Extension Manager Updates

KBExit

Anyone else having issues with running updates in Extension Manager? Or at least checking for updates? Numerous clients are having this issue right now, but nothing is populating in the logs.

GreXXL

KBExit can you specify what "having issues" means?

ernestdefoe

GreXXL it says failed. Extensions will install but will not check for updates.

KBExit

I was not getting any answers via Extension Manager, so I took matters in Composer directly.
Found this:

composer update --with-all-dependencies
Loading composer repositories with package information
Warning: the packages key 'kilowhat/flarum-ext-audit-pro' doesn't match the name defined in the package metadata 'kilowhat/flarum-ext-audit' in repository https://flarum.org/composer
Warning: the packages key 'kilowhat/flarum-ext-audit-pro' doesn't match the name defined in the package metadata 'kilowhat/flarum-ext-audit' in repository https://flarum.org/composer
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

Problem 1
- Root composer.json requires fof/pretty-mail *, found fof/pretty-mail[0.1.0, ..., 0.4.0, 1.0.0, ..., 1.1.2] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-zqkh-gtty-c5yv") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

I would much rather the extension developer fix the issue instead of allowing insecure practices lol. Putting it on the extension post and posting to github,

https://discuss.flarum.org/d/11178-friendsofflarum-pretty-mail/217

KBExit

Update. @ernestdefoe the extension Pretty Mail is marked to be discontinued.
https://discuss.flarum.org/d/11178-friendsofflarum-pretty-mail/216

I think removing the extension from your site will restore Extension Manager to run properly.

ernestdefoe

KBExit nope I uninstalled Pretty Mail and it still won’t check for updates.

KBExit

ernestdefoe the log in the failed fetches have other extensions listed. I wonder if it's a combination of multiple then.

KBExit

Looking at the logs, I think it's the PWA extension yet again lol.
Remove it, and it should work again.

KBExit

So, Pretty Mail is discontinued moving on with 2.0 (not needed according to the FoF Team)
and PWA is just abandoned and obsolete.

