Just Launched: GitHub Deployments

Say goodbye to the hassle of manual file uploads and tedious deployments, and say hello to WordPress.com’s new GitHub Deployments.

With GitHub Deployments, you can seamlessly connect your repository to your WordPress.com site in just a few clicks. Now you can focus on what you do best: writing outstanding code. Each time you push a change to your GitHub repository, it will be deployed to your WordPress.com site automatically or upon request. 

Check out this video overview from Paulo Trentin, one of the developers who worked on this feature:

Here are three reasons why we know you’re going to love GitHub Deployments on WordPress.com:

1. A streamlined workflow

GitHub Deployments help you manage your site’s code in a reliable, predictable, and automated way using version control instead of older or manual mechanisms, such as FTP or SSH tools. In its simplest form, it doesn’t require a workflow file like our previous GitHub integration, which relied on a GitHub action; instead, you can connect and deploy in just a few clicks, all within your WordPress.com dashboard.

This is a welcome change for developers who want to simplify their code deployment process and migrate away from the manual operations and error-prone nature of SFTP and SSH transfers. 

GitHub Deployments also allows you to connect multiple repositories to a single site, encouraging code reusability between the sites you manage. Want to deploy a plugin or theme to multiple sites with a single branch push? Have at it! Want to manage your entire site’s code from a GitHub repository? We’ve got you covered!

2. Run checks and tasks

GitHub Deployments also gives you the power to process files and run tasks before transferring the files to your WordPress.com site through GitHub workflows. This helps ensure that all team members publish code following your chosen patterns and expectations, for example. 

If that’s your thing, you can install Composer dependencies and run any command supported by GitHub actions prior to sending any code updates to your site. Find a few of our favorite workflow recipes here.

Three cheers for unified, well-written code!

3. Deploy the way you want

You can adjust the deployment settings for each repository, giving you complete control over how your code is shipped.

You can choose to automatically deploy changes to your WordPress.com site as soon as code is committed to your repository, or you can request deployments manually. Manual deployments give you the most control over when your code changes are pushed live, as you’ll use the GitHub Deployments interface to trigger a deployment. We recommend manual deployments if you don’t want to use a staging site.

In general, automatic deployments are not recommended for live production sites, as any changes to the code in the repository are automatically deployed from GitHub to the live site. Instead, you may decide to automatically deploy first to a staging site and then sync the staging site to production once you’re ready.

That said, choose your own adventure and deploy on your own terms.

Do your thing, and we’ll handle the rest

Development on WordPress.com has never been easier. Say goodbye to manual deployments and hello to more efficient collaboration, streamlined version control, and the peace of mind that comes with knowing your project data is secure.

Get instant access to our new GitHub Deployments with a Creator or Entrepreneur plan (did you know we have a 14-day refund policy?).

Ready to try GitHub Deployments out for yourself? Click here to start deploying, and learn more by reading our developer documentation.

Major kudos to the GitHub Deployments team on this launch! Paulo Trentin, Jeroen Pfeil, Kenroy Mcleish, Mike Kelly, Javier Arce, Jeff Sanquist, Alexa Peduzzi, Jeremy Anderberg, and our beta testers.

Re-Creating The New York Times’ Website in Under 30 Minutes Using WordPress.com

In this “Build and Beyond” video, Jamie Marsland re-creates The New York Times’ website in less than 30 minutes using WordPress.com. By utilizing mega menus, master layouts, typography controls, and post grids, Jamie shows us what’s possible with the limitless customizations available with WordPress.

When it comes to mega menus, specifically, it’s worth noting that this is a highly complex customization that should only be attempted by WordPress pros and is mainly shown here as a demo of what’s possible. Please read this blog post on the WordPress.org developer blog before embarking on your own mega menu.

To learn more and get started on your own site today, click below:

WordCamp Asia 2024: The WordPress Community Comes Together in Taipei

This year’s WordCamp Asia was held in Taipei, the vibrant capital city of Taiwan. Members from WordPress.com joined other Automatticians, as well as around 2,000 other attendees from across 70 countries to connect, learn, build, and give back to the platform that powers millions of top websites across the internet.

The event kicked off with Contributor Day, an opportunity for anyone in the WordPress community, from newcomers to seasoned experts, to get involved and contribute to WordPress. Contributing can mean contributing to code, but it can also mean sharing your expertise in design, offering support in forums, translating content, and much much more. This year’s Contributor Day had a fantastic turnout and it was amazing to see so many folks show up and participate! 

