WordPress.org

Welcome!

The WordPress coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. development team builds WordPress! Follow this site for general updates, status reports, and the occasional code debate. There’s lots of ways to contribute:

Found a bugbug A bug is an error or unexpected result. Performance improvements, code optimization, and are considered enhancements, not defects. After feature freeze, only bugs are dealt with, with regressions (adverse changes from the previous version) being the highest priority.? Create a ticket in the bug tracker.

Want to contribute? Get started quickly with tickets marked as good first bugs for new contributors or join a bug scrub. There’s more on the reports page, like patches needing testing, and on feature projects page.

Other questions? Here is a detailed handbook for contributors, complete with tutorials.

This post summarizes the dev chat meeting from June 27th (agenda, Slack archive).

4.9.7 planning

Confirmed @pbiron and @joshuawold as co-release leads with @sergeybiryukov and @psykro as co-deputies
Likely focus for 4.9.7 to be “Try GutenbergGutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. https://wordpress.org/gutenberg/” prompt and privacy fixes
Release timing for 4.9.7 will be confirmed amongst release leads and shared when ready
Consensus that release leads have previous contribution experience (not necessarily CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. contributions), also helpful that a lead or deputy has commit access
Aiming to expand roster of individuals who have experience leading releases, so one approach is pairing “new” leads with “experienced” ones though other candidates could feasilby be experienced enough to not require a co-lead
Though no defined process exists on selecting or confirming leads, if someone has concerns about a nominated lead they can directly talk with @jeffpaul if they’re not comfortable speaking up during the devchat though ideally concerns are more transparent or at least leverages a group and not a single entity to coordinate concerns appropriately

Updates from focus leads and component maintainers

The Gutenberg team released v3.1 and published release notes as to the updates included
The JavaScriptJavaScript JavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser. https://www.javascript.com/. team published notes from their meeting where they discussed sunsetting the packages repository, an alternative to wp.apiRequest, a deprecation strategy, data module improvements, the build process, and inline docsinline docs (phpdoc, docblock, xref). Many thanks to them for continuing to share notes from their chats
Reminder to focus leads and component maintainers to try and publish meeting notes from your chats to help socialize what’s happening across the different teams in #core.

Devchat coordination

@jeffpaul will be offline most of July, so @joemcgill, @audrasjb, and @antpb will help coordinate devchats (collecting agenda items and publishing an agenda, running the actual devchat meeting, and publishing a devchat summary). post-devchat note: @whitneyyadrich also volunteered to assist with devchat coordination

General announcements

@jeffpaul: some comments lately about security issues and the security team, reminder about responsible security disclosures, people’s views will be better received if they’re formed as offering solutions to problems rather than continuing to point out problems
- @paragoninitiativeenterprises: recent security advisory showed longer ETA than expected, security team needs more resources (e.g., personnel) and it falls upon the community to ensure the security team has the manpower it needs
- @jeffpaul: anyone who feels they have the ability and interest to contribute to WordPress Security should reach out to @aaroncampbell
Effort from .ORG to contact hosts with large amounts of WordPress installs to help manually update sites from 4.9.3, current count hovering over a million sites but down significantly, still working with some groups (e.g., Google search console team) to try to get more people updated

Next meeting

The next meeting will take place on July 4, 2018 at 20:00 UTC in the #core SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/. channel. Please feel free to drop in with any updates or questions. If you have items to discuss but cannot make the meeting, please leave a comment on this post so that we can take them into account.

#4-9-3, #4-9-7, #core-js, #dev-chat, #gutenberg, #security, #summary

David Anderson 8:36 pm on June 29, 2018

The section on the security team, in this summary, reads strangely. Surely if the current organisation of the coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. team with a dedicated security sub-team is not working, then the core team should look at how they could change the specifics of that organisation?

To hive off a separate security sub-team, and then say it’s the community’s fault for not adequately staffing it, and that this is why security issues are not being address, does not make sense to me. It is clear that plenty of priorities for WP are getting adequate attention (e.g. Gutenburg). Security surely ought also to be a priority. If there are not enough people working on security, then rather than saying “so, unfortunately security must suffer”, shouldn’t the core team look at how it could internally re-organise itself to resolve the problem?

From what I’ve read, inadequate attention to security reports is a long term problem. Doesn’t that call out for leadership to take hold of it and address it? Saying that it’s the community’s fault means that it’s everybody’s fault and nobody’s fault, and that nobody will take responsibility. But there is a core team, so nobody taking responsibility should not be the outcome.
- Jonathan Bossenger 12:41 pm on June 30, 2018
  
  @davidanderson to clarify, that statement of the security team being understaffed was one person’s opinion on the matter, @jeffpaul was merely summarising the comments in that part of the discussion, including a call for anyone who wants to assist to contact the relevant person. In other words, it was not the coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. team saying that it’s the community’s fault that the security team is understaffed.
BearlyDoug 1:45 am on July 1, 2018

Effort from .ORG to contact hosts with large amounts of WordPress installs to help manually update sites from 4.9.3, current count hovering over a million sites but down significantly, still working with some groups (e.g., Google search console team) to try to get more people updated

Is there a place where hosting providers can let you know about them? My employer hosts just over 200 WP sites on our networknetwork (versus site, blog) (1x 4.7.9, 2x 4.8.1, 7x 4.9.5, the rest are 4.9.6).

Thanks!
- Jeffrey Paul 7:55 pm on August 24, 2018
  
  @bearlydoug I’d recommend checking in the #hosting-community channel in WordPress Slack
David Page 7:42 pm on July 4, 2018

I’d like to see if https://core.trac.wordpress.org/ticket/38280 can get in the next patchpatch A special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing. release. I realise it’s an enhancementenhancement Enhancements are simple improvements to WordPress, such as the addition of a hook, a new feature, or an improvement to an existing feature., but it doesn’t deployDeploy Launching code from a local development environment to the production web server, so that it's available to visitors. new files and it has had a component reviewer go over it.
hbrack 7:56 pm on July 4, 2018

I have a question re: last week’s security discussion about the “WordPress File Delete to Code Execution” issue publicly reported by ripstech. Is there a plan to include a fix to address this in the next WPress release? Or is your recommendation that everyone apply the temporary hotfix that was posted on that same blogblog (versus network, site) post? It’d be great to know if there are immediate plans to resolve it on the WPress side, particularly for those who have many client installs to patchpatch A special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing.. Thanks in advance!

Comments are closed.

Welcome!

Communication

Dev Chat Summary: June 27th (4.9.7 week 6)

4.9.7 planning

Updates from focus leads and component maintainers

Devchat coordination

General announcements

Next meeting

Welcome!

Communication

4.9.7 planning

Updates from focus leads and component maintainers

Devchat coordination

General announcements

Next meeting

Share this: