+
+		/*
+		 * The media templates are inside <script type="text/html"> tags,
+		 * whose content is treated as raw text by the HTML Tag Processor.
+		 * Extract each script block's content, process it separately,
+		 * then reassemble the full output.
+		 */
+		$script_processor = new WP_HTML_Tag_Processor( $html );
+		while ( $script_processor->next_tag( 'SCRIPT' ) ) {
+			if ( 'text/html' !== $script_processor->get_attribute( 'type' ) ) {
+				continue;
+			}
+			/*
+			 * Unlike wp_add_crossorigin_attributes(), this does not check whether
+			 * URLs are actually cross-origin. Media templates use Underscore.js
+			 * template expressions (e.g. {{ data.url }}) as placeholder URLs,
+			 * so actual URLs are not available at parse time.
+			 * The crossorigin attribute is added unconditionally to all relevant
+			 * media tags to ensure cross-origin isolation works regardless of
+			 * the final URL value at render time.
+			 */
+			$template_processor = new WP_HTML_Tag_Processor( $script_processor->get_modifiable_text() );
+			while ( $template_processor->next_tag() ) {
+				if (
+					in_array( $template_processor->get_tag(), array( 'AUDIO', 'IMG', 'VIDEO' ), true )
+					&& ! is_string( $template_processor->get_attribute( 'crossorigin' ) )
+				) {
+					$template_processor->set_attribute( 'crossorigin', 'anonymous' );
+				}
+			}
+			$script_processor->set_modifiable_text( $template_processor->get_updated_html() );
+		}
+
+		echo $script_processor->get_updated_html();
+	}
 }
diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php
index 10845a592be47..efb82399ed688 100644
--- a/src/wp-includes/media.php
+++ b/src/wp-includes/media.php
@@ -6359,3 +6359,205 @@ function wp_get_image_editor_output_format( $filename, $mime_type ) {
 	 */
 	return apply_filters( 'image_editor_output_format', $output_format, $filename, $mime_type );
 }
+
+/**
+ * Checks whether client-side media processing is enabled.
+ *
+ * Client-side media processing uses the browser's capabilities to handle
+ * tasks like image resizing and compression before uploading to the server.
+ *
+ * @since 7.0.0
+ *
+ * @return bool Whether client-side media processing is enabled.
+ */
+function wp_is_client_side_media_processing_enabled(): bool {
+	/**
+	 * Filters whether client-side media processing is enabled.
+	 *
+	 * @since 7.0.0
+	 *
+	 * @param bool $enabled Whether client-side media processing is enabled. Default true.
+	 */
+	return (bool) apply_filters( 'wp_client_side_media_processing_enabled', true );
+}
+
+/**
+ * Sets a global JS variable to indicate that client-side media processing is enabled.
+ *
+ * @since 7.0.0
+ */
+function wp_set_client_side_media_processing_flag(): void {
+	if ( ! wp_is_client_side_media_processing_enabled() ) {
+		return;
+	}
+
+	wp_add_inline_script( 'wp-block-editor', 'window.__clientSideMediaProcessing = true', 'before' );
+
+	/*
+	 * Register the @wordpress/vips/worker script module as a dynamic dependency
+	 * of the wp-upload-media classic script. This ensures it is included in the
+	 * import map so that the dynamic import() in upload-media.js can resolve it.
+	 */
+	wp_scripts()->add_data(
+		'wp-upload-media',
+		'module_dependencies',
+		array( '@wordpress/vips/worker' )
+	);
+}
+
+/**
+ * Enables cross-origin isolation in the block editor.
+ *
+ * Required for enabling SharedArrayBuffer for WebAssembly-based
+ * media processing in the editor.
+ *
+ * @since 7.0.0
+ *
+ * @link https://web.dev/coop-coep/
+ */
+function wp_set_up_cross_origin_isolation(): void {
+	if ( ! wp_is_client_side_media_processing_enabled() ) {
+		return;
+	}
+
+	$screen = get_current_screen();
+
+	if ( ! $screen ) {
+		return;
+	}
+
+	if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
+		return;
+	}
+
+	// Cross-origin isolation is not needed if users can't upload files anyway.
+	if ( ! current_user_can( 'upload_files' ) ) {
+		return;
+	}
+
+	wp_start_cross_origin_isolation_output_buffer();
+}
+
+/**
+ * Starts an output buffer to send cross-origin isolation headers.
+ *
+ * Sends headers and uses an output buffer to add crossorigin="anonymous"
+ * attributes where needed.
+ *
+ * @since 7.0.0
+ *
+ * @link https://web.dev/coop-coep/
+ *
+ * @global bool $is_safari
+ */
+function wp_start_cross_origin_isolation_output_buffer(): void {
+	global $is_safari;
+
+	$coep = $is_safari ? 'require-corp' : 'credentialless';
+
+	ob_start(
+		static function ( string $output ) use ( $coep ): string {
+			header( 'Cross-Origin-Opener-Policy: same-origin' );
+			header( "Cross-Origin-Embedder-Policy: $coep" );
+
+			return wp_add_crossorigin_attributes( $output );
+		}
+	);
+}
+
+/**
+ * Adds crossorigin="anonymous" to relevant tags in the given HTML string.
+ *
+ * @since 7.0.0
+ *
+ * @param string $html HTML input.
+ * @return string Modified HTML.
+ */
+function wp_add_crossorigin_attributes( string $html ): string {
+	$site_url = site_url();
+
+	$processor = new WP_HTML_Tag_Processor( $html );
+
+	// See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin.
+	$cross_origin_tag_attributes = array(
+		'AUDIO'  => array( 'src' => false ),
+		'IMG'    => array(
+			'src'    => false,
+			'srcset' => true,
+		),
+		'LINK'   => array(
+			'href'        => false,
+			'imagesrcset' => true,
+		),
+		'SCRIPT' => array( 'src' => false ),
+		'VIDEO'  => array(
+			'src'    => false,
+			'poster' => false,
+		),
+		'SOURCE' => array( 'src' => false ),
+	);
+
+	while ( $processor->next_tag() ) {
+		$tag = $processor->get_tag();
+
+		if ( ! isset( $cross_origin_tag_attributes[ $tag ] ) ) {
+			continue;
+		}
+
+		if ( 'AUDIO' === $tag || 'VIDEO' === $tag ) {
+			$processor->set_bookmark( 'audio-video-parent' );
+		}
+
+		$processor->set_bookmark( 'resume' );
+
+		$sought = false;
+
+		$crossorigin = $processor->get_attribute( 'crossorigin' );
+
+		$is_cross_origin = false;
+
+		foreach ( $cross_origin_tag_attributes[ $tag ] as $attr => $is_srcset ) {
+			if ( $is_srcset ) {
+				$srcset = $processor->get_attribute( $attr );
+				if ( is_string( $srcset ) ) {
+					foreach ( explode( ',', $srcset ) as $candidate ) {
+						$candidate_url = strtok( trim( $candidate ), ' ' );
+						if ( is_string( $candidate_url ) && '' !== $candidate_url && ! str_starts_with( $candidate_url, $site_url ) && ! str_starts_with( $candidate_url, '/' ) ) {
+							$is_cross_origin = true;
+							break;
+						}
+					}
+				}
+			} else {
+				$url = $processor->get_attribute( $attr );
+				if ( is_string( $url ) && ! str_starts_with( $url, $site_url ) && ! str_starts_with( $url, '/' ) ) {
+					$is_cross_origin = true;
+				}
+			}
+
+			if ( $is_cross_origin ) {
+				break;
+			}
+		}
+
+		if ( $is_cross_origin && ! is_string( $crossorigin ) ) {
+			if ( 'SOURCE' === $tag ) {
+				$sought = $processor->seek( 'audio-video-parent' );
+
+				if ( $sought ) {
+					$processor->set_attribute( 'crossorigin', 'anonymous' );
+				}
+			} else {
+				$processor->set_attribute( 'crossorigin', 'anonymous' );
+			}
+
+			if ( $sought ) {
+				$processor->seek( 'resume' );
+				$processor->release_bookmark( 'audio-video-parent' );
+			}
+		}
+	}
+
+	return $processor->get_updated_html();
+}
+
diff --git a/src/wp-includes/rest-api/class-wp-rest-server.php b/src/wp-includes/rest-api/class-wp-rest-server.php
index dbf605523d2dc..2953d50505577 100644
--- a/src/wp-includes/rest-api/class-wp-rest-server.php
+++ b/src/wp-includes/rest-api/class-wp-rest-server.php
@@ -1368,6 +1368,34 @@ public function get_index( $request ) {
 			'routes'          => $this->get_data_for_routes( $this->get_routes(), $request['context'] ),
 		);
 
+		// Add media processing settings for users who can upload files.
+		if ( wp_is_client_side_media_processing_enabled() && current_user_can( 'upload_files' ) ) {
+			// Image sizes keyed by name for client-side media processing.
+			$available['image_sizes'] = array();
+			foreach ( wp_get_registered_image_subsizes() as $name => $size ) {
+				$available['image_sizes'][ $name ] = $size;
+			}
+
+			/** This filter is documented in wp-admin/includes/image.php */
+			$available['image_size_threshold'] = (int) apply_filters( 'big_image_size_threshold', 2560, array( 0, 0 ), '', 0 );
+
+			// Image output formats.
+			$input_formats  = array( 'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/avif', 'image/heic' );
+			$output_formats = array();
+			foreach ( $input_formats as $mime_type ) {
+				/** This filter is documented in wp-includes/class-wp-image-editor.php */
+				$output_formats = apply_filters( 'image_editor_output_format', $output_formats, '', $mime_type );
+			}
+			$available['image_output_formats'] = (object) $output_formats;
+
+			/** This filter is documented in wp-includes/class-wp-image-editor-imagick.php */
+			$available['jpeg_interlaced'] = (bool) apply_filters( 'image_save_progressive', false, 'image/jpeg' );
+			/** This filter is documented in wp-includes/class-wp-image-editor-imagick.php */
+			$available['png_interlaced']  = (bool) apply_filters( 'image_save_progressive', false, 'image/png' );
+			/** This filter is documented in wp-includes/class-wp-image-editor-imagick.php */
+			$available['gif_interlaced']  = (bool) apply_filters( 'image_save_progressive', false, 'image/gif' );
+		}
+
 		$response = new WP_REST_Response( $available );
 