{ "installed": [ { "name": "askvortsov/flarum-pwa", "direct-dependency": true, "homepage": null, "source": "https://github.com/askvortsov1/flarum-pwa", "version": "v3.4.0", "release-age": "1 year old", "release-date": "2024-04-13T19:02:14+00:00", "latest": "v3.4.1", "latest-status": "semver-safe-update", "latest-release-date": "2024-06-15T17:30:36+00:00", "description": "Turn your flarum site into a progressive web app!", "abandoned": false }, { "name": "aws/aws-sdk-php", "direct-dependency": false, "homepage": "http://aws.amazon.com/sdkforphp", "source": "https://github.com/aws/aws-sdk-php/tree/3.363.3", "version": "3.363.3", "release-age": "3 weeks old", "release-date": "2025-11-26T19:05:22+00:00", "latest": "3.369.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-12-19T19:08:40+00:00", "description": "AWS SDK for PHP - Use Amazon Web Services in your PHP project", "abandoned": false }, { "name": "capybash/magicbb", "direct-dependency": true, "homepage": "https://github.com/capybash/magicbb", "source": "https://github.com/capybash/magicbb", "version": "v7.0.0", "release-age": "1 month old", "release-date": "2025-10-22T15:16:07+00:00", "latest": "v7.1.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-10-22T15:18:38+00:00", "description": "Extra BBCodes, handy toolbar buttons, and unique text formatting for the forum composer.", "abandoned": false }, { "name": "capybash/magicread", "direct-dependency": true, "homepage": "https://github.com/capybash/magicread", "source": "https://github.com/capybash/magicread", "version": "v4.0.0", "release-age": "1 month old", "release-date": "2025-10-22T15:22:08+00:00", "latest": "v4.1.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-10-22T15:29:01+00:00", "description": "Clean pagination inside discussions and a live character counter for the composer.", "abandoned": false }, { "name": "capybash/magicslider", "direct-dependency": true, "homepage": "https://github.com/capybash/magicslider", "source": "https://github.com/capybash/magicslider", "version": "v6.0.0", "release-age": "1 month old", "release-date": "2025-10-22T15:34:07+00:00", "latest": "v6.1.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-10-22T15:37:51+00:00", "description": "Configurable image slider replacing the WelcomeHero on the forum home page.", "abandoned": false }, { "name": "composer/ca-bundle", "direct-dependency": false, "homepage": null, "source": "https://github.com/composer/ca-bundle/tree/1.5.9", "version": "1.5.9", "release-age": "1 month old", "release-date": "2025-11-06T11:46:17+00:00", "latest": "1.5.10", "latest-status": "semver-safe-update", "latest-release-date": "2025-12-08T15:06:51+00:00", "description": "Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.", "abandoned": false }, { "name": "doctrine/cache", "direct-dependency": false, "homepage": "https://www.doctrine-project.org/projects/cache.html", "source": "https://github.com/doctrine/cache/tree/2.2.0", "version": "2.2.0", "release-age": "3 years old", "release-date": "2022-05-20T20:07:39+00:00", "latest": "2.2.0", "latest-status": "up-to-date", "latest-release-date": "2022-05-20T20:07:39+00:00", "description": "PHP Doctrine Cache library is a popular cache implementation that supports many different drivers such as redis, memcache, apc, mongodb and others.", "warning": "Package doctrine/cache is abandoned, you should avoid using it. No replacement was suggested.", "abandoned": true }, { "name": "fgrosse/phpasn1", "direct-dependency": false, "homepage": "https://github.com/FGrosse/PHPASN1", "source": "https://github.com/fgrosse/PHPASN1/tree/v2.5.0", "version": "v2.5.0", "release-age": "3 years old", "release-date": "2022-12-19T11:08:26+00:00", "latest": "v2.5.0", "latest-status": "up-to-date", "latest-release-date": "2022-12-19T11:08:26+00:00", "description": "A PHP Framework that allows you to encode and decode arbitrary ASN.1 structures using the ITU-T X.690 Encoding Rules.", "warning": "Package fgrosse/phpasn1 is abandoned, you should avoid using it. No replacement was suggested.", "abandoned": true }, { "name": "fof/extend", "direct-dependency": false, "homepage": null, "source": "https://github.com/FriendsOfFlarum/extend/tree/1.3.3", "version": "1.3.3", "release-age": "2 years old", "release-date": "2023-11-30T08:13:16+00:00", "latest": "1.3.4", "latest-status": "semver-safe-update", "latest-release-date": "2025-12-08T19:17:33+00:00", "description": "Configurable PHP components for your Flarum extension", "abandoned": false }, { "name": "fof/upload", "direct-dependency": true, "homepage": "https://friendsofflarum.org", "source": "https://github.com/FriendsOfFlarum/upload", "version": "1.8.6", "release-age": "1 month old", "release-date": "2025-11-10T13:40:25+00:00", "latest": "1.8.7", "latest-status": "semver-safe-update", "latest-release-date": "2025-12-02T13:15:20+00:00", "description": "The file upload extension for the Flarum forum with insane intelligence.", "abandoned": false }, { "name": "google/apiclient", "direct-dependency": false, "homepage": "http://developers.google.com/api-client-library/php", "source": "https://github.com/googleapis/google-api-php-client/tree/v2.14.0", "version": "v2.14.0", "release-age": "2 years old", "release-date": "2023-05-11T21:54:55+00:00", "latest": "v2.18.4", "latest-status": "semver-safe-update", "latest-release-date": "2025-09-30T04:23:07+00:00", "description": "Client library for Google APIs", "abandoned": false }, { "name": "google/auth", "direct-dependency": false, "homepage": "http://github.com/google/google-auth-library-php", "source": "https://github.com/googleapis/google-auth-library-php/tree/v1.44.0", "version": "v1.44.0", "release-age": "1 year old", "release-date": "2024-12-04T15:34:58+00:00", "latest": "v1.49.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-11-06T21:27:55+00:00", "description": "Google Auth Library for PHP", "abandoned": false }, { "name": "google/cloud-core", "direct-dependency": false, "homepage": null, "source": "https://github.com/googleapis/google-cloud-php-core/tree/v1.52.10", "version": "v1.52.10", "release-age": "2 years old", "release-date": "2023-12-08T22:36:35+00:00", "latest": "v1.69.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-12-06T04:51:04+00:00", "description": "Google Cloud PHP shared dependency, providing functionality useful to all components.", "abandoned": false }, { "name": "google/cloud-storage", "direct-dependency": false, "homepage": null, "source": "https://github.com/googleapis/google-cloud-php-storage/tree/v1.36.1", "version": "v1.36.1", "release-age": "1 year old", "release-date": "2024-01-05T17:34:35+00:00", "latest": "v1.49.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-12-06T04:51:04+00:00", "description": "Cloud Storage Client for PHP", "abandoned": false }, { "name": "justinrainbow/json-schema", "direct-dependency": false, "homepage": "https://github.com/jsonrainbow/json-schema", "source": "https://github.com/jsonrainbow/json-schema/tree/6.6.2", "version": "6.6.2", "release-age": "3 weeks old", "release-date": "2025-11-28T15:24:03+00:00", "latest": "6.6.3", "latest-status": "semver-safe-update", "latest-release-date": "2025-12-02T10:21:33+00:00", "description": "A library to validate a json schema.", "abandoned": false }, { "name": "kreait/firebase-php", "direct-dependency": false, "homepage": "https://github.com/kreait/firebase-php", "source": "https://github.com/kreait/firebase-php", "version": "7.16.0", "release-age": "1 year old", "release-date": "2024-11-17T22:12:51+00:00", "latest": "7.24.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-11-27T22:03:59+00:00", "description": "Firebase Admin SDK", "abandoned": false }, { "name": "phpseclib/phpseclib", "direct-dependency": false, "homepage": "http://phpseclib.sourceforge.net", "source": "https://github.com/phpseclib/phpseclib/tree/3.0.47", "version": "3.0.47", "release-age": "2 months old", "release-date": "2025-10-06T01:07:24+00:00", "latest": "3.0.48", "latest-status": "semver-safe-update", "latest-release-date": "2025-12-15T11:51:42+00:00", "description": "PHP Secure Communications Library - Pure-PHP implementations of RSA, AES, SSH2, SFTP, X.509 etc.", "abandoned": false }, { "name": "plesk/ratchetphp", "direct-dependency": false, "homepage": "http://socketo.me", "source": "https://github.com/plesk/ratchetphp/tree/v1.0.4", "version": "v1.0.4", "release-age": "10 months old", "release-date": "2025-01-29T12:14:52+00:00", "latest": "v1.0.6", "latest-status": "semver-safe-update", "latest-release-date": "2025-03-10T09:15:54+00:00", "description": "PHP WebSocket library", "abandoned": false }, { "name": "ramsey/uuid", "direct-dependency": false, "homepage": null, "source": "https://github.com/ramsey/uuid/tree/4.9.1", "version": "4.9.1", "release-age": "3 months old", "release-date": "2025-09-04T20:59:21+00:00", "latest": "4.9.2", "latest-status": "semver-safe-update", "latest-release-date": "2025-12-14T04:43:48+00:00", "description": "A PHP library for generating and working with universally unique identifiers (UUIDs).", "abandoned": false }, { "name": "s9e/text-formatter", "direct-dependency": false, "homepage": "https://github.com/s9e/TextFormatter/", "source": "https://github.com/s9e/TextFormatter/tree/2.14.3", "version": "2.14.3", "release-age": "2 years old", "release-date": "2023-11-11T15:27:53+00:00", "latest": "2.19.3", "latest-status": "semver-safe-update", "latest-release-date": "2025-11-14T21:26:59+00:00", "description": "Multi-purpose