Grav CMS - Package Updates

[Package Updates]

[2.2.3]

• Update grav to 2.2.3
• Full Changelog
• Updated Twig to 3.30 (through Grav's getgrav/Twig fork), which brings upstream's fixes since 3.29, among them faster object attribute reads and macros declared by a parent template, a for loop variable that was undefined inside a nested loop's sequence, and the spread operator now rejected outside sequences, mappings and call arguments.
• Theme and plugin templates now compile without any of the Twig sandbox's checks, which only ever apply to Twig in page content, so pages render faster (about half the Twig time on a busy listing template, within a few percent of running with no sandbox at all). Twig in page content, and any template rendered with the sandbox switched on, is checked exactly as before. That includes a theme template that was already loaded when a {% sandbox %} block or a sandboxed include reaches it, along with its blocks, macros and parent: it renders from a separately compiled copy with every check in place, so it gives the same output, and blocks the same things, as before. This uses a new opt-in feature of Grav's Twig fork (getgrav/Twig), so it needs that fork's matching commit.
• Grav's Twig now refuses a template loaded by a different Twig environment when one is passed to include() or {% include %}, the same as Twig itself does, instead of rendering it with the other environment's settings. A template object from Grav's own environment passed on its own now renders instead of failing with a type error.

[Package Updates]

[2.2.4]

• Update grav to 2.2.4
• Full Changelog
• A page's Markdown version (<route>.md) and llms-full.txt include the full page again on sites running the Archives plugin, instead of only a title and navigation links #4339
• An uploaded SVG whose doctype declares entities is no longer emptied by the sanitizer (rhukster/dom-sanitizer 1.0.19)
• A multisite that keeps each site in user/env/<host>/ loads its theme, plugin and media files again. The bundled server configs protect config/, accounts/ and data/ inside each env folder the same way they protect them in user/, and the upgrade updates an existing .htaccess, and the user/env/.htaccess an earlier upgrade added, to match. Sites on nginx, Caddy, lighttpd or IIS need to copy the new rules from webserver-configs/ by hand #4335
• Saving a page whose blueprint has a list containing only an elements field no longer fails with an error, and the fields inside each element now belong to their list item instead of the top of the blueprint, where they could clash with a field of the same name (rockettheme/toolbox 2.0.1) #4337

[Package Updates]

[2.2.5]

• Update grav to 2.2.5
• Full Changelog
• Twig in page content can use the guard tag to check that a function, filter or test exists before calling it #4341
• Folder settings in a .env file, such as GRAV_BACKUP_PATH and GRAV_TMP_PATH, now apply on hosts that turn off PHP's putenv() for web requests, and no longer write an error to the log on every request #4344
• An SVG with only a viewBox now reports its real width and height, a viewBox separated by commas is understood, and a relative width such as 100% is no longer read as 100 pixels #4347
• A redirect with a status code followed by a query string, such as /new[301]?a=1&b=2, is now sent with that status code and without the [301] in the address, instead of as a 302 to an address containing it #3320 #4343
• A page's group permissions now deny every letter after a - up to the next +, so -c+r-ud, which the Admin saves for create, update and delete denied, no longer allows delete #4340
• Query parameters reach the Admin and API on web servers that rewrite to index.php without passing the query string on, such as an nginx try_files line missing ?$query_string, so switching the editor to another language no longer loads the default language's page #4338
• A form field directive written in page frontmatter can now only check whether its Flex object exists; directives in blueprint files are unchanged
• The current page address no longer includes the visitor's HTTP Basic username and password when it is printed or turned into an array, and Uri::user() and Uri::password() are empty for the current request

[Package Updates]

[2.2.6]

• Update grav to 2.2.6
• Full Changelog
• With the logs or cache folder moved by GRAV_LOG_PATH or GRAV_CACHE_PATH, the cache and backup jobs write their output to the moved logs folder, a job's output: can be a log:// path, and bin/grav cache-cleanup and the GPM permission check find the moved cache folder. Thanks @onetrev #4344
• Scheduler history files older than the retention_days setting are now deleted, instead of collecting forever #4344

[Package Updates]

[2.2.7]

