recipe-maintainers/wordpress
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

chore: upgrade wordpress to 7.1.4 #3

Open
autonomic-bot wants to merge 1 commits from upgrade-cea471c into main
pull from: upgrade-cea471c
merge into: :main
Conversation 2 Commits 1 Files Changed 1
+1 -1
autonomic-bot commented 2026-10-30 04:53:09 +00:00
Owner
Copy Link
Copy Source

WordPress 7.1.3 → 7.1.4 (security release)

service current new
app wordpress:7.1.3 wordpress:7.1.4
db mariadb:13.0 no change (13.0 is latest stable; 13.1.x are -rc)
ftp (optional overlay) atmoz/sftp:alpine no change (no versioned upstream tag)

Upstream release notes: wordpress 7.1.3→7.1.4: https://wordpress.org/news/2026/10/wordpress-7-1-4/
Image tags: https://hub.docker.com/_/wordpress (7.1.4 published 2026-10-29)

What 7.1.4 fixes

Security-only short-cycle release: RCE in the WordPress upgrade process (upgrade window); stored XSS
in crafted block markup, privacy data-removal requests, the Interactivity API, customizer selective
refresh, the Categories block, crafted user logins, playlists/image blocks, and the
core/comments-pagination-next|previous blocks; stored DoS in the Interactivity API; unauth
discovery of unpublished customizer changesets; a note-read authorization weakness for privileged
users; bundled root-cert CA refresh (eMudhra revocation).

Operator Action Required

  • No breaking changes — no migration, no new/renamed config. Tag-only bump.
  • Advisories: deterministic scan found 0 CVEs classifiable for this window (its 27 unclassified
    entries are all MariaDB/server, not in this window); the security value is the 7.1.4 release notes
    above. No CVE ids are published in those notes yet.
  • Open PR #2 (pr-20261021-190326, PHP/session hardening on 7.1.3) is left untouched. 7.1.4 is a
    fresh current-PHP build; if both merge this PR's tag wins, and #2 may then be redundant.
  • atmoz/sftp:alpine is left as-is: Docker Hub has no newer versioned tag (only floating
    alpine/debian variants), so there is nothing pin-able to bump.

Recommended release command (run after merge; this PR does not touch the version label)

abra recipe release wordpress -z

Live verification (pre-PR, direct deploy on cc-ci)

Deployed the WIP branch directly with abra app deploy --chaos on the local swarm
(dev-wordpress, torn down afterwards): app converged to wordpress:7.1.4 + mariadb:13.0,
wp core version = 7.1.4, wp core verify-checksums PASS, installer + REST index OK,
/wp-json/wp/v2/settings 401 unauth, /xmlrpc.php 405 on GET, post create/read OK, and an
authenticated XML-RPC wp.getUsersBlogs round-trip succeeded.

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## WordPress 7.1.3 → 7.1.4 (security release) | service | current | new | |---------|---------|-----| | app | `wordpress:7.1.3` | `wordpress:7.1.4` | | db | `mariadb:13.0` | no change (13.0 is latest stable; 13.1.x are `-rc`) | | ftp (optional overlay) | `atmoz/sftp:alpine` | no change (no versioned upstream tag) | **Upstream release notes:** wordpress 7.1.3→7.1.4: https://wordpress.org/news/2026/10/wordpress-7-1-4/ **Image tags:** https://hub.docker.com/_/wordpress (7.1.4 published 2026-10-29) ### What 7.1.4 fixes Security-only short-cycle release: RCE in the WordPress upgrade process (upgrade window); stored XSS in crafted block markup, privacy data-removal requests, the Interactivity API, customizer selective refresh, the Categories block, crafted user logins, playlists/image blocks, and the `core/comments-pagination-next|previous` blocks; stored DoS in the Interactivity API; unauth discovery of unpublished customizer changesets; a note-read authorization weakness for privileged users; bundled root-cert CA refresh (eMudhra revocation). ### Operator Action Required - **No breaking changes** — no migration, no new/renamed config. Tag-only bump. - Advisories: deterministic scan found 0 CVEs classifiable for this window (its 27 unclassified entries are all MariaDB/server, not in this window); the security value is the 7.1.4 release notes above. No CVE ids are published in those notes yet. - Open PR #2 (`pr-20261021-190326`, PHP/session hardening on 7.1.3) is left untouched. 7.1.4 is a fresh current-PHP build; if both merge this PR's tag wins, and #2 may then be redundant. - `atmoz/sftp:alpine` is left as-is: Docker Hub has no newer versioned tag (only floating `alpine`/`debian` variants), so there is nothing pin-able to bump. ### Recommended release command (run after merge; this PR does not touch the version label) abra recipe release wordpress -z ### Live verification (pre-PR, direct deploy on cc-ci) Deployed the WIP branch directly with `abra app deploy --chaos` on the local swarm (`dev-wordpress`, torn down afterwards): app converged to `wordpress:7.1.4` + `mariadb:13.0`, `wp core version` = 7.1.4, `wp core verify-checksums` PASS, installer + REST index OK, `/wp-json/wp/v2/settings` 401 unauth, `/xmlrpc.php` 405 on GET, post create/read OK, and an authenticated XML-RPC `wp.getUsersBlogs` round-trip succeeded. Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-10-30 04:53:10 +00:00
chore: upgrade wordpress to 7.1.4
cc-ci/testme cc-ci: success
Details
cea471c8d6
autonomic-bot requested review from trav 2026-10-30 04:53:10 +00:00
autonomic-bot requested review from notplants 2026-10-30 04:53:11 +00:00
autonomic-bot commented 2026-10-30 04:53:15 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-30 04:53:46 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — wordpress @ cea471c8 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `wordpress` @ `cea471c8` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/114/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/114) [![level](https://ci.autonomic.zone/runs/114/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/114) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/114) · [dashboard](https://ci.autonomic.zone/)
All checks were successful
cc-ci/testme cc-ci: success
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin upgrade-cea471c:upgrade-cea471c
git checkout upgrade-cea471c
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (Aadil Ayub) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/wordpress#3