CoreBB 1.1.7

CoreBB 1.1.7 introduces the first full CoreBB secure patching pipeline: a release-manager generated update package, a public updates.json manifest, admin-panel validation, sideload support, and guarded package application.

Highlights

• Added a manifest-driven update system backed by https://corebb.net/security/updates.json.
• Added admin-panel update checks for latest stable, latest security, and minimum safe versions.
• Added secure update package validation before applying files.
• Added sideload support so administrators can upload a package ZIP directly through the admin panel.
• Added package preflight checks before upgrade application.
• Added guarded upgrade application with backup confirmation.
• Added version stamping so applied packages update the installed CoreBB version.
• Added release tooling to generate update ZIPs, clean deployable ZIPs, public manifests, and release repo syncs.
• Added one-button global release publishing through the CoreBB Release Manager.

Secure Patching System

CoreBB update packages are now generated with a package manifest and file hash list. Before an uploaded or downloaded package can be applied, CoreBB extracts it into private update storage and validates the package structure.

Validation checks include:

• Package metadata must be present and readable.
• Package project must match CoreBB.
• Package version must be newer than the installed version.
• Package schema version must be compatible.
• Required PHP version must be satisfied.
• Every package file must be listed in manifest.sha256.
• Every listed package file must match its SHA-256 hash.
• Unmanifested files are rejected.
• Unsafe paths and preserved runtime paths are blocked.
• Preserved local data such as uploads, avatars, private config, cache, sessions, and environment files are not replaced.
• Obsolete file deletion is limited to declared package paths.

The admin update flow now separates validation, preview, and application. Administrators can inspect what will be replaced, preserved, deleted, and migrated before applying an upgrade.

Update Sources

CoreBB can now work from both official and sideloaded update sources:

• Official updates are discovered through https://corebb.net/security/updates.json.
• Sideloaded updates can be uploaded manually through the admin panel.
• Uploaded packages are validated the same way as downloaded packages.
• The update page reports installed version, latest stable version, latest security version, and minimum safe version.

Website Integration

The public CoreBB website now reads the latest release version from security/updates.json, keeping the website, update manifest, release ZIPs, and admin updater aligned around the same source of truth.

Fixes

• Fixed clean release builds excluding vendor source folders named Cache.
• Fixed stale public website version text.
• Improved package version stamping.
• Improved update-package validation errors for unexpected or unmanifested files.
• Improved release artifact consistency between local builds, public Git, FTP uploads, and admin-panel update checks.

Upgrade

Administrators can update from the CoreBB admin update panel using the published update package, or sideload a package ZIP manually and validate it before applying.

Security Page

CoreBB now includes a public security information page at:

https://corebb.net/forum/security/

This page is separate from the machine-readable update manifest at https://corebb.net/security/updates.json.

The security page explains where CoreBB security information lives, how administrators should monitor update status, and where security-related project links can be found. It gives site owners and users a human-readable place to confirm the project’s security posture, while the admin updater continues to use the JSON manifest for automated version and patch checks.