» tagged pages
» logout

sorted by: recent | see : popular
Content Tagged with Releases + Wordpress

WordPress 2.6

I’m happy to announce that version 2.6 of WordPress.org is now available, almost a month ahead schedule. Version 2.6 “Tyner,” named for jazz pianist McCoy Tyner, contains a number of new features that make WordPress a more powerful CMS: you can now track changes to every post and page and easily post from wherever you are on the web, plus there are dozens of incremental improvements to the features introduced in version 2.5.

We’ve prepared a brief video tour of 2.6, if you have 3 minutes and 29 seconds to spare, it’s worth a watch:

If you’d like to embed the tour video in your blog, copy and paste this code for the high quality version:

<embed src="http://v.wordpress.com/mARhRBcT/fmt_dvd" type="application/x-shockwave-flash" width="640" height="385" flashvars="blog_domain=http://wordpress.org/development/2008/07/wordpress-26/&width=640&height=385"> </embed>

And here’s a smaller version, 400 pixels wide:

<embed src="http://v.wordpress.com/mARhRBcT/fmt_std" type="application/x-shockwave-flash" width="400" height="250" flashvars="blog_domain=http://wordpress.org/development/2008/07/wordpress-26/&width=400&height=250"> </embed>

Here’s a more textual overview of what’s hawt in 2.6:

Post Revisions: Wiki-like tracking of edits

With the power of modern computers, it’s silly that we still use save and editing metaphors from the time when the most common method of storage was floppy disks. WordPress has always respected the importance of your writing with auto-save, and now we’re taking that to another level by allowing you to view who made what changes when to any post or page through a super-easy interface, much like Wikipedia or a version control system.

Differences between two versions of posts.

This is handy on any blog in case you make a mistake and want to go back to an older version of a post, and it’s super handy for multi-author blogs where you can see every change tracked by person.

Press This!: Post from wherever you are on the web

A few months ago on my blog we started a conversation about the posting bookmarklet in WordPress and which systems we should look to for inspiration, like Flock, FriendFeed, Facebook, Tumblr, and Delicious. From these suggestions and the Quick Post plugin by Josh Kenzer, we developed a Press This bookmark you can add to your toolbar that provides a fast and smart popup to do posts to your WordPress blog:

Screenshot of Press This interface.

For example, if you click “Press This” from a Youtube page it’ll magically extract the video embed code, and if you do it from a Flickr page it’ll make it easy for you to put the image in your post. On my blog I’ve been experimenting with using different categories and the in_category() function — such as video, quote, aside, et cetera — to create a more tumblelog-like format.

Shift Gears: Turbo-speed your blogging

Gears is an open source browser extension project started by Google that developers like us can use to give you features we wouldn’t normally be able to. There are a lot of things we can do with Gears in the future, but in this release we’ve stuck to using what’s called a “Local Server” to cache or keep a copy of commonly-used Javascript and CSS files on your computer, which can speed up the loading of some pages by several seconds (they just pop right up!). You can install Gears for Firefox or Internet Explorer, with support for Safari and Opera pending. WordPress works just fine without it, you just get a little extra juice when you have it installed.

Theme Previews: See it before your audience does

Now when you select a theme it pops up a window that shows the theme live with all your content, instead of immediately making it active on your site. This is great for just test driving themes before making a switch over publicly, and it is also helpful when you are developing a theme and need to test it but don’t want everybody to see your ongoing mistakes development.

Here are some of the smaller features and improvements in 2.6:

  • Word count! Never guess how many words are in your post anymore.
  • Image captions, so you can add sweet captions like Political Ticker does under your images.
  • Bulk management of plugins.
  • A completely revamped image control to allow for easier inserting, floating, and resizing. It’s now fully integrated with the WYSIWYG.
  • Drag-and-drop reordering of Galleries.
  • Plugin update notification bubble.
  • Customizable default avatars.
  • You can now upload media when in full-screen mode.
  • Remote publishing via XML-RPC and APP is now secure (off) by default, but you can turn it on easily through the options screen.
  • Full SSL support in the core, and the ability to force SSL for security.
  • You can now have many thousands of pages or categories with no interface issues.
  • Ability to move your wp-config file and wp-content directories to a custom location, for “clean” SVN checkouts.
  • Select a range of checkboxes with “shift-click.”
  • You can toggle between the Flash uploader and the classic one.
  • A number of proactive security enhancements, including cookies and database interactions.
  • Stronger better faster versions of TinyMCE, jQuery, and jQuery UI.
  • Version 2.6 fixes approximately 194 bugs.

Developer Notes

WordPress.org had over 75 people contributing code to WordPress 2.6. In addition to the core commit team we had contributions from Dion Hulse, Austin Matzko, Otto42, Benedict Eastaugh, and pishmishy. AaronCampbell and Marco Zehe provided more than a few patches. Back among the top code contributors is Jacob Santos. Alex Concha continues to have WordPress’ back. Joining bug reporting and gardening elite are hakre, Simon Wheatley, mtekk, and Matty Rob. Finally, congratulations to our Peter Westwood on your recent wedding! I’m also proud to announce we’re adding a new core committer to the team: Andrew Ozz (azaozz) has been a huge help to the core team this year, particularly around TinyMCE and making the WYSIWYG something that works for you, not against you.

Because of the new capabilities to make WordPress a clean SVN checkout, plugin and theme authors should do their best to handle forms and posts through WP rather than trying to post to their files directly, here’s a quick Codex article about how to do it using our forward-compatible APIs.

