X-post: The Core Security Initiative: two months in

X-comment from +make.wordpress.org/security: Comment on The Core Security Initiative: two months in

Exploring a design for Feature Notifications

WordPress doesn’t have a good way to tell people what’s happening on their site. Plugins fall back on adminadmin (and super admin) notices that push the page down, so the things that matter, like a failed payment, a security update or a teammate’s question, get lost among reminders and promotions.

Feature Notifications is building a shared fix (status and plan for 0.3.0, weekly updates): one place for what happens on a site, where real problems stand out and people control what they get. Alongside that work, I’ve been exploring what it could look like, and testing it against a real pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party.: every message WooCommerce and WooPayments show today.

Image

↪ Walkthrough video (7 min), the concept | Live demo | Catalog, the system behind it | issue #655

The idea

Today, every plugin tells people things its own way: admin notices that push content down the page, inbox cards, banners, badges. There’s no shared sense of what’s important, so the important things get lost among the rest.

The idea is a better place to show what happens on a site, with a baseline of rules plugins can follow, and in return be seen everywhere in WordPress, including the editor and the front of the site:

  • One bell for the site, its plugins and WordPress.comWordPress.com An online implementation of WordPress code that lets you immediately access a new WordPress environment to publish your content. WordPress.com is a private company owned by Automattic that hosts the largest multisite in the world. This is arguably the best place to start blogging if you have never touched WordPress before. https://wordpress.com/.
  • Each notification opens to show what it’s about (an order, a post), who it’s from, and one clear next step.
  • Real problems stay on top until they’re dealt with. Everything else stays out of the way.

The design is inspired by the WordPress.com notifications panel by Ollie Rozdarz and the WordPress.com notifications team, tested and refined with millions of people every day.

Image

What this is, and isn’t

What this is: a new way to reach people. One notification tray, available not only on certain admin pages like today’s notices, but everywhere: every admin screen, inside the editor, and on the front of the site. Plugins that use it get their message across consistently, instead of resorting to bigger and bigger notices that push the page down. It comes with a design direction and a set of rules, so notifications look and behave the same whoever sends them.

What this isn’t: a breaking change. Existing plugins keep working, and no APIs or hooksHooks In WordPress theme and development, hooks are functions that can be applied to an action or a Filter in WordPress. Actions are functions performed when a certain event occurs in WordPress. Filters allow you to modify certain functions. Arguments used to hook both filters and actions look the same. are being removed. Admin notices, custom ones included, will still work. They’re just not where notifications in WordPress are heading. It also isn’t finished, or all for 0.3.0.

A clearer system

This is the second version of the prototype. The first showed the idea. Early feedback asked how much is the system and how much is left to each plugin, so the second is about rules (what changed):

  • Plugins send data, not layout. They pick one of four layouts and fill its fields: Standard, Object (with a card for what it’s about), Conversation and Group.
  • Five separate dimensions, each changing something different. A dispute, for example, is a payment (type), critical (severityseverity The seriousness of the ticket in the eyes of the reporter. Generally, severity is a judgment of how bad a bug is, while priority is its relationship to other bugs.), operational (intent) and unread (read state), with the sender’s status “Needs response”, later “Won”. CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. owns the values; plugins choose from them.
  • Critical is rare and visible. It stays on top and turns the bell’s count red until it’s resolved, not just read.
  • An Alerts tab gathers critical notifications and warnings in one place, with a count, so what needs attention is always one click away. Warnings wait there until they’re dealt with.
  • Limits against noise. Repeats replace each other, many of the same become one, and tips and offers can all be turned off at once.

All of this is laid out in the catalog: System has the dimensions, layouts and rules, and Styles shows each part, from the badges and row states to the bell itself.

Image

This version also adds a few smaller things people asked for. Density, in the ⚙ menu under Appearance, switches between comfortable and compact: one line per row, so busy sites see twice as many at once. Notifications can also be marked as unread from their ⋮ menu.

Image

Open questions

These are open, and feedback on them is especially welcome.

Badges: one per type, or a few kinds?

