WordPress Core Dev Notes

Maintenance of the GitHub mirror of the WordPress build repository has transferred from Mark Jaquith to the WordPress.org systems team. Syncing issues should now be reported on the make/systems blog or via the Slack #meta channel.

Start of the meeting in Slack, facilitated by @amykamala [See the agenda…

Release Candidate 1 of the 7.1.1 bug-fix-only maintenance release fixes a 7.1 regression where the reassign dropdown was missing when deleting a user on multisite, silently destroying content, and a 7.1 change where integer keys in WP_Hook::$callbacks caused fatal errors with string functions. Also included are fixes for indexed PNG thumbnails being created larger than the original, wp_get_tooltip() treating custom button markup as a sprintf() format string, 403s on /wp/v2/settings at boot for users without the manage_options cap, and the native sitemap returning 404 on sites with no published posts, plus an update to Node.js v24 LTS and npm v11. Final release is expected September 17, 2026.

The WordPress development toolchain now requires Node.js ≥24.18.0 and npm ≥11.16.0, with older branches staying on the previous versions. Contributors must update local environments, reinstall dependencies, and merge latest trunk before continuing work; Node.js 26.x upgrade is planned for later this year.

The WordPress 7.2 release community announced a weekly bug scrub schedule running from mid-September through early December 2026, with sessions every Tuesday and Thursday on the #core Slack channel. The scrubs will focus on general issues during the alpha phase and reported bugs from the beta phase onward. Volunteers are welcome to join the sessions regardless of experience level.

Matt Mullenweg leads the 7.2 release squad, which continues the smaller, focused squad structure with team-rep collaboration. David Baumwald coordinates, with George Mamadashvili and Peter Wilson as tech leads; design and development leads for the Twenty Twenty-Seven default theme are also named.

Agenda covers the upcoming releases (7.1, 7.2) with an open floor and discussion sections, plus announcements on PHPUnit test cleanup for 7.2, the 7.1 release retrospective, runnable code examples in the Code Reference, and replacing dashicons in the admin bar.

Pushes to trunk now publish test timing metrics to CodeVitals, making slow tests flaggable as candidates to improve. The post lays out a maintenance roadmap for core tests — many leak state, some assert nothing, and several depend on network calls — and invites contributors to claim pieces for fix patches and code reviews.

This is a meeting summary for the WordPress core performance team covering the September 8 chat. Key topics include work on a view transitions feature, an HTML API update, improvements to script handling in the admin, and further focus on data liberation. The conversation lists open performance tickets and ongoing patch reviews.

The WordPress core team is collecting feedback on the 7.1 release cycle through a survey and comments, open until September 30, 2026. Submissions will be anonymized in a follow-up summary.

WordPress 7.1 ships the first two runnable code examples in the Code Reference, powered by WordPress Playground; select Run to execute the snippet in your browser. More runnable snippets are planned for 7.2, and authors can mark code fences with a ```php interactive language tag to make them executable.

Dashicons in the admin bar and sidebar are being replaced with WordPress icon set SVGs via the wp_get_icon() function from WordPress 7.1. The change improves screen-reader predictability, supports forced-colours settings better, and simplifies the visual language.

Contributors held an off-the-record conversation at WordCamp US 2026 about WordPress's relationship with the PHP language and community, covering pain points like backward compatibility friction, PHP 7.4 adoption still at roughly 18% of sites, and a proposal to revisit WASM support.

This dev chat summary covers a proposal for a Secrets API in WordPress 7.2, the published release schedule for 7.1.1, and updates to the WordPress vulnerability disclosure program.

Agenda for the September 2, 2026 WordPress Developers Chat covers upcoming releases, including a Secrets API proposal for WP 7.2, the 7.1.1 release schedule, and updates to the vulnerability disclosure program.

WordPress 7.1.1 is planned as a bug-fix-only maintenance release, scheduled for general release on September 17, 2026. RC1 lands September 10, with bug scrubs and the 7.1.2 milestone opening at the September 8 scrub.

An X-comment from the WordPress security team links to updated information on the Vulnerability Disclosure Program.

WordPress Core Dev Notes cross-posts a comment on the Core Security Initiative blog post.

Proposal outlines a WordPress 7.2 Secrets API with always-on encryption, WP-CLI support, and no admin UI until 7.3. Secrets are stored encrypted under a master-key envelope, masked in logs, and retrieved via wp_get_secret() which distinguishes absent from broken. A feature plugin will ship first, then core with an identical API surface.