Flarum 2.0.0-rc.5 Released 🎉 — polish, patches, and a tidier ecosystem

Different texture this cycle. 2.0.0-rc.5 is 24 merged PRs, and they lean hard toward the unglamorous end of the spectrum: security hardening, reliability, a lighter discussion list, and a cleanup of how the Audit extension wires into the wider ecosystem. There's no single blockbuster feature — and at this stage, that's the point. When the big pieces are already in place, progress starts to look like fewer surprises.
Here's the thing about the fixes in this release: most of them exist because someone ran 2.0 for real. An SSRF corner in avatar fetching, a realtime tab that quietly went stale, an iPad that wanted two taps instead of one — none of those show up in a unit test. They show up when thousands of people use the software in earnest and one of them goes "…huh, that's odd" and tells us. So if you've upgraded and reported anything at all: this changelog has your fingerprints on it. Thank you. Keep it coming.

🚀 Upgrading is a composer update. rc.4 → rc.5 is drop-in. Take a backup, run it on staging if you have one, and keep a way back — same as always.
👀 You're already looking at it. discuss.flarum.org runs the latest 2.x, and the nightly demo rebuilds from it every day.
💬 Ran it? Say so. A one-line "upgraded, no drama" inSupport is worth more than you'd think to the next person hovering over the button.

---

⭐ The headlines

🔒 A round of security hardening

The clearest reason to upgrade sits right at the top of this release. rc.5 tightens three security-sensitive spots:

• Avatar-from-URL fetching is hardened against SSRF and resource abuse. Pulling an avatar from a remote URL now enforces a streaming size cap, rejects oversized image dimensions, and refuses link-local / internal addresses — so the feature can't be nudged into probing your private network or eating all your memory. (#4795)
• Oversized-dimension images are rejected before they're decoded, shutting down a decompression-bomb-style way to exhaust server resources through image uploads. (#4794)
• Two dependency advisories cleared — axios pinned to a patched 0.33.x, and vulnerable transitive dev dependencies (minimatch, serialize-javascript) bumped. (#4802, #4803)

Run avatars-from-URL or accept image uploads? Upgrade for these alone.

🧩 Audit integrations move in with the extensions they belong to

When Audit landed in the core in rc.4, it carried integrations for a handful of FriendsOfFlarum extensions inside the Audit extension itself. That kept coverage intact through the migration, but it was always meant to be temporary — the natural home for "how Impersonate is audited" is Impersonate, not Audit.
rc.5 finishes the job. Those bundled integrations (Impersonate, Split, Merge Discussions, Ban IPs, User Bio, Username Request) have moved out into the extensions that own them, each wiring itself up through the public Flarum\Audit\Extend\Audit extender behind a conditional, so it does nothing unless Audit is switched on. Companion releases of those extensions ship the integration and its tests. The old clarkwinkelmann-author-change shim was retired too, now that fof/author-change carries its own. (#4807, #4806)
Admins won't notice a thing — the same actions land in the log — but the wiring is where it should be, and it doubles as a worked example for any extension that wants to audit itself.

✍️ Markdown lists that keep going

Small, but you'll feel it every time you write. Hit Enter inside a list in the Markdown editor and it now starts the next item for you, instead of dumping you onto a bare line to re-type the bullet. (#4778)

🔌 Realtime that notices when it's fallen asleep

Websockets drop silently more often than you'd like. Desktop tabs now spot a socket that's gone quiet, reconnect, and replay the events they missed while they were out — so a backgrounded tab catches up instead of sitting there confidently wrong until someone refreshes. It's the desktop counterpart to the iOS/Safari reconnection work from earlier cycles. (#4718)

