1.2.3 (10/29/2026)

• Fix: Screenshots in package

1.2.2 (10/25/2026)

• Fix: The test bootstrap (tests/codeception/_bootstrap.php) failed with a fatal error if HUMHUB_PATH pointed to protected/humhub instead of the root of the installation. It now accepts both, falls back to the default location and stops with a readable message that lists the paths it tried
• Docs: How to run the tests (codecept build first, HUMHUB_PATH)

1.2.1 (10/24/2026)

• Fix: Restore in the official Docker image. Module directories that contain no modules (such as the root owned @app/modules with only a .gitignore) are no longer part of a backup, and files that are identical to the backup are not rewritten, so they do not have to be writable. Backups that already contain such a directory can be restored as well
• Fix: Partial restores. Before anything is changed, every file that has to be overwritten is checked (writable, or new files creatable). If one cannot be written, the restore is refused and nothing is changed
• Fix: If a file part fails, the remaining parts and the database import are not started
• Security: For backups restored without a valid signature, the database client is started in restricted mode where available (--sandbox for MariaDB, --commands=OFF for MySQL 8.4+ for dumps without DELIMITER), so client commands in the dump cannot run
• Docs: Docker notes corrected (@app/modules is part of moduleAutoloadPaths but skipped because it contains no modules)
• Package: screenshots referenced in module.json; tests/error_log and the generated test files are no longer part of the package

1.2.0 (10/22/2026)

• Security: Backups are signed (HMAC-SHA256 with an installation specific key). A restore refuses archives without a valid signature unless the administrator explicitly confirms that an unsigned archive (or one signed by another installation) is trusted; archives that were modified after they had been signed are never restored. The signature is checked before the archive is parsed and again before anything is changed
• Security: The settings and the restore page warn if the backup directory is writable by other system users or owned by another user
• Enh: PHP namespace changed to humhub\modules\gmBackup. This only matters if you use the classes of the module in your own code
• Enh: Requesting a restore is logged as info instead of warning
• Enh: New module icon (solid background, white centred symbol, no text)

1.1.0 (10/21/2026)

• Enh: New setting "Compression". "Smaller" (gzip) and "Smallest" (bzip2) compress every module directory and the theme as one archive (solid compression) instead of file by file; bzip2 also compresses the database dump. The result is 15-45% smaller than before, depending on the content (source code compresses best). The default is unchanged ("Standard")
• Enh: Files that are already compressed (images, videos, archives, fonts, ...) are stored instead of being compressed again, which makes backups with many uploads faster
• Enh: Compressed parts are unpacked before a restore changes anything, so a damaged archive cannot cause a partial restore; the restore is refused up front if the server lacks the required PHP extension
• Enh: Unit tests for the solid archives (round trip, damaged and hostile archives) and for compressed backups

1.0.1 (10/20/2026)

• Fix: The backup directory check resolved symlinks only. Directories that are symlinked into the web root (e.g. @webroot/uploads -> /data/uploads in the Docker image) were accepted. The path is now checked as entered and resolved, and directories linked into the web root count as part of it
• Fix: Modules are no longer taken from @app/modules only. All paths of moduleAutoloadPaths except @humhub/modules are backed up and restored; the manifest records every path. A backup whose module directories are not configured on the target installation is refused with an explanation
• Enh: The job queue tables (queue, queue_exclusive) are excluded from the database dump, so jobs from the time of the backup do not come back after a restore
• Enh: Hint of the database option no longer refers to a box that is only shown when something is missing
• Enh: module_image.png compressed (1.6 MB -> 113 KB)
• Enh: Unit tests for the path handling and the archive validation
• Docs: README reduced to the feature overview, note that backups stay in the backup directory after uninstalling, notes on module paths, Docker and the queue tables
• Archive format version 3 (backups created by 1.0.0 cannot be restored)

1.0.0 (10/15/2026)

• Enh: Module id changed from backup to gm-backup (translation category GmBackupModule)
• Fix: HumHub 1.19 compatibility (humhub\helpers\Html, humhub\widgets\bootstrap\Button, humhub\widgets\form\ActiveForm)
• Enh: All actions are restricted to system administrators (before: ManageModules permission)
• Enh: Restore asks for an explicit confirmation on a dedicated page that lists what will be replaced (based on the archive contents), recommends a fresh backup and maintenance mode
• Enh: Restore runs as a queue job, validates the target locations before changing anything and reports parts that could not be restored instead of always showing success
• Enh: Modules, configuration, uploads and themes are resolved via path aliases (@app/modules, @config, @uploads, @themes); missing or partially readable parts are reported and recorded in backup-info.json
• Enh: Automatic backups are now scheduled via HumHub's hourly cron event
• Enh: A failing database dump now aborts the backup instead of storing an incomplete one; the schema-only fallback was removed
• Enh: MariaDB support (mariadb-dump / mariadb), requirement hints on the settings page, documentation of the requirements
• Enh: Backups are only allowed below @runtime or outside the web root; the database password is passed via a temporary option file
• Enh: Backup/restore state is kept per installation (file in @runtime) instead of per session
• Enh: Backups are written to a .part file first and renamed when complete; database dumps are added to the archive without loading them into memory
• Fix: Removed the misleading "database backup is disabled" hint
• Fix: Theme backup used a wrong path (protected/humhub/themes) and the theme name was not validated
• Removed: Dead code (AutoBackupJob, empty/unused methods, PDO restore fallback that split dumps on ;), restyling of core CSS classes
• Docs: Developer section moved to ?#developer, requirements in INSTALLATION.md, note that backups contain personal data, removed the "not for production" warning