Changelog

Product history for Externa Core (what operators install). Newest first. Sourced from GitHub Releases, CHANGELOG.md, and closed milestone issues.

Pre-release betas may still change APIs and schema before GA. Prefer fresh installs or follow Upgrade carefully.

Externa Core

1.0.0-beta.3 — 2026-09-16

Last beta before GA: install/upgrade path, Docker ops depth, security CI, AI/DX, and release/API contracts. Release cut: PR #77. Milestone: 1.0.0-beta.3.

Install & upgrade

• Packagist / create-project — document composer create-project path for qiick/externa-core (#7; Packagist org submit may still be pending)
• Upgrade guide — backup → fetch tag → Composer → migrate → permission sync → frontend rebuild; optional externa:upgrade (#8)
• Interactive installer — guided .env + first-run setup via externa:install (#4)
• Backup & restore — self-hosted runbook for DB, storage/, .env, S3/Docker notes (#19)
• Production without Redis — database queue / degraded realtime path (#20)

Docker & ops

• Multi-arch images — linux/amd64 + linux/arm64 bake (#14)
• Managed Compose profile — app + workers only; external DB/Redis (#15)
• Reverse proxy cookbook — Caddy / Traefik / nginx, TLS, Reverb WebSockets (#17)
• Dev Container — one-click VS Code / Codespaces stack (#18)

AI & DX

• Embeddings for SearchSimilar — real embeddings when a provider is configured (#9)
• ManageRoles duplicate — AI tool can clone roles like the admin UI (#10)

Security & CI

• Composer / npm audit on PRs and main branches (#32)
• Dependabot for Composer and npm (#33)
• CodeQL + secret scanning hygiene for the public repo (#34)
• Lefthook / commitlint — optional local hooks; CI remains source of truth (#31)

Docs & release process

• Release process — CHANGELOG, semver, version bump, GitHub Releases (#22)
• API & GraphQL 1.x compatibility policy (#23)
• GA groundwork — security checklist pass, perf smoke, support window notes (#11)

Docs pages for this cut: Packagist, Upgrade, Backup & restore, Deployment, Reverse proxy, Production without Redis, Releasing, API compatibility, GA readiness.

1.0.0-beta.2 — 2026-09-16

Ops-first pre-release: Docker stacks, health probes, S3/MinIO-safe files, multi-DB CI, and product polish. Full notes: GitHub Release. Compare: v1.0.0-beta.1...v1.0.0-beta.2. Milestone: 1.0.0-beta.2.

Docker & ops

• Local + production Compose — compose.yaml, compose.prod.yaml, multi-stage Dockerfile, Docker CI (#12, PR #55)
• Health probes — GET /health/live and GET /health/ready for LB / Compose (#13)
• S3 / MinIO file storage — FILES_DISK + Flysystem AWS S3 adapter for multi-instance uploads (#16)

Databases & CI

• MySQL 8+ / MariaDB 10.6+ — first-class CI matrix + docs (#5)
• PostgreSQL Pest job — production-leaning driver in CI (#6, PR #53)

Features

• Duplicate non-system roles — clone Spatie permissions + matrices (#2, PR #52)
• Branded transactional email — logo / project_color / name from Appearance (#21, PR #54)

Docs

• README product narrative + UI screenshots (#3, PR #51)

Upgrade notes

• Compose app port defaults to :8000 — set COMPOSE_APP_URL accordingly
• Prefer S3/MinIO via FILES_DISK for multi-container file storage
• Wire LB/Compose checks to /health/live and /health/ready
• Laravel Herd local workflow unchanged

Release cut: PR #57.

1.0.0-beta.1 — 2026-09-13

First public beta. Milestone issues were thin (release cut only); history below is from the GitHub Release, CHANGELOG.md, and PR #1.

Content & collections

• Dynamic collections with a broad field-type set (text, markdown/WYSIWYG, files, relations, blocks/M2A, map, conditions, layout groups)
• Item revisions, activity, advanced multi-rule filters, form layout (tabs / accordion / DnD)
• Collection/field packs and SEO-oriented expansion helpers

Files

• Hierarchical file manager (tags, previews, async duplicate/zip jobs)
• Upload denylist, text sanitization, private file access paths
• Public files API with role-gated grants

Auth, roles & security

• Spatie RBAC + groups with effective role inheritance
• Optional TOTP 2FA and Fortify passkeys (secure context required for WebAuthn)
• Project-level two_factor_required, bounded inputs, HTML sanitization
• Operator threat model + SECURITY.md (host owns TLS / backups / network)

APIs

• Public REST CMS API (/api/v1) with API keys and collection permission matrix
• Opt-in ?include=, Origin allowlist / CORS, response cache controls
• GraphQL at /api/graphql
• Outbound webhooks

Collaboration

• Global chat hub: collection item threads + private/direct chats
• Unread, pins, attachments, realtime (Reverb/Echo when enabled)
• Per-user archive for private chats; notification mark-unread (no auto-read on drawer open)

Ops & admin UX

• Dashboard (activity, storage, upload health) + Health tab (Pulse/Horizon when enabled)
• Horizon / Reverb / Pulse wiring for the full stack; minimal stack runs without Redis
• i18n (en/it/de where shipped), project branding & appearance settings
• Optional AI assistant (OpenAI-compatible / LM Studio) scoped to the signed-in user’s permissions

Requirements (at cut)

Known beta notes (at cut)

• Browser FileManager CI job is fail-soft (product Pest suite remains the hard gate)
• Dependabot findings on the default branch triaged after this cut
• Kitchen Sink / local QA seeders are not shipped in the OSS tree

Docs site versions

This documentation site (externa-docs) versions separately from Core. Product features above always refer to Externa Core tags.

How maintainers cut Core releases: Releasing & versions.