A pre-release WordPress install killed a client’s publish button. The cause was a core bug in hidden async-upload fields, one of several things the 6.9 release candidates cleaned up alongside alternate cron and REST API errors.
A banned member was back in ten minutes on three new accounts, because a dynamic IP beats a firewall rule. What the site actually needed was an incident response protocol: logging, permissions, and a human who owns the ban button.
A client shipped a custom plugin to the WordPress repo and got twenty-four violations back. Most of them came down to one habit: escaping data at the moment you output it instead of trusting the sanitization you did on input.
A regex that injected attributes into product images broke a store’s layout over one misplaced quote. WordPress 6.9 makes serialize_token() public, so the processor rebuilds the markup for you.
Twelve editors on one set of long-form guides, with feedback spread across Slack, email and sticky notes. Block-level notes and the hide and show toggle in 6.9 move that conversation into the editor.
A client’s WordPress.com site outgrew the managed plan after nearly a decade. The XML export timed out and broke thousands of image links, so the move became a SQL migration with a media path filter.
Fifty layers of function_exists() held a membership site together until the LMS renamed its methods. The Abilities API in 6.9 gives plugins a registry to declare what they can do instead.
A client pushed WordPress 6.9 RC3 to a live WooCommerce store and lost checkout inside ten minutes. What broke, why my first quick fix made it worse, and where release candidate testing actually belongs.
Hiding a block used to mean display: none and a browser that still downloaded every asset. WordPress 6.9 leaves hidden blocks out of the rendered HTML, and a short filter stops clients from hiding your structural containers.
A magazine site moving off an emoji subdomain came apart under wp search-replace. WordPress Importer 0.9.5 rewrites URLs during the import instead, using the block markup parsers in core to tell a real URL from a lookalike string.