Between November 16 and November 30, 2025, PHP 8.5 shipped with a pipe operator, a built in URI extension and clone with, Angular v21 arrived, and the Angular team fixed an XSRF token leak in its HTTP client. Act on this first: test before you switch to PHP 8.5, because it brings deprecations and the removal of disable_classes that older plugins, themes and servers can run into.
Below is a quick summary table, then a section on the release covering what shipped, what it means for you, how we use it in WordPress builds, what it means for mobile apps and what to do next.
At a glance
| Release | Date | Type | Who should care | Action |
|---|---|---|---|---|
| PHP 8.5 | Nov 20 | Feature | Every WordPress site, and developers of custom plugins and themes | Plan and test |
| Angular v21 | Nov 19 | Major release | Angular and Ionic app teams | Plan the v21 upgrade |
| Angular security advisories | Nov 26 | Security | Angular, Ionic Angular and SSR front ends | Update Angular packages |
PHP 8.5: the pipe operator, a URI extension and clone with
What shipped
PHP 8.5 was released on November 20, 2025. It is the latest minor release of the PHP language, and it adds a pipe operator, a built in URI extension, a simpler way to clone objects while changing their properties, a new #[\NoDiscard] attribute and persistent cURL share handles, along with a list of deprecations that plugin and theme developers need to plan for.
The pipe operator. The new |> operator passes a value from left to right through a chain of callables. Code that used to be written as nested function calls, read from the inside out, can now be written as a sequence that reads in the order it runs.
A built in URI extension. PHP 8.5 includes an always available URI extension for parsing, normalizing and changing URLs according to the RFC 3986 and WHATWG URL standards. It is powered by the uriparser and Lexbor libraries and gives developers a standards based alternative to parse_url().
Clone with and #[\NoDiscard]. Objects can now be cloned with updated properties by passing an array to clone(), which makes the "with-er" pattern simple for readonly classes. The new #[\NoDiscard] attribute makes PHP warn when a function's return value is ignored, and a (void) cast marks a value as intentionally unused.
Persistent cURL share handles. The new curl_share_init_persistent() function creates cURL share handles that are not destroyed at the end of each request. When a persistent handle with the same options exists, PHP reuses it, which avoids the cost of setting up connections to the same hosts again and again.
Smaller additions developers will use:
- New array_first() and array_last() functions return the first or last value of an array, or null when it is empty
- Fatal errors, such as an exceeded maximum execution time, now include a backtrace
- setcookie() and setrawcookie() support the "partitioned" key
- Static closures and first class callables can be used in constant expressions, including attribute parameters
- Static properties support asymmetric visibility, and #[\Override] can be applied to properties
Deprecations and breaking changes. According to the official release announcement, PHP 8.5 includes these changes that existing code may run into:
- The backtick operator as an alias for shell_exec() is deprecated
- The non canonical casts (boolean), (integer), (double) and (binary) are deprecated in favor of (bool), (int), (float) and (string)
- The disable_classes INI setting has been removed
- Ending case statements with a semicolon instead of a colon is deprecated
- Using null as an array offset or in array_key_exists() is deprecated
- __sleep() and __wakeup() are soft deprecated in favor of __serialize() and __unserialize()
- Warnings are now emitted when casting NAN, when destructuring non array values and when casting floats that cannot be represented as integers
What it means for you
For a site owner, the pipe operator is invisible: pages do not load differently because of it. Most of PHP 8.5 shows up in the quality of the custom code behind your site, not on the page.
Deprecation notices do not stop a site, but they fill logs and point to code that will break in a later PHP version. Using null as an array key and the old cast names are both common in older plugins and custom themes. Some hosting setups used disable_classes as a hardening measure, and with the setting removed in PHP 8.5, that protection no longer applies.
Some of its changes, such as persistent cURL share handles, can reduce overhead for custom integrations, but gains depend on your code and hosting. You do not have to move right away: according to php.net, PHP 8.4 has active support until December 31, 2026 and security support until December 31, 2028.
How we use it in WordPress builds
Pipe operator. In the custom plugins we write and maintain for you, data cleanup steps, such as trimming, formatting and sanitizing form input, become easier to read and review. Easier review means fewer mistakes slip into production. We only use it in code that will run on PHP 8.5 or later, so we check your server version before it goes into anything we ship.
URI extension. Websites handle URLs constantly: redirects, canonical links, API endpoints and links pasted into forms. Parsing them inconsistently is a common source of open redirect and validation bugs. When we build integrations, redirect tools or link handling for a client on PHP 8.5, the new extension lets us validate URLs against a published standard instead of hand written rules. On older PHP versions we keep using WordPress's own URL functions, so nothing breaks while servers catch up.
Clone with and #[\NoDiscard]. Readonly objects are a good fit for settings, prices and API responses that should never change by accident, and clone with makes a slightly changed copy one line instead of a block of boilerplate. Some functions return a result that must be checked, such as whether a payment was captured or a file was saved. On PHP 8.5 projects, we mark those functions with #[\NoDiscard] so PHP itself warns us during development and testing, long before the code reaches your live site.
