Bringing the new theme directory under the WordPress “extend” umbrella allowed us to take advantage of all the infrastructure that has already been built up to support WordPress.org. If you’ve browsed through the plugin directory, you’ll feel right at home in the new theme directory.

We’ve gone through great lengths to make this as painless as possible for theme authors. You don’t need to know anything about Subversion (our back end magic takes care of all that for you), just login with your WordPress.org username and password and go to the upload page. From there you upload your regular theme zip file and we take care of the rest.

Once you upload your new theme we do a few automated checks for some of the requirements for each theme. If we find one that you missed we’ll provide you an error and description of what needs to be fixed. When a theme upload has been accepted we’ll send you an email and put it in the queue to be reviewed, to make sure we didn’t miss anything. After the theme has been approved you’ll get another email letting you know that the theme is now live.

That catches you up to where we’re at today. When you finish that theme you’ve been slaving over, upload it to the new directory and let us know what you think. Since so much has changed since the old theme directory we’re starting fresh from zero. If you’ve got specific questions or suggestions contact us and we’ll do our best to get them answered.

It’s been a long time since themes.wordpress.net stopped accepting new themes. Since then most theme authors have been distributing their themes from their own sites, without a good centralized place for people to browse, search, comment on, and rate themes. With the success of the plugins directory, we’ve wanted to have those same benefits in a theme directory. Today is the day we start making that happen, with the introduction of wordpress.org/extend/themes/.

Bringing the new theme directory under the WordPress “extend” umbrella allowed us to take advantage of all the infrastructure that has already been built up to support WordPress.org. If you’ve browsed through the plugin directory, you’ll feel right at home in the new theme directory.

We’ve gone through great lengths to make this as painless as possible for theme authors. You don’t need to know anything about Subversion (our back end magic takes care of all that for you), just login with your WordPress.org username and password and go to the upload page. From there you upload your regular theme zip file and we take care of the rest.

Once you upload your new theme we do a few automated checks for some of the requirements for each theme. If we find one that you missed we’ll provide you an error and description of what needs to be fixed. When a theme upload has been accepted we’ll send you an email and put it in the queue to be reviewed, to make sure we didn’t miss anything. After the theme has been approved you’ll get another email letting you know that the theme is now live.

That catches you up to where we’re at today. When you finish that theme you’ve been slaving over, upload it to the new directory and let us know what you think. Since so much has changed since the old theme directory we’re starting fresh from zero. If you’ve got specific questions or suggestions contact us and we’ll do our best to get them answered.

I’m happy to announce that version 2.6 of WordPress.org is now available, almost a month ahead schedule. Version 2.6 “Tyner,” named for jazz pianist McCoy Tyner, contains a number of new features that make WordPress a more powerful CMS: you can now track changes to every post and page and easily post from wherever you are on the web, plus there are dozens of incremental improvements to the features introduced in version 2.5.

We’ve prepared a brief video tour of 2.6, if you have 3 minutes and 29 seconds to spare, it’s worth a watch:

If you’d like to embed the tour video in your blog, copy and paste this code for the high quality version:

<embed src="http://v.wordpress.com/mARhRBcT/fmt_dvd" type="application/x-shockwave-flash" width="640" height="385" flashvars="blog_domain=http://wordpress.org/development/2008/07/wordpress-26/&width=640&height=385"> </embed>

And here’s a smaller version, 400 pixels wide:

<embed src="http://v.wordpress.com/mARhRBcT/fmt_std" type="application/x-shockwave-flash" width="400" height="250" flashvars="blog_domain=http://wordpress.org/development/2008/07/wordpress-26/&width=400&height=250"> </embed>

Here’s a more textual overview of what’s hawt in 2.6:

Post Revisions: Wiki-like tracking of edits

With the power of modern computers, it’s silly that we still use save and editing metaphors from the time when the most common method of storage was floppy disks. WordPress has always respected the importance of your writing with auto-save, and now we’re taking that to another level by allowing you to view who made what changes when to any post or page through a super-easy interface, much like Wikipedia or a version control system.

This is handy on any blog in case you make a mistake and want to go back to an older version of a post, and it’s super handy for multi-author blogs where you can see every change tracked by person.

Press This!: Post from wherever you are on the web

A few months ago on my blog we started a conversation about the posting bookmarklet in WordPress and which systems we should look to for inspiration, like Flock, FriendFeed, Facebook, Tumblr, and Delicious. From these suggestions and the Quick Post plugin by Josh Kenzer, we developed a Press This bookmark you can add to your toolbar that provides a fast and smart popup to do posts to your WordPress blog:

For example, if you click “Press This” from a Youtube page it’ll magically extract the video embed code, and if you do it from a Flickr page it’ll make it easy for you to put the image in your post. On my blog I’ve been experimenting with using different categories and the in_category() function — such as video, quote, aside, et cetera — to create a more tumblelog-like format.

Shift Gears: Turbo-speed your blogging

Gears is an open source browser extension project started by Google that developers like us can use to give you features we wouldn’t normally be able to. There are a lot of things we can do with Gears in the future, but in this release we’ve stuck to using what’s called a “Local Server” to cache or keep a copy of commonly-used Javascript and CSS files on your computer, which can speed up the loading of some pages by several seconds (they just pop right up!). You can install Gears for Firefox or Internet Explorer, with support for Safari and Opera pending. WordPress works just fine without it, you just get a little extra juice when you have it installed.

