Grav CMS - Package Updates

[Package Updates]

[2.3.0]

• Update php-base | final to 8.5-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[2.3.1]

• Update grav to 2.2.12
• Full Changelog
• The scheduler webhook now also runs jobs that missed their time since the last call, so a site pinged hourly (or late) no longer skips jobs set for another minute. Add ?mode=due for the old behaviour. The scheduler health check now warns when a job is behind schedule, instead of five minutes after the last run getgrav/grav-plugin-scheduler-webhook#9
• Admin listings of a folder with thousands of pages no longer reload the folder once for every page in it, which made them slow and could run out of memory with caching on getgrav/grav-plugin-admin2#200
• A scheduled backup no longer fails with "ZipArchive::close(): Unexpected length of data" when another job changes a file in the site while the backup is being written. The backup is built again (up to three tries), and if it still can't be written, it is marked as failed while the rest of the scheduler run carries on. A failing job used to stop the whole run, so the jobs after it never ran and none of their results were saved

[Package Updates]

[2.3.2]

• Update grav to 2.2.13
• Full Changelog
• [security] A field in a page's Flex form override keeps the stricter rules for dynamic options after it is merged into the directory blueprint, however it is renamed or numbered. Thanks @soquip
• [security] Page content is now checked for unsafe markup as though its Twig runs, even when Twig is off for that page, since a later move or rename can turn it into a module. Thanks @vLWa7ch
• [security] Flex user accounts: an account without super-admin access can no longer edit or delete a super-admin account through a Flex form, and a submitted password hash is ignored when an account is saved. Thanks @manus-pi
• [security] Flex page storage now refuses a folder, template or language that is not a plain name. Thanks @shm0x00
• [security] Images referenced by stream URI in page content, the watermark image and media_directory() now only come from media folders (pages, images, media, themes, plugins), configurable with the new security.media.allowed_roots setting. Thanks @123abab123789

[Package Updates]

[2.3.3]

• Update grav to 2.2.14
• Full Changelog
• Disabled plugins are no longer loaded, so a disabled plugin with code that doesn't work on this version of Grav can't take the site down, and requests do less work. A disabled plugin is still listed with its settings, and its class still loads if another plugin asks for it. Thanks @NoNoNo #4374
• CSS with a long quoted string or comment (such as an inlined data: URI) minifies again instead of failing with a PCRE error, and a very large data: URI no longer empties the whole stylesheet from the bundle. Thanks @NoNoNo #4372
• Inline JavaScript added with loading: 'inline' no longer renders a stray inline attribute on its script tag, and an inline JS module keeps its code when the pipeline is off. Thanks @NoNoNo #4373

[Package Updates]

[2.3.4]

• Update grav to 2.2.15
• Full Changelog
• Page ids: a page folder can carry a hidden .page-id file holding a permanent id (a UUID) that stays with the folder however it is renamed, reordered or moved, in Admin, with git or over FTP. Read it with $page->uuid() and find a page by it with $pages->findByUuid(); Grav\Common\Page\PageIdentity writes ids, finds a folder by its id after a move, and decides which folder keeps an id that a copy made outside Grav duplicated (the older .page-id wins). Ids are off unless a plugin needs them: it calls PageIdentity::enable() in onPluginsInitialized, or a site sets system.pages.uuid: true, and then saving or creating a page gives its folder an id and a copied page gets its own. bin/grav page-ids gives every page folder an id and reports duplicates, and tells the pages cache so the next request finds the new ids. The file is hidden, so it never shows as a page file or as media, and a page folder moved to another disk (where Grav copies it instead of renaming it) takes its ids with it. Two requests saving one new page at the same moment give it one id, not two
• A scheduler custom job or backup profile added in the admin and saved without being filled in no longer breaks the scheduler: it is skipped, so the other jobs still run and the job list, health check and webhook keep working getgrav/grav-plugin-scheduler-webhook#10
• A new backup profile's default schedule runs once at 3:00 instead of every minute from 3:00 to 3:59, and a job whose Extra Arguments field is saved empty no longer fails
• The scheduler's custom job placeholders read as examples (e.g. bin/grav) instead of looking like values already filled in, and Run At saves the every-minute schedule it shows when left as is

[Package Updates]

[2.3.5]

• Update grav to 2.2.16
• Full Changelog
• [security] The string() Twig function now applies the same sandbox checks as the |string filter. Thanks @dagighost

[Package Updates]

[2.3.6]

• Update grav to 2.2.17
• Full Changelog
• With system.absolute_urls and asset SRI both on, Grav looked for asset files at the web root plus the full URL, so no integrity was added and sites with open_basedir got a fatal error. It now finds the real file, also in subfolders whose name has characters like . or + #4377

[Package Updates]

[2.3.7]

• Update grav to 2.2.21
• Full Changelog
• A plugin that adds a scheduler job as a class method (such as [$this, 'method']) without an id, or with its id where the job's arguments go, no longer crashes every scheduler run and empties the admin's job list #4380
• Updating or reinstalling a plugin swaps the new copy in all at once, so the site never runs with the plugin missing or half copied, and the old copy is put back if the new one cannot be moved in
• JSON sent to the site is now checked against size limits before it is read, so an oversized request is turned away quickly instead of tying up the server (limits are under request.json in system.yaml)
• Sites behind a proxy that ends HTTPS (such as Cloudflare in front of a server on port 80) no longer redirect visitors to the address with :80 added, for example when reloading the admin
• A number field given a value too large for an integer no longer causes a warning on PHP 8.5
• [security] The Apache .htaccess exception for /.well-known/ now covers that folder only, so other hidden files and folders whose names start with well-known stay blocked. Upgrading updates existing .htaccess files
• [security] The security fixes below were found by Anthropic's OSS Scanner
• [security] Twig in page content can only read an account's name, username, e-mail, language and login state, and account secrets such as password hashes, 2FA secrets and reset tokens are no longer included in form values or in an account's array and JSON output
• [security] Twig in page content can no longer use page.path, page.filepath or {% autoescape %}, page methods it calls only change that one page for the current request, and array_key_value() and sort_by_key only work with data content Twig may read
• [security] Settings hidden from content Twig by security.twig_sandbox.config_denied_paths now stay hidden through loops, theme helpers, plugin page settings, theme aliases, unusual path separators and full config listings

[Package Updates]

[2.3.8]

• Update grav to 2.2.22
• Full Changelog
• On servers with the PHP yaml extension, a YAML file with a plain y, yes, on, off, n or no key keeps that key instead of turning it into 1 or 0, so settings such as an image's y: size and the YES/NO language strings load the same as on servers without the extension
• An asset added by the site's own full URL, such as url('theme://css/custom.css', true), or by a link that starts with the site's subfolder, no longer renders with the host or subfolder twice

[Package Updates]

[2.3.9]

• Update grav to 2.2.23
• Full Changelog
• When a cache file can't be deleted, the cache purge job and bin/grav clear now name the file and the reason (such as "Permission denied") instead of "Unknown error", and carry on with the rest of the cache instead of stopping at the first one (#4384)
• [security] The svg_image() Twig function now escapes the classes it adds to the SVG. Thanks @manus-pi
• [security] The svg_image() Twig function only inlines real .svg files, so a theme that takes the image path from a page header can no longer be pointed at other files on the server