News
2024 Update - Site Sunset
I will soon lock down the b2evolution.net site. It will become read only and neither you nor me will be able to post new content to it.
- I will keep the read-only site up for reference for as long as practical. I might convert it to all static pages at some point (and still retain the content).
- I will post future updates on stateoftheevolution.com.
- You may continue to discuss issues on GitHub.
Original post blogged on b2evolution.
Drupal 11.4.0 is now available
The fourth feature release of Drupal 11 is another performance breakthrough. Using only a third of the database and cache lookups compared to Drupal 11.0 and 10.6 for the same requests. It also comes with 15-25% better compression of JS and CSS, much faster translation file handling, a new native command line interface, improved password hashing and a lot more.
New in Drupal 11.4
Biggest performance improvement of the decade (again!)
With Drupal 11.3, we announced that it was the biggest performance improvement of the decade. Drupal 11.4 is arguably the biggest performance improvement of the decade again!
Drupal 11.4 reduces database queries by half compared to 11.3 across a wide range of requests due to optimizations in how entity fields are loaded.
Now, on a completely cold cache, Drupal 11.4 will execute just over 1/3rd of the database and cache lookups compared to Drupal 11.0 or 10.6, representing hundreds of milliseconds saved.
As well as entity loading, entity listing queries have also been significantly improved via reducing the number of table joins, leading to fewer slow queries. This should particularly benefit sites using JSON:API.
To reduce the cost of rendering menus and improve render cache hit rates, menu blocks now have a configuration option to not generate CSS classes for ancestor menu links.
Applying recipes, such as setting up Drupal CMS is twice as fast
We have made recipe-based site installation twice as fast. This significantly improves the UX of installing Drupal CMS and other site recipes. Installing individual recipes is also markedly faster.
Translation file handling: dramatically faster with a modern API
Importing translations during the installer or during site operation is now much faster. On a test site with 66 projects and 38 languages, checking for translation updates was 87% faster on Drupal 11.4 compared to 11.3.
The APIs handling translation files and import have undergone an extensive modernization effort. All .inc files and several important APIs in locale.module have been deprecated and updated to OOP with special attention paid to performance and organization.
15-25% better compression of JS and CSS
Drupal now supports Brotli compression for aggregated CSS and JavaScript files in addition to the existing gzip compression. Brotli typically provides 15-25% better compression ratios than gzip, resulting in faster page loads for browsers that support it. The feature relies on the PHP Brotli extension: ext-brotli.
Immediate security updates of key dependencies allowed in core-recommended
The drupal/core-recommended package no longer pins minor versions for dependencies like Guzzle, Twig, and Symfony Polyfills. In the past, stricter version rules and Composer 2.9's blocking behaviour forced sites to wait for a new Drupal release to get important security fixes. Now, you can install these security fixes immediately. Since the updated dependencies at that time may not have been tested with Drupal core yet, site owners should ensure adequate quality assurance occurs before deploying to production.
New experimental extensible native command line interface
A new extensible ./vendor/bin/dr command line interface was added. While Drupal already includes a CLI script with hardcoded commands, it is not extensible. This new interface was built by a team which included the maintainers of the Drush utility. Drush has been a mainstay for people using Drupal with the command line. Now a transitional period starts as Drush is gradually replaced with the core dr CLI over time. Learn how to make your existing Drush commands compatible.
Simplified and updated default experience
The default installation, the Standard profile, is now leaner. It no longer includes the Article and Page content types, and commenting is disabled by default. Further core startup simplifications are planned for upcoming releases.
The Navigation module is now enabled in the standard administrative interface. The legacy Toolbar module remains available but is scheduled for removal in Drupal 12.
Better entity display management for display builders such as Drupal Canvas
A new overview page has been added under the "Manage display" tab for content entity bundles. Previously, this tab led to the form editing the default view mode. Now, it lists all display modes for the bundle with their label and description and allows one to toggle the enabled/disabled status. The listing makes it easier to integrate tools such as Drupal Canvas.
Distraction-free editing available with CKEditor
Text formats using CKEditor can now be configured to include the FullScreen plugin. This plugin lets users expand the editor to the whole browser viewport, giving more space to comfortably edit content in a distraction-free environment.
Improved password hashing available
The password hashing algorithm is now configurable. The new argon2id option provides much stronger hashing compared to the old bcrypt method. Drupal 12 will default to argon2id, but your site can already start to adopt it. If you update the setting, users' passwords will be rehashed on their next login.