Theme Previews: See it before your audience does

Now when you select a theme it pops up a window that shows the theme live with all your content, instead of immediately making it active on your site. This is great for just test driving themes before making a switch over publicly, and it is also helpful when you are developing a theme and need to test it but don’t want everybody to see your ongoing mistakes development.

Here are some of the smaller features and improvements in 2.6:

• Word count! Never guess how many words are in your post anymore.
• Image captions, so you can add sweet captions like Political Ticker does under your images.
• Bulk management of plugins.
• A completely revamped image control to allow for easier inserting, floating, and resizing. It’s now fully integrated with the WYSIWYG.
• Drag-and-drop reordering of Galleries.
• Plugin update notification bubble.
• Customizable default avatars.
• You can now upload media when in full-screen mode.
• Remote publishing via XML-RPC and APP is now secure (off) by default, but you can turn it on easily through the options screen.
• Full SSL support in the core, and the ability to force SSL for security.
• You can now have many thousands of pages or categories with no interface issues.
• Ability to move your wp-config file and wp-content directories to a custom location, for “clean” SVN checkouts.
• Select a range of checkboxes with “shift-click.”
• You can toggle between the Flash uploader and the classic one.
• A number of proactive security enhancements, including cookies and database interactions.
• Stronger better faster versions of TinyMCE, jQuery, and jQuery UI.
• Version 2.6 fixes approximately 194 bugs.

Developer Notes

WordPress.org had over 75 people contributing code to WordPress 2.6. In addition to the core commit team we had contributions from Dion Hulse, Austin Matzko, Otto42, Benedict Eastaugh, and pishmishy. AaronCampbell and Marco Zehe provided more than a few patches. Back among the top code contributors is Jacob Santos. Alex Concha continues to have WordPress’ back. Joining bug reporting and gardening elite are hakre, Simon Wheatley, mtekk, and Matty Rob. Finally, congratulations to our Peter Westwood on your recent wedding! I’m also proud to announce we’re adding a new core committer to the team: Andrew Ozz (azaozz) has been a huge help to the core team this year, particularly around TinyMCE and making the WYSIWYG something that works for you, not against you.

Because of the new capabilities to make WordPress a clean SVN checkout, plugin and theme authors should do their best to handle forms and posts through WP rather than trying to post to their files directly, here’s a quick Codex article about how to do it using our forward-compatible APIs.

Upgrading

2.6 is pretty much identical to 2.5 from a plugin and theme compatibility point of view, so upgrades from 2.5 should be pretty painless. The 2.5 branch will no longer be maintain so everyone is encouraged to upgrade. Our standard 3-step upgrade instructions apply to this release. There were at least 1,984,047 downloads of the 2.5 series, the fastest growing release we’ve ever had, and I think all of those people will find 2.6 adds a level of polish that really makes WP a pleasure to use every day. (At least I do. :))

Easter Egg

There have been rumors and allegations that there was a so-called “easter egg” added to 2.6 early in its development. These rumors and allegations are completely false!

P.S. If you’re a fan of WordPress, consider joining our fan page on Facebook.

I’m happy to announce that version 2.6 of WordPress.org is now available, almost a month ahead schedule. Version 2.6 “Tyner,” named for jazz pianist McCoy Tyner, contains a number of new features that make WordPress a more powerful CMS: you can now track changes to every post and page and easily post from wherever you are on the web, plus there are dozens of incremental improvements to the features introduced in version 2.5.

We’ve prepared a brief video tour of 2.6, if you have 3 minutes and 29 seconds to spare, it’s worth a watch:

If you’d like to embed the tour video in your blog, copy and paste this code for the high quality version:

<embed src="http://v.wordpress.com/mARhRBcT/fmt_dvd" type="application/x-shockwave-flash" width="640" height="385" flashvars="blog_domain=http://wordpress.org/development/2008/07/wordpress-26/&width=640&height=385"> </embed>

And here’s a smaller version, 400 pixels wide:

<embed src="http://v.wordpress.com/mARhRBcT/fmt_std" type="application/x-shockwave-flash" width="400" height="250" flashvars="blog_domain=http://wordpress.org/development/2008/07/wordpress-26/&width=400&height=250"> </embed>

Here’s a more textual overview of what’s hawt in 2.6:

Post Revisions: Wiki-like tracking of edits

With the power of modern computers, it’s silly that we still use save and editing metaphors from the time when the most common method of storage was floppy disks. WordPress has always respected the importance of your writing with auto-save, and now we’re taking that to another level by allowing you to view who made what changes when to any post or page through a super-easy interface, much like Wikipedia or a version control system.

This is handy on any blog in case you make a mistake and want to go back to an older version of a post, and it’s super handy for multi-author blogs where you can see every change tracked by person.

Press This!: Post from wherever you are on the web

A few months ago on my blog we started a conversation about the posting bookmarklet in WordPress and which systems we should look to for inspiration, like Flock, FriendFeed, Facebook, Tumblr, and Delicious. From these suggestions and the Quick Post plugin by Josh Kenzer, we developed a Press This bookmark you can add to your toolbar that provides a fast and smart popup to do posts to your WordPress blog:

For example, if you click “Press This” from a Youtube page it’ll magically extract the video embed code, and if you do it from a Flickr page it’ll make it easy for you to put the image in your post. On my blog I’ve been experimenting with using different categories and the in_category() function — such as video, quote, aside, et cetera — to create a more tumblelog-like format.

