roots.io

Advanced tools for professional WordPress developers 🔧 by @retlehs

[roots.io @rootswp]

✨ We built WP Composer — an independent, open source Composer repository for WordPress plugins and themes, with 17x faster cold resolves than WPackagist

https://t.co/FbNpebs9me

[Jordi Boggiano @seldaek]

Composer 2.10 is out.

Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.

#php #phpc #composerphp

[roots.io @rootswp]

@zaherg This is for Bedrock/Composer setups — core's pinned in 𝚌𝚘𝚖𝚙𝚘𝚜𝚎𝚛.𝚓𝚜𝚘𝚗 so it's part of what you deploy from your git repo. Run 𝚠𝚙 𝚌𝚘𝚛𝚎 𝚞𝚙𝚍𝚊𝚝𝚎 and that change never makes it into your next deploy.

[roots.io @rootswp]

WordPress 7.0 RC4 just dropped:

𝚌𝚘𝚖𝚙𝚘𝚜𝚎𝚛 𝚛𝚎𝚚𝚞𝚒𝚛𝚎 𝚛𝚘𝚘𝚝𝚜/𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜-𝚏𝚞𝚕𝚕:𝟽.𝟶-𝚁𝙲𝟺

https://t.co/bBpVLbTKtW

[roots.io @rootswp]

For folks using the 𝚛𝚘𝚘𝚝𝚜/𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜 package, you can swap to 𝚛𝚘𝚘𝚝𝚜/𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜-𝚏𝚞𝚕𝚕 to test the latest 7.0 RC:

[Packagist @packagist]

🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages.
Update now (composer self-update) or disable affected Actions workflows.
#composerphp #phpc #php

[Ben Word @retlehs]

Spin up a @rootswp Bedrock site in your browser 🌐

Powered by php-wasm, ghostty-web, Astro on Cloudflare Workers

(Extremely alpha phase & still in a private repo. Got a decent roadmap but time is tight atm - it'll eventually support Acorn and Sage)

https://t.co/04k3UjlKXl

[roots.io @rootswp]

More info on the blog: https://t.co/hrOIyqbaVQ

[roots.io @rootswp]

An early warning system for WordPress plugin security issues: WP Packages now tracks vendor mass closures publicly

RSS feed and APIs also available for mass closures 🔔

https://t.co/jxUw3OLCID

[roots.io @rootswp]

For folks using the 𝚛𝚘𝚘𝚝𝚜/𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜 package, you can swap to 𝚛𝚘𝚘𝚝𝚜/𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜-𝚏𝚞𝚕𝚕 to test the latest 7.0 RC:

[WordPress @WordPress]

WordPress 7.0 Release Candidate 3 is available for testing. The final release is scheduled for May 20, 2026. Test it now and report any issues before launch. https://t.co/cXmvePDV17

[Ben Word @retlehs]

PSA for Acorn users: skip transients, reach for Laravel Cache — https://t.co/bEnx8SHG1n

Just caught Claude Code reaching for a transient & updated Radicle's PHP style guide to be more explicit about this. Official 𝚂𝙺𝙸𝙻𝙻𝚂.𝚖𝚍 files for our major projects coming soon!

[roots.io @rootswp]

Automatic self-signed trusted certs for Lima VMs have landed in the latest version of Trellis CLI ✨

𝚝𝚛𝚎𝚕𝚕𝚒𝚜 𝚟𝚖 𝚝𝚛𝚞𝚜𝚝

Exports the cert and key out of the VM, trusts the cert in the macOS keychain and Firefox profiles

𝚋𝚛𝚎𝚠 𝚞𝚙𝚐𝚛𝚊𝚍𝚎 𝚝𝚛𝚎𝚕𝚕𝚒𝚜-𝚌𝚕𝚒

[roots.io @rootswp]

🙈 @WooCommerce assumes your wp-content directory is "wp-content" and uses site_url() instead of home_url() in some areas

PR submitted for one the bugs: https://t.co/EJ6IFjNbfg

Reported the other issues: https://t.co/46cX8uVKN7

[roots.io @rootswp]

3 ways WordPress plugins break non-standard installs:

- Hardcoded wp-content paths
- Direct wp-load.php includes
- Assuming WP lives at the root

https://t.co/oWWODU6MWU

[Ben Word @retlehs]

Using ACF made sense in 2019 but it doesn't mesh with modern WordPress development. I just inherited a site that heavily uses ACF and it's a complete mess.

- Use 𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜⁠/⁠𝚋𝚞𝚒𝚕𝚍 with 𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜⁠/⁠𝚌𝚘𝚖𝚙𝚘𝚗𝚎𝚗𝚝𝚜 for modern WordPress settings (𝚋𝚞𝚒𝚕𝚍 is the successor to 𝚜𝚌𝚛𝚒𝚙𝚝𝚜, been using it all week and it's great — no more webpack)

- Native blocks are more powerful with a better, modern UX. You can use dynamic server rendered blocks where it makes sense, and WordPress 7.0's PHP block registration can replace most ACF blocks

- Use the Block Locking API so clients can't break the layouts you build

- Use extended-cpts for CPT/taxonomy management

ACF repeaters and flexible layouts aren't the way. InnerBlocks + nested native blocks do this with a better UX.

Build some boilerplates using 𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜⁠/⁠𝚌𝚘𝚖𝚙𝚘𝚗𝚎𝚗𝚝𝚜 for settings pages (ACF settings pages look out of place compared to this), native blocks, etc. and let agents use them to produce better interfaces quickly

I've been doing this for years on hybrid themes and haven't looked back (not using FSE, it's not the right setup for the designs I work on)

"But ACF is faster" — not anymore. Agents close the gap, and reviewing their diffs helps you see what modern WP actually looks like.

