WordPress Release: 4.9.14

TL;DR

WordPress 4.9.14 is a security and maintenance release that addresses several important issues. This update includes fixes for JSON corruption in the Customizer, user password security improvements, query handling refinements, cache API escaping enhancements, and better UTF-8 character support in filenames. These changes improve security, stability, and internationalization support across the platform.

Highlight of the Release

• Enhanced security for user passwords by invalidating activation keys on password updates
• Improved Customizer stability with additional filters to prevent JSON corruption
• Better support for international characters in file names
• Fixed query handling to ensure proper results for date/time based queries
• Improved cache API escaping for better security

Migration Guide

No specific migration steps are required for this maintenance release. WordPress 4.9.14 is a backward-compatible update that can be safely applied to existing WordPress 4.9.x installations.

As with any WordPress update, it's recommended to:

1. Back up your website before updating
2. Update all themes and plugins to their latest versions
3. Test your website functionality after the update

Upgrade Recommendations

This release contains important security fixes, so upgrading is strongly recommended for all sites running WordPress 4.9.x.

If you're running an older version of WordPress, consider updating to the latest major version (WordPress 5.x) to receive ongoing security updates and access to the latest features, including the block editor.

For sites that must remain on the 4.9 branch for compatibility reasons, updating to 4.9.14 is essential to maintain security.

Bug Fixes

• Query Handling: Fixed an issue where date/time based queries could potentially return multiple posts when only a single result was expected.
• Customizer: Added additional filters to prevent JSON corruption in the Customizer, ensuring more reliable data handling.
• File Name Sanitization: Expanded sanitize_file_name() function to better support UTF-8 characters, improving compatibility with international file names.
• Cache API: Enhanced escaping around the stats method in the cache API to prevent potential security issues.

New Features

No major new features were introduced in this maintenance release. WordPress 4.9.14 focuses on security enhancements and bug fixes to improve the stability and security of existing functionality.

Security Updates

• User Authentication: Enhanced security by ensuring that user_activation_key is properly invalidated when a user updates their password, preventing potential reuse of expired keys.
• Customizer Data Handling: Added additional filters to prevent JSON corruption in the Customizer, which could potentially lead to security vulnerabilities.
• Cache API: Improved escaping around the stats method in the cache API to prevent potential security issues.
• Query Handling: Fixed a potential security issue by ensuring that only a single post can be returned on date/time based queries when appropriate.

Performance Improvements

This release doesn't include specific performance improvements as its primary focus is on security enhancements and bug fixes. However, the improvements to query handling for date/time based queries may result in more efficient database operations in certain scenarios.

Impact Summary

WordPress 4.9.14 is primarily a security and maintenance release that addresses several important issues without introducing major new features or breaking changes.

The security improvements include better handling of user password activation keys, enhanced Customizer data protection, improved cache API escaping, and fixed query handling. These changes collectively strengthen WordPress against potential security vulnerabilities.

The enhancement to file name sanitization with better UTF-8 character support is particularly beneficial for international users, improving the platform's global accessibility.

For developers, the changes to query handling and Customizer filters provide more predictable and secure behavior, while the removal of unused test methods helps maintain a cleaner codebase.

Overall, this release represents WordPress's ongoing commitment to security and stability for the 4.9 branch, which remains important for sites that haven't yet migrated to WordPress 5.x.