@rootswp

Advanced tools for professional WordPress developers πŸ”§ https://xitter.cf/t.co/aWZDsySk6l Tweets by @retlehs

roots.io/
Joined March 2011
  • Tweets793
  • Following220
  • Followers3.9K
130Media
✨ We built WP Composer β€” an independent, open source Composer repository for WordPress plugins and themes, with 17x faster cold resolves than WPackagist wp-composer.com/
Screenshot of performance section from https://wp-composer.com/wp-composer-vs-wpackagist

ALT Screenshot of performance section from https://wp-composer.com/wp-composer-vs-wpackagist

7
53
12
203
51,435
PHP now recommends keeping session upload progress disabled until the next PHP release (CVE-2026-115560): Trellis v1.32.2 makes this the default roots.io/php2shell-patching-…
Screenshot of the diff from https://github.com/roots/trellis/pull/1697

ALT Screenshot of the diff from https://github.com/roots/trellis/pull/1697

Screenshot of session upload progress informational advisory from php.net

ALT Screenshot of session upload progress informational advisory from php.net

roots.io
@rootswpOct 21
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are out with fixes for two critical RCE vulnerabilities. Trellis v1.32.1 switches PHP to packages.sury.org, which had the patched builds first. Here's how to upgrade, or apply just the PHP change: discourse.roots.io/t/upgradi…
Screenshot of the linked post

ALT Screenshot of the linked post

2
3
24
1,483
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
49
898
151
2,834
398,337
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are out with fixes for two critical RCE vulnerabilities. Trellis v1.32.1 switches PHP to packages.sury.org, which had the patched builds first. Here's how to upgrade, or apply just the PHP change: discourse.roots.io/t/upgradi…
Screenshot of the linked post

ALT Screenshot of the linked post

1
3
1
15
2,065
An unofficial stopgap is going around: Set session.upload_progress.enabled = Off until you can upgrade PHP hasn't confirmed it helps, but WordPress and Laravel don't use the feature Trellis steps are in the thread along with Cloudflare rules discourse.roots.io/t/upgradi…
roots.io
@rootswpOct 20
PHP is shipping a security release tomorrow (Oct 21, 14:00 UTC) for two critical vulnerabilities Re-provisioning Trellis won't upgrade PHP on its own. Here's how to upgrade once the PPA build is out: discourse.roots.io/t/upgradi… PHP's announcement: php.net/archive/2026.php#202…

Upgrading PHP on Trellis servers for the Oct 21 security release

PHP is shipping a security release tomorrow, Wednesday, October 21 at 14:00 UTC. It fixes two critical vulnerabilities, both rated CVSS 9.2 (announcement). The affected and fixed versions will be...

discourse.roots.io
4
28
6
167
37,086
Oh boy, it's about to get serious tomorrow 😬 cert.europa.eu/publications/…
40
186
41
1,278
274,765
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
344
4,176
1,254
18,608
7,049,355
PHP is shipping a security release tomorrow (Oct 21, 14:00 UTC) for two critical vulnerabilities Re-provisioning Trellis won't upgrade PHP on its own. Here's how to upgrade once the PPA build is out: discourse.roots.io/t/upgradi… PHP's announcement: php.net/archive/2026.php#202…

Upgrading PHP on Trellis servers for the Oct 21 security release

PHP is shipping a security release tomorrow, Wednesday, October 21 at 14:00 UTC. It fixes two critical vulnerabilities, both rated CVSS 9.2 (announcement). The affected and fixed versions will be...

discourse.roots.io
2
5
1
39
38,212
🚨 If you use PHP, get ready to update your PHP version (8.0+) tomorrow at 14:00 UTC for a critical PHP security release! php.net/archive/2026.php
16
130
15
572
54,132
Installing WordPress core with Composer? Make updates boring: β†’ Let Renovate open a PR as soon as a new roots/wordpress version drops (see Bedrock's config) β†’ Make sure your e2e tests cover critical paths β†’ Automatically run them against seeded data on every dependency PR
1
16
785
roots.io retweeted
Ploi
@ploi_deploySep 23
WordPress sites on Roots Bedrock now work with every WordPress tool in Ploi. Ploi detects the web/wp core directory, so plugins, themes, search and replace, the WP-CLI console, cronjobs and clones all work. Override the core directory if your fork moved it.
1
3
10
747
Back when Sage used to be called the Roots Theme, it was one of the first WordPress themes to add a build system v6.5.0 used Grunt and Bootstrap v3 with Less, and shortly after we added Bower πŸ‘΄
Tomasz Łakomy
@tlakomySep 24
If you remember this, your back probably hurts.
3
2
30
1,455
🚨 PSA for Radicle users: the latest WordPress security releases (7.0.6, 7.1.2) break Blade views that live outside the theme directory. Front-end fatals with memory exhaustion, wp-admin looks fine. Fixed in Acorn v6.3.0. Update before you update WordPress. If you're using Radicle with WooCommerce, you'll also need changes applied to the sage-woocommerce package. See this topic for more details: discourse.roots.io/t/psa-wor…

