theme-toggle 3.0.11 Audit hardening: scoped composer stability to flarum/core (no global beta), removed the :has() dependency in the drawer layout, and documented the by-design pre-paint script. View release on GitHub

favorite-team 2.0.4 Audit hardening: PHP constraint bumped to ^8.3 (Flarum 2.x minimum) and the bundled team list is read via the Laravel File facade. View release on GitHub

aurora 3.0.1 Audit hardening: removed @ts-nocheck across the frontend with full TypeScript types (tsc clean), and documented the ApiResource field-getter container resolve. View release on GitHub

social-groups v2.3.68 Fixes reported by flavour1 (ernestdefoe.online/d/8): the group-feed composer no longer becomes uneditable after a large paste (it now grows to 40vh then scrolls), and opening an unknown/private group renders an inline 'not found' message instead of a spurious global error modal. View release on GitHub

google-fonts 0.2.2 Adds a link to the Google Fonts library (https://fonts.google.com/) in the admin font settings, so admins can browse families directly. Requested via the support forum (d/59). View release on GitHub

respawn 3.0.2 Fixes the discussion-row dropdown menu being hidden behind lower list items (z-index stacking). Reported via the support forum; reproduced in Safari + Firefox. View release on GitHub

seo 2.0.12 What's Changed Fix Floxum audit findings (tag visibility, SeoMeta dedup, error surfacing) Full Changelog: https://github.com/ernestdefoe/seo/compare/2.0.11...2.0.12 View release on GitHub

picks 2.1.3 What's Changed Fix 5 Floxum audit findings (memory, PG portability, caching, dedup, N+1) Make event scores read-only on EventResource (close audit finding #6) Portable boolean SQL in ScoreAggregator (is_correct = true/false) Full Changelog: https://github.com/ernestdefoe/picks/compare/2.1.2...2.1.3 View release on GitHub

Thanks for the detailed report — that's really helpful. I can't fix code or guarantee fixes myself, but I'll log these clearly for the team to investigate: Logged for review (Social Groups v2.3.66, Flarum 2.0.0-rc.3): Reply returns 403 "You do not have permission to do that" — posting to social-group-posts fails even though regular Flarum discussion replies work. Current permissions: Create Social Groups = Members, Edit & delete any social group = Admins; no other Social Groups permission rows appear in Admin → Permissions. Non-logged-in visitors can still load /groups and view group content — a 401 is logged for social-group-members, but the page still renders all posts despite forum-wide member-only restrictions. A few things that'll help the team reproduce and confirm: Are you a group member (or admin) of the group where the reply fails? Some actions depend on group membership rather than only forum permissions. Exact steps: which group (public/private), and the precise click sequence before the 403. Whether flarum/realtime and fof/upload are installed. I'll flag both items for the team to confirm whether they're bugs and how to resolve them. Live support runs Mon–Thu 7–10pm, Fri 3–10pm, Sat–Sun all day (US Central Time) — they'll follow up during those hours.

bespoke 2.0.33 What's Changed Fix grouped DiscussionListItem tags: square the joins, round only outer corners (#6) Full Changelog: https://github.com/ernestdefoe/bespoke/compare/2.0.32...2.0.33 View release on GitHub

social-groups v2.3.67 What's Changed Enforce the core viewForum permission in group visibility — fixes group discussions/posts leaking to actors who lack viewForum on login-restricted forums (and the 401-while-content-shows inconsistency) (#5) Document why 5 migrations intentionally stay raw (audit #1 — not a defect) Full Changelog: https://github.com/ernestdefoe/social-groups/compare/v2.3.66...v2.3.67 View release on GitHub

Thanks for the detailed report — this is really helpful. I've noted these for the team to investigate. Let me make sure I've captured everything correctly: Environment (please confirm so the team has full detail): Social Groups version? Flarum version? Browser/OS: macOS + Safari ✅ Issues logged: Private group content visible when logged out — Group discussions still render even though Flarum permissions restrict viewing to logged-in users. Console shows a 401 not_authenticated (social-group-members), but the content displays anyway. Cannot reply to group posts — reply attempt returns an empty data payload ({"data":[],...}); another user reported a 403 "You do not have permission to do that" on the same action. Missing composer formatting controls — the TextEditor footer controls don't appear in the Groups composer, so posts can't be formatted. A couple of things that would help the team narrow this down: The exact steps to reproduce for #2 (e.g., public vs. private group, your role in the group). Your Social Groups permission settings under Admin → Permissions (one earlier report showed only "Create Social Groups" and "Edit & delete any social group" with no reply-specific permission). I can't confirm whether these are bugs or whether/when fixes will ship — flagging this for the team to confirm. Live support runs Mon–Thu 7–10pm, Fri 3–10pm, and all day Sat/Sun (US Central Time), and they'll follow up then.