Do more with PHP attributes
You can now use attributes on your controllers to specify the routes the controller is used for. Any class in a module's Controller namespace (for example, Drupal\example\Controller) that have the Symfony\Component\Routing\Attribute\Route attribute will be picked up as route definitions. Even multiple routes can be defined on one class. This supplements the existing .routing.yml based declarations.
It is now possible to use the Drupal\Core\Entity\Attribute\Bundle attribute to define bundle classes, when in need of specific logic for an entity subtype. This previously required an entity_type_info or entity_type_info_alter implementation.
No more .theme files, only a few .module files left
All .theme and .theme-settings.php files in core have moved to PHP classes. Support for .theme files is still planned to be retained in Drupal 12 to ease the transition, but will be removed in Drupal 13.
Most .module files have been converted too: 32 modules are fully converted to PHP classes, with 11 modules remaining (4 of which are deprecated for removal in Drupal 12).
A team of 26 key contributors worked on 57 issues since January 2026 to get here, making Drupal's code more consistent. Also thanks to the dozens of users that worked on the many decades old issues that this initiative built upon.
Front controllers now utilize symfony/runtime
Drupal now integrates the Symfony Runtime component to separate bootstrapping logic from request handling. This provides a clear separation of concerns between preparing the environment (runtime) and handling a request, which will also later enable better integration with FrankenPHP.
Write faster tests with new helper method
A new trait for kernel tests, HttpKernelUiHelperTrait, allows kernel tests to make HTTP requests to the test site and make assertions against the returned content. This has the potential for many browser tests to be converted to kernel tests, which are much faster to run because unlike browser tests, they don't fully set up a test site by running the Drupal installer.
New experimental administrative theme
The Gin administrative theme has been added to Drupal core as the "Default Admin" experimental theme. The theme includes a new dark mode option.
While it is not yet actually the default admin theme, when it becomes stable it will replace Claro as the look of Drupal's backend. We encourage module maintainers to test their module's UIs and provide feedback!
Core maintainer team updates
Since Drupal 11.3 Andrei Mateescu was appointed as a provisional general core committer and is now a Content Moderation and the Workflows module maintainer too. Also Edward Wu was appointed as provisional release manager.
Various wonderful contributors also took our call for subsystem maintainership:
- Moshe Weitzman is now a maintainer of the core CLI
- Derek Wright stepped up to be a Content Moderation and core CLI maintainer
- Kent Richards is a new accessibility maintainer
- Max Pogonowski was added as a maintainer for Menu UI and the token system
- Jürgen Haas and Sascha Eggenberger are maintainers of the new Default Admin theme
- Chris Weber was added as a maintainer for Settings Tray
- Stephen Mustgrave stepped up to maintain the Options module and Menu UI
- Lucas Hedding is now a maintainer for the Image module and the Authentication and Authorization subsystem
- Christian López Espínola is a new maintainer to the Language and Content Translation modules
We also thank maintainers that stepped down in this period:
- Heather Brooke Drummond stepped down from their maintainer role on Breakpoint and Responsive Image modules
- Brian Gilbert stepped down from his core mentoring role
- Wim Leers stepped down from being maintainer of Drupal's CKEditor integration, Editor module, JSON:API module and REST module
- Gareth Goodwin stepped down from maintaining the Umami demo
Want to get involved?
If you are looking to make the leap from Drupal user to Drupal contributor, or you want to share resources with your team as part of their professional development, there are many opportunities to deepen your Drupal skill set and give back to the community. Check out the Drupal contributor guide.
You would be more than welcome to join us at DrupalCon Rotterdam in September 2026 to attend sessions, network, and enjoy mentorship for your first contributions.
Drupal 12 is coming the week of December 7, 2026
Drupal 12 will be released with the upcoming Drupal 11.5 at the beginning of December this year. Drupal 11.5 will be a Long Term Support release with version 11 support expected until the end of 2028.
e107 v2.3.9 Bootstrap CMS Released
[!CAUTION] v2.3.9 is a maintenance release for sites on v2.3.8 or earlier. Upgrade from any 2.x at or below v2.3.8. If your site tracks the
masterbranch, you are already past v2.3.9, so installing it would be a downgrade. v2.4.x is planned to be the next forward step.[!NOTE] There are no security fixes in this release. If your site is still on v2.3.7 or earlier, the release you need urgently is v2.3.8, which closed an unauthenticated SQL injection and two further advisories. v2.3.9 carries all of that forward and adds bug fixes on top.