Upgrading

2.6 is pretty much identical to 2.5 from a plugin and theme compatibility point of view, so upgrades from 2.5 should be pretty painless. The 2.5 branch will no longer be maintain so everyone is encouraged to upgrade. Our standard 3-step upgrade instructions apply to this release. There were at least 1,984,047 downloads of the 2.5 series, the fastest growing release we’ve ever had, and I think all of those people will find 2.6 adds a level of polish that really makes WP a pleasure to use every day. (At least I do. :))

Easter Egg

There have been rumors and allegations that there was a so-called “easter egg” added to 2.6 early in its development. These rumors and allegations are completely false!

P.S. If you’re a fan of WordPress, consider joining our fan page on Facebook.

WordPress: Development Blog RSS2 Feed

WordPress 2.5.1

Version 2.5.1 of WordPress is now available. It includes a number of bug fixes, performance enhancements, and one very important security fix. We recommend everyone update immediately, particularly if your blog has open registration. The vulnerability is not public but it will be shortly.

In addition to the security fix, 2.5.1 contains many bug fixes. If you are interested only in the security fixes, you can download these corrected copies of wp-includes/pluggable.php, wp-admin/includes/media.php, and wp-admin/media.php. Replace your existing copies of these files with these new copies.

If you download the entire 2.5.1 release, you will be getting over 70 other fixes. 2.5.1 focuses on fixing the most annoying bugs and improving performance. Here are some highlights:

  • Performance improvements for the Dashboard, Write Post, and Edit Comments pages.
  • Better performance for those who have many categories
  • Media Uploader fixes
  • An upgrade to TinyMCE 3.0.7
  • Widget Administration fixes
  • Various usability improvements
  • Layout fixes for IE

Secret lives of blogs

Since 2.5 your wp-config.php file allows a new constant called SECRET_KEY which basically is meant to introduce a little permanent randomness into the cryptographic functions used for cookies in WordPress. You can visit this link we set up to get a unique secret key for your config file. (It’s unique and random on every page load.) Having this line in your config file helps secure your blog.

Many thanks to Steven Murdoch for responsibly reporting the security issue (CVE-2008-1930) and Alex Concha for reporting an XSS issue.

WordPress: Development Blog RSS2 Feed

WordPress 2.5

WordPress 2.5, the culmination of six months of work by the WordPress community, people just like you. The improvements in 2.5 are numerous, and almost entirely a result of your feedback: multi-file uploading, one-click plugin upgrades, built-in galleries, customizable dashboard, salted passwords and cookie encryption, media library, a WYSIWYG that doesn’t mess with your code, concurrent post editing protection, full-screen writing, and search that covers posts and pages.

For a short overview of the features with screenshots, it’d be best to visit our sneak peek announcement for RC1. Or check out a 4-minute screencast of the new interface in action. If you just want to jump straight to the good stuff here’s where you can find 2.5 upgrade and download information.

If you want to see everything I would grab a cup of coffee or a mojito, because this post is epic.

User Features

Cleaner, faster, less cluttered dashboard — we’ve worked hard to take your feedback about what’s most important in the dashboard and organize things to allow you to focus on what’s important — your blog — and get out of your way. In collaboration with Happy Cog and the community we’ve taken the first major step forward in the WordPress interface since version 1.5.

Dashboard Widgets — the dashboard home page is now a series of widgets, including ones to show you fun stats about your posting, latest comments, people linking to you, new and popular plugins, and of course WordPress news. You can customize any of the dashboard widgets to show, for example, news from your local paper instead of WP news. Plugins can also hook in, for example the WordPress.com stats widget adds a handy double-wide stats box.

Multi-file upload with progress bar — before when you would upload a large file you’d wait forever, never knowing how far along it was. And uploading more than one photo was an exercise in patience, as you could only do one at a time. Now you can select a whole of folder images or music or videos at once and it’ll show you the progress of each upload.

Bonus: EXIF extraction — if you upload JPEG files with EXIF metadata like camera make and model, aperture, shutter speed, ISO, et al. WordPress will extract all the data into custom fields you can use in your template. If you use the EXIF title fields or similar those will be put into their equivalent fields in WP. Most modern digital cameras generate EXIF data.

Search posts and pages — search used to cover just posts, now it includes pages too, a great boon for those using WordPress as a CMS. New themes can style or sort pages differently in results.

Tag management — you can now add, rename, delete, and do whatever else you like to tags from inside WordPress, no plugins needed.

Password strength meter — when you change your password on your profile it’ll tell you how strong your password is to help you pick a good one.

Concurrent editing protection — for those of you on multi-author blogs, have you ever opened a post while someone was already editing it, and your auto-saves kept overwriting each other, irrecoverably losing hours of work? I bet that added a few words to your vocabulary. Now if you open a post that someone else is editing, WordPress magically locks it and prevents you from saving until the other person is done. You’ll see a message like below.

Few-click plugin upgrades — if the plugins you use are part of the plugin directory since 2.3 we’ve told you when they have an update available. Now we take that to the next logical step — downloading and installing the upgrade for you. This is dependent a little bit on your host setup, and it may ask you for your FTP password much like OS X or Windows will ask you for a password, but it works well on majority of hosts we were able to test, your mileage may very, plugins in mirror may be larger than they appear.

