Flarum 2.0.0-rc.4 Released — Audit joins core, 2.0 stable in sight

IanM · 2026-06-18T12:06:58+00:00

Flarum 2.0.0-rc.4 Released 🎉 — 2.0 stable is almost here This is it — 2.0 stable is very, very close now. Today we're shipping 2.0.0-rc.4 (33 merged PRs since rc.3), and it's the clearest sign yet that the finish line is right in front of us. This isn't just maintenance: rc.4 brings a previously-premium extension into the open-source core, adds new realtime features, and closes out a security fix and a stack of bugs. And here's the thing we can't say loudly enough: we are this close because of you. The forums running 2.0 in production, the people filing bug reports, the "I upgraded and everything's fine" notes and the "this broke for me" ones — that feedback, good and bad, is exactly what turns a release candidate into a stable release. Every report has sanded down another edge. The bug reports are getting rarer, the fixes smaller, the confidence higher. That's what the last stretch before 2.0 stable looks like, and we're nearly through it. 🚀 Production-ready for early adopters. The upgrade from rc.3 is a plain composer update. Back up your database, test on staging if you can, keep a rollback plan — the usual. 👀 This forum runs it. discuss.flarum.org is on the latest 2.x. So is the nightly demo, rebuilt daily. You're looking at 2.0 right now. 💬 Already upgraded? Tell us. Drop a note inSupport — every "running it in prod, all good" report builds confidence for the next forum about to take the leap. ⭐ The headlines 🗂️ Audit joins the open-source core The big one: flarum/audit is now a first-party extension. It records moderation and administration actions — discussions, posts, users, settings, permissions, extension toggles, and more — to a tamper-resistant log you can browse from the admin panel, or (with permission) straight from a user's or discussion's page. It's searchable by action, actor, user, client type, discussion, and IP address. This started life as Clark Winkelmann's KILOWHAT Audit extension, which the Flarum Foundation has brought in-house and reworked as a first-party extension — and the previous free/pro split is gone, so every feature is now included. New installs of Flarum 2.0 will come with Audit bundled in; on existing installs it's opt-in from the Extensions page. It also ships with integrations out of the box — Tags, Flags, Lock, Sticky, Approval, Suspend and Nicknames, plus several FriendsOfFlarum extensions (Impersonate, Split, Merge Discussions, Ban IPs, User Bio, Username Request) — and extension developers can now log their own actions through a public extender. Read more in the announcement and the docs. (#4711) 💬 Ambient typing indicators — now on the tag list too Realtime gains an ambient "someone's typing here" indicator on the discussion list — a subtle, coalesced presence dot that shows activity without flooding the client. In rc.4 it extends to the index sidebar tag list: a tag lights up while someone is typing in — or composing a new discussion in — one of its discussions, with restricted tags only ever shown to people who can see them. The typing indicator was also reworked to be reusable and movable so extensions can place it where it fits. (#4731, #4756, #4721) 🔔 "A new version is available" — without a manual reload Ever deployed an update and left everyone already on the forum running stale JS/CSS until they happened to refresh? Not any more. When the forum's assets are rebuilt — a deployment, an extension toggle — browsing users are now prompted to reload to pick up the new version. It works on every forum via the API, and instantly (no interaction needed) on forums running Realtime. (#4752) 🔒 A realtime security fix rc.4 closes an authorization gap in the Realtime WebSocket: client-originated events were rebroadcast to the channel named in the payload without checking the sender was subscribed to it. Realtime now only relays client- events to private/presence channels the sender is actually subscribed to. If you run Realtime, this is a good reason to upgrade. (#4738) 🛠️ Everything else in rc.4 🐛 Fixes Small avatars no longer vanish. Avatar uploads smaller than 100×100 were skipped entirely, leaving a database record pointing at a file that was never written (a 404). The base image is now always generated. (#4740) A TypeError when creating a user with a nickname is fixed. (#4734) Custom tag slug drivers now work. The tag filter resolved slugs against the literal slug column, so custom slug drivers returned no results; resolution now goes through the active driver. (#4739) A related fix ensures an unslugged tag's slug is serialized correctly to the API. (#4746) The loading indicator no longer flickers. A lazy-loaded chunk that arrives quickly used to flash a "Loading…" toast for a split second; it's now debounced so it only appears for genuinely slow loads. (#4750) Pusher boot crash fixed, and discussion-list updates restored. (#4730) Internal API requests are no longer subjected to JSON:API query validation meant for external callers. (#4728) The upgrade page now returns HTTP 503 instead of 200, so health checks and caches treat it correctly. (#4720) The admin Extensions page shows the correct database display name again. (#4747) Realtime notification toasts now show the correct toast, and stop being dropped. (#4713) Post mention notifications no longer jump on the page. (#4686) The initial page of posts embedded