 		$fields = $request['_fields'] ?? '';
diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
index f824b0c9e2cab..1a135ba546779 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
@@ -63,6 +63,75 @@ public function register_routes() {
 				'args'                => $this->get_edit_media_item_args(),
 			)
 		);
+
+		if ( wp_is_client_side_media_processing_enabled() ) {
+			$valid_image_sizes = array_keys( wp_get_registered_image_subsizes() );
+			// Special case to set 'original_image' in attachment metadata.
+			$valid_image_sizes[] = 'original';
+			// Used for PDF thumbnails.
+			$valid_image_sizes[] = 'full';
+
+			register_rest_route(
+				$this->namespace,
+				'/' . $this->rest_base . '/(?P<id>[\d]+)/sideload',
+				array(
+					array(
+						'methods'             => WP_REST_Server::CREATABLE,
+						'callback'            => array( $this, 'sideload_item' ),
+						'permission_callback' => array( $this, 'sideload_item_permissions_check' ),
+						'args'                => array(
+							'id'             => array(
+								'description' => __( 'Unique identifier for the attachment.' ),
+								'type'        => 'integer',
+							),
+							'image_size'     => array(
+								'description' => __( 'Image size.' ),
+								'type'        => 'string',
+								'enum'        => $valid_image_sizes,
+								'required'    => true,
+							),
+							'convert_format' => array(
+								'type'        => 'boolean',
+								'default'     => true,
+								'description' => __( 'Whether to convert image formats.' ),
+							),
+						),
+					),
+					'allow_batch' => $this->allow_batch,
+					'schema'      => array( $this, 'get_public_item_schema' ),
+				)
+			);
+		}
+	}
+
+	/**
+	 * Retrieves the query params for the attachments collection.
+	 *
+	 * @since 7.0.0
+	 *
+	 * @param string $method Optional. HTTP method of the request.
+	 *                       The arguments for `CREATABLE` requests are
+	 *                       checked for required values and may fall-back to a given default.
+	 *                       Default WP_REST_Server::CREATABLE.
+	 * @return array<string, array<string, mixed>> Endpoint arguments.
+	 */
+	public function get_endpoint_args_for_item_schema( $method = WP_REST_Server::CREATABLE ) {
+		$args = parent::get_endpoint_args_for_item_schema( $method );
+
+		if ( WP_REST_Server::CREATABLE === $method && wp_is_client_side_media_processing_enabled() ) {
+			$args['generate_sub_sizes'] = array(
+				'type'        => 'boolean',
+				'default'     => true,
+				'description' => __( 'Whether to generate image sub sizes.' ),
+			);
+			$args['convert_format']     = array(
+				'type'        => 'boolean',
+				'default'     => true,
+				'description' => __( 'Whether to convert image formats.' ),
+			);
+		}
+
+		return $args;
 	}
 
 	/**
@@ -192,6 +261,7 @@ public function create_item_permissions_check( $request ) {
 	 * Creates a single attachment.
 	 *
 	 * @since 4.7.0
+	 * @since 7.0.0 Added `generate_sub_sizes` and `convert_format` parameters.
 	 *
 	 * @param WP_REST_Request $request Full details about the request.
 	 * @return WP_REST_Response|WP_Error Response object on success, WP_Error object on failure.
@@ -205,9 +275,24 @@ public function create_item( $request ) {
 			);
 		}
 
+		// Handle generate_sub_sizes parameter.
+		if ( isset( $request['generate_sub_sizes'] ) && ! $request['generate_sub_sizes'] ) {
+			add_filter( 'intermediate_image_sizes_advanced', '__return_empty_array', 100 );
+			add_filter( 'fallback_intermediate_image_sizes', '__return_empty_array', 100 );
+			// Disable server-side EXIF rotation so the client can handle it.
+			// This preserves the original orientation value in the metadata.
+			add_filter( 'wp_image_maybe_exif_rotate', '__return_false', 100 );
+		}
+
+		// Handle convert_format parameter.
+		if ( isset( $request['convert_format'] ) && ! $request['convert_format'] ) {
+			add_filter( 'image_editor_output_format', '__return_empty_array', 100 );
+		}
+
 		$insert = $this->insert_attachment( $request );
 
 		if ( is_wp_error( $insert ) ) {
+			$this->remove_client_side_media_processing_filters();
 			return $insert;
 		}
 
@@ -225,6 +310,7 @@ public function create_item( $request ) {
 			$thumbnail_update = $this->handle_featured_media( $request['featured_media'], $attachment_id );
 
 			if ( is_wp_error( $thumbnail_update ) ) {
+				$this->remove_client_side_media_processing_filters();
 				return $thumbnail_update;
 			}
 		}
@@ -233,6 +319,7 @@ public function create_item( $request ) {
 			$meta_update = $this->meta->update_value( $request['meta'], $attachment_id );
 
 			if ( is_wp_error( $meta_update ) ) {
+				$this->remove_client_side_media_processing_filters();
 				return $meta_update;
 			}
 		}
@@ -241,12 +328,14 @@ public function create_item( $request ) {
 		$fields_update = $this->update_additional_fields_for_object( $attachment, $request );
 
 		if ( is_wp_error( $fields_update ) ) {
+			$this->remove_client_side_media_processing_filters();
 			return $fields_update;
 		}
 
 		$terms_update = $this->handle_terms( $attachment_id, $request );
 
 		if ( is_wp_error( $terms_update ) ) {
+			$this->remove_client_side_media_processing_filters();
 			return $terms_update;
 		}
 
@@ -283,6 +372,8 @@ public function create_item( $request ) {
 		 */
 		wp_update_attachment_metadata( $attachment_id, wp_generate_attachment_metadata( $attachment_id, $file ) );
 
+		$this->remove_client_side_media_processing_filters();
+
 		$response = $this->prepare_item_for_response( $attachment, $request );
 		$response = rest_ensure_response( $response );
 		$response->set_status( 201 );
@@ -291,6 +382,18 @@ public function create_item( $request ) {
 		return $response;
 	}
 
+	/**
+	 * Removes filters added for client-side media processing.
+	 *
+	 * @since 7.0.0
+	 */
+	private function remove_client_side_media_processing_filters() {
+		remove_filter( 'intermediate_image_sizes_advanced', '__return_empty_array', 100 );
+		remove_filter( 'fallback_intermediate_image_sizes', '__return_empty_array', 100 );
+		remove_filter( 'wp_image_maybe_exif_rotate', '__return_false', 100 );
+		remove_filter( 'image_editor_output_format', '__return_empty_array', 100 );
+	}
+
 	/**
 	 * Inserts the attachment post in the database. Does not update the attachment meta.
 	 *
@@ -988,6 +1091,59 @@ public function prepare_item_for_response( $item, $request ) {
 		if ( in_array( 'missing_image_sizes', $fields, true ) ) {
 			require_once ABSPATH . 'wp-admin/includes/image.php';
 			$data['missing_image_sizes'] = array_keys( wp_get_missing_image_subsizes( $post->ID ) );
+
+			// Handle PDFs which don't use wp_get_missing_image_subsizes().
+			if ( empty( $data['missing_image_sizes'] ) && 'application/pdf' === get_post_mime_type( $post ) ) {
+				$metadata = wp_get_attachment_metadata( $post->ID, true );
+
+				if ( ! is_array( $metadata ) ) {
+					$metadata = array();
+				}
+
+				$metadata['sizes'] = $metadata['sizes'] ?? array();
+
+				$fallback_sizes = array(
+					'thumbnail',
+					'medium',
+					'large',
+				);
+
+				// The filter might have been added by ::create_item().
+				remove_filter( 'fallback_intermediate_image_sizes', '__return_empty_array', 100 );
+
+				/** This filter is documented in wp-admin/includes/image.php */
+				$fallback_sizes = apply_filters( 'fallback_intermediate_image_sizes', $fallback_sizes, $metadata );
+
+				$registered_sizes = wp_get_registered_image_subsizes();
+				$merged_sizes     = array_keys( array_intersect_key( $registered_sizes, array_flip( $fallback_sizes ) ) );
+
+				$data['missing_image_sizes'] = array_values( array_diff( $merged_sizes, array_keys( $metadata['sizes'] ) ) );
+			}
+		}
+
+		if ( in_array( 'filename', $fields, true ) ) {
+			$data['filename'] = $this->get_attachment_filename( $post->ID );
+		}
+
+		if ( in_array( 'filesize', $fields, true ) ) {
+			$data['filesize'] = $this->get_attachment_filesize( $post->ID );
+		}
+
+		if ( in_array( 'exif_orientation', $fields, true ) && wp_attachment_is_image( $post ) ) {
+			$metadata = wp_get_attachment_metadata( $post->ID, true );
+
+			// Default to 1 (no rotation needed) if orientation not set.
+			$orientation = 1;
+
+			if (
+				is_array( $metadata ) &&
+				isset( $metadata['image_meta']['orientation'] ) &&
+				(int) $metadata['image_meta']['orientation'] > 0
+			) {
+				$orientation = (int) $metadata['image_meta']['orientation'];
+			}
+
+			$data['exif_orientation'] = $orientation;
 		}
 
