Update since v0.5.0-beta.2

v0.6.0-beta.1 pre-release

• Security pass: stored-XSS fix with repair path, Host-header distrust for reset/canonical links, installer re-run guard with self-delete, server scripts refuse web execution
  
• Test suite is now deterministic — full regression run on every push
  

Mobile
Postbits stack under 760px, grids collapse cleanly, last-post cells show title/byline/date with truncation, reply text sits tight under quotes.

Plugin API
Display hooks (nav, userbox, profile, AdminCP), server-side postbit content, route registration, install/migrate/uninstall lifecycle, username flair everywhere.

Reliability
Double reports, concurrent mod-action races, reset-link reuse, proxy-wide login lockouts, and partial writes from crashed requests — all fixed with tests.

Nothing too exciting here but more to come as we march towards v1

v0.6.0-beta.2 — pre-release

Drop-in upgrade: upload the files, then run the database updates from AdminCP (new tables/columns only — migrations never touch your content).

New

• Plugin API: display hooks (nav row, userbox, profile, AdminCP nav + dashboard), server-side postbit content, route registration for plugin pages
  
• Plugin lifecycle: per-plugin migrations, enable/disable hooks, and a confirmed AdminCP uninstall that removes tables, settings, and files
  
• Username flair everywhere a name renders — threads, memberlist, profiles, PMs, alerts, reports, admin lists
  
• Mod queue stays inside AdminCP (/admin/reports — resolve and warn keep the admin chrome and return you to the queue you came from)
  
• Mobile finish: 360px pass, stacked last-post cells with truncated titles, tighter spacing under quotes
  

Fixed

• Double-clicking Report can no longer file it twice
  
• Password-reset links work exactly once, even if clicked twice at the same moment
  
• Two mods handling the same report can't double-punish anymore
  
• Login throttle counts per account, so one shared proxy can't lock out every login
  
• Topics, replies, moves, splits, merges, deletes, warns, and bans now save all-or-nothing (no more half-written states if something crashes mid-save)
  
• Forms ignore the second click while the first is still sending
  

Full list with file references, as always, in the changelog. Report anything odd with device + browser for layout stuff, steps to reproduce for the rest.