in the page load is no longer re-fetched. (#4703) Flag::$reason is now correctly typed as nullable, so static analysis stops flagging legitimate code that leaves it null. (#4760) ♿ Accessibility Composer control buttons and the new discussion button now have accessible labels for screen readers. (#4723, #4749, #4758) ⚡ Performance The editCredentials permission check no longer loads the target user's groups when it doesn't need to. (#4729) The admin bundle is smaller — sortablejs is now lazy-loaded instead of shipping on every admin page. (#4754) 🧩 Under the hood The Audit lifecycle gained coverage: GDPR erasure requests are now audit-logged (#4732) and discussion approvals are recorded (#4748). MariaDB was added to the frontend database-driver enum (#4701), and a circular optional-dependency in Audit was removed (#4712). TagLinkButton was converted to TypeScript with an extensible linkItems list, giving extensions a clean way to add to a tag link. (#4755) 💙 This is a community release As ever, a big slice of this cycle came from the community: 9 of the 33 PRs were written by contributors outside the core team. That's the engine that carries Flarum across the line to a major release. Contributors this cycle: @davetodave178 — HTTP 503 on the upgrade page #4720, MariaDB in the frontend driver enum #4701, the Extensions page database display name #4747, and serializing an unslugged tag's slug #4746 @datitisev — base image for small avatar uploads #4740 @CyberGene — avoid re-fetching embedded initial posts #4703 @ClaudiusH — accessible label for the new discussion button #4749 and the follow-up aria-label key fix #4758 @zxbmmmmmmmmm — post mention notification jumping #4686 @IanM — Audit migration, ambient typing (discussion list & tags), asset-update notifications, the realtime security fix, and the bulk of the rest If you've ever thought about contributing, this is the moment. 2.0 is being built in the open, in real time, by people like you. 🚀 Help us bring 2.0 home We're at the doorstep of stable. The single best thing you can do to get us across it is run rc.4 and tell us how it goes — good or bad. Every forum that upgrades is one more real-world proving ground, and every report (especially the "this broke" ones) is a direct line to a more solid 2.0.0. See it live — nightly.flarum.site, rebuilt daily, and right here on discuss.flarum.org Upgrade your install — composer update -W, then php flarum migrate, php flarum cache:clear, and php flarum assets:publish (back up first, and test on staging if you can) Then come back and tell us — what worked, what didn't, what you'd want in 2.0 final Where to report: Bugs in core — flarum/frameworkissues General feedback, questions, extension behaviour —Support Security issues — security@flarum.org (please don't post publicly) 2.0 stable is almost here — and the feedback you send on rc.4 is what gets us the final mile. Let's bring it home together. 💪 📋 Changelog Added (audit) migrate the Audit extension to 2.x, split first-party integrations, and add GDPR/core coverage by @IanM #4711 (core, realtime) notify browsing users when the forum's assets are updated by @IanM #4752 (realtime) ambient typing indicators on the discussion list by @IanM #4731 (realtime) ambient typing dots on the index sidebar tag list by @IanM #4756 (realtime) make the typing indicator reusable and movable by @IanM #4721 (gdpr) audit-log the erasure request lifecycle by @IanM #4732 (approval) log discussion approval in the audit log by @IanM #4748 (core) add MariaDB to the frontend DatabaseDriver enum by @davetodave178 #4701 Changed (tags) convert TagLinkButton to TSX with an extensible linkItems list by @IanM #4755 Fixed (flags) type Flag::$reason and $reason_detail as nullable by @IanM #4760 (a11y) fix the aria-label text key for the new discussion button by @ClaudiusH #4758 (core) debounce the loading indicator to avoid flicker by @IanM #4750 (avatar) ensure the base image exists for small avatar uploads by @datitisev #4740 (tags) delegate tag slug resolution to the active slug driver by @IanM #4739 (tags) serialize an unslugged tag's slug to the API by @davetodave178 #4746 (realtime) only relay client events to channels the sender is subscribed to by @IanM #4738 (nicknames) TypeError when creating a user with a nickname by @IanM #4734 (pusher) boot crash and restore discussion-list updates by @IanM #4730 (core) don't apply JSON:API query validation to internal API requests by @IanM #4728 (core) return HTTP 503 when the upgrade page is shown by @davetodave178 #4720 (core) add the missing database display name on the ExtensionPage by @davetodave178 #4747 (core) add accessible labels to composer control buttons by @IanM #4723 (a11y) add an accessible label to the new discussion button by @ClaudiusH #4749 (realtime) show the correct notification toast, and stop dropping it by @IanM #4713 (audit) remove circular optional-dependencies on first-party extensions by @IanM #4712 (core) fix abandoned-extensions sync never being scheduled by @IanM #4707 (core) avoid re-fetching the page of posts embedded in the initial page load by @CyberGene #4703 (mentions) fix post mention notification jumping by @zxbmmmmmmmmm #4686 Performance (core) avoid loading the target user's groups in the editCredentials check by @IanM #4729 (admin) lazy-load sortablejs to shrink the admin bundle by @IanM #4754 Documentation (realtime) provide a realtime docs link by @IanM #4722

