The WordPress coreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress. development team builds WordPress! Follow this site for general updates, status reports, and the occasional code debate. There’s lots of ways to contribute:
Found a bugbugA bug is an error or unexpected result. Performance improvements, code optimization, and are considered enhancements, not defects. After feature freeze, only bugs are dealt with, with regressions (adverse changes from the previous version) being the highest priority.?Create a ticket in the bug tracker.
This is the first in a series of weekly status update posts from the WP Feature Notifications work.
Security PRS
There are 30+ open Dependabot PRs that will resolve various dependency security alerts across the repository. It would be really helpful if any contributors have time to help review these PRs, or fix any merge conflicts (using the @dependabot rebase comment).
0.3.0 release tracking issue
GitHubGitHubGitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https://github.com/issue #302 has been updated to include any open (and newly created) issues that will make the 0.3.0 (aka MVPMinimum Viable Product"A minimum viable product (MVP) is a product with just enough features to satisfy early customers, and to provide feedback for future product development." - WikiPedia) release possible. This tracking issue now lists the 16 open items required for the 0.3.0 release.
All development work toward releasing 0.3.0 will focus on these 16 open issues, and contributors are invited to focus their efforts on them.
While the only actively supported version of WordPress is the most recent one, security updates are backported to older branches as a courtesy. All versions >=4.7 are in a security-only support state, receiving select security patches as a courtesy to users of WordPress.
The code maintained in the Gutenberg repository is just as critical to all WordPress versions >=5.0.
The code in the GutenbergGutenbergThe Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc.
https://wordpress.org/gutenberg/ repository that corresponds to each release of WordPress is organized using wp/X.Y branches. These branches are frozen in time snapshots of the code that was used by wordpress-develop to build the final software that is released to the world. However, because the testing infrastructure in these branches has not been well maintained so automated checks and test suites are currently broken. Some fail consistently while others don’t run at all due to poorly scoped branchbranchA directory in Subversion. WordPress uses branches to store the latest development code for each major release (3.9, 4.0, etc.). Branches are then updated with code for any minor releases of that branch. Sometimes, a major version of WordPress and its minor versions are collectively referred to as a "branch", such as "the 4.0 branch". filters, event targeting, and other issues.
It’s imperative that these GitHubGitHubGitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https://github.com/ Actions workflows and the underlying testing infrastructure is restored to a working state to ensure that all relevant security patches that affect Gutenberg can be properly validated and confirmed before being shipped to end users in WordPress coreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress..
That’s where you come in!
Enter: Operation Tall Stack 🥞
Over the last few weeks I have worked with AI to create a pull request stack for each and every wp/x.y branch on the gutenberg repository that:
Gets CI passing again, so changes to these branches are properly tested before they ship in a WordPress release.
Modernizes and hardens the workflows by removing jobs that serve no purpose on a release branch, updating and pinning actions and runner images, and adding safeguards like job timeouts and workflow linting.
Makes each branch’s test environment predictable by pinning it to the software versions that match its WordPress release, and testing the PHPPHPThe web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher and Node.js versions that release actually supports.
Repairs the local development tooling (wp-env, Composer and PHPUnit), which broke as the outside services and packages it relies on changed over time.
Stabilizes the test suites by fixing or backporting fixes for flaky and broken tests.
Some details about the approach:
One fix per PR. Each stack has between 18 and 32 pull requests, and each one addresses a single, specific problem. Reviews come in small, targeted pieces instead of one large diff.
Stacked PRs. Each PR is based on the one below it, so the stack reads from the bottom up. The Files changed tab on each PR shows only that PR’s change, and CI on the top PR tests the whole stack together.
Same fix, same shape on every branch. A fix that applies to several branches has the same branch name (fix-actions-X.Y/<fix-name>) and a matching title on each of them. It also sits in roughly the same position in every stack. That makes it possible to review one fix across all branches at once, rather than reading through one branch’s entire stack.
Only the branches that need it. Each fix was checked against each branch’s actual code, and a fix only appears where the problem exists. Where a branch differs, the PR adapts the fix to that branch.
FollowingtrunktrunkA directory in Subversion containing the latest development code in preparation for the next major release cycle. If you are running "trunk", then you are on the latest revision.where possible. Many fixes are backports or adaptations of changes already made on trunk, and those PRs link to the original PR or commit.
No new package releases: Changes that would publish new versions of the repository’s npm packages are forbidden. The only exception is wp-env, a development-only tool that is not part of the WordPress code shipped to users, that a good portion of the testing infrastructure depends on to be operable.
Documented and traceable. Every PR description explains what changed, why, and how, and cites the failing CI runs or error output it addresses. Each PR also links to a tracking issue for its branch.
Human review: Any pull request related to this effort in draft state should be considered AI-produced and unverified by a human. I have staged each branch’s stack in my fork for testing and verification before pushing to WordPress/gutenberg. Each PR is then marked ready for review after a final confirmation.
Review Strategy
Before this work can be merged, this needs to be reviewed and approved. With roughly 500 total pull requests across 20+ branches, your help is needed.
After discussing with a few contributors, it’s become clear that the best way to review each branch’s stack of pull requests properly is to divide them up by fix, not by individual stacks. This allows someone to review all of the PRs related to a specific fix as it relates to the code within each wp/X.Y branch without having to context switch through each and every problem in a stack.
While there is an overarching ticketticketCreated for both bug reports and feature development on the bug tracker. for this project (GB-82780) and a sub-issue for each wp/X.Y branch, there are no issues for the individual fixes. To help divide and track the review efforts without overlap, I’ve created an issue for claiming and tracking the review efforts (GB-84853).
You’ll find a table on that issue that assigns each fix an alphabetical identifier and links to the corresponding pull request for each version branch. The first comment lists the branch name, a 1-2 sentence description, and any PRs that applied the same changes to trunk for each fix (if any).
Please use the following procedure if you’re able and interested to help in reviewing these pull requests:
If you’re able, edit the table in the issue’s description to add yourself as the reviewer for that fix.
When you claim a given fix, you are pledging that you will explicitly submit a review with an approval or a request for change on every PR in that row. An approving review is required for every PR in a given stack, otherwise the stack cannot be merged.
Claim one row at a time. You can always claim another after you complete the first.