 		$context = ! empty( $request['context'] ) ? $request['context'] : 'view';
@@ -1159,6 +1315,27 @@ public function get_item_schema() {
 			'readonly'    => true,
 		);
 
+		$schema['properties']['filename'] = array(
+			'description' => __( 'Original attachment file name.' ),
+			'type'        => 'string',
+			'context'     => array( 'view', 'edit' ),
+			'readonly'    => true,
+		);
+
+		$schema['properties']['filesize'] = array(
+			'description' => __( 'Attachment file size in bytes.' ),
+			'type'        => 'integer',
+			'context'     => array( 'view', 'edit' ),
+			'readonly'    => true,
+		);
+
+		$schema['properties']['exif_orientation'] = array(
+			'description' => __( 'EXIF orientation value. Values 1-8 follow the EXIF specification, where 1 means no rotation needed.' ),
+			'type'        => 'integer',
+			'context'     => array( 'edit' ),
+			'readonly'    => true,
+		);
+
 		unset( $schema['properties']['password'] );
 
 		$this->schema = $schema;
@@ -1724,4 +1901,235 @@ protected function get_edit_media_item_args() {
 
 		return $args;
 	}
+
+	/**
+	 * Gets the attachment's original file name.
+	 *
+	 * @since 7.0.0
+	 *
+	 * @param int $attachment_id Attachment ID.
+	 * @return string|null Attachment file name, or null if not found.
+	 */
+	protected function get_attachment_filename( int $attachment_id ): ?string {
+		$path = wp_get_original_image_path( $attachment_id );
+
+		if ( $path ) {
+			return wp_basename( $path );
+		}
+
+		$path = get_attached_file( $attachment_id );
+
+		if ( $path ) {
+			return wp_basename( $path );
+		}
+
+		return null;
+	}
+
+	/**
+	 * Gets the attachment's file size in bytes.
+	 *
+	 * @since 7.0.0
+	 *
+	 * @param int $attachment_id Attachment ID.
+	 * @return int|null Attachment file size in bytes, or null if not available.
+	 */
+	protected function get_attachment_filesize( int $attachment_id ): ?int {
+		$meta = wp_get_attachment_metadata( $attachment_id );
+
+		if ( isset( $meta['filesize'] ) ) {
+			return $meta['filesize'];
+		}
+
+		$original_path = wp_get_original_image_path( $attachment_id );
+		$attached_file = $original_path ? $original_path : get_attached_file( $attachment_id );
+
+		if ( is_string( $attached_file ) && is_readable( $attached_file ) ) {
+			return wp_filesize( $attached_file );
+		}
+
+		return null;
+	}
+
+	/**
+	 * Checks if a given request has access to sideload a file.
+	 *
+	 * Sideloading a file for an existing attachment
+	 * requires both update and create permissions.
+	 *
+	 * @since 7.0.0
+	 *
+	 * @param WP_REST_Request $request Full details about the request.
+	 * @return true|WP_Error True if the request has access to update the item, WP_Error object otherwise.
+	 */
+	public function sideload_item_permissions_check( $request ) {
+		return $this->edit_media_item_permissions_check( $request );
+	}
+
+	/**
+	 * Side-loads a media file without creating a new attachment.
+	 *
+	 * @since 7.0.0
+	 *
+	 * @param WP_REST_Request $request Full details about the request.
+	 * @return WP_REST_Response|WP_Error Response object on success, WP_Error object on failure.
+	 */
+	public function sideload_item( WP_REST_Request $request ) {
+		$attachment_id = $request['id'];
+
+		$post = $this->get_post( $attachment_id );
+
+		if ( is_wp_error( $post ) ) {
+			return $post;
+		}
+
+		if (
+			! wp_attachment_is_image( $post ) &&
+			! wp_attachment_is( 'pdf', $post )
+		) {
+			return new WP_Error(
+				'rest_post_invalid_id',
+				__( 'Invalid post ID. Only images and PDFs can be sideloaded.' ),
+				array( 'status' => 400 )
+			);
+		}
+
+		if ( isset( $request['convert_format'] ) && ! $request['convert_format'] ) {
+			// Prevent image conversion as that is done client-side.
+			add_filter( 'image_editor_output_format', '__return_empty_array', 100 );
+		}
+
+		// Get the file via $_FILES or raw data.
+		$files   = $request->get_file_params();
+		$headers = $request->get_headers();
+
+		/*
+		 * wp_unique_filename() will always add numeric suffix if the name looks like a sub-size to avoid conflicts.
+		 * See /wp-includes/functions.php.
+		 * With the following filter we can work around this safeguard.
+		 */
+		$attachment_filename = get_attached_file( $attachment_id, true );
+		$attachment_filename = $attachment_filename ? wp_basename( $attachment_filename ) : null;
+
+		$filter_filename = static function ( $filename, $ext, $dir, $unique_filename_callback, $alt_filenames, $number ) use ( $attachment_filename ) {
