Lumora Press v0.15.0 Release Notes

🚀 What's New in v0.15.0

Release Date: September 14, 2026

A Comments-and-cleanup release: Tags gets Trash and theme-customizable archives, Comments gains a full moderation dashboard and a Privacy section (IP anonymization, GDPR export/erasure), a new Lumora Sweep plugin handles database housekeeping, and a real credential-leak security bug in author URLs is fixed.

🔒 Security: Author Slugs No Longer Leak Login Usernames (LP-170)

Posts, Pages, search results, and RSS feeds were all building the public /author/{slug} URL from an author's login username instead of their Display Name — since a username is also valid for logging in, this published half of a working login credential on every page an author had posted to. Author slugs are now built from Display Name, with automatic -2/-3 disambiguation when two authors share one.

🏷️ Tags: Trash & Theme-Customizable Archives (LP-011)

The admin Tags list gained an "All"/"Trash" status-tab pair — deleting a tag now moves it to Trash first (Restore, Delete Permanently, Empty Trash, plus matching bulk actions) instead of removing it immediately, mirroring Categories exactly. A theme can now provide its own tag.php template for tag archives, falling back to the shared archive.php automatically. A post's own tags now also show on homepage/archive listing cards and search results, not just its single page.

💬 Comments: Moderation Dashboard & Privacy Tools (LP-012)

The admin Comments screen gained search, and filter by user/IP/date alongside the existing status filter, plus a new "Statistics" tab (status-count cards, a Comments Over Time chart, Top Commenters, Most Commented posts/pages). An IP Blacklist option on Settings > Discussion marks a comment from a listed address as Spam outright. Notify-on-reply, an "Insert Emoji" button next to every comment/reply textarea, and collapsible long threads (over 10 replies) round out this pass. On the privacy side: commenter IP addresses can now be anonymized before storage, the guest Website field can be turned off entirely, and a new "Comment Data Requests" panel on Settings > Privacy looks up every comment under an email address for JSON export or full erasure.

🧹 New Plugin: Lumora Sweep (LPP-022)

An optional database cleanup utility adding a Sweep tab to Maintenance > Tools — per-category preview counts and one-click Clean Up for excess revisions, old trashed posts/pages, old spam/trashed comments, orphaned/duplicate post_meta rows, and an off-by-default unused categories/tags check, each followed by a table optimization pass.

🔍 "Discover" Buttons for Server Filepath Fields (LP-169)

The WordPress Importer's wp-config.php/uploads-folder/gallery-folder fields, Lumora Gallery Shortcodes' config.php field, and Visitor Stats' GeoIP-file field can now find a candidate path next to this install automatically instead of requiring it to be typed by hand.

🔌 Plugins Screen Polish (LP-171)

The "Install a Plugin" upload form moved to the top of the page, above the Installed Plugins list. Also fixed: a bundled plugin's "Settings" link was unreadable on hover once visited — a CSS specificity collision between the visited-link color and the hover-state color, the same bug class already fixed for the "View" row-action chip elsewhere.

🐛 Also Fixed

The Folder Gallery shortcode's thumbnails no longer upscale (and blur) a source image smaller than 150×150px, and gained a size attribute matching the single Insert Image picker's own Size field. The "Header image height" Theme Option no longer silently overrides a theme's own header height until an administrator explicitly sets it. A tag name longer than 191 characters (or blank) can no longer bypass server-side validation. The Plugins screen's "Cancel" action (discarding a staged plugin ZIP mid-install) now has CSRF protection, closing the only action on that screen without one.

🧪 Quality

The Docker PHP 8.2/8.3/8.4/8.5 + MariaDB matrix (2543 tests, 7775 assertions, 4 pre-existing/unrelated skips) ran clean on all four versions. See docs/CHANGELOG.md for the complete, unabridged list of every change in this release.

Lumora Press v0.14.0 Release Notes

🚀 What's New in v0.14.0

Release Date: September 13, 2026

A workflow-and-editing release: Plugins gets bulk actions and a discoverability boost, Lumora Gallery Shortcodes can now reach more than one Gallery site, the WYSIWYG editor can finally link an image, and a couple of long-standing full-page-reload rough edges got the AJAX-in-place treatment.

🔌 Plugins Screen: Bulk Actions & Settings Links

The bulk-actions bar (previously "Delete" only) now also offers "Activate" and "Deactivate" for any selected mix of plugins in one request — the row checkbox column appears for every plugin now, not just inactive ones (LP-163). Every bundled plugin's row, grid card, and Details panel also now show a "Settings" link (and, where relevant, additional links) pointing straight at that plugin's real admin page — closing a real gap for plugins with no top-level sidebar menu of their own, like Lumora Shield, Font Awesome, Emoji Picker, and Dummy Content (LP-166).

🖼️ Lumora Gallery Shortcodes: Multiple Installations

The Lumora Gallery Shortcodes plugin can now connect to more than one separately-installed Lumora Gallery site at once. Settings lists every configured connection with Edit/Delete/"Make Default" actions, and both [lumora_gallery_album] and [lumora_gallery_newest] gained a gallery="{slug}" attribute to pick which connection to read from (LPP-021). An install with one Gallery connection already configured needs no action at all — it migrates automatically.

