WordPress Release: 4.4.25

TL;DR

WordPress 4.4.25 Release: Build Tools Modernization & Security Update

This maintenance release focuses primarily on modernizing the build and testing infrastructure for the 4.4 branch. It updates Node.js support to version 14.x, introduces a Docker-based local development environment, and migrates automated testing from TravisCI to GitHub Actions. The release also includes an important security improvement to PHPMailer's attachment handling. While most changes are behind-the-scenes for developers and maintainers, the PHPMailer update is relevant for all WordPress 4.4 installations.

Highlight of the Release

• Updated Node.js support to version 14.x LTS
• Migrated automated testing from TravisCI to GitHub Actions
• Added Docker-based local WordPress development environment
• Improved PHPMailer attachment handling for better security
• Enhanced test reliability with better timeout handling

Migration Guide

No specific migration steps are required for this release. The changes are primarily focused on development infrastructure and don't affect the public-facing functionality of WordPress sites.

If you're a developer working with the 4.4 branch:

1. Update your local environment to use Node.js 14.x if needed
2. If using the Docker-based local development environment, follow the standard setup instructions
3. Note that automated tests now run on GitHub Actions instead of TravisCI

Upgrade Recommendations

This release contains a security improvement to PHPMailer's attachment handling, so upgrading is recommended for all sites running WordPress 4.4.

However, it's important to note that WordPress 4.4 is no longer officially supported with security updates. For optimal security and features, we strongly recommend upgrading to the latest version of WordPress (6.4+ at the time of this release).

If you must remain on the 4.4 branch for compatibility reasons, this update should be applied as soon as possible.

Bug Fixes

Test Suite Improvements

• Enhanced Timeout Handling: Improved the skipTestOnTimeout() function to handle more types of timeouts in HTTP tests, including "Resolving timed out" and "Connection timed out" scenarios.

• JavaScript File Corrections: Restored JavaScript files in the 4.4 branch that were unintentionally changed in previous commits.

• Object Cache Drop-in: Added an object cache drop-in to the tests/phpunit/includes directory to avoid relying on external repositories.

New Features

Development Environment Improvements

• Docker-based Local Environment: Backported the Docker-based local WordPress development environment to the 4.4 branch, making it consistent with newer WordPress versions.

• Node.js 14.x Support: Updated the 4.4 branch to support the latest LTS version of Node.js (14.x), allowing the same version to be used across all maintained WordPress branches.

• GitHub Actions Integration: Replaced TravisCI with GitHub Actions for automated testing, including:

  • Workflow dispatch event support for scheduled test runs
  • Parallel jobs for single site and multisite tests
  • Separate parallel jobs for slow tests on PHP ≤ 5.6
  • Better branch and path scoping for pull request workflows

• Package Management Updates: Replaced npm-shrinkwrap.json with a modern package-lock.json file and updated dependencies to their latest compatible versions.

Security Updates

PHPMailer Security Update

• Improved Attachment Handling: Enhanced the security of attachment handling in PHPMailer, addressing potential vulnerabilities in email functionality.

This security improvement was backported from newer WordPress versions to ensure continued security for sites running WordPress 4.4.

Performance Improvements

Testing Performance Enhancements

• Parallel Test Execution: Split single site and multisite tests into parallel jobs to improve testing speed.

• Optimized Test Groups: Removed unused test groups from the 4.4 branch to streamline the testing process.

• Slow Test Isolation: Separated slow tests into dedicated parallel jobs for PHP ≤ 5.6 to prevent timeouts and improve overall test reliability.

Impact Summary

WordPress 4.4.25 is primarily a maintenance and infrastructure update for the 4.4 branch, with minimal impact on end users. The most significant user-facing change is an improvement to PHPMailer's attachment handling, which enhances security for sites using email functionality.

For developers and maintainers, this release modernizes the development toolchain by adding support for Node.js 14.x, introducing a Docker-based local environment, and migrating automated testing to GitHub Actions. These changes align the 4.4 branch's development infrastructure more closely with newer WordPress versions, making it easier to maintain despite its age.

While WordPress 4.4 is no longer officially supported with security updates, this release demonstrates WordPress's commitment to providing courtesy security fixes for older versions when possible. However, site owners should still prioritize upgrading to a current, fully-supported WordPress version for optimal security and functionality.