New Release: WordPress 4.9.8

This notice relates to the following platforms: WordPress.com VIP, VIP Go

WordPress 4.9.8, a maintenance release, was deployed today. All sites across WordPress.com and VIP Go have been upgraded.

This release contains 46 fixes and several small enhancements, including:

  • TinyMCE: Updated to v4.7.13
  • Privacy: The type of request being confirmed is now included in the subject line for all privacy confirmation emails.
  • Performance: Extreme memory leak related to wp_is_stream in wp-includes/functions.php in WordPress 4.9.7
  • REST API: Attachments controller should respect “Max upload file size” and “Site upload space” in multisite
  • REST API: Only render fields specific to request when _fields= is used
  • REST API: Expose revision count and last revision ID on Post response
  • Meta: the register_meta() function supports registration of metadata not only for an entire object type (posts, terms, comments, users), but also for a specific object subtype (such as a specific post type or taxonomy).

Please note that the “Try Gutenberg” banner will not be shown on either WordPress.com or VIP Go.

More information about this release can be found in the official announcement post and the update guide.

Call for Testing: WordPress 4.9.8 RC

This notice relates to the following platforms: WordPress.com VIP, VIP Go

Update (2018-07-31 1700 UTC): The core release for 4.9.8 has been pushed to Thursday, August 2.

WordPress 4.9.8, a maintenance release, is due to be released Tuesday, July 31, 2018. A release candidate is available for testing now.

What’s New?

The main features of the release are:

  • Gutenberg (VIP Go only): Introduces a “Try Gutenberg” callout – a promotion for Gutenberg on your site’s dashboard (this does not appear if you already have Gutenberg installed)
  • Emoji: Update Twemoji to 11.0
  • TinyMCE: Updates to v4.7.13 (as noted below, WordPress.com sites will receive this update on Thursday, July 26).

In addition to the above, 4.9.8 contains 41 fixes and enhancements, including:

  • Performance: Extreme memory leak related to wp_is_stream in wp-includes/functions.php in WordPress 4.9.7
  • REST API: Attachments controller should respect “Max upload file size” and “Site upload space” in multisite
  • REST API: Only render fields specific to request when _fields= is used
  • REST API: Expose revision count and last revision ID on Post response
  • Privacy: Don’t replace comment author URL and email with anything
  • Privacy: Inconsistent use of blogname and sitename in Privacy emails

When is this being deployed?

WordPress.com VIP sites will receive the changes in two phases:

  1. Thursday, July 26: TinyMCE update.
  2. Tuesday, July 31: All other changes.

VIP Go sites will receive the update on Tuesday, July 31 Thursday, August 2 (the same date as the public release).

We’ll follow-up with additional Lobby posts once the updates have been deployed.

What do I need to do?

We highly recommend updating your local development environments to the release candidate using the Beta Tester plugin or updating it to track the 4.9 branch via either the Subversion or GitHub repos.

What if I need more information?

More information about this release can be found in the official announcement post about the release candidate. And always, if you have any questions or concerns, please let us know.

New Release: WordPress 4.9.7

This notice relates to the following platforms: WordPress.com VIP, VIP Go

WordPress 4.9.7, a security and maintenance release, was deployed today. All sites across WordPress.com VIP and VIP Go have been upgraded.

This release contains a security fix to a media issue that could potentially allow a user with certain capabilities to attempt to delete files outside the uploads directory. No VIP-hosted sites – neither VIP sites on WordPress.com nor sites on VIP Go – were vulnerable to this issue prior to this release.

In addition to the security patch, 4.9.7 contains 17 fixes, including:

  • Taxonomy: Improve cache handling for term queries.
  • Posts, Post Types: Clear post password cookie when logging out.
  • Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.
  • Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.
  • Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.

More information about this release can be found in the official announcement post and the update guide.

New Release: WordPress 4.9.6

This notice relates to the following platforms: WordPress.com VIP, VIP Go

WordPress 4.9.6, a privacy and maintenance release, was released last week. All sites across WordPress.com VIP and VIP Go have been upgraded.

The primary focus of this release was to introduce new tools to support Europe’s General Data Protection Regulation (GDPR), which takes effect on May 25, 2018. These include a tool to create and manage a Privacy Policy; tools to manage personal data export and erasure requests; and the ability for commenters to opt-in to having their data saved in a cookie.

As a reminder:

  • On the WordPress.com VIP platform, these tools are disabled.
  • On the VIP Go platform, these tools are be available and clients can choose to disable them.
    • Note: we are aware of an issue with generating the export download and are currently working on a fix.

More information about this release can be found in our earlier post, the official announcement post and the update guide.

New Release: WordPress 4.9.5

This notice relates to the following platforms: WordPress.com VIP, VIP Go

WordPress 4.9.5 was released yesterday. This is a security and maintenance release, and both WordPress.com VIP and VIP Go have been upgraded.

This release includes various bug fixes and addresses the following security issues:

  • Switch to wp_safe_redirect() when redirecting the login page when SSL is forced.
  • Escape HTML returned from get_the_generator().
  • Disallow localhost in wp_http_validate_url().

More information about this release can be found in the announcement post and release notes.

New Release: WordPress 4.9.4

This notice relates to the following platforms: WordPress.com VIP, VIP Go

WordPress 4.9.4 was released today. This is a maintenance release, and both WordPress.com VIP and VIP Go have been upgraded.

This release fixes a severe issue — introduced in 4.9.3 — that could cause WordPress’ automatic background update feature to fail. This issue did not impact VIP sites as updates are managed by our team.

More information about this release can be found in the announcement post and release notes.

New Release: WordPress 4.9.3

This notice relates to the following platforms: WordPress.com VIP, VIP Go

WordPress 4.9.3 was released today. This is a maintenance release, and both WordPress.com VIP and VIP Go have been upgraded.

This release includes various bug fixes, including fixes for Customizer changesets, widgets, and the visual editor, as well as the addition of canonical redirects for posts when their publish date changes.

More information about this release can be found in the announcement post and release notes.

New Release: WordPress 4.9.2

This notice relates to the following platforms: WordPress.com VIP, VIP Go

WordPress 4.9.2 was released today. This is a security and maintenance release, and both WordPress.com VIP and VIP Go have been upgraded.

This release includes various bug fixes and the following security update:

An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that is included with WordPress. Because the Flash files are no longer needed for most use cases, they have been removed from WordPress.

More information about this release can be found in the announcement post and release notes.

WordPress 4.9 Postponed

This notice relates to the following platforms: VIP Go

In order to accommodate teams that may want to be online during the scheduled WordPress upgrade, we’re going to postpone the upgrade on VIP Go until tomorrow, November 16th. We apologize for any inconvenience. The release went later than than anticipated, so we’ll upgrade tomorrow during US business hours instead.