🔗 Link an Image in the WYSIWYG Editor

Clicking an image in the WYSIWYG editor (Posts, Pages, Downloads) now shows a small floating "Insert/Edit Link" button right next to it — pick a URL, or search existing Posts/Pages from a live list, the same dialog text already used (LP-168). This also fixed a real bug: the link dialog previously destroyed a selected image outright instead of wrapping it.

⚡ Two Full-Page-Reloads Fixed

The Media Manager's "Import from Server" batch import used to reload the whole admin page for every 10-file batch; it now drives the same fetch()-based continue loop the Updates page's Backups section and Visitor Stats' GeoLite2 import already use (LP-167). PHP 8.5 also joined the supported version range (previously 8.2–8.4).

🗑️ Removed

Two one-time historical data-repair Maintenance › Tools utilities — "Fix Double-Encoded Text" and "Migrate Download Categories" — were already run to completion and are gone entirely, with no ongoing purpose left to serve (LP-164).

🐛 Also Fixed

Downloads' and Lumora Gallery Shortcodes' own Shortcodes reference screens had ragged, unaligned "Attributes" columns — now a real aligned table with styled attribute-name pills. Thumbnail generation and optimization no longer trigger a PHP 8.5 imagedestroy() deprecation warning.

🧪 Quality

The Docker PHP 8.2/8.3/8.4/8.5 + MariaDB matrix (2375 tests, 7398 assertions, 4 pre-existing/unrelated skips) ran clean on all four versions — including, for the first time, an actual build-and-run of the PHP 8.5 Docker service itself (previously verified only via host PHP-CLI). A real PHP 8.5 deprecation surfaced and was fixed: a test helper's now-pointless ReflectionMethod::setAccessible(true) call. See docs/CHANGELOG.md for the complete, unabridged list of every change in this release.

Lumora Press v0.13.0 Release Notes

🚀 What's New in v0.13.0

Release Date: September 11, 2026

A cleanup-and-hardening release: the REST API is gone, a "coming soon" page gets a real gate, image lightboxing gets more reliable and more secure, and the Lumora Gallery shortcodes and admin Tags screen both pick up real features.

🔒 REST API Removed Entirely (LP-155)

The token-authenticated JSON REST API under /api/v1/... and the Settings › API Tokens screen that issued its bearer tokens are both gone — not disabled, not hidden behind a setting, removed completely, along with Settings › General's "REST API" section. An update run drops the now-orphaned api_tokens database table automatically.

🚧 A Real "Coming Soon" Gate (LP-156)

Dropping a static index.html next to index.php in the site root now actually takes over / ahead of the app — before, the app's own rewrite rules always routed / into index.php (or the installer) regardless of index.html's presence. Delete index.html when you're ready to launch; every other URL, including the installer and /admin/, is unaffected the whole time.

🖼️ Lumora Gallery Shortcodes & Lightbox Improvements

Imported or absolute-URL content images (common with imported content, or a hand-typed link to a companion site's own media) now get PhotoSwipe lightbox treatment just like relative-URL images always did — resolved client-side, in the visitor's own browser, so no extra server-side network call is needed on every page view (LP-157). The Lumora Gallery Shortcodes plugin also gained a multi-album [lumora_gallery_album] that combines several albums into one block (LPP-019), and a no_album_info="1" attribute on both shortcodes for a bare row of thumbnails with no title or "View album" link (LPP-020).

🏷️ Tags: Search, Stats, and a Faster Editor (LP-011)

The admin Tags list gained a Search & Filter panel (name/slug, minimum post count, created-date and last-used-date ranges) and a Usage Statistics panel (Most Used, Least Used, unused count, Recently Created, Recently Used), mirroring what Categories already had. The Post editor's tag-input autocomplete is also faster now, and TagService memoizes lookups for the life of a request.

🛡️ Also Hardened

A post/page body containing a ../-style traversal link could make ContentRenderer read a file outside content/uploads purely to report its pixel dimensions for the lightbox — that resolution is now verified against the project root before the file is ever read (LP-158).

🐛 Also Fixed

Auto-generated excerpts (and search snippets, and OG/meta description tags) could run two source paragraphs together with no space and leak a literal >/& instead of a real character (LP-161). A bare /index.php request 404'd instead of showing the homepage (LP-160). The Post/Page HTML editor's toolbar hid buttons — including Insert/Edit Link — behind a "..." overflow menu; it now wraps onto a second row instead (LP-159). Appearance › Themes card buttons and screenshot heights now line up properly across a row instead of drifting with each card's own description length or screenshot size.

🧪 Quality

The Docker PHP 8.2/8.3/8.4 + MariaDB matrix (2364 tests, 7388 assertions, 4 pre-existing/unrelated skips) ran clean on all three versions. See docs/CHANGELOG.md for the complete, unabridged list of every change in this release.

