9.5.7 Release Notes

Behavioral Improvements

    Say why each security advisory is ignored (#13247) (thanks mlocati)
    Ask AI tools for short code comments and no automatic commits (#13253) (thanks mlocati)
    EventService (Calendar) was missing some key events, they have been added. (#13251) (thanks dbuerer)
    Sanitize the inline designs read from a CIF (#13266) (thanks mlocati)
    Avoid the browser asking for credentials in the API documentation console (#13249) (thanks mlocati)

Bug Fixes

    Upgrade to 9.5.5 fails on MySQL 8 when migration 20260914000000 alters PageContainerInstances.containerID (#13245) (thanks mlocati)
    Could not add second block into a Pagetype (#13252) (thanks mlocati)
    Fixed: Adding social links (mail and phone number) (#13268) (thanks mlocati)
    Keep the custom styles of each page version apart (#13264) (thanks mlocati)
    Fix the custom style of the global areas (#13265) (thanks mlocati)
    Dashboard user page shows "Email Validated: Unknown" for validated users (never shows "Yes") (#13258)
    Fixed: When moving pages, it can get two un-removable canonical URLs simultaneously (#12945) (thanks MarkusElmer)
    Fixed: Stack translations missing (#10582) (thanks mlocati)
    Fixed Concrete CMS being unable to be installed by Composer (except by ignoring audits)

Developer

    Check security advisories in a dedicated workflow (#13262) (thanks mlocati)
    Update composer dependencies (#13270) (thanks mlocati)
    Update enshrined/svg-sanitize to 1.0 (#13256) (thanks mlocati)
    Test install and update with strict and empty sql_mode (#13257) (thanks mlocati)
	
9.5.5 Release Notes

New Features

    Enhanced Thumbnail Editor: Crop Controls, Live Preview, and Dialog Improvements (#13016) (thanks katalysis)
    Add an option to exclude system pages from the Remove Old Page Versions task (thanks digitmaster)

Behavioral Improvements

    Bug: Completed tasks can remain shown as running (#418) (thanks digitmaster)
    The Home Folder is not pre-selected when uploading files from blocks (#12794) (thanks broreece)
    Add date_public to the Page API transformer (#13125) (thanks broreece)
    Fixed: File dialogs throw a fatal error instead of "Invalid file" when fID is empty or non-numeric (#13152) (thanks janscarton)
    Better breadcrumb support in the Dashboard Express pages (thanks mlocati)
    Persist Dashboard panel visibility preference (#12994) (thanks digitmaster) Dashboard panel now will stay closed for much longer if the user manually closes it.
    Express Entry List block: check the classes when reading its settings back (#13237) (thanks mlocati)
    Config Key for Help System (#11669) (thanks aembler)

Bug Fixes

    Legacy Form block throws an error on submit (#13129) (thanks mlocati)
    [Fix] PHP 8 error in Add Workflow dashboard page caused by incorrect View::element argument order (#13119) (thanks biplobice)
    When there was a PHP_EXTENSION_ERROR while uploading a file, we would show the wrong error message. This is now fixed. (thanks darkdi)
    Bug: Dashboard page favorite icon stays gray in dark mode (thanks digitmaster)
    Fixed bug in REST API where block was updated twice (thanks mlocati)
    Fixed bug where programmatically updating the Google Maps block through code could clear the API key (thanks mlocati)
    Bug fixes in the image block when saving links using the REST API (thanks mlocati)
    Fixed bug where installing Concrete via composer was impossible with security auditing enabled, due to upstream dependencies (thanks mlocati)
    concretecms/monolog-cascade not compatible with symfony/config v6.4.44 (#13219) (thanks mlocati)
    Fixed bug where conversation max file size for registered users was set incorrectly (thanks mlocati)
    Many bug fixes to the Content Import Format (thanks mlocati)
    Many bug fixes in the REST API (thanks mlocati)
    Express Entry Detail block: don't preset an entry mode that doesn't exist (#13187) (thanks mlocati)
    Express Entry List block: fill the edit dialog even when the entity has no attributes (#13188) (thanks mlocati)
    Fix duplicate composer schedule dialogs by cleaning up on close. (#13190) (thanks broreece)
    Clarify Waiting For Me notification menu label and fix dropdown positioning (#13192) (thanks broreece)
    Fixed bug where copying a calendar event associated to a page and deleting the new event would delete the page, orphaning the original calendar event's page relation (thanks eastagiletracker)
    Fix the URL returned after renaming an Express search preset (#13214) (thanks mlocati)
    Fix stale search index when page attributes are deleted. (#13226) (thanks broreece)
    Allow clearing the skin of a page (#13225) (thanks mlocati)
    Prevent duplicate File Manager folder submissions (#13189) (thanks digitmaster)
    Fix deleting all keys in Cache/Driver/RedisStashDriver (#12966) (thanks mlocati)
    Page List set to "Everywhere" on the homepage shows no results after upgrading to 9.5.4. (#13232)

Security Updates

    CVE-2026-106551 (8.6) @bp0lr

Developer

    Improvements to new ConcreteFetch JS fetch library (thanks mlocati)
    Lots of code cleanup (thanks mlocati)
    Packages that define tasks no longer need to explicitly register their task controllers with the task manager. (thanks mlocati)
    Re-implemented many formerly skipped tests (thanks mlocati)
    Update composer dependencies (#13239) (thanks mlocati)