Buttondown vs Sulu

Sulu is a Symfony-based CMS for developer-built sites, released as a synchronised pair: every 3.0.x patch ships within a minute or two of the matching 2.6.x patch, carrying largely the same pull requests. The 3.0.9 / 2.6.26 pair is the most substantive in months. Media assets gain Origin and AI Disclosure information, delivered as a doctrine migration with new columns and an updated form metadata snapshot, and the AI platform integration now reports a reason when it turns a request down. Two-factor setup adds an authenticator app (TOTP) flow and a Google Authenticator method, and a deprecation batch retires AbstractRestController, RestControllerTrait, ApiWrapper and the persistence component repositories and traits.

Three threads run through the pairs and their balance has shifted. Editor and framework upkeep continue — Symfony 8 request bag replacements, PHPStan baselines kept green — but this release adds two things that aren't maintenance. The media provenance work puts AI disclosure into the content model itself rather than leaving it to editors, which is the shape of a CMS preparing for disclosure obligations. The controller and repository deprecations point the other way, at an API layer being cleared out ahead of whatever 3.x becomes, since 3.0 has otherwise read like a maintenance branch alongside 2.6.

Expect the deprecated REST controller and persistence layers to be removed in a future major, since deprecating four API surfaces in one release is how Sulu signals a rewrite is staged. Whether the AI disclosure fields are surfaced on the delivery side or stay editorial metadata isn't visible in these entries.