XF 2.4 XenForo 2.4 status and what's new under the hood?

Where are we?​

XenForo Community PSD Edit (1).webp
TL;DR: We're working hard to release XenForo 2.4 ASAP, but it's taking longer than expected due to scope changes and strategic decisions to wait for certain upstream developments that will benefit the long-term roadmap. Here's an analogy to explain why:

Software development is like planning a cross-country expedition with multiple destinations.

When you set out for version 2.4, you're not just driving to the next town over. You're charting a course through unknown territory with several strategic stops planned along the way - each representing a major milestone or feature release.

But the challenge is the landscape keeps changing along the journey.
  • New roads open up (better technologies emerge)
  • Bridges get washed out (dependencies break or become obsolete)
  • You discover scenic routes that would benefit all future travellers (opportunities for architectural improvements)
  • Weather conditions shift (market demands or user needs evolve)
  • Your vehicle needs unexpected maintenance (technical debt must be addressed)
You can't just focus on reaching the immediate next stop. You must consider how each decision affects the entire journey ahead. Taking a shortcut to reach 2.4 faster might leave you stranded when trying to reach 3.0, 4.0 or even 5.0.

This is why scope changes occur: experienced developers are constantly recalibrating the route based on new information, ensuring the expedition can successfully reach not just the next destination, but all the strategic waypoints that follow.

The delays aren't detours, rather they're course corrections that keep the long-term journey viable.

To be slightly less cryptic, these are some of the specific challenges we have faced along the way:

A new Tiptap version is coming​

When we announced that Tiptap is coming to XenForo 2.4 it was 95% complete, and we then took a bit of a pause to work on other projects, which we have talked about since and will be discussing in this thread. Since then, Tiptap have announced Tiptap V3 which is currently in beta. Given how core the editor is to the forum experience, it makes a lot of sense to ship XenForo 2.4 with Tiptap V3 rather than Tiptap V2 as originally planned. While the changes involved are not too extensive, we also don't want to ship 2.4 with a dependency that is still in beta and subject to change. While we are not planning to wait for Tiptap V3 to be stable, necessarily, we do at least want to give it a little bit more time so we have a higher degree of confidence that we're shipping a stable editing experience.

We started talking about a rewrite (again)​

While this is not currently the direction we've decided to go in, it's responsible for us to at least consider all routes available to us to help us reach our destination.

1749736697928.webp


After nearly 8 years since the release of XenForo 2.0, many of the technologies we use are showing their age, many of the decisions we made have started to slow us down more than we would like, and as a framework, XenForo becomes a less productive framework to work with. The solution to this problem can be to start from scratch, but we have ultimately decided that this is not something we need to do at this stage.

Instead, over the next few versions, including 2.4, we will be attempting to make iterative architectural changes to the framework so that we all have greater tools at our disposal to improve both the developer and user experience, particularly focusing on the implementation of developer tools and features that have become commonplace in other frameworks, such as Laravel.

Some of our best features are simply not finished​

There are one or two features that we see requested consistently from customers in our community forums and feedback channels, and we're excited to confirm they are coming in 2.4! However, it serves no one well if we release such highly-anticipated features before they are ready and before they have the usual level of quality, polish, and extensibility you would expect from a XenForo release. We'd rather take the extra time to get them right than rush them out and disappoint users with a subpar implementation that requires immediate patches or lacks the flexibility for customisation. We'll be sharing exciting details about what these features are and how they work in the coming weeks, so stay tuned!

We can't keep up!​

I just counted and there are about 15 features that have been merged or are pending to be merged into XF 2.4 that we haven't announced yet. Some of these are smaller and aren't worthy of a dedicated HYS of their own (so they'll probably be rolled into a "miscellaneous" HYS or two), and some of these are going to be mentioned below, but while we have been "cooking" (as the kids say these days) it has meant that things like code reviews, and writing HYS posts hasn't been easy to balance. There is also potentially more stuff coming from generous contributions from esteemed developers such as @Xon and @digitalpoint, assuming we have time to implement (otherwise they will wait for... a future version).


With all of that now being said, while 2.4 is taking longer than we wanted, we have been busy and we are very much nearing the end of development.

