Flarum 1.8.14 Released ๐
We're shipping another maintenance release for the Flarum 1.x series. This one includes a security fix for flarum/nicknames, a solid batch of bug fixes, meaningful performance improvements, and some welcome changes to the GDPR extension.
โ ๏ธ Flarum 1.x end-of-life is coming
This release marks a turning point for the 1.x series. It is likely one of the last regular releases.
With Flarum 2.0 approaching its Release Candidate phase, we are shifting 1.x into an almost-EOL state with immediate effect:
โ No new features, improvements, or tweaks are planned for 1.x
โ Non-security bug fixes will generally not be backported
โ ๏ธ Security vulnerabilities will be investigated and addressed where possible โ but we want to be honest: the aging dependency stack (Flarum 1.x runs on Laravel 8, which is itself well into EOL) means that some security issues may simply not be fixable on this branch
โ
Flarum 2.0 is where all active development, security work, and long-term support is happening
The official EOL date for 1.x has not yet been set, but it will be clearly communicated in advance. The current plan is to officially EOL Flarum 1.x 12 months after the 2.0 stable release. In the meantime, we strongly encourage all 1.x forum admins to start planning their upgrade to Flarum 2.0.
๐ If you haven't started evaluating Flarum 2.0 yet, now is the time. Beta.8 โ the last beta before the RC phase โ is due in approximately two weeks.
๐จ A note on Flarum 2.0 โ action required for extension developers
Beta.8 is due in approximately two weeks, and it will be the last beta before the RC (Release Candidate) phase.
Here's what the RC phase means in practice:
๐ถ Beta (where we are now) โ APIs are still in flux. We can still make changes to core to accommodate extension needs.
๐ท Release Candidate โ The API is frozen. No new features, no breaking changes. Only critical bug fixes are accepted.
๐ข Stable 2.0.0 โ RC with no blockers = stable release.
For extension developers, this is your most important window. Once we enter RC, the ability to adapt the core API to your extension's needs closes. If you're working on a 2.0 update and find that core is getting in your way โ an API is too rigid, something is missing, an interface is awkward โ now is the time to tell us. Open a discussion here or file an issue on GitHub. We are actively listening and we want to help you ship compatible extensions alongside 2.0 stable.
๐ฃ Please test your extensions against beta.7 (and shortly, beta.8) and let us know what you find. Every compatibility report before RC is an opportunity to fix something permanently. After RC, it has to wait for 2.1.
๐ Help translate Flarum 2.0
Flarum 2.0 brings a lot of new strings, and getting them translated before stable is a huge community effort. If you speak a language other than English, your help is needed โ even a few strings reviewed or translated makes a difference.
Translations for Flarum 2.0 are managed on Weblate: weblate.rob006.net/projects/flarum2
You don't need to be a developer โ if you can read and write your language, you can contribute. Every little helps. ๐
๐ Security fix โ flarum/nicknames v1.8.3 (CVE-2026-30913)
If you use the flarum/nicknames extension, updating to 1.8.3 is strongly recommended.
A medium-severity vulnerability was discovered and responsibly disclosed via the SBB Community bug bounty programme. When flarum/nicknames is enabled, a user could set their nickname to a string that email clients interpret as a hyperlink โ for example a bare domain name (nasty.com) or markdown link syntax ([CLICK](https://evil.com)). The nickname is included verbatim in plain-text notification emails, potentially misleading recipients into visiting attacker-controlled URLs.
Variant 1 (autolink) โ a nickname like nasty.com is auto-linked by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird)
Variant 2 (markdown) โ a nickname like [CLICK](https://evil.com) is rendered as a clickable link by email clients that auto-render markdown in plain text (e.g. Apple Mail, Thunderbird)
The fix adds validation in flarum/nicknames to reject nicknames containing characters that could be misinterpreted in email contexts, while preserving legitimate nicknames like Jane.Smith.
The default username-based display name driver is not affected โ it already constrains values to [a-zA-Z0-9_-]+. Any third-party display name driver that permits arbitrary characters should be reviewed.
๐ Thanks to tank0 for reporting this responsibly via Intigriti, and to @gianniguida and @Davetodave178 for helping with the fix and verification.
โก Performance improvements
This release includes several under-the-hood optimisations. Nothing you'll see directly โ but your server will thank you.
โก Notification counts cached โ was a DB query on every page load; now cached for 5 minutes and invalidated automatically when something changes (including when you delete all notifications).
โก Auth last-seen write eliminated โ was an unconditional DB write on every authenticated request; now only writes when the data has actually changed.
โก Scheduler timestamp moved to cache โ was a DB write every ~1 minute; now stored in the cache layer instead.
Together, these changes add up to noticeably fewer database operations โ especially on sites with active users.
๐ก Running Redis? The gains stack up significantly. fof/redis v1.1.6 pairs perfectly with these core improvements. It caches Flarum's forum settings in Redis with a three-layer chain โ per-request in-process cache, then Redis, then the database โ so settings are read from the database at most once per Redis TTL, and from Redis at most once per request regardless of how many times settings->get() is called. In production, this alone can reduce Redis egress from settings reads by over 95%. On top of that, fof/redis now auto-detects phpredis (the native PHP extension) and uses it automatically when available, enabling persistent connections that reuse the socket across requests within the same PHP-FPM worker โ significantly reducing connection overhead at scale. If you're running Redis and haven't updated fof/redis recently, now is a great time.
๐ Bug fixes
HTTP 405 "Method Not Allowed" pages now show the correct message ("This page does not support that request method.") instead of the generic "An error occurred" fallback.
PHP warnings in restricted environments โ a handful of PHP notices/warnings that could appear on certain hosting configurations have been resolved.
Less boolean custom functions โ a regression where custom Less functions returning boolean values were not handled correctly has been fixed.
Extension Manager โ references to the discontinued Extiverse marketplace have been removed.
๐ GDPR extension โ v1.8.2
This release includes a significant security and compliance update to the flarum/gdpr extension:
One-time confirmation links โ the erasure confirmation token is now invalidated after use. Previously, a user's confirmation email link could be re-used indefinitely; it is now a true one-time link.
Processed request guard โ revisiting a confirmation link for an already-processed or manually-handled erasure request now returns a proper error instead of silently resetting its status.
Confirmation IP logging โ the IP address used to confirm an erasure request is now stored for audit purposes.
Automatic IP purge โ a new scheduled command (gdpr:clear-confirmation-ips) automatically nulls stored confirmation IPs after 90 days, keeping data retention proportionate.
Erasure modal timestamps โ the admin process-erasure modal now shows the requested-at, confirmed-at, and eligible-for-auto-processing dates.
๐ฆ Versions released
๐ How to update
composer update
As always, back up your database before updating, and test on a staging environment first if possible.
๐ Full changelog
Core (flarum/core)
Fixed
Show correct error message for HTTP 405 Method Not Allowed responses by @IanM #4417
Fix PHP warnings in restricted environments by @IanM #4336
Fix Less boolean custom functions returning incorrect values by @IanM #4405
Invalidate unread notification count cache when all notifications are deleted by @IanM #4391
Performance
Added
- Fire
ApplicationBooted event after all service provider boot callbacks complete by @IanM #4358
Nicknames (flarum/nicknames)
Security
- Validate nicknames to prevent display name injection in notification emails (CVE-2026-30913) GHSA-3c4m-j3g4-hh25
Extension Manager (flarum/extension-manager)
Changed
- Remove Extiverse marketplace references by @IanM #4395
Suspend (flarum/suspend)
Changed
GDPR (flarum/gdpr)
Fixed / Security
Added