Lumora Press v0.12.0 Release Notes

🚀 What's New in v0.12.0

Release Date: September 9, 2026

Feeds go all the way, Contact Forms picks up its remaining big-ticket items, and the admin sidebar gets a classic-WordPress-style makeover.

📡 RSS, Atom & JSON Feed, Everywhere (LP-013)

Feeds are now first-class across the whole site, not just posts. Tag feeds, author feeds, comment feeds (site-wide and per-post), and a Pages feed join the existing site-wide/per-category posts feed — every one of them available in RSS 2.0, Atom 1.0, and now JSON Feed 1.1 too. Feed items list their categories/tags and link to their comments section. A new "Enable specific feed types" panel on Settings › General lets each feed type be switched off independently, and an optional setting can fold a post's or page's approved comments straight into its own feed item for readers that don't fetch the separate comment-thread feed. Plugin authors can now register an entirely new feed type or a custom format (feed_types/feed_formats filters) that works across every existing feed automatically.

✉️ Contact Forms: Search, Archive, File Uploads (LPP-003)

Contact Forms › Submissions gained a search box, a date-range filter, and a new Archived tab alongside All/Inbox/Spam — archiving hides an entry without deleting it. CSV/JSON export now covers the current filtered view with no row cap. A form's field editor gained a File Upload type (single attachment, capped and type-restricted, served only through an authenticated download link), and a new submission's notification email now sets its Reply-To to the submitter's own address.

🖱️ Collapsed Admin Sidebar with Flyout Submenus (LP-151, LP-154)

The admin sidebar now defaults to a classic-WordPress-style collapsed, icon-only width — hovering or keyboard-focusing a section with sub-pages (Posts, Media Manager, Appearance, and so on) pops its submenu out next to it, instead of pushing everything below it down the page. A toggle in the sidebar switches back to the previous full-width layout any time, remembered per browser; mobile is unchanged. A follow-up pass restyled the sidebar's toggle buttons as solid accent-colored buttons and sharpened up two icons (Plugins, Settings) that were easy to miss next to their more colorful neighbors.

🛡️ Lumora Shield Moves Home (LP-153)

Lumora Shield no longer has its own top-level sidebar entry. Its Settings screen is now a "Lumora Shield" tab on Settings › Security, and its Logs screen is now a section on Maintenance › Logs, right alongside the existing Application Errors and Login Attempts. Old bookmarks still work — both former URLs redirect to their new home.

💾 Smaller Database Backups (LP-152)

A database backup taken via an update or the on-demand "Back up now" button is now gzip-compressed on any server with the zlib extension (the overwhelming majority of hosts), shrinking its size considerably for a large site. A host without zlib falls back to the previous plain format automatically, and both formats restore transparently.

🐛 Also Fixed

A comment feed/widget content leak — a trashed or Private post's approved comments could still surface in /comments/feed and the Recent Comments widget, even though the post itself was correctly hidden everywhere else. The Lumora Classic theme's footer widget titles were unreadable against the footer's dark background. Lumora Shield's four settings forms shared one CSRF token, so only the last-rendered form's Save button actually worked — each now verifies independently.

🧪 Quality

The Docker PHP 8.2/8.3/8.4 + MariaDB matrix (2369 tests, 7399 assertions) ran clean on all three versions. See docs/CHANGELOG.md for the complete, unabridged list of every change in this release.

Lumora Press v0.11.0 Release Notes

🚀 What's New in v0.11.0

Release Date: September 7, 2026

A structural release for content organization: Categories catch all the way up to Pages with tree views, images, hierarchical URLs, and breadcrumbs, Pages itself gains sortable columns and proper validation, backups become downloadable, and Widgets and Visitor Stats each pick up a batch of real gaps closed.

🗂️ Categories: Images, Hierarchical URLs, Tree View, and Breadcrumbs (LP-010)

The biggest single addition in this release. The admin Categories list's post-count column now links to a pre-filtered Posts list (matching what Tags already had), and a new "Search & Filter" panel lets you search by name/slug or filter by parent, minimum post count, or a created-date range. Categories can now carry their own image, shown on that category's archive page on both bundled themes. A category's URL now reflects its parent/child position (e.g. /category/tv-movies/star-trek), with old flat links permanently redirecting to the correct nested URL — and the archive page itself can show a breadcrumb trail. The admin list's unfiltered view now renders as a real depth-indented tree with drag-and-drop (and keyboard-accessible) reordering and per-row expand/collapse, and a new "Archive display" field lets a single category override the site-wide post display mode. Bulk actions gained a "Change parent to…" option, and category names are now validated the same way Post/Page titles already are.

📄 Pages: Sortable Columns, Validation, and Permission Testing (LP-009)

The admin Pages list's Title, Created, and Published columns are now clickable to sort, mirroring the Downloads list. Pages now enforce the same title-required/length-cap validation and content sanitization Posts already had. The Pages screens' form-handling logic moved into a dedicated PagesController, closing out this ticket's last remaining gaps.