Shift Gears: Turbo-speed your blogging

Gears is an open source browser extension project started by Google that developers like us can use to give you features we wouldn’t normally be able to. There are a lot of things we can do with Gears in the future, but in this release we’ve stuck to using what’s called a “Local Server” to cache or keep a copy of commonly-used Javascript and CSS files on your computer, which can speed up the loading of some pages by several seconds (they just pop right up!). You can install Gears for Firefox or Internet Explorer, with support for Safari and Opera pending. WordPress works just fine without it, you just get a little extra juice when you have it installed.

Theme Previews: See it before your audience does

Now when you select a theme it pops up a window that shows the theme live with all your content, instead of immediately making it active on your site. This is great for just test driving themes before making a switch over publicly, and it is also helpful when you are developing a theme and need to test it but don’t want everybody to see your ongoing mistakes development.

Here are some of the smaller features and improvements in 2.6:

• Word count! Never guess how many words are in your post anymore.
• Image captions, so you can add sweet captions like Political Ticker does under your images.
• Bulk management of plugins.
• A completely revamped image control to allow for easier inserting, floating, and resizing. It’s now fully integrated with the WYSIWYG.
• Drag-and-drop reordering of Galleries.
• Plugin update notification bubble.
• Customizable default avatars.
• You can now upload media when in full-screen mode.
• Remote publishing via XML-RPC and APP is now secure (off) by default, but you can turn it on easily through the options screen.
• Full SSL support in the core, and the ability to force SSL for security.
• You can now have many thousands of pages or categories with no interface issues.
• Ability to move your wp-config file and wp-content directories to a custom location, for “clean” SVN checkouts.
• Select a range of checkboxes with “shift-click.”
• You can toggle between the Flash uploader and the classic one.
• A number of proactive security enhancements, including cookies and database interactions.
• Stronger better faster versions of TinyMCE, jQuery, and jQuery UI.
• Version 2.6 fixes approximately 194 bugs.

Developer Notes

WordPress.org had over 75 people contributing code to WordPress 2.6. In addition to the core commit team we had contributions from Dion Hulse, Austin Matzko, Otto42, Benedict Eastaugh, and pishmishy. AaronCampbell and Marco Zehe provided more than a few patches. Back among the top code contributors is Jacob Santos. Alex Concha continues to have WordPress’ back. Joining bug reporting and gardening elite are hakre, Simon Wheatley, mtekk, and Matty Rob. Finally, congratulations to our Peter Westwood on your recent wedding! I’m also proud to announce we’re adding a new core committer to the team: Andrew Ozz (azaozz) has been a huge help to the core team this year, particularly around TinyMCE and making the WYSIWYG something that works for you, not against you.

Because of the new capabilities to make WordPress a clean SVN checkout, plugin and theme authors should do their best to handle forms and posts through WP rather than trying to post to their files directly, here’s a quick Codex article about how to do it using our forward-compatible APIs.

Upgrading

2.6 is pretty much identical to 2.5 from a plugin and theme compatibility point of view, so upgrades from 2.5 should be pretty painless. The 2.5 branch will no longer be maintain so everyone is encouraged to upgrade. Our standard 3-step upgrade instructions apply to this release. There were at least 1,984,047 downloads of the 2.5 series, the fastest growing release we’ve ever had, and I think all of those people will find 2.6 adds a level of polish that really makes WP a pleasure to use every day. (At least I do. :))

Easter Egg

There have been rumors and allegations that there was a so-called “easter egg” added to 2.6 early in its development. These rumors and allegations are completely false!

P.S. If you’re a fan of WordPress, consider joining our fan page on Facebook.

On Tuesday, May 27th, WordPress will turn 5 years old. We’ve come a long way from that original 0.7 release.

To celebrate we’re throwing a party in San Francisco at 111 Minna, starting at 9PM. You can get the full details and RSVP on Upcoming.org or on Facebook.

I hope you see some of you there, should be a fun time.

If you host a party in your area for WordPress’ 5th, let us know and we’ll post it here.

Update: Party in Sydney! Blog post, Facebook.

On Tuesday, May 27th, WordPress will turn 5 years old. We’ve come a long way from that original 0.7 release.

To celebrate we’re throwing a party in San Francisco at 111 Minna, starting at 9PM. You can get the full details and RSVP on Upcoming.org or on Facebook.

I hope you see some of you there, should be a fun time.

If you host a party in your area for WordPress’ 5th, let us know and we’ll post it here.

Update: Party in Sydney! Blog post, Facebook.

We’re doing some usability testing in New York City.  Join in if you’re in the area.

We’re doing some usability testing in New York City.  Join in if you’re in the area.

WordCamps are my favorite events to go to because there’s something about the core WordPress community that attracts smart folks with good philosophies that are fun to hang out with. In this post I’ve collated the upcoming WordCamps we know about, including the one in San Francisco. Hopefully there will be one nearby so you can meet other WordPressers in your area.

WordCamp San Francisco will be August 16 at the Mission Bay Conference Center.

WordCamp Paris will be on May 3rd. Here’s their official site.

WordCamp Italy in Milan will be May 10th. (And I believe I’ll be there.)

WordCamp Birmingham UK will be July 19-20.

WordCamp Toronto will be October 4th.

There are people in the planning stages in Australia, Philippines, Beijing, Utah, Hawaii, UK, NYC, and possibly others, so if you live in one of those areas and would like to help set up a WordCamp in your area Google around or connect with bloggers in your area.