Highlights
- Regression fixed: You can install e107 into any database your server will accept. v2.3.8 turned away database names containing a dot or a space, and said something unrelated when it did, which left some people unable to install at all. (https://github.com/e107inc/e107/discussions/5819)
- Regression fixed: Your dashboard will tell you about updates again. Debug code left switched on had silenced the update notice for everyone, whatever version they were running. (https://github.com/e107inc/e107/pull/5839)
- No more broken placeholder images. e107 borrowed them from an outside service that has since shut down. It now draws its own, on your own server. (https://github.com/e107inc/e107/issues/5581)
- Members-only pages no longer send visitors round in circles. On some sites a guest was bounced between the login page and the members-only page until the browser gave up. (https://github.com/e107inc/e107/issues/5335)
- Database backups finish on modern PHP. A single empty file inside an archive used to stop the whole backup part-way through. (https://github.com/e107inc/e107/issues/5208)
- Media Manager search finds what you are looking for. Searching for "orchidea" now finds "Orchidea", in every alphabet, not just in English. (https://github.com/e107inc/e107/discussions/5791)
- Adding an FAQ works again. The form was saving its answers into the wrong columns, or refusing to save at all. (https://github.com/e107inc/e107/pull/5839)
For Administrators
Fixed
- Installer: valid database names were rejected. v2.3.8 allow-listed the database name to
A-Za-z0-9_-. MySQL and MariaDB permit periods, spaces, dollar signs and Unicode in database names, verified on MariaDB 10.11 and MySQL 8.0, so an existing database named, for example,e107_2.3.8could not be used at all. The restriction protected nothing, because whoever fills in that form already holds the database credentials, and the name only ever reaches SQL inside backticks. It is now escaped there instead. The table prefix keeps itsA-Za-z0-9_rule, because the prefix really is dropped into queries unquoted. (https://github.com/e107inc/e107/discussions/5819) - Installer: the wrong error message on two failure paths. A rejected database name and a database server below the minimum version both showed "A database name or prefix beginning with some digits followed by 'e' or 'E' is not acceptable", which described neither problem. Each failure now states the rule it actually broke, and a too-old MySQL server is named as such. (https://github.com/e107inc/e107/discussions/5819)
- The core-update notice never appeared on the dashboard. Two leftover debug lines pinned the cached result to a fixed value and returned early, so the notice was dead for everyone. It now checks for an update when the cache is cold, stores the answer for an hour, and renders the notice. The separate scheduled update e-mail is unchanged, and the dashboard deliberately does not send it. (https://github.com/e107inc/e107/pull/5839)
- Broken placeholder images across a fresh install.
via.placeholder.comhas gone; the domain no longer completes a TLS handshake.thumb.phpused to redirect missing-image requests there, the hero plugin's three sample slides embedded its URLs directly, and the media handler had a special case for the domain name.thumb.phpnow serves a small SVG placeholder it generates itself, with cache headers, in about two microseconds; the hero slides ship as local SVG files; and image detection now ignores the query string, so existing database content still pointing at the dead service is classified correctly instead of by domain name. (https://github.com/e107inc/e107/issues/5581) - "Too many redirects" on members-only pages. The members-only redirect always sent visitors to
login.php, ignoring acustomlogin.phpif the site had one, and the login page could only render in its bare iframe form. Worse, with registration disabled and no social login, the stock login page turns a guest away and bounces them back to the page they came from, looping until the browser aborts. e107 now redirects to whichever login page the site is configured to use, and falls back to the members-only notice in exactly that dead-end case, so the loop cannot form. (https://github.com/e107inc/e107/issues/5335) - Backup failed on PHP 8.2+ when an archive held a zero-byte file. Reading zero bytes from a file is an error on modern PHP, and the backup routine did it unconditionally while compressing in memory, ending the backup with a fatal error. Zero-length files are now written as empty entries. (https://github.com/e107inc/e107/issues/5208)
