WordPress News Roundup September 2017: WordPress 4.8.2 Release, WordPress Drops React, Then Facebook Relicenses It

September 2017 delivered the most dramatic JavaScript story in WordPress history. On September 14, Matt Mullenweg announced that WordPress would move away from React because of the patent clause in its license, meaning Gutenberg would need to be rebuilt on another library. Just over a week later, Facebook said it would relicense React under the MIT license, and React was suddenly back on the table.

The month also brought WordPress 4.8.2 with nine security fixes, the permanent removal of the Display Widgets plugin after malicious code was found, and new community programs to make WordCamps more accessible.

Mergers, Acquisitions, and Investments

No major WordPress acquisitions or funding rounds were announced in September. The month’s most consequential ownership story was a warning: the Display Widgets plugin had changed hands earlier in the year, and its new owner had added code that led to its permanent removal from the directory.

WordPress Core Updates

• The React decision: In “On React and WordPress”, Matt Mullenweg said Facebook’s decision to keep the patent clause made React too risky for a project used by so many businesses, and that Gutenberg would be rewritten with a different library. When Facebook dropped the clause and moved React to MIT, the core team reopened the question.
• Framework-agnostic blocks: Contributors explored an approach that would let blocks be built with any JavaScript library, so the underlying framework could be swapped without breaking the rest of the project. Discussion continued into October with input from leaders of other open source projects.
• WordPress 4.8.2: Released September 19, it fixed nine security issues in 4.8.1 and earlier and included six maintenance fixes.
• Preparing 4.9: SWFUpload was confirmed for removal in WordPress 4.9, and a new core Gallery widget was targeted for the same release.
• Gutenberg 1.1 and 1.2: Version 1.1 added autocomplete for blocks, and 1.2 added post meta support and an extended settings placeholder. The team also said Gutenberg would take a new approach to TinyMCE in 5.0, with a plugin available for people who wanted the old interface.

Other WordPress News

• DonateWC: Ines van Essen launched DonateWC to help people attend and speak at WordCamps, and the crowdfunding campaign reached its initial goal within days.
• WordCamp Incubator returns: The Community team brought back the incubator program to help underserved cities hold their first WordCamps, starting with a call for experienced mentors.
• 500 meetup groups: The official WordPress meetup chapter program passed 500 groups.
• Global WordPress Translation Day 3: The Polyglots team held its third 24-hour translation event on September 30.
• Plugin support reps: WordPress.org added a support representative role so plugin owners could designate people to answer forum questions.
• Equifax on WordPress: Equifax launched a WordPress-powered site for consumers affected by its data breach, a high-profile, if unwelcome, use of the platform.
• Apply Filters ends: The developer podcast Apply Filters announced it would retire after 83 episodes.
• WooCommerce 3.2: The next WooCommerce release was pushed back to October 11 and would introduce version checks for extensions before updates.

Security Alerts and Plugin Vulnerabilities

• WordPress 4.8.2: The release hardened $wpdb->prepare() against unsafe queries built by plugins and themes, reported by Slavco, and fixed XSS issues in oEmbed discovery, the visual editor, the plugin editor, template names and the link modal, along with path traversal issues in file unzipping and the Customizer and an open redirect on the user and term edit screens.
• Display Widgets removed: On September 13, Display Widgets was permanently removed from WordPress.org after its new owner added code that loaded spam content onto sites, one of the clearest examples yet of an ownership change turning a trusted plugin into a threat.
• SI CAPTCHA Anti-Spam removed: Later in the month, SI CAPTCHA Anti-Spam was also permanently removed for including spam code after a change of ownership.

Industry Trends and Insights

• Open source licensing matters: WordPress’s public stand was widely credited with adding pressure on Facebook to relicense React. It showed how much weight a project running on more than a quarter of the web could carry.
• The plugin supply chain: Two directory removals in one month put the risks of buying established plugins with large user bases firmly in the spotlight, with calls for more transparency when plugins change hands.
• Developer tools: GitHub and Facebook released Atom-IDE, and DigitalOcean partnered with GitHub on Hacktoberfest for October.
• Breach fallout: The Equifax breach made data security a mainstream concern in the months before GDPR enforcement.

Theme of the Month: GeneratePress

GeneratePress, Tom Usborne’s lightweight theme, was a favorite among developers who cared about clean code and fast page loads. In a month when trust in plugin and theme authors was being tested, its long track record and transparent development stood out.

Plugin of the Month: Regenerate Thumbnails

Alex Mills’ Regenerate Thumbnails passed 5 million downloads at the turn of the month, and a rewrite was in the works. Anyone who has switched themes knows why: it rebuilds image sizes after a theme change, a small utility that quietly fixed problems on millions of sites.

Host of the Month: DigitalOcean

DigitalOcean’s Hacktoberfest partnership with GitHub encouraged developers to contribute to open source in October. Its simple cloud servers and one-click WordPress images had also made it a popular choice for developers who wanted to run their own WordPress hosting.

Founder of the Month: Ines van Essen

Ines van Essen founded DonateWC to fund travel for people who could not otherwise attend WordCamps, and it reached its first fundraising goal in September. Within weeks it would sponsor its first applicant to WordCamp Cape Town.

Looking Ahead to October 2017

October was set to bring the first betas of WordPress 4.9 and more debate over Gutenberg’s JavaScript foundations, now that React was MIT-licensed. WooCommerce 3.2 was due on October 11, and WooConf was scheduled in Seattle.

The first WordCamp Dublin was set for October 14–15, and Hacktoberfest ran all month.