Hey y’all,
We built WP Composer, a fully open source, community-funded Composer repository for WordPress plugins and themes.
After WPackagist was acquired by WP Engine last week, we felt that infrastructure this central to the WordPress Composer workflow shouldn’t be controlled by a single corporation. WP Composer is an independent alternative built and maintained by Roots.
Every free plugin and theme from the WordPress.org directory is available with clean package naming — wp-plugin/* and wp-theme/* instead of the old wpackagist-plugin and wpackagist-theme prefixes.
Migrating from WPackagist takes a few commands, or you can use our migration script. The codebase is GitHub. If you rely on Composer for WordPress, consider sponsoring Roots to keep this tooling independent.
WP Composer also supports Composer v2’s metadata-url protocol, which WPackagist lacks — meaning Composer fetches only the metadata it needs instead of downloading bulk provider indexes. In our benchmarks, cold resolves are ~17x faster.
For a full breakdown, see WP Composer vs WPackagist.
Here’s everything else that’s new since our last update:
Recent blog posts
-
Introducing WP Composer as a WPackagist Replacement — An independent, community-funded Composer repository for WordPress plugins and themes
-
WordPress File Headers Have Overstayed Their Welcome — Why WordPress should replace its non-standard file header system with JSON-based metadata
-
Announcing Acorn AI — Integrate WordPress’s Abilities API with Laravel’s AI framework, define AI-powered capabilities as Laravel classes, and expose them as MCP tools
-
Announcing Acorn User Roles — Define user roles in a PHP config file instead of scattered database calls, with automatic syncing across environments
-
What’s New in Trellis (March 2026) — HTTP/3 support, runtime hardening, Redis session storage, and more
-
What’s New in Bedrock v1.29.0 — PHP 8.3 minimum, built-in Pest testing infrastructure, and bug fixes
Roots project updates
Trellis v1.28.0–v1.29.0 — HTTP/3 support, optional WordPress runtime hardening controls, Ansible 2.19 support, Redis PHP session storage, and multiple Nginx security fixes.
Bedrock v1.28.5–v1.29.2 — PHP 8.3 minimum, Pest testing scaffold, opt-in WP_DEVELOPMENT_MODE support, and env loading fixes.
Acorn v5.0.6 — Output buffering fixes, PHP 8.5+ compatibility, and ApplicationBuilder middleware support. (Lots more coming in the next upcoming release, which will be soon)
Sage v11.0.2–v11.0.3 — Explicit Tailwind source globs, border radius presets in wordpressThemeJson (new feature from the latest release of our vite-plugin), and WP 6.9.1 block-style-variation fix.
Trellis CLI v1.16.0–v1.17.0 — New server commands with extensible provider support, Hetzner Cloud as a server provider, Lima HTTP port forwarding, VM logs command, and --skip-tags for provisioning.
Radicle v2.3.0–v2.3.2 (must be a customer to view) — PHP 8.4 minimum, webfont setup, block rendering improvements, various refactors and bugfixes.
Bedrock Autoloader v1.1.0 — New bedrock_autoloader_load_plugins filter for selectively excluding mu-plugins, symlink support, and safer synthetic activation hooks.
wp-config v2 (coming soon) — A complete rewrite with a fluent, chainable API. Config::make($rootDir)->bootstrapEnv() replaces manual Dotenv setup, when() enables conditional config, and instance-scoped hooks replace static methods. Check out the README for a preview. This will be one of the biggest changes coming to Bedrock v2.
Scaffolding support for acorn-example-package — Our Acorn package template now supports scaffolding to help you get started building your own packages faster.
New documentation
WP-CLI i18n improvement for Blade component props
Our PR to the WP-CLI i18n command was merged — wp i18n make-pot now extracts translatable strings from Blade component prop bindings (e.g., :message="__('...', 'theme')"). This should be included in the next WP-CLI release.
WordPress news
- WordPress v7 will support PHP-only block registration — register server-side rendered blocks without any JavaScript
WordPress projects and community Acorn packages
-
MilliCache — High-performance full-page caching for WordPress using Redis, ValKey, KeyDB, or Dragonfly (Acorn integration available)
-
Substrate — AI MCP server for development with Bedrock, Acorn, and Sage
-
40Q SEO Assistant — Editor-side SEO metadata suggestions powered by Acorn
-
WP Query Block — An Acorn package providing a Query Block for the Gutenberg editor
-
WP-CLI All Sites — Run any WP-CLI command across every site in a multisite network with
--all-sites -
WP Queue Worker — Event-loop job queue for WordPress using Workerman
-
WP Sudo — Gate risky WordPress actions behind reauthentication with 2FA support
-
WP Malware Cleanup MCP — MCP server for cleaning malware from WordPress sites via SSH and WP-CLI
-
Omni Icon — SVG icon library for WordPress
-
WP OpenCode — Bootstrap WordPress + OpenCode instances with pluggable chat interfaces
-
Excerpt Check — Prompts authors to add an excerpt before publishing
-
ByMiles AI — AI design partner that generates custom WordPress designs using native blocks
-
Git It Write — Automatically publish markdown files from GitHub as WordPress posts
If you benefit from our work, please consider sponsoring us. Your support keeps our WordPress projects alive! All sponsors are invited to our Discord server where you can chat with our maintainers and other community members.
Thanks for reading
Subscribe at https://roots.io/newsletter/