As always, there was a variety of informative and inspiring talks. Some of our favorites included talks about the future of WordPress, the multifaceted nature of design, building and maintaining WordPress sites with AI, achieving efficient workflows with the site editor, and the importance of diversity, equity, inclusion, and belonging in the tech and WordPress communities. If any of these topics pique your interest, you can take a look at the livestream recordings for these and all other WordCamp Asia 2024 talks here

While our colleagues from the WordPress Project, Woo, and Jetpack participated in the event, folks from WordPress.com were also present, contributing, networking, and engaging with the community.

This year we were particularly interested in connecting with developers so that we could better understand their experiences with WordPress.com. Our hosting infrastructure, powered by WP Cloud, is best-in-class, yet the benefits aren’t as well-known in the developer community. To help get the word out about all of our developer-focused features, we’ve recently relaunched our developer site at developer.wordpress.com. Check it out to learn about staging sites, WP-CLI access, and Studio, our upcoming local development environment. 

During the anticipated closing Q&A session at WordCamp Asia 2024, Matt Mullenweg, co-founder of WordPress and CEO of Automattic, opened up about his dreams for a web that’s both open and accessible to everyone. He shared how the core principles of open source are not just shaping WordPress but also knitting together a worldwide community of contributors.

That sense of community is something you can definitely feel at WordCamps. Thirty-six percent of attendees at this WordCamp were first-time participants—a testament to the event’s growing appeal and the ever-expanding WordPress community.

During the closing remarks, Matt revealed that State of the Word 2024 will be held in Tokyo, Japan. The lead organizers also revealed the next WordCamp Asia location: Manila, Philippines, in February 2025. With Manila’s rich tapestry of Spanish, European, American, and Asian influences, we’re in for a vibrant mix of culture, cuisine, and community!

But you don’t have to wait until 2025 to start getting involved. There’s a huge number of local and regional WordCamps happening year-round. Head over to https://central.wordcamp.org/ to find one near you. Whether you’re looking to develop your skills, learn something new, network with the community, there’s something for everyone. We hope to see you out there! 

Introducing “Build and Beyond”: A New Video Series From WordPress.com and Jamie Marsland

Jamie Marsland has been preaching the WordPress gospel for over a decade and has trained thousands of people on blocks, plugins, and more. Through his popular YouTube channel and hands-on courses, Jamie provides incredible tutorials and breaks down the most common misconceptions about building with WordPress. 

We’re happy to share that WordPress.com is partnering with Jamie over the next few months to create a series of videos that will show you how to get the most out of your website experience. From exciting new feature announcements to handy tips and tricks to Jamie’s mind-blowing “website re-creations,” we promise you’ll learn something new in every video.  

Starting later this week, you’ll see those videos posted to both our own YouTube channel as well as this blog. Stay tuned!  

WP Cloud Is Powering the Future of WordPress

The foundational infrastructure for the websites you build and manage is crucial for ensuring a safe, secure, fast, and reliable environment. That’s where WP Cloud comes in. 

Automattic, the parent company of WordPress.com, built WP Cloud because we wanted a cloud platform constructed from the ground up just for WordPress. We’ve hosted millions of websites across the WordPress ecosystem and have become one of the most trusted providers in cloud services. 

At WordPress.com, the WP Cloud infrastructure powers all websites on our Creator and Entrepreneur plans

We’re proud of WP Cloud’s 99.999% uptime, automated burst scaling and failure detection, and failover redundancies that allow you to spend time focusing on building your business or serving your clients instead of worrying about whether a traffic spike will crash the site. 

WP Cloud is also incredibly secure. With DDoS protection, malware scanning, anti-spam measures, SSL certificates, TLS traffic encryption, and real-time backups, you’ll have peace of mind from day one. 

We’re confident that there’s no better cloud platform for your WordPress site(s) than WP Cloud. And we’re not the only ones to think so. 

Today, WP Cloud is announcing that Bluehost—one of the largest website hosts in the world—is launching a new product built atop WP Cloud’s best-in-class infrastructure. 

Bluehost Cloud includes all the technical excellence of WP Cloud, with bundled options for hosting multiple websites. Plus, as with all of the sites on WordPress.com, it comes with Jetpack’s highly acclaimed performance and security features built right in. 

To kick off this partnership, we’re showcasing Bluehost Cloud on WordPress.com’s pricing page, so that you can choose the product that best fits your business needs. As fellow supporters of the WordPress ecosystem, we’re glad Bluehost has chosen WP Cloud for this powerful new offering.

Take advantage of these robust WP Cloud solutions with the Creator, Entrepreneur, or Bluehost Cloud plan.

