@rootswp

Advanced tools for professional WordPress developers πŸ”§ https://xitter.cf/t.co/aWZDsySk6l Tweets by @retlehs

roots.io/
Joined March 2011
  • Tweets790
  • Following220
  • Followers3.9K
129Media
✨ We built WP Composer β€” an independent, open source Composer repository for WordPress plugins and themes, with 17x faster cold resolves than WPackagist wp-composer.com/
Screenshot of performance section from https://wp-composer.com/wp-composer-vs-wpackagist

ALT Screenshot of performance section from https://wp-composer.com/wp-composer-vs-wpackagist

7
53
12
203
51,425
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are out with fixes for two critical RCE vulnerabilities. Trellis v1.32.1 switches PHP to packages.sury.org, which had the patched builds first. Here's how to upgrade, or apply just the PHP change: discourse.roots.io/t/upgradi…
Screenshot of the linked post

ALT Screenshot of the linked post

1
3
15
619
An unofficial stopgap is going around: Set session.upload_progress.enabled = Off until you can upgrade PHP hasn't confirmed it helps, but WordPress and Laravel don't use the feature Trellis steps are in the thread along with Cloudflare rules discourse.roots.io/t/upgradi…
roots.io
@rootswpOct 20
PHP is shipping a security release tomorrow (Oct 21, 14:00 UTC) for two critical vulnerabilities Re-provisioning Trellis won't upgrade PHP on its own. Here's how to upgrade once the PPA build is out: discourse.roots.io/t/upgradi… PHP's announcement: php.net/archive/2026.php#202…

Upgrading PHP on Trellis servers for the Oct 21 security release

PHP is shipping a security release tomorrow, Wednesday, October 21 at 14:00 UTC. It fixes two critical vulnerabilities, both rated CVSS 9.2 (announcement). The affected and fixed versions will be...

discourse.roots.io
4
28
6
169
36,891
Oh boy, it's about to get serious tomorrow 😬 cert.europa.eu/publications/…
40
187
41
1,279
272,952
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
339
4,168
1,247
18,535
6,960,648
PHP is shipping a security release tomorrow (Oct 21, 14:00 UTC) for two critical vulnerabilities Re-provisioning Trellis won't upgrade PHP on its own. Here's how to upgrade once the PPA build is out: discourse.roots.io/t/upgradi… PHP's announcement: php.net/archive/2026.php#202…

Upgrading PHP on Trellis servers for the Oct 21 security release

PHP is shipping a security release tomorrow, Wednesday, October 21 at 14:00 UTC. It fixes two critical vulnerabilities, both rated CVSS 9.2 (announcement). The affected and fixed versions will be...

discourse.roots.io
2
5
1
39
38,009
🚨 If you use PHP, get ready to update your PHP version (8.0+) tomorrow at 14:00 UTC for a critical PHP security release! php.net/archive/2026.php
16
130
15
573
53,487
Installing WordPress core with Composer? Make updates boring: β†’ Let Renovate open a PR as soon as a new roots/wordpress version drops (see Bedrock's config) β†’ Make sure your e2e tests cover critical paths β†’ Automatically run them against seeded data on every dependency PR
1
16
782
roots.io retweeted
Ploi
@ploi_deploySep 23
WordPress sites on Roots Bedrock now work with every WordPress tool in Ploi. Ploi detects the web/wp core directory, so plugins, themes, search and replace, the WP-CLI console, cronjobs and clones all work. Override the core directory if your fork moved it.
1
3
10
745
Back when Sage used to be called the Roots Theme, it was one of the first WordPress themes to add a build system v6.5.0 used Grunt and Bootstrap v3 with Less, and shortly after we added Bower πŸ‘΄
Tomasz Łakomy
@tlakomySep 24
If you remember this, your back probably hurts.
3
2
30
1,452
🚨 PSA for Radicle users: the latest WordPress security releases (7.0.6, 7.1.2) break Blade views that live outside the theme directory. Front-end fatals with memory exhaustion, wp-admin looks fine. Fixed in Acorn v6.3.0. Update before you update WordPress. If you're using Radicle with WooCommerce, you'll also need changes applied to the sage-woocommerce package. See this topic for more details: discourse.roots.io/t/psa-wor…

PSA: WordPress 7.0.6 / 7.1.2 security release breaks Blade views that live outside the theme...

The latest WordPress security releases (7.1.2, backported to 7.0.6, 6.8.x, and older branches) changed how locate_template() works. It now rejects any template name containing .. unless the file...

discourse.roots.io
2
9
739
Welcome @humanmadeltd github.com/humanmade/altis-c…

Switch WordPress core package to roots/wordpress by joehoyle Β· Pull Request #1022 Β· humanmade/alt...