---

🛠️ The rest of the list

🐛 Fixes

• Notification emails can't leak their title anymore — one is set explicitly so nothing bleeds through. (#4768)
• One tap, not two, on touch devices — opening a discussion from the list on iPad no longer demands a double-tap. (#4556)
• page[limit]=0 returns an empty page rather than a 500. (#4775)
• show_language_selector has a proper default and behaves when it's never been set. (#4792)
• The database transactions manager binds correctly, so anything resolving it from the container stops erroring. (#4800)
• The abandoned-extensions email body renders instead of coming out blank. (#4804)
• The Messages dialogs dropdown points at the right route again. (#4791)
• The tag slug-driver setting reads as a friendly model name instead of a raw class string. (#4793)
• Approving a pending discussion updates its tag metadata, keeping tag counts honest. (#4777)
• GDPR erasure-completion emails now go out in the recipient's own locale (#4786) and render with the right view data (#4798).

♿ Accessibility

• Post stream items carry a role so screen readers can make sense of the stream. (#4780)

⚡ Performance

• A lighter discussion list — post likes are no longer dragged in by default on the index. (#4796)
• Fewer queries on the posts endpoint — discussion state is eager-loaded. (#4797)

🧹 Housekeeping

• Dropped redundant nested lockfiles from the GDPR and Realtime extensions. (#4801)
• Refreshed the Laravel version referenced in PHP docblocks. (#4762)

---

💙 Made with the community

7 of this cycle's 24 PRs came from outside the core team — and on a release that's mostly about hardening, that's the good stuff: the fixes and touches that only exist because people beyond the maintainers are living in the codebase.
A round of thanks to everyone who shipped this cycle:

• @KBExit — Markdown lists that continue on Enter #4778, an empty page for page[limit]=0 #4775, and tag metadata on discussion approval #4777
• @CyberGene — desktop realtime tabs recovering after a silent socket drop #4718
• @ClaudiusH — a role on post stream items for accessibility #4780
• @grimur82 — GDPR erasure emails in the recipient's locale #4786
• @davetodave178 — refreshing the Laravel version in the docblocks #4762
• @IanM — the security hardening, the Audit integration move, and most of the rest

First PR or fiftieth, it all counts — and it all ends up in a line like these. If you've been meaning to jump in, the water's warm.

---

🧭 On the fence? Ask the Upgrade Advisor

For most forums, "should I upgrade?" really means "will my extensions come with me?" — and there's now a free tool that answers it before you touch a thing. FoF Upgrade Advisor adds an admin page that runs a batch of Flarum 2.0 readiness checks and boils them down to a single go/no-go verdict:

• Every installed extension is checked for a 2.0-compatible release — the thing that most often holds an upgrade up — with abandoned, superseded, and premium/private cases each called out so you know exactly what needs attention.
• PHP and database versions are checked against what 2.0 needs (and nudged toward modern, supported releases).

Install it, read the verdict, clear what it flags:

composer require fof/upgrade-advisor:"*"

Once it reports green and you've made the jump, it's done its job — uninstall and carry on. If you've been putting the upgrade off because you weren't sure what might break, this is the place to start.

---

🙌 What actually moves the needle right now

The build is in good shape. What turns "good shape" into a stable tag is mileage — forums running the release candidate and reporting back. That's the single most useful thing you can do this week:

1. Look before you leap — kick the tyres on the nightly demo or right here on discuss.flarum.org, both tracking 2.x.
2. Upgrade — composer update -W, then php flarum migrate, php flarum cache:clear, php flarum assets:publish. Back up first; stage it if you can.
3. Report back — the wins, the weird bits, the wishlist for 2.0 final.