+			return self::filter_wp_unique_filename( $filename, $dir, $number, $attachment_filename );
+		};
+
+		add_filter( 'wp_unique_filename', $filter_filename, 10, 6 );
+
+		$parent_post = get_post_parent( $attachment_id );
+
+		$time = null;
+
+		// Matches logic in media_handle_upload().
+		// The post date doesn't usually matter for pages, so don't backdate this upload.
+		if ( $parent_post && 'page' !== $parent_post->post_type && ! str_starts_with( $parent_post->post_date, '0000-00-00' ) ) {
+			$time = $parent_post->post_date;
+		}
+
+		if ( ! empty( $files ) ) {
+			$file = $this->upload_from_file( $files, $headers, $time );
+		} else {
+			$file = $this->upload_from_data( $request->get_body(), $headers, $time );
+		}
+
+		remove_filter( 'wp_unique_filename', $filter_filename );
+		remove_filter( 'image_editor_output_format', '__return_empty_array', 100 );
+
+		if ( is_wp_error( $file ) ) {
+			return $file;
+		}
+
+		$type = $file['type'];
+		$path = $file['file'];
+
+		$image_size = $request['image_size'];
+
+		$metadata = wp_get_attachment_metadata( $attachment_id, true );
+
+		if ( ! $metadata ) {
+			$metadata = array();
+		}
+
+		if ( 'original' === $image_size ) {
+			$metadata['original_image'] = wp_basename( $path );
+		} else {
+			$metadata['sizes'] = $metadata['sizes'] ?? array();
+
+			$size = wp_getimagesize( $path );
+
+			$metadata['sizes'][ $image_size ] = array(
+				'width'     => $size ? $size[0] : 0,
+				'height'    => $size ? $size[1] : 0,
+				'file'      => wp_basename( $path ),
+				'mime-type' => $type,
+				'filesize'  => wp_filesize( $path ),
+			);
+		}
+
+		wp_update_attachment_metadata( $attachment_id, $metadata );
+
+		$response_request = new WP_REST_Request(
+			WP_REST_Server::READABLE,
+			rest_get_route_for_post( $attachment_id )
+		);
+
+		$response_request['context'] = 'edit';
+
+		if ( isset( $request['_fields'] ) ) {
+			$response_request['_fields'] = $request['_fields'];
+		}
+
+		$response = $this->prepare_item_for_response( get_post( $attachment_id ), $response_request );
+
+		$response->header( 'Location', rest_url( rest_get_route_for_post( $attachment_id ) ) );
+
+		return $response;
+	}
+
+	/**
+	 * Filters wp_unique_filename during sideloads.
+	 *
+	 * wp_unique_filename() will always add numeric suffix if the name looks like a sub-size to avoid conflicts.
+	 * Adding this closure to the filter helps work around this safeguard.
+	 *
+	 * Example: when uploading myphoto.jpeg, WordPress normally creates myphoto-150x150.jpeg,
+	 * and when uploading myphoto-150x150.jpeg, it will be renamed to myphoto-150x150-1.jpeg
+	 * However, here it is desired not to add the suffix in order to maintain the same
+	 * naming convention as if the file was uploaded regularly.
+	 *
+	 * @since 7.0.0
+	 *
+	 * @link https://github.com/WordPress/wordpress-develop/blob/30954f7ac0840cfdad464928021d7f380940c347/src/wp-includes/functions.php#L2576-L2582
+	 *
+	 * @param string      $filename            Unique file name.
+	 * @param string      $dir                 Directory path.
+	 * @param int|string  $number              The highest number that was used to make the file name unique
+	 *                                         or an empty string if unused.
+	 * @param string|null $attachment_filename Original attachment file name.
+	 * @return string Filtered file name.
+	 */
+	private static function filter_wp_unique_filename( $filename, $dir, $number, $attachment_filename ) {
+		if ( empty( $number ) || ! $attachment_filename ) {
+			return $filename;
+		}
+
+		$ext       = pathinfo( $filename, PATHINFO_EXTENSION );
+		$name      = pathinfo( $filename, PATHINFO_FILENAME );
+		$orig_name = pathinfo( $attachment_filename, PATHINFO_FILENAME );
+
+		if ( ! $ext || ! $name ) {
+			return $filename;
+		}
+
+		$matches = array();
+		if ( preg_match( '/(.*)(-\d+x\d+)-' . $number . '$/', $name, $matches ) ) {
+			$filename_without_suffix = $matches[1] . $matches[2] . ".$ext";
+			if ( $matches[1] === $orig_name && ! file_exists( "$dir/$filename_without_suffix" ) ) {
+				return $filename_without_suffix;
+			}
+		}
+
+		return $filename;
+	}
 }
diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 6d1b7dee5d0bf..f9ea36720baea 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -310,6 +310,10 @@ function wp_default_packages_scripts( $scripts ) {
 
