The second release candidate for WordPress 3.1 is now available. The requisite haiku:

Rounding up stragglers
Last few bugs for 3.1
Go test RC2

As I outlined in the announcement post for RC1, release candidates are the last stop before the final release. It means we think we’re done, and we again have no bugs to squash. But with tens of millions of users, many server configurations and setups, and thousands of plugins and themes, it’s still possible we’ve missed something.

Beta 1 came on Thanksgiving, RC1 on Christmas, and RC2 on New Year’s Day. We won’t be waiting for another holiday for the final release, though, so if you haven’t tested WordPress 3.1 yet, now is the time!

Select changes since RC1:

• The security fixes included in WordPress 3.0.4
• Fix issues related to handling a static front page
• Fixes and enhancements for the pagination buttons
• Fix searching for partial usernames
• Properly reactivate plugins after editing them
• Always show the current author in the author dropdown when editing a post
• Fixes for attachment taxonomies
• Fix node removal for the admin bar
• Fix the custom post type show_in_menu argument
• Various fixes for right-to-left languages
• and a few dozen more changes

If you are testing the release candidate and think you’ve found a bug, there are a few ways to let us know:

• Post it to the Alpha/Beta area in the support forums
• Report it to the wp-testers mailing list
• Join the development IRC channel and tell us live at irc.freenode.net #wordpress-dev
• File a bug ticket on the WordPress Trac

To test WordPress 3.1, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the release candidate here (zip).

If any known issues crop up, you’ll be able to find them here. If you’d like to know which levers to pull in your testing, check out a list of features in our Beta 1 post.

Download WordPress 3.1 RC 2

Version 3.0.4 of WordPress, available immediately through the update page in your dashboard or for download here, is a very important update to apply to your sites as soon as possible because it fixes a core security bug in our HTML sanitation library, called KSES. I would rate this release as “critical.”

This issue affects all versions of WordPress prior to 3.0.4, so if you are still on a 2.X release you need to update as well.

I realize an update during the holidays is no fun, but this one is worth putting down the eggnog for. In the spirit of the holidays, consider helping your friends as well.

If you are a security researcher, we’d appreciate you taking a look over this changeset as well to review our update. We’ve given it a lot of thought and review but since this is so core we want as many brains on it as possible. Thanks to Mauro Gentile and Jon Cave (duck_) who discovered and alerted us to these XSS vulnerabilities first.