A retrospective on the WordPress 6.9.2 security release on March 10th, covering what went wrong and what went right. Key issues included three security commits missing from the release package due to human error in the merge process, a template loading bug requiring a fast-follow 6.9.3 release eight hours later, and significant delays backporting fixes to 22 older branches. A 7.0 beta 4 was also released to keep beta testers on a secure version. Action points include adding merge verification steps to the release checklist, improving build asset testing workflows, adding unit test coverage for the template loading fix, and increasing automation for the backporting process.
Sort: