Conversation
* Fix choices IDs (#5379) * Fix choices IDs * Cleanup dots from ID values * Update changelog Co-authored-by: Robert Means <robert@apostrophecms.com> --------- Co-authored-by: Robert Means <robert@apostrophecms.com> (cherry picked from commit 9f458b5) * Bump CLI dependencies (#5383) (cherry picked from commit a5e1a4a) * Native browser shortcuts work again (#5384) (cherry picked from commit b9b32bd) * Pro 8838 charset (#5385) * Removes encoding option and comments hardcoded encoding meta * add changeset * Response to first comments (cherry picked from commit 08845c5) * Log aposResponse errors (#5386) * log aposResponse errors * add changeset --------- Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com> (cherry picked from commit d45e27f) * merge back the thanks (#5388) (cherry picked from commit f3501f4) * ignore inline table array as draggable ui for windows (#5392) (cherry picked from commit b360b05) * Layout focus orchestration (#5393) (cherry picked from commit 77a2968) * Bump dependencies (#5398) * Bump dependencies * Fix missing test await resulting in random failures (cherry picked from commit 008417f) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) * allow newer twitter domain * infogr.am still around * facebook no longer does oembed (cherry picked from commit e9b3bac) * Layout editable gap (#5397) (cherry picked from commit bc8f7be) * a11y fixes (#5401) (cherry picked from commit 2e2f3b4) * clarifications (#5403) (cherry picked from commit 13f2c69) --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Merge commit from fork * Fixed arbitrary image URL import vulnerability in rich text impport API * additional reporter * Merge commit from fork * Merge commit from fork * Merge commit from fork * secure the link URL field of image widgets * credit * Merge commit from fork * fix xmp tag vulnerability * thanks * Merge commit from fork * Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly to close this vulnerability. * changeset
* release oembetter 1.2.0 * left commit
…-latest [latest] Fix focus trap on the last element in a modal
[latest] Fix import-export noise
[latest] A11y fixes part 3
* Bump CLI dependencies (#5383) * Fix choices IDs (#5379) * Fix choices IDs * Cleanup dots from ID values * Update changelog Co-authored-by: Robert Means <robert@apostrophecms.com> --------- Co-authored-by: Robert Means <robert@apostrophecms.com> * Native browser shortcuts work again (#5384) * Pro 8838 charset (#5385) * Removes encoding option and comments hardcoded encoding meta * add changeset * Response to first comments * Log aposResponse errors (#5386) * log aposResponse errors * add changeset --------- Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> * merge back the thanks (#5388) * Postgres (#5365) * postgres experimental WIP * astonishingly, all mocha tests of apostrophe pass with this * mocha tests pass, actual sites work * lint clean * listDatabases support, but changes are coming * wip * dump and restore updates * backpressure, adequate handling of ObjectId for our needs (becomes its hex representation) * mild performance optimization * profiling * testing issue resolved * refactored to db-connect module, introduced sqlite adapter * sqlite WIP * debugging * programmatic API for dump/restore/copy dbs * linting, documentation * MIT license * text ranking is more accurate, documentation is more complete * good full text search for sqlite * updates for compatibility with the rest of the public and private modules, plus a few fixes to genuinely ambiguous tests * requirements found by testing private modules * fixes from full cypress run * eslint passing * restore permissions * maximize atomicity * bug fixes * * exit properly when asset tests fail * "npm test" tests all three adapters * ignore claude-tools in eslint * postgres and sqlite-inclusive ci matrix attempt * clean up logs * We hit github's limit on total configurations because every package gets its own matrix. Solve that with grouping: * apostrophe core * All regular ecosystem packages other than core * non-database-requiring packges * mongodb-specific packages This will probably speed it up too because it won't have to spin up a container a bazillion times. * hardened the asset tests, made them less timing sensitive, fixed a bad commit resulting from the way they dodgily patch themselves without a robust cleanup mechanism * fix a root cause of asset test instability * log mess * implemented missing $size operator * test compatibility * advanced permission uses regex in $in * regex in $in * .db() should not make false promises in plain postgres mode, it should fail * ability to specify a default adapter * obsolete file * put escapeHost back where it belongs * dead code removal, test cleanup * emulate-mongo-3-driver only needed in db-connect * no claude logs in repo (tools are welcome) * * shared aggregation implementation, other shared things * optimize $match when it is the first step in aggregation, don't fetch the whole collection đŸ˜œ * multipostgres listDatabases() and .db() should return and expect "fully qualified virtual database names," e.g. physical_db_name-schemaname * vanilla postgres should not attempt to use .db() with alternate names in tests * documentation corrections * documentation errors * listDatabases and documentation corrections * more edge cases revealed by latest work from Miro * anchored prefix regexps are optimized documentation improvements * * matchesQuery in the aggregation cursor implementation doesn't throw on unrecognized operators. It should, and it should support the same mongodb operators that the regular find() path does in postgres/sqlite (our official subset), unless there is an extraordinary reason not to. * Similarly, the main query implementation for normal queries should throw on unrecognized operators if it doesn't already. * The dump/restore programmatic APIs in db-connect concern me. These involve returning the entire database as a string, which could exhaust memory. This impacts both utilities and also copyDatabase(). Could these APIs return and expect async iterators instead of strings? * The test "anchored regex on an indexed field uses a btree index search" runs explain on a query that's hardcoded in the test. Instead these SQL based adapters should expose a means to get the SQL for a query, so it can be directly tested. Otherwise this test proves nothing as changes to the adapter accumulate in future. * Why is this test searching for "at least 1" and not exactly 1? it('should find documents with null value', async function() { const docs = await db.collection('test').find({ value: null }).toArray(); // MongoDB matches both null and missing fields with { value: null } expect(docs.length).to.be.at.least(1); }); * What is the maximum size of a db-connect document in the postgres and sqlite adapters? * Update the copyright year in db-connect/LICENSE.md to 2025. * The db-connect README mentions: sqlite://:memory: What happens if you try to use .db('some-name') with that? I think it would be best to just not support throwaway in-memory sqlite databases because I doubt anyone would intentionally store a website in one. * do not swallow dump/restore errors on indexes * cover how to run the utilities * fix detection of source * separate sanitization for index names * regex prefix safety * pnpm --------- Co-authored-by: Thomas Boutell <boutell@vcs.trox.local> * forgot to include a changeset (#5390) * ignore inline table array as draggable ui for windows (#5392) * Layout focus orchestration (#5393) * Pro 9405 remove hreflang (#5395) * Remove hreflang generation and update README * Add changeset * Changeset update * Pro 9406 base url (#5396) * Removes `seoSiteCanonicalUrl` * Update tests and remove missed log * Change semver level * Bump dependencies (#5398) * Bump dependencies * Fix missing test await resulting in random failures * Pro 9405 remove hreflang (#5395) * Remove hreflang generation and update README * Add changeset * Changeset update * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) * allow newer twitter domain * infogr.am still around * facebook no longer does oembed * Layout editable gap (#5397) * a11y fixes (#5401) * clarifications (#5403) * Merge commit from fork * Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly to close this vulnerability. * changeset * Merge commit from fork * fix xmp tag vulnerability * thanks * Merge commit from fork * secure the link URL field of image widgets * credit * Merge commit from fork * Merge commit from fork * Merge commit from fork * Fixed arbitrary image URL import vulnerability in rich text impport API * additional reporter * mergeback (#5409) * Latest merge prerelease 2026 05 (#5404) * Fix choices IDs (#5379) * Fix choices IDs * Cleanup dots from ID values * Update changelog Co-authored-by: Robert Means <robert@apostrophecms.com> --------- Co-authored-by: Robert Means <robert@apostrophecms.com> (cherry picked from commit 9f458b5) * Bump CLI dependencies (#5383) (cherry picked from commit a5e1a4a) * Native browser shortcuts work again (#5384) (cherry picked from commit b9b32bd) * Pro 8838 charset (#5385) * Removes encoding option and comments hardcoded encoding meta * add changeset * Response to first comments (cherry picked from commit 08845c5) * Log aposResponse errors (#5386) * log aposResponse errors * add changeset --------- Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> (cherry picked from commit d45e27f) * merge back the thanks (#5388) (cherry picked from commit f3501f4) * ignore inline table array as draggable ui for windows (#5392) (cherry picked from commit b360b05) * Layout focus orchestration (#5393) (cherry picked from commit 77a2968) * Bump dependencies (#5398) * Bump dependencies * Fix missing test await resulting in random failures (cherry picked from commit 008417f) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) * allow newer twitter domain * infogr.am still around * facebook no longer does oembed (cherry picked from commit e9b3bac) * Layout editable gap (#5397) (cherry picked from commit bc8f7be) * a11y fixes (#5401) (cherry picked from commit 2e2f3b4) * clarifications (#5403) (cherry picked from commit 13f2c69) --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> * Latest security merge (#5407) * Merge commit from fork * Fixed arbitrary image URL import vulnerability in rich text impport API * additional reporter * Merge commit from fork * Merge commit from fork * Merge commit from fork * secure the link URL field of image widgets * credit * Merge commit from fork * fix xmp tag vulnerability * thanks * Merge commit from fork * Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly to close this vulnerability. * changeset * release only (changelogs formatted) (#5408) --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> * mergeback (#5414) * Latest merge prerelease 2026 05 (#5404) * Fix choices IDs (#5379) * Fix choices IDs * Cleanup dots from ID values * Update changelog Co-authored-by: Robert Means <robert@apostrophecms.com> --------- Co-authored-by: Robert Means <robert@apostrophecms.com> (cherry picked from commit 9f458b5) * Bump CLI dependencies (#5383) (cherry picked from commit a5e1a4a) * Native browser shortcuts work again (#5384) (cherry picked from commit b9b32bd) * Pro 8838 charset (#5385) * Removes encoding option and comments hardcoded encoding meta * add changeset * Response to first comments (cherry picked from commit 08845c5) * Log aposResponse errors (#5386) * log aposResponse errors * add changeset --------- Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> (cherry picked from commit d45e27f) * merge back the thanks (#5388) (cherry picked from commit f3501f4) * ignore inline table array as draggable ui for windows (#5392) (cherry picked from commit b360b05) * Layout focus orchestration (#5393) (cherry picked from commit 77a2968) * Bump dependencies (#5398) * Bump dependencies * Fix missing test await resulting in random failures (cherry picked from commit 008417f) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) * allow newer twitter domain * infogr.am still around * facebook no longer does oembed (cherry picked from commit e9b3bac) * Layout editable gap (#5397) (cherry picked from commit bc8f7be) * a11y fixes (#5401) (cherry picked from commit 2e2f3b4) * clarifications (#5403) (cherry picked from commit 13f2c69) --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> * Latest security merge (#5407) * Merge commit from fork * Fixed arbitrary image URL import vulnerability in rich text impport API * additional reporter * Merge commit from fork * Merge commit from fork * Merge commit from fork * secure the link URL field of image widgets * credit * Merge commit from fork * fix xmp tag vulnerability * thanks * Merge commit from fork * Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly to close this vulnerability. * changeset * release only (changelogs formatted) (#5408) * allow oembetter to be released (#5412) * release oembetter 1.2.0 (#5413) * release oembetter 1.2.0 * left commit --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> * Fix focus trap on the last element in a modal (#5406) * Fix focus trap on the last element in a modal * Fix trap escaping edge cases * Fix import-export noise (#5399) * remove noise, switch to utils debug * Fix tests * Introduce debug option * changelog * Fix test sorting issue * A11y fixes part 3 (#5416) * Fix editor modal a11y issues * Fix manager a11y problems * Fix page