Flarum 2.0.0-rc.5 Released 🎉 — polish, patches, and a tidier ecosystem
Different texture this cycle.
2.0.0-rc.5 is
24 merged PRs, and they lean hard toward the unglamorous end of the spectrum: security hardening, reliability, a lighter discussion list, and a cleanup of how the Audit extension wires into the wider ecosystem. There's no single blockbuster feature — and at this stage, that's the point. When the big pieces are already in place, progress starts to look like
fewer surprises.
Here's the thing about the fixes in this release: most of them exist because someone
ran 2.0 for real. An SSRF corner in avatar fetching, a realtime tab that quietly went stale, an iPad that wanted two taps instead of one — none of those show up in a unit test. They show up when thousands of people use the software in earnest and one of them goes "…huh, that's odd" and tells us. So if you've upgraded and reported anything at all: this changelog has your fingerprints on it. Thank you. Keep it coming.
🚀
Upgrading is a composer update. rc.4 → rc.5 is drop-in. Take a backup, run it on staging if you have one, and keep a way back — same as always.
👀
You're already looking at it. discuss.flarum.org runs the latest
2.x, and the
nightly demo rebuilds from it every day.
💬
Ran it? Say so. A one-line "upgraded, no drama" in
Support is worth more than you'd think to the next person hovering over the button.
⭐ The headlines
🔒 A round of security hardening
The clearest reason to upgrade sits right at the top of this release. rc.5 tightens three security-sensitive spots:
- Avatar-from-URL fetching is hardened against SSRF and resource abuse. Pulling an avatar from a remote URL now enforces a streaming size cap, rejects oversized image dimensions, and refuses link-local / internal addresses — so the feature can't be nudged into probing your private network or eating all your memory. (#4795)
- Oversized-dimension images are rejected before they're decoded, shutting down a decompression-bomb-style way to exhaust server resources through image uploads. (#4794)
- Two dependency advisories cleared —
axios pinned to a patched 0.33.x, and vulnerable transitive dev dependencies (minimatch, serialize-javascript) bumped. (#4802, #4803)
Run avatars-from-URL or accept image uploads? Upgrade for these alone.
🧩 Audit integrations move in with the extensions they belong to
When Audit landed in the core in rc.4, it carried integrations for a handful of FriendsOfFlarum extensions
inside the Audit extension itself. That kept coverage intact through the migration, but it was always meant to be temporary — the natural home for "how Impersonate is audited" is Impersonate, not Audit.
rc.5 finishes the job. Those bundled integrations (Impersonate, Split, Merge Discussions, Ban IPs, User Bio, Username Request) have moved out into the extensions that own them, each wiring itself up through the public
Flarum\Audit\Extend\Audit extender behind a conditional, so it does nothing unless Audit is switched on. Companion releases of those extensions ship the integration and its tests. The old
clarkwinkelmann-author-change shim was retired too, now that
fof/author-change carries its own. (
#4807,
#4806)
Admins won't notice a thing — the same actions land in the log — but the wiring is where it should be, and it doubles as a worked example for any extension that wants to audit itself.
✍️ Markdown lists that keep going
Small, but you'll feel it every time you write. Hit
Enter inside a list in the Markdown editor and it now starts the next item for you, instead of dumping you onto a bare line to re-type the bullet. (
#4778)
🔌 Realtime that notices when it's fallen asleep
Websockets drop silently more often than you'd like. Desktop tabs now spot a
socket that's gone quiet, reconnect, and replay the events they missed while they were out — so a backgrounded tab catches up instead of sitting there confidently wrong until someone refreshes. It's the desktop counterpart to the iOS/Safari reconnection work from earlier cycles. (
#4718)
🛠️ The rest of the list
🐛 Fixes
- Notification emails can't leak their title anymore — one is set explicitly so nothing bleeds through. (#4768)
- One tap, not two, on touch devices — opening a discussion from the list on iPad no longer demands a double-tap. (#4556)
page[limit]=0 returns an empty page rather than a 500. (#4775)show_language_selector has a proper default and behaves when it's never been set. (#4792)- The database transactions manager binds correctly, so anything resolving it from the container stops erroring. (#4800)
- The abandoned-extensions email body renders instead of coming out blank. (#4804)
- The Messages dialogs dropdown points at the right route again. (#4791)
- The tag slug-driver setting reads as a friendly model name instead of a raw class string. (#4793)
- Approving a pending discussion updates its tag metadata, keeping tag counts honest. (#4777)
- GDPR erasure-completion emails now go out in the recipient's own locale (#4786) and render with the right view data (#4798).