Friendlier visual post editor — I’m not sure how to articulate this improvement except to say “it doesn’t mess with your code anymore.” We’re now using version 3.0 of TinyMCE, which means better compatibility with Safari, and we’ve paid particular attention this release to its integration and interaction with complex HTML. It also now has a “no-distractions” mode which is like Writeroom for your browser.

Built-in galleries — when you take advantage of multi-file upload to upload a bunch of photos, we have a new shortcode that lets you to easily embed galleries by just putting [ gallery] (without the space) in your post. It’ll display all your thumbnails and captions and each will link each to a page where people can comment on the individual photos. I’ve been using this feature on my blog and have already uploaded over 1,200 pictures into 23 galleries. The shortcode has some hidden options too, check out this documentation.

Developer Features

Now for the geeky stuff. While we’re excited about the above features, each one represents a new opportunity or API for other developers to take to another level. (The best of which we’ll someday integrate back into WP.)

Salted passwords — we now use the phpass library to stretch and salt all passwords stored in the database, which makes brute-forcing them impractical. If you use something like mod_auth_mysql we’ve created a plugin that will allow you to use legacy MD5 hashing. (The hashing is completely pluggable.) Users will automatically switch to the more secure passwords next time they log in.

Secure cookies — cookies are now encrypted based on the protocol described in this PDF paper. which is something like user name|expiration time|HMAC( user name|expiration time, k) where k = HMAC(user name|expiration time, sk) and where sk is a secret key, which you can define in your config.

Easy taxonomy and URL creation — probably best illustrated with an example: I can call register_taxonomy() with a few arguments to register a “people” taxonomy and whenever I edit an image I’ll see a UI like tags has for identifying the people in a photo, and these will be URL addressable with /person/firstname-lastname/. All with a single function call.

Inline documentation — the vast majority of the new code going into WordPress include inline documentation that explains the functions and documents their arguments.

Database optimization — we haven’t changed the table layout in this release, which is one of the reasons so many plugins work fine with 2.5. We have added a few new indicies and made a few default fields more flexible based on some bottlenecks we found on WordPress.com, which now hosts 2.7 million WordPress blogs. It should be invisible to the application, just a bit faster on the database side.

$wpdb->prepare() — now almost all of the SQL in WordPress is prepared first, and the same functions are available to your plugins. This should prevent elementary SQL escaping issues.

Media buttons — the add media buttons above the post are both expandable, so you could have an “Add Google Map” button if you like, They can be overridden, so if you think you can do the video or audio tab better than we have you can replace the default.

Shortcode API — the new gallery functionality is powered by the new shortcode API. Shortcodes are little bracket-delineated strings that can be magically expanded at runtime to something more interesting. They give users a short, easy to type and copy/paste string they can move around their post without worrying about messing up complex HTML or embed codes. The Shortcode API is fully documented.

Now you see why 2.5 took a little extra time. )

Upgrade Notes

2.5 does include security fixes so it is recommended for all users, the 2.3 branch will no longer be updated. The upgrade instructions for this version are pretty much the same as any other version. The most important thing to check is your plugins, so if for example everything works except the new uploader, a legacy plugin might be causing a javascript error on the page and breaking it. If something goes wrong, the safest thing to do is turn your plugins off (we have a button to do them all at once, now) and turn them back on one-by-one, testing the problem along the way. This has solved almost everybody’s problems in testing, and it also lets you know which plugin author to show some love to so they’ll update their plugin, and which plugin authors already have so you can shower them with praises on your blog.

One brief note about some of the new upload and plugin upgrade features, there are some edge-case hosting platforms, like versions of Lighttpd before 1.5 or over-agressive mod_security rules, which can break. If something isn’t working like it was looked in the screenshot, ask your host if there’s something on the server side which may be interfering. Hosts, feel free to join and post to our wp-testers mailing list if you have an environment that requires some extra code to work around. We’d be happy to include it in the next update.

Quick tip: in 2.5 you click the name of things to edit them, like your username to edit your profile or the title of a post to edit it.

The Community is Growing

More than growing, it’s on fire. We always talk about things like downloads, and the 2.3 branch has already had 1.92 million downloads as I write this post, but this time we have some far more interesting information I’d like to share.

There were over 1,200 commits to our repository since 2.3.0 and over 90 people were credited in them. This means in our core code, not plugins, there were at least 90 individual folks that contributed something high-quality enough that it made the cut to be part of the download you guys get today. I had no idea this group of people was so large.

Outside of the core commit team, there was particular help from these people, in rough order of number of credits and tickets: mdawaffe (Michael Adams), azaozz (Andrew Ozz), nbachiyski (Nikolay Bachiyski), andy (Andy Skelton), iammattthomas (Matt Thomas), tellyworth (Alex Shiels), josephscott (Joseph Scott), lloydbudd (Lloyd Budd), DD32 (Dion), filosofo (Austin Matzko), hansengel (Hans Engel), pishmishy, ffemtcj, Viper007Bond, ionfish (Benedict Eastaugh), jhodgdon (Jennifer Hodgdon), Otto42, thee17 (Charles E. Free-Melvin), and xknown. Also want to thank MichaelH and Lorelle on the documentation side, and moshu, Kafkaesqui, whooami, MichaelH, Otto42, and jeremyclark13 for helping with support.

The 2.5 branch is nicknamed “Brecker” in honor of Michael Brecker, an exceptionally talented saxophonist who could cross styles effortlessly and never stopped experimenting and pushing himself until he passed away last year.

