Grav CMS - Package Updates

[Package Updates]

[2.2.5]

• Update grav to 2.2.5
• Full Changelog
• Twig in page content can use the guard tag to check that a function, filter or test exists before calling it #4341
• Folder settings in a .env file, such as GRAV_BACKUP_PATH and GRAV_TMP_PATH, now apply on hosts that turn off PHP's putenv() for web requests, and no longer write an error to the log on every request #4344
• An SVG with only a viewBox now reports its real width and height, a viewBox separated by commas is understood, and a relative width such as 100% is no longer read as 100 pixels #4347
• A redirect with a status code followed by a query string, such as /new[301]?a=1&b=2, is now sent with that status code and without the [301] in the address, instead of as a 302 to an address containing it #3320 #4343
• A page's group permissions now deny every letter after a - up to the next +, so -c+r-ud, which the Admin saves for create, update and delete denied, no longer allows delete #4340
• Query parameters reach the Admin and API on web servers that rewrite to index.php without passing the query string on, such as an nginx try_files line missing ?$query_string, so switching the editor to another language no longer loads the default language's page #4338
• A form field directive written in page frontmatter can now only check whether its Flex object exists; directives in blueprint files are unchanged
• The current page address no longer includes the visitor's HTTP Basic username and password when it is printed or turned into an array, and Uri::user() and Uri::password() are empty for the current request

[Package Updates]

[2.2.6]

• Update grav to 2.2.6
• Full Changelog
• With the logs or cache folder moved by GRAV_LOG_PATH or GRAV_CACHE_PATH, the cache and backup jobs write their output to the moved logs folder, a job's output: can be a log:// path, and bin/grav cache-cleanup and the GPM permission check find the moved cache folder. Thanks @onetrev #4344
• Scheduler history files older than the retention_days setting are now deleted, instead of collecting forever #4344

[Package Updates]

[2.2.7]

• Update grav to 2.2.8
• Full Changelog
• Plugins can react when an image is loaded with the new onImageMediumReset event, for example to queue a watermark or other action on every image from its own metadata
• Setting only watermark_all for images in system.yaml no longer removes the watermark image, position and scale settings, and the watermark settings can now be edited in the Admin under Images
• The scheduler log no longer gets two lines written every minute when no job was due; runs that do work still log their full detail. Thanks @onetrev #4355
• The compiled config, blueprints and languages caches are written to a temporary file and moved into place, and a damaged one is rebuilt, so a request arriving while the cache is being rewritten no longer fails with a blank error page. Thanks @omega8cc #4356
• The scheduler's run summary in scheduler.log counted each successful job twice

[Package Updates]

[2.2.8]

• Update grav to 2.2.9
• Full Changelog
• Adding an environment folder such as user/env/<host>/ no longer creates a new security key for that host, which broke forms and sessions signed with the old one. The key stays in user/config, and a copy an earlier version put in an environment folder is moved there
• A plugin or theme zipped from inside its own folder, or a zip made on macOS with a __MACOSX folder, now installs with bin/gpm direct-install and the admin's install-from-zip instead of failing with "Not a valid Grav package". Thanks @wakqasahmed #2688 #4357
• Sites on PHP-FPM pools that disable getmypid() (a common hardening) no longer fail when the page index is rebuilt: its temporary database file is named with a random string instead of the process id. The scheduler's whoami() also checks for get_current_user() before calling it

[Package Updates]

[2.2.9]

• Update grav to 2.2.10
• Full Changelog
• With images.watermark.watermark_all on, every image now gets the watermark, not only images with a resize or other action. A 1x image made from an @2x file and a framed image are stamped once, and retina alternatives are kept. Thanks @HawkForge #4359 #4360
• A remote CSS or JS file in the asset pipeline (a CDN stylesheet, for example) now gives up after 5 seconds if its server doesn't answer (set with the new assets.pipeline_remote_timeout option in system.yaml), instead of holding the page until PHP's max_execution_time ends it with a 503. When a remote file can't be downloaded, its group is not cached: that request renders each file as its own tag, and the next request tries the download again