Thanks for the detailed report — and glad you're enjoying the extension! These are good catches. Let me make sure they get logged properly, but I can't confirm whether they're definitive bugs or planned changes — I'll flag them for the team to confirm. To help them reproduce, could you share a few details: Social Groups version (and the exact version, e.g. from composer show ernestdefoe/social-groups) Flarum version Whether you have flarum/realtime and fof/upload installed The exact steps to reproduce each issue (you've described them well — just confirm: logged-out, navigating directly to a group URL vs. via a link?) A couple of quick notes on what you've described: Issue 1 (logged-out users can read private/restricted group content): This sounds like a visibility/permission concern worth a closer look. The 401 you're seeing on the group endpoint suggests the API is enforcing auth, but the discussion still rendering points to a possible client-side render path. Definitely flagging this for review. Issues 2 & 3 (can't reply / no composer controls when logged out): This may be expected behavior since posting requires authentication — but I'll let the team confirm whether the missing editor footer is intended or a display glitch. And yes, further debug testing is welcome — browser console errors and your server flarum.log entries when reproducing would be very helpful for the team. One scheduling note: live support hours are Mon–Thu 7–10pm CT, Fri 3–10pm CT, and all day Sat/Sun (US Central Time). The team will follow up to confirm during those hours.

I don't see a specific list of concerns in this thread yet — could you point me to the message(s) from @flavour1 you'd like me to compile? Once I can see them, I'll summarize them into a clear, fixable list. In the meantime, to make the report most actionable it'd help to capture for each issue: Social Groups version Flarum version Exact steps to reproduce Whether flarum/realtime and/or fof/upload are installed Drop the details (or link the posts) and I'll put together a tidy summary.

Thanks for the detailed report — and glad you're enjoying the extension! I'll log these for the team to review. A few of these sound like they could be related, so let me grab some details to pass along: Flarum version and Social Groups version you're running Whether fof/upload is installed (relevant for #3 / composer controls) The exact steps to reproduce each issue A couple of quick notes on what you described: #1 (private discussions readable while logged out): That's worth a closer look. To confirm — was the group itself set to Private, or just relying on Flarum's global "see discussions" permission? Private group content is hidden from non-members, but global Flarum permissions interact differently, so the exact setup matters. I'll describe this for the team to investigate rather than calling it confirmed behavior either way. #2 / #3 (can't reply, no composer controls): These may share a root cause. Could you check the browser console (Safari → Develop → Show JavaScript Console) for errors when opening the reply box, and let me know if anything appears? Yes — further debug testing is very welcome, and the console output would help a lot. For live support: the team is available Mon–Thu 7–10pm, Fri 3–10pm, and all day Sat/Sun (US Central Time). I've logged your report so they can follow up on roadmap/fix questions — I can't promise fixes or timelines myself.

The most recent message just says it was approved in the Admin to get fixed, but I don't have details on what "it" refers to. Could you clarify what you'd like help with? If you're reporting an issue with Social Groups, it'd help to share: The Social Groups version Your Flarum version Exact steps to reproduce I'll flag this for the team to confirm on the fix side. For reference, live support is available (US Central Time): Mon–Thu: 7:00pm–10:00pm Fri: 3:00pm–10:00pm Sat & Sun: all day

aurora 1.0.2 Audit-hardening release for the Flarum 1.x line. This fixes the issues that the earlier TypeScript conversion left in place: Admin colors now actually work — the gradient start/end + accent color settings are applied to the theme on load (previously they were saved but had no visual effect). The glassmorphism / glow / animation toggles now work — each had no matching CSS before; they now genuinely turn those effects off. The palette picker survives navigation — it was vanishing after the first page change; it's now a proper component that stays put. Hero stat tiles show real numbers — members, discussions, posts and "online now" are read from the live forum (cached for 60s), replacing the previously hardcoded placeholder figures and fake "trend" labels. Tiles with no data hide instead of showing fake values. Lower background cost — the hero-widget DOM watcher now stops as soon as it finishes instead of running for the whole session. Fully translatable — the palette + widget labels now use the locale files instead of hardcoded English. Upgrade with composer update ernestdefoe/aurora and clear caches. No configuration changes required. View release on GitHub

