Flarum is now Composer-powered

Composer is a dependency manager for PHP. It allows applications to easily pull in external code libraries, which means they can avoid reinventing the wheel. It also keeps dependencies up-to-date so that security and bug fixes are propagated more rapidly.

Prior to beta 3, Flarum already utilized Composer to pull in its dependencies during development. We would then package up the result into a ZIP file and distribute it on the Flarum website, ready to upload and run on a web server. Extensions underwent a similar build process and could be uploaded into the extensions directory.

However, this ideology resulted in some issues:

• Duplicate dependency conflicts. If two extension ZIPs included two different versions of the same library, then there could potentially be conflicts and incompatibilities which would be difficult to hunt down.
• A complex build process. Because it involved installing dependencies for Flarum's core and bundled extensions, building a release took a long time and was quite a fragile process. This was also a barrier to setting up nightly builds.
• A proprietary dependency and update manager. In order to have an automatic install/update process for Flarum and its extensions, we would essentially need to implement our own version of Composer anyway.

Moving forward, we have decided to move to a fully Composer-driven architecture and ecosystem. Each Flarum instance has a composer.json file which contains a list of the extensions to install. Composer reads this file and pulls them all in, along with their dependencies, resolving any conflicts that may occur. Everything can be updated to the latest version with a single command. And using Composer to power the extension ecosystem will enable us to deliver a Marketplace much sooner than originally planned.

There is one notable caveat: Under normal circumstances, Composer must be run from the command-line. This means that currently, Flarum cannot be installed on shared hosts which do not support SSH. Rest assured that we are planning to address this in the future and make sure that Flarum is accessible to everyone. In the meantime, if you want to run Flarum, you will need to find a host that permits SSH access.

Backend codebase & API refactoring

All of the backend classes, namespaces, and events have been systematically tidied up. The way extensions work has also undergone some slight changes. Therefore, it should come as no surprise that extensions that worked with beta 2 will not work with beta 3.

While there is no concrete transition guide to update your extensions, there is a new Quick Start tutorial which you can follow to get up-to-speed with how extensions work in beta 3.

Improved internationalization

@Dominion has done a huge amount of work to overhaul Flarum's translation key naming scheme so that it's descriptive and consistent. He's also extracted many hardcoded strings, especially in the administration UI, to make them translatable. This paves the way for a solidified language pack creation process – documentation is currently in the works. In the meantime, you can check out the flarum/english repository for an idea of what a language pack looks like.

We've also switched to use of Symfony's Translation component instead of a proprietary one, making way for more powerful pluralization rules.

New moderation tools

• Hide/restore discussions. Discussions can be soft-deleted by moderators or by the OP if no one has replied.
• Flags. New bundled extension that allows posts to be flagged for moderator review.
• Approval. New bundled extension that hides/flags new posts to be approved by the moderation team.
• Akismet. New bundled extension that checks new posts for spam with Akismet.
• IP address logging. IP addresses are stored with posts for use by extensions (e.g. Akismet).
• Flood control. Users must wait at least ten seconds between consecutive posts.

Other features

• Social login. New bundled extensions that allow users to log in with Facebook, Twitter, and GitHub.
• More compact post layout. All controls are grouped over to the right.
• Improved permissions. The admin Permissions page has been improved with icons and other tweaks.
• Improved extension management. The admin Extensions page has a new look and is easier to use.
• Easier debugging. The "oops" error message has a Debug button to inspect a failed AJAX request.
• Improved JavaScript minification. Minification is done by ClosureCompiler only when debug mode is off, resulting in easier debugging and smaller production assets.

And, of course, many smaller improvements and bug fixes – check out the full changelog.

Updating from Beta 2

Updating from beta 2 involves getting your hands a little dirty. You basically need to install a fresh version of Flarum. Remember, you need SSH access to do this. If you need help, start a new discussion.

1. Disable all extensions. (If you've set a language other than English as the default language for your forum, be sure to set the default language back to English before disabling the language pack!)
2. Back up your database, your config.php file, and your assets directory.
3. Delete everything in your forum directory.
4. Follow the installation instructions for beta 3.
5. Replace config.php and assets with your backups.
6. Run the following queries on your database:

   UPDATE `migrations` SET `extension` = CONCAT('flarum-', extension) WHERE `extension` IS NOT NULL;
   UPDATE `config` SET `key` = CONCAT('flarum-', `key`) WHERE `key` LIKE '%.%';

7. Visit yourforum.com/admin and enter your database password to perform the update.
8. Re-enable extensions. After enabling the English language pack, you may need to delete assets/*.js if language strings are not showing up.
9. Reconfigure permissions.
10. If you're using Flarum on the WWW, be sure to disable debug mode in config.php and delete assets/*.js to serve up minified assets.

Phew! Rest assured that the new Composer architecture will make future updates very simple.

Known Issues

• Translations may not appear correctly after upgrading from beta 2 and enabling the English language pack. Delete assets/*.js files to fix.
• Editing a tag, or attempting to restrict permissions by tag, results in a "You don't have permission to do that" error.

These issues will be fixed in a new beta release within a few days.

Thank You

Thanks to all the contributors for this release: @Franz, @Dominion, Kirk Bushell, and others. You're all amazing!