💾 Downloadable Backups (LP-144)

Every backup on Maintenance › Updates now has a "Download files"/"Download database" link alongside Restore and Delete, so a copy can be saved off-server before or instead of restoring it in place.

🎛️ Widgets: Delete, Cross-Theme Survival, and PHP Code Widgets (LP-048)

Active widgets can now be deleted directly instead of deactivating first. A widget assigned to a sidebar that a theme switch removes now moves to Inactive Widgets instead of becoming unreachable. A new "PHP Code" core widget type runs entered code server-side, restricted to Administrators — the same trust level the Theme Editor already requires.

📊 Visitor Stats Report Page (LPP-014)

A new Visitor Stats › Stats admin screen alongside the existing Dashboard widget, with today/7-day/30-day/all-time totals, a switchable Views Over Time chart, and Top Posts/Top Referrers/Top Countries/Browser/Device breakdowns — still aggregate, day-level data only, with no live "who's online" view.

🐛 Also Fixed

The Create/Edit Tag form now correctly redisplays itself with its error banner on a failed validation, the same fix just applied to Categories.

🧪 Quality

The Docker PHP 8.2/8.3/8.4 + MariaDB matrix (2296 tests including Integration/) ran clean on all three versions. See docs/CHANGELOG.md for the complete, unabridged list of every change in this release.

Lumora Press v0.10.0 Release Notes

🚀 What's New in v0.10.0

Release Date: September 4, 2026

A writing-and-reading-focused release: Tags catch up to Categories with real bulk actions and a "Related Posts" block, post listings finally show comment counts and links, a new bundled Emoji Picker, portable settings you can carry between installs, and a batch of editor-toolbar and Read More tag fixes.

🏷️ Tags: Bulk Actions, Post Counts, and Related Posts (LP-011)

The admin Tags list gained checkboxes and a bulk-actions bar — Delete, Merge into… (reassigns every merged tag's posts to the target and removes the source tags), and a one-click Remove unused tags — mirroring what Categories already had. Each row's post count now links straight to the admin Posts list, pre-filtered to that tag. On the public side, a post's own tags now show on its single-post page (both bundled themes), linked to their tag archive, and every post's page shows a "Related Posts" block of other posts sharing at least one tag with it, most-shared-tags-first.

💬 Comment Counts & Links on Post Listings (LP-141)

The homepage/Posts-page listing and every category, tag, author, and date archive now show each post's comment count next to its categories, linking through to that post's own comment thread — the classic "X Comments" link readers of the reference platforms this project draws on will recognize. Shows "Comments Closed" with no link only when a post has comments closed and no existing comments to read.

😀 New Plugin: Emoji Picker (LPP-006)

A search-and-browse-by-category emoji picker for the Post/Page/Downloads editor toolbar (both Visual/HTML and Markdown), bundled and active by default. Each signed-in user gets their own Recently Used category; inserting an emoji drops a plain Unicode character with no images, no shortcodes, and no network requests beyond a same-origin "record recently used" call. Settings › Writing › Emoji Picker controls which editors show it, how many recently-used emoji to remember, and the default category shown on open.

📦 Portable Settings Export/Import (LP-140)

Maintenance › Tools gained an Export Settings download and an Import Settings upload for copying Permalinks, Reading, Discussion, Media (including Thumbnails and the Media Viewer/Lightbox), and the portable part of General settings from one Lumora Press install to a completely unrelated one. Site identity (site URL, tagline, admin email) and anything install-specific (Security, Privacy, Redirects, Cache, Embeds, or a setting referencing a specific local media file or page) is never included. Import shows a before/after diff of exactly what will change before anything is applied.

🖼️ Featured Image Placement (LP-143)

A new "Featured Image" section under Appearance › Customize › Body lets a site choose, via two small clickable preview diagrams, whether a single post's or page's featured image appears above the title (the new default) or beside it as before. On the Lumora Classic theme's own Classic homepage layout, the same choice switches the front-page listing between the two arrangements too.

⌨️ Keyboard-Accessible Reordering (LP-139)

The Post/Page editor sidebar and the Pages tree view — both previously mouse-only for reordering — now get the same Move Up/Move Down button pair Dashboard's reorderable widgets already had.

✏️ Editor Toolbar & Read More Tag Fixes (LP-146, LP-147, LP-148, LP-149)

The Visual/HTML editor's Insert Read More Tag button now uses a scissors icon matching the Markdown editor's own, moved earlier in the toolbar next to Bullet List, and Insert Shortcode gained its own distinct icon after accidentally sharing Source Code's. Two real bugs fixed alongside: a post's More tag marker could leak into its own single-post view as literal <!--more--> text or a visible "Read More" label instead of only cutting off listing previews, and the Read More marker's intended blue divider styling in the Visual/HTML editor never actually applied because the admin CSP silently dropped TinyMCE's inline style — it now loads as a real linked stylesheet.

🐛 Also Fixed

Downloads' "Download" button and Description-field images no longer reveal the real server file path after one click (LPP-013) — both now stream through masked endpoints instead of redirecting. Lumora Gallery Shortcodes' "View album" link now points at the Gallery site's real album page instead of its homepage. Maintenance › Updates' backup Restore/Delete/Backup Now actions now anchor back to the Backups panel instead of jumping to the top of the page. Visitor Stats' GeoLite2 country-data import now advances in place via fetch() instead of a full-page reload per batch.

🧪 Quality

Full composer test suite (2059 unit tests) runs clean on host PHP 8.4. The Docker PHP 8.2/8.3/8.4 matrix (2155 tests including Integration/) ran clean on all three versions — one one-off MediaServiceTest failure on the first PHP 8.3 pass was confirmed as container I/O flakiness (unrelated to this release's changes) by an immediate clean re-run. See docs/CHANGELOG.md for the complete, unabridged list of every change in this release.

Lumora Press v0.9.0 Release Notes

🚀 What's New in v0.9.0

Release Date: August 31, 2026

A big one — a new plugin for embedding Lumora Gallery content, a major Post/Page editor overhaul, and a long list of admin-wide "why couldn't I already do this" fixes: bulk-delete for plugins and themes, reorderable Dashboard widgets, a working multi-page theme preview, and more.

🖼️ New Plugin: Lumora Gallery Shortcodes (LPP-015, LPP-018)

Embed albums and images from a separately-installed Lumora Gallery site into Lumora Press posts and pages — [lumora_gallery_album] (a whole album, its newest N images, or specific images by id) and [lumora_gallery_newest] (the newest N images across the entire gallery). Thumbnails open in Lumora Press's own PhotoSwipe lightbox; Lumora Gallery is never required for Lumora Press to work, and nothing on the Gallery side needs to change. Its Settings screen can now also auto-detect the connection details straight from the Gallery site's own config.php — the same convenience the WordPress Importer plugin already offers for a source site's wp-config.php — including reading the Gallery's own base URL from its database once the detected connection works.

✏️ Post & Page Editor Overhaul (LP-083, LP-110, LP-130, LP-131, LPP-017)

The New/Edit Post and Page screens gained a real sidebar layout — Publish, Featured Image, Categories, Tags, and other meta boxes as drag-reorderable, collapsible cards, closer to classic WordPress's own editor shape. A new "Insert Shortcode" toolbar button lets you pick a registered shortcode and fill in its attributes through a real form (category picker, icon browser, checkboxes) instead of typing [shortcode attr="value"] by hand — covering Font Awesome's [icon], the WordPress Importer's download shortcode, Downloads, Contact Forms, and both new Gallery shortcodes. The WYSIWYG editor's "Insert/Edit Link" dialog can now link directly to an existing Post or Page picked from a searchable list, instead of requiring a copy-pasted permalink. And every place a featured image can be chosen (the editor sidebar, Media Manager's default-featured-image setting) now opens a real WordPress-style Media Library grid picker instead of a plain filename dropdown.

🎨 Appearance: A Real Per-Theme Customizer, and Theme Preview That Actually Works (LP-123, LP-137, LP-138)

Appearance › Customize is now a tabbed screen (Header, Welcome Message, Body — colors/typography/layout/post display, Menu, Widgets, Footer) with values scoped per active theme, no CSS editing required. Inactive themes can now be deleted directly from the Themes grid, individually or in bulk. And previewing an inactive theme (the "Preview" link) now actually persists as you click through the site — post, category, tag, author, and nav menu links all keep the preview active, instead of silently reverting to the real theme the moment you left the homepage.

🔌 Plugins Page: Delete Inactive Plugins, Individually or in Bulk (LP-133)

A quick "Delete" action on each plugin's row/card — previously only available inside the "Details" dialog — plus a checkbox-driven "Bulk actions" bar for clearing out several unused plugins at once.

📊 Reorderable Dashboard Widgets (LP-134)

Every Dashboard widget (Recent Posts, Recent Comments, Quick Draft, System Information, Popular Downloads, Update Status, and plugin-provided panels like Visitor & Post View Statistics' own Site Visitors widget) can now be dragged into a different order, or reordered with keyboard-accessible Move Up/Move Down buttons — saved per signed-in admin, not site-wide.

💬 Comments: Status Counts, and an Empty Spam Action (LP-135, LP-136)

The status filter row (All / Pending / Approved / Spam / Trash) now shows a count on every tab, matching how All Posts/Pages/Downloads already work. The Spam tab also gained an "Empty Spam" button alongside the existing "Empty Trash" — previously the only way to remove spam comments permanently was one at a time.

🗑️ Empty Trash on Every Admin Trash Tab (LP-126)

Categories, Tags, Pages, Users, and Downloads' Trash views all gained the one-click "Empty Trash" action Posts and Comments already had.

