WordPress News Roundup August 2015: WordPress 4.3 “Billie” Brings Menus to the Customizer

August 2015 brought WordPress 4.3 “Billie,” the release that moved menu management into the Customizer and changed how WordPress handles passwords. It arrived two weeks after a security release that patched six issues, and in the same month the Plugin Directory passed one billion total downloads.

By the end of the month, attention had already turned to 4.4: Twenty Sixteen, the next default theme, appeared on GitHub and in the Theme Directory, and the community was asked what it wanted from the year’s final release.

Mergers, Acquisitions, and Investments

No significant acquisitions or funding rounds were announced in August. The nearest thing to a business restructuring was Stream’s decision to shut down its cloud data storage service on October 1, a reminder that hosted add-ons to free plugins could be hard to sustain.

WordPress Core Updates

• WordPress 4.2.4: Released on August 4, it addressed six issues, including three cross-site scripting vulnerabilities and a potential SQL injection, found by Marc-Alexandre Montpas of Sucuri, Helen Hou-Sandí of the security team, Netanel Rubin of Check Point and Ivan Grigorov. It also fixed a potential timing side-channel attack reported by Johannes Schmitt of Scrutinizer and a way to lock posts from being edited, along with four bugs.
• WordPress 4.3 “Billie”: Released on August 18 and named after jazz singer Billie Holiday, 4.3 added menus in the Customizer, formatting shortcuts (asterisks for lists, number signs for headings), site icons, and a new password system that sends reset links instead of emailing passwords and generates strong passwords automatically. Comments were turned off on new pages by default, and list views across the admin were refined for accessibility and small screens. Konstantin Obenland led the release, which had 246 contributors with props.
• Text patterns and the link toolbar: The new formatting shortcuts and a quick link toolbar in the visual editor were among the most noticed day-to-day changes for writers.
• Planning 4.4: With Scott Taylor leading the next release, contributors began gathering feature ideas, and the oEmbed-for-posts proposal and REST API infrastructure were both in contention.
• Twenty Sixteen: The first look at the new default theme arrived on August 25, and it was made available on GitHub and in the Theme Directory on August 31.

Other WordPress News

• A billion downloads: The WordPress Plugin Directory surpassed one billion total downloads on August 10.
• Community Summit dates: The WordPress Community Summit was set for December 2 and 3, just ahead of WordCamp US in Philadelphia, whose organisers published their case for the city.
• Kim Parsell scholarship opens: The WordPress Foundation began accepting applications for the Kim Parsell Memorial Scholarship on August 19.
• WordPress.com Action Bar: WordPress.com unveiled the Action Bar, a floating toolbar shown on WordPress.com sites, on August 28.
• Favicons phased out of themes: With site icons now in core, the Theme Review Team began phasing out favicon options in themes.
• Lasso becomes Editus: After July’s trademark dispute, Nick Haskins rebranded his front-end editing plugin as Editus.
• Higher education: A new conference devoted to WordPress in higher education was announced as WordCampus, later renamed WPCampus.
• Licensing explained: Lawyer Richard Best published a human-readable version of the GPLv2, helping product businesses understand their obligations.

Security Alerts and Plugin Vulnerabilities

• Core security praised: After a spring of disclosure troubles, the 4.2.4 release drew public praise for the core team’s handling of security, and WP Tavern published a short interview with new security czar Nikolay Bachiyski.
• WP REST API 1.2.3: The REST API plugin patched a cross-site scripting vulnerability on August 14.
• BuddyPress 2.3.3: Patched security vulnerabilities in the BuddyPress Messages component on August 28.

Industry Trends and Insights

Decoupled WordPress was moving from experiment to practice. WP Tavern explored why some front-end developers were using WordPress purely as a back end and rendering sites with JavaScript frameworks, a pattern the REST API project was designed to support. The billion-download milestone, meanwhile, showed the scale of the plugin economy that any architectural change would have to carry with it.

The 4.3 password changes also reflected a wider industry shift. Emailing plain-text passwords had long been criticised, and replacing that with reset links and generated passwords brought WordPress in line with modern security practice across the web.

Theme of the Month: Twenty Sixteen

Twenty Sixteen, designed by Takashi Irie, who had also designed the two previous default themes, was unveiled in August. It paired a horizontal masthead with an optional right sidebar, custom colour options and a mobile-first fluid grid, aiming to work for both blogs and traditional websites. It was slated to ship with WordPress 4.4 in December.

Plugin of the Month: WP REST API

The WP REST API plugin was the most consequential plugin in development in August. While the 1.x branch received a security fix, version 2 was being prepared for a phased merge into core, and the 4.4 cycle offered the first realistic chance to get its infrastructure into WordPress itself.

Host of the Month: Media Temple

Media Temple, owned by GoDaddy since 2013, continued to push its managed WordPress hosting in 2015, including a partnership earlier in the year with the SIDEKICK in-dashboard training service. Its emphasis on helping clients learn WordPress fitted a month in which core focused on making everyday editing easier.

Founder of the Month: Miriam Schwab

Miriam Schwab, founder of the Israeli WordPress agency illuminea, was interviewed on WP Weekly in August. As an agency owner, she represented the growing number of WordPress businesses building international client bases from outside the United States.

Looking Ahead to September 2015

September was expected to bring the first maintenance release for 4.3 and the start of serious 4.4 development under Scott Taylor, with a decision looming on how much of the REST API would be merged. WordCamp US tickets were due to go on sale, and ThemeConf was scheduled for September 2 to 4.