VIP Platform Changelog

Core WordPress tests are already validated as running successfully as part of the WordPress release process. Running them without including vip-go-mu-plugins on every change to vip-go-mu-plugins isn’t necessary.

We will continue to run the WordPress core test jobs in CircleCI that include vip-go-mu-plugins on every change to ensure changes work as expected with WordPress core.

https://github.com/Automattic/vip-go-mu-plugins/pull/1910

add_role can lead to database writes which, when called on init, can trigger on the frontend. That is not ideal as it can cause performance problems. It can also lead to undesirable circumstances with other roles being removed if there are intermittent database issues.

We still trigger our upgrade routine on admin_init so new installs still get the VIP Support roles added correctly.

https://github.com/Automattic/vip-go-mu-plugins/pull/1912

We have a couple of CircleCI jobs that run core tests with vip-go-mu-plugins attached for each submitted change. Sometimes vip-go-mu-plugins ends up changing assertions in a core test and those tests need to be excluded since we know they will fail 100% of the time.

https://github.com/Automattic/vip-go-mu-plugins/pull/1909

We need to keep the changelog up to date so that everyone can be informed of changes to our platform. We’re adding processes in to make that a reality and having a reminder in the PR template is a part of facilitating those processes.

https://github.com/Automattic/vip-go-mu-plugins/pull/1907

We’re continuing to clean up code that isn’t 100% compliant with our coding standards.

This change also adds the phpcs:errors NPM script to our package.json. This brings yet another tool for cleaning up existing non-standard code and ensuring all added code is compliant with our standards.

This script is useable by running:

~$ npm run phpcs:errors

The most up to date details on this script are available in our package.json file.

https://github.com/Automattic/vip-go-mu-plugins/pull/1904

#code-standards, #mu-plugins

We upgraded Jetpack 9.2 to Jetpack 9.2.1.

Not a lot of significant changes in this patch release, just bugfixes and compatibility improvements.

Improved compatibility

• Site Health Tools: improve PHP 8 compatibility.
• Twenty Twenty One: add support for Jetpack’s Content Options.

Bug fixes

• Instant Search: fix layout issues with filtering checkboxes with some themes.
• WordPress.com Toolbar: avoid Fatal errors when the feature is not active.
• WordPress.com Toolbar: avoid 404 errors when loading the toolbar.

https://github.com/Automattic/vip-go-mu-plugins/pull/1905

#jetpack

We’ve added two new filters to our login limiting functionality, which gives you the ability to tweak the thresholds for our application-level brute force protections. For example, you may want to lower them during situations with high security sensitivity.

• wpcom_vip_ip_username_login_threshold : how many failed attempts to allow for an IP address and username combination
• wpcom_vip_ip_login_threshold : how many failed attempts to allow for an IP address

For example, if you wanted to only allow one attempt for a group of usernames per IP:

add_filter( 'wpcom_vip_ip_username_login_threshold', function( $threshold, $ip, $username ) {
	if ( 'adminuser' === $username || 'otheradminuser' === $username ) {
		$threshold = 1;
	}

	return $threshold;
}, 10, 3 );

https://github.com/Automattic/vip-go-mu-plugins/pull/1782

When using the Cache Personalization API library, any Vary headers sent before the library was initialized would be overridden. This is no longer the case and all supported Vary headers are now properly supported.

https://github.com/Automattic/vip-go-mu-plugins/pull/1740

We’ve upgraded the Query Monitor plugin to 3.6.4 (previously 3.1.1).

As we’re jumping up a few releases, there are quite a few changes. A few notable ones:

• Dark mode
• Stack trace support for fatal errors
• wp_die() support
• Related Hooks for various panels
• Block debugging support for sites using the Block Editor

Not using Query Monitor yet? Learn how to enable Query Monitor on your environments.

https://github.com/Automattic/vip-go-mu-plugins/pull/1775

We updated the Two Factor plugin to 0.7 (previously 0.6). This version includes numerous bug fixes including better compatibility with password managers like 1Password and fixing an annoying notice about incorrectly registered scripts. Learn more about the changes in the Release Notes.

https://github.com/Automattic/vip-go-mu-plugins/pull/1737

We now set the default $end_date param using the site’s local date (rather than UTC time). Previously, the function could return incorrect data due to the mismatch in timezones.

https://github.com/Automattic/vip-go-mu-plugins/pull/1756

Starting today, any applications created with new GitHub repos will have Content Distribution disabled by default in their non-production environments.

The change was introduced in our VIP Skeleton repo here:

https://github.com/Automattic/vip-go-skeleton/pull/55

If you would like to tweak this behavior, you can remove or adjust the lines in the vip-config.php file in your repo.

Note: This will not impact existing applications or new applications/environments created that use existing GitHub repos.

Learn more about Content Distribution.

#skeleton #jetpack

We’ve pushed a fix to properly clear an internal stats cache for uploaded files. This was causing an incorrect filesize value to be returned after an upload (if done within the same request).

wp> $file = wp_upload_bits( 'hello.txt', 'world' )['file'];
int(5)
wp> filesize( $file );
int(5) <= this would previously return 0

The fix was pushed in our mu-plugins repo here:

https://github.com/Automattic/vip-go-mu-plugins/pull/1741

#mu-plugins