Latch v0.5.0.0

Latch v0.5.0.0 — operator security & setup milestone

Secure-by-default operator experience: hardened staff sessions, guided local.php configuration, and first-class support for tier-2 catalog plugins.

Highlights

Security

• Staff session hardening (admin/mod only): IP+UA fingerprint binding, idle timeout (default 30m), step-up TOTP/password for sensitive admin POSTs (/admin/step-up), email alert on new staff device when mail works
• Builds on Security mode (Standard/High) from 0.4.7

Operators

• php bin/latch configure — interactive walkthrough for site URL, encryption key, Turnstile, staff session, OIDC, mail, plugin secrets
  • --show for masked status (safe to paste)
  • --section=turnstile,mail for partial runs
  • Optional prompt after interactive install (--no-configure to skip)
  • RPM: latch-setup prints sudo latch configure (does not auto-run)
• Cloudflare Free / Tunnel / Turnstile: CLOUDFLARE.md

Plugins (catalog)

Use Admin → Plugins → Catalog or Latch-plugins v1.0.13:

• avatar-url 1.0.0 (min Latch 0.4.8)
• board-icon-pack 1.0.0

Install / upgrade

# Tarball
tar -xzf latch-0.5.0.0.tar.gz && cd latch-0.5.0.0-stage
bash scripts/install.sh --url=https://forum.example.com
php bin/latch configure   # recommended after install

# Fedora/RHEL (after COPR rebuild)
sudo dnf upgrade latch
sudo latch configure --show
sudo latch doctor

Deferred (not in 0.5.0)

Docker demo, Packagist, WebAuthn, fediverse-share, phpBB real-dump guide.

Full notes: CHANGELOG.md