From 5f656a325527799dffa63496b0ed842c26a896a7 Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Sun, 5 Jul 2026 17:05:58 -0500 Subject: [PATCH] docs(changelog): backfill 02.56.07 (security/integrity) and 02.56.08 (component fix) Both releases shipped with empty changelog sections (the auto-promote moved an empty [Unreleased]). Backfill what actually shipped and de-duplicate the doubled version headers. Claude-Session: https://claude.ai/code/session_01WbGBN9VyRK61zczYWcCQ2i --- CHANGELOG.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9792d5fa..47332a0d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,11 +3,23 @@ ## [02.56.08] --- 2026-07-05 -## [02.56.08] --- 2026-07-05 +### Fixed +- Component manifest `` reverted to the element-safe `MokoSuiteBackup`. The "Type - Name" display convention made Joomla derive the component element as `com_component-mokosuitebackup`, registering a duplicate component and leaving the real `com_mokosuitebackup` orphaned on the old version — the admin component appeared "stuck" and served the old UI (broken remote-destinations tab, legacy fields). (#213) ## [02.56.07] --- 2026-07-05 -## [02.56.07] --- 2026-07-05 +### Security +- Mask the FTP password in `AjaxController::maskSecrets()`/`mergeExistingSecrets()` — stored FTP remotes no longer leak their password via `listRemotes`. (#169) +- Stop the API single-item view (`Backups/JsonapiView`) leaking the server `absolute_path`. (#187) +- SFTP uploader uses `StrictHostKeyChecking=accept-new` instead of `no`. (#182) + +### Fixed +- `DatabaseDumper` writes a real newline after `DROP TABLE` (was a literal `\n`), fixing streamed dumps. (#179) +- Profile-picker forms order by `id` instead of the dropped `ordering` column (query failed on upgraded sites). (#180) +- `uninstall.mysql.sql` now drops the snapshots table. (#181) +- CLI snapshot delete uses the real `data_file` column (was `file_path`, so files were never removed). (#184) +- Remove the duplicate pre-update backup — the content plugin no longer subscribes to `onExtensionBeforeUpdate` (owned by the system plugin). (#186) +- `DatabaseImporter` collects non-fatal statement errors (`getErrors()`/`hasErrors()`) so restores are no longer silent. (#188) ## [02.56.05] --- 2026-07-05