You can always find out more at WordCamp Central.

WordCamps are my favorite events to go to because there’s something about the core WordPress community that attracts smart folks with good philosophies that are fun to hang out with. In this post I’ve collated the upcoming WordCamps we know about, including the one in San Francisco. Hopefully there will be one nearby so you can meet other WordPressers in your area.

WordCamp San Francisco will be August 16 at the Mission Bay Conference Center.

WordCamp Paris will be on May 3rd. Here’s their official site.

WordCamp Italy in Milan will be May 10th. (And I believe I’ll be there.)

WordCamp Birmingham UK will be July 19-20.

WordCamp Toronto will be October 4th.

There are people in the planning stages in Australia, Philippines, Beijing, Utah, Hawaii, UK, NYC, and possibly others, so if you live in one of those areas and would like to help set up a WordCamp in your area Google around or connect with bloggers in your area.

You can always find out more at WordCamp Central.

Version 2.5.1 of WordPress is now available. It includes a number of bug fixes, performance enhancements, and one very important security fix. We recommend everyone update immediately, particularly if your blog has open registration. The vulnerability is not public but it will be shortly.

In addition to the security fix, 2.5.1 contains many bug fixes. If you are interested only in the security fixes, you can download these corrected copies of wp-includes/pluggable.php, wp-admin/includes/media.php, and wp-admin/media.php. Replace your existing copies of these files with these new copies.

If you download the entire 2.5.1 release, you will be getting over 70 other fixes. 2.5.1 focuses on fixing the most annoying bugs and improving performance. Here are some highlights:

• Performance improvements for the Dashboard, Write Post, and Edit Comments pages.
• Better performance for those who have many categories
• Media Uploader fixes
• An upgrade to TinyMCE 3.0.7
• Widget Administration fixes
• Various usability improvements
• Layout fixes for IE

Secret lives of blogs

Since 2.5 your wp-config.php file allows a new constant called SECRET_KEY which basically is meant to introduce a little permanent randomness into the cryptographic functions used for cookies in WordPress. You can visit this link we set up to get a unique secret key for your config file. (It’s unique and random on every page load.) Having this line in your config file helps secure your blog.

Many thanks to Steven Murdoch for responsibly reporting the security issue (CVE-2008-1930) and Alex Concha for reporting an XSS issue.

Version 2.5.1 of WordPress is now available. It includes a number of bug fixes, performance enhancements, and one very important security fix. We recommend everyone update immediately, particularly if your blog has open registration. The vulnerability is not public but it will be shortly.

In addition to the security fix, 2.5.1 contains many bug fixes. If you are interested only in the security fixes, you can download these corrected copies of wp-includes/pluggable.php, wp-admin/includes/media.php, and wp-admin/media.php. Replace your existing copies of these files with these new copies.

If you download the entire 2.5.1 release, you will be getting over 70 other fixes. 2.5.1 focuses on fixing the most annoying bugs and improving performance. Here are some highlights:

• Performance improvements for the Dashboard, Write Post, and Edit Comments pages.
• Better performance for those who have many categories
• Media Uploader fixes
• An upgrade to TinyMCE 3.0.7
• Widget Administration fixes
• Various usability improvements
• Layout fixes for IE

Secret lives of blogs

Since 2.5 your wp-config.php file allows a new constant called SECRET_KEY which basically is meant to introduce a little permanent randomness into the cryptographic functions used for cookies in WordPress. You can visit this link we set up to get a unique secret key for your config file. (It’s unique and random on every page load.) Having this line in your config file helps secure your blog.

Many thanks to Steven Murdoch for responsibly reporting the security issue (CVE-2008-1930) and Alex Concha for reporting an XSS issue.

An Event Apart is a web design and development conference which features some of the same fine folks who helped out with WordPress 2.5. (And many others.) I attended the one in Chicago a while back and was engaged the whole day in interesting talks on design, writing copy as interface, advanced CSS, and creativity — each topic presented by the leading folks in the field.

The conference normally costs just under a thousand dollars to attend, which is well worth it, but because of our association with the folks they’ve set up a discount for WordPress users.

If you enter AEAWP on checkout the price drops to $795, or $200 below the regular registration fee. The coupon is unlimited, and can be used for one ticket or five. They have events coming up in New Orleans, Boston, San Francisco, and Chicago. You can learn more and register on their site at aneventapart.com.

We’ll also have some final dates for WordCamp San Francisco coming up, I’ll be posting those soonish so people can start making vacation and travel plans. (Nothing like a blogging vacation.)

An Event Apart is a web design and development conference which features some of the same fine folks who helped out with WordPress 2.5. (And many others.) I attended the one in Chicago a while back and was engaged the whole day in interesting talks on design, writing copy as interface, advanced CSS, and creativity — each topic presented by the leading folks in the field.

The conference normally costs just under a thousand dollars to attend, which is well worth it, but because of our association with the folks they’ve set up a discount for WordPress users.

If you enter AEAWP on checkout the price drops to $795, or $200 below the regular registration fee. The coupon is unlimited, and can be used for one ticket or five. They have events coming up in New Orleans, Boston, San Francisco, and Chicago. You can learn more and register on their site at aneventapart.com.

We’ll also have some final dates for WordCamp San Francisco coming up, I’ll be posting those soonish so people can start making vacation and travel plans. (Nothing like a blogging vacation.)