manager a11y problems * fix media manager a11y issues * fix a11y issues in style editor and user settings * Fix login a11y issues * eliminate a modal issue * Remove bad aria in rich text * Fix wrong aria in layout * changelog * Fix totp a11y issues, doc context state safety * Fix uncaught error - popup blockers/tests * Fix initial focus trap issue, introduced with recent changes (#5426) * PRO-9542: fix the bug that breaks sitemaps for RA (#5433) * PRO-9542: fix the bug that breaks sitemaps for RA * see changeset * Feature/prevent infinite redirects (#5429) * log aposResponse errors * add changeset * prevent infinite redirects to external URLs --------- Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> * add draggable: false support to non-inline array field (#5435) * add draggable: false support to non-inline array field * Add changeset * Make logged-in cookie name configurable via options (#5430) The logged-in cookie name was hardcoded as 'loggedIn' with TODO comments indicating it should be configurable. This is needed for deployments where multiple Apostrophe instances share a domain (e.g., staging and production on subpaths) and need distinct cookie names to avoid conflicts. Changes: - Added 'loggedInCookieName' option to the login module (defaults to 'loggedIn' for backward compatibility) - Replaced all hardcoded references with self.loggedInCookieName - Removed the TODO comments Usage: modules: { '@apostrophecms/login': { options: { loggedInCookieName: 'myAppLoggedIn' } } } Addresses the TODO comments: 'get cookie name from config' Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com> * Revert "Make logged-in cookie name configurable via options (#5430)" (#5436) This reverts commit ddcdaa7. * Feature create-apostrophe (#5425) * Fix new schema areas in existing documents (Astro) (#5434) * Fix orphan or new-in-the-schema areas in external front-ends * Save missing empty areas in the DB, refactor nunjucks path * PRO-6295: jsx as an optional alternative to nunjucks (#5391) * jsx as an optional alternative to nunjucks * eslint, all tests pass * log a useful stack trace on attachment errors! Holy shit! * fix lint * clarify behavior * more tests pass linter * This is just a unit test, but it can't hurt to be thorough & satisfy github-advanced-security Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * true access to the apos object in jsx, per the spec * more test coverage, no code changes * fix watchers --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * no watch in prod (#5439) * Fix new schema areas in existing documents (Astro) Part II (#5440) * Prevent data corruption when stubbing areas for Astro * Fix false positive orphan area warnings * Guard against corrupt area items * Fix raw-text sanitization bypass vulnerability and add regression tests (#5432) * changeset for singh contribution (#5442) * Fix relationship select scrolling issue (#5445) * Fix relationship select scrolling issue * Prevent same scrolling bugs to appear in media manager * jsx changeset (#5446) * Ensure install of the project root for astro projects (#5449) * test node 26 (#5450) * test node 26 * support node 26 by bumping the better-sqlite3 version * node 22 requirement * Add link for telemetry policy (#5455) * remove absent options (#5456) * Remove consumed 4.30.0 changesets from main (#5454) * cli links that are correct, or will be post publish (#5458) * release db connect to solve chicken and egg problem in cypress-tools (#5459) * Corrects documentation links (#5457) * Corrects documentation links * correct `guides` -> `guide` --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Thomas Boutell <boutell@vcs.trox.local> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> Co-authored-by: RohithVangalla1 <reachrohithv@gmail.com> Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Dipanshu singh <161134993+Dipanshusinghh@users.noreply.github.com>
