DEV: Refactoring? I barely know her!

Welcome to DEV, your biweekly dose of WordPress news.

We’ve rounded up the latest tools, clever developer tricks, new features, and standout community creations, all carefully curated to help you keep building with confidence. 🧱

Stick around until the end to see the moment a future star is born.

In today’s edition:

Patchstack and FAIR are teaming up to create a brand new security MVP that gives you early warning before chaos hits your site.
December 2nd is coming: WordPress 6.9 is released and we expect dramatic keynote moments.
Coming soon: Watch someone else destroy your carefully crafted block in real time.

Hot off the press: what’s new?

You know that moment when your code looks a little wobbly and you think, “ Um, I’ll clean it up later.”?

Yes. This way you end up with something that is technically functional but structurally cries out for help.

It’s always:Just keep going, no time for refactoring…Until you have something that’s held together with TODO comments, mysterious helper functions, and that one CSS class you’re too afraid to delete. But hey, that’s part of the charm, right?

In the meantime, we’ve got your back with the latest developer tips, news, and insights to help you build something small firmer this week. 🧱

🎶 Oh little town San Francisco🎶

Mark your calendar for December 2, 2025. Shining on the dark streets of San Fran is the eternal light of the annual State of the Word keynote, and the hopes and fears of all the years (aka WordPress 6.9) will be launched on the very same evening.

This year’s event, hosted by Matt Mullenweg, promises to be a showcase of what’s next for the WordPress ecosystem: big announcements, surprises, and live demos. And yes, if you’ve been waiting for 6.9, you can finally unpack it and play with it.

Whether you’re in San Fran or watching from your computer chair with a cup of coffee, you can expect live walk-throughs of new features, a first look at future roadmaps, and plenty of grand poetic messages about the ✨meaning of all this✨.

Whether you’re a freelancer, agency, or plugin builder, now is the time to pause, pay attention, and plan for what’s to come.

👉 Remind yourself of what’s new in 6.9
👉 If you haven’t already, check out the official announcement on the State of the Word site

Real-time collaboration is getting closer for WordPress

Ever wish WordPress editing felt a little more… Google Docs-y? Real-time collaboration is moving forward Phase 3 of the Gutenberg Roadmap. Soon you might see your teammates actually typing instead of just imagining them silently judging you.

The goal: faster, smoother and truly collaborative teamwork.

This is what the core team lays the foundation for:

Live cursors and simultaneous editing
Inline comments and suggestions
Improved post locking (no more ‘This post is currently being edited’ purgatory)
More intuitive version history
Smoother workflows with multiple authors

Of course, getting WordPress to behave like Google Docs is no easy feat. If Steve Burge explained it years agoGoogle can rely on its own tightly controlled ecosystem. WordPress, on the other hand, has to make all this magic work in very different hosting configurations, from enterprise-level powerhouses to simple shared servers.

WordPress VIPreleased in late October, uses WebSockets to enable real-time editing, complete with live cursors, automatic conflict resolution, and friendly floating avatars. The catch? You’ll need WordPress 6.7+, a WebSocket server, and a custom Gutenberg build. Not every host supports that, so this approach may ultimately be a solution VIP-only party for a while.

Good news: Block comments (“Notes”) will ship on December 2 with WordPress 6.9, which will let you leave, view, and resolve asynchronous inline comments on blocks.

Real-time collaboration is slowly but surely coming. One day this feeling will be yours too within WordPress!

👉 Check out the latest Phase 3 update at Make.WordPress.org
👉 Follow the roadmap as WordPress moves towards real-time editing

FAIR Alert: Patch Stack & FAIR Build Security MVP at CloudFest USA

During the first CloudFest USA Hackathon in Miami on November 4, more than 22 contributors from Patchstack and the FAIR Package Manager project put their heads together to FAIR Software Security Assistant.

It’s an MVP of a tool that gives you vulnerability alerts right in your WordPress admin.

This is what they cooked:

A vulnerability screening engine that couples Patchstack’s intelligence with FAIR’s decentralized packaging system.
A policy engine that allows hosts or site owners to block, flag, or approve plugins and themes before they appear on dashboards.
A minimal dashboard/monitoring interface so you can visualize the health of your repository without delving into logs or obscure APIs.

👉 View the project description here for more details.

This means the conversation shifts from “how do we fix bugs?” to “how do we prevent the risky things from ever being installed in the first place?” If you run a lot of WordPress sites or build tools that others install, this is worth your attention.

Hosts that adopt FAIR can theoretically start enforcing security earlier in the chain, which means fewer surprise patches and hopefully fewer late nights of “oh no, we have a vulnerability.”

This MVP is just a starting point. FAIR plans to expand integrations, refine UX, and keep the project agnostic so other security providers can join in as well.

And the best part? You don’t have to be a developer to contribute. Hackathon teams consisted of backend, UI/UX, and policy experts, proving that anyone can help shape the project.

👉 Interested in helping? Join the FAIR Slack chat
👉 Watch this great video interview about the project