6.1.8

Note: this release includes security-related fixes! Many thanks to @orionhridoy for reporting it to us responsibly!

• GHSA-gpv9-q5r2-877q / 9972ebf
• GHSA-m685-x9x3-7f53 / 4bdb18c

What's Changed

• fix(translations): resolve duplicate unit id in messages.fr by @Vondry in #3795
• fix(translations): add missing general.phrase.none key by @Vondry in #3796
• fix(translations): correct min_ratio parameter in Turkish validators by @Vondry in #3798
• chore(deps): bump postcss-selector-parser by @dependabot[bot] in #3800
• chore(deps): bump browserslist from 4.28.2 to 4.28.8 by @dependabot[bot] in #3801
• chore(deps-dev): bump brace-expansion from 1.1.15 to 1.1.18 by @dependabot[bot] in #3802
• chore(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 by @dependabot[bot] in #3803
• chore(deps): bump js-yaml from 4.3.1 to 4.3.2 by @dependabot[bot] in #3804
• chore(deps-dev): bump svgo from 2.8.3 to 2.8.4 by @dependabot[bot] in #3805
• Release 6.1.8 by @bobvandevijver in #3806

Full Changelog: 6.1.7...6.1.8

6.1.7

Note: this release includes a security-related fix! Many thanks to @johnweeklys for reporting it to us responsibly!

• GHSA-m2j9-f9xw-xxgw / 9795d39

What's Changed

• Bump axios from 1.16.1 to 1.18.0 by @dependabot[bot] in #3755
• Reduce PHPStan baseline: fix generic object types and invalid array keys by @Vondry in #3758
• Use Symfony HTTP utils to generate an always valid redirect response by @bobvandevijver in #3768
• XLIFF format normalisation: convert remaining 1.2 catalogues to 2.0 by @Vondry in #3770
• Fix validator placeholders that never interpolate by @Vondry in #3771
• Correct French validator placeholders and typo from PR #3771 review thread by @bobvandevijver with @Copilot in #3772
• Fix failing Cypress E2E suite: login redirect (cookie_secure) by @Vondry in #3757
• Add explicit type definition by @bobvandevijver in #3774
• fix(translations): correct broken Czech strings in messages, security and validators by @Vondry in #3779
• Fix: keep the save button enabled after previewing (#3778) by @Vondry in #3791
• fix: repair broken Makefile targets and stale server docs by @Vondry in #3777
• fix(translations): replace unresolved %url% in built-with-bolt string by @Vondry in #3785
• fix(translations): restore dropped placeholders in bg/de/es/hu by @Vondry in #3784
• fix(translations): restore English placeholder names in de/uk by @Vondry in #3783
• fix(translations): correct srcLang in 7 XLIFF files by @Vondry in #3780
• fix(translations): correct compared_value placeholder in ru/uk validators by @Vondry in #3781
• fix(translations): remove stray whitespace inside placeholders (ru/uk) by @Vondry in #3782
• feat(translations): add Slovak (sk) catalogues for messages, validators and security by @Vondry in #3786
• chore(assets): modernise frontend lint tooling (ESLint 10 flat config, Prettier 3, Stylelint 17) by @Vondry in #3775
• chore(deps-dev): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in #3787
• chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.5 by @dependabot[bot] in #3788
• chore(deps-dev): bump svgo from 2.8.2 to 2.8.3 by @dependabot[bot] in #3762
• chore(deps): bump immutable from 5.1.6 to 5.1.9 by @dependabot[bot] in #3759
• chore(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 by @dependabot[bot] in #3761
• chore(deps-dev): bump ip-address from 10.2.0 to 10.5.0 by @dependabot[bot] in #3776
• chore(deps): bump phin and node-vibrant by @dependabot[bot] in #3766
• Show content validation errors when Saving Ajaxy by @mindaugasjackunaspcin #3793

Full Changelog: 6.1.6...6.1.7

6.1.6

What's Changed

• Fix: Resetting forgotten password by @Vondry in #3732
• Bump websocket-driver from 0.7.4 to 0.7.5 by @dependabot[bot] in #3752
• Fix TimedPublishSubscriber for doctrine/dbal 4.x by @Senne in #3750

New Contributors

• @Senne made their first contribution in #3750

Full Changelog: 6.1.5...6.1.6

6.1.5

Note: this release includes a security-related fix!

• Prevent SSRF due to unchecked followed redirects (@Vondry)

Full Changelog: 6.1.4...6.1.5

6.1.4

Note: this release includes several security-related fixes!

• Fix SQL injection in ListFormatHelper (@Vondry)
• Prevent SSRF in upload-from-URL and embed endpoint (@Vondry)
• Filter unpublished/viewless content from the public Relation API (@Vondry)
• Block open redirect on login endpoint (@0xmgaye, fix by @bobvandevijver)

What's Changed

• Bump dependencies by @bobvandevijver in #3730
• Bump http-proxy-middleware from 2.0.9 to 2.0.10 by @dependabot[bot] in #3740
• Bump undici from 6.26.0 to 6.27.0 by @dependabot[bot] in #3737
• Bump launch-editor from 2.14.0 to 2.14.1 by @dependabot[bot] in #3731
• Bump locutus from 2.0.39 to 3.0.25 by @dependabot[bot] in #3744

Full Changelog: 6.1.3...6.1.4

6.1.3

What's Changed

• Prevent user to create/delete folder/files anywhere by @kouz75 in #3717
• Security related fixes by @bobvandevijver in #3723

Full Changelog: 6.1.2...6.1.3

6.1.2

What's Changed

• Upgrade actions to Node24 versions by @bobvandevijver in #3706
• Remove @vue/cli-service by @bobvandevijver in #3707
• Fix MySQL CAST AS TEXT regression by @kouz75 in #3710
• Mysql - Fix field trait item types by @kouz75 in #3713

Full Changelog: 6.1.1...6.1.2

6.1.1

What's Changed

• Bump basic-ftp from 5.2.1 to 5.2.2 by @dependabot[bot] in #3703
• Bump follow-redirects from 1.15.11 to 1.16.0 by @dependabot[bot] in #3705
• Disable save button during form submission by @kouz75 in #3704

New Contributors

• @kouz75 made their first contribution in #3704

Full Changelog: 6.1.0...6.1.1

6.1.0

What's Changed

• Upgrade erusev parsedown packages by @bobvandevijver in #3702

Full Changelog: 6.0.3...6.1.0

6.0.3

What's Changed

• Bump axios from 1.13.5 to 1.15.0 by @dependabot[bot] in #3701

Full Changelog: 6.0.2...6.0.3