Posting in case it saves anyone else the couple of hours it cost me.

I installed the 4.7.0 security release (pkg_seblod_4.7.0.zip, dated 28-Jul-2026) over an existing 4.6.0 install on Joomla 5.4. The package installed successfully and the SEBLOD welcome screen appeared as expected — but Extensions → Manage still showed 4.6.0 for the component and every bundled extension afterwards, which naturally looked like the update had failed.

After digging in, the update had applied correctly. The issue is that the internal version strings were never bumped in this release:

• administrator/components/com_cck/manifest.xml → still <version>4.6.0</version>
• administrator/components/com_cck/_VERSION.php → still RELEASE = '4.6', DEV_LEVEL = '0'

...even though _CHANGELOG.php correctly lists:

--------------- 4.7.0 Upgrade Release [28-Jul-2026] ------------- * Security fixes

and the actual patched files (e.g. site/controller.php, admin/install/cms/dev/helper.php, lib/_/dev/helper.php) are dated 28-Jul-2026 and present on disk. I verified the live files matched the package byte-for-byte via md5, so the fix is genuinely in place.

Two problems this causes:

1. It's impossible to confirm you're patched from the admin UI — Manage will always report 4.6.0, so the update looks like it silently failed.
2. Anyone running version-based security monitoring (mysites.guru, scanners, etc.) will keep flagging patched sites as vulnerable, because all they can read is the version string.

Request to the team: could the manifest <version> and _VERSION.php be bumped to 4.7.0 in the package (or a re-rolled build), so installs report correctly and monitoring tools stop showing false positives? Right now the only way to distinguish a patched site from a genuinely-vulnerable 4.6.0 one is to inspect files on the server, which isn't practical at scale.

Otherwise — thanks for continuing to maintain SEBLOD and for getting the security fix out.

Appendix — verifying a patched install from the server

Paths below assume a standard Joomla layout; adjust the docroot to your site.

1. Confirm the 4.7.0 changelog entry is present (human-readable check):

grep -A1 "4.7.0 Upgrade Release" /path/to/site/administrator/components/com_cck/_CHANGELOG.php

Should return the 4.7.0 Upgrade Release [28-Jul-2026] line followed by * Security fixes.

2. Confirm the patched files match the release byte-for-byte (md5, from pkg_seblod_4.7.0.zip):

md5sum /path/to/site/administrator/components/com_cck/_CHANGELOG.php \
       /path/to/site/components/com_cck/controller.php

Expected values:

26afec4879c0aa50e49e7c873e80b094   _CHANGELOG.php   (administrator/components/com_cck/)
a041be518e26416551cce99058b3dd36   controller.php   (components/com_cck/  ← site, not administrator)

If both hashes match, the security fix is genuinely installed regardless of the "4.6.0" shown in Extensions → Manage.

Files updated in the 4.7.0 release (dated 28-Jul-2026), for reference:

• components/com_cck/controller.php (site controller)
• administrator/components/com_cck/install/cms/dev/helper.php
• administrator/components/com_cck/_CHANGELOG.php
• libraries/cck/_/dev/helper.php (from the bundled lib_cck library)