New WordPress.org

All of this wasn’t enough, so in our copious spare time we decided to redesign WordPress.org to better match the aesthetics of the new dashboard and also to spruce up a few areas that needed lovin’. Some parts of the site, like the Codex, might show the old style for a day or two. We know, just give us a bit of time. Thanks to Matt Thomas for his epic effort in designing and coding the new site.

What’s Next

As always with WordPress, we don’t claim any of these features to be perfect, or to be better than everyone else in the world, but they are done by and for the people and the one thing we do promise is that with every release we listen and do our best to improve.

2.5 is a major milestone for WordPress not because it added dozens of user-requested features, but because it reaffirms that we’re as passionate about blogging as the day we started. Our community is too fierce to rest on its laurels — contrary to what pundits claim, blogging is far from “finished” and every improvement just whets our appetite for more. And more is coming.

It’s a good thing WordPress doesn’t limit the length of posts, because this one would have hit it. If you made it this far, thanks for sharing a bit of your day with us. I sincerely hope this new version of WordPress helps you do what you love to do.

WordPress: Development Blog RSS2 Feed

WordPress 2.3.2

WordPress 2.3.2 is an urgent security release that fixes a bug that can be used to expose your draft posts. 2.3.2 also suppresses some error messages that can give away information about your database table structure and limits and stops some information leaks in the XML-RPC and APP implementations. Get 2.3.2 now to protect your blog from these disclosures.

As a little bonus, 2.3.2 allows you to define a custom DB error page. Place your custom template at wp-content/db-error.php. If WP has a problem connecting to your database, this page will displayed rather than the default error message.

For more detail on what’s new in 2.3.2, view the list of fixed bugs and see the changes between 2.3.1 and 2.3.2.

Special thanks to Alex Concha for his help on this release.

WordPress: Development Blog RSS2 Feed

WordPress 2.3.1

WordPress 2.3.1 is now available. 2.3.1 is a bug-fix and security release for the 2.3 series.

2.3.1 fixes over twenty bugs. Some of the notable fixes are:

  • Tagging support for Windows Live Writer
  • Fixes for a login bug that affected those with a Blog Address different than
    their WordPress Address
  • Faster taxonomy database queries, especially tag intersection queries
  • Link importer fixes

Unfortunately, some security issues were found in 2.3. Janek Vind found an XSS problem that can be exploited if your php setup has register_globals enabled. For this reason, upgrading to 2.3.1 is advised.

The full set of changes between 2.3 and 2.3.1 is available for viewing on trac.

Get 2.3.1 from the download page and enjoy.

WordPress: Development Blog RSS2 Feed

WordPress 2.3.1 Release Candidate 1

WordPress 2.3.1 is almost ready to go. Before we send it out the door, we’re making a release candidate available so everyone can give it a last look.

2.3.1 fixes over twenty bugs. Some of the notable fixes are:

  • Tagging support for Windows Live Writer
  • A login bug that affected those with a Blog Address different than
    their WordPress Address is fixed
  • Faster taxonomy database queries, especially tag intersection queries
  • Link importer fixes

More details will be provided in the final release announcement. Until then, download RC1 and let us know if it fixes a particular bug in 2.3 that was annoying you. If you find that something has broken since 2.3, please open a ticket so we can address the problem before the final 2.3.1 release.

WordPress: Development Blog RSS2 Feed

WordPress 2.3

I’m thrilled to announce that Version 2.3 “Dexter” of WordPress is now ready for the world. This release includes native tagging support, plugin update notification, URL handling improvements, and much more. This release is named for the great tenor saxophonist Dexter Gordon.

The entire team is really proud of this release, and I’m happy that this is our second on-time release under our new development schedule. The grand experiment of a more agile WordPress with significant features in the hands of users more often is working. I could write a blog post about each new feature, but I’ll try to be brief:

  1. Native tagging support allows you to use tags in addition to categories on your posts, if you so choose. We’ve included importers for the Ultimate Tag Warrior, Jerome’s Keywords, Simple Tags, and Bunny’s Technorati Tag plugins so if you’ve already been using a tagging plugin you can bring your data into the new system. The tagging system is also wicked-fast, so your host won’t mind.
  2. Our new update notification lets you know when there is a new release of WordPress or when any of the plugins you use has an update available. It works by sending your blog URL, plugins, and version information to our new api.wordpress.org service which then compares it to the plugin database and tells you whats the latest and greatest you can use.
  3. We’ve cleaned up URLs a bunch in a feature we call canonical URLs which does things like enforce your no-www preference, redirect posts with changed slugs so a link never goes bad, redirect URLs that get cut off in emails on similar to the correct post, and much more. This helps your users, and it also helps your search engine optimization, as search engines like for each page to be available in one canonical location. More info here.
  4. Our new pending review feature will be great for multi-author blogs. It allows authors to submit a post for review by an editor or administrator, where before they would just have to save a draft and hope someone noticed it.
  5. There is new advanced WYSIWYG functionality (we call it the kitchen sink button) that allows you to access some features of TinyMCE that were previously hidden.

You’ll notice that two of those features are straight out of the most-voted for ideas list. That’s just the user facing stuff, if you’re a developer you’ll be interested in:

  1. Full and complete Atom 1.0 support, including the publishing protocol.
  2. We’re using the new jQuery which is “800% faster.”
  3. Behind the user-facing tags system is a really kickass taxonomy system, which adds a ton of flexibility. It’s probably the biggest schema upgrade since version 1.5.
  4. The importers have been revamped to be more memory efficient, and you can now add an importer through a plugin.
  5. Through hooks and filters you can now override the update system, the dashboard RSS feeds, the feed parser, and tons more than you could in 2.2.
  6. The new $wpdb->prepare() way of doing SQL queries.
  7. Finally there were over 351 tickets in Trac closed for this release, with over a hundred people contributing. This is the polish, the hundreds of tiny bug fixes and features that make WordPress what it is.