Django security releases issued: 5.0.3, 4.2.11, and 3.2.25

In accordance with our security release policy, the Django team
is issuing
Django 5.0.3,
Django 4.2.11, and
Django 3.2.25.
These releases addresses the security issue detailed below. We encourage all
users of Django to upgrade as soon as possible.

CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

django.utils.text.Truncator.words() method (with html=True) and
truncatewords_html template filter were subject to a potential
regular expression denial-of-service attack using a suitably crafted string
(follow up to CVE-2019-14232 and CVE-2023-43665).

Thanks Seokchan Yoon for the report.

This issue has severity “moderate” according to the Django security policy.

Affected supported versions

Django 5.0
Django 4.2
Django 3.2

Resolution

Patches to resolve the issue have been applied to the 5.0, 4.2, and 3.2
release branches. The patches may be obtained from the following changesets:

On the 5.0 release branch
On the 4.2 release branch
On the 3.2 release branch

The following releases have been issued:

Django 5.0.3 (download Django 5.0.3 | 5.0.3 checksums)
Django 4.2.11 (download Django 4.2.11 | 4.2.11 checksums)
Django 3.2.25 (download Django 3.2.25 | 3.2.25 checksums)

The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

General notes regarding security reporting

As always, we ask that potential security issues be reported via
private email to [email protected], and not via Django’s
Trac instance or the django-developers list. Please see our security
policies
for further
information.

Django accessibility in 2023 and beyond

Happy birthday, Django accessibility team! 🌈

The team has been up and running for three years, and is now looking for new members. With a lot happening in this space, we thought we were overdue for an update on what we’re up to.

Django accessibility in 2023

We’re very happy with the work done to date. There have been a lot of efforts to improve the accessibility of core Django features such as forms, and of the administrative interface. Beyond Django core, there has also been progress on djangoproject.com, Django packages, and community awareness via talks and events.

Django core

We made a lot of improvements this year. Django forms saw big fixes, which shipped in Django 5.0:

Fields’ help text and errors should be associated with input – #32819
Fields’ errors should be programmatically associated with fields – #32820

With forms being such a core feature of Django, reused across countless websites, those changes will lead to accessibility improvements across big parts of the web.

The admin interface also saw a lot of fixes and improvements:

Tab order should match visual order for admin model forms’ submit buttons – #33728
Low text contrast over light blue backgrounds in admin light theme – #34036
Ensures <meta name=”viewport”> does not disable text scaling and zooming – #34617
Admin action log entry types should be communicated to screen reader users – #34618
Django admin site name shouldn’t be an h1 – #34621
RelatedFieldWidgetWrapper links don’t convey their state for screen reader users – #34622
Active row states invisible for WHCM users – #34627
RelatedFieldWidgetWrapper link icons are very hard to see – #34628
Use banner landmark or <header> element for the admin header area – #34832
Use a main landmark in the admin interface – #34833
Use search role for the admin changelist search form – #34834
Use a nav element or navigation landmark for changelist filters – #34835
Date picker cancel button does not respect color theme/dark mode – #34857
Main landmark is on the wrong element – #34905
Accessible names for Add / Change buttons in Django Admin – #34909
Admindocs index skips from h1 to h3 – #34911
Admindocs back-links and bookmarklet help text is too small – #34912
Django Admin high contrast mode no clear session – #34913
Missing scope attribute in admin doc table headers – #34919

Some of those improvements will reflect for everyone, and some will only be beneficial for users of specific assistive technologies, such as Contrast themes in Windows:

→ Screenshot of the admin interface in a “Change redirect” form, in Windows high contrast mode with the “Black” theme.

Can you spot the five issues in this screenshot? Though Contrast Themes isn’t well known, it’s a built-in feature of Windows which is essential for people with low vision. There is a lot of room for improvement to better support it in Django.

We’ve also made a lot of progress on documenting accessibility considerations, though there is still work to be done there:

FAQ: What assistive technologies are supported for using the admin?
In progress: Accessibility guidelines for all contributors
In progress: Guidelines for accessibility considerations in documentation

And finally tooling improvements such as running accessibility checks in the CI pipeline is still a big topic for us, with in-progress efforts to add checks in Selenium tests and standalone with Pa11y.

Django website

In 2023, the website saw its first ever accessibility audit with a focus on the homepage, as well as a good number of accessibility improvements. Those are all very welcome iterative steps in the context of user research on the usability of the website, led by 20tab.

