WordPress

WordPress core dev notes cross-post a comment thread from the Security blog on the Core Security Initiative two months in.

A design exploration for Feature Notifications proposes a single notification tray—one bell for the site, its plugins, and WordPress.com—available across every admin screen, the editor, and the front of the site, with four layouts, five core-owned dimensions (type, severity, intent, read state, status), and an Alerts tab that pins critical items until resolved. The post stresses this is not a breaking change: existing plugins keep working and no APIs or hooks are removed, though admin notices are no longer where notifications are heading.

WordPress 7.1.4 patches a weakness in the upgrade process that can lead to remote code execution during the upgrade window, plus stored XSS issues in block markup, the Interactivity API, Customizer selective refresh, the Categories, Playlist and image blocks, and comment pagination blocks. It also fixes a stored denial of service in the Interactivity API, unpublished customizer changesets being discoverable by unauthenticated users, notes readable by privileged users without edit access to the attached post, and updates bundled root certificates for the eMudhra revocation.

The block editor now allows rich text formatting across blocks, and Avatar gains initials, colored fallbacks, and an optional color ring. The release also adds extensive block supports across the block library — covering background image and gradient, minimum width and height, shadow, typography, and writing mode — plus standardized focus rings and DataViews improvements.

Core Dev Notes cross-posts a comment from the AI team's "WordPress for the Agentic Web" post.

The October 28, 2026 Core developers chat covers upcoming releases and Core development, noting WordPress 7.2 Beta 2 shipped October 27 with Beta 3 scheduled for November 3. Also on the agenda: the release roadmap survey open until November 16 and the Contributor Toolkit 2.0 redesign.

Beta 2 builds on the first beta with continued Abilities API development covering content querying, capability requirements, schema handling, and permissions, plus new server-side registration capabilities for DataViews and DataForm. Additional work includes REST API flexibility, admin asset loading, and a transition to modern SVG icons in the admin. Final release is scheduled for December 8, 2026.

WordPress is soliciting feedback on the release roadmap posts that have followed roughly the same shape and approach for the last three years, with a deadline of November 16th. Feedback outside the survey format can be left as a comment, and results will be summarized in a follow-up post or comment.

The Contributor Toolkit's interface is rebuilt on the WordPress Design System with a settings dialog covering theme, language, site, and account options, and every string is now translatable, with Czech, Dutch, English (Canada), English (UK), Galician, Hungarian, Lao, Polish, Serbian, and Turkish shipping in 2.0. The installed app is about 350 MB smaller, site details list changed files as a folder tree with per-file revert, and Trac ticket details persist across restarts.

The README now notes where developers can find the demo code plugin for trying out the feature, and 23 Dependabot PRs were merged, including a grouped update of 37 @wordpress/* packages. Open contributor PRs now cover the REST API (GET, POST, and DELETE on notifications), schema v2 tables, user-scoped repositories, and UTC date handling.

Agenda for the October 21, 2026 developer chat announces WordPress 7.2 Beta 1 released October 20 with Beta 2 scheduled for October 27, plus a call for code review help repairing Gutenberg GitHub Actions workflows for wp/x.y branches.

Eliminating script and style concatenation has landed in core as of r64585 and ships in WordPress 7.2-beta1, retiring the use of load-scripts.php and load-styles.php and closing more than 10 Trac tickets. The change replaces concatenation, previously used in the login and admin for core's own assets, with prefetching of blocking scripts and styles known to be used on the next screen.

WordPress 7.2 Beta 1 expands viewport-specific styling to more design tools and blocks, adds text shadow controls customizable via block settings and theme.json presets, and introduces a new On This Day dashboard widget surfacing posts published on the same date in previous years. Client-side media processing now extends to the Media Library, resizing, compressing, and converting images in the browser before upload, and the beta also ships a Customized filter for Global Styles, emoji reactions on notes, and faster admin asset loading with prefetching. Final release is scheduled for December 8, 2026.

Recap of feedback from the WordPress 7.1 "Mary Lou" retrospective, covering what to keep (release parties, security auditing), add (release squad kick-off call, earlier visibility into block editor UI changes), and change (dropping event-tied launches, restoring the official Docs role). Takeaways also call for more automation and wider beta and RC testing with hosts.

GitHub issue #302 now lists the 16 open items required for the 0.3.0 MVP release, and all development work is to focus on them. The project also has 30+ open Dependabot PRs resolving dependency security alerts, and weekly office hours restart Thursday, October 22, 2026 at 11:00 am UTC in the #feature-notifications Slack channel.

WordPress is calling for code review help on roughly 500 pull requests across 20+ wp/X.Y branches that restore broken GitHub Actions workflows and test suites in the Gutenberg repository, fixing branch filters, pinned action and runner versions, and flaky tests so security patches can be validated before shipping. Reviews are divided by fix rather than by stack, claimed one row at a time on tracking issue GB-84853, and require an approving review from a WordPress GitHub org member with write access.

“What’s new in Gutenberg…” posts (labeled with the #gutenberg-new tag) are posted following every Gutenberg release on a biweekly basis, showcasing new features included in each release. As a reminder, [here’s an…

Interactivity API gains a data-wp-html directive and reactive navigation lifecycle with an initiator API, and the UI package adds Meter, Progress with custom color support, and SearchableSelectControl components. Plus dozens of block-level design controls across minimum width and height, shadow, border, padding, and duotone support.

Agenda for the next WordPress Developers Chat on October 14, 2026 at 15:00 UTC in the core Slack channel, focused on upcoming release discussions with an open floor section. Announcements include WordPress 7.2 Beta 1 scheduled for October 20, a wp_kses() progress report, and NO_BACKSLASH_ESCAPES SQL mode now off by default in 7.2.