March 2026 patch release 1.8.14 - EOL soon
Flarum 1.8.14 Released 🎉
We're shipping another maintenance release for the Flarum 1.x series. This one includes a security fix for flarum/nicknames, a solid batch of bug fixes, meaningful performance improvements, and some welcome changes to the GDPR extension.⚠️ Flarum 1.x end-of-life is coming
This release marks a turning point for the 1.x series. It is likely one of the last regular releases.With Flarum 2.0 approaching its Release Candidate phase, we are shifting 1.x into an almost-EOL state with immediate effect:
- ❌ No new features, improvements, or tweaks are planned for 1.x
- ❌ Non-security bug fixes will generally not be backported
- ⚠️ Security vulnerabilities will be investigated and addressed where possible — but we want to be honest: the aging dependency stack (Flarum 1.x runs on Laravel 8, which is itself well into EOL) means that some security issues may simply not be fixable on this branch
- ✅ Flarum 2.0 is where all active development, security work, and long-term support is happening
🚀 If you haven't started evaluating Flarum 2.0 yet, now is the time. Beta.8 — the last beta before the RC phase — is due in approximately two weeks.
🚨 A note on Flarum 2.0 — action required for extension developers
Beta.8 is due in approximately two weeks, and it will be the last beta before the RC (Release Candidate) phase.Here's what the RC phase means in practice:
- 🔶 Beta (where we are now) — APIs are still in flux. We can still make changes to core to accommodate extension needs.
- 🔷 Release Candidate — The API is frozen. No new features, no breaking changes. Only critical bug fixes are accepted.
- 🟢 Stable
2.0.0— RC with no blockers = stable release.
📣 Please test your extensions against beta.7 (and shortly, beta.8) and let us know what you find. Every compatibility report before RC is an opportunity to fix something permanently. After RC, it has to wait for 2.1.
🌍 Help translate Flarum 2.0
Flarum 2.0 brings a lot of new strings, and getting them translated before stable is a huge community effort. If you speak a language other than English, your help is needed — even a few strings reviewed or translated makes a difference.Translations for Flarum 2.0 are managed on Weblate: weblate.rob006.net/projects/flarum2
You don't need to be a developer — if you can read and write your language, you can contribute. Every little helps. 🙏
🔐 Security fix — flarum/nicknames v1.8.3 (CVE-2026-30913)
If you use the flarum/nicknames extension, updating to 1.8.3 is strongly recommended.A medium-severity vulnerability was discovered and responsibly disclosed via the SBB Community bug bounty programme. When
flarum/nicknames is enabled, a user could set their nickname to a string that email clients interpret as a hyperlink — for example a bare domain name (nasty.com) or markdown link syntax ([CLICK](https://evil.com)). The nickname is included verbatim in plain-text notification emails, potentially misleading recipients into visiting attacker-controlled URLs.- Variant 1 (autolink) — a nickname like
nasty.comis auto-linked by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird) - Variant 2 (markdown) — a nickname like
[CLICK](https://evil.com)is rendered as a clickable link by email clients that auto-render markdown in plain text (e.g. Apple Mail, Thunderbird)
flarum/nicknames to reject nicknames containing characters that could be misinterpreted in email contexts, while preserving legitimate nicknames like Jane.Smith.The default username-based display name driver is not affected — it already constrains values to
[a-zA-Z0-9_-]+. Any third-party display name driver that permits arbitrary characters should be reviewed.🙏 Thanks to tank0 for reporting this responsibly via Intigriti, and to @gianniguida and @Davetodave178 for helping with the fix and verification.
⚡ Performance improvements
This release includes several under-the-hood optimisations. Nothing you'll see directly — but your server will thank you.- ⚡ Notification counts cached — was a DB query on every page load; now cached for 5 minutes and invalidated automatically when something changes (including when you delete all notifications).
- ⚡ Auth last-seen write eliminated — was an unconditional DB write on every authenticated request; now only writes when the data has actually changed.
- ⚡ Scheduler timestamp moved to cache — was a DB write every ~1 minute; now stored in the cache layer instead.
💡 Running Redis? The gains stack up significantly.fof/redisv1.1.6pairs perfectly with these core improvements. It caches Flarum's forum settings in Redis with a three-layer chain — per-request in-process cache, then Redis, then the database — so settings are read from the database at most once per Redis TTL, and from Redis at most once per request regardless of how many timessettings->get()is called. In production, this alone can reduce Redis egress from settings reads by over 95%. On top of that,fof/redisnow auto-detectsphpredis(the native PHP extension) and uses it automatically when available, enabling persistent connections that reuse the socket across requests within the same PHP-FPM worker — significantly reducing connection overhead at scale. If you're running Redis and haven't updatedfof/redisrecently, now is a great time.
🐛 Bug fixes
- HTTP 405 "Method Not Allowed" pages now show the correct message ("This page does not support that request method.") instead of the generic "An error occurred" fallback.
- PHP warnings in restricted environments — a handful of PHP notices/warnings that could appear on certain hosting configurations have been resolved.
- Less boolean custom functions — a regression where custom Less functions returning boolean values were not handled correctly has been fixed.
- Extension Manager — references to the discontinued Extiverse marketplace have been removed.
🔒 GDPR extension — v1.8.2
This release includes a significant security and compliance update to the flarum/gdpr extension:- One-time confirmation links — the erasure confirmation token is now invalidated after use. Previously, a user's confirmation email link could be re-used indefinitely; it is now a true one-time link.
- Processed request guard — revisiting a confirmation link for an already-processed or manually-handled erasure request now returns a proper error instead of silently resetting its status.
- Confirmation IP logging — the IP address used to confirm an erasure request is now stored for audit purposes.
- Automatic IP purge — a new scheduled command (
gdpr:clear-confirmation-ips) automatically nulls stored confirmation IPs after 90 days, keeping data retention proportionate. - Erasure modal timestamps — the admin process-erasure modal now shows the requested-at, confirmed-at, and eligible-for-auto-processing dates.
📦 Versions released
flarum/core—1.8.14flarum/nicknames—1.8.3⚠️ security fixflarum/extension-manager—1.0.8flarum/suspend—1.8.6flarum/gdpr—1.8.2
🚀 How to update
composer update📋 Full changelog
Core (flarum/core)
Fixed
- Show correct error message for HTTP 405 Method Not Allowed responses by @IanM #4417
- Fix PHP warnings in restricted environments by @IanM #4336
- Fix Less boolean custom functions returning incorrect values by @IanM #4405
- Invalidate unread notification count cache when all notifications are deleted by @IanM #4391
Performance
- Eliminate redundant DB writes in auth middleware and cache notification counts by @IanM #4365
- Store scheduler last-run timestamp in cache instead of database by @IanM #4363
Added
Nicknames (flarum/nicknames)
Security
- Validate nicknames to prevent display name injection in notification emails (CVE-2026-30913) GHSA-3c4m-j3g4-hh25
Extension Manager (flarum/extension-manager)
Changed
Suspend (flarum/suspend)
Changed
GDPR (flarum/gdpr)
Fixed / Security
- Invalidate erasure confirmation token after use (one-time link) by @IanM flarum/gdpr#70
- Guard against re-confirming already-processed erasure requests by @IanM flarum/gdpr#70
Added
- Log confirming IP address on erasure requests for audit purposes by @IanM flarum/gdpr#70
- Scheduled command to purge confirmation IPs after 90 days by @IanM flarum/gdpr#70
- Show requested-at, confirmed-at, and eligible-for-auto-processing dates in erasure modal by @IanM flarum/gdpr#70
