Restore minimum WordPress requirement to 6.8 by kasparsd · Pull Request #1013 · WordPress/two-factor

kasparsd · 2026-10-02T12:25:28Z

What?

Restore the minimum required WordPress version from 7.0 to 6.8, matching the requirement in Two-Factor 0.16.0.

Why?

WordPress 6.8 sites running Two-Factor 0.16.0 are blocked from updating to 0.17.0 by the WordPress 7.0 requirement. This prevents those sites from receiving the security fix shipped in 0.17.0.

How?

Lower the Requires at least plugin header to 6.8.
Update contributor instructions to reflect the WordPress 6.8 minimum. Preserve the readme support policy and note that the plugin attempts to maintain backward compatibility with older WordPress versions for as long as possible.
Add WordPress 6.8 and 6.9 to the existing PHPUnit CI matrix.

Use of AI Tools

AI assistance: Yes
Tool(s): OpenAI Codex
Model(s): GPT-6
Used for: Investigating the issue and version history, editing the plugin metadata, documentation and CI matrix, running validation commands, and preparing this pull request.

Testing Instructions

Build the plugin with npm run build.
Install and activate it on WordPress 6.8 with PHP 7.4 or later; verify activation is allowed by the minimum-version check.
Configure a supported two-factor provider and verify a login requires and accepts the second factor.
Run the single-site and multisite suites through npm test in a running wp-env environment using WordPress 6.8. The added CI matrix entries run both suites against WordPress 6.8 and 6.9.

Validation performed: npm run build and PHP lint passed. The diff whitespace check passed with the readme's existing CRLF line endings accounted for. Local PHPUnit execution was attempted through the required wp-env wrapper but could not run because the tests-cli container is stopped; WordPress 6.8 runtime compatibility has not been verified locally.

Changelog Entry

Fixed - Restore WordPress 6.8 compatibility so supported sites can receive the security fixes in Two-Factor 0.17.0.

Allow WordPress 6.8 sites to receive the security fixes in 0.17.0. Restore the previous minimum and cover it in the CI test matrix. Fixes #1012

github-actions · 2026-10-02T12:25:39Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: kasparsd <kasparsd@git.wordpress.org>
Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>
Co-authored-by: georgestephanis <georgestephanis@git.wordpress.org>
Co-authored-by: todeveni <skithund@git.wordpress.org>
Co-authored-by: Xilonz <xilonz@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-10-02T12:28:15Z

✅ WordPress Plugin Check Report

✅ Status: Passed

📊 Report

All checks passed! No errors or warnings found.

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

kasparsd · 2026-10-02T12:46:52Z

The PHP 8.5 test error is caused by WP core internal, not this plugin:

There were 2 errors:

1) Test_ClassTwoFactorCore::test_filter_authenticate_api_with_app_password
PHPUnit\Framework\Exception: [02-Oct-2026 12:31:23 UTC] PHP Deprecated:  Non-canonical cast (double) is deprecated, use the (float) cast instead in /var/www/html/wp-includes/IXR/class-IXR-message.php on line 180
[02-Oct-2026 12:31:23 UTC] PHP Deprecated:  Non-canonical cast (boolean) is deprecated, use the (bool) cast instead in /var/www/html/wp-includes/IXR/class-IXR-message.php on line 199

2) Test_ClassTwoFactorCore::test_filter_authenticate_api
PHPUnit\Framework\Exception: [02-Oct-2026 12:31:25 UTC] PHP Deprecated:  Non-canonical cast (double) is deprecated, use the (float) cast instead in /var/www/html/wp-includes/IXR/class-IXR-message.php on line 180
[02-Oct-2026 12:31:25 UTC] PHP Deprecated:  Non-canonical cast (boolean) is deprecated, use the (bool) cast instead in /var/www/html/wp-includes/IXR/class-IXR-message.php on line 199

masteradhoc · 2026-10-02T19:55:20Z

Hey @kasparsd,

Appreciate the quick response and the idea here.

See https://github.com/WordPress/two-factor/blob/master/readme.txt#L134-L136:

This plugin supports the last two major versions of WordPress and the minimum PHP version supported by those WordPress versions.

Supporting WordPress 6.8 would therefore not be in line with our current documented support policy. We could certainly change that policy, but I think we should distinguish between lowering the minimum WordPress version and lowering the minimum PHP version.

Dropping the minimum PHP version back to 7.2 would likely cause issues with dependencies and future development. For example, things like the WP Secret API may expect PHP 7.4, which is also closer to the minimum version supported by WordPress core.