IanM

DLBB circular deps, with this exact message was an issue during development of flarum/audit for 2.x. Do you by any chance have the dev version of it installed via composer? That's the only thing I can think of here...

edit: try the latest version of fof/geoip

DLBB

IanM Do you by any chance have the dev version of it installed via composer?

Really sorry, no idea. I just run composer update -W --prefer-dist --no-dev -a on rc3 then composer require flarum/audit:"*".

IanM try the latest version of fof/geoip

Got the latest fof/geoip 2.0.0-beta.9

Edit: Tried reinstall Audit with composer require flarum/audit, still the same.

IanM

DLBB have you run php flarum migrate after the upgrade?

IanM

MathieuM I've looked briefly at this and have a partial understanding of the problem. I documented it along with what I think need to change in Extension Manager in flarum/framework4764

In the meantime, I think your only realistic option is to upgrade via the CLI, which to be honest is always going to be safer/more reliable than we can ever make Extension Manager...

SpikeNit

Updated from 2.0.0-rc.3. Went smoothly, without a hitch, using composer update. Downloaded and activated flarum/audit. Works well! Pusher is now working properly with this update (their free version).

edit add-on: Monitoring site showed an error "503 Service Unavailable" during update.

Wlork

Thank you so much for your work!

I'm very glad to hear that development is progressing well and that we're in the home stretch.

However, I didn't understand this :

IanM Ambient typing indicators — now on the tag list too

IanM Realtime gains an ambient "someone's typing here" indicator on the discussion list

I don't see anything ?

SpikeNit

Wlork I saw someone typing here, while you were typing your post. I think it said, "Anonymous is typing" or similar.

IanM

Wlork

On desktop, the tags list shows typing indicators when someone is typing. In this example from discuss, people are typing in discussions in bothMeta andExtensions

On mobile, this is within the header dropdown

DLBB

IanM Yep! These are the complete commands i first run.

composer update -W --prefer-dist --no-dev -a
composer require flarum/audit:"*"
php flarum migrate
php flarum assets:publish
php flarum cache:clear

Rerun php flarum migrate now and still the same.

IanM

SpikeNit Monitoring site showed an error "503 Service Unavailable" during update.

Yes, this is a new change in rc.4 - see flarum/framework4720

SpikeNit

IanM yup....just was confirming it worked as expected.

navindra

Yay! It's happening! 🎉

📦 Flarum-In-A-Box has been updated to Flarum 2.0.0-rc.4 now with Flarum Audit installed and enabled by default.

SpikeNit

navindra With my update, Flarum Audit was not installed. I had to go to extension area and download it, via extension manager method.

Wlork

IanM On desktop, the tags list shows typing indicators when someone is typing. In this example from discuss, people are typing in discussions in bothMeta andResources

On mobile, this is within the header dropdown

Ho 😮 It's great, thank you ! I will test that 😁

luceos

IanM I just saw the animating tripple dots in the discussion index. What a fantastic addition 👏

IanM

luceos there's a few "easter eggs" to find actually 😉

No cheating, can you find them all? 😛

navindra

luceos +1 I've always considered realtime to be overkill for my uses, but I have to admit that animation looks nice.

luceos

IanM No cheating, can you find them all?

Now you've done it! 👀

navindra I feel it was already pretty interesting honestly, and I must confess I had more plans with it than I was able to implement. So I'm very excited to see feature development in this extension happen out of the blue 😍

Stezkoy

IanM I had a similar problem, I had to disable GeoIP 2.0.0-beta.9 to get Audit to work.

IanM

Stezkoy very odd.... I've ran this upgrade on 7 forums in the last few days, and not encountered this at all. Need more information/investigation here