Display all header anchor link indicators, always – #1429
Add Keyboard Accessibility To Hamburger Menu – #1418
Fix selection css on dark mode – #1415
Add back to top link in documentation – #1370
Improve accessibility on warning admonitions – #1360
Accessibility review of djangoproject.com at DjangoCon Europe 2023

Thank you to our website contributors Sarah Abderemane, Thibaud Colas, ontowhee, Sanyam Khurana, Hana Burtin, Paolo Melchiorre, and Tom Carrick ❤️.

Accessibility in our community

We’re elated to see accessibility being such a prominent topic in our community. In 2023, there were a lot of accessibility talks at Django events. There were accessibility contributors at the sprints for DjangoCon Europe, and DjangoCon US. The #accessibility channel on the Django Discord was also very active, and we got a new Accessibility forum category.

There were a lot of accessibility-focused talks at Django events:

Django Accessibility for Everyone – DjangoCon Europe 2023, by Lauren Parsons
Consider the Colourblind – Django Day CPH 2023, by Michael Nicholson
Best Practices for Making a Wagtail Site as Accessible as Possible – DjangoCon US 2023, by Scott Cranfill
Django’s accessibility track record – DjangoCon US 2023, by Thibaud Colas
Making Our Python Code More Accessible – PyOhio 2023, Dmitriy Chukhin & Janelle Bouchard

Our very own accessibility team member Sarah Abderemane was also featured on Django Chat: Accessibility – Sarah Abderemane 🎉, while Tom and Thibaud signed up for Djangonaut Space’s first session as navigators.

Behind the scenes, the accessibility team also started maintaining a backlog of django accessibility improvement, and also publish their accessibility team meeting notes on the forum.

Django accessibility in numbers

This year, we were able to produce statistics on the accessibility of Django projects, thanks to reports from the HTTP Archive. There is clear room for improvement, with Django websites generally scoring lower than sites built with other technologies:

→ Median Lighthouse website accessibility score of websites by framework. Source: HTTP Archive cwvtech.report, December 2023. Next.js: 85/100, Rails: 83, “All”: 82.5, Django: 80.5, ASP.NET: 79, Laravel: 78.5.

There is also clear data to establish exactly which accessibility issues are common on Django websites:

→ Difference in Lighthouse audit success rate for sites built with Django vs. average site, HTTP Archive 2023-04-01 data, Django vs. “All”. We see 8 metrics where Django does worse than average, and 8 where it does better.

We see those numbers as a good challenge for the Django community to explore ways in which the framework could be improved. There is clear room for improvement, and we have a lot of ideas on how to go about it.

Accessibility plans for 2024

There are a lot of ways in which the accessibility of Django could be improved in 2024. Here are a few ideas that have been discussed so far, where our accessibility team is looking for help:

Django ecosystem accessibility audits: Testing Trac or the Forum; or popular Django packages.
Creating an official Django demo site: converting Tom’s django-admin-demo to a ready-to-use official demo.
Stylesheets linting: To catch and fix common issues such as small font sizes or poor focus states.
Accessibility in docs: A possible big docs overhaul as a Google Season of Docs project.
New, accessible admin components: Addressing big gaps in the admin interface.
User testing: Working directly with users of assistive technologies.
An official Django accessibility statement: On the website, loud and clear.

New members

With this roadmap of improvements in mind, our accessibility team is looking for six new members in 2024. If this sounds like the type of valuable, high-purpose work you want to contribute to – reach out on the Django Discord in #accessibility, or on the forum.

Thank you

Thank you to everyone who took part in making Django more accessible in 2023 and early 2024. You rock!


You?

Come say hi on the forum

Django security releases issued: 5.0.2, 4.2.10, and 3.2.24

In accordance with our security release policy, the Django team
is issuing
Django 5.0.2,
Django 4.2.10, and
Django 3.2.24.
These releases address the security issue detailed below. We encourage all
users of Django to upgrade as soon as possible.

CVE-2024-24680: Potential denial-of-service in intcomma template filter

The intcomma template filter was subject to a potential denial-of-service
attack when used with very long strings.

Thanks Seokchan Yoon for the report.

This issue has severity “moderate” according to the Django security policy.

