search

roots / wordpress

Automatically updated WordPress Composer package
https://roots.io/composer-wordpress-resources/
MIT License
171 stars 15 forks source link

Old themes not in WordPress core 5.1 are installed with roots/wordpress #3

Closed noelspringer closed 2 years ago

noelspringer commented 5 years ago

Themes currently installed with WP core 5.1 from both wordpress.org and the johnpbloch/wordpress composer package are:

Themes installed with roots/wordpress include the above three themes as well as the old themes twentyeleven through to twentyfifteen.

QWp6t commented 5 years ago

This repo installs releases from the official wordpress/wordpress repo.

LeoColomb commented 5 years ago

Actually @noelspringer is right. And I'm not sure zip archives from mirrored git repo releases are the official distribution zips. It seems to be more that ones: https://wordpress.org/download/releases/.

noelspringer commented 5 years ago

Aha i see that repo includes the older themes. Curious though since the official WordPress releases don't include them.

Could the older themes have been removed from the official releases for security reasons?

LeoColomb commented 5 years ago

@noelspringer I guess old themes are kept in the sources for maintenance, but removed when building archives for distribution.

noelspringer commented 5 years ago

Makes sense Leo. Thanks

retlehs commented 4 years ago

image

let's start figuring out some options on what we can do to remove the old themes that aren't typically distributed with wordpress

LeoColomb commented 4 years ago

@retlehs One option available to exclude default and old themes is downloading "no-content" build from WordPress.org repo:

https://downloads.wordpress.org/release/wordpress-{$version}-no-content.zip

PS: I've setup my own WordPress-composer repo where with "no-content" option, but I would like to configure a complete org with all the different available options.

austinpray commented 4 years ago

@LeoColomb eventually we will finish https://github.com/roots/wordpress-packager which will allow releasing all three packages

LeoColomb commented 4 years ago

@austinpray That would be awesome, indeed 🙂 Let me know if I can help

austinpray commented 4 years ago

Looking at getting this fixed ASAP since this behavior triggers a security notice.

If anyone has time to experiment: it might be as simple as just adding some more metadata to the package to blacklist those old themes? https://getcomposer.org/doc/04-schema.md#archive

Also as far as rollout: pretty sure it's safe to assume that people will not mind if these themes disappear the next time they bump the roots/wordpress version?

strarsis commented 3 years ago

+1 for this! Having less unused files is always good.

retlehs commented 2 years ago

https://packagist.org/packages/roots/wordpress-no-content is now available to use, fyi!

props to @LeoColomb and @swalkinshaw for their work on the new composer wordpress packages via https://github.com/roots/wordpress-packager