🐛 Bug Fixes

Content rendering could produce invalid nested <p>/<div> markup in certain block combinations (LP-125). A Font Awesome activation bug surfaced a confusing error message (LP-128). Imported posts could silently end up with no featured image and no explanation why (LP-129) — the Import screen now refuses to start when it can't actually reach the source uploads folder, and calls out any post/page whose featured image import failed by name. The WordPress Importer now renders two more NextGEN Gallery shortcode variants that were previously left as raw, unrendered text on migrated content (LPP-016).

🔒 Also in This Release

An anonymous, opt-out install ping (LP-127) lets the project gauge real adoption — no personal or site-identifying data included. Settings › Privacy's configured Privacy Policy Page now actually gets linked from the default theme's footer (LP-132), previously invisible unless an admin manually added it to a menu.

🧪 Quality

Full composer test suite (1995 unit tests) runs clean on host PHP 8.4. The Docker PHP 8.2/8.3/8.4 matrix hit a local port-3306 conflict with this machine's own dev-install MySQL server on two of the three versions (a pre-existing environment issue, not a code regression — see PHP Test Suite/TEST_LOG.md for the full detail); PHP 8.3 ran the complete matrix (Unit + Integration, 2091 tests) cleanly. See docs/CHANGELOG.md for the complete, unabridged list of every change in this release.

Lumora Press 0.8.0 Release Notes

🚀 What's New in v0.8.0

A Media Manager-heavy release, plus a brand-new Contact Forms plugin and a round of Downloads polish.

✉️ Contact Forms (New Plugin, LPP-003)

A lightweight contact form builder, off by default: build a form from a fixed field list (Name, Email, Subject, Message, Text, Textarea, Checkbox, Select), embed it anywhere with a shortcode, and read submissions from a dedicated Contact Forms › Submissions inbox. Honeypot, submission-timing, and per-IP rate-limit spam protection are always on; optional Google reCAPTCHA, Cloudflare Turnstile, and Akismet integrations are off by default and configured from Contact Forms › Settings. Deliberately scoped down from a much larger original spec.

🗂️ Media Manager Folder Tree Gets Smarter (LP-120, LP-121, LP-107)

Folders with subfolders can now be expanded/collapsed, remembered per-user across page loads, with a quick delete button sitting directly next to each folder's name. "All Files," "General Uploads," and every folder now show a file-count badge (a folder's count includes everything filed in its subfolders too). Search also got smarter — a multi-word term like game wallpaper now matches regardless of word order, instead of requiring the exact phrase as one contiguous substring.

🖼️ Default Featured Image, Set Directly From the Image (LP-099)

An image's own Media Manager edit panel now has a "Set as Default Featured Image"/"Remove as Default" action, a direct alternative to picking it from Media Manager › Thumbnails' filename dropdown — both stay in sync automatically.

🔗 Hierarchical Page URLs (LP-084)

A Page's public URL now reflects its position in the parent/child hierarchy — e.g. /about/team for a "Team" page under an "About" parent — instead of the old flat /page/{slug}, regardless of nesting depth. Every existing page's URL changes, including top-level pages (/page/about becomes /about); the old flat URL keeps working via an automatic permanent redirect, so existing bookmarks and search engine listings aren't broken.

📊 Downloads Plugin Follow-Ups (LPP-011, LPP-012, LP-126)

All Downloads now shows each download's click count. A new Downloads › Categories admin screen manages Downloads' own dedicated category taxonomy — search & sort, status tabs, bulk actions, and an Empty Trash action. The Add Download screen gained a third source option, "Use an existing file from the Media Library," and the Edit Download screen can now swap a download's underlying file or URL entirely instead of requiring delete-and-re-add.

🌗 Public Light/Dark Mode Toggle (LP-117)

The default theme gained a visitor-facing header button that switches between an explicit Light and Dark choice, persisted in the browser and applied before the page paints — no flash of the wrong theme on reload.

📝 Default Theme Polish (LP-118, LP-119)

Single posts and post listings now show each post's assigned categories, and a logged-in author/editor sees a quiet "Edit this post" link. Comment reply threads render properly nested, with tighter spacing on narrow mobile widths.

🔧 Maintenance › Logs (LP-114)

A real admin screen behind the previously-placeholder menu entry, showing the application error log and recorded failed login attempts with current lockout status.

🐛 Bug Fixes

Internal ticket IDs and dev-doc/class-name references were leaking into user-facing admin copy in five places (LP-101) — all removed after a full-codebase audit. Several admin visual-consistency fixes: the "View" row action now has its own distinct color instead of sharing one with unrelated row actions, All Pages' tree view now colors its title links, and list table column headers are readable again instead of washed-out. Gravatar avatars were silently blocked by the default Content-Security-Policy. WordPress Importer now correctly renders two more Simple Download Monitor shortcodes that were previously left as raw text on migrated content.

🧪 Quality

Full composer test suite (1771 unit tests) runs clean. composer stan reports 12 pre-existing findings, all following the same already-established nullsafe-property/missing-iterable-type patterns elsewhere in the codebase — none introduced by or specific to this release's actual logic. See docs/CHANGELOG.md for the complete, unabridged list of every change in this release.

