Changed
- Built the way Flarum's own extensions are, after a review by the Flarum team, since this becomes Flarum's Extension Manager in 2.1:
- The screen uses Flarum's own buttons, alerts and dialogs. Confirmations open a dialog instead of the browser's pop-up, and problems show as Flarum alerts.
- Colours come from your theme throughout, so dark mode and custom themes look right everywhere.
- Errors reach the screen through Flarum's error handling, in your forum's language.
Security
- Downloads only ever use HTTPS, including after a redirect, and a token is only sent to the exact host it belongs to.
auth.json is no longer backed up (its writes are atomic), and old copies are removed. Other backups keep the original file's permissions.- Repository addresses with a username or token in them are never shown back in the browser.
- On hosts that can't run separate processes, updating Flarum itself no longer sends the database credentials over the network. A one-time token is used instead.
Fixed
- The flag that clears PHP's compiled-code cache can no longer get stuck if it was created by root, and checking for it costs one file check per request.
composer update ernestdefoe/millwright
php flarum cache:clear