If you are reviewing the PRs in a row and are unable to finish within 24 hours, please comment on the issue and (if able) and note in the Reviewer column of the table the branches that you reviewed. Example: “Needed: 6.0-5.7. (@desrosj reviewed 7.1-6.1)”
Anyone is welcome to help review these PRs. However, the rulesets configured on the gutenberg repository require at least one approving review from a member of the WordPress GitHub organization granted write access to the repository.
Currently only the wp/7.1 through wp/5.7 branches are ready and pushed to the gutenberg repository, but the rest will be added in the coming days. When new stacks are pushed and ready, a comment will be left on the issue to notify everyone who has helped out.
Phase 2
Restoring these workflows to a functional state is phase 1 of the necessary efforts to make these more maintainable long term. Once the workflows are functional in each wp/X.Y branch, a second effort will begin to adopt the reusable workflow pattern matching the strategy in wordpress-develop (see TracTracAn open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress.#61213), which makes maintenance of these workflow files significantly easier because the functional logic being performed lives in trunk and is shared amongst all branches that perform a given type of testing or automation.
Thank you to everyone in advance for your help contributing to this effort!
“What’s new in GutenbergGutenbergThe Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc.
https://wordpress.org/gutenberg/…” posts (labeled with the #gutenberg-new tag) are posted following every Gutenberg release on a biweekly basis, showcasing new features included in each release. As a reminder, here’s an overview of different ways to keep up with Gutenberg and the Editor.
This release comes with a new place for notes: they now float in a margin next to the content, so collaborating no longer means closing the Settings sidebarSidebarA sidebar in WordPress is referred to a widget-ready area used by WordPress themes to display information that is not a part of the main content. It is not always a vertical column on the side. It can be a horizontal rectangle below or above the content area, footer, header, or any where in the theme.. Adding a categoryCategoryThe 'category' taxonomy lets you group posts / content together that share a common bond. Categories are pre-defined and broad ranging., a tagtagA directory in Subversion. WordPress uses tags to store a single snapshot of a version (3.6, 3.6.1, etc.), the common convention of tags in version control systems. (Not to be confused with post tags.), or a post to a navigation menuNavigation MenuA theme feature introduced with Version 3.0. WordPress includes an easy to use mechanism for giving various control options to get users to click from one place to another on a site. now takes a single search, and the Gallery blockBlockBlock is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. can sort its images and tint all of them with one duotone.
The design tools consistency work started in 24.1 continues with about 80 more PRs, and the release also includes more than 60 bugbugA bug is an error or unexpected result. Performance improvements, code optimization, and are considered enhancements, not defects. After feature freeze, only bugs are dealt with, with regressions (adverse changes from the previous version) being the highest priority. fixes plus some accessibilityAccessibilityAccessibility (commonly shortened to a11y) refers to the design of products, devices, services, or environments for people with disabilities. The concept of accessible design ensures both “direct access” (i.e. unassisted) and “indirect access” meaning compatibility with a person’s assistive technology (for example, computer screen readers). (https://en.wikipedia.org/wiki/Accessibility) and performance improvements. For developers, ReactReactReact is a JavaScript library that makes it easy to reason about, construct, and maintain stateless and stateful user interfaces.
https://reactjs.org 19 is now enabled by default, and feedback on it is welcome and needed.
Notes move into a canvas margin beside the content
Until now, floating notes and the Settings sidebar couldn’t be open at the same time, and the notes column took space away from the content. In Gutenberg 24.2, notes live in a margin the editor reserves next to the canvas, so they stay visible while you change blocks or post settings (#83786).
When the canvas gets narrower, each thread shrinks to its author’s avatarAvatarAn avatar is an image or illustration that specifically refers to a character that represents an online user. It’s usually a square box that appears next to the user’s name., and clicking the avatar expands the thread again. A new Notes submenu in the Options menu expands, minimizes, or hides the notes, and the editor remembers your choice (#83768).
Other changes make working with notes safer: deleting a note now shows an Undo action (#83988), a note or reply you haven’t sent is kept when you select another block (#84110), and the notes scroll together with the canvas (#83852).
One search for every link in a navigation menu
Adding anything other than a page to a navigation menu used to mean knowing the right block first, like Category Link or Tag Link, and then searching inside it. Now the link search of the Navigation block looks through every type of content at once and shows the type beside each result, so pages, posts, categories, and tags are one search away (#83408). Switching an existing link to another type, for example from a category to a page, also no longer means deleting it and adding it again.
The same search lists the blocks a navigation menu accepts, so typing “Home” finds the Home Link block (#83652). Results are now ranked by type too, with posts and pages before categories, tags, and media, and nothing is discarded when several types are searched together. That ranking applies to every link search in the editor, so on large sites, tags and attachments no longer push the post you’re looking for out of the results (#83407).
Sort any gallery and tint all of its images
The Order by control of the Gallery block now works for galleries of hand-picked images too. Choosing Newest to oldest, Oldest to newest, A → Z, or Z → A sorts the images once, and you can still drag them into any other order afterwards. Random moved into the same control and shuffles the images on the front end each time the page loads (#83438).
Galleries also gain duotone support. One filterFilterFilters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. now tints every image in a gallery, either from the block settings or, for every gallery on the site, from Global Styles. A duotone set on a single image keeps priority over the one set on the gallery (#83978).
Design tools reach even more blocks
The design tools consistency work continues with about 80 more PRs. Some highlights:
Minimum width and height controls, previously available on five blocks, now reach 40, including Buttons, Columns, Heading, Media & Text, and Post Title.
Shadows reach ten more blocks, including Paragraph, List, Buttons, Social Icons, and Gallery.
Duotone reaches Gallery, Media & Text, and Video, so a video can now match the tint of the images around it (#83979, #83981).
Background images and gradients reach Button, List, List Item, and Media & Text.
Line indent reaches Heading, Post Author Biography, and Poetry, which also gains text columns and fit text.
Every block and support is listed in the changelog.
React 19 is now on by default and some Interactivity APIAPIAn API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways.enhancements
Gutenberg 24.2 turns the React 19 experiment on by default (#83784). Sites now load React 19 for the react and react-dom scripts, unless a theme or pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. known to have compatibility issues is active, so folks using one of those keep React 18. That list started from the issues observed on WordPress.comWordPress.comAn online implementation of WordPress code that lets you immediately access a new WordPress environment to publish your content. WordPress.com is a private company owned by Automattic that hosts the largest multisite in the world. This is arguably the best place to start blogging if you have never touched WordPress before. https://wordpress.com/ and was extended for this release (#84607).
