Externa Core 1.0.0 — first stable GA

On 21 September 2026 we cut Externa Core v1.0.0, the first stable (GA) release. It builds on the public betas (v1.0.0-beta.1 … beta.4) with install and Docker DX, webhook hardening, and admin polish. Full notes: GitHub Release v1.0.0 · docs Changelog.

Who this is for

• New operators starting a self-hosted Externa instance.
• Beta testers on 1.0.0-beta.4 who need a clear path to stable.

If you already run a newer tag (1.1.x / 1.2.x), this post is historical — jump to the 1.1.0 or 1.2.0 notes instead.

What changed for users

Install path is Packagist-first

Stable install is:

composer create-project qiick/externa-core externa-core
cd externa-core
php artisan externa:install

create-project copies the app tree once. It is not the update channel — later releases come from Git tags / Docker image pins, then php artisan externa:upgrade (migrate / permissions / cache). See Upgrade and Quick Start.

Docker quick-deploy

GHCR multi-arch images on v* tags, compose.quick.yaml, gated RUN_SEED on first boot, and healthchecks landed for operators who prefer Compose over Herd. Docs: Deploy with Docker.

Webhook signing secrets are mandatory

Outbound webhooks refuse delivery when the signing secret is empty (no empty-key HMAC). Configure a secret on every webhook before you expect deliveries. This was deferred from beta.4 and is a behavior change vs earlier betas.

Opt-in upstream sync

php artisan externa:upgrade --sync-upstream=vX.Y.Z can merge the official tag into your tree when you choose to. Default externa:upgrade still only migrates, syncs permissions, and clears caches — it does not pull code.

Admin polish

Drag-and-drop reorder for M2A blocks and unified single-line field control heights shipped in the same cut.

Upgrade steps

Fresh install

Follow Quick Start: composer create-project → php artisan externa:install → open APP_URL.

From 1.0.0-beta.4

1. Back up the database and .env (Backup & restore).
2. Bring code to tag v1.0.0 (git checkout/merge or Docker image ghcr.io/qiick-io/externa-core:1.0.0).
3. Run:

composer install
npm ci && npm run build
php artisan externa:upgrade
# or: php artisan migrate --force && php artisan permissions:sync && php artisan optimize:clear

4. Set a signing secret on every outbound webhook.
5. Restart queue workers (and Reverb/Horizon if you use them).

Breaking / behavior notes

• Empty webhook signing secrets → no delivery until configured.
• Requirements at GA: PHP 8.4+ (composer ^8.4), Node 24 for the admin frontend build. Prefer patched PHP 8.4.27+ or 8.5.12+ on new hosts.

Sources

• GitHub Release v1.0.0
• Changelog (docs) · Upgrade · Releasing & versions