Lumora Press 0.7.0 Release Notes

🚀 What's New in v0.7.0

This is a big one — the largest batch of accumulated work released at once, spanning WordPress migration, Pages, Categories, the admin dark mode overhaul, and a long tail of polish and bug fixes.

📥 WordPress Importer Reaches 1.0 (LPP-004)

Every checklist item on the WordPress Importer's own ticket is now complete. A direct database connection or a WXR (.xml) export file can migrate users, categories/tags, pages, posts, comments, media, menus, and classic widgets from an existing WordPress site — plus Simple Download Monitor downloads, "Media Library Folders" organization, and NextGEN Gallery (including its album grouping). This release's own contribution: "Skip"/"Overwrite existing content" now covers Categories, Tags, Folders, Downloads, and NextGEN images too (previously only Posts/Pages/Comments/Media), a dedicated post-import summary screen with a distinct "Action Needed" section, two more detected-but-unresolvable media constructs (Jetpack Tiled Gallery, [slideshow]), and a redirect mapping report with CSV export. Along the way: HTML-aware image reference rewriting, internal link rewriting between imported posts/pages, dry-run previews, resumable imports with live progress, and site settings write-back.

🔐 Harder-to-Guess Admin Accounts (LP-124)

An admin/staff account's login username must now be different from its Display Name — the name shown publicly as a post's byline. Required for every role except Subscriber, enforced both in the installer's admin-account step (which also gained a real Display Name field instead of silently reusing the username) and the admin Add/Edit User screen. An Administrator account additionally can't use an obviously guessable username like "admin".

🖼️ Insert a Whole Folder as a Thumbnail Gallery (LP-122)

A new "Insert Folder" button sits next to Insert Image in both editors — drop a whole Media folder into a post/page at once as a row of thumbnails, instead of inserting each image one at a time. The row always reflects the folder's current contents, and linking to the full-size image joins the post's existing lightbox gallery.

📄 Pages Catch Up to Posts (LP-009)

Pages gained the same maturity Posts already had: Trash with restore, bulk actions, a drag-and-drop tree view, Quick Edit, search & filtering, Duplicate, Preview, Pending Review and Private visibility, discussion (comments) settings, and a "Change author to…" bulk action.

🗂️ Categories Grow Up (LP-010)

Categories gained Trash with restore, a "Merge into…" bulk action (moves a category's posts and child categories into another before removing it), and per-category RSS/Atom feeds.

🌙 Admin Dark Mode & Visual Polish (LP-085, LP-087–LP-092)

A real per-user dark mode toggle for the whole admin, plus a full visual consistency pass: panel/card section title backgrounds, link color cohesion (no stray :visited styling), consistent primary/secondary button usage, sidebar expand/collapse-all, and consistent form field styling everywhere.

🎨 Front Page & Archive Display (LP-079, LP-094, LP-095, LP-102)

A new "Post Display" tab controls whether the front page and archives show full content or excerpts, full-width featured images above posts, the theme's own content-width choice now wins over the generic Theme Options default, and a redundant "Welcome to {Site}" heading was removed from the homepage listing.

🧭 Navigation & Menu Improvements (LP-103, LP-104, LP-106, LP-111)

Appearance › Menus' "Add Items" panel now shows pages/categories nested by hierarchy, the Pages and Categories widgets render real nested output, more flat category/parent pickers gained nesting and depth caps, and Pages now sits directly after Posts in the admin sidebar.

🖥️ New Post/Page Screens & Media Manager (LP-097, LP-105, LP-115, LP-116)

A redesigned New Post/New Page screen, a Thumbnails/List view-mode toggle for Media Manager, a merged Media Manager picker for Insert/Edit Image with search, folder sort, a bigger window, and pagination, and a "View" row action on All Posts/All Pages for published rows.

🔧 Themes, Updates & Plugins (LP-081, LP-086, LP-098)

Update an installed theme in place from a ZIP upload, a visible stage-by-stage progress indicator for both update paths on Maintenance › Updates, and a Grid/List view-mode toggle for the Plugins screen.

📊 Downloads Plugin Matures (LPP-007, LPP-008, LPP-009)

A real Downloads admin screen (LPP-008) with its own downloads table, a redesigned All Downloads list with status tabs, category filter, and real Trash/Restore/Duplicate (LPP-009), plus a Shortcodes reference page.

🐛 Bug Fixes

A long tail of real bugs fixed this release: trashed posts/pages could still be selected as menu items or parent pages; a lightbox opened from an imported image could show the wrong aspect ratio; imported HTML content could render with literal, un-rendered tags visible as text; multi-file Media Manager uploads always failed every file after the first; theme activation could silently fail with no error shown; thumbnail generation never corrected EXIF orientation on servers without the exif extension; and "Insert Image → Link To: None" now means no link at all, not just no different link.

🧪 Quality

Full composer test suite (1622 unit tests) and composer stan both run clean — the 11 pre-existing phpstan findings are unrelated to this release's work (PageService.php, UserService.php, CommentService.php, CoreWidgets.php). See docs/CHANGELOG.md for the complete, unabridged list of every change in this release.