If you maintain a plugin or theme that uses React, please test it with Gutenberg 24.2 and report any issue you find. If something breaks on a site, turn React 19 off under Gutenberg > Experiments. To set the inert attribute in a way that works with both React 18 and React 19, use the new @wordpress/react-inert-value package (#83987).
The Interactivity API also gets two additions. The new data-wp-html directive renders HTMLHTMLHyperText Markup Language. The semantic scripting language primarily used for outputting content in web browsers. from the store, the same way data-wp-text renders text, and it only accepts values marked as trusted with asDangerousHTML() (#83092):
import { asDangerousHTML, store } from '@wordpress/interactivity';
store( 'myPlugin', {
state: {
get description() {
return asDangerousHTML(
'<p>A <strong>formatted</strong> description.</p>'
);
},
},
} );
The router now exposes state.navigating and state.initiator, so a block knows when a client-side navigation is in progress and which block started it (#83280).
Other notable highlights
Restore original image: after cropping an image, the Image editor offers Restore original image in its More options menu, so going back to the uncropped image no longer needs a trip to the Media Library (#81805).
Button links: the link popover of the Button block opens only when you click Link or press the keyboard shortcut, instead of every time you select a linked button (#30166).
Columns: the column count slider is gone. Add a column with the plus button next to the Columns button in the block toolbar, and remove one like any other block (#83262).
Options menu: the View group now has Appearance, Notes, and Panels submenus. Sidebars added by plugins moved into Panels, and their pinned toolbar buttons stay where they were (#82976).
Post author: the author field is always searchable, and it searches users on the server, so the right person shows up on sites with many users (#83323).
Navigation Link states: Global Styles can style the hover, focus, focus-visible, and active states of navigation links, starting with typography (#83451).
Icon search: the icon library also matches keywords, so “hamburger” finds the Menu icon and “gear” finds Settings (#82367).
Reduced motion: the Video and Cover blocks don’t autoplay in the editor when reduced motion is preferred, and Cover background embeds don’t autoplay on the front end either (#83337, #83452).
Inserter performance: opening the inserter blocks the main thread for less time, and selecting another block while it’s open no longer re-renders every item in it (#83437, #83284).
New post slugs: a new post could be published with the auto-draft slug after clicking into the Slug field. That no longer happens (#83518).
Interactivity API Router: Add reactive navigation lifecycle and initiator API. (83280)
Enhancements
Dashboard Widgets: Let a mounted widgetWidgetA WordPress Widget is a small block that performs a specific function. You can add these widgets in sidebars also known as widget-ready areas on your web page. WordPress widgets were originally created to provide a simple and easy-to-use way of giving design and structure control of the WordPress theme to the user. declare actions at runtime. (83877)
Avatar: Explain that avatars use the GravatarGravatarIs an acronym for Globally Recognized Avatar. It is the avatar system managed by WordPress.com, and used within the WordPress software.
https://gravatar.com service. (83567)
Button: Add background image, size, and gradient support. (83950)
Button: Only open the link popover on explicit user action. (30166)
Buttons: Add minimum width and height support. (83894)
Post ExcerptExcerptAn excerpt is the description of the blog post or page that will by default show on the blog archive page, in search results (SERPs), and on social media. With an SEO plugin, the excerpt may also be in that plugin’s metabox.: Add minimum width and height support. (83578)
Post Featured ImageFeatured imageA featured image is the main image used on your blog archive page and is pulled when the post or page is shared on social media. The image can be used to display in widget areas on your site or in a summary list of posts.: Add border style support. (83956)
Post Terms: Add minimum width and height support. (83586)
Post Time to Read: Add minimum width and height support. (83598)
Post Title: Add minimum width and height support. (83600)
Preformatted: Add minimum width and height support. (83587)
Block Supports: Add background-clip block support infrastructure. (77141)
Block Supports: Ensure position type is a string. (83500)
Block Switcher: Show design system focus ring on pattern previews. (83933)
Fit text: Size each block instance in a loopLoopThe Loop is PHP code used by WordPress to display posts. Using The Loop, WordPress processes each post to be displayed on the current page, and formats it according to how it matches specified criteria within The Loop tags. Any HTML or PHP code in the Loop will be processed on each post. https://codex.wordpress.org/The_Loop independently. (83985)
Fix translator comments for block count announcements. (83555)
Honour background skip serialization in the editor. (83943)
Inserter: Use design system focus ring for previews. (83126)
Notes: Move floating notes into a canvas margin. (83786)
Bug Fixes
Connectors: Keep a stored API key read-only when it can’t be verified. (83889)
Date: Drop a trailing backslash instead of formatting it as “undefined”. (81528)
Experiments: Don’t invalidate saved option with a legacy key. (84619)
useServerSideRender: Parse messages from caught errors. (83365)
Components
BorderControl: Remove % from the border width units. (83492)
Checkbox: Prevent rounded themes from making checkboxes circular. (83526)
CollapsibleCard: Scope the headerHeaderThe header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes. focus ring to its own trigger. (81314)
FocalPointPicker: End a drag released over the editor canvas. (83348)
Menu: Disable triggers instead of roots in consumers. (83791)
PaletteEdit: Stop changing the slug when renaming a preset. (83750)
Popover: Close non-modal popovers on iframeiframeiFrame is an acronym for an inline frame. An iFrame is used inside a webpage to load another HTML document and render it. This HTML document may also contain JavaScript and/or CSS which is loaded at the time when iframe tag is parsed by the user’s browser. interaction. (83509)
Popover: Drop the will-change hint once the popover stops moving. (77359)
RadioControl: Keep a 16px visual with a larger hit target. (83840)
SandBox: Fix embed previews that require a referrer in Safari. (84014)
TextControl: Use design system colors when disabled. (83307)
Theme: Fix virtual modules, root styles, and seed validation. (83355)
Theme: Improve accessibility, API documentation, and compatibility checks. (83358)
Theme: Make JavaScriptJavaScriptJavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser.
