Stream Engine 0.7.0

Added

• Photo albums for personal blogs and communities, with bulk uploads, editing,
  comments, ratings and a configurable showcase with rankings. Includes
  accessibility tests for both themes, light/dark modes and RTL.
• Album covers, drag-and-drop ordering, moving photos between albums in the
  same context, bulk deletion, and keyboard-accessible photo viewing.
• Protected original and preview images (JPEG, PNG and WebP), configurable
  upload limits, retry-safe publication and cleanup of orphaned photo files.

Changed

• Admin dashboard layouts now use cookies instead of the admin_dashboard_layouts
  table; existing layouts are reset. Dashboard services now live in the Admin module.
• Existing Feed types can no longer be changed through the editor or API.
  Integrations must choose the type when creating content.

Security

• Messenger attachments now use private storage and check conversation access
  before delivery, with shared file delivery.
• Photo pages, comments, rankings and file delivery enforce access to the
  photograph, album and parent blog or community. Photos cannot be self-rated.

Upgrade notes

• From 0.6.2, back up the database and persistent files, deploy the release
  and bundled browser assets, install dependencies from the lockfiles, and run
  composer migrate. The new migration
  20261113000000_drop_admin_dashboard_layouts removes the obsolete dashboard
  table; dashboard arrangements must be configured again.
• The fresh-install schema.sql and manifest.json are regenerated for 0.7.0.
  Galleries reuse the existing Feed, metadata and upload tables. Use migrations
  for existing sites; do not import the snapshot over an existing database.
• Deploy the Nginx internal /protected-uploads/ location from
  docker/nginx/default.conf. Its alias must match UPLOADS_DIR plus
  -private (by default storage/uploads-private/). Make this directory
  writable by PHP and include it in backups; private file delivery requires
  Nginx support for X-Accel-Redirect.
• Existing messenger attachments are not automatically moved from public
  storage or assigned the new message-attachment purpose. Their old public
  URLs remain accessible, while the new conversation attachment endpoint
  rejects them. Plan a separate file/data migration before upgrading a site
  that needs to preserve attachment access; this release does not retroactively
  protect previously uploaded files.
• Database rollback requires the matching backup; down migrations are not
  provided. The reviewed low-severity Chonky/deepmerge advisory remains
  documented in SECURITY.md.

Installation assets

• schema.sql and manifest.json are a matching pair for fresh installations.
• Existing installations must run composer migrate; do not import the schema snapshot.

Full changelog: v0.6.2...v0.7.0

Stream Engine 0.6.2

Changed

• Updated frontend dependencies, including React, React Router, Vite,
  Playwright, axe-core, Chonky and icon libraries. Rebuilt production assets
  and refreshed the third-party license report.
• Updated PHP dependencies: phpdotenv, crawler-detect, PHPUnit and Symfony
  polyfills.
• Updated the GitHub Actions SARIF uploader used by Semgrep.

Fixed

• Theme selection cards and the file browser's new-folder button now expose
  accessible names that include their visible labels.

Upgrade notes

• From 0.6.1, install dependencies from the updated Composer lockfile and deploy
  the bundled browser assets. No new database migrations or schema changes
  are required. The installation manifest is refreshed for release 0.6.2.
• The existing Chonky/deepmerge low-severity advisory remains covered by the
  reviewed mitigation in SECURITY.md; this release does not claim an upstream
  fix.

Full changelog: v0.6.1...v0.6.2

Stream Engine 0.6.1

Added

• Added articles.list-id, articles.list-slug, articles.index and articles.by-term page actions; list page size is configurable and related articles are opt-in.
• Audio uploads store title and artist tags; the player and its accessible label
  use them, falling back to the post title and filename.

Fixed

• Module discovery no longer loads global vendor classes that can terminate PHP.

Security

• Rate-limited login and password recovery; password resets are atomic and
  invalidate existing sessions.
• Enforced parent-content access for comments, disabled caching of private
  responses, and restricted CSS in user-authored content.
• Hardened upload response headers and documented secret-URL access for private
  attachments; verified isolation of file-browser data from vulnerable theme merges.

Upgrade notes

• Back up the database and persistent files, install dependencies from the
  lockfiles, and run composer migrate. This release includes
  20261101000000_rename_articles_list_action,
  20261102000000_add_auth_rate_limits, and
  20261108000000_add_upload_audio_tags.
• Stored articles.list actions are migrated to articles.list-slug; update
  module definitions that still use the old action name.
• The fresh-install schema and manifest are regenerated for 0.6.1. Use
  migrations for existing installations; do not import schema.sql over them.
• Deploy the bundled rebuilt browser assets and updated Nginx configuration
  for hardened upload response headers. Private attachments use secret URLs;
  see SECURITY.md for the access model and its limits.
• Dependency audit: the Chonky/deepmerge chain retains three low-severity
  advisory entries with no upstream fix. File-browser data is isolated from
  vulnerable theme merges; the reviewed mitigation is documented in SECURITY.md.
• Database rollback requires restoring the matching backup; down migrations
  are not provided.

