This release adds a couple of small CLI and JSON API improvements, announces the deprecation of the legacy JSON API v2 and of Secret Word authentication on the v3 API, and fixes several bugs — most notably a JSON API regression that broke every POST request and a split archive issue that could fail post-processing.
JSON API v2 and Secret Word authentication are deprecated
JSON API v2 and Secret Word authentication on the v3 JSON API are now deprecated. Both will be removed in version 11.0, planned for October 2027. If you use either of these, please migrate to the v3 JSON API with Joomla! user credentials before then.
POST requests to the v3 JSON API always failed
Any client sending a POST request to the v3 JSON API endpoint received an error instead of a valid response. GET requests were unaffected. This is now fixed.
JSON API: non-Super-User accounts can now use the API
The v3 JSON API now supports authenticating as a Joomla! user who is not a Super User, as long as that user has been granted the necessary Akeeba Backup privileges.
Split archives could fail post-processing
When a split archive's data happened to end exactly on a part boundary, backup created an extra, empty final part. Post-processing (uploading to remote storage) then failed with a “Missing input parameters” error. This is now fixed.
akeeba:profile:import can now target a specific profile
The akeeba:profile:import CLI command accepts a new --profile option to import into a specific profile ID, and a --force option to overwrite an existing profile instead of always creating a new one.
Other changes
- Log files are no longer created with a plain
.log extension. When a .log.php file would be blocked by the server, backup now falls back to a plain .php extension instead of .log, keeping log contents from being served as plain text.
- Failed JSON API authentication now fires the
onUserLoginFailure event, so login-failure plugins (e.g. brute-force protection) see these attempts.
akeeba:sysconfig:get and akeeba:sysconfig:set now report a proper error when a required argument is missing.- CLI commands now correctly treat their mandatory arguments as mandatory, and the CLI command reference no longer documents positional arguments as
--options. akeeba:backup:alternate, which was missing from the reference, has been added.
- The OAuth2 token refresh request now sends the correct cache-busting headers.
- Manage Backups and the Site Transfer Wizard now show the correct path when the output directory is missing or outside
open_basedir.
- The Options page's “Check for failed backups” section header now shows translated text instead of the raw language key.
- Corrected a handful of English, French, and Italian strings that displayed a literal backslash before an apostrophe, and translated three previously untranslated Site Transfer Wizard strings.
Changelog
New features
- akeeba:profile:import into specific profile ID with --profile, overwriting profile with --force
Bug fixes
- [LOW] CLI command reference documented positional arguments as --options
- [LOW] CLI commands treated mandatory arguments as optional
- [LOW] Failed JSON API authentication did not fire onUserLoginFailure
- [LOW] Manage Backups, Site Transfer Wizard showed wrong path when output directory missing or outside open_basedir
- [LOW] Some English, French, and Italian strings displayed a literal backslash before an apostrophe
- [LOW] The OAuth2 token refresh had wrong cache-busting headers
- [LOW] The Options page "Check for failed backups" section header had no language string, showing the raw key instead
- [LOW] Three Site Transfer Wizard strings were untranslated
- [LOW] akeeba:backup:alternate was missing from the CLI command reference
- [MEDIUM] POST requests to the v3 JSON API endpoint always failed
- [MEDIUM] Split archives could end in an empty part, failing post-processing with "Missing input parameters"
- [MEDIUM] akeeba:sysconfig:get and akeeba:sysconfig:set improper error when missing the argument
Miscellaneous changes
- JSON API v2, and Secret Word authentication on the v3 API, are deprecated; removal in 11.0, October 2027
- JSON API: support for non-Super-User accounts in the API
- Logs never created with .log extension; when .log.php is blocked we now use just .php