Skip to content

LiveSeptember 23, 2026 · one session

Update Forecast

Reads a plugin release's changelog and every support topic since it came out, and says whether to update today.

I built Update Forecast for a decision every WordPress maintainer makes each week: update this plugin now, or wait? It reads the new release's changelog and every support-forum topic opened since it came out, sorts the breakage reports from the how-to questions, and gives one of five verdicts with the topics behind it linked. The free tools I found rate the plugin, not the release, and none of them reads the forum.

Forecast a plugin(opens in a new tab)Build something similar
keyless WordPress.org sources per forecast
3
verdicts, each with its reasons and topics
5
support topics read per release at most
30
typed questions per topic, six topics a request
4
before a quiet release is called safe
72 h
tests, two of them from real plugin data
28
a forecast is kept, so repeats cost nothing
20 min
records stored
0

Architecture

Five parts, without a database.

My role: Product owner and developer. I researched the gap, set the brief and shipped it to production, with Claude Code as my AI pair programmer.

  • src/lib/wporg.ts

    The three sources: the plugin's details, changelog and forum feed cached 15 minutes, the current WordPress version an hour.

  • src/lib/forecast.ts

    The readings (Jev or keyword rules) and the verdict: a pure function with named thresholds, kept 20 minutes.

  • src/lib/jev.ts

    One typed request per batch, every question pointing into the state by path, answers validated, one retry when busy.

  • src/lib/injection.ts

    Forum text written to steer AI readers is kept away from Jev, read by the rules and flagged.

  • src/app

    A page per plugin, a batch of ten for update day and a JSON endpoint, all read live and kept out of search.

  • Next.js 16
  • React 19
  • TypeScript
  • Tailwind CSS 4
  • fast-xml-parser
  • Vitest
  • Vercel
  • Jev (TypeSafe AI)

Why it exists

The per-release reading nobody offered for free

The standard advice before a plugin update is manual: read the changelog, then read the support forum for reports of breakage. The free tools I found answer a different question.

What exists

  • A free plugin risk score rates the plugin from five Plugin API factors; it reads neither the changelog nor the forum
  • A per-update score from code-diff size and version gap, inside paid maintenance platforms
  • WordPress.org's automated security review, announced on September 9, 2026, checks each release for security risks and says nothing about functional breakage

What Update Forecast adds

  • What the release's changelog says, read together with what people have reported since it came out
  • A verdict that links to the topics behind it, so the reader can check the evidence

How it reads

A changelog and every topic since the release

For any plugin on WordPress.org it fetches the details and changelog, the newest support topics with their first post, and the current WordPress version. Only topics opened since the release count; older ones are counted and set aside.

With Jev

  • One request for the changelog entry: does it fix a security issue, does it announce a breaking change or a required action, and what kind of release is it
  • One request per six topics, four typed questions each: did it break after the update, is the site down, is a key flow such as checkout or login broken, and what kind of topic is it
  • Every question points at its topic by path, so no forum text is ever part of an instruction

Without a key

  • The same readings from tested keyword rules, and the page says which reader it used
  • Two rules were tightened after real data: Wordfence 9.0.1's notes on login security and deprecation notices were neither a security fix nor a breaking change, and a Yoast SEO topic about a WordPress core update was not the plugin's fault

The verdict

Five answers, each with its reasons

The verdict is a pure function of the readings, with named thresholds. A topic Jev is at least 70% sure about counts toward it; one it is unsure about is listed for you to review yourself.

Verdicts

  • Hold: two or more people report the site going down or a key flow breaking, or one does among three or more reports of problems
  • Test on staging first: a security fix that someone reports breaking a site, or a changelog that announces a breaking change
  • Update now: it fixes a security issue, and nothing serious is reported against it
  • Wait: under 72 hours old, one serious report, or two or more reports of smaller problems
  • Safe to update: 72 hours or more old, and at most one minor problem reported

Update day

  • Up to ten plugins at once, each with the same reading as a single forecast

Built to be run by strangers

A public tool that protects its key

Prompt injection

  • Forum text goes only into Jev's state, never into a question, and every answer is checked against what was asked
  • A topic written to steer AI readers is kept away from Jev, read by the rules and flagged on the page

Limits

  • Ten forecasts a minute per address on each server instance, a daily Jev budget, and every forecast kept 20 minutes
  • It accepts only a WordPress.org plugin slug, so it cannot be pointed at any other site
  • HTTPS with HSTS preload, a strict content security policy, and crawlers kept off every live read

Tests and delivery

Fixtures from real plugins, and a fake network

The readers and the verdict are tested with fixtures and an injected network; the Jev requests with a fake Jev that records them, so the tests prove forum text never reaches an instruction.

Checks before shipping

  • Vitest, TypeScript strict, ESLint and a production build, on every push through GitHub Actions
  • Live checks after deploying: HTTP to HTTPS, the security headers, real forecasts for Contact Form 7 and Elementor, a bad slug refused, and requests past the limit answered 429

Hosting

  • Vercel, from a private GitHub repository; no database and no paid service

Growth

Skills I sharpened.

AI engineering
Jev (TypeSafe AI): typed questions with path references, batched fan-out, composite scoring and confidence gating.
WordPress
The Plugins API, support-forum feeds, changelogs and release cadence, read the way a maintainer would.
Security
Prompt-injection screening, typed and validated answers, per-address limits and a daily key budget.
Next.js 16
App Router, next/form, streamed loading states, route handlers, Tailwind CSS 4.
Testing
Vitest with fixtures from real plugins and an injected network.