Full changelog: v0.6.0...v0.6.1

Stream Engine 0.6.0

Added

• MySQL 8.4 LTS or newer is supported alongside MariaDB 10.10 or newer; the installer and migrations adapt the schema to the server. Moving a site between the two is not supported.
• Feed editor: a Metadata section for name/value pairs. Page editor: a feed picker with search and in-place feed creation.
• “Show password” buttons on password fields; password reset asks for the new password once.
• Comment author names link to the author's profile.
• An “Accessibility problem” issue form linked from the accessibility statement.

Changed

• The administration API checks the complete page tree the next boot will load (persisted pages, module runtime pages, api/admin paths) before saving a page, and rejects duplicate patterns, ambiguous dynamic siblings and duplicate singleton actions instead of letting the site fail to start.
• WCAG 2.2 AA conformance: screen-reader names and announcements, keyboard access (including the Trix toolbar and administration selects), focus handling, contrast, target sizes and 320 px layouts across both themes and the administration panel. See the accessibility audit.
• Forms state their rules up front, and error messages in every locale name the limit or the fix. Site notifications stay longer and pause on hover or focus; errors stay until closed.
• Global moderators can read, edit and delete all content regardless of visibility, like administrators, but still have no access to Administration, uploads or private messages.
• A feed can be bound to only one page; existing duplicates stay saveable until their feed is changed.
• Plurals follow CLDR via ICU on server and browser; catalog plurals are keyed by category. Formatter::plural() is deprecated in favour of transChoice().
• The rich-text heading button writes <h2> instead of <h1>.

Removed

• Unused profile “avatars” tab templates in both themes.

Fixed

• Profile → Email and password saved nothing; it now works through POST /api/v1/my/security with email confirmation (migration 20261016000000_add_email_verification_new_email).
• The navigation burger is no longer shown when the top menu is empty.
• Translation gaps (Scheduler screen, Russian errors) and plural forms in English, Arabic and Russian.
• Smaller fixes: default avatars on comments, profile save without a picture, restored trix.css and custom-content.css build outputs, forum post anchors and layout glitches.

Security

• All responses send X-Content-Type-Options: nosniff. Existing Nginx installations should add add_header X-Content-Type-Options nosniff always; to their /uploads/ and / locations.

Full changelog: v0.5.1...v0.6.0

Stream Engine 0.5.1

Highlights

Stream Engine 0.5.1 fixes an application bootstrap failure on installations
that use the same reusable page action for more than one concrete page.

Fixed-content actions such as article.show-id may now correctly back
multiple routes with different Feed IDs, while actions explicitly declared as
singletons remain protected from duplicate definitions.

Fixed

• Application bootstrap no longer rejects multiple pages that intentionally
  share a non-singleton action.
• Singleton action validation now follows each module's normalized page-action
  contract instead of treating every action name as globally unique.
• Added regression coverage for multiple article.show-id pages with distinct
  Feed IDs and for duplicate singleton rejection.
• Corrected administrator and developer routing documentation to distinguish
  reusable page actions from singleton actions.

Upgrade notes

No database migration is required for this patch release. Existing page rows
do not need to be changed or removed.

Update the package normally:

composer update

Stream Engine 0.5.0

Highlights

Stream Engine 0.5.0 moves fixed internal module routes out of the database and into module-owned runtime page trees. Administrators now configure only public mount pages, while modules own and validate their internal routing structure.

This release also introduces unique 24-hour feed view counting, stable cursor pagination for growing feeds, and stricter TypeScript validation.

Changed

Module-owned runtime pages

• Forum, personal-blog, and community internal routes are now registered in memory beneath their public mount pages.
• The Pages editor exposes only routes that administrators may genuinely create or configure.
• Moving or removing a public mount page automatically moves or removes its runtime subtree on the next request.
• Runtime routes define access rules, indexing behavior, feed metadata, settings, and localized breadcrumb names in module code.
• Runtime page hierarchies and route conflicts are validated during application boot.
• Internal URLs are resolved and generated through the shared PageTree.
• Fresh installations persist only public mount pages.
• The upgrade migration removes the legacy internal page rows.

Feed views

• Feed views are counted at most once per member or guest within a 24-hour window.
• Known crawlers no longer increase view counters.
• View counting remains independent from read/unread state.

Pagination

• Profile, community, and tag-filtered post feeds now use stable (created_at, id) cursor pagination instead of offsets.
• New content no longer causes duplicate or skipped entries while an existing feed is being paginated.

