Welcome to WP-CLIWP-CLIWP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/https://make.wordpress.org/cli/!
WP-CLI is the official command line tool for interacting with and managing your WordPress sites.
Want to submit your first pull request to WP-CLIWP-CLIWP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/https://make.wordpress.org/cli/? We’ve identified a few good first issues for you to get your feet wet:
A new release of WP-CLIWP-CLIWP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/https://make.wordpress.org/cli/ is available as of today: WP-CLI v2.7.1. For this release, we had 4 contributors collaborate to get 12 pull requests merged.
As always, big thanks to the WP-CLI sponsors that make the continued maintenance possible.
This is a patch release to fix a few regressions that were introduced with release v2.7.0.
Detailed change log
To avoid too much noise in the list above, the following types of pull requests have been omitted:
PRs that only bumped dependencies to their latest version.
Fix PHPPHPPHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. http://php.net/manual/en/intro-whatis.php. 8.1 fatal error with --orderby=size and --size_format=mb [#230]
Avoid throwing error when excluding missing pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party [#332]
A new release of WP-CLIWP-CLIWP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/https://make.wordpress.org/cli/ is available as of today: WP-CLI v2.7.0. For this release, we had 48 contributors collaborate to get 195 pull requests merged. 🎉
As always, big thanks to the WP-CLI sponsors that make the continued maintenance possible. ❤️
This is a small release with the main purpose of getting some much needed bug fixes into a stable version. Nevertheless, we also have a few new features that I’ll want to highlight. As always, you can also skip directly to the detailed changelog if you prefer.
Support for docker-compose run
The --ssh flag and ssh configuration key (and along with them the remote execution aliases) have learned a new scheme: docker-compose-run:.
The docker: and docker-compose: schemes for the ssh option are useful, but they only work when the target container is already running and therefore supports running a shell command via docker[-compose] exec.
With the support of the new docker-compose-run scheme in place you could put the following config into the root of any project that uses wordpressdevelop/cli and then simply use wp <cmd> instead of npm run env:cli -- <cmd> or docker-compose run cli -- <cmd>.
# wp-cli.yml
ssh: docker-compose-run:cli
Customizable global parameters
It was not previously possible to extend the list of parameters without modifying the WP-CLI source files. While we are still considering different options for making the global parameters extensibleExtensibleThis is the ability to add additional functionality to the code. Plugins extend the WordPress core software. via a clean APIAPIAn API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways., we already needed a short-term solution for a specific use case.
Because of this, we now introduced a set of small changes that allow the global parameters to be adapted on a “platform level”. This means that, for now, you can change the global parameters, but only if you control the environment in which WP-CLI is being executed in. This functionality works through the combination of the following changes:
A new constant WP_CLI_CONFIG_SPEC_FILTER_CALLBACK is being checked to filterFilterFilters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. the array that the config-spec.php file has provided.
A new environment variable WP_CLI_EARLY_REQUIRE is checked to allow for the environment to provide extra PHPPHPPHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. http://php.net/manual/en/intro-whatis.php. bootstrapping logic.
You can use both of these to let the WP_CLI_EARLY_REQUIRE load a PHP file that defines a new filter callback and then sets the WP_CLI_CONFIG_SPEC_FILTER_CALLBACK to point to that filter.
This test snippet shows an example of how these two mechanisms can be used in tandem:
Download WordPress CoreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress. files without extracting them
Previously, you could already use the core download command not only to retrieve the set of files from the WordPress central servers. But we did not have a way to solely download a ZIP archive of WordPress Core instead.
Now you can do so via the --extract flag. This is on by default to keep with the current behavior, but you can now switch extraction off by adding the --no-extract flag.
Why would you do that, if it is a single file download you could also trigger via wget or curl? Well, for one, it uses the HTTPHTTPHTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands. stack of WordPress/WP-CLI to do the download. And what’s more, it allows you to use the smart WP-CLI flags like --version to automatically retrieve the file from the right URLURLA specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org.