Today each type of notification has its own small badge on the row: a speech bubble for comments, an order icon, a bar chart for stats. That’s what WordPress.com does, and it’s quick to scan. But the list grows every time a plugin brings something new, like bookings or form entries. The alternative is a few generic badges that never grow (message, reaction, activity, system, milestone, tip), with the specifics shown in the circle and the title instead. Which works better as more plugins join? Both are compared in the catalog.

Image

Severity: are three values enough?

Severity decides what stands out. Critical is pinned at the top and turns the bell’s count red, warnings wait in the Alerts tab, and info is everything else. There’s no “success”: good news already shows in the status, like a dispute marked “Won”. Core’s docs suggest alert, warning and info, close to this. Are three values enough, and who decides which notifications are allowed to be critical?

Who did it and what it’s about: optional extras, or proper fields?

To show who did something (a customer’s name and picture) and what it’s about (a card for the order), a notification needs two pieces of data core doesn’t store today. They can go in core’s existing meta column, as actor and about, without changing the database. But that keeps them optional and loosely defined. Should they stay in meta, or become proper fields every plugin fills the same way?

Across channels: where should each event arrive?

The same event can reach someone in several ways: the bell, a count in the admin menu, an email, a push to their phone. A new order today does three of these, and could do four if Orders gets its own menu item with a count. Which events belong where, so each arrives once, in the right place? This needs a review of every event, not just the bell.

Unread: a tab, or a filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output.?

I’d keep a top-level Unread tab, even though it mixes read state in with the categoryCategory The 'category' taxonomy lets you group posts / content together that share a common bond. Categories are pre-defined and broad ranging. tabs, because it’s what people most often want to see. For comparison, the demo also has Show only unread, a filter that works within any tab, so you can see what’s unread in Store, for example. To try it, open Demo in the admin bar › Unread › In the gear menu, then the bell’s ⚙ menu › Show only unread.

Image

Settings: how do they scale?

People can mute notifications per channel, like WooCommerce › Orders, and turn off each plugin’s tips with one switch. With many plugins, each sending several kinds, that list gets long fast. How should settings stay manageable? This hasn’t been explored yet.

AccessibilityAccessibility Accessibility (commonly shortened to a11y) refers to the design of products, devices, services, or environments for people with disabilities. The concept of accessible design ensures both “direct access” (i.e. unassisted) and “indirect access” meaning compatibility with a person’s assistive technology (for example, computer screen readers). (https://en.wikipedia.org/wiki/Accessibility): does the keyboard work for you?

The keyboard follows the WordPress.com panel: arrows move through the list, Enter opens a notification and moves focus into it, Esc goes back to the same row, and Esc again closes the bell. Here’s a short GIF of it in action. Does it work well with screen readers and other assistive technologyAssistive technology Assistive technology is an umbrella term that includes assistive, adaptive, and rehabilitative devices for people with disabilities and also includes the process used in selecting, locating, and using them. Assistive technology promotes greater independence by enabling people to perform tasks that they were formerly unable to accomplish, or had great difficulty accomplishing, by providing enhancements to, or changing methods of interacting with, the technology needed to accomplish such tasks. https://en.wikipedia.org/wiki/Assistive_technology?

What’s next

  • Collecting feedback, here and on issue #655.
  • Stress-testing the system against other plugins. WooCommerce was the first deep test. Next, more plugins’ notices go through the same catalog, starting with Jetpack, to see how they fit and where the rules need to change.
  • A first step in 0.3.0: shaping what core’s first hub can show, so it already moves in this direction.

When could this ship?

Not soon, and that’s fine. 0.3.0 comes first, as a feature pluginFeature Plugin A plugin that was created with the intention of eventually being proposed for inclusion in WordPress Core. See Features as Plugins, and merging into core follows after it. Plugins can only adopt notifications once they’re in WordPress, and and moving over is up to each plugin, at its own pace. Jonathan’s weekly updates follow the plan. There’s time for feedback to shape this.

Feedback

Your feedback is welcome, whether you use WordPress, build plugins that send notifications today, or work on accessibility. Leave a comment on this post, or on issue #655, where the work continues. You can also find us in #feature-notifications on SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/.

Props @jameskoster for early feedback, @joen for guidance, and @keoshi for earlier explorations into notifications.

#feature-notifications

+make.wordpress.org/design/

X-post: WordPress for the Agentic Web

X-comment from +make.wordpress.org/ai: Comment on WordPress for the Agentic Web

Dev Chat Agenda – October 28, 2026

Dev Chat on October 28th is canceled, and will resume next week

The next WordPress Developers Chat will take place on Wednesday, October 28, 2026, at 15:00 UTC in the core channel on Make WordPress Slack.

The live meeting focuses on upcoming releases and CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. development, with time for discussions and open floor.

If you have requests for help with a ticketticket Created for both bug reports and feature development on the bug tracker. or another discussion topic, please post details in the comments section at the end of this agenda, or bring it up in Dev Chat during open floor.

Announcements 📢

WordPress 7.2

General

Discussions 💬

The discussion section of the agenda is for discussing important topics affecting the upcoming release or larger initiatives that impact the Core Team. To nominate a topic for discussion, please leave a comment on this agenda with a summary of the topic, any relevant links that will help people get context for the discussion, and what kind of feedback you are looking for from others participating in the discussion.

Open floor  🎙️

Any topic can be raised for discussion in the comments, as well as requests for assistance on tickets. Tickets in the milestone for the next major or maintenance release will be prioritized.

Please include details of tickets / PRs and the links in the comments, and indicate whether you intend to be available during the meeting for discussion or will be async.

Props to @kirasong for the pre-publish review.

#7-2, #agenda, #core, #dev-chat

Help shape future Release Roadmaps by Nov 16th

For each WordPress release, a roadmap is pulled together to share what’s planned and provide opportunities for folks to contribute. Over the last three years, these posts have taken roughly the same shape and approach, with some variation around the number of items to include based on how far along an area of work is. To ensure these posts continue to be meaningful and evolve as the WordPress project does, please use this link below to give feedback by November 16th. All are welcome to give feedback. Thank you in advance.


I’m interested in hearing from all audiences from coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. committers to extenders to hosting companies to everyday users. If you have feedback that doesn’t fit neatly into the survey, please just comment below to share your feedback and don’t feel like you need to force your thoughts into the format of this survey. After November 16th, I’ll either write a separate post summarizing the feedback or leave a comment on this one with the results and likely some reflections based on my experience pulling them together. My aim is to use this feedback to see what to evolve for the release roadmaps to come.

#survey

WordPress Contributor Toolkit 2.0: A redesigned app, in your language

TL;DR: WordPress Contributor Toolkit v2.0.0 has been released with a new interface built on the WordPress Design System, a settings dialog, a dark theme, and translations into ten languages.

The WordPress Contributor Toolkit removes the points of friction first-time contributors face before they write a line of code, especially during Contributor Days. You do not have to install GitGit Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Git is easy to learn and has a tiny footprint with lightning fast performance. Most modern plugin and theme development is being done with this version control system. https://git-scm.com/, Node.js, npm, or Docker on your machine.

The app started by setting up a full WordPress Core development environment. Version 1.0 added the full Core contribution workflow, from reading a TracTrac An open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress. ticketticket Created for both bug reports and feature development on the bug tracker. to sending your fix back as a pull request or a patchpatch A special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing.. Version 1.2 added the same workflow for Gutenberg.

Now, version 2.0 brings a redesigned interface, available in ten languages. The CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. and GutenbergGutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. https://wordpress.org/gutenberg/ workflows work the same way as in 1.2.

Image

A new look, built on the WordPress Design System

The whole window has been redesigned with the WordPress Design System: the sidebarSidebar A sidebar in WordPress is referred to a widget-ready area used by WordPress themes to display information that is not a part of the main content. It is not always a vertical column on the side. It can be a horizontal rectangle below or above the content area, footer, header, or any where in the theme., the page headerHeader The header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes., the site details, the cards, the dialogs and the tray at the bottom. If you have used the blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. editor, the buttons, notices and dialogs will look familiar.