Development

• TypeScript checking now runs in strict mode across browser sources, JavaScript tests, and Vite/Vitest configuration.

Upgrade notes

Update the package and apply the new database migrations:

composer update
composer migrate

Stream Engine 0.4.6

Highlights

Stream Engine 0.4.6 improves forum conversations, moderation, statistics, and
presence, and adds a production-ready scheduler to the Docker Compose setup.

Forum conversations

• Write rich-text quick replies with an inline preview and safely escaped quote
  insertion.
• Edit or delete your own replies with explicit controls and confirmation.
• Use reliable @mention autocomplete in forum editors; mentions now stay in
  sync after topic edits, including profile links in paginated replies.
• Rate individual topic posts and replies, with each post retaining its own
  score and vote state.

Forum statistics and presence

• Topic lists now show real post and distinct-participant totals instead of
  placeholders.
• Topic pages display participant avatars, overflow counts, and per-author
  forum post totals.
• Forum sections now show the same live member, guest, and bot presence summary
  as the forum index, with a capped member-name list.

Topic lifecycle and uploads

• Topic authors can delete a topic during its first 24 hours when it has no
  replies; concurrent replies are protected from accidental deletion.
• Unattached forum attachment-card uploads are collected hourly after 24 hours,
  with reservation and race-safe rechecks.

Docker scheduler

• Docker Compose now runs bin/cron.php once per minute through Supercronic,
  using the shared application image.
• Docker configuration files are grouped under docker/ for a clearer layout.

Fixes

• Constrained default-theme forum pages to the standard content width.
• Restored visible Trix toolbar icons in light mode.

Upgrade notes

This release contains one database migration for upload-purpose tracking. After
updating the application, run:

composer migrate

The release includes rebuilt production assets and an updated installation
schema snapshot for clean installations.

Full changelog: v0.4.5...v0.4.6

Stream Engine 0.4.5

Highlights

Stream Engine 0.4.5 expands site branding, registration controls, mentions,
and privacy options for personal blogs.

Site branding

• Upload, replace, or remove a responsive header logo from the administration
  settings. The site name remains visible alongside the logo in both bundled
  themes.
• Configure site icons with generated favicon and Apple Touch Icon variants,
  optional SVG support, and one-click restoration of the defaults.

Registration and abuse protection

• Choose between closed registration, email-confirmed accounts, and accounts
  activated immediately after registration.
• Configure a registration honeypot and optional Turnstile or hCaptcha
  verification.
• Automatically remove registrations that remain unconfirmed for more than
  24 hours.

Mentions and notifications

• Use @username mentions in comments, forum posts, and private messages,
  with autocomplete, escaped profile links, and support for username changes.
• Deliver configurable, deduplicated mention notifications only after access
  checks, with deep links to the referenced content.

Friends-only posts

• Personal blog posts can now be limited to friends. Mutual friend requests
  become memberships, and removing either side immediately revokes access.

Upgrade notes

This release contains two database migrations. After updating the application,
run:

composer migrate

The release includes rebuilt production assets and an updated installation
schema snapshot for clean installations.

Full changelog: v0.4.4...v0.4.5

Stream Engine 0.4.4

Highlights

• Added a full admin file browser for browsing, uploading, creating folders, moving, renaming, copying, and deleting files.
• Added an admin Scheduler with task health, intervals, next runs, durations, heartbeat status, operating modes, per-task controls, manual execution, and bounded run history.
• The Pages list now renders the page tree as an indented hierarchy.

Scheduler and cron

• Cron mode is now stored in application settings and managed from the admin interface instead of through CRON_MODE.
• Task state and individual attempts are separated into cron_tasks and cron_run_history, with clear queued, running, successful, failed, failed-to-start, and timed-out states.
• Removed the legacy CRON_KEY setting and public cron HTTP endpoint. Web mode now starts the internal runner from normal application requests.
• Fixed manual execution under PHP-FPM and made run status, duration, errors, and next-run information update reliably.

Upgrade and release tooling

• Run composer migrate after updating. This release includes five scheduler database migrations.
• composer update now prints a non-blocking warning when database migrations are pending.
• Installation snapshots are built in an automatically created isolated database that is removed after the build.

Full changelog: v0.4.3...v0.4.4

Stream Engine 0.4.3

Highlights

• Modules can now declare validated action-specific select fields stored in page settings. The standard page editor renders and validates them automatically while preserving unrelated settings.
• Root applications can provide themes from their own views/themes directory alongside the built-in engine themes.

Improvements

• New menu items default to the top group. The group field suggests top, bottom, and user while still allowing custom names.
• Menu item ordering is assigned server-side when items are created or moved.
• The page editor now displays structured API validation errors correctly.

Full changelog: v0.4.2...v0.4.3