You can view the Codex for more information about the release and some screenshots. And of course the place to download is always the same. Before you upgrade you may want to check out our Preparing for 2.3 post and the list of compatible plugins on the Codex.

A number of people are hosting upgrade parties around the world, including myself in San Francisco. If you are let me know and I’ll promote it on my blog.

WordPress: Development Blog RSS2 Feed

WordPress 2.3 Release Candidate 1

The first release candidate for WordPress 2.3 is now available. We’ve spent the week since beta 3 fixing bugs and shaping RC1 into release candidate material. If you would like try RC1 and help us get 2.3 ready for its final release on Monday the 24th, download RC1 here and report any bugs you find. Although we consider this release candidate to be stable, keep in mind that this is still pre-release software. You may find some lingering bugs. Please back up your database before upgrading. If you have problems with RC1, you will not be able to revert back to your previous release without a database backup.

And a big thanks to those of you who have been testing the betas and now the RC. Your efforts make 2.3 better for everyone.

WordPress: Development Blog RSS2 Feed

WordPress 2.3 Beta 3

Beta 3, the third and final beta for WordPress 2.3, is now available. Many bugs have been fixed since the second beta, and we could use your help finding and fixing more bugs in preparation for the first Release Candidate due next Monday. The standard disclaimer for betas applies. Beta 3 is pre-release software that is still being tested. If you would like try out Beta 3 and help report bugs, join the wp-testers mailing list and download beta 3 here.

WordPress: Development Blog RSS2 Feed

WordPress 2.2.3

2.2.3 is a security and bug-fix release for the 2.2 series. Since this is a security release, we suggest you upgrade immediately. Two of the fixes are high priority.

On our Trac you can see the bugs closed and the files changed for 2.2.3.

To get 2.2.3, please see our download page.

As always, upgrade instructions including an extended upgrade guide are available.

Thanks to Alexendar Concha, Aaron Newman, and xknown for identifying and helping us fix the security vulnerabilities.

WordPress: Development Blog RSS2 Feed

WordPress 2.2.2 and 2.0.11

Today we have two security-related releases available for both users of our main 2.2 branch and the legacy 2.0 branch. As these releases include only security and minor bugfixes they should not cause any plugin or theme compatibility issues, so you have no good excuse not to upgrade.

On our Trac you can see the bugs closed for 2.2.2 and 2.0.11 to get more details about the problems fixed. With a little more Trac magic you can see all the changed files for 2.2.2 or 2.0.11.

Our download page is always the best place to get the latest release, and our legacy page now has the latest in the 2.0 branch.

As always, we have upgrade instructions available and an extended upgrade guide.

Thanks to Alex C. and Benjamin Flesch for help with this release.

WordPress: Development Blog RSS2 Feed

WordPress 2.1.3 and 2.0.10

We have a security update release now available for both the 2.1 and 2.0 branches of WordPress now available for immediate download. This update is highly recommend for all users of both branches.

These releases include fixes for several publicly known minor XSS issues, one major XML-RPC issue, and a proactive full sweep of the WordPress codebase to protect against future problems. Many thanks to Sumit Siddharth and Alex Concha for their help with reporting issues in this release.

As an update to the systems issue we had last month, we have taken dozens of additional precautions with the servers and systems that run WordPress.org and they appear to be working well, despite hundreds of hack attempts after we publicly disclosed there had been a problem. We are also now aggressively monitoring all downloads for any changes or modifications, and we are confident the same type of problem won’t happen again.

WordPress: Development Blog RSS2 Feed

WordPress 2.2.1

WordPress 2.2.1 is now available. 2.2.1 is a bug fix release for the 2.2 series. Since 2.2 was released a month ago, the WordPress community has been improving fit-and-finish by identifying and fixing those little bugs that can be so annoying and by fine-tuning some small details. The result is a nicely polished 2.2.1 release. The full list of bugs fixed in 2.2.1 is available here. Here are some highlights.

Unfortunately, 2.2.1 is not just a bug fix release. Some security issues came to light during 2.2.1 development, making 2.2.1 a required upgrade. 2.2.1 addresses the following vulnerabilities:

Special thanks to Alexander Concha for his continued assistance in making WordPress more secure. Special thanks also to Daniel Jalkut of Red Sweater Software for his improvements to our XML-RPC implementation.

WordPress: Development Blog RSS2 Feed

WordPress 2.2

On behalf of the entire WordPress team, I’m proud and excited to announce the immediate availability of version 2.2 “Getz” for download. This version includes a number of new features, most notably Widgets integration, and over two hundred bug fixes. It’s named in honor of tenor saxophonist Stan Getz.