A few smaller changes make the screen easier to read:

  • The sites list shows each site’s server status beside its name, so you can see which sites are running without opening them.
  • The footer’s tray buttons are labeled with their names, not only icons.
  • The next-action cue is visible on warning notices, so the button that moves you forward stands out even when something needs your attention.
  • The Trac window uses the app’s theme.

Settings in one place

Version 2.0 adds a settings dialog. Open it from the cog at the bottom right of the window, from Settings… in the app menu on macOS, or from the File menu on Windows and Linux.

Image

The settings are in three groups:

  • General. The theme, the language, whether a site’s server and build watch start when you open it, whether what was running at quit starts again next time, and a default folder for new sites.
  • Sites. The PHPPHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher version every site’s development server runs on, and the WP_DEBUG and SCRIPT_DEBUG flags. A change applies the next time a server starts, and the site details show the values the next start will use.
  • Account. Your WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ username and the event you are at, which go into a patch you hand to a mentor, and the GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https://github.com/ account the app opens pull requests with.

The theme can be light, dark, the same as your operating system, or custom: pick a background and a primary color, and the app builds every other color from them.

The app speaks your language

Every string in the interface is now translatable: the setup checklist, the trunktrunk A directory in Subversion containing the latest development code in preparation for the next major release cycle. If you are running "trunk", then you are on the latest revision. update, Review & submit changes, the pull request form and GitHub sign-in, the ticket and branchbranch A directory in Subversion. WordPress uses branches to store the latest development code for each major release (3.9, 4.0, etc.). Branches are then updated with code for any minor releases of that branch. Sometimes, a major version of WordPress and its minor versions are collectively referred to as a "branch", such as "the 4.0 branch". notices, patch errors, the Terminal and Logs output, the mail dialog, the app menu, and the app’s own dialogs.

Version 2.0 ships in ten languages: Czech, Dutch, English (Canada), English (UK), Galician, Hungarian, Lao, Polish, Serbian and Turkish.

By default the app follows your operating system’s language. To choose another one, open Settings, pick a Language, and relaunch when the dialog offers to.

The contributor toolkit interface translated

A language ships with the app once it is at least 80% translated on translate.wordpress.org, so the list grows with each release. If yours is not there yet, the Contributor Toolkit project on translate.wordpress.org is a good first contribution in itself.

See what changed, file by file

After you apply a patch or check out a pull request, the site’s details now list the Changed files as a tree of folders, in two groups:

  • From the patch or From PR #N: the files the change itself touches. A pencil marks the ones you have edited since.
  • Your changes: every other file you have changed on that ticket or issue.
Image

Click a file to open it in your editor, inside the site’s folder. Each file you changed has a revert button that puts back just that file, so you can undo one experiment without losing the patch you are testing. Discard your changes now removes only your own work and leaves the applied patch or pull request in place.

Trac details that stay

When you click Read details from Trac, the app now keeps what it read. Quit and reopen it, and the ticket’s summary, status, type, component, milestone and keywords are still there, with the time they were read. A refresh button beside that line reads the ticket again when you want the latest.

The ticket card has also been reorganized: the ticket’s title leads, its facts are on labeled rows, and unsubmitted work on the ticket appears as a notice with Review and submit and Discard changes buttons.

A smaller download for Contributor DayContributor Day Contributor Days are standalone days, frequently held before or after WordCamps but they can also happen at any time. They are events where people get together to work on various areas of https://make.wordpress.org/ There are many teams that people can participate in, each with a different focus. https://make.wordpress.org/support/handbook/getting-started/getting-started-at-a-contributor-day/

At a Contributor Day, everyone downloads the app at the same time, on the same networknetwork (versus site, blog). Version 2.0 is about 350 MB smaller once installed. It no longer ships PHP builds it never loads, libraries already bundled into the interface, or Chromium language files for languages the app has no translationtranslation The process (or result) of changing text, words, and display formatting to support another language. Also see localization, internationalization. for.