Due to a bug in the build in johnpbloch/wordpress-core#40 the 7.1.1 and other packages are corrupted. That coupled with the fact the wordpress releases on https://github.com/johnpbloch/wordpress-co...

github.com
roots.io
@rootswpSep 18
Welcome @wpcli github.com/wp-cli/wp-cli-tes…

Install WordPress from roots/wordpress-full in Composer-based tests by swissspidy Β· Pull Request...

Two fixes to the Given a WP installation with Composer path, one commit each. 1. Swap johnpbloch/wordpress-core for roots/wordpress-full johnpbloch/wordpress-core repackages every release into its ...

github.com
23
2,798
Welcome @wpcli github.com/wp-cli/wp-cli-tes…

Install WordPress from roots/wordpress-full in Composer-based tests by swissspidy Β· Pull Request...

Two fixes to the Given a WP installation with Composer path, one commit each. 1. Swap johnpbloch/wordpress-core for roots/wordpress-full johnpbloch/wordpress-core repackages every release into its ...

github.com
1
3
1
41
5,417
Acorn is 6 stars away from 1k πŸ‘€ github.com/roots/acorn
Screenshot of the page header from https://roots.io/acorn/

ALT Screenshot of the page header from https://roots.io/acorn/

1
1
10
617
πŸ“ˆ 2 million installs on WP Packages Thanks for trusting us with a piece of your build πŸ™ wp-packages.org/

WP Packages β€” WordPress Packages for Composer | WPackagist Alternative

Composer repository for WordPress.org plugins and themes.

wp-packages.org
1
2
13
626
For plugin and theme authors, there are README badges now if you want to show off your Composer install counts wp-packages.org/docs#badges
Screenshot of a wp-packages.org installs badge from the docs page

ALT Screenshot of a wp-packages.org installs badge from the docs page

2
174
roots.io retweeted
Jordi Boggiano
@seldaekMay 28
Composer 2.10 is out. Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with. #php #phpc #composerphp
Composer fending off packages, Malware automatically blocked

ALT Composer fending off packages, Malware automatically blocked

9
85
11
336
25,817
WordPress 7.0 RC4 just dropped: πšŒπš˜πš–πš™πš˜πšœπšŽπš› πš›πšŽπššπšžπš’πš›πšŽ πš›πš˜πš˜πšπšœ/πš πš˜πš›πšπš™πš›πšŽπšœπšœ-πšπšžπš•πš•:𝟽.𝟢-πšπ™²πŸΊ wordpress.org/news/2026/05/w…

WordPress 7.0 Release Candidate 4

The fourth Release Candidate (β€œRC4”) for WordPress 7.0 is ready for download and testing! This version of the WordPress software is under development. Please do not install, run, or test this versi…

wordpress.org
roots.io
@rootswpMay 8
For folks using the πš›πš˜πš˜πšπšœ/πš πš˜πš›πšπš™πš›πšŽπšœπšœ package, you can swap to πš›πš˜πš˜πšπšœ/πš πš˜πš›πšπš™πš›πšŽπšœπšœ-πšπšžπš•πš• to test the latest 7.0 RC:
1
1
4
1,146
roots.io retweeted
Packagist
@packagistMay 13
🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages. Update now (composer self-update) or disable affected Actions workflows. #composerphp #phpc #php
5
91
10
210
92,430
roots.io retweeted
Ben Word
@retlehsMay 12
Spin up a @rootswp Bedrock site in your browser 🌐 Powered by php-wasm, ghostty-web, Astro on Cloudflare Workers (Extremely alpha phase & still in a private repo. Got a decent roadmap but time is tight atm - it'll eventually support Acorn and Sage) playground.roots.io
Screenshot of playground.roots.io

ALT Screenshot of playground.roots.io

Screenshot of playground.roots.io

ALT Screenshot of playground.roots.io

2
3
23
1,409
An early warning system for WordPress plugin security issues: WP Packages now tracks vendor mass closures publicly RSS feed and APIs also available for mass closures πŸ”” wp-packages.org/closures
Screenshot of https://wp-packages.org/closures

ALT Screenshot of https://wp-packages.org/closures

2
4
25
1,467
More info on the blog: roots.io/wp-packages-now-tra…

WP Packages Now Tracks Mass Plugin Closures

A public history of vendor mass-closure events on WordPress.org β€” recorded automatically when 2+ plugins from the same vendor are closed within a day.

roots.io
213
Load more