LoginSign Up
← Back to all sparks
J

Joomla

MKT AUTO
Velocity5.0

Open-source content management system for websites and portals

www.joomla.org ↗

Two security releases ship the same day, and 6.2 finally clears alpha

cmssecurity-releaseparallel-branchesbackportsbetaphp
◆Current state
Joomla is running three branches at once: 5.4.x as the maintenance line, 6.1.x as the current series, and 6.2.0 now in beta. On 18 August both maintenance branches shipped security releases hours apart — 5.4.8 with 32 merged PRs and 6.1.3 with four — each carrying the same 'install as soon as possible' banner. The release bodies remain download tables and SHA-256 checksums with the merged-PR list at the very end, so the actual change set is only readable from the tail.
◆Where it's heading
The paired-branch pattern that defined the last month has now completed a full cycle: rc1 on 11 August, rc2 on 15 August, finals on 18 August, both branches in lockstep. The fix content is defensive rather than additive — path-traversal checks in com_templates, an ACL check before exposing the user edit link, division-by-zero guards in ListModel and subforms, Smart Search memory limits. Meanwhile 6.2.0 moved from Alpha 3 to Beta 1 after four static weeks, pulling in 19 PRs that include a security flag for updates, secure article preview without frontend login, and a language fallback chain for the AI subsystem.
◆Prediction
Expect 6.2.0 to run a second beta before a release candidate, and the 5.4.x/6.1.x pair to resume their coupled patch cadence with the next rc pair a few weeks out.

◆Recent moves

  1. 13h ago

    6.2.0 reaches beta with secure article preview and update security flags

    The 6.2 branch clears alpha after four weeks parked at Alpha 3, taking 19 PRs from 22 contributors. The substantive items are a security flag for updates, secure article preview that no longer requires a frontend login, a webservices change splitting intro and full text on content GET, and a language fallback chain for the AI subsystem — feature work, but of the branch-stabilizing kind rather than anything that redirects the 6.x line.

    View source ↗
  2. 16h ago

    5.4.8 security release: path-traversal checks and ACL fix in the maintenance line

    The 5.4 line's security release lands the largest change set of the pair — 32 PRs from 30 contributors. The security-relevant work is concrete: path-traversal checks in com_templates, an ACL check before rendering the user edit link, and division-by-zero guards in ListModel and subforms. It ships the fixes its two release candidates staged over the preceding week.

    View source ↗
  3. 16h ago

    6.1.3 security release ships four backported fixes

    The 6.1 branch's half of the same-day security pair, carrying four PRs against the 5.4 line's 32 — filepatcher cleanup from the 6.1.2 hotfix, a tag batch-copy fix, and npm updates. The asymmetry is the point: the current series inherits far less remediation debt than the maintenance line it runs beside.

    View source ↗
  4. 3d ago

    6.1.3 RC2 stages the 6.1 security fixes

    The second release candidate for 6.1.3, superseded three days later by the final. Its content is the same four-PR set the shipped release carries, so it is a staging tag rather than a distinct event.

    View source ↗
  5. 3d ago

    5.4.8 RC2 stages the 5.4 security fixes

    The 5.4 half of the second RC pair, published 90 minutes after its 6.1 twin and superseded by the 18 August final. Paired-branch staging, not an independently shipped change.

    View source ↗
  6. 7d ago

    6.1.3 RC1 opens the August patch cycle

    The first release candidate of the 6.1.3 cycle, four days ahead of RC2 and a week ahead of the final. It marks the start of the August patch train rather than delivering anything users install.

    View source ↗