WordPress 2.5, the culmination of six months of work by the WordPress community, people just like you. The improvements in 2.5 are numerous, and almost entirely a result of your feedback: multi-file uploading, one-click plugin upgrades, built-in galleries, customizable dashboard, salted passwords and cookie encryption, media library, a WYSIWYG that doesn’t mess with your code, concurrent post editing protection, full-screen writing, and search that covers posts and pages.

For a short overview of the features with screenshots, it’d be best to visit our sneak peek announcement for RC1. Or check out a 4-minute screencast of the new interface in action. If you just want to jump straight to the good stuff here’s where you can find 2.5 upgrade and download information.

If you want to see everything I would grab a cup of coffee or a mojito, because this post is epic.

User Features

Cleaner, faster, less cluttered dashboard — we’ve worked hard to take your feedback about what’s most important in the dashboard and organize things to allow you to focus on what’s important — your blog — and get out of your way. In collaboration with Happy Cog and the community we’ve taken the first major step forward in the WordPress interface since version 1.5.

Dashboard Widgets — the dashboard home page is now a series of widgets, including ones to show you fun stats about your posting, latest comments, people linking to you, new and popular plugins, and of course WordPress news. You can customize any of the dashboard widgets to show, for example, news from your local paper instead of WP news. Plugins can also hook in, for example the WordPress.com stats widget adds a handy double-wide stats box.

Multi-file upload with progress bar — before when you would upload a large file you’d wait forever, never knowing how far along it was. And uploading more than one photo was an exercise in patience, as you could only do one at a time. Now you can select a whole of folder images or music or videos at once and it’ll show you the progress of each upload.

Bonus: EXIF extraction — if you upload JPEG files with EXIF metadata like camera make and model, aperture, shutter speed, ISO, et al. WordPress will extract all the data into custom fields you can use in your template. If you use the EXIF title fields or similar those will be put into their equivalent fields in WP. Most modern digital cameras generate EXIF data.

Search posts and pages — search used to cover just posts, now it includes pages too, a great boon for those using WordPress as a CMS. New themes can style or sort pages differently in results.

Tag management — you can now add, rename, delete, and do whatever else you like to tags from inside WordPress, no plugins needed.

Password strength meter — when you change your password on your profile it’ll tell you how strong your password is to help you pick a good one.

Concurrent editing protection — for those of you on multi-author blogs, have you ever opened a post while someone was already editing it, and your auto-saves kept overwriting each other, irrecoverably losing hours of work? I bet that added a few words to your vocabulary. Now if you open a post that someone else is editing, WordPress magically locks it and prevents you from saving until the other person is done. You’ll see a message like below.

Few-click plugin upgrades — if the plugins you use are part of the plugin directory since 2.3 we’ve told you when they have an update available. Now we take that to the next logical step — downloading and installing the upgrade for you. This is dependent a little bit on your host setup, and it may ask you for your FTP password much like OS X or Windows will ask you for a password, but it works well on majority of hosts we were able to test, your mileage may very, plugins in mirror may be larger than they appear.

Friendlier visual post editor — I’m not sure how to articulate this improvement except to say “it doesn’t mess with your code anymore.” We’re now using version 3.0 of TinyMCE, which means better compatibility with Safari, and we’ve paid particular attention this release to its integration and interaction with complex HTML. It also now has a “no-distractions” mode which is like Writeroom for your browser.

Built-in galleries — when you take advantage of multi-file upload to upload a bunch of photos, we have a new shortcode that lets you to easily embed galleries by just putting [ gallery] (without the space) in your post. It’ll display all your thumbnails and captions and each will link each to a page where people can comment on the individual photos. I’ve been using this feature on my blog and have already uploaded over 1,200 pictures into 23 galleries. The shortcode has some hidden options too, check out this documentation.

Developer Features

Now for the geeky stuff. While we’re excited about the above features, each one represents a new opportunity or API for other developers to take to another level. (The best of which we’ll someday integrate back into WP.)

Salted passwords — we now use the phpass library to stretch and salt all passwords stored in the database, which makes brute-forcing them impractical. If you use something like mod_auth_mysql we’ve created a plugin that will allow you to use legacy MD5 hashing. (The hashing is completely pluggable.) Users will automatically switch to the more secure passwords next time they log in.

Secure cookies — cookies are now encrypted based on the protocol described in this PDF paper. which is something like user name|expiration time|HMAC( user name|expiration time, k) where k = HMAC(user name|expiration time, sk) and where sk is a secret key, which you can define in your config.

Easy taxonomy and URL creation — probably best illustrated with an example: I can call register_taxonomy() with a few arguments to register a “people” taxonomy and whenever I edit an image I’ll see a UI like tags has for identifying the people in a photo, and these will be URL addressable with /person/firstname-lastname/. All with a single function call.

Inline documentation — the vast majority of the new code going into WordPress include inline documentation that explains the functions and documents their arguments.

Database optimization — we haven’t changed the table layout in this release, which is one of the reasons so many plugins work fine with 2.5. We have added a few new indicies and made a few default fields more flexible based on some bottlenecks we found on WordPress.com, which now hosts 2.7 million WordPress blogs. It should be invisible to the application, just a bit faster on the database side.

$wpdb->prepare() — now almost all of the SQL in WordPress is prepared first, and the same functions are available to your plugins. This should prevent elementary SQL escaping issues.

