WordPress News Roundup May 2005: WordPress 1.5.1 Ships, Followed by a 40-Minute Security Fix

May 2005 was the first real maintenance cycle for WordPress 1.5. Version 1.5.1 brought a large set of fixes and new hooks for plugin authors. Two quick follow-ups showed how fast the small team could ship a fix when it had to. Meanwhile WordPress.org kept building out its directory pages, this time with an official themes page.

Mergers, Acquisitions, and Investments

There were no WordPress deals. In the wider blog infrastructure market, the update-tracking service blo.gs announced that it had been sold. The buyer was not named at first, but Matt Mullenweg later confirmed it was Yahoo. Ping-O-Matic, which Mullenweg ran, was becoming one of the few independent ping services left.

WordPress Core Updates

• WordPress 1.5.1 (May 9): The first 1.5 maintenance release fixed more than 170 bugs, added many new Plugin API hooks and included a security fix credited to Thomas Waldegger. The announcement counted 207,981 downloads of 1.5.0.
• WordPress 1.5.1.1: Optimisations in 1.5.1 had broken feeds and trackbacks and pingbacks, so the download was quickly replaced with 1.5.1.1 to fix those and a few other bugs.
• WordPress 1.5.1.2 (May 27): A vulnerability that could be triggered on sites using the default template was patched in under 40 minutes. The fix was one line in the category template functions, and the team audited the codebase for similar problems.
• Three-second upgrades: Mullenweg upgraded his own blog to 1.5.1 with a single Subversion update. It was an early sign of how version control would change how developers ran WordPress sites.

Other WordPress News

• 200,000 downloads: On May 5 the download counter passed 200,000. Mullenweg said only DreamHost’s auto-installs were being counted so far, and the team wanted to add other hosts.
• Official themes page: At the end of the month WordPress.org launched an official themes page under its Extend section, based on an original mockup by Chris Messina.
• Caching in core? Mullenweg said the team would look at building advanced caching like WP-Cache into WordPress itself in the future.
• Gnomedex bound: Mullenweg was confirmed as a speaker at Gnomedex in Seattle in June.

Security Alerts and Plugin Vulnerabilities

May had two security fixes: the one in 1.5.1, and the default-template issue fixed in 1.5.1.2. For 1.5.1.2 the team published manual patch instructions for users who could not upgrade straight away. It also pointed out that hosts running the Apache module mod_security would already have blocked attacks of this kind, and said it would mark on the hosting page which recommended hosts used it.

Industry Trends and Insights

Blogging infrastructure was consolidating. Ping services, aggregators and search tools were being bought by larger companies, while publishing software competed on how easy it was to install and upgrade. One-click installers at hosts like DreamHost, and Subversion for developers, made WordPress very easy to get started with, and that ease helped it keep growing.

Plugin of the Month: WP-Cache

WP-Cache 2 stored generated pages and served them almost as fast as static files, so a WordPress blog could handle hundreds of requests a second. Mullenweg recommended it again this month. For bloggers who might be linked from Slashdot, it was the difference between staying up and going down, and it later became the basis for WP Super Cache.

Host of the Month: DreamHost

DreamHost offered one of the earliest one-click WordPress installers. Its installs were the only ones automatically included in WordPress’s download counter when it passed 200,000, which shows how many new users started there.

Founder of the Month: Ricardo Galli

Ricardo Galli, a Spanish academic and free-software advocate, wrote WP-Cache, building on ideas from the earlier Staticize plugin. Later in 2005 he co-founded Menéame, the Spanish social news site, which ran on its own software. In WordPress his caching work set the pattern for the performance plugins that followed.

Looking Ahead to June 2005

June would bring Gnomedex, more community meetups and continued maintenance of the 1.5 branch, while early development of the next major release went on in Subversion.