Directly install a specific locale
Previously, when you wanted to install a locale of WordPress Core other than the default en_US, you had to first run a wp core install, and then switch the locale in a second step.
Now, WP-CLI allows you to select a specific locale right away via core install‘s new --locale flag.
Ordering of the db size results
To quickly see what the biggest tables in your installation are, you can now make use of the new --order and --orderby flags. The most useful example would be to use --orderby=size --order=desc to get the largest tables first.
Clean duplicate metaMetaMeta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. values
Due to limitations of the WordPress database schema, the WordPress importer can end up inadvertently creating duplicate post meta entries if the import is run multiple times.
WP-CLI has now learned a new command to remove duplicate post meta values for a given meta key.
# Delete duplicate post meta.
wp post meta clean-duplicates 1234 enclosure
Success: Cleaned up duplicate 'enclosure' meta values.
Exclude select plugins on certain pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party commands
The plugin commands activate, deactivate, delete and uninstall now accept an additional --exclude flag if you use their --all flag.
The --exclude accepts a comma-separated list of plugin slugs, and allows you to do operations in the vein of “deactivate all plugins except for these few ones”.
# Deactivate all plugins with exclusion
$ wp plugin deactivate --all --exclude=hello,wordpress-seo
Plugin 'contact-form-7' deactivated.
Plugin 'ninja-forms' deactivated.
Success: Deactivated 2 of 2 plugins.
Multiple changes to the i18n support
In our ongoing effort to further internationalization support within GutenbergGutenbergThe Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. https://wordpress.org/gutenberg/, we have made yet another around of i18n changes and additions.
Most of the changes deal with changes to block.json and theme.json, in order to support all the latest fields and mechanisms.
Also, there is now a new update-po command. Up until now, if you added a new translation to one of your plugins, you could update the messages.pot file with make-pot, but you’d have to update existing po files with the new translation by hand. With the new i18n update-po (which is a WP-CLI alternative to msgmerge), you get around this without requiring manual edits.
And finally, i18n now supports PHP Blade templates as an additional input format to parse for translations.
Detailed change log
To avoid too much noise in the list above, the following types of pull requests have been omitted:
PRs that only bumped dependencies to their latest version.
Fix broken tests due to DB connection failure error message change [#224]
Stop reordering most MySQLMySQLMySQL is a relational database management system. A database is a structured collection of data where content, configuration and other options are stored. https://www.mysql.com/. arguments [#221]
Add support for --order, --orderby flags in db size command [#226]
Support filtering for users without a role with --role=none [#360]
Sync user-contributed example to user delete [#358]
Fix JSONJSONJSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. formatting in feature file [#368]
Add post meta clean-duplicates <id> <key> command [#366]
A new release of WP-CLIWP-CLIWP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/https://make.wordpress.org/cli/ is available as of today: WP-CLI v2.6.0. For this release, we had 57 contributors collaborate to get 311 pull requests merged. 🎉
The pandemic is still controlling our daily lives, and as a side-effect we still notice a significant reduction in contributors to WP-CLI, probably due to the lack of in-person contributor days.
As always, big thanks to the WP-CLI sponsors that make the continued maintenance possible – even with a reduced number of contributors. ❤️
Apart from the numerous bug fixes that were included in this release, we also managed to snuggle in a few new features that add to the power or convenience of your CLICLICommand Line Interface. Terminal (Bash) in Mac, Command Prompt in Windows, or WP-CLI for WordPress. experience, so I want to spend a few paragraphs going over some of the noteworthy changes. As always, you can also skip directly to the detailed changelog if you prefer.
PHPPHPPHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. http://php.net/manual/en/intro-whatis.php. 8.1 Support
WP-CLI now officially supports PHP 8.1. All commands are being extensively tested against PHP 8 and the actual development is currently being done on PHP 8.1 as well.
However, keep in mind that PHP 8.1 support is not fully there for WordPress CoreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress., and especially for a large part of plugins and themes. Due to the nature of the changes that PHP 8.1 brings about, it is very easy to break perfectly compatible WordPress Core or WP-CLI via the actions/filters system. Keep this in mind when trying to diagnose PHP 8.1 compatibility issues and trying to deduce where the erroneous code is to be found.
Tabular data showing a timeline with supported PHP releases, with only 8.0 and 8.1 currently in active support.
For those of you who are not closely following the PHP release cycles, please be aware that only PHP 8.0 and 8.1 are currently actively supported versions. WP-CLI sticks with the WordPress Core PHP support policy (+ 1 year), which means we’re still spending huge amounts of efforts to keep everything running all the way down to PHP 5.6 at the moment.
If you want to help the maintainers in their work, please ensure that all your sites run on the latest PHP versions, and nag your hosting providers to move everything over to the latest and greatest. WordPress will only bump the minimum version when the number of active sites on PHP 5.6 has dropped to an insignificant amount.
New commands for managing application passwords
The following commands were added to allow CLI users to create and manage WordPress application passwords:
wp user application-password list
wp user application-password get
wp user application-password exists
wp user application-password update
wp user application-password record-usage
wp user application-password create
wp user application-password delete
WP-CLI examples of creating a new application password and then listing all existing application passwords for that same user.
Although you could technically already work with application passwords by directly controlling the WordPress user-metaMetaMeta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. table, this now provides a clean APIAPIAn API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. that abstracts away the technical implementation. See the Application Passwords: Integration Guide to find out more about how to use them.
New global flag: --context
A new global flag --context=<context> was added which allows users to select the WordPress context in which WP-CLI is supposed to execute its command(s).
One of the main goals is to allow WP-CLI to run updates on premium plugins and themes without requiring any special setup. From our initial testing, this allows a large range of popular premium extensions to just work™️ with WP-CLI in terms of their update procedures.
Possible values for this flag with this initial release:
cli: The context which has been the default before introduction of this flag. This is something in-between a frontend and an admin request, to get around some of the quirks of WordPress when running on the console.
admin: A context that simulates running a command as if it would be executed in the administration backend. This is meant to be used to get around issues with plugins that limit functionality behind an is_admin() check.
auto: Switches between cli and admin depending on which command is being used. For this initial release, all wp plugin * and wp theme * commands will use admin, while all other commands will use cli.
frontend: [WIP] This does nothing yet.
Roadmap: By default, the --context flag will be set to cli with this initial release (v2.6.0). With WP-CLI v2.7.0, the default will change to auto. This gradual deployment will allow hosters and site owners to run tests on v2.6.0 by manually setting the context before the default behavior is changed.
If you want to use the future default of --context=auto right away in your present operations, you can do so by adding the necessary context: auto line to your global wp-cli.yml configuration file. Feel free to check the documentation on WP-CLI configuration files if this is new to you.
We also have a new hook to support this new global flag: before_registering_contexts. This hook behaves like a filterFilterFilters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. with one argument: array<string, Context> $contexts. When hooking into this hook, the callback should return (a potentially modified) $contexts value. This can be used to remove or override bundled contexts or add new ones.
To make this work, the hook functionality in WP-CLI (provided via WP_CLI::do_hook()) was modified to return the first argument if arguments were provided.
Thanks to Cloudways for the special support and testing of this new flag with the goal of solving the “premium updates problem” for everyone.
Configurable WP-CLI cache settings
The WP-CLI file cache can now be configured via the following environment variables:
WP_CLI_CACHE_DIR – Directory in which to store the cached files. Default value: "$home/.wp-cli/cache".
WP_CLI_CACHE_EXPIRY – Time after which cached files are automatically purged, in seconds. Default value: 15552000 (6 months).
WP_CLI_CACHE_MAX_SIZE – Total size of the file cache after which older files are purged, in bytes. Default value: 314572800 (300 MB).