Where to send it:

• Core bugs → flarum/frameworkissues
• Questions, feedback, extension quirks →Support
• Security → [email protected] (privately, please)

Every upgrade report is one more data point pushing 2.0.0 over the edge into "done." Thanks for running the candidates in the wild — at this stage, that is the work. 🙏

---

📋 Changelog

Added

• (markdown) continue lists when pressing Enter in the Markdown editor by @KBExit #4778

Changed

• (audit) move the bundled third-party integrations out to their own extensions by @IanM #4807
• (audit) remove the clarkwinkelmann-author-change integration (replaced by fof/author-change) by @IanM #4806
• (deps) remove redundant nested lockfiles for gdpr/realtime by @IanM #4801

Fixed

• (core) set an explicit title on notification emails so it can't leak by @IanM #4768
• (core) register a default for the show_language_selector setting by @IanM #4792
• (core) reject oversized-dimension images before decoding by @IanM #4794
• (core) return an empty page instead of a 500 when page[limit]=0 is requested by @KBExit #4775
• (core) bind the database transactions manager by @IanM #4800
• (core) render the abandoned-extensions email body by @IanM #4804
• (core) fix iPad/touch devices requiring a double-tap in the discussion list by @IanM #4556
• (a11y) add a role attribute to PostStream items by @ClaudiusH #4780
• (messages) use the correct route name in the dialogs dropdown by @IanM #4791
• (tags) show a friendly model name for the tag slug driver setting by @IanM #4793
• (tags) update tag metadata when a pending discussion is approved by @KBExit #4777
• (gdpr) send the erasure completion email in the user's locale by @grimur82 #4786
• (gdpr) share view data for the erasure completion email by @IanM #4798
• (realtime) recover desktop tabs after silent socket loss and catch up on missed events by @CyberGene #4718

Security

• (core) harden avatar-from-URL fetch with a streaming cap, resolution guard, and link-local block by @IanM #4795
• (deps) pin axios to patched 0.33.x to clear advisories by @IanM #4802
• (deps) bump vulnerable transitive dev deps (minimatch, serialize-javascript) by @IanM #4803

Performance

• (likes) don't default-include post likes on the discussion index by @IanM #4796
• (core) eager-load discussion state on the posts endpoint by @IanM #4797

Documentation

• (core) update the Laravel version in PHP docblocks by @davetodave178 #4762

Flarum 1.8.17 Released

A small maintenance release for the Flarum 1.x series. No security fixes this time — it's a handful of bug fixes plus the new first-party Audit extension. It isn't bundled by default on 1.x; install it with composer require flarum/audit:"*" if you want it. You can read more about flarum/audit in @GreXXL's post here.
There's no urgency to upgrade unless one of the fixes below affects you, but it's a safe update with no breaking changes.

The Audit extension is now first-party

The big addition this release is flarum/audit, a first-party audit log. It records moderation and administration actions — discussions, posts, users, settings, permissions, extension enable/disable, and so on — to a tamper-resistant log you can browse from the admin panel, or (with permission) directly from a discussion or user's page.
This started life as Clark Winkelmann's KILOWHAT Audit extension, which we've brought in-house and reworked as a first-party extension. It is not installed by default on 1.x — add it with composer require flarum/audit:"*", then enable it from the Extensions page.
If you're coming from kilowhat/flarum-ext-audit (or the free/pro variants), the switch is handled for you: Composer replaces the old package, and your existing log table is renamed and kept intact — no data is lost.
A couple of things worth knowing:

• Extension integrations (Flags, Tags, Lock, FoF Ban IPs, and others) only log when the relevant extension is enabled.
• IP-to-country flags are shown if you also run FoF GeoIP; there's nothing to configure in Audit itself.

Full documentation is on the docs site.

Bug fixes

A few things that were broken or annoying are now fixed:

• Abandoned-extensions sync never ran. The weekly task that refreshes the abandoned-extensions list (added in 1.8.16) was registered too late in the boot process and never made it into the scheduler, so the admin panel never flagged anything. It's now scheduled correctly. (#4706)
• Mobile post count. On mobile, a discussion's total post count didn't update after you replied. (#4684)
• Tooltips. Fixed a flash of the native browser tooltip, some teardown leaks when tooltips were removed, and tooltips not picking up dynamic text changes. (#4675)
• Browsers without XSLT. Recent browser changes have started dropping XSLT support; the forum now ships a polyfill so it keeps booting on those browsers. (#4644)