PSA: WordPress 7.0.6 / 7.1.2 security release breaks Blade views that live outside the theme...

The latest WordPress security releases (7.1.2, backported to 7.0.6, 6.8.x, and older branches) changed how locate_template() works. It now rejects any template name containing .. unless the file...

discourse.roots.io
2
9
742
Welcome @humanmadeltd github.com/humanmade/altis-c…

Switch WordPress core package to roots/wordpress by joehoyle Β· Pull Request #1022 Β· humanmade/alt...

Due to a bug in the build in johnpbloch/wordpress-core#40 the 7.1.1 and other packages are corrupted. That coupled with the fact the wordpress releases on https://github.com/johnpbloch/wordpress-co...

github.com
roots.io
@rootswpSep 18
Welcome @wpcli github.com/wp-cli/wp-cli-tes…

Install WordPress from roots/wordpress-full in Composer-based tests by swissspidy Β· Pull Request...

Two fixes to the Given a WP installation with Composer path, one commit each. 1. Swap johnpbloch/wordpress-core for roots/wordpress-full johnpbloch/wordpress-core repackages every release into its ...

github.com
23
2,801
Welcome @wpcli github.com/wp-cli/wp-cli-tes…

Install WordPress from roots/wordpress-full in Composer-based tests by swissspidy Β· Pull Request...

Two fixes to the Given a WP installation with Composer path, one commit each. 1. Swap johnpbloch/wordpress-core for roots/wordpress-full johnpbloch/wordpress-core repackages every release into its ...

github.com
1
3
1
41
5,421
Acorn is 6 stars away from 1k πŸ‘€ github.com/roots/acorn
Screenshot of the page header from https://roots.io/acorn/

ALT Screenshot of the page header from https://roots.io/acorn/

1
1
10
618
πŸ“ˆ 2 million installs on WP Packages Thanks for trusting us with a piece of your build πŸ™ wp-packages.org/

WP Packages β€” WordPress Packages for Composer | WPackagist Alternative

Composer repository for WordPress.org plugins and themes.

wp-packages.org
1
2
13
627
For plugin and theme authors, there are README badges now if you want to show off your Composer install counts wp-packages.org/docs#badges
Screenshot of a wp-packages.org installs badge from the docs page

ALT Screenshot of a wp-packages.org installs badge from the docs page

2
175
roots.io retweeted
Jordi Boggiano
@seldaekMay 28
Composer 2.10 is out. Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with. #php #phpc #composerphp
Composer fending off packages, Malware automatically blocked

ALT Composer fending off packages, Malware automatically blocked

9
85
11
336
25,827
WordPress 7.0 RC4 just dropped: πšŒπš˜πš–πš™πš˜πšœπšŽπš› πš›πšŽπššπšžπš’πš›πšŽ πš›πš˜πš˜πšπšœ/πš πš˜πš›πšπš™πš›πšŽπšœπšœ-πšπšžπš•πš•:𝟽.𝟢-πšπ™²πŸΊ wordpress.org/news/2026/05/w…

WordPress 7.0 Release Candidate 4

The fourth Release Candidate (β€œRC4”) for WordPress 7.0 is ready for download and testing! This version of the WordPress software is under development. Please do not install, run, or test this versi…

wordpress.org
roots.io
@rootswpMay 8
For folks using the πš›πš˜πš˜πšπšœ/πš πš˜πš›πšπš™πš›πšŽπšœπšœ package, you can swap to πš›πš˜πš˜πšπšœ/πš πš˜πš›πšπš™πš›πšŽπšœπšœ-πšπšžπš•πš• to test the latest 7.0 RC:
1
1
4
1,147
roots.io retweeted
Packagist
@packagistMay 13
🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages. Update now (composer self-update) or disable affected Actions workflows. #composerphp #phpc #php
5
91
10
210
92,476
Load more