I had AI summarize a list of the things I believe are missing and needed in the next release of XenForo. I hope the XF Team starts making regular updates a thing for paying customers otherwise what is the value proposition.
1. PHP & Core Architecture Modernization
1. PHP & Core Architecture Modernization
- Native PHP 8.2/8.3+ Type System & Enums: Transition core XF\Mvc\Entity and Service classes away from docblock-only typing toward declare(strict_types=1);, native union/intersection return types, readonly properties, and Backed Enums for entity states (visible, moderated, deleted) instead of magic strings.
- Native PHP Attributes for Add-on Development: Allow developers to register class extensions, event listeners, routes, and permissions using native PHP 8 #[Attributes] directly in classes rather than clicking through the ACP Development UI for every single hook.
- Persistent CLI Queue Worker (xf:jobs-worker): Move beyond cron/page-trigger job execution by providing an official long-running CLI worker daemon (compatible with Supervisor/systemd and Redis) for instant background processing of emails, webhooks, and search indexing.
- First-Party Image Optimization (AVIF & libvips): Follow up on 2.3’s WebP support with native AVIF encoding and optional libvips support to drastically cut memory spikes during large image uploads compared to GD/Imagick.
- Strict Nonce-Based Content Security Policy (CSP): Provide a native ACP toggle to generate per-request cryptographic nonces for all <xf:js> and inline template scripts so admins can deploy a strict CSP without unsafe-inline.
- Argon2id Default & Hashed Tokens at Rest: Default new installations (and seamlessly rehash on login) to Argon2id where supported by PHP, and ensure all REST API keys, OAuth tokens, and remember-me cookies are stored as SHA-256 hashes in the database rather than plaintext/reversible strings.
- Passkey-Only / Enforced 2FA Per User Group: Upgrade WebAuthn support so admins can require phishing-resistant MFA (Passkeys/Hardware keys only, disabling email OTP fallback) for staff and sensitive user groups.
- Native Attachment EXIF/Metadata Scrubber: Automatically strip GPS coordinates and camera serial EXIF metadata at the byte level on upload (even when image resizing isn't triggered) to protect user privacy.
- Subresource Integrity (SRI) & Local Asset Bundling: Automatically generate integrity hashes for all external scripts/styles and remove remaining hard dependencies on third-party CDNs for privacy compliance.
- Automated "Trust Level" System (TL0–TL4): XenForo’s User Group Promotions are static and cumbersome compared to Discourse’s Trust Levels. Add a native progression engine that tracks time read, posts read, and flags received—automatically lifting link/media restrictions for vetted new users and granting self-moderation tools (like thread retitling or tag editing) to trusted regulars.
- Collaborative "Wiki" Posts: Allow the first post of any thread (or designated thread type) to be marked as a "Community Wiki," permitting users above a specific permission/trust threshold to collaboratively edit it with a full side-by-side revision history and rollback log.
- Native Real-Time Updates via SSE (Server-Sent Events): Without requiring a heavy Node.js setup, implement lightweight HTTP/2 Server-Sent Events (or optional WebSocket broadcasting) to show real-time "User X is replying..." indicators, live alert counters, and instant new-post notifications inside active threads.
- Topic Timers & Automated Thread Lifecycle: Give moderators and OPs native "Topic Timers" on threads—e.g., Auto-close after X days, Auto-close X hours after the last reply, Auto-bump, or Auto-delete/archive on a specific date.
- Interactive Thread Minimap & Summarize This Thread: For megathreads (50+ pages), add a Discourse-style vertical timeline scrubber alongside a "Summarize Thread" filter that dynamically collapses the thread view down to only the highest-reacted/most-quoted posts so latecomers can catch up in 2 minutes.
- Split/Branch Reply into New Thread (With Backlinks): Make it a single-click inline action for moderators (or users replying to a tangent) to "Reply as Linked Thread," automatically cross-linking the original post and the newly branched thread so off-topic derails are cleanly redirected.
Last edited:
