Dev Diary: Build 18

luceos

Welcome to the next cycle, the first post-stable release.

Share in our excitement of releasing stable on the Announcement 🥳

We'll post information about our plans soon ™️ , but first we'll take a bit of time off to relax after our months of effort in releasing stable. We'll follow up with support and bug reports in a timely manner.

luceos

matteocontrini I think you've been absolutely correct in opening a discussion, it speaks for your dedication towards Flarum. I actually announced the break in the OP:

luceos but first we'll take a bit of time off to relax after our months of effort in releasing stable

I must confess this statement is far too vague, even for me 🙈

matteocontrini This helps clarifying and it's one of the things I was curious about, although it's not my business.

Don't undersell yourself, we are trying as much as we can to be an open, transparent organisation. These questions are always valued, even when they hit a weakness in the project.

Darkle P.S. I really like that you talk about framework instead of just forum, definitely Flarum is evolving in that direction.

Towards stable it has become easier to see what our purpose is and where we fit into the community market. It might be harder to understand for some, but the further Flarum matures the more it will make sense.

davwheat

My main focus in build 18 will be working on the accessibility issues that we've found in core. These are pretty important to get right, so will need a fair amount of research.

I also plan to start properly testing core with real screenreader software to make sure that everything works well for people who need to use these assistive technologies.

I've got some other things on the horizon, too, such as removing float and using CSS grid and flexbox instead (this will likely be for 2.0 due to issues relating to breaking forum themes), and refactoring the new Users List into a reusable table component for use in extensions and other things in core.

Maybe I'll even face my fears and touch some of the PHP... shudders 😛

010101

davwheat This is really exciting! I recently got my first taste of difficulties surrounding proper accessibility because I got my first WordPress theme approved to be in their official repository. It was actually a little tough for me. They now require that your theme’s main menu be fully usable without a mouse. Drop downs must open with tab or enter.

It makes sense and every website should be this way, but it was new for me to figure out and I’m sure the way I did it isn’t the best way. 😬

luceos

The next release will probably be a quick patch release v1.0.1 to address the issue with installations. There are two problems with the new installation method which tries to import a database dump:

it uses the mysql binary from the mysql-client behind the scenes; this binary might not be available on every system.
it uses the symfony Process logic to wrap around importing the database with the mysql binary; this Process class requires several proc_* functions which might not be available for security reasons on shared hosting environments.

We failed to live by one of our principles "built for everyone". This installation procedure should not have been modified with the stable release.

In v1.0.1 we are going to reset these changes and improve its logic for v1.1.

Reference: flarum/core2890

Zeokat

I'm one of those that can't update until this problem is fixed, my hosting have disabled all proc_* functions 🤨

luceos

I just upgraded discuss to 1.0.2. You will find a couple of bugs, the one that jumped into my face is the issue with subtags being shown by default.
I've added a dedicated demos page on flarum.org: https://flarum.org/demos; @Ralkage had a great suggestion for a landing page post that we most likely introduce on our demos too.
I've helped publish the security advisory on GitHub and requested a CVE for 1.0.2 after the team found and solved it autonomously during my sleep (this team y'all 🥰 ).

Zeokat version 1.0.1 fixed that

BedsideNinja

Is the YouTube stream still coming? I'd love to see changes in 1.0 explained in one place.

luceos

I just published a new version of flarum/tags to fix the sub tag issue (flarum/core2895).

Check that you are on Flarum v1.0.2 by running:

php flarum -V

If it reads v1.0.2 you can simply upgrade using:

composer update flarum/tags --prefer-dist --no-dev -a
php flarum cache:clear

This change has been deployed to discuss.

Thanks to @SychO for jumping on this nuisance so quickly and creating a PR to remedy it 🤟

BedsideNinja thanks for reminding me; yeah I still plan on creating a video, I'm not sure it will be a livestream yet as I'd like to go over the features of the stable product in one go. With all that is going on, I really need some time to sit down and prep a content plan for that.

ornanovitch

luceos This change has been deployed to discuss.

I still see some weird behavior on discuss's sidenav when clicking directly on a secondary tag 🧐

luceos

ornanovitch that is certainly possible, what to do:

go to https://demo.flarum.site to see whether you can reproduce the issue there
if so create an issue on https://github.com/flarum/core/issues/new by filling in the requested information for a bug report

That would be much appreciated.

ornanovitch

luceos Of course! I just wanted to verify it wasn't some Discuss deployment delay or something. flarum/tags is still on 1.0.1 on demo.flarum.site, is it automatically re installed each day as nightly? If so, I'll check tomorrow 🔔

luceos

ornanovitch it's updating, thanks for taking notice of that 😉

ornanovitch

~~OK perfect: I can't reproduce on demo ☑️~~ Ooops, just reproduced with more tags. I'll try to find a clear pattern before opening an issue on GH

luceos

We just had a very relaxed two hour call with several people from the team. Things we talked about:

a little celebration on reaching stable
security vulnerability review and the fact that our CVE report caused an XSS on the CVE website
create a plan of attack by listing things to discuss in upcoming meetings

Our plan for this build 18 cycle is to release patches for bugs that have been discovered. Then in build 19 we will work on the first minor release v1.1. We hope to publish major releases at a 12 month interval; v2.0 would then be scheduled somewhere around May next year.

We also talked about our support/patch policy and decided to keep patching for security issues on previous major versions for two months after a new major major release is published. Two months is enough time for active maintainers to release upgraded extensions, especially if given clear upgrade documentation and a developer announcement with the release candidate(s). We hope to promote a healthy upgrade habit with our end users, developers and partners. But we also wish to reduce unnecessary support weight on our small and flexible team.

The channels that you can currently keep yourself in the loop about updates to Flarum:

follow the tag blog
https://coderelease.io/
follow us on twitter
join our discord server
install extiverse/mercury on your Flarum forum

Darkle

luceos I love the transparency of the Flarum team that you have with us, it's not a common thing. I was just writing a draft about the new cycles a few days ago, I was very curious about how the development cycles would evolve after the stable release and this already gives me an idea of the way.

It will be very interesting, so far the extension developers have been under pressure with the super fast cycles of these last betas, with this we might start to see more feature updates 🙂

matteocontrini

luceos security vulnerability review and the fact that our CVE report caused an XSS on the CVE website

what 😂

tankerkiller125

matteocontrini Yes... It was super funny when we realized what had happened. Apparently their site just trust whatever the dev/company inputs into the description, and in our description we included an example that triggered their site to execute it.

matteocontrini

tankerkiller125 I guess they need to file a CVE now...

al_naydenov

Hi there, nice work. How can I get the latest release? On GigHub it still says version 1.0. Thanks.

luceos

al_naydenov follow the installation instructions: https://docs.flarum.org/install.html