Lumora Press 0.6.0 Release Notes

Release Date: August 10, 2026

Lumora Press version 0.6.0 brings significant enhancements to content editing, media handling, system security during updates, discussion management, auto-embed capabilities, and site search.

---

What’s New in 0.6.0

📝 Content Editing & Visual Tools

• Permalink Display: Published post edit screens now feature a dedicated "Permalink" row above the Slug field with a direct "View Post" link.

• Text & Image Alignment: Paragraphs and headings gain an alignment toolbar (left, center, right, justify). Image alignment choices (None, Left, Center, Right) are now available in the Insert Media picker. Markdown mode supports these via trailing-marker syntax ({.center}, {.aligncenter}).

• Attachment Display Settings: Select image display sizes (Thumbnail, Medium, Large, Full) and link targets (None, Media File) before inserting images into posts or pages.

• Draft Scheduling: Draft posts can store a planned publish date, preserving the date if converted to a scheduled post later.

🖼️ Media & Lightbox Enhancements

• Content-Embedded Image Lightbox: Images inserted into post/page body content automatically open in the PhotoSwipe lightbox on the front end. Opt out per image using the no-lightbox CSS class.

• Configurable Lightbox Image Sizes: Set which thumbnail size (or raw original) loads when the lightbox opens via Settings › Media.

• Rich Media Lightbox Controls: Lightbox overlays now display image dimensions, optional filenames, a direct download button, auto-advancing gallery slideshows (4-second interval), and deep-linking via #lp-media-{id} URLs.

• Video Enhancements: Video items in the Media Manager can now assign a poster image and a WebVTT caption/subtitle track.

• Direct Embed Snippets: Copy direct URLs and standard HTML embed snippets directly from the Media Manager image edit screen.

• FTP Import Image Optimization: Optional GD re-encoding (JPEG/WebP) for imported FTP images to keep file sizes minimal.

💬 Discussion & Moderation

• Discussion Settings Screen: Configure comment defaults, auto-closing after set days, nesting limits, pagination, and guest field requirements under Settings › Discussion.

• Bulk Comment Moderation: Approve, unapprove, mark as spam, trash, or permanently delete comments in bulk.

• Spam & Moderation Controls: Add moderation and disallowed keyword lists, set link-count thresholds, and integrate with the new comment_is_spam filter alongside Akismet.

• Notifications & Avatars: Receive admin/author email alerts for new comments or moderation queues. Support for Gravatar rating caps, built-in defaults, or custom uploaded avatars.

🔗 Auto-Embeds

• Twitter/X Embeds: Bare tweet status URLs on their own line convert into embedded tweets, with conditional loading of official widget scripts.

• Bluesky Embeds: Standalone Bluesky post URLs automatically resolve AT-URIs and content hashes on save using BlueskyResolverService.

🔍 Search & Classic Widgets

• Expanded Search Scope: Site search now scans Categories, Tags, and Authors (with published posts) alongside Posts and Pages, ranking results by relevance.

• Statistics Widget: Displays counts for published posts, pages, approved comments, and registered users.

• Social Links Widget: Displays profile links with automated Font Awesome icon support for active platforms.

🛡️ System Operations & Updates

• Update Safety Verification: Background maintenance mode briefly engages during ZIP updates. Pre-update checks verify database server version minimums, config.php integrity, available storage space, active user warnings, and modified core file alerts.

• Automatic Backup Verification: Backups generated prior to updates are verified immediately upon creation.

• Reverse Proxy Cache Purging: Successful updates automatically purge external reverse-proxy and edge caches.

• Drag-and-Drop ZIP Uploads: Maintenance update uploads now support drag-and-drop with real-time upload progress tracking.

---

⚡ Performance Improvements

• Request-Life Query Memoization: MediaService::find(), UserService::findById(), and ThumbnailService::thumbnailsFor() now cache queries per request, eliminating duplicate queries caused by author links and featured images on listing pages. Cache evictions trigger automatically on writes.

---

🛠️ Bug Fixes & Improvements

• WYSIWYG Image Paths: Disabled TinyMCE's automatic relative URL rewriting (relative_urls: false), preventing front-end 404 image errors on published content.

• Lightbox Layout & Sizing: Fixed aspect ratio stretching on author-linked images by reading real pixel dimensions directly from disk. Fixed pointer-event clipping issues on PhotoSwipe toolbars.

• Asset Versioning: Added automatic modification-time query parameters (?v={mtime}) to theme and admin CSS/JS assets for reliable cache-busting.

• CSP Compatibility: Shifted lightbox filename configurations out of inline scripts and onto data-show-filenames HTML attributes to adhere to strict Content Security Policies.

• Markdown Lightbox Support: Added internal markers to ensure Markdown-authored images without explicit width/height attributes trigger front-end lightboxes properly.

• Icon Color Fixes: Corrected SVG path fill properties on lightbox download and slideshow icons.