text formatting and markup library. Plugins offer support for BBCodes, Markdown, emoticons, HTML, embedding third-party media (YouTube, etc...), enhanced typography and more.", "abandoned": false }, { "name": "staudenmeir/eloquent-eager-limit", "direct-dependency": false, "homepage": null, "source": "https://github.com/staudenmeir/eloquent-eager-limit/tree/v1.6.1", "version": "v1.6.1", "release-age": "5 years old", "release-date": "2020-11-22T18:13:55+00:00", "latest": "v1.8.3", "latest-status": "semver-safe-update", "latest-release-date": "2023-07-12T21:15:26+00:00", "description": "Laravel Eloquent eager loading with limit", "abandoned": false }, { "name": "swiftmailer/swiftmailer", "direct-dependency": false, "homepage": "https://swiftmailer.symfony.com", "source": "https://github.com/swiftmailer/swiftmailer/tree/v6.3.0", "version": "v6.3.0", "release-age": "4 years old", "release-date": "2021-10-18T15:26:12+00:00", "latest": "v6.3.0", "latest-status": "up-to-date", "latest-release-date": "2021-10-18T15:26:12+00:00", "description": "Swiftmailer, free feature-rich PHP mailer", "warning": "Package swiftmailer/swiftmailer is abandoned, you should avoid using it. Use symfony/mailer instead.", "abandoned": "symfony/mailer" }, { "name": "symfony/routing", "direct-dependency": false, "homepage": "https://symfony.com", "source": "https://github.com/symfony/routing/tree/v6.1.11", "version": "v6.1.11", "release-age": "2 years old", "release-date": "2023-01-01T08:36:55+00:00", "latest": "v6.4.30", "latest-status": "semver-safe-update", "latest-release-date": "2025-11-22T09:51:35+00:00", "description": "Maps an HTTP request to a set of configuration variables", "abandoned": false }, { "name": "web-token/jwt-core", "direct-dependency": false, "homepage": "https://github.com/web-token", "source": "https://github.com/web-token/jwt-core/tree/v2.2", "version": "v2.2.3", "release-age": "5 years old", "release-date": "2020-08-22T13:17:25+00:00", "latest": "v2.2.11", "latest-status": "semver-safe-update", "latest-release-date": "2021-03-17T14:55:52+00:00", "description": "Core component of the JWT Framework.", "warning": "Package web-token/jwt-core is abandoned, you should avoid using it. Use web-token/jwt-library instead.", "abandoned": "web-token/jwt-library" }, { "name": "web-token/jwt-key-mgmt", "direct-dependency": false, "homepage": "https://github.com/web-token", "source": "https://github.com/web-token/jwt-key-mgmt/tree/v2.2.11", "version": "v2.2.11", "release-age": "4 years old", "release-date": "2021-03-17T14:55:52+00:00", "latest": "v2.2.11", "latest-status": "up-to-date", "latest-release-date": "2021-03-17T14:55:52+00:00", "description": "Key Management component of the JWT Framework.", "warning": "Package web-token/jwt-key-mgmt is abandoned, you should avoid using it. Use web-token/jwt-library instead.", "abandoned": "web-token/jwt-library" }, { "name": "web-token/jwt-signature", "direct-dependency": false, "homepage": "https://github.com/web-token", "source": "https://github.com/web-token/jwt-signature/tree/v2.2.11", "version": "v2.2.11", "release-age": "4 years old", "release-date": "2021-03-01T19:55:28+00:00", "latest": "v2.2.11", "latest-status": "up-to-date", "latest-release-date": "2021-03-01T19:55:28+00:00", "description": "Signature component of the JWT Framework.", "warning": "Package web-token/jwt-signature is abandoned, you should avoid using it. Use web-token/jwt-library instead.", "abandoned": "web-token/jwt-library" }, { "name": "web-token/jwt-signature-algorithm-ecdsa", "direct-dependency": false, "homepage": "https://github.com/web-token", "source": "https://github.com/web-token/jwt-signature-algorithm-ecdsa/tree/v2.2.11", "version": "v2.2.11", "release-age": "4 years old", "release-date": "2021-01-21T19:18:03+00:00", "latest": "v2.2.11", "latest-status": "up-to-date", "latest-release-date": "2021-01-21T19:18:03+00:00", "description": "ECDSA Based Signature Algorithms the JWT Framework.", "warning": "Package web-token/jwt-signature-algorithm-ecdsa is abandoned, you should avoid using it. Use web-token/jwt-library instead.", "abandoned": "web-token/jwt-library" }, { "name": "web-token/jwt-util-ecc", "direct-dependency": false, "homepage": "https://github.com/web-token", "source": "https://github.com/web-token/jwt-util-ecc/tree/v2.0.4", "version": "v2.0.8", "release-age": "6 years old", "release-date": "2019-06-22T13:06:07+00:00", "latest": "v2.2.11", "latest-status": "semver-safe-update", "latest-release-date": "2021-03-24T13:35:17+00:00", "description": "ECC Tools for the JWT Framework.", "warning": "Package web-token/jwt-util-ecc is abandoned, you should avoid using it. Use web-token/jwt-library instead.", "abandoned": "web-token/jwt-library" } ] }