[roots.io @rootswp]

New utility package from @TomBroucke that provides a fluent interface for adding WordPress action and filter hooks 😍

https://t.co/S4Xp40DNcI

[roots.io @rootswp]

What's actually in the WooCommerce telemetry payload and four ways to turn it off — your store's revenue numbers are in there, sent weekly to a third party:

https://t.co/Z4f0QjNq7q

[roots.io @rootswp]

@megane9988 Nice write up! We’re all about the hybrid approach, too. PHP themes aren’t dead 👍 (https://t.co/VKnPq4ZUuE)

[roots.io @rootswp]

@se_nadir I'd want it for my own projects too. Biggest reason we haven't shipped telemetry in ours is the blowback OSS projects get whenever they add it. The GH CLI telemetry rollout happening right now is a case in point (https://t.co/aZxYrwJ2Bx)

[roots.io @rootswp]

What's actually in the WooCommerce telemetry payload and four ways to turn it off — your store's revenue numbers are in there, sent weekly to a third party:

https://t.co/Z4f0QjNq7q

[Sybre Waaijer @SybreWaaijer]

Fun fact: WooCommerce collects your sensitive information without asking for consent.

Luckily, it merely consists of about 1000 data points.

Let's dive into it... 🧵

Disclosure: I'm a WooCommerce Marketplace partner.

[roots.io @rootswp]

@se_nadir From the store owner's perspective, anything leaving their server to a remote domain they don't control is effectively third-party.

[roots.io @rootswp]

🚨 WooCommerce Subscriptions has been silently breaking renewals since 2017. This is a must-read if you use the plugin.

@SybreWaaijer found $43k in lost revenue
@adampreiser estimates $100k lost on one of his smallest stores

Check the thread for queries to run on your own site

[Sybre Waaijer @SybreWaaijer]

100,000+ stores run this WooCommerce plugin. I doubt any of them know their payments are broken. Any store with $1M ARR could be missing $700k+ in revenue. If you run WooCommerce Subscriptions, check your store.

Yesterday, I reported a bug to WooCommerce that silently broke subscription payments after a product switch. Then I got worried: if they missed something this obvious, what else did they get wrong? So I started auditing. Within hours, I had found three more bugs. There were 121 affected subscriptions, and $43,274 in lost revenue.

Here's what I found.

WooCommerce Subscriptions has an internal flag that controls whether a subscription charges the customer automatically or waits for them to pay manually. When a customer checks out with (for example) Stripe or PayPal, this flag should be set to "automatic." If it isn't, subscription renewals silently stop working: no charge is attempted, no failure email is sent, and the subscription goes on hold until the customer notices and pays manually, or doesn't and churns.

Bug 1 (stale cache): After saving subscription dates, the order cache was never cleared. Subsequent saves could serve a stale object with the flag still set to its default: manual. Fixed in subscriptions-core 6.9.0.

Bug 2 (broken HPOS backfill): Missing getter/setter methods prevented subscription metadata from being properly synced to postmeta in HPOS when data sync is enabled. Fixed in subscriptions-core 6.5.0.

Bug 3 (unnecessary re-fetch): wcs_create_subscription() returned a freshly fetched instance from cache/DB instead of the already-configured object. Any unsaved state, including the corrected flag, was silently discarded. Fixed in subscriptions-core 7.1.0.

These three combined accounted for roughly 7% of all subscriptions created at checkout that were silently born broken, despite the customer paying successfully. For 7+ years (we have data from 2017–2024). Automatic payments NEVER fired for these subscriptions. Users never got renewal emails, either. The only way to know they were broken was if the customer noticed they lost access and contacted support, or if the merchant audited their database manually.

Bug 4 (switch): When a customer upgrades or downgrades their subscription, the switcher flags the subscription as manual renewal; it only corrects the flag if the payment gateway changes. A customer switching plans while keeping the same gateway (e.g. Stripe to Stripe) cements the flag stuck on manual. I discovered this two days ago, when I found a happy customer in the store overview that I had just helped upgrade, with multiple valid cards on file, put "On Hold" because of a missed payment.

For years, I've offered to help WooCommerce improve its code quality and performance. I dry-run code: I find bugs by reading. All four of these bugs are clearly visible in the source without needing to use the software. They could have been caught early. They weren't. The incompetence is immeasurable (well, actually, with the diagnostic queries in my next post, it might be measurable). Our store is small. WooCommerce Subscriptions powers hundreds of thousands of stores. If 7% of subscriptions were silently broken across even a fraction of them, we're looking at potentially millions of dollars in spoiled revenue industry-wide that could have been prevented. Perhaps even billions.

None of this was disclosed well or at all. No admin notice. No email. No advisory.

The fixes shipped under vague changelog lines like "Make sure we always clear the subscription object from cache after updating dates" and "Ensure proper backfilling of subscription metadata." One fix was labeled "Dev" instead of "Fix." Two don't appear in the GitHub release notes at all. No remediation tool or diagnostic query was provided. Store owners have NO way to know they're affected unless they manually audit their database. The woocommerce-subscriptions-core repo was archived in May 2025 after the code was absorbed into WooCommerce core — making the fix history harder to trace.

If you run WooCommerce Subscriptions and used HPOS before mid-2024, check your store. Queries are linked in the tweet below.

[Ben Word @retlehs]

The new @Cloudflare site is a great baseline — it checks whether you return Markdown

✨ https://t.co/aosZud6e5b checks whether you return it correctly (Vary, q-values, 406, Link rel=alternate), tracks which AI agents actually adopt the standard, and includes integration guides