Dev Diary: Build 18

luceos

The next release will probably be a quick patch release v1.0.1 to address the issue with installations. There are two problems with the new installation method which tries to import a database dump:

it uses the mysql binary from the mysql-client behind the scenes; this binary might not be available on every system.
it uses the symfony Process logic to wrap around importing the database with the mysql binary; this Process class requires several proc_* functions which might not be available for security reasons on shared hosting environments.

We failed to live by one of our principles "built for everyone". This installation procedure should not have been modified with the stable release.

In v1.0.1 we are going to reset these changes and improve its logic for v1.1.

Reference: flarum/core2890

Zeokat

I'm one of those that can't update until this problem is fixed, my hosting have disabled all proc_* functions 🤨

luceos

I just upgraded discuss to 1.0.2. You will find a couple of bugs, the one that jumped into my face is the issue with subtags being shown by default.
I've added a dedicated demos page on flarum.org: https://flarum.org/demos; @Ralkage had a great suggestion for a landing page post that we most likely introduce on our demos too.
I've helped publish the security advisory on GitHub and requested a CVE for 1.0.2 after the team found and solved it autonomously during my sleep (this team y'all 🥰 ).

Zeokat version 1.0.1 fixed that

BedsideNinja

Is the YouTube stream still coming? I'd love to see changes in 1.0 explained in one place.

luceos

I just published a new version of flarum/tags to fix the sub tag issue (flarum/core2895).

Check that you are on Flarum v1.0.2 by running:

php flarum -V

If it reads v1.0.2 you can simply upgrade using:

composer update flarum/tags --prefer-dist --no-dev -a
php flarum cache:clear

This change has been deployed to discuss.

Thanks to @SychO for jumping on this nuisance so quickly and creating a PR to remedy it 🤟

BedsideNinja thanks for reminding me; yeah I still plan on creating a video, I'm not sure it will be a livestream yet as I'd like to go over the features of the stable product in one go. With all that is going on, I really need some time to sit down and prep a content plan for that.

ornanovitch

luceos This change has been deployed to discuss.

I still see some weird behavior on discuss's sidenav when clicking directly on a secondary tag 🧐

luceos

ornanovitch that is certainly possible, what to do:

go to https://demo.flarum.site to see whether you can reproduce the issue there
if so create an issue on https://github.com/flarum/core/issues/new by filling in the requested information for a bug report

That would be much appreciated.

ornanovitch

luceos Of course! I just wanted to verify it wasn't some Discuss deployment delay or something. flarum/tags is still on 1.0.1 on demo.flarum.site, is it automatically re installed each day as nightly? If so, I'll check tomorrow 🔔

luceos

ornanovitch it's updating, thanks for taking notice of that 😉

ornanovitch

~~OK perfect: I can't reproduce on demo ☑️~~ Ooops, just reproduced with more tags. I'll try to find a clear pattern before opening an issue on GH

luceos

We just had a very relaxed two hour call with several people from the team. Things we talked about:

a little celebration on reaching stable
security vulnerability review and the fact that our CVE report caused an XSS on the CVE website
create a plan of attack by listing things to discuss in upcoming meetings

Our plan for this build 18 cycle is to release patches for bugs that have been discovered. Then in build 19 we will work on the first minor release v1.1. We hope to publish major releases at a 12 month interval; v2.0 would then be scheduled somewhere around May next year.

We also talked about our support/patch policy and decided to keep patching for security issues on previous major versions for two months after a new major major release is published. Two months is enough time for active maintainers to release upgraded extensions, especially if given clear upgrade documentation and a developer announcement with the release candidate(s). We hope to promote a healthy upgrade habit with our end users, developers and partners. But we also wish to reduce unnecessary support weight on our small and flexible team.

The channels that you can currently keep yourself in the loop about updates to Flarum:

follow the tag blog
https://coderelease.io/
follow us on twitter
join our discord server
install extiverse/mercury on your Flarum forum

Darkle

luceos I love the transparency of the Flarum team that you have with us, it's not a common thing. I was just writing a draft about the new cycles a few days ago, I was very curious about how the development cycles would evolve after the stable release and this already gives me an idea of the way.

It will be very interesting, so far the extension developers have been under pressure with the super fast cycles of these last betas, with this we might start to see more feature updates 🙂

matteocontrini

luceos security vulnerability review and the fact that our CVE report caused an XSS on the CVE website

what 😂

tankerkiller125

matteocontrini Yes... It was super funny when we realized what had happened. Apparently their site just trust whatever the dev/company inputs into the description, and in our description we included an example that triggered their site to execute it.

matteocontrini

tankerkiller125 I guess they need to file a CVE now...

al_naydenov

Hi there, nice work. How can I get the latest release? On GigHub it still says version 1.0. Thanks.

luceos

al_naydenov follow the installation instructions: https://docs.flarum.org/install.html

al_naydenov

luceos thanks, I was asking where is the latest git code? In GitHub it only shows version 1.0 while I see some blogs about patching this version. Hope it makes sense.

luceos

al_naydenov https://github.com/flarum/core/releases/tag/v1.0.2

luceos

We decided to change the way we handle security disclosures. From now on we are partnered with Huntr , which is a VC backed project to secure open source by providing bounties for reporting and fixing security vulnerabilities.

As a consequence reporters and fixers of vulnerabilities are now rewarded financially and on their Huntr profile for their efforts in making the web a safer place.

The fact that Huntr is aimed at open source software closely matches our own beliefs of creating open, free and secure software to the benefit of everyone.

Our policies have been adjusted on our docs, website and main repositories.

If you have a vulnerability to disclose, make sure to follow our security policy.