Media buttons — the add media buttons above the post are both expandable, so you could have an “Add Google Map” button if you like, They can be overridden, so if you think you can do the video or audio tab better than we have you can replace the default.

Shortcode API — the new gallery functionality is powered by the new shortcode API. Shortcodes are little bracket-delineated strings that can be magically expanded at runtime to something more interesting. They give users a short, easy to type and copy/paste string they can move around their post without worrying about messing up complex HTML or embed codes. The Shortcode API is fully documented.

Now you see why 2.5 took a little extra time.

Upgrade Notes

2.5 does include security fixes so it is recommended for all users, the 2.3 branch will no longer be updated. The upgrade instructions for this version are pretty much the same as any other version. The most important thing to check is your plugins, so if for example everything works except the new uploader, a legacy plugin might be causing a javascript error on the page and breaking it. If something goes wrong, the safest thing to do is turn your plugins off (we have a button to do them all at once, now) and turn them back on one-by-one, testing the problem along the way. This has solved almost everybody’s problems in testing, and it also lets you know which plugin author to show some love to so they’ll update their plugin, and which plugin authors already have so you can shower them with praises on your blog.

One brief note about some of the new upload and plugin upgrade features, there are some edge-case hosting platforms, like versions of Lighttpd before 1.5 or over-agressive mod_security rules, which can break. If something isn’t working like it was looked in the screenshot, ask your host if there’s something on the server side which may be interfering. Hosts, feel free to join and post to our wp-testers mailing list if you have an environment that requires some extra code to work around. We’d be happy to include it in the next update.

Quick tip: in 2.5 you click the name of things to edit them, like your username to edit your profile or the title of a post to edit it.

The Community is Growing

More than growing, it’s on fire. We always talk about things like downloads, and the 2.3 branch has already had 1.92 million downloads as I write this post, but this time we have some far more interesting information I’d like to share.

There were over 1,200 commits to our repository since 2.3.0 and over 90 people were credited in them. This means in our core code, not plugins, there were at least 90 individual folks that contributed something high-quality enough that it made the cut to be part of the download you guys get today. I had no idea this group of people was so large.

Outside of the core commit team, there was particular help from these people, in rough order of number of credits and tickets: mdawaffe (Michael Adams), azaozz (Andrew Ozz), nbachiyski (Nikolay Bachiyski), andy (Andy Skelton), iammattthomas (Matt Thomas), tellyworth (Alex Shiels), josephscott (Joseph Scott), lloydbudd (Lloyd Budd), DD32 (Dion), filosofo (Austin Matzko), hansengel (Hans Engel), pishmishy, ffemtcj, Viper007Bond, ionfish (Benedict Eastaugh), jhodgdon (Jennifer Hodgdon), Otto42, thee17 (Charles E. Free-Melvin), and xknown. Also want to thank MichaelH and Lorelle on the documentation side, and moshu, Kafkaesqui, whooami, MichaelH, Otto42, and jeremyclark13 for helping with support.

The 2.5 branch is nicknamed “Brecker” in honor of Michael Brecker, an exceptionally talented saxophonist who could cross styles effortlessly and never stopped experimenting and pushing himself until he passed away last year.

New WordPress.org

All of this wasn’t enough, so in our copious spare time we decided to redesign WordPress.org to better match the aesthetics of the new dashboard and also to spruce up a few areas that needed lovin’. Some parts of the site, like the Codex, might show the old style for a day or two. We know, just give us a bit of time. Thanks to Matt Thomas for his epic effort in designing and coding the new site.

What’s Next

As always with WordPress, we don’t claim any of these features to be perfect, or to be better than everyone else in the world, but they are done by and for the people and the one thing we do promise is that with every release we listen and do our best to improve.

2.5 is a major milestone for WordPress not because it added dozens of user-requested features, but because it reaffirms that we’re as passionate about blogging as the day we started. Our community is too fierce to rest on its laurels — contrary to what pundits claim, blogging is far from “finished” and every improvement just whets our appetite for more. And more is coming.

It’s a good thing WordPress doesn’t limit the length of posts, because this one would have hit it. If you made it this far, thanks for sharing a bit of your day with us. I sincerely hope this new version of WordPress helps you do what you love to do.

WordPress 2.5, the culmination of six months of work by the WordPress community, people just like you. The improvements in 2.5 are numerous, and almost entirely a result of your feedback: multi-file uploading, one-click plugin upgrades, built-in galleries, customizable dashboard, salted passwords and cookie encryption, media library, a WYSIWYG that doesn’t mess with your code, concurrent post editing protection, full-screen writing, and search that covers posts and pages.

For a short overview of the features with screenshots, it’d be best to visit our sneak peek announcement for RC1. Or check out a 4-minute screencast of the new interface in action. If you just want to jump straight to the good stuff here’s where you can find 2.5 upgrade and download information.

If you want to see everything I would grab a cup of coffee or a mojito, because this post is epic.

User Features

Cleaner, faster, less cluttered dashboard — we’ve worked hard to take your feedback about what’s most important in the dashboard and organize things to allow you to focus on what’s important — your blog — and get out of your way. In collaboration with Happy Cog and the community we’ve taken the first major step forward in the WordPress interface since version 1.5.

Dashboard Widgets — the dashboard home page is now a series of widgets, including ones to show you fun stats about your posting, latest comments, people linking to you, new and popular plugins, and of course WordPress news. You can customize any of the dashboard widgets to show, for example, news from your local paper instead of WP news. Plugins can also hook in, for example the WordPress.com stats widget adds a handy double-wide stats box.

