All Versions
283
Latest Version
Avg Release Cycle
5 days
Latest Release
24 days ago

Changelog History
Page 3

  • v2.0.0-rc.10

    June 19, 2026

  • v2.0.0-rc.1

    May 04, 2026

  • v2.0.0-beta.4

    April 29, 2026

  • v2.0.0-beta.3 Changes

    April 28, 2026

    👌 Improved

    • Twig sandbox is now the sole layer of SSTI protection on editor-authored content — the legacy regex pre-filter has been retired. With the sandbox stable in beta.2 (allowlist-based Twig\Sandbox\SecurityPolicy covering tags / filters / functions / methods / properties), the security.twig_filter.* blacklist + whitelist that pre-dated it served only as a logging fallback when the sandbox was disabled. Removed across the board: blueprint section + 6 fields (twig_filter.enabled, logging, admin_hint, whitelist.{functions,filters,properties}); the twig_filter: block in system/config/security.yaml; Security::cleanDangerousTwig() / cleanDangerousTwigWithStatus() / getDangerousTwigPatterns(); the CALLABLE_DANGEROUS_NAMES and INTROSPECTION_NAMES constants and their compiled-pattern caches; Security::logTwigBlock() / twigWhitelistHint() and the per-request dedup map; the three Twig::process{Page,String,Site} call sites that used to wrap content in the regex pass before handing it to Twig; and tests/unit/Grav/Common/Security/CleanDangerousTwigTest.php. The sandbox remains toggleable via security.twig_sandbox.enabled for sites that genuinely need container access from page content; the toggle now ships with an explicit warning that disabling it removes the only SSTI protection on editor-authored content. The admin-hint comment Twig appended after a filtered render moves with the rename: appendTwigFilterAdminHint → appendSandboxAdminHint, reading from the new security.twig_sandbox.admin_hint config (default true). Net effect: a single, clean enforcement layer; ~350 fewer lines of regex; one config story to document; the sandbox is what catches a violation, the sandbox is what logs it. No upgrade action needed — security.twig_filter.* keys in user yaml are silently ignored.
    🛠 Bugfix
    • 🛠 Fixed selectize field optionally able to store keys

  • v2.0.0-beta.2 Changes

    April 25, 2026

    Summary

    • Twig content sandbox — page content authored in the editor now renders through a Twig sandbox with allowlisted tags / filters / functions / methods / properties, blocking the SSTI class of attacks. Theme templates are unaffected.
    • 💻 Admin UI for the sandbox — new "Twig Sandbox" section under Configuration → Security with toggles and editable allowlists; can be disabled wholesale if a site needs the old unrestricted behaviour.
    • 🔒 Dedicated logs/security.log — every blocked Twig expression is logged with the page route and a pointer to the exact setting to change.
    • Soft-fail on sandbox violations — the rest of the page still renders, visitors see a small placeholder, admins get a hint to the log entry.
    • Smarter dangerous-Twig filter — fewer false positives (e.g. {{ page.header.user.mail }} no longer flagged just because it contains "mail").
    • 🔒 Major security hardening pass — fixes for ten advisories shipped together:

  • v2.0.0-beta.1 Changes

    April 16, 2026

    🆕 New

    • Rebrand 1.8-beta as 2.0-beta
    • 🆕 NEW Quark2 theme fro Grav 2.0
    • 🆕 NEW Migrate Grav plugin required to get from 1.x to 2.0
    • 🆕 NEW API support plugin support required for Admin2
    • 🆕 NEW Admin2 is the new default Admin for Grav 2.0
    • 🚚 Moved to Github Markdown Alerts over Markdown Notices

  • v1.8.0-beta.29 Changes

    December 28, 2025

    👌 Improved

    * Avoid mail in twig content trigger security error
* Don’t do internal grav-based gzip, rely on webserver
* Updated vendor libs

    🛠 Bugfix

    * Fix for grav not picking up config + page changes
* Fix for unusual format SVGs
* Fix for nested config changes
* Fix for user editing causing `hashed_password` to be removed
* Fix of setEscaper move in Twig 3.9+
* Fix for broken symlinks

  • v1.8.0-beta.28

    December 09, 2025

  • v1.8.0-beta.27

    November 30, 2025

  • v1.8.0-beta.26

    November 29, 2025