✨ We built WP Composer — an independent, open source Composer repository for WordPress plugins and themes, with 17x faster cold resolves than WPackagist
wp-composer.com
Cooldown now works for WordPress plugins and themes too! WP Packages records when it first serves each version, and resets the clock if a release is changed after the fact on WordPress.org
roots.io/wp-packages-no…
PHP now recommends keeping session upload progress disabled until the next PHP release (CVE-2026-115560):
Trellis v1.32.2 makes this the default
roots.io/php2shell-patc…
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are out with fixes for two critical RCE vulnerabilities.
Trellis v1.32.1 switches PHP to packages.sury.org, which had the patched builds first. Here's how to upgrade, or apply just the PHP change:
discourse.roots.io/t/upgrading-ph…
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are out with fixes for two critical RCE vulnerabilities.
Trellis v1.32.1 switches PHP to packages.sury.org, which had the patched builds first. Here's how to upgrade, or apply just the PHP change:
discourse.roots.io/t/upgrading-ph…