[Package Updates]

[2.2.10]

• Update grav to 2.2.11
• Full Changelog
• A licence key saved with a stray space in the product slug or the key itself ( lightbox-gallery, for example) now works for installs and updates. Spaces are trimmed when a key is saved, and keys already saved that way are read correctly
• An image pasted into the editor as inline data (a data: image) now shows on the frontend. Grav was turning the + characters in the image data into spaces, which also affected image paths with a + in them such as a+b.png getgrav/grav-premium-issues#628

[Package Updates]

[2.3.0]

• Update php-base | final to 8.5-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[2.3.1]

• Update grav to 2.2.12
• Full Changelog
• The scheduler webhook now also runs jobs that missed their time since the last call, so a site pinged hourly (or late) no longer skips jobs set for another minute. Add ?mode=due for the old behaviour. The scheduler health check now warns when a job is behind schedule, instead of five minutes after the last run getgrav/grav-plugin-scheduler-webhook#9
• Admin listings of a folder with thousands of pages no longer reload the folder once for every page in it, which made them slow and could run out of memory with caching on getgrav/grav-plugin-admin2#200
• A scheduled backup no longer fails with "ZipArchive::close(): Unexpected length of data" when another job changes a file in the site while the backup is being written. The backup is built again (up to three tries), and if it still can't be written, it is marked as failed while the rest of the scheduler run carries on. A failing job used to stop the whole run, so the jobs after it never ran and none of their results were saved

[Package Updates]

[2.3.2]

• Update grav to 2.2.13
• Full Changelog
• [security] A field in a page's Flex form override keeps the stricter rules for dynamic options after it is merged into the directory blueprint, however it is renamed or numbered. Thanks @soquip
• [security] Page content is now checked for unsafe markup as though its Twig runs, even when Twig is off for that page, since a later move or rename can turn it into a module. Thanks @vLWa7ch
• [security] Flex user accounts: an account without super-admin access can no longer edit or delete a super-admin account through a Flex form, and a submitted password hash is ignored when an account is saved. Thanks @manus-pi
• [security] Flex page storage now refuses a folder, template or language that is not a plain name. Thanks @shm0x00
• [security] Images referenced by stream URI in page content, the watermark image and media_directory() now only come from media folders (pages, images, media, themes, plugins), configurable with the new security.media.allowed_roots setting. Thanks @123abab123789

[Package Updates]

[2.3.3]

• Update grav to 2.2.14
• Full Changelog
• Disabled plugins are no longer loaded, so a disabled plugin with code that doesn't work on this version of Grav can't take the site down, and requests do less work. A disabled plugin is still listed with its settings, and its class still loads if another plugin asks for it. Thanks @NoNoNo #4374
• CSS with a long quoted string or comment (such as an inlined data: URI) minifies again instead of failing with a PCRE error, and a very large data: URI no longer empties the whole stylesheet from the bundle. Thanks @NoNoNo #4372
• Inline JavaScript added with loading: 'inline' no longer renders a stray inline attribute on its script tag, and an inline JS module keeps its code when the pipeline is off. Thanks @NoNoNo #4373

[Package Updates]

[2.3.4]