IanM

KBExit PWA is (slowly) being adopted by FoF, and will be available as fof/pwa for both 1.x and 2.x 🙂

KBExit

IanM @ernestdefoe just standby to rip the bandaid.
Thank you @IanM !

ernestdefoe

KBExit it’s not the PWA extension either. Uninstalled it and still can’t check for updates.

KBExit

ernestdefoe wtf

KBExit

Update, I was able to force an update for your site via Composer after removing Pretty Mail and PWA by the way.
I am investigating what else is holding up.

KBExit

With the assist of AI Debugging, it flagged these two in addition:

doctrine/cache
swiftmailer/swiftmailer

IanM

KBExit You'll see many issues with old deps on Flarum 1.x.

I think the simplest thing for now, would be to downgrade composer to 2.8.x - still new enough to be secure, but does not have the extension blocking features

KBExit

IanM I don't remember updating composer itself. Would this be a result of another dependency or extension update?

IanM

KBExit from your terminal, run composer -V

KBExit

IanM thank you, I think I've isolated my issue! Running patches now!

KBExit

@IanM still no dice.
______ / ____/___ ____ ___ ____ ____ ________ _____ / / / __ \/ ____ \/ __ \/ __ \/ ___/ _ \/ /
/ // // / / / / / / // / // (__ ) / /
_/_// // // ./_//_//
//
Composer version 2.8.4 2024-12-11 11:57:47`