Other improvements

  • Sites run as a local environment, so Application Passwords can be tested over HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands..
  • Adminer opens the right database when the site uses randomized SQLite storage or a custom DB_PATH.
  • The debug.log pane no longer shows a line twice, or replays the whole file when you save it from an editor.
  • The pull request preview no longer lists trunk’s files when the site’s trunk is behind.
  • The main window can no longer be navigated away from the app or open other windows, and HTMLHTML HyperText Markup Language. The semantic scripting language primarily used for outputting content in web browsers. mail is shown in a separate frame.

The full list is in the v2.0.0 release notes.

Help shape the next version

Try it on a real ticket or issue, in your own language if the app includes it, and tell us how it went:

  • Something broke? Open an issue with what you did and what happened.
  • Something felt off? Use the feedback form, or the feedback button in the app.
  • A string reads wrong in your language? Suggest a better one on translate.wordpress.org.
  • Want to talk it through? Ask in #core, or #core-editor for the Gutenberg flow, or comment below.

Resources

Props to @greenshady for review and feedback.

+make.wordpress.org/playground/ +make.wordpress.org/test/ +make.wordpress.org/community/

#contributor-day, #playground, #wordcamp

WP Feature Notifications weekly update: 2026-10-23

This week was more of a maintenance week: 24 PRs merged, 23 of them Dependabot updates, The more interesting activity is in review: 16 new contributor PRs opened this week.

Highlights

  • README now points to the demo pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. (#648, @psykro): adds a note telling developers where to find the demo code plugin for trying out the feature.
  • Big dependency catch-up: 23 Dependabot PRs merged, with support from @masteradhoc, including a grouped update of 37 @wordpress/* packages (#598). Another 17 stale Dependabot PRs were closed without merging (usually because a newer version replaced them).
  • Strong contributor pipeline: open PRs now cover the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) https://developer.wordpress.org/rest-api/ (GET, POST, and DELETE on notifications), a schema v2 with a design write-up, user-scoped repositories, UTC date handling, and npm script fixes.

Dependency updates

PackageFrom → ToPR
@wordpress/* group (37 packages)—#598
axios1.16.1 → 1.20.0#605
baseline-browser-mapping2.10.30 → 2.11.21#602
compression1.8.1 → 1.8.2#623
eslint-import-resolver-typescript4.4.4 → 4.4.5#646
follow-redirects1.16.0 → 1.16.1#636
handlebars4.7.9 → 4.7.10#621
httpHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands.-proxy-middleware2.0.9 → 2.0.10#572
immutable5.1.5 → 5.1.9#596
joi18.2.1 → 18.3.0#610
launch-editor2.13.2 → 2.14.2#565
moment2.30.1 → 2.31.0#604
node-forge1.3.1 → 1.4.0#554
postcss8.5.14 → 8.5.31#593
proxy-addr2.0.7 → 2.0.8#620
re-resizable6.9.11 → 6.11.2#547
serialize-javascriptJavaScript JavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser. https://www.javascript.com6.0.1 → 6.0.2#562
simple-git3.17.0 → 3.36.0#557
svgo3.3.3 → 3.3.5#601
tar6.2.0 → 6.2.1#569
websocket-driver0.7.4 → 0.7.5#574
ws6.2.3 → 6.2.6#573
symfony/process (Composer)5.4.22 → 5.4.51#582

Every individually listed bump is a minor or patchpatch A special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing. release; the @wordpress/* group is in #598.

In progress

REST API

  • #640 feat(rest): add GET /notifications/{id} (faisalahammad)
  • #639 feat(rest): add DELETE /notifications/{id} (faisalahammad)
  • #635 Add POST endpoint to Notification Controller (AshishJii)
  • #644 REST: Add missing text domain and fix typos in REST API controller strings (devmuhib009)

Data model & storage

  • #637 fix(database): add schema v2 tables (faisalahammad)
  • #638 docs: add database schema design post (faisalahammad)
  • #626 fix: make notification repository user-scoped (elphizu)
  • #627 Model: Handle dates in UTC and keep column fields out of message metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. (huzaifaalmesbah)
  • #624 Framework: Store one Factory instance per subclass (huzaifaalmesbah)
  • #642 Channels: Fix namespace typo in includes/channels.php and add tests (devmuhib009)

UIUI User interface / JSJS JavaScript, a web scripting language typically executed in the browser. Often used for advanced user interfaces and behaviors.