And, while disappointing (to all of us) it is important to maintain perspective. XenForo 2.2 was released in September 2020. XenForo 2.3 was released nearly four years later. XenForo 2.4 is not 3 more years away.

But, you clicked this to find out what's new, right? So let's go.
 
Last edited:
I also struggle to believe that phpbb, SMF and all the rest have had several security releases while xenforo has none... I can't believe that there aren't any holes in this code while there is in all the others? Feel free to correct me, but it is something that concerns me.
While for the innocent your observation makes sense reality is more complex. However, given your earlier statement...

I've worked in software development for over a decade and I've never seen such a mess of communication and lack of progress. This just feels like a hobbyist organisation pretending to be a professional one.

... your post is a little surprising as you should know better and not be part of the innocent brigade, judging from the very strong opinion you have. However: There is no such thing as "bugfree software" (the software closest to that was probably TeX) . When limiting to security related issues it becomes a little bit more difficult: There are patterns, guides and best practices in the areas of coding, architecture and craftsmanship that lead to a more secure software than if you ignore them. Still, issues may be there (and potentially will be) - but you won't know until they are discovered. The general perception is that XF has a very good code quality, far above the average. I can't judge as I am not a coder and I can even less judge on other software but in general a small team of skilled engineers with high coding standards, a good architecture and as little complexity as possible foster safe software. XF seems to follow that route - which, to a degree - explains both: Few security updates (as they are rarely needed due to the code quality) and slower development than others (that fire out releases but do not care too much for code quality or coding standards, with issues as a result). Whenever a security issue is found in XF it gets fixed quickly, judging from the history. If none is found there is no need for a fix release - pretty simple. Anyway it is not true that XF has "none". Just look at the announcement forums:

Bildschirmfoto 2025-10-24 um 11.20.10.webp


Two updates explicitly labeled as "Security Fixes" in 2025 until now. So it seems a bit you are comparing apples to oranges while having no clue about fruit anyway plus not looking at the amount of apples at all (while falsely stating there would be none). ;)

What would you prefer:

• A sorrowfully coded software where rarely occuring security issues get fixed fast (and even backported to earlier versions)

or

• A software that continuously fires out security fixes in high frequency because it has to (probably partly due to low code quality, low coding standards, aged code and bad architecural decisions).

I know what I would choose...
 
Last edited:
You make excellent points, although I think the sweet spot is somewhere in between our perspectives :)
Do you know of a security issue in XenForo? Did you look at the code? If not: Would you feel better if XF released a monthly security update with nothing in it but dummy code? It would be a total security theatre - but silence your criticism (despite in fact there would not be a difference vs. not releasing such an update)...
 
Do you know of a security issue in XenForo? Did you look at the code? If not: Would you feel better if XF released a monthly security update with nothing in it but dummy code? It would be a total security theatre - but silence your criticism (despite in fact there would not be a difference vs. not releasing such an update)...
Start here https://xenforo.com/community/forums/bugs/
 
Do you know the difference between a bug report, a confirmed functional bug, a bugfix release and a security issue and a security release? Seems not to be the case. Or you just want to troll.

While the responsiveness towards bug reports leaves a lot to be desired (to say it politely) - a fact that I have often stated in the past - it is a completely different topic from the wish for higher frequent security fix releases, no matter if there is a security issue or not.

However: Dummy releases that contain no actual code change at all but only bogus could also help against the moaning there would be too few releases...
 
Do you know the difference between a bug report, a confirmed functional bug, a bugfix release and a security issue and a security release? Seems not to be the case. Or you just want to troll.

While the responsiveness towards bug reports leaves a lot to be desired (to say it politely) - a fact that I have often stated in the past - it is a completely different topic from the wish for higher frequent security fix releases, no matter if there is a security issue or not.

However: Dummy releases that contain no actual code change at all but only bogus could also help against the moaning there would be too few releases...
Must have went over your head when acting like new XF releases would be unneeded or just “dummy code” as you were portraying earlier. Maybe start being honest here in the conversation for once.
 
Must have went over your head when acting like new XF releases would be unneeded or just “dummy code” as you were portraying earlier.
My understanding of that was that if a security fix was not actually needed (if there are no security issues) there could be a release that didn’t actually do anything, but would satisfy those people who complain about not enough releases. Or maybe not.
 
Back
Top Bottom