♿ Accessibility
- Post stream items carry a
role so screen readers can make sense of the stream. (#4780)
⚡ Performance
- A lighter discussion list — post likes are no longer dragged in by default on the index. (#4796)
- Fewer queries on the posts endpoint — discussion state is eager-loaded. (#4797)
🧹 Housekeeping
- Dropped redundant nested lockfiles from the GDPR and Realtime extensions. (#4801)
- Refreshed the Laravel version referenced in PHP docblocks. (#4762)
💙 Made with the community
7 of this cycle's 24 PRs came from outside the core team — and on a release that's mostly about hardening, that's the good stuff: the fixes and touches that only exist because people beyond the maintainers are living in the codebase.
A round of thanks to everyone who shipped this cycle:
- @Karl — Markdown lists that continue on Enter #4778, an empty page for
page[limit]=0 #4775, and tag metadata on discussion approval #4777
- @CyberGene — desktop realtime tabs recovering after a silent socket drop #4718
- @ClaudiusH — a
role on post stream items for accessibility #4780
- @grimur82 — GDPR erasure emails in the recipient's locale #4786
- @davetodave178 — refreshing the Laravel version in the docblocks #4762
- @IanM — the security hardening, the Audit integration move, and most of the rest
First PR or fiftieth, it all counts — and it all ends up in a line like these. If you've been meaning to jump in, the water's warm.
🧭 On the fence? Ask the Upgrade Advisor
For most forums, "should I upgrade?" really means "will my extensions come with me?" — and there's now a free tool that answers it before you touch a thing.
FoF Upgrade Advisor adds an admin page that runs a batch of Flarum 2.0 readiness checks and boils them down to a single go/no-go verdict:
- Every installed extension is checked for a 2.0-compatible release — the thing that most often holds an upgrade up — with abandoned, superseded, and premium/private cases each called out so you know exactly what needs attention.
- PHP and database versions are checked against what 2.0 needs (and nudged toward modern, supported releases).
Install it, read the verdict, clear what it flags:
composer require fof/upgrade-advisor:"*"
Once it reports green and you've made the jump, it's done its job — uninstall and carry on. If you've been putting the upgrade off because you weren't sure what might break, this is the place to start.
🙌 What actually moves the needle right now
The build is in good shape. What turns "good shape" into a stable tag is
mileage — forums running the release candidate and reporting back. That's the single most useful thing you can do this week:
- Look before you leap — kick the tyres on the nightly demo or right here on discuss.flarum.org, both tracking
2.x.
- Upgrade —
composer update -W, then php flarum migrate, php flarum cache:clear, php flarum assets:publish. Back up first; stage it if you can.
- Report back — the wins, the weird bits, the wishlist for 2.0 final.
Where to send it:
Every upgrade report is one more data point pushing 2.0.0 over the edge into "done." Thanks for running the candidates in the wild — at this stage, that
is the work. 🙏
📋 Changelog
Added
- (markdown) continue lists when pressing Enter in the Markdown editor by @Karl #4778
Changed
- (audit) move the bundled third-party integrations out to their own extensions by @IanM #4807
- (audit) remove the clarkwinkelmann-author-change integration (replaced by fof/author-change) by @IanM #4806
- (deps) remove redundant nested lockfiles for gdpr/realtime by @IanM #4801
Fixed
- (core) set an explicit title on notification emails so it can't leak by @IanM #4768
- (core) register a default for the
show_language_selector setting by @IanM #4792
- (core) reject oversized-dimension images before decoding by @IanM #4794
- (core) return an empty page instead of a 500 when
page[limit]=0 is requested by @Karl #4775
- (core) bind the database transactions manager by @IanM #4800
- (core) render the abandoned-extensions email body by @IanM #4804
- (core) fix iPad/touch devices requiring a double-tap in the discussion list by @IanM #4556
- (a11y) add a
role attribute to PostStream items by @ClaudiusH #4780
- (messages) use the correct route name in the dialogs dropdown by @IanM #4791
- (tags) show a friendly model name for the tag slug driver setting by @IanM #4793
- (tags) update tag metadata when a pending discussion is approved by @Karl #4777
- (gdpr) send the erasure completion email in the user's locale by @grimur82 #4786
- (gdpr) share view data for the erasure completion email by @IanM #4798
- (realtime) recover desktop tabs after silent socket loss and catch up on missed events by @CyberGene #4718
Security
- (core) harden avatar-from-URL fetch with a streaming cap, resolution guard, and link-local block by @IanM #4795
- (deps) pin axios to patched 0.33.x to clear advisories by @IanM #4802
- (deps) bump vulnerable transitive dev deps (minimatch, serialize-javascript) by @IanM #4803
Performance
- (likes) don't default-include post likes on the discussion index by @IanM #4796
- (core) eager-load discussion state on the posts endpoint by @IanM #4797
Documentation