Affected supported versions

Django main branch
Django 5.0
Django 4.2
Django 3.2

Resolution

Patches to resolve the issue have been applied to Django’s main branch and the
5.0, 4.2, and 3.2 stable branches. The patches may be obtained from the
following changesets:

On the main branch
On the 5.0 release branch
On the 4.2 release branch
On the 3.2 release branch

The following releases have been issued:

Django 5.0.2 (download Django 5.0.2 | 5.0.2 checksums)
Django 4.2.10 (download Django 4.2.10 | 4.2.10 checksums)
Django 3.2.24 (download Django 3.2.24 | 3.2.24 checksums)

The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E

General notes regarding security reporting

As always, we ask that potential security issues be reported via private email
to [email protected], and not via Django’s Trac instance, nor via
the Django Forum, nor via the django-developers list. Please see our security
policies
for further information.

DSF calls for applicants for a Django Fellow

After five years as part of the Django Fellowship program, Mariusz Felisiak has let us know that he will be stepping down as a Django Fellow in March 2024 to explore other things. Mariusz has made an extraordinary impact as a Django Fellow and has been a critical part of the Django community.

The Django Software Foundation and the wider Django community are grateful for his service and assistance.

The Fellowship program was started in 2014 as a way to dedicate high-quality and consistent resources to the maintenance of Django. As Django has matured, the DSF has been able to fundraise and earmark funds for this vital role. As a result, the DSF currently supports two Fellows – Mariusz Felisiak and Natalia Bidart. With the departure of Mariusz, the Django Software Foundation is announcing a call for Django Fellow applications. The new Fellow will work alongside Natalia.

The position of Fellow is focused on maintenance and community support – the work that benefits most from constant, guaranteed attention rather than volunteer-only efforts. In particular, the duties include:

Answering contributor questions on Forum and the django-developers mailing list
Helping new Django contributors land patches and learn our philosophy
Monitoring the [email protected] email alias and ensuring security issues are acknowledged and responded to promptly
Fixing release blockers and helping to ensure timely releases
Fixing severe bugs and helping to backport fixes to these and security issues
Reviewing and merging pull requests
Triaging tickets on Trac

Being a Django contributor isn’t a prerequisite for this position — we can help get you up to speed. We’ll consider applications from anyone with a proven history of working with either the Django community or another similar open-source community. Geographical location isn’t important either – we have several methods of remote communication and coordination that we can use depending on the timezone difference to the supervising members of Django.

If you’re interested in applying for the position, please email us at [email protected] describing why you would be a good fit along with details of your relevant experience and community involvement. Also, please include your preferred hourly rate and when you’d like to start working. Lastly, please include at least one recommendation.

Applicants will be evaluated based on the following criteria:

Details of Django and/or other open-source contributions
Details of community support in general
Understanding of the position
Clarity, formality, and precision of communications
Strength of recommendation(s)

Applications will be open until 1200 AoE, February 16, 2024, with the expectation that the successful candidate will be notified no later than March 1, 2024.

DjangoCon Europe 2025 Call for Proposals

DjangoCon Europe 2024 will be held June 5th-9th in Vigo, Spain but we’re already looking ahead to the 2025 conference. Could your town – or your football stadium, circus tent, private island or city hall – host this wonderful community event?

Hosting a DjangoCon is an ambitious undertaking. It’s hard work, but each year it has been successfully run by a team of community volunteers, not all of whom have had previous experience – more important is enthusiasm, organizational skills, the ability to plan and manage budgets, time and people – and plenty of time to invest in the project.

How to apply

We’ve set up a working group of previous DjangoCon Europe organizers that you can reach out to with questions about organizing and running a DjangoCon Europe. [email protected]. There will also be an informational session set up towards the end of January or early February for interested organizers. Please email the working group to express interest in participating.

In order to give people the chance to go to many different conferences DjangoCon Europe should be held between January 5 and April 15 2025. Please read the licensing agreement the selected organizers will need to sign for the specific requirements around hosting a DjangoCon Europe

If you’re interested, we’d love to hear from you. This year we are going to do rolling reviews of applications, in order to hopefully give more time and certainty to the selected proposal to start planning. The board will begin evaluating proposals on February 20th. The selection will be made at any time between February 20th and May 31st. The DSF Board will communicate when a selection has been made and the application process is complete. IF you are interested in organizing it is in your best interest to get a good proposal in early.

Following the established tradition, the selected hosts will be publicly announced at this year’s DjangoCon Europe by the current organizers.

The more detailed and complete your proposal, the better. Things you should consider, and that we’d like to know about, are:

dates Ideally between early January and mid April 2025
numbers of attendees
venue(s)
accommodation
transport links
budgets and ticket prices
committee members

We’d like to see:

timelines
pictures
prices
draft agreements with providers
alternatives you have considered

Email your proposals to [email protected]. We look forward to reviewing great proposals that continue the excellence the whole community associates with DjangoCon Europe.