https://www.javascript.com token fallback transforms syntax-aware. (83356)
Theme: Preserve global token references in Lightning CSS. (83359)
UI: Align selection popup checkmarks with the first label line. (82942)
UI: Preserve Autocomplete item type inference. (84095)
Columns: Allow dropping a column at the outer edges. (83274)
Fix ‘Manage allowed blocks’ not shown when it’s the only ‘Advanced’ control. (84067)
Fix style / nested attribute overwrite during multi-selection. (80070)
Paste: Give each pasted data-URI image unique filename to avoid upload collisions. (79480)
Paste: Replace non-breaking spaces at the edges of text with regular spaces. (83464)
Rich text: Fix iOSiOSThe operating system used on iPhones and iPads. double tap selection, preventing focus capture under editable host. (81042)
Show whitespace changes in the Resolve Block diff. (82397)
Style states: Fix exception when there’s no selected block. (84140)
Typography: List only the weights inside a variable font’s range. (83128)
Block Library
Group, Cover: Track drop zone element in state. (83756)
Image: Fix invalidinvalidA resolution on the bug tracker (and generally common in software development, sometimes also notabug) that indicates the ticket is not a bug, is a support request, or is generally invalid. CSS url() value in circle-mask style. (82333)
Image: Fix lightbox using thumbnail aspect ratio instead of original image ratio. (79058)
Image: Fix the lightbox overlay becoming unusable (can’t close) when it isn’t a direct child of <body>. (83480)
Image: Improve specificity of the lightbox button selector. (70800)
Math: Store cell alignment in the MathML and polyfill alignment and overlines in Chromium. (83164)
Post Featured Image: Fix crash when isLink is enabled. (81584)
Tag Cloud: Update styles and add !important. (70224)
Template Part: Fall back to rendering a template part from the theme file if the db version is unavailable. (83809)
Collaboration
Notes: Delete permanently when the trashTrashTrash in WordPress is like the Recycle Bin on your PC or Trash in your Macintosh computer. Users with the proper permission level (administrators and editors) have the ability to delete a post, page, and/or comments. When you delete the item, it is moved to the trash folder where it will remain for 30 days. is disabled. (84102)
Notes: Draw the canvas divider from body so it uses the theme text color. (84158)
Notes: Keep anchor writes out of undo history. (84079)
Notes: Preserve unsent note and reply drafts. (84110)
Notes: Reset paragraph top margin in floating notes. (84101)
Notes: Restore child notes trashed along with their parent note. (84100)
Notes: Restrict menu actions for resolution notes and resolved threads. (73243)
Notes: Scroll floating notes with the canvas. (83852)
Media
Media Editor: Fix pan drag flooding undo history after wheel zoom. (83558)
Media Editor: Stop the crop pixel snap from recording undo history. (83571)
MediaEdit: Show a checkerboard background behind image previews. (83846)
MediaUpload: Fix console error when reopening Gallery media library. (76749)
MediaUpload: Fix the gallery prop ignoring allowedTypes. (78257)
Data Layer
CoreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress. Data: Rank link suggestions by type, and stop discarding merged results. (83407)
RTC: Fix undo breaking for non-synced entities. (83888)
DataViews
Fields: Fix AuthorView for users who can’t edit users. (83498)
Measure the container as the data view mounts to avoid a single column flash. (83752)
Post Editor
Editor: Fix new posts being published with the auto-draft slug. (83518)
REST APIREST APIThe REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”)
https://developer.wordpress.org/rest-api/: Add action-trash link to posts and comments. (84045)
Site Editor
ExtensibleExtensibleThis is the ability to add additional functionality to the code. Plugins extend the WordPress core software. Site Editor: Pass custom block categories to the blocks store. (83762)
Global Styles: Fix popover position in Styles screen. (84048)
DataViews: Fix README to describe sort() as receiving field values, not items. (83483)
Design System: Clarify tooltip labeling and UI review guidance. (83898)
Docs: Clarify wordpress/ui icon color requirements. (83564)
Docs: Describe isolated dependencies for agents. (84141)
Docs: Fix published Vitest migrationMigrationMoving the code, database and media files for a website site from one server to another. Most typically done when changing hosting companies.-guide links. (83449)
Docs: Note that block attributes and global styles values are untrusted at render time. (83473)
Docs: Recommend UI Tabs for switching views. (83516)
Docs: Refine design system agent guidance. (84007)
Docs: Remove CheckboxControl heading from InspectorControls example. (83844)
Docs: Update deprecation testing guidance for shared reset. (83989)
Env: Change the core branchbranchA directory in Subversion. WordPress uses branches to store the latest development code for each major release (3.9, 4.0, etc.). Branches are then updated with code for any minor releases of that branch. Sometimes, a major version of WordPress and its minor versions are collectively referred to as a "branch", such as "the 4.0 branch". from trunktrunkA directory in Subversion containing the latest development code in preparation for the next major release cycle. If you are running "trunk", then you are on the latest revision. to master in the documentation. (83566)
Media Editor: Remove initial state seeding from the session. (83893)
Media Utils: Add MediaEdit as a private API. (84046)
Return 0 from the edit root lookup when there is no edit root. (84096)
Block Library
Breadcrumbs: Fix typo in aria label translationtranslationThe process (or result) of changing text, words, and display formatting to support another language. Also see localization, internationalization. context. (84112)
Playlist: Replace the waveform player patchpatchA special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing. with its no-autoinit entry. (83132)
Global Styles: Ignore theme.jsonJSONJSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. values of unexpected types. (84523)
Tools
PR metaMetaMeta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress.: Move the props list into the shared comment. (82302)
Props Bot: Skip bare reviews that duplicate their review comment runs. (84076)
Testing
Block editor: Isolate mutable test fixtures. (83098)
Block editor: Wait for final keyboard link suggestions. (83489)
Block library: Isolate order-sensitive test interactions. (83101)
Blocks: Isolate registration state in tests. (83099)
Build Tools: Fix flaky ESM package types test timeout. (84068)
Changelog validator: Ignore Markdown, Storybook, and configuration files. (83618)
CI: Check CHANGELOG presence for published tooling and configuration packages. (83577)
Coding standards: Skip anonymous class methods in block library function name sniffsniffA module for PHP Code Sniffer that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects code smells, similar to how a dog would "sniff" out food.. (83900)
Developer tools: Simplify editor setup and add Zed settings. (84143)
Fix check type declarations errors when running npm run dev. (84070)
Ignore composer vendor files from top-level gitignore. (22283)
Link upstream fixes for Storybook and Vitest warnings. (83632)
Release Tooling: Read the npm v12 JSON output shapes. (84075)
Release: Rewrite SVNSVNSubversion, the popular version control system (VCS) by the Apache project, used by WordPress to manage changes to its codebase. publication scripts in Node.js. (84034)
In Moving to a server-aware approach for collaboration, @chriszarate explains why the server needs to be at the heart of real-time collaboration, and introduces the engines we’ve been investigating to power the future of RTC. In this post, we’ll explore each of the sync engines built for RTC and the different ways they achieve collaboration.