Goodies:

  • WordPress Widgets allow you to easily rearrange and customize areas of your weblog (usually sidebars) with drag-and-drop simplicity. This functionality was originally available as a plugin Widgets are now included by default in the core code, significantly cleaned up, and enabled for the default themes.
  • Full Atom support, including updating our Atom feeds to use the 1.0 standard spec and including an implementation of the Atom Publishing API to complement our XML-RPC interface.
  • A new Blogger importer that is able to handle the latest version of Google’s Blogger product and seamlessly import posts and comments without any user interaction beyond entering your login.
  • Infinite comment stream, meaning that on your Edit Comments page when you delete or spam a comment using the AJAX links under each comment it will bring in another comment in the background so you always have 20 items on the page. (I know it sounds geeky, but try it!)
  • We now protect you from activating a plugin or editing a file that will break your blog.
  • Core plugin and filter speed optimizations should make everything feel a bit more snappy and lighter on your server.
  • We’ve added a hook for WYSIWYG support in a future version of Safari.

In addition there were also dozens of UI and accessibility improvements, ranging from more concise wording around options and links to things like a view and preview link above the content box when you’re editing a post or page, as well as several important security fixes. We don’t plan to continue to support the 2.1 branch, so this is a required upgrade.

Developer Features:

We also improved a great deal under the hood that hopefully you’ll never notice, but if you’re a developer for the WP platform it provides a lot to sink your teeth into. Here is a sampling:

  • A new set of WordPress-specific XML-RPC APIs that allow for editing pages, setting categories, and much more.
  • We now use jQuery for a number of internal functions, and hope to transition all of our JS to use it. (We still need volunteers for this.)
  • Comment feeds now support multiple formats, including Atom.
  • Our internal mail functions now use phpMailer, which allows for things like SMTP support.
  • You can now set database collation and character set in your config file.
  • You can also hardcode your site and WP URL in the config file, overriding the values in the DB.
  • Finally we’ve increased the inline documentation of a number of functions inside of WP, which should help you navigate those parts of the code.

If you’d like an in-depth look at everything that changed, here is a list of all 244 closed tickets in our bug tracker and you can use this link to see what files and lines of code changed. (It was a lot!)

New Development Cycle

Most interesting about this release is that is our first under the new, experimental development cycle that we first talked about when we released version 2.1 fewer than 4 months ago. We delayed a few weeks from our target date in April, but ended up under our original goal of a 4 month major release cycle. My thanks and congratulations to the entire WordPress community for pulling together and making that happen. It wasn’t without its bumps, but the things we learned along the way will make our next release in September even better. You can now look forward to a fast but stable schedule of new features and goodies several times a year from WordPress.

Around the Community

There were 1.4 million downloads of WordPress 2.1 in the four months it was available.

I wrote a post that covers some of the media that WP has been getting lately and its history.

We’ve expanded WordPress.org quite a bit, most notably the very active plugins directory and the ideas forum.

Come meet other WordPress users and developers at WordCamp, which is going to be taking place July 21-22 in San Francisco.

Don’t forget to check out WordPress’ cousins MU and bbPress, both of which have been seeing some pretty cool development lately.

Help Out

The most valuable thing you can give back to WordPress is your time — the time to help a friend discover the joy of blogging, the time to help a stranger (a friend you haven’t met yet) on the support forums, or the time to help make WordPress a better product.

WordPress: Development Blog RSS2 Feed

WordPress 2.1.1 dangerous, Upgrade to 2.1.2

Long story short: If you downloaded WordPress 2.1.1 within the past 3-4 days, your files may include a security exploit that was added by a cracker, and you should upgrade all of your files to 2.1.2 immediately.

Longer explanation: This morning we received a note to our security mailing address about unusual and highly exploitable code in WordPress. The issue was investigated, and it appeared that the 2.1.1 download had been modified from its original code. We took the website down immediately to investigate what happened.

(more…)

WordPress: Development Blog RSS2 Feed

WordPress 2.1 “Ella”

On behalf of the WordPress.org community of commiters, contributers, and volunteers, I’m very proud to announce the immediate availability of WordPress 2.1 “Ella”, named for jazz vocalist Ella Fitzgerald. Here’s a sampling of what’s in the new version:

  • Autosave makes sure you never lose a post again.
  • Our new tabbed editor allows you to switch between WYSIWYG and code editing instantly while writing a post.
  • The lossless XML import and export makes it easy for you to move your content between WordPress blogs.
  • Our completely redone visual editor also now includes spell checking.
  • New search engine privacy option allows you take you to indicate your blog shouldn’t ping or be indexed by search engines like Google.
  • You can set any “page” to be the front page of your site, and put the latest posts somewhere else, making it much easier to use WordPress as a content management system.
  • Much more efficient database code, faster than previous versions. Domas Mituzas from MySQL went over all our queries with a fine-toothed comb.
  • Links in your blogroll now support sub-categories and you can add categories on the fly.
  • Redesigned login screen from the Shuttle project.
  • More AJAX to make custom fields, moderation, deletions, and more all faster. My favorite is the comments page, which new lets you approve or unapprove things instantly.
  • Pages can now be drafts, or private.
  • Our admin has been refreshed to load faster and be more visually consistent.
  • The dashboard now instantly and brings RSS feeds asynchronously in the background.
  • Comment feeds now include all the comments, not just the last 10.
  • Better internationalization and support for right-to-left languages.
  • The upload manager lets you easily manage all your uploads pictures, video, and audio.
  • A new version of the Akismet plugin is bundled.

…and much, much more. There are little easter eggs hidden everywhere, so the best way to find everything new is to just try it out.