This not only allows you to fine-tune the WP-CLI cache behavior for the best balance between available storage and bandwidth usage, it could also be used to share cache storage between installations/users (beware the security implications, though!).
Use custom names/locations for the wp-config.php file
The different config * commands now accept a new flag --config-file=<filepath> that allow you point the different manipulations towards a custom location, that might not even fully adhere to conventions for the WordPress wp-config.php file.
This allows you for example to use the config set command for a configuration file outside of the WordPress document root (and parent folder).
Keep in mind that you’re on your own when it comes to making WordPress understand the structure and bootstrap correctly!
Generate a dotenv file from your existing wp-config.php file
For all the 12-factor app fans out there, WP-CLI has learnt a new format for its config list command: --format=dotenv. This will take the existing configuration key/value pairs in your wp-config.php file and render them in a format that you can use in a .env file.
WP-CLI example of list the contents of the wp-config.php file into a file in dotenv format and then showing the result.
Combine with the previously mentioned --config-file to extract the dotenv file from an arbitrary location, even without a WordPress installation present.
Allow pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party/theme enumeration without forcing an update check
Previously, when you run plugin list or theme list, WP-CLI would automatically run a check in the background to see if updates are available. This is slow and expensive to do, and might not always be what is needed, especially in scripting scenarios.
This automatic check for updates can now be disabled for these two commands with the --skip-update-check flag. This can drastically speed up some scripts and make them more reliable.
New flag --strict for adapting the filtering of taxonomies by post type
When retrieving taxonomies for a given post type, the old default behavior of WordPress (through the use of get_taxonomies()) is to only show those taxonomies that have as a sole associated post type the requested one. Taxonomies that have multiple associated post types, including the requested one, are not returned.
WordPress had added a newer mechanism via get_object_taxonomies() that would return all taxonomies that are in some way associated with the requested post type, even if other post types are associated as well.
WP-CLI now has a new --strict flag for the taxonomy list command that defines whether the strict filtering (the old default) should be used, or the more sensible inclusive approach should be used via --no-strict (or --strict=false).
We’ve opted to make this new, more sensible approach (i.e. --no-strict) the new default, so be mindful of that if you’re using taxonomy list in a script somewhere.
Another round of improvements to the i18n * commands
As with all of the recent releases, the i18n * commands have received yet another round of overall improvements to keep in sync with the localisation requirements of WordPress Core.
From new flags like --subtract-and-merge, --update-mo-files & --location and multiple improvements to the way JavascriptJavaScriptJavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser. https://www.javascript.com/. syntax is parsed all the way up to the support for the new theme.json format, all your localization needs should be accounted for (at least for now).
Make your to check out the detailed logs to find out more and play around with the new functionality when you get the chance!
With super admin permissions come super admin consequences!
WP-CLI now mirrors the behavior of WordPress core and triggers various hooksHooksIn WordPress theme and development, hooks are functions that can be applied to an action or a Filter in WordPress. Actions are functions performed when a certain event occurs in WordPress. Filters allow you to modify certain functions. Arguments used to hook both filters and actions look the same. when you grant or revoke the super admin status to users.
The following actions are being triggered now but the super-admin add & super-admin remove commands:
revoked_super_admin (after changes, executed only on success)
Changes to the default branches
In order to make the language used in the code and documentation of WP-CLI more inclusive, work has started to change the name of default branch across all repositories. From now on, the default branch name across the WP-CLI GitHubGitHubGitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged be the repository owner. https://github.com/ organization is main.
This change is currently a work in progress, as it unfortunately causes open pull requests to be automatically closed and often become unsalvageable. The current progress of this effort can be monitored here: wp-cli/wp-cli#5598.
Keep this in mind when you want to check out the latest development state of a repository or contribute by creating a PR!
Detailed change log
To avoid too much noise in the list above, the following types of pull requests have been omitted:
PRs that only bumped dependencies to their latest version.
