What's Changed

6.0.3 - 2026-09-28

Changed

• Use timestamp-aware file and database session handlers to avoid rewriting unchanged sessions.

Full Changelog: 6.0.2...6.0.3

What's Changed

Fixed

• Updated the Vite library config to use import.meta.dirname.

Changed

• Expanded frontend Vitest and backend PHPUnit coverage to 100%.
• Fixed wrong PHP version requirement in VersionsService (PHP_MIN_VERSION should be ^8.1, not ^8.0).

Full Changelog: 6.0.1...6.0.2

What's Changed

Changed

• Update Google Analytics tracking code to GA4 format in analytics.html.twig. Note: This is a breaking change for users who have customized this template with the old Universal Analytics code. You will need to update your custom template to use the new GA4 code format.
• Removed pages/partials/config.js.twig and pages/partials/page.js.twig templates, as they were not being used anymore. This also removes the site JavaScript global variable, which is not used by Vue. If you were using site in your custom JavaScript, you will need to update your code to use a different method of passing configuration data to the frontend (e.g. implement back in your custom Twig templates).
• Update Bake command title ASCII art.
• Fix #33: UF's language codes do not always map to valid HTML lang codes.
• Add CSV download functionality to the Sprunje tables UI.
• Allow Sprunjer table to set the default page size to "all" to display all rows in a single page.

Full Changelog: 6.0.0...6.0.1

👀 See the release discussion about UserFrosting 6.0 for more info : https://github.com/orgs/userfrosting/discussions/1326

What's Changed

Changed

• Bump minimum Node.js requirement from 18 to 20 (NODE_MIN_VERSION in VersionsService).

What's Changed

• No changes.

Full Changelog: 6.0.0-rc.3...6.0.0-rc.4

What's Changed

Fixed

• [Markdown] ContentController / Markdown::getFilePath() now performs a case-insensitive fallback lookup via listResources() when the exact-match locator call returns nothing. Fixes file-not-found errors on case-sensitive filesystems when the URL casing differs from the filename (e.g. URL tos → file Tos.md).
• debug:version (and the debug command that calls it) now warns when a .env file exists at the application base path but cannot be read by the current process. This helps diagnose deployment permission issues quickly.

Changed

• FilePermissionMiddleware now accepts an Illuminate\Cache\Repository dependency and caches a successful permission check for a configurable TTL. On a cache hit the is_writable() loop is skipped entirely, eliminating redundant filesystem calls on every request.
• VersionsService: NODE_VERSION and NPM_VERSION container entries are now lazy closures instead of eagerly-evaluated exec() calls, so the shell commands are only executed when the values are actually resolved (i.e. during Bakery CLI commands, not on every web request).
• Bump Composer dependency userfrosting/vite-php-twig from ^1.0.2 to ^1.2.0.

Added

• New config keys cache.file_permission.key (default uf_file_permissions) and cache.file_permission.ttl (default 0 — disabled) to control the permission-check cache.
• Production config now sets cache.file_permission.ttl to 3600 seconds.

Full Changelog: 6.0.0-rc.2...6.0.0-rc.3

What's changed

• No changes

Full Changelog: 6.0.0-rc.1...6.0.0-rc.2

What's Changed

• [Core] Remove site.debug.ajax config (legacy jQuery flag)
• [Core] Change PHP_RECOMMENDED_VERSION to PHP 8.5

Full Changelog: 6.0.0-beta.8...6.0.0-rc.1

What's Changed

• Now ship built modules instead of source code
• Specify node engine version

Full Changelog: 6.0.0-beta.7...6.0.0-beta.8