• Update grav to 2.2.8
• Full Changelog
• Plugins can react when an image is loaded with the new onImageMediumReset event, for example to queue a watermark or other action on every image from its own metadata
• Setting only watermark_all for images in system.yaml no longer removes the watermark image, position and scale settings, and the watermark settings can now be edited in the Admin under Images
• The scheduler log no longer gets two lines written every minute when no job was due; runs that do work still log their full detail. Thanks @onetrev #4355
• The compiled config, blueprints and languages caches are written to a temporary file and moved into place, and a damaged one is rebuilt, so a request arriving while the cache is being rewritten no longer fails with a blank error page. Thanks @omega8cc #4356
• The scheduler's run summary in scheduler.log counted each successful job twice

[Package Updates]

[2.2.8]

• Update grav to 2.2.9
• Full Changelog
• Adding an environment folder such as user/env/<host>/ no longer creates a new security key for that host, which broke forms and sessions signed with the old one. The key stays in user/config, and a copy an earlier version put in an environment folder is moved there
• A plugin or theme zipped from inside its own folder, or a zip made on macOS with a __MACOSX folder, now installs with bin/gpm direct-install and the admin's install-from-zip instead of failing with "Not a valid Grav package". Thanks @wakqasahmed #2688 #4357
• Sites on PHP-FPM pools that disable getmypid() (a common hardening) no longer fail when the page index is rebuilt: its temporary database file is named with a random string instead of the process id. The scheduler's whoami() also checks for get_current_user() before calling it

[Package Updates]

[2.2.9]

• Update grav to 2.2.10
• Full Changelog
• With images.watermark.watermark_all on, every image now gets the watermark, not only images with a resize or other action. A 1x image made from an @2x file and a framed image are stamped once, and retina alternatives are kept. Thanks @HawkForge #4359 #4360
• A remote CSS or JS file in the asset pipeline (a CDN stylesheet, for example) now gives up after 5 seconds if its server doesn't answer (set with the new assets.pipeline_remote_timeout option in system.yaml), instead of holding the page until PHP's max_execution_time ends it with a 503. When a remote file can't be downloaded, its group is not cached: that request renders each file as its own tag, and the next request tries the download again

[Package Updates]

[2.2.10]

• Update grav to 2.2.11
• Full Changelog
• A licence key saved with a stray space in the product slug or the key itself ( lightbox-gallery, for example) now works for installs and updates. Spaces are trimmed when a key is saved, and keys already saved that way are read correctly
• An image pasted into the editor as inline data (a data: image) now shows on the frontend. Grav was turning the + characters in the image data into spaces, which also affected image paths with a + in them such as a+b.png getgrav/grav-premium-issues#628

[Package Updates]

[2.3.0]

• Update php-base | final to 8.5-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[2.3.1]

• Update grav to 2.2.12
• Full Changelog
• The scheduler webhook now also runs jobs that missed their time since the last call, so a site pinged hourly (or late) no longer skips jobs set for another minute. Add ?mode=due for the old behaviour. The scheduler health check now warns when a job is behind schedule, instead of five minutes after the last run getgrav/grav-plugin-scheduler-webhook#9
• Admin listings of a folder with thousands of pages no longer reload the folder once for every page in it, which made them slow and could run out of memory with caching on getgrav/grav-plugin-admin2#200
• A scheduled backup no longer fails with "ZipArchive::close(): Unexpected length of data" when another job changes a file in the site while the backup is being written. The backup is built again (up to three tries), and if it still can't be written, it is marked as failed while the rest of the scheduler run carries on. A failing job used to stop the whole run, so the jobs after it never ran and none of their results were saved

[Package Updates]

[2.3.2]

• Update grav to 2.2.13
• Full Changelog
• [security] A field in a page's Flex form override keeps the stricter rules for dynamic options after it is merged into the directory blueprint, however it is renamed or numbered. Thanks @soquip
• [security] Page content is now checked for unsafe markup as though its Twig runs, even when Twig is off for that page, since a later move or rename can turn it into a module. Thanks @vLWa7ch
• [security] Flex user accounts: an account without super-admin access can no longer edit or delete a super-admin account through a Flex form, and a submitted password hash is ignored when an account is saved. Thanks @manus-pi
• [security] Flex page storage now refuses a folder, template or language that is not a plain name. Thanks @shm0x00
• [security] Images referenced by stream URI in page content, the watermark image and media_directory() now only come from media folders (pages, images, media, themes, plugins), configurable with the new security.media.allowed_roots setting. Thanks @123abab123789