Persistent cURL share handles. Many WordPress sites call outside services on every page or checkout: payment gateways, shipping rates, CRMs and AI APIs. In custom integrations we write on PHP 8.5, we can use persistent share handles for busy endpoints and measure the response times before and after, so any gain is something you can see in the numbers.
Fatal error backtraces and partitioned cookies. A timeout or fatal error on a live site has always been hard to trace, because the log only said where PHP stopped. With a backtrace in the log, we can see which plugin or function led there, and we make sure error logs stay private and are not displayed to visitors. Partitioned cookies are designed for content embedded on other websites, such as booking widgets, chat tools or forms inside a partner's site; we review embedded features on client sites and test them in current browsers to confirm sessions and logins still work inside the embed.
What it means for mobile apps
The pipe operator, clone with and #[\NoDiscard] apply to the app backends we build as much as to plugins: readonly objects for API responses, and checked results for things like payment capture, mean fewer places for a bug to hide. AppPresser apps load content from your WordPress site, so the app runs on whichever PHP version the site runs, and we include the app's screens in the staging test before a site moves to PHP 8.5.
What to do next
Core support is only part of the picture. Your site also depends on its theme and every active plugin, and those move at their own pace. We test each client site on a PHP 8.5 staging copy first, check the front end, checkout, forms and admin screens, and watch the error log for warnings. Before we move a client site, we scan the theme and plugins for deprecated patterns, fix the custom code we are responsible for and flag third party plugins whose authors have not caught up. For sites on servers we manage, we review the php.ini settings and replace any reliance on disable_classes with controls that still work, such as proper file permissions and a web application firewall. Sites move to PHP 8.5 only when that test is clean; until then, a supported earlier version keeps them safe. Our support and maintenance plans include tested PHP upgrades on staging, and our custom WordPress development team can update custom plugins and themes for the new version. Contact us to talk it through.
Angular v21 Drops zone.js From New Apps and Makes Vitest the Default
What shipped
The Angular team announced v21 on November 19, 2025. The headline changes:
- Released November 19, 2025 (angular.dev lists v21 as released 2025-11-19).
- New applications no longer include zone.js by default.
- Vitest is the stable default test runner in the Angular CLI.
- Signal Forms launched as an experimental API built on signals.
- Angular Aria launched in developer preview with 8 accessible UI patterns.
- The Angular MCP server ships with seven stable and experimental tools.
What it means for you
New projects start without zone.js, which changes how change detection runs. Existing apps keep working, but code that relied on zone.js timing should be tested before it moves to the new defaults.
How we use it in WordPress builds
We use Angular for some decoupled front ends that read content from the WordPress REST API. For those builds, v21 mostly changes the test setup and how new components are generated, not how WordPress data is fetched.
What it means for mobile apps
Ionic Angular apps can move to v21 on their own schedule. AppPresser apps that use custom Angular components should run their test suite under the new defaults before upgrading, since zoneless behavior can change when the screen updates after a network call.
What to do next
Run ng update on a branch and run the full test suite. Keep zone.js in existing apps until you have tested without it. Our headless WordPress team handles Angular front ends tied to WordPress.
Angular security advisories
What shipped
The Angular team published these security advisories in this period:
- CVE-2025-66035 (high): XSRF token leakage through protocol relative URLs in the HTTP client, in @angular/common
What it means for you
These flaws are in the Angular framework, not in WordPress. They matter if you run an Angular front end, an Ionic Angular app or server side rendering in front of WordPress.
How we use it in WordPress builds
On headless WordPress front ends built with Angular, we update the @angular packages to the fixed version for the project's major line and rerun rendering, login and form tests.
What it means for mobile apps
Ionic Angular apps ship Angular inside the app, so a fix for code that runs in the app needs a rebuild and a new store submission.
What to do next
- Update to Angular 21.0.1, 20.3.14 or 19.2.16 or later.
- Ask our mobile app team to rebuild and resubmit an affected app.
How AlphaWeb handles updates for you
One release in two weeks, but a new PHP version touches every plugin, theme and server it runs on. Our support and maintenance plans cover tested WordPress core, theme and plugin updates on staging first, then in production, with uptime monitoring and help when something breaks. Our WordPress security and hosting service keeps PHP versions and servers current, and our custom WordPress development and custom mobile apps teams put new features to work when they fit.
We also track the server, app platform and payment releases behind your site and app, including Angular. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Request a custom development quote, or tell us about your project through our Mission Brief.
Frequently asked questions
Do existing Angular apps lose zone.js when they update to v21?
No. Only new projects created with v21 leave zone.js out. An existing app keeps zone.js until you choose to remove it.
Brief Us on Your Mission
Want to talk about a website, mobile app, migration or AI project? Fill out the Mission Brief and a specialist will follow up to schedule a call and put together a free quote.
