Advanced tools for professional WordPress developers 🔧 https://xitter.cf/t.co/aWZDsySk6l Tweets by @retlehs

Joined March 2011
roots.io retweeted
WordPress sites on Roots Bedrock now work with every WordPress tool in Ploi. Ploi detects the web/wp core directory, so plugins, themes, search and replace, the WP-CLI console, cronjobs and clones all work. Override the core directory if your fork moved it.
1
3
10
735
roots.io retweeted
Composer 2.10 is out. Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with. #php #phpc #composerphp
9
85
11
336
25,811
roots.io retweeted
🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages. Update now (composer self-update) or disable affected Actions workflows. #composerphp #phpc #php
5
91
10
210
92,422
roots.io retweeted
Spin up a @rootswp Bedrock site in your browser 🌐 Powered by php-wasm, ghostty-web, Astro on Cloudflare Workers (Extremely alpha phase & still in a private repo. Got a decent roadmap but time is tight atm - it'll eventually support Acorn and Sage) playground.roots.io
2
3
23
1,409
roots.io retweeted
PSA for Acorn users: skip transients, reach for Laravel Cache — roots.io/acorn/docs/laravel-… Just caught Claude Code reaching for a transient & updated Radicle's PHP style guide to be more explicit about this. Official 𝚂𝙺𝙸𝙻𝙻𝚂.𝚖𝚍 files for our major projects coming soon!
1
1
13
1,220
roots.io retweeted
Using ACF made sense in 2019 but it doesn't mesh with modern WordPress development. I just inherited a site that heavily uses ACF and it's a complete mess. - Use 𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜⁠/⁠𝚋𝚞𝚒𝚕𝚍 with 𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜⁠/⁠𝚌𝚘𝚖𝚙𝚘𝚗𝚎𝚗𝚝𝚜 for modern WordPress settings (𝚋𝚞𝚒𝚕𝚍 is the successor to 𝚜𝚌𝚛𝚒𝚙𝚝𝚜, been using it all week and it's great — no more webpack) - Native blocks are more powerful with a better, modern UX. You can use dynamic server rendered blocks where it makes sense, and WordPress 7.0's PHP block registration can replace most ACF blocks - Use the Block Locking API so clients can't break the layouts you build - Use extended-cpts for CPT/taxonomy management ACF repeaters and flexible layouts aren't the way. InnerBlocks + nested native blocks do this with a better UX. Build some boilerplates using 𝚠𝚘𝚛𝚍𝚙𝚛𝚎𝚜𝚜⁠/⁠𝚌𝚘𝚖𝚙𝚘𝚗𝚎𝚗𝚝𝚜 for settings pages (ACF settings pages look out of place compared to this), native blocks, etc. and let agents use them to produce better interfaces quickly I've been doing this for years on hybrid themes and haven't looked back (not using FSE, it's not the right setup for the designs I work on) "But ACF is faster" — not anymore. Agents close the gap, and reviewing their diffs helps you see what modern WP actually looks like.
21
7
4
116
9,717
roots.io retweeted
What's actually in the WooCommerce telemetry payload and four ways to turn it off — your store's revenue numbers are in there, sent weekly to a third party: roots.io/disable-woocommerce…
Fun fact: WooCommerce collects your sensitive information without asking for consent. Luckily, it merely consists of about 1000 data points. Let's dive into it... 🧵 Disclosure: I'm a WooCommerce Marketplace partner.
2
9
3
30
8,589
roots.io retweeted
Shipped a public status page for WP Packages — every 5-minute build, package changes, and hourly closure checks are now fully transparent wp-packages.org/status
2
15
1,042
roots.io retweeted
WP Packages now supports immutable dev-trunk installs for every WP plugin that doesn't have tags reflecting the latest version. Unlike WPackagist's approach (mutable zip with a cache-busting timestamp, causing unexpected plugin updates), we pin dev-trunk to a specific SVN rev.
2
5
17
1,409
roots.io retweeted
No more crazy composer.json workaround needed anymore, just: composer require wp-plugin/example-plugin:dev-trunk Every plugin now has a example-plugin~dev.json file on the CDN
2
7
881
roots.io retweeted
WP Packages is a new community-funded, open source Composer repository for WordPress plugins and themes, built as an independent alternative to WPackagist. It supports Composer v2's metadata-url protocol, syncs every 5 minutes, and is roughly 17x faster on cold dependency resolves. wp.me/pZhYe-5g2
3
14
1
72
6,534
roots.io retweeted
~12% of WordPress plugins are "doing it wrong" — releasing via SVN trunk without tagging versions. We now flag every one of them with workarounds for Composer users. wp-packages.org/untagged
1
3
1
17
2,074
roots.io retweeted
Clarifying some things I’ve seen about WP Composer/Roots this week: – We started working on a WPackagist replacement last August, long before any recent attention – RTs/posts by dot org are unrelated to our motivations, but we do appreciate the extra visibility – Roots has been an independent open source org in the WordPress ecosystem since 2011, with one goal: improve the WP developer experience – We’ve never been an agency or owned by a hosting company, just a team and community focused on open source – I do sell one product, Radicle, to help fund that work, along with past products like screencasts and the Sage book – WP dot com has been a sponsor since 2021, and others, including Pantheon, have supported Roots over the years, with no influence on our roadmap – WP Engine hasn’t been involved with Roots, no sponsorship or collaboration to date, including support and documentation for Sage 11 – When critical ecosystem infrastructure ends up controlled by a private equity-owned company, especially when that platform still has gaps in Composer support, we think the community deserves an open alternative
5
15
2
84
10,667
roots.io retweeted
FYI Composer repos can include an ‘info’ field in packages.json that displays messages to every developer on install/update. Any repo maintainer could use this to push ads, upsells, or whatever else directly into your terminal wp-composer.com will never do this
We are planning on adding: "WPackagist is now maintained by WP Engine." in the CLI. That is all.
2
1
19
3,037
roots.io retweeted
Glad WPackagist found a home, but tooling this central to the WP Composer workflow probably shouldn’t be owned by a private-equity backed company. I started building a prototype of a WordPress Composer registry (w/ mirror support) for @rootswp late last year, and I’m now more motivated for us to get it launched sooner and keep it community-owned.
WPackagist has been acquired by @wpengine. For over a decade, Outlandish built and maintained this service. Now WP Engine is carrying it forward - with the same commitment to the developer community in the WordPress ecosystem.
7
9
2
80
17,732
roots.io retweeted
roots/wp-config v2 is coming soon, a new fluent API for WordPress configuration github.com/roots/wp-config
4
2
24
1,332
roots.io retweeted
Acorn AI will use your provider keys defined in laravel/ai's config file to populate keys for WordPress AI plugins without exposing your keys in plaintext in the database 🔒 This AI connectors page is coming in WordPress 7.0 github.com/roots/acorn-ai/pu…
1
2
8
1,370
roots.io retweeted
With Trellis deploys, the current git SHA is added as an environment variable & you can use that to show the deployed version in the WP admin footer (Helpful for debugging and ensuring you're on the correct version of the codebase)
2
5
583
roots.io retweeted
No more hunting down changelogs whenever you update plugins via wpackagist 👀
Made a GitHub action that will hopefully prevent some unwanted surprises if you're using WPackagist
1
1
8
822