Developer Features

Developers will especially love this release, as it has much cleaner code than 2.0 and includes hundreds of enhancements that will enable a new generation of richer plugins. Here’s a taste of some of the things included:

  • Psuedo-cron functionality let’s you schedule events much like cron.
  • Users admin can now comfortably handle hundreds of thousands of users.
  • The new WP_Error class cleans up how we do error reporting and handling.
  • The javascript loader makes it easier for plugins to include rich functionality.
  • Tons of new hooks and APIs.
  • We’ve started to fill out our code inline documentation.
  • Image and thumbnail API allows for richer media plugins.
  • Custom header, color picker, and image cropping framework.

2.1 also includes over 550 bug fixes.

The Future

What’s really exciting for me is what’s coming in the future. First of all, the 2.0 series was an unparalleled success, with over 1.8 million downloads, and thanks to the work of Mark Jaquith we’re committing to maintaining stable security and bug fixes on the 2.0 branch until 2010.

More exciting for most of our users, though, is our new development cycle. Based on everything we’ve learned in the past 3 years of doing WordPress, we’ve decided to shift to a more frequent release schedule like Ubuntu, with major releases coming several times a year. So, for the first time in WordPress’ history, I have an answer to when the next version is coming out: April 23rd.

Even better, the development will be driven primarily by the features you guys are voting for on the ideas board. (But wait, there’s more: the ideas board now has a new Hot-or-Not-like interface for rating a bunch of ideas at once, so go get your vote on and have a say in WordPress 2.2.)

WordPress: Development Blog RSS2 Feed

WordPress 2.0.7

Recently a bug in certain versions of PHP came to our attention that could cause a security vulnerability in your blog. We’re able to work around it fairly easily, so we’ve decided to release 2.0.7 to fix the PHP security problem and the Feedburner issue that was in 2.0.6. It is recommended that everyone running WordPress 2.0.6 or lower upgrade to this new version.

Because this is a much smaller update than previous versions, you do not have to update all of WordPress’ files if you’re upgrading from version 2.0.6. Here is the list of files that have changed since 2.0.6:

  • wp-admin/inline-uploading.php
  • wp-admin/post.php
  • wp-includes/classes.php
  • wp-includes/functions.php
  • wp-settings.php
  • wp-includes/version.php

We know it sucks to have a release only 10 days after our last one, but we think it’s important enough for your blog to be secure to do it, and hopefully only having to change a few files will make the upgrade easier than normal.

Here are the changes that have been made since 2.0.6:

  • Security fix for wp_unregister_GLOBALS() to work around the zend_hash_del_key_or_index bug in PHP 4 versions less than 4.4.3 and PHP 5 versions less than 5.1.4 with register_globals set to “On.”
  • Feeds now properly serve 304 Not Modified headers instead of mismatched 200/304 headers (a.k.a. the FeedBurner bug).
  • Backport of another 304 Not Modified fix from WordPress 2.1
  • Deleting WordPress Pages no longer gives an “Are You Sure?” prompt.
  • After deleting a WordPress Page, you are now properly redirected to the Edit Pages screen.
  • Sending an image at original size in Internet Explorer no longer adds an incorrect “height” attribute.

And just as a reminder, the next major version of WordPress (2.1) is due out by the end of the month, but the 2.0 branch of WordPress will continue to be maintained for several years.

WordPress: Development Blog RSS2 Feed

WordPress 2.0.6

We have a pretty important release available for everyone, it includes an important security fix and it’s recommended that everyone upgrade. This is the latest release in our stable 2.0 line, which we’ve committed to maintaining for several more years.

Here’s what’s new:

  • The aforementioned security fixes.
  • HTML quicktags now work in Safari browsers.
  • Comments are filtered to prevent them from messing up your blog layout.
  • Compatibility with PHP/FastCGI setups.

For developers, there’s a new anti-XSS function called attribute_escape(), and a new filter called “query” which allows you filter any SQL at runtime. (Which is pretty powerful.) Thanks to Mark Jaquith for handling this release and Stefan Esser for responsibly reporting the security issue.

As always, you can download the latest version of WordPress here.

As a side note, this is probably our last release before 2.1 is out, which will be our first major feature release in quite a while. 2.1 just entered beta stage, so if you’re interested in helping out with that process consider joining our beta group. As a reminder, if you’re a plugin or theme author you should check your code to make sure it’s compatible with 2.1 before the release.

WordPress: Development Blog RSS2 Feed

WordPress 2.0.5 - Ronan

It’s new release time. The latest in our venerable 2.0 series, which now counts over 1.2 million downloads, is available for download immediately, and we suggest everyone upgrade as this includes security fixes. We’re breaking the tradition of naming releases after jazz musicians to congratulate Ryan Boren on his new son (and first WP baby) Ronan.

What’s new? We have about 50 or so bugfixes, which you can review on our dev tracker here, mostly minor bug fixes around feeds, custom fields, and internationalization. If you’d like a nitty-gritty view, check out Mark’s blog post on the changes.

Like every release this was the result of a lot of people in the WordPress community, and I’d like to thank all our contributors and testers including Mustlive, Peter Westwood, and Robert Deaton. This is also the first release handled by our new 2.0 maintainer, Mark Jaquith. He joins myself and Ryan with commit access and is “committed” to keeping the 2.0 base stable as we head into the exciting new 2.1 world. Congrats to Mark

WordPress: Development Blog RSS2 Feed

MU 1.0 and bbPress

The WordPress family has been really starting to grow lately. I wanted to let you guys know about two big releases: WordPress Multi-user 1.0 and bbPress 0.72.

