I do use Bedrock alot. Also Sage ten is being evaluated. But this thread is for clarification of Sage.
I did follow the guidelines installing this. But I can not two weeks later see what version I downloaded somewhere. Why is there no version to it in the composer.json file? All the tags in git repo has it?
There are currently 115 tags on the Bedrock repo in the github.
Lots of minor things, as bumping up versions - but sometimes there are more than that.
How do you work with keeping it up to date?
I have 28 wordpress sites within a major company - so for me it is crucial due to both security and compliance - to not be to far behind - since IT governance plays a huge role at our work.
We don’t update Bedrock. I realise this sounds a bit strange from a secops standpoint.
Bedrock can be thought of as a project template, rather than a dependency. It contains very little code. The more complex components required to make it all work are installed via composer.json - see the installed roots/* packages eg. roots/wp-password-bcrypt. These can be upgraded and follow semver. This is what we aim to keep up to date.
If we needed a new Bedrock feature, we’d re-run composer create-project roots/bedrock in a new directory, migrate configs and install theme / plugin dependencies from composer / GIT. But to date, we’ve never needed to do that.
The most important thing is to keep WordPress, plugins and composer dependencies up to date. All of which can be accomplished with composer.
At one point I was adding a got ignored text file to the project where I would add the version number to keep track of what release I was at, but haven’t found this necessary.
Yeah, I do get that their is much updates done “automatically” in the composer update you can set to a part of the maintenance of projects - which we already do.
But sometimes there are bugs and fixes in files like the application.php in bedrock.
As for an example the WP_POST_REVISIONS which used php syntax as of ?: operator instead of the now updated ?? - that was added by the Bedrock team.
And if you start new projects with always getting the “latest” bedrock - then it seems ok. And you have to merge in your own boilerplate lines into the application.php.
But for existing projects - I guess I have to go read up on Bedrock tags from time to time, to see if there are updates that is outside of the packages.
But I am thankful for your input. It makes me change perspective of course.