* Bump CLI dependencies (#5383) * Fix choices IDs (#5379) * Fix choices IDs * Cleanup dots from ID values * Update changelog Co-authored-by: Robert Means <robert@apostrophecms.com> --------- Co-authored-by: Robert Means <robert@apostrophecms.com> * Native browser shortcuts work again (#5384) * Pro 8838 charset (#5385) * Removes encoding option and comments hardcoded encoding meta * add changeset * Response to first comments * Log aposResponse errors (#5386) * log aposResponse errors * add changeset --------- Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> * merge back the thanks (#5388) * Postgres (#5365) * postgres experimental WIP * astonishingly, all mocha tests of apostrophe pass with this * mocha tests pass, actual sites work * lint clean * listDatabases support, but changes are coming * wip * dump and restore updates * backpressure, adequate handling of ObjectId for our needs (becomes its hex representation) * mild performance optimization * profiling * testing issue resolved * refactored to db-connect module, introduced sqlite adapter * sqlite WIP * debugging * programmatic API for dump/restore/copy dbs * linting, documentation * MIT license * text ranking is more accurate, documentation is more complete * good full text search for sqlite * updates for compatibility with the rest of the public and private modules, plus a few fixes to genuinely ambiguous tests * requirements found by testing private modules * fixes from full cypress run * eslint passing * restore permissions * maximize atomicity * bug fixes * * exit properly when asset tests fail * "npm test" tests all three adapters * ignore claude-tools in eslint * postgres and sqlite-inclusive ci matrix attempt * clean up logs * We hit github's limit on total configurations because every package gets its own matrix. Solve that with grouping: * apostrophe core * All regular ecosystem packages other than core * non-database-requiring packges * mongodb-specific packages This will probably speed it up too because it won't have to spin up a container a bazillion times. * hardened the asset tests, made them less timing sensitive, fixed a bad commit resulting from the way they dodgily patch themselves without a robust cleanup mechanism * fix a root cause of asset test instability * log mess * implemented missing $size operator * test compatibility * advanced permission uses regex in $in * regex in $in * .db() should not make false promises in plain postgres mode, it should fail * ability to specify a default adapter * obsolete file * put escapeHost back where it belongs * dead code removal, test cleanup * emulate-mongo-3-driver only needed in db-connect * no claude logs in repo (tools are welcome) * * shared aggregation implementation, other shared things * optimize $match when it is the first step in aggregation, don't fetch the whole collection đŸ˜œ * multipostgres listDatabases() and .db() should return and expect "fully qualified virtual database names," e.g. physical_db_name-schemaname * vanilla postgres should not attempt to use .db() with alternate names in tests * documentation corrections * documentation errors * listDatabases and documentation corrections * more edge cases revealed by latest work from Miro * anchored prefix regexps are optimized documentation improvements * * matchesQuery in the aggregation cursor implementation doesn't throw on unrecognized operators. It should, and it should support the same mongodb operators that the regular find() path does in postgres/sqlite (our official subset), unless there is an extraordinary reason not to. * Similarly, the main query implementation for normal queries should throw on unrecognized operators if it doesn't already. * The dump/restore programmatic APIs in db-connect concern me. These involve returning the entire database as a string, which could exhaust memory. This impacts both utilities and also copyDatabase(). Could these APIs return and expect async iterators instead of strings? * The test "anchored regex on an indexed field uses a btree index search" runs explain on a query that's hardcoded in the test. Instead these SQL based adapters should expose a means to get the SQL for a query, so it can be directly tested. Otherwise this test proves nothing as changes to the adapter accumulate in future. * Why is this test searching for "at least 1" and not exactly 1? it('should find documents with null value', async function() { const docs = await db.collection('test').find({ value: null }).toArray(); // MongoDB matches both null and missing fields with { value: null } expect(docs.length).to.be.at.least(1); }); * What is the maximum size of a db-connect document in the postgres and sqlite adapters? * Update the copyright year in db-connect/LICENSE.md to 2025. * The db-connect README mentions: sqlite://:memory: What happens if you try to use .db('some-name') with that? I think it would be best to just not support throwaway in-memory sqlite databases because I doubt anyone would intentionally store a website in one. * do not swallow dump/restore errors on indexes * cover how to run the