WordPress News Roundup October 2017: WordPress 4.9 Betas Race to RC as 4.8.3 Hardens prepare()

October 2017 was a sprint toward WordPress 4.9. Core shipped four betas and a release candidate in a single month, with new Customizer workflows, a safer code editing experience and widget improvements all heading for a mid-November release. On the last day of the month, WordPress 4.8.3 delivered a security fix that had taken six weeks to get right.

Gutenberg also took an important step, adding initial support for meta boxes, one of the biggest concerns raised by plugin developers. And in a sign of how far WordPress’s influence reached, Matt Mullenweg joined the board of GitLab.

Mergers, Acquisitions, and Investments

• GitLab’s Series C: GitLab raised a $20 million Series C round and added Matt Mullenweg to its board of directors, linking WordPress’s co-founder to one of the most prominent open-core companies in software development.

No major acquisitions of WordPress companies were announced in October.

WordPress Core Updates

• WordPress 4.9 betas: Beta 1 landed on October 5, followed by betas on October 12, 19 and 25, and the release candidate on October 31, with a target release date of November 14.
• What 4.9 would bring: Drafts, scheduling and front-end preview links for Customizer changes; a new themes experience in the Customizer; syntax highlighting and error checking in code editors, plus protection against fatal errors from edits in the theme and plugin editors; and widget improvements including shortcodes and embeds in the Text widget.
• “Try Gutenberg” pulled: Beta 4 removed the planned “Try Gutenberg” call to action from the 4.9 dashboard, leaving the new editor as an opt-in plugin for now.
• Build tools: Core replaced Browserify with webpack in its build process.
• WordPress 4.8.3: Released October 31 to fix a security issue in $wpdb->prepare() (details below).
• Gutenberg 1.3 to 1.5: Version 1.3 added a feedback option for testers, 1.4 added an HTML mode for blocks, and 1.5 added initial meta box support and made Gutenberg the default editor when the plugin was active. Matías Ventura also set out his vision for blocks, front-end editing and the future of themes.

Other WordPress News

• GoDaddy’s new platform: GoDaddy launched a new managed WordPress hosting platform aimed at web professionals.
• 2017 user survey: The annual WordPress survey opened on October 26, with results promised for WordCamp US.
• Canvas retired: WooCommerce retired its Canvas theme and recommended customers migrate to Storefront.
• WooCommerce milestones: WooCommerce 3.2 added coupons in the admin and pre-update version checks for extensions, and WooCommerce stores were reported to be on track to surpass $10 billion in sales for the year. WooConf took place in Seattle.
• AMP partnership: As the AMP project turned two, Automattic partnered with Google to improve the official AMP plugin for WordPress.
• Patreon and WordPress: Patreon launched an app directory and a free WordPress plugin for membership sites.
• Charity hackathons: The do_action format had spread from Cape Town and Johannesburg to Beirut, Austin and Montréal, with Bristol and Zurich planned for 2018.
• Camp Press Iceland: The community retreat announced an Iceland edition for April 19–22, 2018.
• GDPR for WordPress: A community project launched to give plugin developers a common standard for GDPR compliance.

Security Alerts and Plugin Vulnerabilities

• WordPress 4.8.3: Anthony Ferrara reported that the hardening added to $wpdb->prepare() in 4.8.2 still allowed unexpected and unsafe queries, creating a possible SQL injection risk in plugins and themes. Core itself was not directly vulnerable. The fix changed how esc_sql() behaved, which affected a small number of developers.
• Disqus breach: Disqus disclosed that data from 17.5 million accounts, taken in a 2012 breach, had been exposed, and the company reset passwords for affected users, many of them commenters on WordPress sites.
• Postman SMTP removed: The popular Postman SMTP plugin was pulled from WordPress.org over unresolved security issues, and a developer forked it to keep a maintained version available.

Industry Trends and Insights

• React spreads: Drupal’s core maintainers proposed adopting React for administrative interfaces, a parallel to WordPress’s own shift toward modern JavaScript.
• HTTPS pressure: Chrome 62 expanded its “Not secure” warnings for HTTP pages and added support for variable fonts.
• Developer tools: Firebug was officially retired in favor of the Firefox developer tools, and GitHub launched a dependency graph with security alerts on the way.
• Platform competition: Medium opened its partner program, and Facebook tested a pay-to-play model for publishers in the News Feed, making owned publishing on WordPress look more attractive.

Theme of the Month: Canvas

Canvas, one of WooThemes’ best-known themes, reached the end of the road in October. For years it had been the go-to flexible framework for many WooThemes customers, and its retirement marked the end of an era as WooCommerce focused on Storefront and its core product.

Plugin of the Month: AMP

The AMP plugin for WordPress got new momentum when Automattic and Google agreed to work together on it. Publishers relying on mobile search traffic had been asking for better AMP support, and the partnership promised a plugin that would keep up with the format.

Host of the Month: GoDaddy

GoDaddy’s new managed WordPress platform for professionals arrived alongside the ManageWP and Sucuri businesses it had bought over the previous two years. It was a clear bid for agency and freelancer business at the high end of the market.

Founder of the Month: Jack Conte

Jack Conte, co-founder and CEO of Patreon, oversaw the launch of Patreon’s app directory and free WordPress plugin in October. It gave creators a direct way to put patron-only content on their own WordPress sites, an early sign that membership would become a major WordPress business model.

Looking Ahead to November 2017

WordPress 4.9 was due on November 14, with another release candidate planned before launch. Gutenberg development was continuing at speed, with more work on meta boxes and the writing experience.

WordCamp Harare was set for November 4, and attention was turning to WordCamp US in Nashville on December 1–3, where survey results and the State of the Word were expected.