All engines currently live in an experimental pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party., gutenberg-sync-engines, which you can run right now to evaluate the engines below. Our goal is to assess engine choices with your help, and choose the next engine foundation for server-side RTC in WordPress.
This post is a guide for testers and an introduction to the concepts of each engine. We’d love for you to try each engine and help us evaluate which best matches an ideal future for RTC in WordPress.
Terms
Here are some common technical terms used in this post worth explaining:
A sync engine is logic for combining changes when multiple people edit the same post. The three sync engines available in gutenberg-sync-engines are yjs-server, DE-RTC, and intent-log.
A transport is the way changes travel between a browser and the server. These include a combination of HTTPHTTPHTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands. polling, WebRTC, WebSockets, and Server-sent events (SSE). Any engine works with any transport.
Any change that is set aside for review is held somewhere but not applied to the post. This can apply to merge conflicts and changes blocked for security reasons. When a change is set aside for review, a person is required to decide whether to accept it.
Setup
Sync engines and transports are chosen under Settings → Collaboration:
The requirements for running the plugin are WordPress 7.0+ and the Presence API plugin, which is used to keep track of which users are on which post. The plugin ships an internal (lightly modified) copy of GutenbergGutenbergThe Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc.
https://wordpress.org/gutenberg/ in order to make the sync engine swappable, so it will not work with another active Gutenberg plugin.
To try out the engines, follow the setup steps in the README. Select a sync engine and transport, and start editing a post in multiple browsers.
Engines: What do they have in common?
In all engines, every change is processed through WordPress. When an edit arrives, the server confirms who sent it, checks they are allowed to make it, validates it for unsafe code, determines how to merge it with everyone else’s changes, and stores the result. The differences between engines are the implementations of these steps. Every engine allows multiple users to edit at the same time, works with every transport, and shows who is editing a post in varying levels of detail.
Engine 1: yjs-server
Summary: Built on the conflictconflictA conflict occurs when a patch changes code that was modified after the patch was created. These patches are considered stale, and will require a refresh of the changes before it can be applied, or the conflicts will need to be resolved.-free replicated data type (CRDT) library Yjs, the same technology used for client-side RTC in the current Gutenberg experiment. Every browser uses the Yjs library to merge changes into a document, sending the result to the server. The server verifies changes before they are shared with other users.
Yjs is an open-source and widely used CRDT implementation. In Yjs, two copies of a document edited separately can always be combined, in any order, and both end up identical. There are no merge conflicts. The server implementation runs a PHP version of Yjs to verify changes before passing them on to other users.
Engine: yjs-server Transport: Polling with a WebRTC advisory channel
How your change travels to peers: You type a word. Your browser applies it locally to a copy of the editor document and sends a binary update to the server. The server opens the shared copy of the post, verifies the update, and saves it. Everyone else receives the update over the engine transport and applies it to their local copy of the document.
Strengths
The most battle-tested library for collaboration. Yjs is used by many products, and has also received the most testing in Gutenberg.
No merge conflicts. Yjs has a deterministic algorithm for combining edits, which means there’s never an edit that conflicts with the document.
The most “real time” collaboration. Yjs updates are fast and small (no matter the size of a document), communicate cursor-level presence, and are designed for a real-time feel.
Weaknesses
Yjs “hides” conflicts by choosing a winner itself. If two collaborators change a blockBlockBlock is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. setting at the same time, one user silently wins. If two people rewrite the same sentence at the same time, it’s possible for the result to be a mix that nobody wrote individually. Nobody is warned about conflicts, because the engine does not treat them as conflicts.
It communicates in compressed binary messages. Instead of “User A added ‘Lorem ipsum’ to paragraph 1”, Yjs messages look like { "type": "update", "data": "AAAG+/m3og8CA4IERAE0A6gAx…" }. This is efficient for update size, but can make debugging and understanding history more difficult.
Server agents cannot easily participate in collaboration. Outside tools that alter post content directly can’t easily interact with live collaboration, which can make it possible for an editor’s working copy and post content in the database to diverge.
Two implementations. The yjs-server engine requires matching JSJSJavaScript, a web scripting language typically executed in the browser. Often used for advanced user interfaces and behaviors. and PHPPHPThe web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher implementations because the browser is in charge of merging changes, but the server must also validate. The implementations are kept matching by shared tests, but a divergence between them would cause issues. Protocol updates must be made on server and client at the same time.
Engine 2: DE-RTC
Summary: Most similar to single-user WordPress. People share and merge changes only when they save. The server combines incoming saves with everyone else’s, and produces merge conflicts when there is an overlap. This engine is not designed for Google Docs-style real-time editing, preferring a slower update cadence. Because changes are made via save, external plugins, scripts, or WP-CLIWP-CLIWP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/https://make.wordpress.org/cli/ commands that change post content can take part almost as easily as human edits.
The “DE” in DE-RTC stands for Distributed Editing. @dmsnell proposed the design in WordPress/wordpress-develop#12334 and WordPress/gutenberg#79602, and we’ve ported it into the sync engines plugin. It follows a more traditional WordPress model: if saving is how people share work, then anything that can save a post can take part, including tools that are not browsers. Although DE-RTC can send advisory data over every transport, post data updates are sent via regular saves on the configured save cadence.
Engine: DE-RTC with 10 second save cadence
How your change travels to peers: You make some changes. Every ten seconds (default), your browser sends the whole post to the server through WordPress’s normal autosave. The server merges based on three copies of the post: the version you started from, your updated version, and the current shared version on the server. Changes that do not overlap are combined automatically. When two people change a block in a way that conflicts, that block is set aside for review.
Outside tools can easily take part. A plugin, script, or agent that changes post content can collaborate with a live editor instead of replacing their work.
One implementation for merging, owned by the server. Browser logic is simple and sends the whole post to the server, and the server is in charge of making merges. Unlike yjs-server and intent-log, there is no required duplication of logic between browser and server.
Great for small, low-cost hosting. A few larger requests over a long interval are usually more friendly than constant polling on resource-constrained hosts.
Weaknesses
It is not real-time. You see other people’s changes on the save interval, not author cursors with live updates. The save interval can be adjusted, but DE-RTC scales best with infrequent updates.
Each save sends the whole post, so updates get bigger as the post grows.
Outside tools must say which version they started from. For outside post edits to merge with folks in the editor, tools are required to say which post version they started from (e.g. Base-version: 123). This is simpler than the other engines, but requires tools to be RTC-aware.
The server does not know what you meant. DE-RTC only sees content before and after a save, not “I split this paragraph.” Large post changes made together, like splitting or rearranging blocks, are more often set aside for review.
Engine 3: intent-log
Summary: The browser sends messages describing what a person did in Gutenberg terms, and the server is in charge of keeping a log. For example “Split block 1 at index 20”, then “Add text ‘Lorem Ipsum’ to block 2”. Messages explain changes in human terms. Simultaneous changes are combined via operational transform. Incompatible changes cause conflicts like DE-RTC.
Engine: intent-log Transport: Polling (with 10 second cadence to allow time to edit)
How your change travels to peers: You type some text. Your browser describes it: “insert ‘Lorem ipsum’ at position 0 in block 1”, and sends the message to the server. The server adjusts your change to fit anything that arrived since (if a peer added three letters before yours, your insert moves three places over), adds it to the log, and sends back an answer. Conflicts are set aside for human merge review. Everyone else receives the official server-side log of actions after your changes are processed.
Example intent-log messages for the demo above:
// User B adds content to block 02f5e6c3
{
"intentId": "...",
"baseSeq": 585,
"type": "insert_text",
"payload":{
"syncId": "02f5e6c3-2876-43a6-b041-6f3d0a217095",
"field": "content",
"offset": 42,
"text": " in the editor."
}
}
// At the same time, User A merges block 02f5e6c3 into block 8d979605
{
"intentId": "...",
"baseSeq": 585,
"type": "merge_blocks",
"payload":{
"survivorId": "8d979605-e1d7-4cec-bc6e-4a3eaa6f30bc",
"absorbedId": "02f5e6c3-2876-43a6-b041-6f3d0a217095",
"field": "content",
"joinOffset": 48
}
}
Strengths
The server understands what happened in human terms. In yjs-server, moving a block in a post can look like a rewrite of the post, because the engine has no context when diffing a change. In intent-log, a block move is a simple message (“Moved block 1 to position 3”). This allows for context-aware merge strategies and server-side understanding of changes.
Intent-log keeps a human-readable record of the session. Every post has a built-in readable history of recent actions and who made them.
Outside tools can join by saying which version they started from, similar to DE-RTC. External saves can be turned into intent-log edits and combined with others.
Weaknesses
Intent-log can only process one update at a time per post. Intent-log uses a lock to manage incoming messages one at a time. Under heavy use within a single post, lock contention may be an issue and cause updates to sync more slowly.
Operational transforms are difficult. Intent-log is built on operational transforms, which involve realigning concurrent edits so that they can be combined without conflict. This difficult logic still needs a lot of work in intent-log.
Two implementations. The intent-log engine requires both a JS and PHP implementation because the browser must show your edits instantly as well as keep them in the right place as other changes arrive. This means intent-log runs the same logic in your browser (JS) and on the server (PHP) in order to avoid separation between the two logs. The implementations are kept matching by shared tests, but a divergence between them would cause issues. Protocol updates must be made on server and client at the same time.
Side by side
yjs-server
DE-RTC
intent-log
Updates arrive quickly?
Yes
No
Yes
Live cursors in the text
Yes, Google Docs-style
No
Yes (not implemented yet)
What the browser sends
Binary updates
The whole post
Short descriptions of edits
Where does the merge logic live?
Server and browser
Server
Server (with browser preview)
Two people make a conflicting change
Combined silently, one person wins
Set aside for review
Set aside for review
Outside tools
Not merged with live session
Join by naming a version
Join by naming a version
Server work per change
Most, grows with post size
Middle, upload grows with post size
Least
Transports: How changes travel
We’re mostly concerned with engine selection in this post, but we have several transports available that all engines can support. We expect transport options to depend on hosting availability. Here’s a quick rundown of those transports:
Transport
How it works
What it needs
Polling
The browser sends local updates and asks the server for updates on a timer, every N seconds. Can be adjusted anywhere from one to 25 seconds (default 5).
No special infrastructure. Works on every host, and can be scaled at the cost of PHP workers.
Polling with WebRTC advisory channel
The browser sends local updates and asks the server for updates on a relaxed polling timer. However, when any peer makes a change, other peers are notified via WebRTC to immediately request an update from the server instead of waiting until the next poll cycle.
Browsers that can reach each other over WebRTC. When not possible, falls back to regular polling.
Server-sent events
The browser keeps one connection open to WordPress and receives updates through it continuously. Local updates are sent to the polling endpoint.
Hosting that allows long-open connections. One server process per open window, can consume PHP workers.
Server-sent events (daemon)
The same one-way connection as server-sent events, but run on a stable, separate process instead of a general PHP worker. Local updates are sent to the polling endpoint.
A server that can run a separate process, and hosting that allows long-open connections.
WebSocket
A connection open in both directions, run on a separate process. Changes arrive almost instantly.
A server that can run a separate WebSocket process.
Higher-fidelity transports are designed to be downgradable and fall back to polling. That means that if you choose a transport that relies on a separate service (such as the WebSocket daemon) and it stops responding, polling will always be available as a backup.
Call to action
Try it out and tell us what you think! When you test, please keep in mind that all three engines need polish and may have bugs. We want to hear about bugs, but care most about the major design differences between the engines and how they might affect your workflow. Are fast updates and live cursors a must for you? Do you prefer the simpler model of DE-RTC? How do you feel about the merge conflicts you encountered?
Report what you find on GitHub issues or in #feature-realtime-collaboration on WordPress Slack. For more in-depth information, see documentation in the repository:
data-flow.md shows technical engine data flows on one page.
The live meeting will focus on the discussion for upcoming releases, and have an open floor section.
The various curated agenda sections below refer to additional items. If you have ticketticketCreated for both bug reports and feature development on the bug tracker. requests for help, please continue to post details in the comments section at the end of this agenda or bring them up during the dev chat.
Announcements 📢
WordPress 7.2
WordPress 7.2 BetaBetaA pre-release of software that is given out to a large group of users to trial under real conditions. Beta versions have gone through alpha testing in-house and are generally fairly close in look, feel and function to the final product; however, design changes often occur as part of the process. 1 is scheduled for release next Tuesday, Oct 20 at 15:00 UTC
The discussion section of the agenda is for discussing important topics affecting the upcoming release or larger initiatives that impact the CoreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress. Team. To nominate a topic for discussion, please leave a comment on this agenda with a summary of the topic, any relevant links that will help people get context for the discussion, and what kind of feedback you are looking for from others participating in the discussion.
Open floor 🎙️
Any topic can be raised for discussion in the comments, as well as requests for assistance on tickets. Tickets in the milestone for the next major or maintenance release will be prioritized.
Please include details of tickets / PRs and the links in the comments, and indicate whether you intend to be available during the meeting for discussion or will be async.
The Presence APIAPIAn API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. meeting took place on Monday, October 12, 2026 at 15:00 UTC in #feature-presence-api. It also hosts the real-time collaboration (RTC) work. This week’s focus was the feature pluginFeature PluginA plugin that was created with the intention of eventually being proposed for inclusion in WordPress Core. See Features as Plugins merge criteria, and which gaps are left before a coreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress. proposal.
Presence API 0.17.0 shipped October 8. A site can now switch off each piece it doesn’t want, and the presence functions take an $args array (#789).
The debugger and DB viewer moved into their own presence-debugger pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. (#760), and Presence Scenes gained arrivals, coming-back and fading-out scenes (#775).
Follow-ups
GutenbergGutenbergThe Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc.
https://wordpress.org/gutenberg/ Sync Engines (GSE) is drafting a Make post to be published this week.
The collaborator-liveness work left over from #647 now lives in GSE: a second tab is GSE#147, and another device is GSE#148. #815 gives GSE#148 a way to tell a second browser from a second tab.
@iamchitti is taking Firefox and WebKit end-to-end runs, scoped to the tab coordination specs (#808).
Inline CSS in the PHPPHPThe web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher files moves into stylesheets (#807).
@iamchitti took touch devices (#821), keyboard-only checks (#822) and the feature with JavaScriptJavaScriptJavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser.
https://www.javascript.com off (#823).
Nobody has claimed HTMLHTMLHyperText Markup Language. The semantic scripting language primarily used for outputting content in web browsers. validation or a security audit yet, and neither has an issue. Comment on #550 to take one.
Path to core
Post locks are the first consumer, and GSE is the first outside project on the API. The readiness gate on #550 asks for three outside projects and eight weeks without a breaking API change, counted from 0.17.0, so December 3 at the earliest. Anyone building on the API, or considering it for a plugin or host, is welcome to get in touch.
Open floor
Private security reporting is now enabled on the repository, thanks to @huzaifaalmesbah.
@iamchitti asked where the TracTracAn open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress. proposal draft is, and offered to review it this week.
Since the meeting
Presence API 0.18.0 shipped with the session hash (#815) and core’s copy of each API function winning once it exists (#805).
Since WordPress 7.1 the Toolbar is also displayed in the Post Editor and the Site Editor (#65091, dev note). That change made an old problem more visible: the first two items of the Toolbar, the W and the site name, do not behave the same everywhere. #66258 proposes to fix that. This post outlines the change, the reasons, and asks for feedback before a patchpatchA special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing. is written.
TracTracAn open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress.ticketticketCreated for both bug reports and feature development on the bug tracker.: core.trac.wordpress.org/ticket/66258
A click on the W goes to the About WordPress page.
A click on the site name goes to the site in the adminadmin(and super admin), and to the Dashboard on the front end.
The site name menu also changes. In the admin it has only Visit Site. On the front end it has Dashboard, Plugins and Themes.
In the editors, the Toolbar has no link to the Dashboard.
The proposal
Two fixed links.
The W always goes to the Dashboard. Dashboard is the first item of the W menu. About WordPress and the other items stay in the menu. On small screens the W stays visible. Today it is hidden under 600px.
The site name always goes to the site. The menu is the same everywhere: Visit Site, Plugins and Themes. On multisitemultisiteUsed to describe a WordPress installation with a network of multiple blogs, grouped by sites. This installation type has shared users tables, and creates separate database tables for each blog (wp_posts becomes wp_0_posts). See also network, blog, site, Manage Site comes after Visit Site. Classic themes keep Widgets, Menus, Background and HeaderHeaderThe header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes..
The Dashboard has one place, under the W. Please, check following images:
Why
The W is the most visible item of the Toolbar, and today it goes to a page people rarely need. With this change it gets a useful click. There is no learned behavior to unlearn.
One click to the Dashboard from everywhere. So, we can build the right mental model.
One behavior to learn. People do not need to check where they are before they click.
Two clear places. The W is the admin. The site name is the site front end.
It works on multisite. My Sites stays next to the W, as today. In the Networknetwork(versus site, blog) Admin, the W goes to the network Dashboard.
How to test it
Open the Playground link. It loads WordPress with the test pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. active and lands on the Dashboard. Or download the plugin and install it on a test site. Deactivate it to compare with the current behavior. It stores nothing in the database.
What to look for:
The admin, the front end, the Post Editor and the Site Editor. The W and the site name do the same thing in all of them.
A window under 600px. The W is visible and goes to the Dashboard.
A multisite, if you have one. The Network Admin and a sub site.
A classic theme. Widgets, Menus, Background and Header stay in the site name menu.
A plugin that adds items to the W menu or the site name menu. The node IDs do not change, so they should keep working.
