Recent releases from organizations and products in the Framework category.
WordPress is moving away from in-person live release events to a livestreamed Zoom webinar format that lets more of the release squad participate without travel. The change starts with WordPress 7.2, due early December 2026.
WordPress/core-release-utils packages six CLI tools that draft HelpHub version pages, write svn cp tag commands from each branch's $wp_version, verify tags reach the GitHub mirror, check svn merge --record-only coverage, apply PR diffs via svn patch, and build contributor lists for release posts and the credits API. Each tool has a README and tests, and prints commands for the operator to run.
Gutenberg's JavaScript unit and integration tests now use Vitest, and @wordpress/scripts 36.0.0 makes Vitest the default runner for test-unit-js with projects installing and configuring their own runner. Jest tests can continue via test-unit-jest after a one-time setup, while @wordpress/jest-preset-default and @wordpress/jest-console are deprecated with no Vitest replacements planned.
The September 23, 2026 core dev chat covers the 7.2 roadmap, the new Ipsum default theme, and a call for testing the DataForm editor inspector. Announcements also note WordPress 7.1.1 shipped 17 core bug fixes, 19 block editor fixes, and 11 security fixes, and 7.1.2 fixed one important security issue.
The weekly performance chat reviewed open performance Trac tickets for the next major and minor milestones, with #57548 still a priority, and noted a backlog of Performance Lab work awaiting attention. The next chat is scheduled for October 6, 2026 at 16:00 UTC.
WordPress 7.1.2 fixes a critical severity vulnerability where an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories, potentially leading to remote code execution. The fix is being backported to all branches eligible for security fixes, currently through 4.7.
Fixes a rare issue where ISR pages on Vercel could intermittently be served a cached redirect to a nonsense URL like /$0/ instead of the page, with unresolvable requests now returning 404. Also corrects the immutable Cache-Control rule for hashed /_astro/* assets being emitted after the filesystem route handle in the Vercel output config.
@astrojs/mdx v8 can no longer be installed alongside astro versions that bundle an older @astrojs/markdown-satteri lacking MDX support, and the error message now suggests updating astro when the processor is too old. Dependency @astrojs/markdown-satteri was bumped to 0.4.2.
Image transforms without a specified quality no longer output higher quality than expected on certain formats, and image requests work again when using imageService: 'compile' with passthroughImageService(). Also fixed the optimizeDeps.include glob astro/runtime/** matching .d.ts files, which created 83 unnecessary optimizer entries and empty output chunks per environment during dev.
Incremental builds no longer repeatedly render pages whose modules or compiled CSS reference bundled assets. Also fixes the dev server re-evaluating the entire server module graph on every request, which affected adapters running outside Vite's module runner such as @astrojs/cloudflare, plus domain-based i18n routing now respects security.allowedDomains.
Syntax highlighting for fenced code blocks is fixed when raw HTML is enabled. Also fixes satteriHeadingIdsPlugin sharing Slugger state across documents when reused as a user hast plugin, which gave headings with identical text in different posts incorrect numeric suffixes.
Initial release of the TypeScript content mapper for Astro files.
Fixed a case where rich content diagnostics and snippet edits would not work.
The React integration migrates to @vitejs/plugin-react v6 using Oxc for JSX and Fast Refresh, removing the babel integration option; projects with custom Babel transforms must configure @rolldown/plugin-babel under vite.plugins. An opt-in compiler option enables the Oxc-based React Compiler for client components and hooks via oxc-transform-react.
Updates @qwik.dev/partytown from 0.13.2 to 0.14.4, bringing fixes for analytics event forwarding and iframe loading, support for Google Tag Manager's Tag Assistant preview, and automatic execution of scripts added after client-side navigation.
htmx1An essay argues Markdown is becoming source code rather than documentation, and proposes checking it into a /src/md directory next to the code it produces, with code and tests derived from that Markdown instead of ephemeral prompts. The proposed convention includes README.md, TODO.md, OVERVIEW.md, and per-feature files, authored and curated mainly by humans.
The 7.2 roadmap, targeting an early December 2026 release, outlines security work including sudo mode re-authentication for sensitive actions, a first-class Secrets API for storing credentials, and Application Passwords hardening. The release also adds a Description List and Table of Contents block, an extensible Site Editor for plugin-registered screens, and a new minimal default theme called Ipsum.