utilities * fix detection of source * separate sanitization for index names * regex prefix safety * pnpm --------- Co-authored-by: Thomas Boutell <boutell@vcs.trox.local> * forgot to include a changeset (#5390) * ignore inline table array as draggable ui for windows (#5392) * Layout focus orchestration (#5393) * Pro 9405 remove hreflang (#5395) * Remove hreflang generation and update README * Add changeset * Changeset update * Pro 9406 base url (#5396) * Removes `seoSiteCanonicalUrl` * Update tests and remove missed log * Change semver level * Bump dependencies (#5398) * Bump dependencies * Fix missing test await resulting in random failures * Pro 9405 remove hreflang (#5395) * Remove hreflang generation and update README * Add changeset * Changeset update * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) * allow newer twitter domain * infogr.am still around * facebook no longer does oembed * Layout editable gap (#5397) * a11y fixes (#5401) * clarifications (#5403) * Merge commit from fork * Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly to close this vulnerability. * changeset * Merge commit from fork * fix xmp tag vulnerability * thanks * Merge commit from fork * secure the link URL field of image widgets * credit * Merge commit from fork * Merge commit from fork * Merge commit from fork * Fixed arbitrary image URL import vulnerability in rich text impport API * additional reporter * mergeback (#5409) * Latest merge prerelease 2026 05 (#5404) * Fix choices IDs (#5379) * Fix choices IDs * Cleanup dots from ID values * Update changelog Co-authored-by: Robert Means <robert@apostrophecms.com> --------- Co-authored-by: Robert Means <robert@apostrophecms.com> (cherry picked from commit 9f458b5) * Bump CLI dependencies (#5383) (cherry picked from commit a5e1a4a) * Native browser shortcuts work again (#5384) (cherry picked from commit b9b32bd) * Pro 8838 charset (#5385) * Removes encoding option and comments hardcoded encoding meta * add changeset * Response to first comments (cherry picked from commit 08845c5) * Log aposResponse errors (#5386) * log aposResponse errors * add changeset --------- Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> (cherry picked from commit d45e27f) * merge back the thanks (#5388) (cherry picked from commit f3501f4) * ignore inline table array as draggable ui for windows (#5392) (cherry picked from commit b360b05) * Layout focus orchestration (#5393) (cherry picked from commit 77a2968) * Bump dependencies (#5398) * Bump dependencies * Fix missing test await resulting in random failures (cherry picked from commit 008417f) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) * allow newer twitter domain * infogr.am still around * facebook no longer does oembed (cherry picked from commit e9b3bac) * Layout editable gap (#5397) (cherry picked from commit bc8f7be) * a11y fixes (#5401) (cherry picked from commit 2e2f3b4) * clarifications (#5403) (cherry picked from commit 13f2c69) --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> * Latest security merge (#5407) * Merge commit from fork * Fixed arbitrary image URL import vulnerability in rich text impport API * additional reporter * Merge commit from fork * Merge commit from fork * Merge commit from fork * secure the link URL field of image widgets * credit * Merge commit from fork * fix xmp tag vulnerability * thanks * Merge commit from fork * Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly to close this vulnerability. * changeset * release only (changelogs formatted) (#5408) --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> * mergeback (#5414) * Latest merge prerelease 2026 05 (#5404) * Fix choices IDs (#5379) * Fix choices IDs * Cleanup dots from ID values * Update changelog Co-authored-by: Robert Means <robert@apostrophecms.com> --------- Co-authored-by: Robert Means <robert@apostrophecms.com> (cherry picked from commit 9f458b5) * Bump CLI dependencies (#5383) (cherry picked from commit a5e1a4a) * Native browser shortcuts work again (#5384) (cherry picked from commit b9b32bd) * Pro 8838 charset (#5385) * Removes encoding option and comments hardcoded encoding meta * add changeset * Response to first comments (cherry picked from commit 08845c5) * Log aposResponse errors (#5386) * log aposResponse errors * add changeset --------- Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> (cherry picked from commit d45e27f) * merge back the thanks (#5388) (cherry picked from commit f3501f4) * ignore inline table array as