Joomla Extension Updates Can Now Be Flagged as Security Releases
Until 29 September 2026, a Joomla extension developer had no way to tell a site’s administrator that an update fixed a security problem. The update manager listed a security release exactly like a release that changed a button colour, and the only signal was whatever the changelog said, if anyone opened it. Joomla 5.4.9 and 6.1.4, released on 29 September 2026, changed that. Your update XML can now include a <security> element, and Joomla turns it into a “Security release level” badge in the update manager and a warning on the administrator’s Home Dashboard.
u/mySitesGuru — 10 days ago