• Update grav to 2.2.15
• Full Changelog
• Page ids: a page folder can carry a hidden .page-id file holding a permanent id (a UUID) that stays with the folder however it is renamed, reordered or moved, in Admin, with git or over FTP. Read it with $page->uuid() and find a page by it with $pages->findByUuid(); Grav\Common\Page\PageIdentity writes ids, finds a folder by its id after a move, and decides which folder keeps an id that a copy made outside Grav duplicated (the older .page-id wins). Ids are off unless a plugin needs them: it calls PageIdentity::enable() in onPluginsInitialized, or a site sets system.pages.uuid: true, and then saving or creating a page gives its folder an id and a copied page gets its own. bin/grav page-ids gives every page folder an id and reports duplicates, and tells the pages cache so the next request finds the new ids. The file is hidden, so it never shows as a page file or as media, and a page folder moved to another disk (where Grav copies it instead of renaming it) takes its ids with it. Two requests saving one new page at the same moment give it one id, not two
• A scheduler custom job or backup profile added in the admin and saved without being filled in no longer breaks the scheduler: it is skipped, so the other jobs still run and the job list, health check and webhook keep working getgrav/grav-plugin-scheduler-webhook#10
• A new backup profile's default schedule runs once at 3:00 instead of every minute from 3:00 to 3:59, and a job whose Extra Arguments field is saved empty no longer fails
• The scheduler's custom job placeholders read as examples (e.g. bin/grav) instead of looking like values already filled in, and Run At saves the every-minute schedule it shows when left as is

[Package Updates]

[2.3.5]

• Update grav to 2.2.16
• Full Changelog
• [security] The string() Twig function now applies the same sandbox checks as the |string filter. Thanks @dagighost

[Package Updates]

[2.3.6]

• Update grav to 2.2.17
• Full Changelog
• With system.absolute_urls and asset SRI both on, Grav looked for asset files at the web root plus the full URL, so no integrity was added and sites with open_basedir got a fatal error. It now finds the real file, also in subfolders whose name has characters like . or + #4377

[Package Updates]

[2.3.7]

• Update grav to 2.2.21
• Full Changelog
• A plugin that adds a scheduler job as a class method (such as [$this, 'method']) without an id, or with its id where the job's arguments go, no longer crashes every scheduler run and empties the admin's job list #4380
• Updating or reinstalling a plugin swaps the new copy in all at once, so the site never runs with the plugin missing or half copied, and the old copy is put back if the new one cannot be moved in
• JSON sent to the site is now checked against size limits before it is read, so an oversized request is turned away quickly instead of tying up the server (limits are under request.json in system.yaml)
• Sites behind a proxy that ends HTTPS (such as Cloudflare in front of a server on port 80) no longer redirect visitors to the address with :80 added, for example when reloading the admin
• A number field given a value too large for an integer no longer causes a warning on PHP 8.5
• [security] The Apache .htaccess exception for /.well-known/ now covers that folder only, so other hidden files and folders whose names start with well-known stay blocked. Upgrading updates existing .htaccess files
• [security] The security fixes below were found by Anthropic's OSS Scanner
• [security] Twig in page content can only read an account's name, username, e-mail, language and login state, and account secrets such as password hashes, 2FA secrets and reset tokens are no longer included in form values or in an account's array and JSON output
• [security] Twig in page content can no longer use page.path, page.filepath or {% autoescape %}, page methods it calls only change that one page for the current request, and array_key_value() and sort_by_key only work with data content Twig may read
• [security] Settings hidden from content Twig by security.twig_sandbox.config_denied_paths now stay hidden through loops, theme helpers, plugin page settings, theme aliases, unusual path separators and full config listings

[Package Updates]

[2.3.8]

• Update grav to 2.2.22
• Full Changelog
• On servers with the PHP yaml extension, a YAML file with a plain y, yes, on, off, n or no key keeps that key instead of turning it into 1 or 0, so settings such as an image's y: size and the YES/NO language strings load the same as on servers without the extension
• An asset added by the site's own full URL, such as url('theme://css/custom.css', true), or by a link that starts with the site's subfolder, no longer renders with the host or subfolder twice

[Package Updates]

[2.3.9]

• Update grav to 2.2.23
• Full Changelog
• When a cache file can't be deleted, the cache purge job and bin/grav clear now name the file and the reason (such as "Permission denied") instead of "Unknown error", and carry on with the rest of the cache instead of stopping at the first one (#4384)
• [security] The svg_image() Twig function now escapes the classes it adds to the SVG. Thanks @manus-pi
• [security] The svg_image() Twig function only inlines real .svg files, so a theme that takes the image path from a page header can no longer be pointed at other files on the server