Wrong/missing minor version for WP developer edition

[d19dotca]

@guyds I think the way Cloudron packages this one means it will only apply the WordPress updates to NEW deployments, rather than upgrading existing sites. It will respect the currently deployed WordPress version, because we noted earlier the expectation here is that the package updates don’t actually touch any thing in the app for us, as we want full control over the versioning updates ourselves instead. If you want the app packages to update your core WordPress too, then you’d want to use the regular packaged app rather than Unmanaged/Developer style.

[girish]

@d19dotca said in Wrong/missing minor version for WP developer edition:

I think the way Cloudron packages this one means it will only apply the WordPress updates to NEW deployments, rather than upgrading existing sites

Pretty much this.

[jdaviescoates]

Also, if it turns out you do want your WP Developer package to auto-update (like I do, I think generally it's safer to auto update than the risk of being hacked if you don't update, especially if you have nice Cloudron backups which make restoring easy), then just enable that within WordPress itself.

Also, IMHO everyone using WP should install WordFence too for good measure.

[guyds]

Hi all, this isn't pretty much about how to keep Wordpress up-to-date or secure but about how Cloudron updates it (or not).

As I said, Cloudron DOES update the package to the latest version so it is expected that the version number is increased. If that is not the case then what's the point of updating it.

I'm sorry, but I still don't get it.

Of course I can enable auto-updates in Wordpress, of course I can use MainWP, ManageWP and others to keep Wordpress and its plugins and themes up-to-date, but that's not the point of this topic.

[girish]

@guyds said in Wrong/missing minor version for WP developer edition:

If that is not the case then what's the point of updating it.

On Cloudron, packages are docker images. Docker images bundle a lot of things - libraries, apache, php, to name a few. When the package is updated, these libraries are updated to the latest secure version. This is the only reason to update the WP developer app inside Cloudron despite it not updating WP itself. Does that make sense?

[d19dotca]

@guyds said in Wrong/missing minor version for WP developer edition:

As I said, Cloudron DOES update the package to the latest version so it is expected that the version number is increased. If that is not the case then what's the point of updating it.
I'm sorry, but I still don't get it.

So as we said earlier, the logic is that the package update will only apply the latest WordPress version IF it's a new deployment. If it's an existing deployment, the package update doesn't really do much. And that's intentional here for WordPress Developer package, as the whole point of the Developer package is to ensure Users have full control over their WordPress updates rather than being forced by Cloudron. Other benefits too, but that's one of the biggies.

[guyds]

Ok, I thought the whole point of the developer package was to have a "regular" version of Wordpress where you have more permissions and control over the code (such as plugins, themes, ...) similar to packages of other apps (NextCloud, Matomo, whatever) and that the managed version of Wordpress was to have a locked down version for security reasons.

But actually it seems none of the 2 Wordpress packages work in a similar way as the packages for other apps, since the managed version is a locked down version and the developer version is a "do it yourself" version.
Is that correct?

If so, then why is there no regular version of the Wordpress package where the core (i.e. Wordpress itself) is updated, similar to other Cloudron apps, while the plugins and other stuff are up to the user (again, similar to other Cloudron apps)?

Take for example Nextcloud:
When there's a newer version of Nextcloud a new Cloudron package is prepared and after updating to that new package Nextcloud is at the newer version. Nextcloud plugins/addons are not updated and should be managed by the user.
Why isn't this behaviour applicable to (one of) the Wordpress package(s)?

[robi]

@guyds Have you tried the managed version yet? It's as regular as most people need with ability to install any plugins and tweaks.

[guyds]

@robi Yes, I tried it but it's too locked down. There were several plugins that didn't work, e.g. some security plugins.

[d19dotca]

@guyds said in Wrong/missing minor version for WP developer edition:

If so, then why is there no regular version of the Wordpress package where the core (i.e. Wordpress itself) is updated, similar to other Cloudron apps, while the plugins and other stuff are up to the user (again, similar to other Cloudron apps)?

The Developer version is essentially the "regular version of the WordPress package"... you are free to have it auto-update WordPress core (even plugins and themes) as you please, and do essentially whatever you want with it. However all of those updates are completely independent of Cloudron package updates in this case.

If you're expecting Cloudron to update WordPress for you as is the case for other apps, then you want the Managed version instead. As you've said though, that is too locked down for your needs which means you'll want to use Developer but obviously configure it correctly in WordPress to update as you see fit for your own needs.

[robi]

@guyds if you can be more specific on what didn't work, we may be able to provide alternate options that do.

[guyds]

@robi I think this says it all:

https://git.cloudron.io/cloudron/wordpress-managed-app/-/issues/32