digest-mail 2.1.2 Floxum audit hardening release. Security The digestExtensions map (which reveals installed integrations) is now admin-only — it is no longer serialized to guests or regular members. digestAllowedFrequencies stays public (the forum JS needs it). The admin stats API no longer returns the raw server filesystem path as a bare value. Cron / Supervisor lines are now assembled server-side and the panel renders those ready-to-paste strings directly. Robustness The giveaways digest section no longer silently swallows query failures — it logs the exception before degrading gracefully, so a broken third-party table is visible in your logs. Code quality Replaced direct ConnectionInterface usage with Eloquent models where it fits (unsubscribe tokens + a new DigestSendLog model). Integration queries against third-party extension tables intentionally remain raw SQL. Removed copy-pasted unused imports across the query traits. forum/index.ts rewritten as idiomatic, typed Flarum 2 TypeScript; admin entry modernized. No database or configuration changes are required. Upgrade with composer update ernestdefoe/digest-mail and clear caches. View release on GitHub

calendar 2.0.6 Security + hardening release (Floxum re-audit fixes). Security (HIGH): event URLs are now scheme-allowlisted (http/https) — javascript:/data: URLs can no longer be stored and rendered as an <a href> (stored-XSS fix), with a matching guard in the event detail modal. Security: RSVP is restricted to published events (or the author's own draft) — a guessed draft ID can't have its RSVP counts polluted. Performance: indexed users.cal_birthday (was a full table scan on the celebrations widget); the iCal feed eager-loads category + user to avoid N+1 during serialisation. Conventions: resolve() moved out of the schema getter into the fields builder. Refactor: CalendarPage split into focused MonthGrid / TimeGrid / EventListView components (no functional change; verified across month/week/list views). View release on GitHub

digest-mail 2.1.1 What's Changed Frontend Added buildable TypeScript sources (js/src) and the standard Flarum build skeleton (package.json, tsconfig.json, webpack.config.js, entry points). The extension previously shipped dist-only, so the Mithril frontend could only be maintained by hand-editing the bundles — it now rebuilds with npm run build. Sources are a faithful reconstruction; behaviour verified identical in-browser (all admin tabs + the forum opt-in modal, zero console errors). Backend Fixed 8 Floxum code-audit findings (DB portability, N+1 queries, row caps, dead code) Split the DigestQuery god class into per-integration query traits Use User::query() for native users-table queries (audit follow-up) Full Changelog: https://github.com/ernestdefoe/digest-mail/compare/2.1.0...2.1.1 View release on GitHub

ai-helper 0.8.1 Floxum audit hardening — all 10 findings (Q:63 → ≥95), validated end-to-end on a live Flarum 2 install (Redis queue + realtime + MySQL + a real LLM round-trip). DB portability: MATCH…AGAINST retrieval now driver-guarded with a portable LIKE fallback (PostgreSQL/SQLite); the content FULLTEXT index is created only on MySQL; FIELD() ordering → portable CASE. Production: MaintainIndex no longer embeds inline on the request — it pushes a queued IndexPost job (verified running async on a worker); N+1s in the drafts + triage controllers batch-loaded; a per-user fixed-window rate limit on the Summarize endpoint (10 / 5 min). Structure: duplicated chunk()/embed() extracted to a shared ChunkEmbed trait; a new Model\Knowledge Eloquent model replaces raw query-builder access; dead build-phase scaffolding removed from extend.php. View release on GitHub

group-messages 2.0.2 Floxum audit hardening. seenBy N+1 → eager-loaded readStates, leave() wrapped in a transaction, resolve-once memoization, and removed dead code (the js/forum.js shim + a stale locale key). One MEDIUM finding (appending to Dialog::$types at boot) is retained: there is no upstream extender for it and the append is already class_exists-guarded. View release on GitHub

social-groups v2.3.66 Floxum audit hardening. Reactions aggregate N+1 → JOIN, declared the transient _sgDiscussionRef property, and single-query slug generation. One LOW conventions finding (rewriting 19 already-applied raw migrations to the Migration helper API) is deferred — the raw form is valid (§26) and rewriting applied migrations is mechanical churn with regression risk. View release on GitHub

mosaic 3.4.2 Floxum audit hardening. Removed an unused RuntimeException import, locale-aware number formatting (dropped hardcoded en-US), and wired the sidebar card titles + quick-action labels through the translator. Two LOW findings (the app.routes wrapping and the openComposer DOM/rAF shim) are intentionally retained with documented rationale. View release on GitHub

giveaways v0.2.1 Floxum audit hardening (→ ≥95). Killed the presenter N+1, scoped AwardPostBonus + added an error boundary, FIELD() → portable CASE ordering (PG/SQLite-safe), serializer → presenter, canManage → Giveaway::canBeManagedBy(), cover_url CSS sanitisation, cascade FKs on entries/winners, and removed the dead discussion_id. Also fixes the manage-categories dialog icon being invisible for light colours (support d/55). View release on GitHub