docs(changelog): add the 2.7.4 Beta 1 release notes - #197
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis documentation-only change adds the curated 2.7.4 Beta 1 release notes to the versioned changelog, covering security fixes, bug fixes, dependency and UI updates, and test coverage while preserving the repository’s existing release-file workflow. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
🟢 Approval recommended
The change is limited to adding a well-structured curated changelog entry and does not introduce code or behavioral changes requiring further verification.
Pull request overview
Adds the curated 2.7.4 Beta 1 release notes to the 2.7.x narrative changelog, keeping the documented release history aligned with the already-landed security/bugfix work in the codebase.
Changes:
- Add a new “2.7.4 Beta 1 (2026-09)” section above the 2.7.3 Final block.
- Summarize included security fixes, bug fixes, TinyMCE 7.9.3 update (with TinyMCE 5 remaining unpatched), language move, and related guard-test work.
File summaries
| File | Description |
|---|---|
| docs/changelog.270.txt | Adds curated 2.7.4 Beta 1 release notes above the existing 2.7.3 Final section. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| Bug fixes: | ||
| - report a stalled upgrade patch task instead of re-queuing it silently: a task whose apply returned true without satisfying its own check was selected again on every click with no message, and every patch after it was never reached; XoopsUpgrade::apply() now names the task that fails or throws and re-checks after the loop, exception text and undeletable-file lists are shown without absolute server paths, and apply_rmindexhtml() in the 2.5.11 patch reports the files it could not delete instead of claiming success (#184, closes #183) | ||
| - define _AM_SYSTEM_USERS_NO_SUCH_USER, used by the users admin page since 2.5 but never defined; on PHP 8 an unknown user id produced a fatal page instead of a redirect with a message (#190) | ||
| - clear the remember-me cookie on logout, on session restore and in the users admin only when a cookie name is configured; the name is empty when the feature is disabled and setcookie() rejects an empty name on PHP 8, so a logout or a deactivated account on such a site produced an error (#188, #195, closes #191) |
There was a problem hiding this comment.
The note says empty cookie names are avoided on logout and in the users admin, but the directly reachable profile logout still clears the configured cookie without an empty-name guard, and neither users-admin implementation clears this cookie. This gives operators an inaccurate account of which paths were fixed.
There was a problem hiding this comment.
Both points hold. The profile module's own user.php logout carried the same two unguarded calls, and the users admin clears no cookie; the third guarded site is the login handler. Fixed in #198: the guard is applied to the profile logout, the regression test covers both logout pages, and the release note now names the two logout pages and the session restore.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #197 +/- ##
============================================
- Coverage 20.64% 20.63% -0.01%
Complexity 7995 7995
============================================
Files 675 675
Lines 43506 43514 +8
============================================
Hits 8981 8981
- Misses 34525 34533 +8 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Summary
Curated release notes for 2.7.4 Beta 1 in
docs/changelog.270.txt, above the 2.7.3 Final block: the seven security changes (#186 to #189, #194, #196), four bug fixes (#184, #188, #190, #195), the TinyMCE 7.9.3 update with the note that TinyMCE 5 stays unpatched (#193), the front-end menu label move (#185), and the executable guard tests.docs/lang_diff.txtalready carries its 2.7.4-Beta1 section (#185, #190) andinclude/version.phpalready reads 2.7.4-Beta1 (#184).CHANGELOG.mdis regenerated by the workflow when the release is published and is not edited here. README and the release post are Final-only, as at 2.7.3 Beta 1.Release gate
php -lclean on PHP 8.5 over class, kernel, include, the system module and upgrade.tests/andupgrade/testsat baseline on PHP 8.4 and 8.5. No open issues or pull requests remain upstream.Summary by Sourcery
Documentation: