chore: upgrade wordpress to 7.1.3 #1

Open

autonomic-bot wants to merge 4 commits from upgrade-e360226 into main

pull from: upgrade-e360226

merge into: :main

:main

:upgrade-e360226

Conversation 8 Commits 4 Files Changed 1

+1 -1

autonomic-bot commented 2026-08-21 03:49:36 +00:00

Owner

Copy Link

Copy Source

wordpress upgrade: 7.1.2 → 7.1.3

(Re-run 2026-10-09: PR #1 previously carried 7.1.0; extended onto current upstream main bfe9a099 = recipe 4.1.0+7.1.2 and bumped the app to 7.1.3.)

service               | image      | current | new
app                   | wordpress  | 7.1.2   | 7.1.3
db                    | mariadb    | 13.0    | 13.0   (unchanged — abra: already the latest)
ftp (optional overlay)| atmoz/sftp | alpine  | alpine (unchanged — floating tag, abra-unparseable)

The coop-cloud.${STACK_NAME}.version label is intentionally untouched (stays 4.1.0+7.1.2) — it is bumped by the release step below, not in this PR.

Operator Action Required

WordPress 7.1.3 (2026-10-06) is a maintenance & security release — 7 security fixes + 4 bug fixes; the announcement recommends updating immediately. The 7 security issues:

• Stored XSS on the Comments administration page, exploitable via pending comments (Trail of Bits + OpenAI)
• DoS in WP_Http::make_absolute_url() (Anthropic)
• Second-order SQL injection in the WordPress WXR export (Anthropic)
• A weakness allowing Author-role users to sticky posts (Anthropic)
• Unauthenticated disclosure of comments on private & unpublished posts — CVE-2026-66666 (CVSS 6.9, Patchstack)
• Imgur embeds vulnerable to XSS
• Forgeable parameters passed to the {status}_{type} hook can lead to action-name collision

No compose/config/env/volume changes and no DB schema migration required — image-tag bump only. PHP requirement is unchanged (the official image ships PHP 8.3.x). Site-/plugin-level review only if you rely on the affected admin/embed paths.

Upstream release notes: app wordpress 7.1.2→7.1.3: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/ (db and ftp unchanged)

Recommended release command (operator, after the upstream PR merges):

abra recipe release wordpress -z

(patch bump — security + maintenance release, no recipe-level breaking changes; the release step syncs the version label to a.b.c+7.1.3 and tags)

Verification (direct dev deploy on cc-ci, 2026-10-09, torn down after)

• abra app deploy --chaos on the local swarm (dev-wordpress.ci.commoninternet.net) from this branch head f53b93a: converged — app wordpress:7.1.3 1/1 (Apache/2.4.68, PHP/8.3.35), db mariadb:13.0 1/1 (13.0.2).
• Confirmed the running version inside the container: wp core version → 7.1.3 (wp-includes/version.php wp_version = '7.1.3'); core copied cleanly, wp-content volume + recipe-templated .htaccess preserved; healthcheck GET / → 302 (fresh-install wizard, expected — the CI env runs no core_install).
• Dev deploy removed afterwards (0 stacks / 0 volumes / 0 secrets leaked).