- Adding an FAQ inserted the wrong data, or nothing at all. The insert supplied eight values positionally for a ten-column table. On a server in strict mode that is MySQL error 1136 and the FAQ is not saved; otherwise the values shift left and the display order ends up stored as the author's IP address. The insert now names every column, matching the rest of the plugin. (https://github.com/e107inc/e107/pull/5839)
- Duplicated entries in the administration menu. When two entries in a sorted category shared the same display name, the menu builder re-added every matching entry once per match, so two entries sharing a name produced four rows, three produced nine, and so on. Each entry now renders exactly once. (https://github.com/e107inc/e107/issues/5786)
- Media Manager search missed results that clearly matched. The image, icon, audio, video and general media pickers filtered their results with a case-sensitive comparison, so searching for "orchidea" did not find "Orchidea" even though the database query had already matched it. Searching is now case-insensitive, and it folds case correctly for accented Latin, Cyrillic, Greek and Turkish titles too, not only for A to Z. (https://github.com/e107inc/e107/discussions/5791)
- Wrong text on the upload page. Two core language files each defined the same constant with different wording, so the upload page showed whichever one happened to load first. The stray duplicate is gone and the upload page has its own string. (https://github.com/e107inc/e107/issues/5730)
Changed
- The gallery's prettyPhoto share buttons are gone. The default template put a
http://twitter.com/sharelink and a Facebook "like" frame into every gallery overlay. The insecure addresses were blocked as mixed content on any HTTPS site, and the Facebook frame never received the right address anyway, so what remained was broken markup on every image. The default is now empty. A theme that defines its own share template still overrides it and is unaffected. (https://github.com/e107inc/e107/discussions/5651) - Security reporting instructions live in one place. The
SECURITY.mdfile at the top of the repository still pointed reporters at an e-mail address that does not reliably deliver. GitHub serves the policy from.github/SECURITY.md, which asks for private reports through GitHub Security Advisories, so the stale copy has been removed. To report a vulnerability in e107, use Security Advisories. (https://github.com/e107inc/e107/pull/5822)
For Developers
Added
- The reworked
e107-testsharness, backported frommaster.release/v2.3.xcan now run its own PHP matrix locally, including the 5.6 and 7.0 legs whose end-of-life Debian bases previously could not build a container at all. State moves out of per-worktreedocker/.envs/files into Docker labels and per-environment named vendor volumes, solistis global,gcreaps orphans, and the repository'scomposer.lockis never rewritten (composer install, with a loud per-environmentcomposer updatefallback when the interpreter cannot satisfy the lock). Adapted for this branch: no Selenium service,DEFAULT_PHP=8.2, acceptance browseshttp://localhost/from inside the web container, and Codeception stays at 4.2.2. Validated on 5.6, 7.0, 7.4, 8.1 and 8.2. (https://github.com/e107inc/e107/pull/5837, https://github.com/e107inc/e107/pull/5836) - Offline coverage for the library manager.
testCdnUrlContainsVersionasserts each CDN version appears in its resolved URL, andtestCdnFileReportsHardcodedVersionexercises every entry's ownversion_argumentspattern against real bytes vendored undertests/_data/library_headers/.testRefreshCdnFixturesregenerates those fixtures from the live CDNs and is the one Internet-touching path, skipped unlessE107_REFRESH_LIBRARY_FIXTURESis set. (https://github.com/e107inc/e107/issues/4560)
Changed
- Installer name handling: escape, do not restrict.
check_name()'s non-strict mode (the database name) no longer imposes a character-set rule; strict mode (the table prefix) keepsA-Za-z0-9_, because the prefix is interpolated unquoted into every query. A newquoteDbName()doubles backticks and wraps the name, and the threeCREATE/ALTER/DROP DATABASEsites use it.e_db_pdo::database()ande_db_mysql::database()double backticks in their quoted interpolations;mysqli_select_db()needs nothing. The legacy quote and semicolon guard stays, because a semicolon cannot be represented in the PDO DSN.SqlInjectionFixesTestpins the new contract, including a backtick-doubling breakout guard. New stringsLANINS_148,LANINS_149andLANINS_150replace the misusedLANINS_105. (https://github.com/e107inc/e107/discussions/5819) - Themes can opt out of the bare login page.