  • #645 Move hub settings link to a top cog (faisalahammad)
  • #633 fix: convert notification store to thunks (KhushalSainS)
  • #552 Types: add return type declaration to jsonSerialize methods (SirLouen), opened earlier and updated this week

Tooling & repo

  • #632 Tooling: Fix the test:php, php-install, lint:css and docGen npm scripts (huzaifaalmesbah)
  • #631 Tooling: Make lint:pkg-jsonJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. and lint:md:docs lint real files (huzaifaalmesbah)
  • #628 GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https://github.com/: Add a Props Bot workflow (huzaifaalmesbah)
  • #625 GitHub: Update the pull request template (huzaifaalmesbah)
  • #647 npm: bump eslint from 10.4.0 to 10.13.0 (Dependabot)

Closed without merging: 17 Dependabot PRs: #622, #603, #599, #576, #570, #568, #563, #560, #556, #555, #549, #546, #541, #540, #534, #528, #517.

Want to get involved?

#feature-notifications

Dev Chat Agenda – October 21, 2026

The next WordPress Developers Chat will take place on Wednesday, October 21, 2026, at 15:00 UTC in the core channel on Make WordPress Slack.

The live meeting focuses on upcoming releases and CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. development, with time for discussions and open floor.

If you have requests for help with a ticketticket Created for both bug reports and feature development on the bug tracker. or another discussion topic, please post details in the comments section at the end of this agenda, or bring it up in Dev Chat during open floor.

Announcements 📢

WordPress 7.2

General

Discussions 💬

The discussion section of the agenda is for discussing important topics affecting the upcoming release or larger initiatives that impact the Core Team. To nominate a topic for discussion, please leave a comment on this agenda with a summary of the topic, any relevant links that will help people get context for the discussion, and what kind of feedback you are looking for from others participating in the discussion.

Open floor  🎙️

Any topic can be raised for discussion in the comments, as well as requests for assistance on tickets. Tickets in the milestone for the next major or maintenance release will be prioritized.

Please include details of tickets / PRs and the links in the comments, and indicate whether you intend to be available during the meeting for discussion or will be async.

Props to @kirasong for review.

#7-2, #agenda, #core, #dev-chat

Performance Chat Summary: 20 October 2026

The full chat log is available beginning here on Slack.

WordPress Performance TracTrac An open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress. tickets

  • @westonruter shared that, as of r64585, eliminating script/style concatenation has landed in WordPress and is included in the 7.2-beta1 release. This retires the use of load-scripts.php and load-styles.php and closed more than 10 Trac tickets, several of which were over 10 years old.
    • Script/style concatenation was only used in the login/adminadmin (and super admin) for coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.’s own assets. It served its purpose, especially for HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands./1.1, but WordPress 7.2 will use a more modern and performant approach where blocking scripts and styles known to be used on the next screen are prefetched. This approach landed recently in r64120.

Our next chat will be held on Tuesday, November 3, 2026 at 16:00 UTC in the #core-performance channel in Slack.

#core-performance, #hosting, #performance, #performance-chat, #summary

Recap: WordPress 7.1 “Mary Lou” Retrospective

This post summarizes the feedback received from the WordPress 7.1 retrospective. Thank you to those who contributed their feedback via the retrospective survey and comments on the post!

For ease of reading, feedback has been synthesized. Full feedback is available for review in the anonymized form responses and comments to the original post.

Please remember that the following feedback are suggestions to bear in mind for future releases rather than action items for implementation. 

What would you keep?

  • The usual release parties and weekly check-in rituals.
  • Good communication throughout the release cycle, including security updates.
  • Security auditing, including handling all known high-risk HackerOne issues before deployDeploy Launching code from a local development environment to the production web server, so that it's available to visitors..
  • Task lists for every role.

