Changes in 4.9.2 (2 Nov 2026)

* Maintenance release with security enhancements, general improvements and
  bug fixes.
* Security: Resolved skipping of authentication for concurrent logins via
  cookie (thanks, MoltenGamaLC and Maizeravla).
* Security: Always sandbox preview frames and introduce admin-side CSP layer
  (thanks, Nguyen Trung Hoang).
* Security: Sanitize 'sort' attribute of <txp:authors> tag (thanks, Neder).
* Security: Sanitize 'sort' attribute of <txp:file_download> tag
  (thanks, Maizeravla and MoltenGamaLC).
* Security: Sanitize 'url_title' attribute consistently (thanks, Maizeravla
  and MoltenGamaLC).
* Security: CSP improvements to mitigate user privilege CSRF
  (thanks, AnhNg1410).
* Security: Theme import is now CSRF-aware (thanks, Bilguundalai).
* Security: Validate administrative user status on Users panel updates
  (thanks, mansurmavlankulov).
* Security: Resolve sanitization of file paths in XML-RPC mt_uploadImage()
  (thanks, zsm-cry). Refer to CVE-2026-5344 for additional information.
* Fixed: FROM_UNIXTIME(0) timestamp handling on some MySQL/MariaDB versions.
* Fixed: Deleting image(s) deletes corresponding thumbnails (thanks, wet).
* Fixed: Thumbnail generation paths on Windows (thanks, skewray);
* Fixed: Improved exif_read_data() handling (thanks, towndock).
* Fixed: <txp:password_protect> container error (thanks, wet).
* Fixed: Recursive use of <txp:yield>.
* Fixed: Allow upload of plugins where filename length exceeds PHP_MAXPATHLEN.
* Fixed: Theme import with invalid JSON manifest.
* Fixed: Improved Textile support for IETF BCP 47 language tags.
* Fixed: Plugin compilation output: order, not load_order.
* Fixed: Default public theme CSS should not be minified.
* Added: <txp:file_download_info /> tag.
* Added: 'version' attribute to <txp:css /> tag.
* Added: 'download' attribute to <txp:file_download_link /> tag.
* Added: 'aspect' ratio output to <txp:image_info /> tag.
* Added: Publishers can set password for any user, and choose whether
  invite link is sent.
* Added: Copy to clipboard feature for Diagnostics and Setup info.
* Added: Dark mode for default public theme.
* Added: Clean URL test user agent ('Textpattern CMS clean URL test').
* Added: Latest text translations. Thank you to all our translators.
* Changed: Modernisation of default public theme CSS rules.
* Changed: Article 'uid' uses Tiger-128,3 hash instead of MD5 hash.
* Changed: Add TEXTPATTERN_DEFAULT_LANG to config.php during setup.
* Performance: Reduced query count if theme textpack is unchanged.
* Developer: Added 'ext' and 'mime' to global $thisfile array.
* Developer: Added 'uid' to global $thisarticle array.
* Developer: Exposed raw_label in UI\InputLabel.
* Vendors: Textile 4.1.6. (thanks, gocom).
* Vendors: DOMPurify 3.4.17.

Changes in 4.9.1 (14 Feb 2026)

* Maintenance release with security enhancements, general improvements and
  bug fixes.
* Security: Resolved access control regression with articles. Many thanks to
  Federico Frascino.
* Security: Resolved admin-side XSS vulnerability. Many thanks to
  Jan Jeffrie Galvez Salloman, aka '0xj4n'.
* Changed: (Article)Image tags only output dimensions on demand.
* Changed: <txp:article_image> skips empty images/thumbnails.
* Changed: Valueless width/height/crop behaviour in (Article)Image tags.
* Changed: Thumb path now permits virtual/multiple host setups.
* Changed: Use publisher email and fallback if no/invalid sender is supplied
  (thanks, jools-r).
* Fixed: Fatal error with UNIXTIME() changes in MariaDB 11.8+.
* Fixed: Dynamic thumbnail MIME detection (thanks, rezozero/ambroisemaupate).
* Fixed: PHP 5.6 support (thanks, pinalgirkar).
* Fixed: Show template content even if theme is deleted (thanks, Mark Goodwin).
* Fixed: Correct admin theme file scaffold for dynamic thumbnails.
* Fixed: Reintroduce 'No' indicator if thumbnail is missing in Images list
  panel (thanks, wet and phiw13).
* Fixed: Duplicate action only available for existing content.
* Fixed: Assets created with no timestamp use time of creation, not Unix epoch.
* Fixed: Internal errors with password reset email sending on PHP 8.5.
* Added: (Article)Image thumbnails can output any supported format.
* Vendors: jQuery UI 1.14.2.