 		$scripts->add( $handle, $path, $dependencies, $package_data['version'], 1 );
 
+		if ( ! empty( $package_data['module_dependencies'] ) ) {
+			$scripts->add_data( $handle, 'module_dependencies', $package_data['module_dependencies'] );
+		}
+
 		if ( in_array( 'wp-i18n', $dependencies, true ) ) {
 			$scripts->set_translations( $handle );
 		}
diff --git a/tests/phpunit/tests/rest-api/rest-attachments-controller.php b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
index 05029e0845d96..796e58c45d97d 100644
--- a/tests/phpunit/tests/rest-api/rest-attachments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-attachments-controller.php
@@ -1939,9 +1939,12 @@ public function test_get_item_schema() {
 		$response   = rest_get_server()->dispatch( $request );
 		$data       = $response->get_data();
 		$properties = $data['schema']['properties'];
-		$this->assertCount( 29, $properties );
+		$this->assertCount( 32, $properties );
 		$this->assertArrayHasKey( 'author', $properties );
 		$this->assertArrayHasKey( 'alt_text', $properties );
+		$this->assertArrayHasKey( 'exif_orientation', $properties );
+		$this->assertArrayHasKey( 'filename', $properties );
+		$this->assertArrayHasKey( 'filesize', $properties );
 		$this->assertArrayHasKey( 'caption', $properties );
 		$this->assertArrayHasKey( 'raw', $properties['caption']['properties'] );
 		$this->assertArrayHasKey( 'rendered', $properties['caption']['properties'] );
diff --git a/tests/phpunit/tests/rest-api/rest-schema-setup.php b/tests/phpunit/tests/rest-api/rest-schema-setup.php
index 9c6c431e5ef35..0e0e00b934359 100644
--- a/tests/phpunit/tests/rest-api/rest-schema-setup.php
+++ b/tests/phpunit/tests/rest-api/rest-schema-setup.php
@@ -109,6 +109,7 @@ public function test_expected_routes_in_schema() {
 			'/wp/v2/media/(?P<id>[\\d]+)',
 			'/wp/v2/media/(?P<id>[\\d]+)/post-process',
 			'/wp/v2/media/(?P<id>[\\d]+)/edit',
+			'/wp/v2/media/(?P<id>[\\d]+)/sideload',
 			'/wp/v2/blocks',
 			'/wp/v2/blocks/(?P<id>[\d]+)',
 			'/wp/v2/blocks/(?P<id>[\d]+)/autosaves',
diff --git a/tests/qunit/fixtures/wp-api-generated.js b/tests/qunit/fixtures/wp-api-generated.js
index 5caf39e3b4fdf..8963ff1615f8c 100644
--- a/tests/qunit/fixtures/wp-api-generated.js
+++ b/tests/qunit/fixtures/wp-api-generated.js
@@ -3148,6 +3148,18 @@ mockedApiResponse.Schema = {
                             "description": "The ID for the associated post of the attachment.",
                             "type": "integer",
                             "required": false
+                        },
+                        "generate_sub_sizes": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Whether to generate image sub sizes.",
+                            "required": false
+                        },
+                        "convert_format": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Whether to convert image formats.",
+                            "required": false
                         }
                     }
                 }
@@ -3664,6 +3676,47 @@ mockedApiResponse.Schema = {
                 }
             ]
         },
+        "/wp/v2/media/(?P<id>[\\d]+)/sideload": {
+            "namespace": "wp/v2",
+            "methods": [
+                "POST"
+            ],
+            "endpoints": [
+                {
+                    "methods": [
+                        "POST"
+                    ],
+                    "args": {
+                        "id": {
+                            "description": "Unique identifier for the attachment.",
+                            "type": "integer",
+                            "required": false
+                        },
+                        "image_size": {
+                            "description": "Image size.",
+                            "type": "string",
+                            "enum": [
+                                "thumbnail",
+                                "medium",
+                                "medium_large",
+                                "large",
+                                "1536x1536",
+                                "2048x2048",
+                                "original",
+                                "full"
+                            ],
+                            "required": true
+                        },
+                        "convert_format": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Whether to convert image formats.",
+                            "required": false
+                        }
+                    }
+                }
+            ]
+        },
         "/wp/v2/menu-items": {
             "namespace": "wp/v2",
             "methods": [
@@ -12700,6 +12753,43 @@ mockedApiResponse.Schema = {
             ]
         }
     },
+    "image_sizes": {
+        "thumbnail": {
+            "width": 150,
+            "height": 150,
+            "crop": true
+        },
+        "medium": {
+            "width": 300,
+            "height": 300,
+            "crop": false
+        },
+        "medium_large": {
+            "width": 768,
+            "height": 0,
+            "crop": false
+        },
+        "large": {
+            "width": 1024,
+            "height": 1024,
+            "crop": false
+        },
+        "1536x1536": {
+            "width": 1536,
+            "height": 1536,
+            "crop": false
+        },
+        "2048x2048": {
+            "width": 2048,
+            "height": 2048,
+            "crop": false
+        }
+    },
+    "image_size_threshold": 2560,
+    "image_output_formats": {},
+    "jpeg_interlaced": false,
+    "png_interlaced": false,
+    "gif_interlaced": false,
     "site_logo": 0,
     "site_icon": 0,
     "site_icon_url": ""
@@ -13512,6 +13602,8 @@ mockedApiResponse.MediaCollection = [
         "media_details": {},
         "post": null,
         "source_url": "http://example.org/wp-content/uploads//tmp/canola.jpg",
+        "filename": "canola.jpg",
+        "filesize": null,
         "_links": {
             "self": [
                 {
@@ -13589,7 +13681,9 @@ mockedApiResponse.MediaModel = {
     "mime_type": "image/jpeg",
     "media_details": {},
     "post": null,
-    "source_url": "http://example.org/wp-content/uploads//tmp/canola.jpg"
+    "source_url": "http://example.org/wp-content/uploads//tmp/canola.jpg",
+    "filename": "canola.jpg",
+    "filesize": null
 };
 
