Updates to roots/wordpress Composer Package

Since 2018 we’ve offered our roots/wordpress package as a Composer-based way to install WordPress, a convenient part of Bedrock, and as a drop-in replacement for johnpbloch/wordpress. It’s fully automated, based on the official WordPress source, and all done in the open so as to be fully, publicly auditable. People seem to like it, since it’s been downloaded over 4 million times.

Included WordPress themes

The one downside to this system was that, like the default WordPress distribution, it included all the default WordPress themes. That’s fine when you’re downloading a .zip off wordpress.org, but if you’re using Bedrock to pull in WordPress as a dependency it means you’re downloading a bunch of code that you’ll almost certainly never need. This is inefficient, and dead code is always a (theoretical) security risk—not to mention it causes your site to (somewhat ironically) fail the WP Health Check. While you could always have a script to delete those themes after install, it turns out there’s a better way.

Thanks to some amazing work by @LeoColomb, our build process for roots/wordpress can now generate two different packages:

• One that’s the same, with all the themes
• One that contains only WordPress core
• (In theory it could generate others too, but these are the ones we’ll be making)

If you need the default themes, then you can require them separately:

"require": {
   "roots/wordpress": "6.0",
   "wpackagist-theme/twentytwentytwo":"*"
}

Rollout

This development will mean some changes to how our packages work, but our intent is to make this as helpful and non-breaking as possible. You can expect the following to happen:

• roots/wordpress-full will be made available to require via Packagist–in fact, it already is!
• roots/wordpress-no-content will be made available to require via Packagist–in fact, it already is!
• roots/wordpress will begin to suggest on install that users switch to roots/wordpress-full if they want the themes.
• With the release of WordPress 6.0 roots/wordpress will change to serve only WordPress–no themes.

If you have a build process that currently relies on the WordPress core themes being part of the roots/wordpress package, you should switch to roots/wordpress-full as soon as possible.

If you have any questions or concerns, please let us known on Discourse, or chat with us in the Roots Discord that’s available to GitHub Sponsors.