Changes in 4.8.8 (24 January 2022)

* Maintenance release with support for PHP 8.1, security enhancements, general
  improvements and bug fixes.
* Security: Fix reported cross-site scripting issue relating to article preview
  CSRF token (many thanks, Paul Ritchie at Pentest Limited).
* Fixed: More robust numeric searches.
* Fixed: Improved query efficiency of category operations.
* Fixed: Required parameters after optional in tag builder (thanks, phiw13).
* Fixed: Admin-side pagination when sorting by non-unique values.
* Added: PHP 8.1 support.
* Added: Natural search mode.
* Added: Random form selection.
* Added: Support for AVIF image format, on PHP 8.1 or higher.
* Added: Global 'limit', 'offset' and 'sort' attributes.
* Added: 'url_title' attribute to <txp:article[_custom] />.
* Added: 'range' attribute to <txp:article_image />.
* Added: 'date' and 'time' attributes to <txp:if_expired />.
* Added: 'calendar' attribute to <txp:posted /> and similar tags.
* Added: Substring extraction via 'escape' attribute.
* Added: <txp:items_count /> tag.
* Added: Expanded conditional 'match' attribute with comparison operators.
* Added: 'UTC' is now a permitted time zone.
* Added: Custom date formats.
* Changed: <txp:category_list /> with 'children' >1 attribute behaviour.
* Changed: Global 'escape' attribute operates at the items level in lists.
* Changed: Multi-site plugins directory defaults to site/admin/plugins.
* Accessibility: Additional 'aria-label' attributes for some internal links.
* Internal: Removed FOUND_ROWS() which is deprecated in MySQL 8.0.17.
* Internal: Prefer is_readable() and is_file() to file_exists().
* Developer: Added plugin lifecycle events 'upgraded' and 'downgraded'.
* Developer: Export new article IDs on duplicate.
* PrismJS 1.26.0.

Changes in 4.8.7 (30 May 2021)

* High priority maintenance release to address functionality and setup issues
  discovered after 4.8.6 release.
* Fixed: Users panel throws error due to missing DB prefix (thanks, prbt2016).
* Removed: database user GRANT check during initial setup, which broke some
  installations.
* Changed: Context check priority in tags.

Changes in 4.8.6 (28 May 2021)

* DO NOT USE IN PRODUCTION - issues discovered after release, use 4.8.7 instead.
* Maintenance release with bug fixes.
* Fixed: Regression in override form usage in lists (thanks, Christian Rapp).
* Fixed: Undefined $article warning when accessing non-existent articles.
* Fixed: Error with <txp:output_form /> tag on empty forms (thanks, Adi).
* Fixed: Low-privilege users can save immediately after duplicating articles.
* Added: Latest text translations. Thank you to all our translators.
* Added: 'id' attribute to <txp:if_different /> tag.
* Added: 'db' option to the global 'escape' attribute.
* Added: Option to create database during setup.
* Added: Permission (grants) verification during setup.
* Changed: 'Assign sections' from Themes panel only selects its own sections.
* Changed: <txp:variable trim> trims its own output (thanks, cara-tm).
* Changed: <txp:link_to_next/prev> can return URL or container.
* Changed: <txp:page_url> and <txp:if_request> tags are more flexible.
* Changed: Boost power of <txp:article(_custom)> grouping by date.
* Changed: Articles can be filtered by keywords more easily.
* Changed: No Edit options in Write panel without appropriate privileges.
* Changed: No disabled update buttons on Languages panel (thanks, phiw13).
* Changed: Deprecate <txp:search_result_date />. Use <txp:posted /> instead.
* Changed: Remove deprecated break attribute from search_result_excerpt tag.
* Changed: Back-end search improved when handling numbers. Comparators can
  also be used for numeric searches.
* Developer: Permit step=false to hook into explicit empty step callbacks and
  step=null to indicate 'any step'.
* Developer: Permit $pre to be any text. Opens up arbitrary callback grouping.
* Developer: New articles>multi_edit.$method callback on Articles list panel.
* Developer: User panel callbacks:
    user>fields and user>from to manipulate the query
    user>controls to affect the button area
    user_ui>list.row (pluggable_ui) for adding table data
    user>steps for plugins to register custom panel-level functionality.
* Developer: Diagnostics panel callbacks diag>steps and diag_ui>level for
  custom plugin steps.