login.phpforcede_IFRAMEunconditionally. It now defers to thelogincore template, so setting$LOGIN_TEMPLATE['page']['noiframe'] = truein a theme override renders the login page with the full site chrome. The default is unchanged. The members-only redirect target also respectse_LOGINnow rather than hardcodinglogin.php. (https://github.com/e107inc/e107/issues/5335) LAN_418inlan_upload.phpis nowLAN_UL_041.LAN_407andLAN_418were each defined with different values in two core language packs, so load order decided which text won. The unusedLAN_407blurb has been dropped fromlan_signup.php(the signup e-mail composes fromLAN_EMAIL_04/05/06), andlan_upload.php's "Absolute maximum file size: " is renamed toLAN_UL_041, withupload.phprepointed.lan_search.phpkeeps sole ownership ofLAN_418. Translators and language-pack maintainers: addLAN_UL_041to yourlan_upload.php; the oldLAN_418definition there is no longer read. (https://github.com/e107inc/e107/issues/5730)sc_cb_avatar()honours$parm. The chatbox avatar shortcode hardcodedcrop => 'C'and rebuilt its own options array, discarding anycrop,worha template passed in, which pinned chatbox avatars to the legacythumb.phpquery-string URL while sibling avatar shortcodes forwarded$parmand reached SEF addresses.$parmis now merged over the defaults.'C'remains the default crop, so existing rendering is unchanged, but a template can passcrop=falseto escape to a SEF-eligible URL wherethumb.phpis broken on the host. (https://github.com/e107inc/e107/issues/5657)e_library_managertakes an injectable file handler. It defaults toe107::getFile(), anddetectPath()andgetVersion()read through it, so a test can stub every remote read._before()injects a handler that throws on any fetch, so an accidental network read now fails loudly rather than quietly downloading.testDetectionVersionConsistencycompares each CDN pin against its bundled local sibling offline, which catches drift between the shipped copy and the hard-coded version, andtestCoreLibraryPresencehas dropped its remote URL probe. Thecdn.jquery.oncepin is corrected: it claimed 2.1.2 while the bundled copy ships 2.2.3, and the legacy jsDelivr path it used does not serve 2.2.3 at all, so it is repointed at the npm path. (https://github.com/e107inc/e107/issues/4560)e_parse::toAvatar()fetches through thee107::getFile()singleton. Its base64 data-URI branch fetched a real avatar over the network at test time, so any DNS or network hiccup silently fell through to the plain remote- Releases are built and published from GitHub Actions.
build-release.ymlis replaced byrelease.yml. The build step is unchanged in substance, but the workflow now finishes the job instead of stopping at a workflow artifact: it uploads the archives andcore_image.pharto the GitHub Release, then uploads the nine archives to SourceForge over SFTP with a pinned host key and sets the per-platform default downloads. A guard asserts the full tag history was fetched before the core integrity image is built, and a build whose tag does not match the version it produced refuses to upload. (https://github.com/e107inc/e107/pull/5831)
Fixed
e_navigation::admin()cross-join. The sorted branch built a list of every entry's display text and then, for each text, re-appended every entry matching it, emitting K entries K times each for a same-named group. The text list is now deduplicated before the cross-join. (https://github.com/e107inc/e107/issues/5786)pclzipreading zero bytes.fread($h, 0)throws aValueErroron PHP 8.2+, so an archive containing a zero-byte file fatally errored during in-memory compression. The read is guarded, and the file is still written as a zero-byte entry. (https://github.com/e107inc/e107/issues/5208)- Multibyte-safe media search.
stripos()folds case for ASCII only, so a title differing in case on a non-ASCII letter could be dropped by the PHP post-filter even though the case-insensitive database collation had matched it. The five title filters now use the parser'sustrpos()andustrtolower(), which usembstringwhen it is present and fall back to the byte functions when it is not, so there is no new hard dependency. (https://github.com/e107inc/e107/discussions/5791)
Acknowledgements
Thanks to
- @Jimmi08 for reporting the members-only redirect loop (#5335), the duplicated administration menu entries (#5786) and the PHP 8.2 backup failure (#5208); to
- @kreossino for the case-sensitive Media Manager search (discussion #5791) and the broken gallery share template (discussion #5651); to
- @Kanonimpresor for the installation failure that surfaced the database-name regression (discussion #5819); to
- @tgtje for the language-constant collision report (#5730); and to
- @sindizzy, @tgtje and @Taffman, whose thread in #5581 traced the broken images on fresh installs to the shut-down placeholder service.
Full changelog: https://github.com/e107inc/e107/compare/v2.3.8...v2.3.9
Posted July 24, 2026 | 4:24 pm
🧠 Boost Your Geeklog SEO with AI-Generated Meta Tags
Automatically create meta descriptions, keywords, and SEO titles for your articlesIn modern SEO, small details often make a big difference. Meta tags such as meta_description, meta_keywords, and page_title still play an essential role in how your content is displayed and understood by search engines. They directly influence how your stories appear in results, and therefore how often users click them.
I’ve recently built a simple, lightweight utility that helps Geeklog site administrators automatically generate these fields using OpenAI’s API. It works with any Geeklog 2.x site and doesn’t require additional plugins or modifications.
⚙️ Simple, fast, and content-friendly automation
The Geeklog AI SEO Updater connects directly to the Geeklog database and detects any stories missing a meta_description. For each one, it uses the gpt-4o-mini model to analyze the article’s title and introduction, then generates:
- a short optimized meta description (≤ 155 characters),
- a list of relevant meta keywords (5–10 per story),
- and a SEO-friendly page title (≤ 65 characters).
The script automatically detects the language of your site from $_CONF['language'] — it works in French, English, German, Spanish, Italian, and Japanese. You can test results safely in preview mode (?dry=1) or apply them in update mode with a defined article limit.
🔍 Why meta tags still matter
While modern search engines rely on full-page analysis, meta descriptions remain key to how your site looks in results. They act as your article’s “headline” on Google or Bing and have a strong effect on click-through rate.
Meta keywords, even though no longer used by Google for ranking, remain valuable inside Geeklog. They can be used for internal linking or automated features such as:
- a related stories system that connects articles with similar topics,
- a tag cloud for quick exploration,
- or a contextual search module based on shared keywords.
💡 For example, another script could automatically link stories that share two or more identical keywords, creating a stronger internal SEO structure.
🚀 Benefits for site administrators
- Save hours updating metadata across hundreds of stories.
- Keep consistent SEO formatting site-wide.
- Improve visibility and click performance in search results.
- Optionally notify Bing through the IndexNow plugin after each update.
The script only updates stories with empty meta descriptions and checks that you have the proper story.edit admin rights before execution.
🧩 Example usage
# Preview mode (no database update)
https://yourdomain.com/admin/utils/update_meta.php?dry=1
# Update 10 stories
https://yourdomain.com/admin/utils/update_meta.php?limit=10
You can also schedule it as a weekly cron job to automatically optimize metadata for newly published stories.
💡 A foundation for smarter features
This script lays the groundwork for more semantic features inside Geeklog. The generated keywords can later feed new modules such as:
- AI-related stories based on keyword similarity,
- smart internal linking or tag clusters,
- or even advanced search filtering.
By combining Geeklog’s simplicity with AI-assisted metadata, content becomes easier to navigate and better structured for both users and search engines.
📦 Availability
The full documented code is available on the Geeklog Community Forum: 👉 https://www.geeklog.net/forum/index.php?forum=10
It supports PHP 5.6 +, Geeklog 2.x, and optionally integrates with the IndexNow plugin to notify Bing. Every line of the shared version is commented for easy understanding and adaptation.
🧭 Final thoughts
With this AI-powered updater, Geeklog proves it can stay modern and efficient without losing its core simplicity. This approach helps keep older content relevant, visible, and better connected — with minimal effort and full control from the admin panel.
🧩 Author: Ben, Geeklog community contributor Discuss and download on the forum: https://www.geeklog.net/forum/index.php?forum=10
Posted October 28, 2025 | 7:41 pmphpBB 3.3.15 Release - Please update
Greetings everyone,We are pleased to announce the release of phpBB 3.3.15 “In Memory of Mark D. Hamill”. This version is a maintenance and security release of the 3.3.x branch which fixes one security issue, introduces a number of improvements aimed at enhancing the user experience and overall stability of the software and resolves some issues noticed in previous releases.
Since the introduction of phpBB 3.1, phpBB has been using JavaScript and jQuery to improve the responsiveness of prosilver. We did receive a report about a potentially dangerous code in this section. After an internal audit of this and related code, we noticed that some of the handling of data added by an admin is potentially insecure and could lead to cross site scripting.
The improvements include better handling of HTTPS connections in the version check since switching to Guzzle in the previous release as well as the introduction of proper support for TLS v1.3 with SMTP servers.
Notable bug fixes in this release include resolving an issue that resulted in PHP fatal errors when converting from phpBB 2 with Attachment MOD and issues with the pagination resulting in incorrect ordering when searching for users posts. Furthermore, an issue with duplicate users being displayed on the memberlist while sorting and a potential overflow of the topic views count have been addressed.
The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16790
The packages can be downloaded from our downloads page.
The development team thanks everyone who contributed code to this release: rxu, Kailey M Snay, Alexey Dolzhenko, Neo-CTC, NeoDev, battye, cabot, phpBB TR
If you have any questions or comments, we'll be happy to address them in the discussion topic.
- The phpBB TeamPosted April 2, 2025 | 6:58 am
Re: Ultimate Shoutbox & Chatrooms
It took me a while but I found a solution with a help of Claude.Quote button in shoutbox.js produced curly/smart quotation marks (\u201C / \u201D) instead of plain straight quotes ("). When a message went through parse_bbc() for the first time, SMF n...Posted July 29, 2026 | 2:35 am