Pinned Tweet
β¨ We built WP Composer β an independent, open source Composer repository for WordPress plugins and themes, with 17x faster cold resolves than WPackagist
wp-composer.com/
ALT Screenshot of performance section from https://wp-composer.com/wp-composer-vs-wpackagist
Back when Sage used to be called the Roots Theme, it was one of the first WordPress themes to add a build system
v6.5.0 used Grunt and Bootstrap v3 with Less, and shortly after we added Bower π΄
π¨ PSA for Radicle users: the latest WordPress security releases (7.0.6, 7.1.2) break Blade views that live outside the theme directory. Front-end fatals with memory exhaustion, wp-admin looks fine.
Fixed in Acorn v6.3.0. Update before you update WordPress.
If you're using Radicle with WooCommerce, you'll also need changes applied to the sage-woocommerce package. See this topic for more details:
discourse.roots.io/t/psa-worβ¦
Acorn is 6 stars away from 1k π
github.com/roots/acorn
ALT Screenshot of the page header from https://roots.io/acorn/
π 2 million installs on WP Packages
Thanks for trusting us with a piece of your build π
wp-packages.org/
For plugin and theme authors, there are README badges now if you want to show off your Composer install counts
wp-packages.org/docs#badges
ALT Screenshot of a wp-packages.org installs badge from the docs page
roots.io retweeted
Composer 2.10 is out.
Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.
#php #phpc #composerphp
ALT Composer fending off packages, Malware automatically blocked
WordPress 7.0 RC4 just dropped:
ππππππππ πππππππ πππππ/π ππππππππ-ππππ:π½.πΆ-ππ²πΊ
wordpress.org/news/2026/05/wβ¦
roots.io retweeted
π¨ Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages.
Update now (composer self-update) or disable affected Actions workflows.
#composerphp #phpc #php
roots.io retweeted
Spin up a @rootswp Bedrock site in your browser π
Powered by php-wasm, ghostty-web, Astro on Cloudflare Workers
(Extremely alpha phase & still in a private repo. Got a decent roadmap but time is tight atm - it'll eventually support Acorn and Sage)
playground.roots.io
ALT Screenshot of playground.roots.io
ALT Screenshot of playground.roots.io
An early warning system for WordPress plugin security issues: WP Packages now tracks vendor mass closures publicly
RSS feed and APIs also available for mass closures π
wp-packages.org/closures
ALT Screenshot of https://wp-packages.org/closures
For folks using the πππππ/π ππππππππ package, you can swap to πππππ/π ππππππππ-ππππ to test the latest 7.0 RC:
WordPress 7.0 Release Candidate 3 is available for testing. The final release is scheduled for May 20, 2026. Test it now and report any issues before launch. wp.me/pZhYe-5lg
roots.io retweeted
PSA for Acorn users: skip transients, reach for Laravel Cache β roots.io/acorn/docs/laravel-β¦
Just caught Claude Code reaching for a transient & updated Radicle's PHP style guide to be more explicit about this. Official ππΊπΈπ»π»π.ππ files for our major projects coming soon!
ALT Screenshot of part of Radicle's PHP style docs
Automatic self-signed trusted certs for Lima VMs have landed in the latest version of Trellis CLI β¨
πππππππ ππ πππππ
Exports the cert and key out of the VM, trusts the cert in the macOS keychain and Firefox profiles
ππππ πππππππ πππππππ-πππ
π @WooCommerce assumes your wp-content directory is "wp-content" and uses site_url() instead of home_url() in some areas
PR submitted for one the bugs: github.com/woocommerce/woocoβ¦
Reported the other issues: github.com/woocommerce/woocoβ¦
ALT Screenshot of https://github.com/woocommerce/woocommerce/blob/7513d9dbb7295cc08b98cf0882ad3b67d21fd9e6/plugins/woocommerce/includes/class-woocommerce.php#L1206-L1208
3 ways WordPress plugins break non-standard installs:
- Hardcoded wp-content paths
- Direct wp-load.php includes
- Assuming WP lives at the root
roots.io/wordpress-plugins-tβ¦
ALT Screenshot of right and wrong code examples from the blog post
roots.io retweeted
Using ACF made sense in 2019 but it doesn't mesh with modern WordPress development. I just inherited a site that heavily uses ACF and it's a complete mess.
- Use π ππππππππβ /β πππππ with π ππππππππβ /β ππππππππππ for modern WordPress settings (πππππ is the successor to πππππππ, been using it all week and it's great β no more webpack)
- Native blocks are more powerful with a better, modern UX. You can use dynamic server rendered blocks where it makes sense, and WordPress 7.0's PHP block registration can replace most ACF blocks
- Use the Block Locking API so clients can't break the layouts you build
- Use extended-cpts for CPT/taxonomy management
ACF repeaters and flexible layouts aren't the way. InnerBlocks + nested native blocks do this with a better UX.
Build some boilerplates using π ππππππππβ /β ππππππππππ for settings pages (ACF settings pages look out of place compared to this), native blocks, etc. and let agents use them to produce better interfaces quickly
I've been doing this for years on hybrid themes and haven't looked back (not using FSE, it's not the right setup for the designs I work on)
"But ACF is faster" β not anymore. Agents close the gap, and reviewing their diffs helps you see what modern WP actually looks like.