Leave feedback by October 16th
Please leave feedback in the Trac ticket, so it stays in one place. Comments on this post are welcome too. The deadline is October 16th, ahead of the 7.2 BetaBetaA pre-release of software that is given out to a large group of users to trial under real conditions. Beta versions have gone through alpha testing in-house and are generally fairly close in look, feel and function to the final product; however, design changes often occur as part of the process. 1 on October 20th 😊
Feature Notifications is the project exploring a unified notifications system for WordPress (#43484). It has been quiet since version 0.2.0 shipped in April 2023. This post covers where the project stands today and the plan to get to version 0.3.0, with the goal of shipping 0.3.0 alongside the WordPress 7.2 release in December.
Why 0.3.0 matters
The 0.3.0 milestone was always meant to be the first live preview: a working system that creates, stores, displays, and dismisses notifications. That makes 0.3.0 the project’s first functional MVPMinimum Viable Product"A minimum viable product (MVP) is a product with just enough features to satisfy early customers, and to provide feedback for future product development." - WikiPedia rather than a maintenance release.
Where things stand
I’ve spent some time auditing the codebase and putting together a detailed release plan. In short:
The foundations are solid. The data models, factories, channel registry, and database schema are well designed and have unit tests. The notification hub UIUIUser interface in the adminadmin(and super admin) bar is in place.
The system isn’t wired up end to end yet. The persistence layer is still a set of stubs, the REST APIREST APIThe REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”)
https://developer.wordpress.org/rest-api/ returns empty responses, dismissing a notification doesn’t save anything, and the REST controller tests are skipped. A few subtle bugs (in the schema, the factory, model serialization, and the client-side data store) mean wiring things up isn’t enough. They need fixing first.
The release tooling has drifted. Version numbers disagree across files, the readme and changelog are out of date, internationalization doesn’t work end to end, and some CI checks pass without testing anything.
Recent maintenance: the tooling has been brought in line with current WordPress standards (#559), and dependencies are up to date.
Major Kudos
It would be remiss of me not to share massive kudos and thanks to the contributors who stepped in to keep the project moving when I had to step away in 2023, especially @sephsekla, @bitmachina, and @erikyo, and everyone who has contributed to the project so far. I hope you can all join in some way as we work toward getting this merged into coreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress..
Next steps
The work is split into phases, and much of it can happen in parallel:
Clean up the workspace.TriagetriageThe act of evaluating and sorting bug reports, in order to decide priority, severity, and other factors. the open pull requests, including the existing polling PR (#397), and move the relevant issues into the 0.3.0 milestone.
Build the MVP. Ship a schema update with a working upgrade path, implement the notification and subscription repositories, add a PHPPHPThe web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higherAPIAPIAn API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. for emitting notifications to a channel, flesh out the REST endpoints with a proper capabilitycapabilityA capability is permission to perform one or more types of task. Checking if a user has a capability is performed by the current_user_can function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts (the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability). model, fix the client-side store, and add polling and persistent dismissal. A WP-CLIWP-CLIWP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/https://make.wordpress.org/cli/ command to seed sample notifications will make all of this easier to test.
Fix correctness and security issues. These include an open permission check on the subscriptions endpoint, output escaping, URLURLA specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org validation on notification actions, and timezone handling.
Get internationalization working, from text domains through to generating the .pot file and shipping translations in the zip.
Tidy up the release. Align version numbers, set minimum requirements to WordPress 6.7 and PHP 8.1, write the changelog, and fix the release workflow and test matrix.
Release 0.3.0 as a GitHubGitHubGitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https://github.com/ release, submit it to the WordPress.orgWordPress.orgThe community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. directory, and invite everyone to start testing.
You can find more details about the release plan in this Markdown document, which will help focus the work that needs doing.
The target date for this release is 1 December 2026, to align with the final WordPress 7.2 RCrelease candidateOne of the final stages in the version release cycle, this version signals the potential to be a final release to the public. Also see alpha (beta)..
Get involved
If you’d like to help, whether through code, testing, design feedback, or reviewing pull requests, join the #feature-notifications channel in Making WordPress Slack. I’ll post regular updates there as the work moves forward, and it’s the best place to find out where help is needed. You can also follow along on the GitHub repository.
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to the list of SQL modes that WordPress doesn’t support. WordPress already turns off some modes, such as STRICT_ALL_TABLES, TRADITIONAL and ANSI, when it connects to the database. This mode is now on that list too.
Why this change?
WordPress uses the backslash character (\) to escape special characters in SQL queries. When NO_BACKSLASH_ESCAPES is on, MySQLMySQLMySQL is a relational database management system. A database is a structured collection of data where content, configuration and other options are stored. https://www.mysql.com reads the backslash as a normal character, not as an escape character. Queries with escaped values can then fail or return the wrong data.
Some hosts or server setups may turn this mode on. Before this change, sites on those servers could have hard-to-find database problems.
When WordPress connects to the database, wpdb::set_sql_mode() now removes NO_BACKSLASH_ESCAPES from the session’s SQL modes. This affects only the WordPress database connection. It doesn’t change the server’s global settings.
Most sites won’t notice any difference.
What if I need this mode?
If your site really needs NO_BACKSLASH_ESCAPES, you can keep it with the existing incompatible_sql_modesfilterFilterFilters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output.:
WordPress connects to the database before plugins load, so add this code in a db.php drop-in. Code in a normal pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. or a must-use plugin runs too late.
Please note that WordPress CoreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress. may not work correctly with this mode turned on.
Since its inception, WordPress has relied on the KSES1 subsystem to sanitize HTMLHTMLHyperText Markup Language. The semantic scripting language primarily used for outputting content in web browsers.. Its purpose has grown and changed over time, but primarily serves two purposes: correct aesthetic defects that are likely the result of typos or pasting errors; and remove security risks that might appear in untrusted inputs. The original kses library was written before HTML5 fully-formalized HTML parsing and at a time when it was common to “hand type” HTML. Today, however, there is no such thing as “seriously malformed2” HTML and most people author content through rich editors, such as WordPress’ BlockBlockBlock is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. editor. This means that today, the primary purpose of wp_kses() is to prune out risks from untrusted inputs, and it’s time for it to get an overhaul.
As part of #66208, PR#13271 replaced the implementation of wp_kses() with a new one based on the HTML API. This update replaces a complicated chain of functions, string processing, PCRE regular expressions, and outdated logic to ensure that WordPress can perform its sanitization role reliably and comprehensibly.
You must be logged in to post a comment.