v1.3.0 — Moderation, quality gates, and dependency refresh

Highlights

New Features

• PROJ-40 — Ticket Workflow Completion: Dmail notifications on ticket resolution, tag-based takedown post selection, duplicate ticket detection, per-type visibility rules, optimistic locking on claim
• PROJ-41a — Forum Vote Fixes: Unvote endpoint with AJAX UI, N+1 query optimization for vote display
• PROJ-44 — Post Flag Frontend: Category-aware flag dialog (replaces browser prompt), per-flag resolve buttons in moderate view, color-coded category labels, deletedIndex category filter, staff-only flag count on user profiles

CI & Quality Gates

• PROJ-47 — CI Quality Gates Activation: PHPStan Level 3 with baseline, PER-CS 2.0 formatting, asset-build verification, composer audit step
• SECURITY.md — Vulnerability reporting policy
• Dependabot — Automated weekly dependency updates for Composer and GitHub Actions
• Review instructions for ticket/takedown area

Dependency Updates

• PHPMailer 6.12 → 7.0.2
• PHPStan 2.1.39 → 2.1.46
• PHPUnit 13.0.3 → 13.1.1
• php-markdown 1.3 → 2.0.0
• php-cs-fixer/shim 3.94.0 → 3.94.2
• willpaginate 1.0.0 → 1.0.1
• GitHub Actions (checkout v6, cache v5, upload-artifact v5, codecov v6)

Bug Fixes

• PROJ-46 — Security sweep: 13 audit findings resolved
• PROJ-52 — QA findings cleanup: XSS escape in flash messages, blocked user Dmail skip, ticket index auth, migration rollback, flag dialog CSS extraction, redundant CSRF removal, forum pagination fix, unit tests for forum vote methods
• Fix duplicate Dmail on ticket re-resolve
• Fix broken reason_category validation in flag dialog
• Fix nullable type deprecations in ApplyService
• Fix picomatch CVE-2026-33672

Code Quality

• PER-CS 2.0 formatting applied across 400+ files
• PHPStan static analysis baseline established (7562 legacy entries at Level 3)
• install.php now sets bcrypt password hash for new installations

Tests

• Test suite expanded from 34 to 45 tests (116 → 136 assertions)
• New test coverage areas:
  • ForumPostVoteTest — Unvote logic, bulk score loading, bulk user vote loading, empty-input guards, method signatures (12 tests)
• All existing PostReplacement tests (StagingService, ApplyService) continue to pass
• Quality gate status: composer run test is enforced in CI — failing tests block merge

---

Changelog

All commits (22)

• 36cb5c4 fix(ci): regenerate PHPStan baseline after dependency upgrades
• 65f75f6 style: apply PER-CS 2.0 formatting across codebase
• f38028c feat: deliver PROJ-47 CI quality gates activation
• c9cc1a5 fix: deliver PROJ-52 QA findings cleanup (10 fixes)
• 16ba00f fix: resolve QA findings for PROJ-40 and PROJ-44
• 95822dd ci: bump actions/upload-artifact from v4 to v5
• 8407f2b ci: bump codecov/codecov-action from 4 to 6
• 18555de ci: bump actions/cache from 4 to 5
• 611be0f deps: bump phpmailer/phpmailer from 6.12.0 to 7.0.2
• bb8ed7c deps: bump php-cs-fixer/shim from 3.94.0 to 3.94.2
• 2f5e846 deps: bump phpunit/phpunit from 13.0.3 to 13.1.1
• 5bf9779 deps: bump railsphp/willpaginate from 1.0.0 to 1.0.1
• d734614 deps: bump michelf/php-markdown from 1.3 to 2.0.0
• 4f8b1ea deps: bump phpstan/phpstan from 2.1.39 to 2.1.46
• 6f23cd2 ci: bump actions/checkout from 4 to 6
• 75489fe chore: add SECURITY.md, dependabot, tickets review guide, composer audit in CI
• 036768e feat: deliver PROJ-44 post flag frontend + user statistics
• 6fccd1f feat: deliver PROJ-41a forum vote fixes (unvote endpoint + N+1 optimization)
• fc2daee feat: deliver PROJ-40 ticket workflow completion (backend)
• 2b0589a fix(deprecation): use explicit nullable types in ApplyService
• 5c1147a fix(security): deliver PROJ-46 security sweep — 13 audit findings resolved
• bd0935c fix(deps): update picomatch to 2.3.2 (CVE-2026-33672)

Full diff: v1.2.0...v1.3.0

v1.2.0 — Security, moderation, and compliance

A major update focused on security hardening, moderation tooling, and compliance infrastructure. 18 feature specs delivered across 166 changed files.

Security & Hardening

• CSRF protection — global before-filter with per-request token validation on all state-changing endpoints
• SQL injection sweep — parameterized queries across all raw SQL paths, input sanitization hardened
• Auth hardening — bcrypt password migration, session invalidation on password change, brute-force rate limiting
• API key management — scoped keys with usage tracking, expiration support, and rotation

Moderation & Admin Tools

• Post replacement workflow — staged uploads with admin approval, file validation, and audit trail
• Mod action log — structured audit log for all moderator actions
• Ticket & takedown system — user-facing ticket creation, DMCA takedown workflow with status tracking
• Upload whitelist — domain-based allowlist for URL uploads
• Exception log viewer — searchable error log with auto-pruning via background jobs

User Management

• Terms of Service gate — before-filter that blocks access until users accept the current ToS version, with admin version bump and HTTP 451 for API consumers
• User deletion — self-service account deletion with async cleanup of posts, comments, and related data
• Username change requests — moderated name change workflow with history tracking

Platform Infrastructure

• Background job scheduler — FOR UPDATE SKIP LOCKED for concurrent daemon safety, scheduled task support with configurable intervals
• Site settings store — key-value table for runtime config overrides (used by ToS version bump)
• Asset build tooling — CSS/JS compression, Brotli pre-compression, manifest management
• 12 new database migrations — all reversible with down() methods

Database

Run migrations after deploying:

php config/boot.php db:migrate

Full Changelog: v1.1.0...v1.2.0

v1.1.0 — Back from the dead

MyImouto is back. Originally created by Parziphal, the project sat untouched for several years. This release marks the start of active maintenance again.

What's new

• PHP 8.5 baseline — updated all dependencies and compatibility patches
• CI pipeline — GitHub Actions workflow for lint, tests, and static analysis on every PR
• Moebooru parity — stability fixes and core improvements ported from the original Ruby codebase

Pull Requests

• #1 — Update repo links and require PHP 8.5
• #2 — Add CI workflow (PHP Composer + PHPUnit)

Full Changelog: v1.0.8...v1.1.0