Multi-file upload with progress bar — before when you would upload a large file you’d wait forever, never knowing how far along it was. And uploading more than one photo was an exercise in patience, as you could only do one at a time. Now you can select a whole of folder images or music or videos at once and it’ll show you the progress of each upload.

Bonus: EXIF extraction — if you upload JPEG files with EXIF metadata like camera make and model, aperture, shutter speed, ISO, et al. WordPress will extract all the data into custom fields you can use in your template. If you use the EXIF title fields or similar those will be put into their equivalent fields in WP. Most modern digital cameras generate EXIF data.

Search posts and pages — search used to cover just posts, now it includes pages too, a great boon for those using WordPress as a CMS. New themes can style or sort pages differently in results.

Tag management — you can now add, rename, delete, and do whatever else you like to tags from inside WordPress, no plugins needed.

Password strength meter — when you change your password on your profile it’ll tell you how strong your password is to help you pick a good one.

Concurrent editing protection — for those of you on multi-author blogs, have you ever opened a post while someone was already editing it, and your auto-saves kept overwriting each other, irrecoverably losing hours of work? I bet that added a few words to your vocabulary. Now if you open a post that someone else is editing, WordPress magically locks it and prevents you from saving until the other person is done. You’ll see a message like below.

Few-click plugin upgrades — if the plugins you use are part of the plugin directory since 2.3 we’ve told you when they have an update available. Now we take that to the next logical step — downloading and installing the upgrade for you. This is dependent a little bit on your host setup, and it may ask you for your FTP password much like OS X or Windows will ask you for a password, but it works well on majority of hosts we were able to test, your mileage may very, plugins in mirror may be larger than they appear.

Friendlier visual post editor — I’m not sure how to articulate this improvement except to say “it doesn’t mess with your code anymore.” We’re now using version 3.0 of TinyMCE, which means better compatibility with Safari, and we’ve paid particular attention this release to its integration and interaction with complex HTML. It also now has a “no-distractions” mode which is like Writeroom for your browser.

Built-in galleries — when you take advantage of multi-file upload to upload a bunch of photos, we have a new shortcode that lets you to easily embed galleries by just putting [ gallery] (without the space) in your post. It’ll display all your thumbnails and captions and each will link each to a page where people can comment on the individual photos. I’ve been using this feature on my blog and have already uploaded over 1,200 pictures into 23 galleries. The shortcode has some hidden options too, check out this documentation.

Developer Features

Now for the geeky stuff. While we’re excited about the above features, each one represents a new opportunity or API for other developers to take to another level. (The best of which we’ll someday integrate back into WP.)

Salted passwords — we now use the phpass library to stretch and salt all passwords stored in the database, which makes brute-forcing them impractical. If you use something like mod_auth_mysql we’ve created a plugin that will allow you to use legacy MD5 hashing. (The hashing is completely pluggable.) Users will automatically switch to the more secure passwords next time they log in.

Secure cookies — cookies are now encrypted based on the protocol described in this PDF paper. which is something like user name|expiration time|HMAC( user name|expiration time, k) where k = HMAC(user name|expiration time, sk) and where sk is a secret key, which you can define in your config.

Easy taxonomy and URL creation — probably best illustrated with an example: I can call register_taxonomy() with a few arguments to register a “people” taxonomy and whenever I edit an image I’ll see a UI like tags has for identifying the people in a photo, and these will be URL addressable with /person/firstname-lastname/. All with a single function call.

Inline documentation — the vast majority of the new code going into WordPress include inline documentation that explains the functions and documents their arguments.

Database optimization — we haven’t changed the table layout in this release, which is one of the reasons so many plugins work fine with 2.5. We have added a few new indicies and made a few default fields more flexible based on some bottlenecks we found on WordPress.com, which now hosts 2.7 million WordPress blogs. It should be invisible to the application, just a bit faster on the database side.

$wpdb->prepare() — now almost all of the SQL in WordPress is prepared first, and the same functions are available to your plugins. This should prevent elementary SQL escaping issues.

Media buttons — the add media buttons above the post are both expandable, so you could have an “Add Google Map” button if you like, They can be overridden, so if you think you can do the video or audio tab better than we have you can replace the default.

Shortcode API — the new gallery functionality is powered by the new shortcode API. Shortcodes are little bracket-delineated strings that can be magically expanded at runtime to something more interesting. They give users a short, easy to type and copy/paste string they can move around their post without worrying about messing up complex HTML or embed codes. The Shortcode API is fully documented.

Now you see why 2.5 took a little extra time.

Upgrade Notes

2.5 does include security fixes so it is recommended for all users, the 2.3 branch will no longer be updated. The upgrade instructions for this version are pretty much the same as any other version. The most important thing to check is your plugins, so if for example everything works except the new uploader, a legacy plugin might be causing a javascript error on the page and breaking it. If something goes wrong, the safest thing to do is turn your plugins off (we have a button to do them all at once, now) and turn them back on one-by-one, testing the problem along the way. This has solved almost everybody’s problems in testing, and it also lets you know which plugin author to show some love to so they’ll update their plugin, and which plugin authors already have so you can shower them with praises on your blog.