IMO, users who care about security and specifically use a two-factor authentication plugin should not be encouraged to run it on a PHP version that has been unsupported for almost six years.

So, just my opinion: I'm fine with lowering the minimum WordPress core version if there is a good reason to do so, but I would strongly prefer not to lower the minimum PHP version to 7.2.

jeffpaul · 2026-10-03T14:17:10Z

I don't agree with this change, see #1012 (comment)

kasparsd · 2026-10-05T17:20:04Z

@masteradhoc This preserves the PHP 7.4 minimum requirement while relaxing the WP core down to 6.8.

@jeffpaul could we make an exception here due to the security fixes included in the release?

georgestephanis · 2026-10-06T18:20:30Z

Okay, to ask a different question t hat may get more to the root -- can we instead ship a 0.16.1 that includes the fixes but keeps the version requirements lower, but leave current on the up to date version?

masteradhoc · 2026-10-06T18:25:27Z

@georgestephanis just fyi: https://meta.trac.wordpress.org/ticket/6292

in this case it wouldnt help but if there was more time inbetween the releases at least those that wanted to update would have been able.

georgestephanis · 2026-10-06T19:02:02Z

Ugh, so the update check will ignore the older version that it could take. That's unfortunate.

I take it from this PR that we don't actually have any functionality in the plugin that requires higher than 6.8 currently?

masteradhoc · 2026-10-06T19:08:38Z

@georgestephanis you are right - we just need the PHP 7.4 requirement. So a new release would also make it available again for all >= WP 6.8 and >= PHP 7.4

masteradhoc

Seems the testsuite already goes to WP 7.2 trunk to include the WP Secrets API that it cant find on 7.1 as it lands on 7.2. We should work on that in a separate PR

after the guard that 8.5 doesnt get tested on WP 6.8 as thats not supported im fine with this one.

fix: restore WordPress 6.8 compatibility

624e2c4

Allow WordPress 6.8 sites to receive the security fixes in 0.17.0. Restore the previous minimum and cover it in the CI test matrix. Fixes #1012

fix: clarify support policy and test WordPress 6.9

838a532

kasparsd requested review from jeffpaul and masteradhoc and removed request for masteradhoc October 2, 2026 12:29

masteradhoc assigned kasparsd Oct 2, 2026

masteradhoc added 2 commits October 17, 2026 08:07

Merge branch 'master' into fix/1012-wordpress-minimum-version

dbcf56e

exclude 8.5 for wp 6.8

cf7361e

masteradhoc approved these changes Oct 17, 2026

View reviewed changes

masteradhoc merged commit 768ce05 into master Oct 17, 2026
31 of 36 checks passed

masteradhoc deleted the fix/1012-wordpress-minimum-version branch October 17, 2026 16:09

masteradhoc added this to the 0.18.0 milestone Oct 17, 2026

Navigation Menu

Repository navigation

Restore minimum WordPress requirement to 6.8 - #1013

Restore minimum WordPress requirement to 6.8#1013
masteradhoc merged 4 commits into
masterfrom
fix/1012-wordpress-minimum-version

kasparsd commented Oct 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

kasparsd commented Oct 2, 2026

Uh oh!

masteradhoc commented Oct 2, 2026

Uh oh!

jeffpaul commented Oct 3, 2026

Uh oh!

kasparsd commented Oct 5, 2026

Uh oh!

georgestephanis commented Oct 6, 2026

Uh oh!

masteradhoc commented Oct 6, 2026

Uh oh!

georgestephanis commented Oct 6, 2026

Uh oh!

masteradhoc commented Oct 6, 2026 •

edited

Loading

Uh oh!

masteradhoc left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

kasparsd commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What?

Why?

How?

Use of AI Tools

Testing Instructions

Changelog Entry

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026

✅ WordPress Plugin Check Report

📊 Report

Uh oh!

kasparsd commented Oct 2, 2026

Uh oh!

masteradhoc commented Oct 2, 2026

Uh oh!

jeffpaul commented Oct 3, 2026

Uh oh!

kasparsd commented Oct 5, 2026

Uh oh!

georgestephanis commented Oct 6, 2026

Uh oh!

masteradhoc commented Oct 6, 2026

Uh oh!

georgestephanis commented Oct 6, 2026

Uh oh!

masteradhoc commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

masteradhoc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kasparsd commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

masteradhoc commented Oct 6, 2026 •

edited

Loading