roots.io (@rootswp) header
roots.io (@rootswp) profile picture

Advanced tools for professional WordPress developers πŸ”§ https://nitter.cf/t.co/aWZDsySk6l Tweets by @retlehs

Joined March 2011
Photo by roots.io (@rootswp)Photo by roots.io (@rootswp)Photo by roots.io (@rootswp)Photo by roots.io (@rootswp)Photo by roots.io (@rootswp)Photo by roots.io (@rootswp)Photo by roots.io (@rootswp)Photo by roots.io (@rootswp)Photo by roots.io (@rootswp)Photo by roots.io (@rootswp)
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
51
903
151
2,849
409,627
Oh boy, it's about to get serious tomorrow 😬 cert.europa.eu/publications/…
40
185
41
1,275
275,529
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
343
4,174
1,254
18,588
7,079,838
🚨 If you use PHP, get ready to update your PHP version (8.0+) tomorrow at 14:00 UTC for a critical PHP security release! php.net/archive/2026.php
15
130
14
572
54,417
roots.io retweeted
WordPress sites on Roots Bedrock now work with every WordPress tool in Ploi. Ploi detects the web/wp core directory, so plugins, themes, search and replace, the WP-CLI console, cronjobs and clones all work. Override the core directory if your fork moved it.
1
3
10
750
roots.io retweeted
Composer 2.10 is out. Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with. #php #phpc #composerphp
9
85
11
336
25,830
roots.io retweeted
🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages. Update now (composer self-update) or disable affected Actions workflows. #composerphp #phpc #php
5
91
10
210
92,480
roots.io retweeted
Spin up a @rootswp Bedrock site in your browser 🌐 Powered by php-wasm, ghostty-web, Astro on Cloudflare Workers (Extremely alpha phase & still in a private repo. Got a decent roadmap but time is tight atm - it'll eventually support Acorn and Sage) playground.roots.io
2
3
23
1,412
roots.io retweeted
PSA for Acorn users: skip transients, reach for Laravel Cache β€” roots.io/acorn/docs/laravel-… Just caught Claude Code reaching for a transient & updated Radicle's PHP style guide to be more explicit about this. Official πš‚π™Ίπ™Έπ™»π™»πš‚.πš–πš files for our major projects coming soon!
1
1
13
1,221
roots.io retweeted
Using ACF made sense in 2019 but it doesn't mesh with modern WordPress development. I just inherited a site that heavily uses ACF and it's a complete mess. - Use πš πš˜πš›πšπš™πš›πšŽπšœπšœβ /β πš‹πšžπš’πš•πš with πš πš˜πš›πšπš™πš›πšŽπšœπšœβ /β πšŒπš˜πš–πš™πš˜πš—πšŽπš—πšπšœ for modern WordPress settings (πš‹πšžπš’πš•πš is the successor to πšœπšŒπš›πš’πš™πšπšœ, been using it all week and it's great β€” no more webpack) - Native blocks are more powerful with a better, modern UX. You can use dynamic server rendered blocks where it makes sense, and WordPress 7.0's PHP block registration can replace most ACF blocks - Use the Block Locking API so clients can't break the layouts you build - Use extended-cpts for CPT/taxonomy management ACF repeaters and flexible layouts aren't the way. InnerBlocks + nested native blocks do this with a better UX. Build some boilerplates using πš πš˜πš›πšπš™πš›πšŽπšœπšœβ /β πšŒπš˜πš–πš™πš˜πš—πšŽπš—πšπšœ for settings pages (ACF settings pages look out of place compared to this), native blocks, etc. and let agents use them to produce better interfaces quickly I've been doing this for years on hybrid themes and haven't looked back (not using FSE, it's not the right setup for the designs I work on) "But ACF is faster" β€” not anymore. Agents close the gap, and reviewing their diffs helps you see what modern WP actually looks like.
21
7
4
116
9,719
roots.io retweeted
What's actually in the WooCommerce telemetry payload and four ways to turn it off β€” your store's revenue numbers are in there, sent weekly to a third party: roots.io/disable-woocommerce…
Fun fact: WooCommerce collects your sensitive information without asking for consent. Luckily, it merely consists of about 1000 data points. Let's dive into it... 🧡 Disclosure: I'm a WooCommerce Marketplace partner.
2
9
3
30
8,591
roots.io retweeted
Shipped a public status page for WP Packages β€” every 5-minute build, package changes, and hourly closure checks are now fully transparent wp-packages.org/status
2
15
1,042
roots.io retweeted
WP Packages now supports immutable dev-trunk installs for every WP plugin that doesn't have tags reflecting the latest version. Unlike WPackagist's approach (mutable zip with a cache-busting timestamp, causing unexpected plugin updates), we pin dev-trunk to a specific SVN rev.
2
5
17
1,409
roots.io retweeted
No more crazy composer.json workaround needed anymore, just: composer require wp-plugin/example-plugin:dev-trunk Every plugin now has a example-plugin~dev.json file on the CDN
2
7
881
roots.io retweeted
WP Packages is a new community-funded, open source Composer repository for WordPress plugins and themes, built as an independent alternative to WPackagist. It supports Composer v2's metadata-url protocol, syncs every 5 minutes, and is roughly 17x faster on cold dependency resolves. wp.me/pZhYe-5g2
3
14
1
72
6,541
roots.io retweeted
~12% of WordPress plugins are "doing it wrong" β€” releasing via SVN trunk without tagging versions. We now flag every one of them with workarounds for Composer users. wp-packages.org/untagged
1
3
1
17
2,074
roots.io retweeted
Clarifying some things I’ve seen about WP Composer/Roots this week: – We started working on a WPackagist replacement last August, long before any recent attention – RTs/posts by dot org are unrelated to our motivations, but we do appreciate the extra visibility – Roots has been an independent open source org in the WordPress ecosystem since 2011, with one goal: improve the WP developer experience – We’ve never been an agency or owned by a hosting company, just a team and community focused on open source – I do sell one product, Radicle, to help fund that work, along with past products like screencasts and the Sage book – WP dot com has been a sponsor since 2021, and others, including Pantheon, have supported Roots over the years, with no influence on our roadmap – WP Engine hasn’t been involved with Roots, no sponsorship or collaboration to date, including support and documentation for Sage 11 – When critical ecosystem infrastructure ends up controlled by a private equity-owned company, especially when that platform still has gaps in Composer support, we think the community deserves an open alternative
5
15
2
84
10,667
roots.io retweeted
FYI Composer repos can include an β€˜info’ field in packages.json that displays messages to every developer on install/update. Any repo maintainer could use this to push ads, upsells, or whatever else directly into your terminal wp-composer.com will never do this
We are planning on adding: "WPackagist is now maintained by WP Engine." in the CLI. That is all.
2
1
19
3,037
roots.io retweeted
Glad WPackagist found a home, but tooling this central to the WP Composer workflow probably shouldn’t be owned by a private-equity backed company. I started building a prototype of a WordPress Composer registry (w/ mirror support) for @rootswp late last year, and I’m now more motivated for us to get it launched sooner and keep it community-owned.
WPackagist has been acquired by @wpengine. For over a decade, Outlandish built and maintained this service. Now WP Engine is carrying it forward - with the same commitment to the developer community in the WordPress ecosystem.
7
9
2
80
17,733
roots.io retweeted
roots/wp-config v2 is coming soon, a new fluent API for WordPress configuration github.com/roots/wp-config
4
2
24
1,332