DeployDeployLaunching code from a local development environment to the production web server, so that it's available to visitors. from main branch [#385]
Adapt feature test to use HTTPSHTTPSHTTPS is an acronym for Hyper Text Transfer Protocol Secure. HTTPS is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted. This is especially helpful for protecting sensitive data like banking information. with example.com [#78]
Promote a non-200 response from the cron spawn test to an error [#66]
Update example input to reflect example output [#326]
Document default post type filtering for post list command [#321]
Correct the home URLURLA specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org when listing sites [#312]
Fix categoryCategoryThe 'category' taxonomy lets you group posts / content together that share a common bond. Categories are pre-defined and broad ranging., tag and term names missing in export [#86]
Add the_title_export filter and cdata for item title to export [#77]
Remove now unneeded workaround in JS scanner [#256]
Extract strings for translation from theme.jsonJSONJSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. [#254]
Append new widgets to the bottom of a sidebarSidebarA sidebar in WordPress is referred to a widget-ready area used by WordPress themes to display information that is not a part of the main content. It is not always a vertical column on the side. It can be a horizontal rectangle below or above the content area, footer, header, or any where in the theme. [#52]
Here it finally is, the long-awaited WP-CLIWP-CLIWP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/https://make.wordpress.org/cli/ release v2.5.0! For this release, we had 73 contributors collaborate to get a whopping 600 pull requests merged.
It was a very tough release to get out, as so many different systems and dependencies all broke or had issues at the same time: PHPPHPPHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. http://php.net/manual/en/intro-whatis.php., MySQLMySQLMySQL is a relational database management system. A database is a structured collection of data where content, configuration and other options are stored. https://www.mysql.com/., Travis CI, Composer, Requests, … all of these produced major compatibility issues in a seemingly concerted effort! 😅
More importantly, though, I’m pretty certain that all of the WP-CLI contributors were additionally suffering under the “new normal” of COVID-19 – those contributors lucky enough to still earn regular income during the pandemic are still battling health issues (for themselves and their family), isolation and burnout.
As a maintainer, my initial plan was to devise special events and additional incentives to hopefully raise the level of contribution back up again. But I decided against doing so. Even though we all can’t wait to get a new release out and onto servers, I did not want to add to the additional pressure that the volunteer contributors are already feeling right now. The risks of burnout or other negative effects on mental health have never been so prevalent than now where everyone has to dial down their social support systems. In that perspective, I opted to knowingly go with a longer release time. I am fully aware that a lot of companies had to look into extra workarounds or similar to deal with the late release, but I had to assume that this still happens in a paid capacity. Given the global situation, this seemed more justifiable to me than moving the cost towards volunteer health instead.
Thanks to all the support I had during the extended release time, not least to the WP-CLI sponsors who have allowed me to personally invest as much time as needed into the project to make this release happen.
Now, with that being said, let’s go over some of the noteworthy changes in this release. As always, you can also skip directly to the detailed changelog if you prefer.
Security Fixes
This release fixes one direct and one upstream security vulnerability, so it is recommended for everyone to update to this latest release.
Improper Certificate Validation in WP-CLI framework
This security vulnerability is categorized as CWE-295: Improper Certificate Validation with a CSSCSSCSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. V3 severity rating of ‘high‘ and was disclosed as CVE-2021-29504 (GitHubGitHubGitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged be the repository owner. https://github.com/ security advisory GHSA-rwgm-f83r-v3qj).
An improper error handling in HTTPSHTTPSHTTPS is an acronym for Hyper Text Transfer Protocol Secure. HTTPS is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted. This is especially helpful for protecting sensitive data like banking information. requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself.
The vulnerability stems from the fact that the default behavior of WP_CLI\Utils\http_request() when encountering a TLS handshake error is to disable certificate validation and retry the same request.
The default behavior has been changed with version 2.5.0 of WP-CLI and the wp-cli/wp-cli framework (via wp-cli/wp-cli#5523) so that the WP_CLI\Utils\http_request() method accepts an $insecure option that is false by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of WP_CLI\Utils\http_request(), including those in separate WP-CLI bundled or third-party packages.
Insecure Deserialization of untrusted data in upstream Requests library
The vulnerability was found in the FilteredIterator class and was first reported to the WordPress project. The security fix applied to WordPress has been ported back into the Requests library and was distributed with release v1.8.0.
Breaking Changes
The security fix for CVE-2021-29504 detailed above led to a breaking change where the retry behavior of commands that use remote requests is disabled. Furthermore, the framework is stricter in making use of the certificates that are provided via environment settings.
This means that automated systems that previously succeeded with reliable downloads of external assets can now start to fail because there is an issue with the certificate verification. This can be due to either the environment being misconfigured for certificate verification or the server to connect to actually being insecure.
To get back to the previous behavior, the affected commands now include a new --insecure flag that re-enables the insecure retrying mechanism again. Beware: This opens up these remote requests to man-in-the-middle attacks!
The following commands were affected and were adapted to recognize this new --insecure flag:
cli update
config create
config shuffle-salts
core download
core update
core verify-checksums
package install
plugin install
plugin update
plugin verify-checksums
theme install
theme update
PHP 8 support
WP-CLI now officially supports PHP 8. All commands are being extensively tested against PHP 8 and the actual development is currently being done on PHP 8 as well.
However, keep in mind that PHP 8 support is not fully there for WordPress CoreCoreCore is the set of software required to run WordPress. The Core Development Team builds WordPress., and especially for a large part of plugins and themes. Due to the nature of the changes that PHP 8 brings about, it is very easy to break perfectly compatible WordPress Core or WP-CLI via the actions/filters system. Keep this in mind when trying to diagnose PHP 8 compatibility issues and trying to deduce where the erroneous code is to be found.
Improved MySQL/MariaDB support
As it turns out, WordPress Core has not been compatible with a default MySQL database for a while now. What actually happens is that WordPress switches the database in a sort of “legacy” mode at runtime. This has caused the WP-CLI code that uses WPDB to slowly diverge in results from the code that makes direct database requests via the mysql shell binary.
This has now been rectified (at least for all of the major use cases) by letting WP-CLI employ the same “legacy” database mode via a few hacks around the mysql binary.
Package Manager is now powered by Composer v2
Composer v2 has drastically improved both the processing time as well as the memory usage of its dependency resolution mechanisms. And now the WP-CLI Package Manager that you can use via wp package * commands gets to benefit from these same improvements, at it internally uses the new Composer v2 code.
This should also make the dreaded Out-Of-Memory problems with package installation much rarer, even on shared hosting or tight Docker containers.
New commands for managing automatic updates
The following commands were added to allow you to manage the state of automatic updates for plugins and themes:
plugin auto-updates disable
plugin auto-updates enable
plugin auto-updates status
theme auto-updates disable
theme auto-updates enable
theme auto-updates status
Although you could technically already work on the state of the automatic updates by directly controlling the WordPress Options table, this now provides a clean APIAPIAn API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. that abstracts away the technical implementation.
New command for creating MO files
A new command was added to the wp-cli/i18-command package for creating MO files from existing PO files. This can be useful if you use a translation platform that can only output PO files, or tooling that modifies these files.
// Reads from a single .po file.
$ wp i18n make-mo ./wp-content/languages/slug.po
Success: Created 1 file.
// Reads from a directory for multiple .po files.
$ wp i18n make-mo ./wp-content/languages/
Success: Created 5 files.
Smarter I18N handling of JS files
The ongoing effort to improve the internationalization of client-side JavascriptJavaScriptJavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser. https://www.javascript.com/. code that is made necessary by the move to the blockBlockBlock is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience.-based editor has led to a number of improvements to the i18n make-pot command.
Apart from understanding more complex Javascript constructs, like webpack bundling and JS eval() statements, the i18n make-pot now also parses the new block.json file as it is defined in the Block Type Registration RFC. This can optionally be skipped via the new --skip-block-json flag.
New environment variable: WP_CLI_ALLOW_ROOT
When you’ve been using WP-CLI within a Docker container, you’ve probably noticed the big “YIKES!” message you get that aborts the execution of the command if it detects that you’re running as root. You’d then have to add the --allow-root flag to every single command you run within that container.
Within a docker container, everything is done as the root user, though, and there’s no really security issue, as the container itself acts as a sandbox. Therefore, WP-CLI now allows you to let it know not to warn about the root user via the new WP_CLI_ALLOW_ROOT environment variable. Just set this variable through in your container’s ENV section, and you’re good to go – no need for multiple --allow-root flags anymore.
New global parameter: --exec
Some scenarios require you to run a small PHP snippet before the actual WP-CLI command, to make sure the command runs under the right context or encounters the right environment. You would typically do this by creating a PHP file with the code snippet that needs to be executed and then using the --require global parameter to load that file upfront before the command gets executed.
This is very cumbersome for short snippets, though, or not even easily possible on read-only filesystems. Therefore, WP-CLI now also accepts a new global parameter --exec that you can use to execute PHP logic directly from the command-line before running the actual command.
The WP-CLI package manager now supports GitLab URLs. This means you can host your custom commands on GitLab and still easily install them right from the VCS:
Chunked queries in search-replace to avoid memory issues
When you need to run a search & replace operation on a very large database, you can easily run into memory issues. WP-CLI tried to fetch all matching query results into memory to loopLoopThe Loop is PHP code used by WordPress to display posts. Using The Loop, WordPress processes each post to be displayed on the current page, and formats it according to how it matches specified criteria within The Loop tags. Any HTML or PHP code in the Loop will be processed on each post. https://codex.wordpress.org/The_Loop. over them.
This type of operation is now processed via a chunked loop that works on 1000 query results at a time via pagination. This drastically reduces the memory requirements and decouples them from the database size.
This is just the first command that receives this treatment, but expect to see more of such scalability fixes in the future.
Hide global parameters help
If you’re a more seasoned WP-CLI, you might have been annoyed from time to time about the wasted screen real estate on the help screens that always append the list of global parameters every single time.
You can now choose to skip the display of these global parameters by setting the following environment variable:
export WP_CLI_SUPPRESS_GLOBAL_PARAMS=true
All the help screens will then only display the help for the current context.
Switch from Travis CI to GitHub Actions
For multiple different reasons, I decided to move away from Travis CI, and I ended up migrating the entire infrastructure (testing, automation, deployment, publication, …) over to GitHub Actions.
You will now find a .github/workflows folder in each of the repositories that contains a set of workflows for that repository. However, we also have a new wp-cli/.github repository. This contains centralized workflows that mostly deal with keeping the workflows and configurations across all of the other repositories in sync.
This means that, when I now need to make a change in the testing workflow, for example, I don’t need to manually create a pull request in each of the packages. I modify the template workflow in the wp-cli/.github repository instead, and this one then syncs all the changes over to the individual repositories.
The added automation details, as well as the much improved parallelization of running the tests in GitHub Actions has drastically accelerated the development experience and ultimately leads to faster and cheaper maintenance of the entire project.
Documentation is automatically kept in sync
If you’ve contributed to one of the commands before, I might have required you to install the wp-cli/scaffold-package-command package and run a cryptic command on your PR to get the README.md file updated based on changes in the code’s docblocks. This was an awful contributor experience and I wanted to get rid of that requirement.
When I initially experimented with a git hook to automatically add a commit on PRs when they are pushed, I realized that that approach leads down to a path of merge conflicts and confusion.
The move from Travis CI to GitHub Actions was a good opportunity to revisit this, as I have now solved this problem via an automated GitHub Actions workflow. Whenever changes are pushed to the default branch of a repository, the GitHub Actions bot will try to regenerate the documentation and if this actually produced any changes, it creates a new pull request with the needed patch.
This PR can then be reviewed and merged just like any other contribution. It happens independently of the code change a contributor submitted, so they don’t need to worry about any of this.
MigrationMigrationMoving the code, database and media files for a website site from one server to another. Most typically done when changing hosting companies. to Behat v3
WP-CLI has been stuck with Behat v2 for quite a while now, and this also had an impact on the dependencies we needed to rely on. This made the move to PHP 8 compatibility all the more difficult. Therefore wp-cli/wp-cli-tests was updated to migrate from Behat v2 to Behat v3.
Apart from multiple improvements of the syntax and its execution, this also finally makes it easy to reuse the functional testing infrastructure outside of a wp-cli package. Expect to see a guide on how to migrate your own package code to Behat v3 as well as on how to use wp-cli/wp-cli-tests within other contexts soon.
More flexible test setup
The test setup was made way more configurable to adapt to less standardized environments. Where it was previously difficult to run the tests on a non-traditional stack like a Docker network or a GitHub Actions environment, this can now be easily done via a set of new environment variables.
The database credentials can now be provided via the following environment variables:
WP_CLI_TEST_DBHOST
host to use and can include a port, i.e “127.0.0.1:33060”
localhost
WP_CLI_TEST_DBROOTUSER
user that has permission to administer databases and users
root
WP_CLI_TEST_DBROOTPASS
password to use for the above user
(empty password)
WP_CLI_TEST_DBUSER
user that the tests run under
wp_cli_test
WP_CLI_TEST_DBPASS
password to use for the above user
password1
Provided that these environment variables are present and that your database is online, a simple composer prepare-tests will take care of everything.
Detailed change log
To avoid too much noise in the list above, the following types of pull requests have been omitted:
PRs that dealt with Travis CI and its many issues, as Travis CI has now been replaced with GitHub Actions. Note that the PRs that switched from Travis CI to GitHub Actions are still included, as these often include fixes in the tests or even in the actual code to make the tests pass again on GHA.
PRs that only bumped a single dependency to its latest version.
Move fetcher implementations back into framework [#5527]
Add WpOrgApi abstraction to handle WordPress.orgWordPress.orgThe community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ API requests [#5526]
[BREAKING CHANGE] Disable automatic retry by default on certificate validation error [#5523]
Add missing $pipes variables when creating processes [#5522]
Harden error message on failed cache directory creation [#5520]
Update docblocks for methods that accept error objects [#5516]
[BREAKING CHANGE] Use custom certificate if provided [#5514]
[BREAKING CHANGE] Respect provided verify option in Utils\http_request [#5507]
Add $interactive arg for run_mysql_command() [#5420]
Add support for comma-separated flag values [#5419]
Fix SERVER_PORTJSONJSONJSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. encoding failure [#5417]
Create a default global config file if it does not exist [#5411]
Updated minimum required PHP version to 5.6 [#5408]
Include classmap in order to fix Composer 2 deprecation notices [#5407]
Bump PHPCS compatibility tests to new PHP 5.6+ minimum [#5406]
Throw exception when misusing error_to_string() [#5405]
Prevent array access notice when $update_info is null [#214]
Add missing --network parameter for plugin is-active [#222]
Don’t show a warning when theme delete --all skips the active theme [#218]
Deny --dry-run usage when requiring a specific version [#236]
Bump PHPCS compatibility tests to new PHP 5.6+ minimum [#235]
Allow for filtering multiple field values for the list command [#234]
Validate the --statusfilterFilterFilters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. passed to wp plugin list and wp theme list [#229]
Add commands to manage auto-updates for plugins and themes [#259]
Provide clear error message when pluginPluginA plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party fails PHP requirement [#253]
You must be logged in to post a comment.