Maintenance life cycle
Keeping themes and extensions alive: upgrades, compatibility, security fixes and retirement.
38 pages
- The maintenance life cycle: start here The map for keeping a theme alive after its first release - following Exponential releases, upgrade testing, per-release accessibility, CSP and performance audits, security fixes, deprecation, end of life, handover…
- Upgrade testing, step by step The routine for testing a theme against a new Exponential release - update the test installation, clear caches, walk the page list, compare overrides, check the error log, audit, and record the result.
- Checklist: one maintenance cycle One maintenance cycle of a theme as a checklist - watch, test, audit, fix, release, communicate - each item linked to the page that explains it.
- The life cycle of a theme The stages a theme passes through - development, first release, active maintenance, security-only maintenance, end of life, archive or handover - what each stage promises users, and how to announce a change of stage.
- A support policy for your theme Write down which versions of a theme you maintain, with which Exponential and PHP versions, and what an older version gets - modeled on the supported-versions table of Exponential's own security policy.
- Following Exponential releases Where to watch for changes that affect a theme - the changelogs in doc/changelogs, release tags and GitHub releases of the repository, the upgrade notes in doc/eng-us/bc, project news and RSS - and a weekly routine.
- Reading a changelog as a designer What to look for in an Exponential changelog when you maintain a theme - templates you override, design settings, operators, JavaScript libraries, security headers, PHP versions, accessibility - with real examples from…
- A compatibility matrix Keep a table of which theme versions were tested with which Exponential, PHP, server engine and database versions, and the browsers and widths you check - how to fill it honestly and where to publish it.
- PHP version compatibility Keep a theme's PHP code (operators, modules, classes) working on every PHP version Exponential supports - PHP 8.0 is the oldest, PHP 7.4 usable without support - with php -l per version, what typically breaks, and how…
- Declaring compatibility Tell users and tools which Exponential and PHP versions a theme release works with - composer.json require, the README's requirements, extension.xml dependencies and the release notes - consistently.
- An upgrade test environment Set up a place to test a theme against new Exponential and PHP versions - a separate installation installed with Composer, demo content, the theme as a Git checkout, and a way to reset it - never a live site.
- Comparing your overrides with the standard templates Find out whether the standard templates you copied into your theme changed upstream - list your copies, diff them against the new release, and merge fixes (especially escaping and accessibility fixes) into your versions.
- JavaScript library upgrades (jQuery 4, no YUI) Bring a theme's JavaScript up to date with the libraries Exponential ships - jQuery 4.0.0 with Migrate and jQuery UI 1.14.2 through ezjscore, YUI removed - what to search for, what to replace, and how to test.
- Removing inline scripts and styles Move a maintained theme toward a strict Content Security Policy - find inline script blocks, event handler attributes, javascript: links and style attributes, move them into files and data attributes - following how the…
- An accessibility audit for every release A repeatable accessibility audit before each theme release - axe on the page list at three widths in light and dark, keyboard walk, zoom, contrast - recording results and fixing serious issues first, as the 7x themes…
- A CSP audit for every release Check before each release that the theme still works under a strict Content Security Policy - report-only mode on a test siteaccess, the browser console, a grep for inline code, and external resources.
- Visual regression checks: light, dark, zoom Catch unintended visual changes between releases - screenshots of the page list at fixed widths and modes before and after, compared side by side or by tool - with the widths the Exponential project uses.
- A performance audit for every release Check that a release did not make the theme slower - page weight, number of requests, image sizes, layout shift and largest contentful paint on the page list - and compare with the previous release.
- Security fixes in themes The security problems a theme can have - unescaped output, output in the wrong context, inline script injection, links opening other sites, exposed settings - how to find them, and a real fix from a published theme.
- Handling security reports What to do from the moment a security report arrives - acknowledge, reproduce privately, assess, fix, release, credit - and what to do when the report arrives in a public issue.
Documentation license
This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.
Exponential Copyright © 1998-2026 Exponential Foundation and 7x