[3.1.3] - 2026-10-20
Fixed

    Preserve IPv6 SMTP hosts through the security validation added in 3.1.2: bare and bracketed literals share one canonical identity, and the transport adds the brackets required by PHP sockets. A real IPv6 loopback SMTP fixture verifies message delivery.

Security and upgrade

    Includes all 3.1.2 security corrections and upgrade requirements. Install 3.1.3 when upgrading from 3.1.1 or earlier. Custom Sendmail paths require operator configuration, saved mail settings must be retested, delegated administration is bounded, and strict-mode legacy FTPS remains disabled.
	
[3.1.2] - 2026-10-20
Security

    Fix the application-controlled Sendmail executable reported by dutchypoo in GHSA-x294-8g9c-m6fc. Sendmail now uses only an operator-configured executable outside application-managed storage, with trusted filesystem ownership and permissions and shell-safe quoting.
    Require explicit settings permission and recent reauthentication for mail probes. Probes use saved settings only, reject overrides, share an account rate limit and return safe error codes without SMTP diagnostics.
    Limit delegated user, role and group administration to the administrator's current permissions, home scope and extension restrictions, including indirect changes and stronger accounts.
    Refuse legacy FTPS in strict mode because PHP's FTP extension cannot authenticate the actual connection. Confine FTP passive data connections to the authorized control peer.
    Add security regression tests, isolated transport fixtures and pinned source scanning.

Upgrade requirements

    Back up configuration, writable data and the encryption key before upgrading. For a custom Sendmail binary, set EXTPLORER_SENDMAIL_PATH in the server environment; the old web setting is never executed. The executable and every path component must be protected from modification by the PHP worker. Otherwise select SMTP or PHP mail.
    Save and retest mail settings after upgrading; old delivery confirmations are invalidated. Mail validation and test delivery require recent reauthentication and saved settings.
    Delegated administrators need admin_settings to access settings. admin_users alone no longer grants it; account, role and group changes cannot exceed delegated authority.
    Use SFTP instead of strict-mode legacy FTPS. Only an operator's explicit compatibility policy enables the legacy FTPS transport, with its documented certificate-verification limitation.

[3.1.1] - 2026-10-19
Security

    Require the fixed Alpine nghttp2 library in both PHP image stages to resolve CVE-2026-58055.
    Strengthen authorization snapshots and atomic state handling across file operations and metadata updates.

Fixed

    Preserve the requested navigation destination during mutation refreshes and keep file-action targets stable while navigating.
    Unify local and remote upload activation, quarantine handling and metadata lifecycle operations.
    Restore quick-administration rendering and reliable remote integration fixtures in clean checkouts.

Changed

    Update CodeIgniter to 4.7.5, Vue to 3.5.44 and the bundled SFTP implementation to phpseclib 4.0.2. SFTP no longer requires the optional SSH2 extension.
    Update Playwright and PHPStan and refresh reviewed dependency and deployment validation evidence.
    Gate release publication and all moving container aliases on the final archive and verified AMD64/ARM64 images.

v3.1.0
e0a02aa
What's Changed

    build(deps): bump gitleaks/gitleaks-action from 2.3.9 to 3.0.0 by @dependabot[bot] in #51
    build(deps-dev): bump the routine-updates group with 3 updates by @dependabot[bot] in #50
    build(deps): bump the routine-updates group with 3 updates by @dependabot[bot] in #54
    build(deps-dev): bump phpstan/phpstan from 2.2.13 to 2.2.14 in the routine-updates group by @dependabot[bot] in #53
    build(deps-dev): bump the routine-updates group with 2 updates by @dependabot[bot] in #52
    build(deps-dev): bump phpstan/phpstan from 2.2.14 to 2.2.15 in the routine-updates group by @dependabot[bot] in #56
    fix(deps): update source-map-js security fix by @soerennb in #61
    Fix native PHP-FPM production base URL discovery by @soerennb in #62
    Verify copied browser asset provenance and integrity by @soerennb in #63
    Include the spark CLI in release archives by @soerennb in #64