Flarum 1.8.17 Released
A small maintenance release for the Flarum 1.x series. No security fixes this time — it's a handful of bug fixes plus the new first-party Audit extension. It isn't bundled by default on 1.x; install it with composer require flarum/audit:"*" if you want it. You can read more about flarum/audit in @GreXXL's post here.
There's no urgency to upgrade unless one of the fixes below affects you, but it's a safe update with no breaking changes.
The Audit extension is now first-party
The big addition this release is flarum/audit, a first-party audit log. It records moderation and administration actions — discussions, posts, users, settings, permissions, extension enable/disable, and so on — to a tamper-resistant log you can browse from the admin panel, or (with permission) directly from a discussion or user's page.
This started life as Clark Winkelmann's KILOWHAT Audit extension, which we've brought in-house and reworked as a first-party extension. It is not installed by default on 1.x — add it with composer require flarum/audit:"*", then enable it from the Extensions page.
If you're coming from kilowhat/flarum-ext-audit (or the free/pro variants), the switch is handled for you: Composer replaces the old package, and your existing log table is renamed and kept intact — no data is lost.
A couple of things worth knowing:
- Extension integrations (Flags, Tags, Lock, FoF Ban IPs, and others) only log when the relevant extension is enabled.
- IP-to-country flags are shown if you also run FoF GeoIP; there's nothing to configure in Audit itself.
Full documentation is on the docs site.
Bug fixes
A few things that were broken or annoying are now fixed:
- Abandoned-extensions sync never ran. The weekly task that refreshes the abandoned-extensions list (added in 1.8.16) was registered too late in the boot process and never made it into the scheduler, so the admin panel never flagged anything. It's now scheduled correctly. (#4706)
- Mobile post count. On mobile, a discussion's total post count didn't update after you replied. (#4684)
- Tooltips. Fixed a flash of the native browser tooltip, some teardown leaks when tooltips were removed, and tooltips not picking up dynamic text changes. (#4675)
- Browsers without XSLT. Recent browser changes have started dropping XSLT support; the forum now ships a polyfill so it keeps booting on those browsers. (#4644)
For extension developers
- The testing harness now authenticates via cookie, which fixes some integration-test setups. (#4631)
If for example a 1.x extension used actor id 1 (admin) to hit an API endpoint AND provided a cookie param using withCookieParams() (which is a replacement ), in 1.8.17 the cookie authentication would get thrown out.
Previous on 1.x:
$request = $request->withCookieParams(['foo' => 'bar']);
Should now be in 1.8.17 (and also in Flarum 2.x):
$request = $request->withCookieParams(
array_merge($request->getCookieParams(), ['foo' => 'bar'])
);
- Composer is pegged to an LTS version in CI, following the recent GitHub Actions token-disclosure advisories. (#4661)
A note on 1.x
Flarum 2.0.0-rc.4 is imminent, and that's where all the work is now. The 1.x series is effectively on life support: no new features, and maintenance only on an as-really-needed basis. This release is one of those — small fixes worth shipping before 1.x is fully retired at the end of the year.
If you're still on 1.x, it's a good time to start planning the move to 2.0. Extension developers: if your 2.0 update isn't out yet, that's the priority.
Versions released
flarum/core — 1.8.17flarum/audit — 1.8.0 (new; opt-in, install with composer require flarum/audit:"*")
How to update
composer update
php flarum migrate
php flarum cache:clear
php flarum assets:publish
Back up your database first, and test on staging if you can.
Full changelog
Added
Fixed
- Schedule the abandoned-extensions sync command so it actually runs by @IanM #4706
- Mobile discussion total post count not updating on reply by @huoxin #4684
- Native tooltip flash, async teardown leaks, and dynamic text by @huoxin #4675
- Add XSLT polyfill so the forum continues to boot on browsers without XSLT by @IanM #4644
- [Testing] Use cookie for testing authentication by @huoxin #4631
Changed