{ "installed": [ { "name": "capybash/magicbb", "direct-dependency": true, "homepage": "https://github.com/capybash/magicbb", "source": "https://github.com/capybash/magicbb", "version": "v7.0.0", "release-age": "1 month old", "release-date": "2025-10-22T15:16:07+00:00", "latest": "v7.1.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-10-22T15:18:38+00:00", "description": "Extra BBCodes, handy toolbar buttons, and unique text formatting for the forum composer.", "abandoned": false }, { "name": "capybash/magicread", "direct-dependency": true, "homepage": "https://github.com/capybash/magicread", "source": "https://github.com/capybash/magicread", "version": "v4.0.0", "release-age": "1 month old", "release-date": "2025-10-22T15:22:08+00:00", "latest": "v4.1.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-10-22T15:29:01+00:00", "description": "Clean pagination inside discussions and a live character counter for the composer.", "abandoned": false }, { "name": "capybash/magicslider", "direct-dependency": true, "homepage": "https://github.com/capybash/magicslider", "source": "https://github.com/capybash/magicslider", "version": "v6.0.0", "release-age": "1 month old", "release-date": "2025-10-22T15:34:07+00:00", "latest": "v6.1.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-10-22T15:37:51+00:00", "description": "Configurable image slider replacing the WelcomeHero on the forum home page.", "abandoned": false }, { "name": "doctrine/cache", "direct-dependency": false, "homepage": "https://www.doctrine-project.org/projects/cache.html", "source": "https://github.com/doctrine/cache/tree/2.2.0", "version": "2.2.0", "release-age": "3 years old", "release-date": "2022-05-20T20:07:39+00:00", "latest": "2.2.0", "latest-status": "up-to-date", "latest-release-date": "2022-05-20T20:07:39+00:00", "description": "PHP Doctrine Cache library is a popular cache implementation that supports many different drivers such as redis, memcache, apc, mongodb and others.", "warning": "Package doctrine/cache is abandoned, you should avoid using it. No replacement was suggested.", "abandoned": true }, { "name": "google/apiclient", "direct-dependency": false, "homepage": "http://developers.google.com/api-client-library/php", "source": "https://github.com/googleapis/google-api-php-client/tree/v2.14.0", "version": "v2.14.0", "release-age": "2 years old", "release-date": "2023-05-11T21:54:55+00:00", "latest": "v2.18.4", "latest-status": "semver-safe-update", "latest-release-date": "2025-09-30T04:23:07+00:00", "description": "Client library for Google APIs", "abandoned": false }, { "name": "google/auth", "direct-dependency": false, "homepage": "http://github.com/google/google-auth-library-php", "source": "https://github.com/googleapis/google-auth-library-php/tree/v1.44.0", "version": "v1.44.0", "release-age": "1 year old", "release-date": "2024-12-04T15:34:58+00:00", "latest": "v1.49.0", "latest-status": "semver-safe-update", "latest-release-date": "2025-11-06T21:27:55+00:00", "description": "Google Auth Library for PHP", "abandoned": false }, { "name": "plesk/ratchetphp", "direct-dependency": false, "homepage": "http://socketo.me", "source": "https://github.com/plesk/ratchetphp/tree/v1.0.4", "version": "v1.0.4", "release-age": "10 months old", "release-date": "2025-01-29T12:14:52+00:00", "latest": "v1.0.6", "latest-status": "semver-safe-update", "latest-release-date": "2025-03-10T09:15:54+00:00", "description": "PHP WebSocket library", "abandoned": false }, { "name": "s9e/text-formatter", "direct-dependency": false, "homepage": "https://github.com/s9e/TextFormatter/", "source": "https://github.com/s9e/TextFormatter/tree/2.14.3", "version": "2.14.3", "release-age": "2 years old", "release-date": "2023-11-11T15:27:53+00:00", "latest": "2.19.3", "latest-status": "semver-safe-update", "latest-release-date": "2025-11-14T21:26:59+00:00", "description": "Multi-purpose text formatting and markup library. Plugins offer support for BBCodes, Markdown, emoticons, HTML, embedding third-party media (YouTube, etc...), enhanced typography and more.", "abandoned": false }, { "name": "staudenmeir/eloquent-eager-limit", "direct-dependency": false, "homepage": null, "source": "https://github.com/staudenmeir/eloquent-eager-limit/tree/v1.6.1", "version": "v1.6.1", "release-age": "5 years old", "release-date": "2020-11-22T18:13:55+00:00", "latest": "v1.8.3", "latest-status": "semver-safe-update", "latest-release-date": "2023-07-12T21:15:26+00:00", "description": "Laravel Eloquent eager loading with limit", "abandoned": false }, { "name": "swiftmailer/swiftmailer", "direct-dependency": false, "homepage": "https://swiftmailer.symfony.com", "source": "https://github.com/swiftmailer/swiftmailer/tree/v6.3.0", "version": "v6.3.0", "release-age": "4 years old", "release-date": "2021-10-18T15:26:12+00:00", "latest": "v6.3.0", "latest-status": "up-to-date", "latest-release-date": "2021-10-18T15:26:12+00:00", "description": "Swiftmailer, free feature-rich PHP mailer", "warning": "Package swiftmailer/swiftmailer is abandoned, you should avoid using it. Use symfony/mailer instead.", "abandoned": "symfony/mailer" }, { "name": "symfony/routing", "direct-dependency": false, "homepage": "https://symfony.com", "source": "https://github.com/symfony/routing/tree/v6.1.11", "version": "v6.1.11", "release-age": "2 years old", "release-date": "2023-01-01T08:36:55+00:00", "latest": "v6.4.30", "latest-status": "semver-safe-update", "latest-release-date": "2025-11-22T09:51:35+00:00", "description": "Maps an HTTP request to a set of configuration variables", "abandoned": false } ] }