We released JForum 2.9.0, which has the following improvements:

Breaking change: JForum 2.9.0 requires a Servlet 6.0 compatible container like Tomcat 10.1 or Jetty 12 running on Java 11. The previous baseline of Tomcat 9 and Java 8 will no longer work.

During password recovery, JForum no longer says whether the account exists or not; this is in line with current security practices.

Fixed some potential XSS vulnerabilities (which would have been hard to exploit in practice)

Languages that haven't been updated for many years, and are now missing many translations, have been deactivated: NO, JP, HU, TR. All other languages have been brought up-to-date if they were missing translations.

removed ICQ and Skype (which have been turned off) from user profile

new feature: the POP3 mail integration can now import attachments from mails and save those along with the newly created posts (development sponsored by https://captaincasa.org/)

Attachments can be added by *Drag & Drop*, in addition to being uploaded explicitly

set Secure and HttpOnly flags on cookies

A full list of new features is at https://sourceforge.net/p/jforum2/wiki2/NewFeatures290/, upgrade instructions are at https://sourceforge.net/p/jforum2/wiki2/UpgradingFrom283to290/ and you can download it from https://sourceforge.net/projects/jforum2/files/. The documentation is at https://sourceforge.net/p/jforum2/wiki2/Documentation/

All feedback is welcome.