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## wordpress upgrade: 7.1.2 → 7.1.3 _(Re-run 2026-10-09: PR #1 previously carried 7.1.0; extended onto current upstream main `bfe9a099` = recipe 4.1.0+7.1.2 and bumped the app to 7.1.3.)_ ``` service | image | current | new app | wordpress | 7.1.2 | 7.1.3 db | mariadb | 13.0 | 13.0 (unchanged — abra: already the latest) ftp (optional overlay)| atmoz/sftp | alpine | alpine (unchanged — floating tag, abra-unparseable) ``` The `coop-cloud.${STACK_NAME}.version` label is intentionally untouched (stays `4.1.0+7.1.2`) — it is bumped by the release step below, not in this PR. ### Operator Action Required WordPress **7.1.3** (2026-10-06) is a **maintenance & security release** — 7 security fixes + 4 bug fixes; the announcement recommends updating immediately. The 7 security issues: - Stored XSS on the Comments administration page, exploitable via pending comments (Trail of Bits + OpenAI) - DoS in `WP_Http::make_absolute_url()` (Anthropic) - Second-order SQL injection in the WordPress WXR export (Anthropic) - A weakness allowing Author-role users to sticky posts (Anthropic) - Unauthenticated disclosure of comments on private & unpublished posts — **CVE-2026-66666** (CVSS 6.9, Patchstack) - Imgur embeds vulnerable to XSS - Forgeable parameters passed to the `{status}_{type}` hook can lead to action-name collision No compose/config/env/volume changes and no DB schema migration required — image-tag bump only. PHP requirement is unchanged (the official image ships PHP 8.3.x). Site-/plugin-level review only if you rely on the affected admin/embed paths. **Upstream release notes:** app wordpress 7.1.2→7.1.3: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/ (db and ftp unchanged) Recommended release command (operator, after the upstream PR merges): `abra recipe release wordpress -z` (patch bump — security + maintenance release, no recipe-level breaking changes; the release step syncs the version label to `a.b.c+7.1.3` and tags) ### Verification (direct dev deploy on cc-ci, 2026-10-09, torn down after) - `abra app deploy --chaos` on the local swarm (`dev-wordpress.ci.commoninternet.net`) from this branch head `f53b93a`: converged — app **`wordpress:7.1.3` 1/1** (Apache/2.4.68, PHP/8.3.35), db `mariadb:13.0` 1/1 (13.0.2). - Confirmed the running version inside the container: `wp core version` → **7.1.3** (`wp-includes/version.php` `wp_version = '7.1.3'`); core copied cleanly, `wp-content` volume + recipe-templated `.htaccess` preserved; healthcheck `GET /` → 302 (fresh-install wizard, expected — the CI env runs no `core_install`). - Dev deploy removed afterwards (0 stacks / 0 volumes / 0 secrets leaked). Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants

autonomic-bot added 1 commit 2026-08-21 03:49:36 +00:00

chore: upgrade wordpress to 7.1.0 e36022601b

autonomic-bot requested review from trav 2026-08-21 03:49:36 +00:00

autonomic-bot requested review from notplants 2026-08-21 03:49:36 +00:00

autonomic-bot commented 2026-08-21 03:49:40 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-08-21 03:49:58 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — wordpress @ e3602260 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1301

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `wordpress` @ `e3602260` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1301 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1301) · [dashboard](https://ci.commoninternet.net/)

autonomic-bot added 1 commit 2026-09-11 07:33:22 +00:00

chore: upgrade wordpress to 7.1.0 5e46fa3fbb

autonomic-bot commented 2026-09-11 07:33:33 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-09-11 07:33:47 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — wordpress @ 5e46fa3f ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `wordpress` @ `5e46fa3f` ✅ **passed** [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1358) [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1358) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1358) · [dashboard](https://ci.commoninternet.net/)

autonomic-bot added 1 commit 2026-09-18 08:03:45 +00:00

chore: upgrade wordpress to 7.1.0 c6e598d511

autonomic-bot commented 2026-09-18 08:03:53 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-09-18 08:04:00 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — wordpress @ c6e598d5 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `wordpress` @ `c6e598d5` ✅ **passed** [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1375) [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1375) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1375) · [dashboard](https://ci.commoninternet.net/)

autonomic-bot changed title from chore: upgrade wordpress to 7.1.0 to chore: upgrade wordpress to 7.1.3 2026-10-09 03:26:18 +00:00

autonomic-bot added 1 commit 2026-10-09 03:26:19 +00:00

chore: upgrade wordpress to 7.1.3 a40f54587b

autonomic-bot commented 2026-10-09 03:26:27 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-10-09 03:26:28 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — wordpress @ a40f5458 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `wordpress` @ `a40f5458` ✅ **passed** [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/49) [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/49) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/49) · [dashboard](https://ci.autonomic.zone/)

All checks were successful

Hide all checks

cc-ci/testme cc-ci: success

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin upgrade-e360226:upgrade-e360226

git checkout upgrade-e360226

Sign in to join this conversation.

Reviewers

No Reviewers

trav

notplants

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/wordpress#1