WordPress 6.9.4

WordPress 6.9.4

WordPress 6.9.2 and WordPress 6.9.3 were released yesterday, addressing 10 security issues and a bug that affected template file loading on a limited number of sites.

The WordPress Security Team has discovered that not all of the security fixes were fully applied, therefore 6.9.4 has been released containing the necessary additional fixes.

Because this is a security release, it is recommended that you update your sites immediately.

via https://wordpress.org/news/2026/03/wordpress-6-9-4-release/

Additional changes

• 🔧 Sort composer.json packages alphabetically (#814)

Full Changelog: 1.29.1...1.29.2

v1.29.1

What's Changed

Dependencies

• ⬆️ Bump roots/wordpress to v6.9.3 (#808)
• ⬆️ Bump roots/bedrock-autoloader to v1.1.0 (#809)
  • Add bedrock_autoloader_load_plugins filter to selectively exclude mu-plugins from autoloading
  • Fix plugin discovery when plugins directory doesn't exist or is a symlink
  • Fix plugin counting including non-plugin directories
  • Move synthetic activation hooks to init to prevent fatals on first load
• ⬆️ Bump roots/bedrock-disallow-indexing to v2.1.0 (#812)
  • Display WP_ENVIRONMENT_TYPE in the disallow-indexing dashboard notice

Full Changelog: 1.29.0...1.29.1

v1.29.0

What's Changed

Infrastructure

• ⬆️ Bump minimum PHP to 8.3 (#805)

New features

• ✅ Add Pest testing scaffold (#806)
• ✨ Add opt-in support for WP_DEVELOPMENT_MODE (#803)

Bug fixes

• 🐛 Fix intermittent env loading failures (#800)
• 🐛 Guard WP_ENVIRONMENT_TYPE against redefinition (#802)

Documentation

• 📝 Add DB_HOST note for socket connection issues (#804)
• 📝 Clarify mu-plugins gitignore rule (#801)

Full Changelog: 1.28.5...1.29.0

WordPress 6.9.1

What's Changed

• chore(deps): ⬆️ bump wpackagist-theme/twentytwentyfive to v1.4 by @renovate[bot] in #795
• fix(deps): ⬆️ bump roots/wordpress to v6.9.1 by @renovate[bot] in #799

Full Changelog: 1.28.4...1.28.5

WordPress 6.9

What's Changed

• Composer: Add name to wpackagist repository by @tangrufus in #790
• Remove roave/security-advisories by @retlehs in #791
• Bump roots/wordpress to v6.9 in #794

Full Changelog: 1.28.3...1.28.4

WordPress 6.8.3

What's Changed

• ⬆️ WordPress 6.8.3 by @retlehs in #784
• ⬆️ Twenty Twenty-Five to v1.3 in #777
• 🩹 Fix $webroot_dir phpdoc type by @LucasDemea in #781

New Contributors

• @LucasDemea made their first contribution in #781

Full Changelog: 1.28.2...1.28.3

WordPress 6.8.2

What's Changed

• ⬆️ Bump roots/wordpress to v6.8.2 (#776)

WordPress 6.8.1

What's Changed

• ⬆️ Bump roots/wordpress to v6.8.1 (#772)
• ⬆️ Bump vlucas/phpdotenv to v5.6.2 (#773)

Remove wp-password-bcrypt

What's Changed

Remove roots/wp-password-bcrypt by @dalepgrant (#770)

• https://roots.io/sunsetting-wp-password-bcrypt-with-wordpress-6-8/
• https://make.wordpress.org/core/2025/02/17/wordpress-6-8-will-use-bcrypt-for-password-hashing/
• https://wordpress.org/download/releases/6-8/

WordPress 6.8

What's Changed

• ⬆️ Bump roots/wordpress to v6.8 (#767)
• ⬆️ Bump wpackagist-theme/twentytwentyfive to v1.2 (#769)