One brief note about some of the new upload and plugin upgrade features, there are some edge-case hosting platforms, like versions of Lighttpd before 1.5 or over-agressive mod_security rules, which can break. If something isn’t working like it was looked in the screenshot, ask your host if there’s something on the server side which may be interfering. Hosts, feel free to join and post to our wp-testers mailing list if you have an environment that requires some extra code to work around. We’d be happy to include it in the next update.

Quick tip: in 2.5 you click the name of things to edit them, like your username to edit your profile or the title of a post to edit it.

The Community is Growing

More than growing, it’s on fire. We always talk about things like downloads, and the 2.3 branch has already had 1.92 million downloads as I write this post, but this time we have some far more interesting information I’d like to share.

There were over 1,200 commits to our repository since 2.3.0 and over 90 people were credited in them. This means in our core code, not plugins, there were at least 90 individual folks that contributed something high-quality enough that it made the cut to be part of the download you guys get today. I had no idea this group of people was so large.

Outside of the core commit team, there was particular help from these people, in rough order of number of credits and tickets: mdawaffe (Michael Adams), azaozz (Andrew Ozz), nbachiyski (Nikolay Bachiyski), andy (Andy Skelton), iammattthomas (Matt Thomas), tellyworth (Alex Shiels), josephscott (Joseph Scott), lloydbudd (Lloyd Budd), DD32 (Dion), filosofo (Austin Matzko), hansengel (Hans Engel), pishmishy, ffemtcj, Viper007Bond, ionfish (Benedict Eastaugh), jhodgdon (Jennifer Hodgdon), Otto42, thee17 (Charles E. Free-Melvin), and xknown. Also want to thank MichaelH and Lorelle on the documentation side, and moshu, Kafkaesqui, whooami, MichaelH, Otto42, and jeremyclark13 for helping with support.

The 2.5 branch is nicknamed “Brecker” in honor of Michael Brecker, an exceptionally talented saxophonist who could cross styles effortlessly and never stopped experimenting and pushing himself until he passed away last year.

New WordPress.org

All of this wasn’t enough, so in our copious spare time we decided to redesign WordPress.org to better match the aesthetics of the new dashboard and also to spruce up a few areas that needed lovin’. Some parts of the site, like the Codex, might show the old style for a day or two. We know, just give us a bit of time. Thanks to Matt Thomas for his epic effort in designing and coding the new site.

What’s Next

As always with WordPress, we don’t claim any of these features to be perfect, or to be better than everyone else in the world, but they are done by and for the people and the one thing we do promise is that with every release we listen and do our best to improve.

2.5 is a major milestone for WordPress not because it added dozens of user-requested features, but because it reaffirms that we’re as passionate about blogging as the day we started. Our community is too fierce to rest on its laurels — contrary to what pundits claim, blogging is far from “finished” and every improvement just whets our appetite for more. And more is coming.

It’s a good thing WordPress doesn’t limit the length of posts, because this one would have hit it. If you made it this far, thanks for sharing a bit of your day with us. I sincerely hope this new version of WordPress helps you do what you love to do.

2.5 is coming along thanks to the fantastic feedback you guys provided on RC1 (over 580 pingbacks and counting), and we’re now ready to show you a bit more of a peek with a short screencast covering the new dashboard and uploader and Release Candidate 2. First here’s the screencast, which is also available embedded below, as a Flash movie, or as a 17mb AVI download:

I’ve uploaded more than a thousand photos already into the new gallery system — it works.

(This was my first screencast, but I hope we can have more on WordPress.org and our documentation in the future.)

If you make frequent backups and you’re interested in helping us out with development by testing the very latest, download and install Release Candidate 2 of WordPress 2.5, and join our testers mailing list to report any bugs you find in the code.

Finally with regards to theme and plugin compatibility, we’ve had no reports of any broken themes in this upgrade, which makes sense because we didn’t really change anything core about themes, just added new optional capabilities like Gravatars. Plugins that work with the admin may require updating to take advantage of the new, cleaner UI in WordPress 2.5.

The community has started to keep a list here of which plugins work great and which don’t. It’s worth looking at, or even better just deactivate your plugins before upgrading for 2.5 and let the built-in updater notify and give you one-click upgrades to plugins you have installed, assuming the developer is cool and has updated their code for 2.5 already.

2.5 is coming along thanks to the fantastic feedback you guys provided on RC1 (over 580 pingbacks and counting), and we’re now ready to show you a bit more of a peek with a short screencast covering the new dashboard and uploader and Release Candidate 2. First here’s the screencast, which is also available embedded below, as a Flash movie, or as a 17mb AVI download:

I’ve uploaded more than a thousand photos already into the new gallery system — it works.

(This was my first screencast, but I hope we can have more on WordPress.org and our documentation in the future.)

If you make frequent backups and you’re interested in helping us out with development by testing the very latest, download and install Release Candidate 2 of WordPress 2.5, and join our testers mailing list to report any bugs you find in the code.

Finally with regards to theme and plugin compatibility, we’ve had no reports of any broken themes in this upgrade, which makes sense because we didn’t really change anything core about themes, just added new optional capabilities like Gravatars. Plugins that work with the admin may require updating to take advantage of the new, cleaner UI in WordPress 2.5.

The community has started to keep a list here of which plugins work great and which don’t. It’s worth looking at, or even better just deactivate your plugins before upgrading for 2.5 and let the built-in updater notify and give you one-click upgrades to plugins you have installed, assuming the developer is cool and has updated their code for 2.5 already.