 mockedApiResponse.TypesCollection = {
diff --git a/tools/gutenberg/copy-gutenberg-build.js b/tools/gutenberg/copy-gutenberg-build.js
index 36b55bcae5d64..0d1c454ca8085 100644
--- a/tools/gutenberg/copy-gutenberg-build.js
+++ b/tools/gutenberg/copy-gutenberg-build.js
@@ -441,15 +441,11 @@ function generateScriptLoaderPackages() {
 				// Parse PHP array to JavaScript object
 				const assetData = parsePHPArray( match[ 1 ] );
 
-				// For regular scripts, use dependencies as-is
-				// Keep dependencies array (don't use module_dependencies)
+				// For regular scripts, use dependencies as-is.
 				if ( ! assetData.dependencies ) {
 					assetData.dependencies = [];
 				}
 
-				// Remove module_dependencies if present (not used for regular scripts)
-				delete assetData.module_dependencies;
-
 				// Create entries for both minified and non-minified versions
 				const jsPathMin = `${ entry.name }.min.js`;
 				const jsPathRegular = `${ entry.name }.js`;
@@ -920,9 +916,11 @@ async function main() {
 	const scriptsSrc = path.join( gutenbergBuildDir, scriptsConfig.source );
 	const scriptsDest = path.join( wpIncludesDir, scriptsConfig.destination );
 
-	// Transform function to remove source map comments from all JS files
+	// Transform function to remove source map comments from all JS files.
+	// Only match actual source map comments at the start of a line (possibly
+	// with whitespace), not occurrences inside string literals.
 	const removeSourceMaps = ( content ) => {
-		return content.replace( /\/\/# sourceMappingURL=.*$/gm, '' ).trimEnd();
+		return content.replace( /^\s*\/\/# sourceMappingURL=.*$/gm, '' ).trimEnd();
 	};
 
 	if ( fs.existsSync( scriptsSrc ) ) {