What would you add?

  • A kick-off call for the release squad, which helped the group work together and could be continued when time zones allow.
  • More emphasis on user documentation and on completing it on time.
  • Earlier visibility into user-facing blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. editor UIUI User interface changes. Some changes, such as the Elements panel and the GIF video block variation, were mainly documented in dev notesdev note Each important change in WordPress Core is documented in a developers note, (usually called dev note). Good dev notes generally include a description of the change, the decision that led to this change, and a description of how developers are supposed to work with that change. Dev notes are published on Make/Core blog during the beta phase of WordPress release cycle. Publishing dev notes is particularly important when plugin/theme authors and WordPress developers need to be aware of those changes.In general, all dev notes are compiled into a Field Guide at the beginning of the release candidate phase. or GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https://github.com/ PRs, which made it harder for documentation contributors and for people supporting site editors to prepare.
  • Developers marking their tickets for dev notes or the field guideField guide The field guide is a type of blogpost published on Make/Core during the release candidate phase of the WordPress release cycle. The field guide generally lists all the dev notes published during the beta cycle. This guide is linked in the about page of the corresponding version of WordPress, in the release post and in the HelpHub version page. where appropriate, and writing their own dev notes.
  • Wider testing, for example by inviting hosts to test in their own environments and providing them with AI prompts to use on their setups.

What would you change, reduce, or remove?

  • Launching live at an event. One respondent felt it was not worth the added stress, and other members of the release squad agreed. If a release is tied to an event again, it helps when everyone involved follows the agreed schedule and arrangements during the event.
  • Better time zone overlap among release squad members where possible.
  • A request to bring back the official Docs role. Documentation work during a release is substantial, and only a few contributors currently have the experience to cover it.
  • More Learn content related to the release.

What else would you like to express about any part of the release cycle or release squad?

  • More contributors who can follow many parts of the project at once would help. This gap was noticeable in several places during the cycle.
  • More awareness of concerns in the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. and theme ecosystem.
  • More automation, given how often the release process has been carried out.
  • The release squad communicated thoughtfully and was open to feedback, and respondents thanked the squad for their work.

Did you have an official role on the release squad during the 7.1 release?

This section describes if the survey participants are part of release squad or observer.

Image

Did you contribute to the 7.1 release?

This section describes if the participants actually contributed to 7.1 release or not.

Image

How did collaborating on this project feel?

This section included ways for one to indicate how much they agreed or disagreed with a statement around collaboration.

Image

Would you like to be part of future release squads?

  • 25%: I have been part of a release squad and I will gladly repeat.
  • 50%: I haven’t been part of a squad but I would like to try in the future.
  • 25%: I have been part of a release squad but will not repeat in the near future.
  • 0%: I haven’t been part of a release squad and currently have no interest in it.
Image

What is your feedback on the current release squad size?

Image

Takeaways and next steps

  • Consider the impact before tying a release to a live event, and agree early on a schedule that everyone involved can follow.
  • Continue holding a kick-off call for the release squad, and consider time zone overlap when assembling the squad.
  • Find ways to share user-facing editor UI changes earlier with documentation and support contributors.
  • Encourage developers to mark tickets for dev notes or the field guide and to write their own dev notes.
  • Investigate which parts of the release process could be automated.
  • Find new ways to encourage wider testing during the betaBeta A pre-release of software that is given out to a large group of users to trial under real conditions. Beta versions have gone through alpha testing in-house and are generally fairly close in look, feel and function to the final product; however, design changes often occur as part of the process. and RCrelease candidate One of the final stages in the version release cycle, this version signals the potential to be a final release to the public. Also see alpha (beta). period, for example together with hosts.
  • Make it clearer which contributors can follow many parts of the project and are available to help with specific areas.
  • Look at ways to connect more Learn content to each release.
  • Find ways to raise awareness of concerns from the plugin and theme ecosystem during the cycle.

Props to @annezazu for reviewing this post. 

#7-1, #retrospective