WordPress MU is an official branch of WordPress that is designed for managing and hosting thousands of blogs instead of just one. It’s the software that powers WordPress.com, for example. MU has been in heavy development for about a year now, and we’ve finally polished it up to a place where we feel like it’s ready for public consumption. Since setup is a bit more complex than the 5-minute install of regular WordPress, MU is best suited for a more server-savvy audience. You can download it on the WordPress MU site.

Second I wanted to introduce an old friend you are all probably familiar with from our support forums, bbPress. bbPress is forum software with the WordPress touch, and developed by the same folks. It has some pretty cool features, such as tagging, RSS feeds, Akismet spam protection, AJAX interaction, but the team focused the most on creating something fast and light. bbPress can power a forum with hundreds of thousands of posts with just a fraction of the load as WordPress. (If we could re-write WP from scratch, it would be a lot like bbPress.) What is probably most compelling for WordPress users, though, is that bbPress supports complete user and login integration with WP.

bbPress is not quite 1.0 yet, some of you may recognize the 0.72 version number from the early days of WordPress, but if you’re searching for a little something fresh in forum software, try downloading bbPress and giving it a go.

WordPress: Development Blog RSS2 Feed

WordPress 2.0.4

WordPress 2.0.4, the latest stable release in our Duke series, is available for immediate download. This release contains several important security fixes, so it’s highly recommended for all users. We’ve also rolled in a number of bug fixes (over 50!), so it’s a pretty solid release across the board.

Upgrading is fairly simple, just overwrite your old files with the latest from the download. If you’d like more thorough instructions, the Codex is always the best spot.

Since this is a security release, if you have any friends with blogs make sure to remind them to upgrade and lend a hand if they’re not too savvy. We’re all in this together.

Thanks to Geoff and Mark Jaquith for identifying.

WordPress: Development Blog RSS2 Feed

WordPattern (April Fools!)

On behalf of the WordPress community, I’m proud to announce a merger we’ve had on our minds since the first time we saw Dean Allen’s dog — WordPress and Textpattern are joining forces to create the greatest CMSMS ever, WordPattern. “WordPress and Textpattern: Two great tastes that taste great together.”

As with any great union, there were compromises involved. “I’m going all-Georgia, all the time. And blue is the new yellow.” said Dean Allen. Matt Mullenweg mused “Ten custom fields should be enough for anybody!”

We have a list of new features, downloads, and much more available on WordPattern.org. Our respective websites are being decommisioned so it’s best to go there for new information.

WordPress: Development Blog RSS2 Feed

2.0.2 Security Release

An important security issue has been brought to the attention of the WordPress team and we have worked diligently to bring you a new stable release that addresses it. Our latest version 2.0.2 contains several bugfixes and security fixes.

The problems addressed are unannounced XSS issues privately discovered and reported to the WordPress team. Thanks to Michael Boman, Mark Jaquith, Robert Deaton, and David House for assisting with this release.

Just a quick note: this is different than the snake-oil reports that went out on some security lists a few days ago. There were a couple, but they were either not actual security problems, too small to warrant a release, or just patently false. Remember: just because you read it on a mailing list doesn’t mean that it’s true. We’d be the first people to panic if there was an actual problem.

As always, when something serious crosses our desks we jump on it and get a well-tested release out as soon as possible.

WordPress: Development Blog RSS2 Feed

2.0.1 Release

It’s been exactly one month since we released the well-received WordPress 2.0 release. In the past 4 weeks we’ve been listening closely to feedback, squashing bugs wherever we find them, and watching how 2.0 handled under different loads.

We’ve rolled up all the most important fixes into a 2.0.1 release, which is now available for download.
All in all we’ve closed 114 bugs in the 2.0.1 release, which you’re welcome to check out if you’re curious about every fix. To summarize:

  • You can now specify an upload directory, and whether to use date-based storage or not.
  • Caching has been fixed under certain PHP enviroments.
  • Permalinks have been fixed for weird enviroments as well.
  • XML-RPC uploading works.
  • Compatibility with older versions of PHP.
  • Several WYSIWYG fixes and cleanups.
  • Imports now use much less memory.
  • Now works with MySQL 5.0 in strict mode.

Happy blogging!

WordPress: Development Blog RSS2 Feed

WordPress 2

The WordPress community is very proud to present the next generation of WordPress to the world, our 2.0 “Duke” release, named in honor of jazz pianist and composer Duke Ellington. We’ve been working long and hard to bring you this release, and I hope you enjoy using it as much as we’e enjoyed working on it. In this release we’ve focused a tremendous amount on what we believe to be the core of blogging — the writing interface. Before you upgrade from an earlier version, remember that this is a major release and thousands of lines of code have changed. Before upgrading it’s always good, just in case, to make a backup of your database and WordPress files. It only takes a few minutes and gives you a total safety net if for whatever reason things don’t work. It is also probably a good idea to turn off your plugins, and activate them one-by-one after you’ve upgraded. Without further ado, you can download WordPress 2 right now. Read on for more information about what we think you’ll love about Duke.

(more̷ ;)

WordPress: Development Blog RSS2 Feed

2.0 Release Candidate

The next release of WordPress is drawing near. Please help us shake out any last remaining bugs by downloading and testing the 2.0 Release Candidate. If all goes well, the Release Candidate will become 2.0 final. We’re almost there. Download, test, and head over to the Beta Forum to let us know if the Release Candidate is ready for prime time. Downloads taken down. Go get the real thing!

WordPress: Development Blog RSS2 Feed