For extension developers

• The testing harness now authenticates via cookie, which fixes some integration-test setups. (#4631)

If for example a 1.x extension used actor id 1 (admin) to hit an API endpoint AND provided a cookie param using withCookieParams() (which is a replacement ),  in 1.8.17 the cookie authentication would get thrown out.
Previous on 1.x:

$request = $request->withCookieParams(['foo' => 'bar']);

Should now be in 1.8.17 (and also in Flarum 2.x):

$request = $request->withCookieParams(
    array_merge($request->getCookieParams(), ['foo' => 'bar'])
);

• Composer is pegged to an LTS version in CI, following the recent GitHub Actions token-disclosure advisories. (#4661)

A note on 1.x

Flarum 2.0.0-rc.4 is imminent, and that's where all the work is now. The 1.x series is effectively on life support: no new features, and maintenance only on an as-really-needed basis. This release is one of those — small fixes worth shipping before 1.x is fully retired at the end of the year.
If you're still on 1.x, it's a good time to start planning the move to 2.0. Extension developers: if your 2.0 update isn't out yet, that's the priority.

Versions released

• flarum/core — 1.8.17
• flarum/audit — 1.8.0 (new; opt-in, install with composer require flarum/audit:"*")

How to update

composer update
php flarum migrate
php flarum cache:clear
php flarum assets:publish

Back up your database first, and test on staging if you can.

Full changelog

Added

• First-party Audit extension by @IanM #4704

Fixed

• Schedule the abandoned-extensions sync command so it actually runs by @IanM #4706
• Mobile discussion total post count not updating on reply by @huoxin #4684
• Native tooltip flash, async teardown leaks, and dynamic text by @huoxin #4675
• Add XSLT polyfill so the forum continues to boot on browsers without XSLT by @IanM #4644
• [Testing] Use cookie for testing authentication by @huoxin #4631

Changed

• Peg Composer to an LTS version by @davetodave178 #4661

Flarum Audit joins the Open Source core

We're happy to announce another great feature coming to the Open Source community. For years, one of the most popular premium extensions has been Audit (Pro), built by @clarkwinkelmann — whose work has shaped Flarum's extension ecosystem for a long time. We're delighted to share that Audit is joining the Open Source core.
The Flarum Foundation has purchased the code from Clark and is about to release it as flarum/audit — the first-party successor to the kilowhat/flarum-ext-audit, audit-pro and audit-free extensions. We've refactored it and added easier filtering of log entries, and the previous free/pro split is gone: every feature is now included. New installs of Flarum 2.0 will come with Audit bundled in; on 1.x and existing 2.x installs it's opt-in, enabled from the Extensions page. It arrives with the upcoming Flarum 1.8.17, with a 2.x-compatible version following in RC4.
It records moderation and administration actions to a tamper-resistant audit log, so you can see who did what, when, and from where — searchable by action, actor, user, client type, discussion, and IP address, with quick shortcuts to a specific user's or discussion's history.
Out of the box it logs actions from the bundled Flarum extensions — Tags, Flags, Lock, Sticky, Approval, Suspend and Nicknames — alongside core events like group changes and permission updates. It also integrates with several popular third-party extensions, including FriendsOfFlarum's Impersonate, Split, Merge Discussions, Ban IPs, User Bio and Username Request.
@IanM has taken it further still: he's built a public Flarum\Audit\Extend\Audit extender so other extension developers can log their own actions to the audit log — no need to modify Audit itself. If you maintain an extension, now is a good time to think about which moderative and administrative actions you'd want to log. It's all documented today:

• Using the Audit extension
• Integrating your extension with Audit

This is the second previously premium-only feature to become widely available to the community, after @luceos's generous donation of flarum/realtime. Both extensions have already been improved now that they're open — and that's exactly the point: Open Source means the whole community can build on them, and we're already seeing it happen.
Want to help us bring more to Open Source? Consider contributing — every contribution counts!