draggable ui for windows (#5392) (cherry picked from commit b360b05) * Layout focus orchestration (#5393) (cherry picked from commit 77a2968) * Bump dependencies (#5398) * Bump dependencies * Fix missing test await resulting in random failures (cherry picked from commit 008417f) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400) * PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) * allow newer twitter domain * infogr.am still around * facebook no longer does oembed (cherry picked from commit e9b3bac) * Layout editable gap (#5397) (cherry picked from commit bc8f7be) * a11y fixes (#5401) (cherry picked from commit 2e2f3b4) * clarifications (#5403) (cherry picked from commit 13f2c69) --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> * Latest security merge (#5407) * Merge commit from fork * Fixed arbitrary image URL import vulnerability in rich text impport API * additional reporter * Merge commit from fork * Merge commit from fork * Merge commit from fork * secure the link URL field of image widgets * credit * Merge commit from fork * fix xmp tag vulnerability * thanks * Merge commit from fork * Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly to close this vulnerability. * changeset * release only (changelogs formatted) (#5408) * allow oembetter to be released (#5412) * release oembetter 1.2.0 (#5413) * release oembetter 1.2.0 * left commit --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> * Fix focus trap on the last element in a modal (#5406) * Fix focus trap on the last element in a modal * Fix trap escaping edge cases * Fix import-export noise (#5399) * remove noise, switch to utils debug * Fix tests * Introduce debug option * changelog * Fix test sorting issue * A11y fixes part 3 (#5416) * Fix editor modal a11y issues * Fix manager a11y problems * Fix page manager a11y problems * fix media manager a11y issues * fix a11y issues in style editor and user settings * Fix login a11y issues * eliminate a modal issue * Remove bad aria in rich text * Fix wrong aria in layout * changelog * Fix totp a11y issues, doc context state safety * Fix uncaught error - popup blockers/tests * Fix initial focus trap issue, introduced with recent changes (#5426) * PRO-9542: fix the bug that breaks sitemaps for RA (#5433) * PRO-9542: fix the bug that breaks sitemaps for RA * see changeset * Feature/prevent infinite redirects (#5429) * log aposResponse errors * add changeset * prevent infinite redirects to external URLs --------- Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> * add draggable: false support to non-inline array field (#5435) * add draggable: false support to non-inline array field * Add changeset * Make logged-in cookie name configurable via options (#5430) The logged-in cookie name was hardcoded as 'loggedIn' with TODO comments indicating it should be configurable. This is needed for deployments where multiple Apostrophe instances share a domain (e.g., staging and production on subpaths) and need distinct cookie names to avoid conflicts. Changes: - Added 'loggedInCookieName' option to the login module (defaults to 'loggedIn' for backward compatibility) - Replaced all hardcoded references with self.loggedInCookieName - Removed the TODO comments Usage: modules: { '@apostrophecms/login': { options: { loggedInCookieName: 'myAppLoggedIn' } } } Addresses the TODO comments: 'get cookie name from config' Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com> * Revert "Make logged-in cookie name configurable via options (#5430)" (#5436) This reverts commit ddcdaa7. * Feature create-apostrophe (#5425) * Fix new schema areas in existing documents (Astro) (#5434) * Fix orphan or new-in-the-schema areas in external front-ends * Save missing empty areas in the DB, refactor nunjucks path * PRO-6295: jsx as an optional alternative to nunjucks (#5391) * jsx as an optional alternative to nunjucks * eslint, all tests pass * log a useful stack trace on attachment errors! Holy shit! * fix lint * clarify behavior * more tests pass linter * This is just a unit test, but it can't hurt to be thorough & satisfy github-advanced-security Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * true access to the apos object in jsx, per the spec * more test coverage, no code changes * fix watchers --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * no watch in prod (#5439) * Fix new schema areas in existing documents (Astro) Part II (#5440) * Prevent data corruption when stubbing areas for Astro * Fix false positive orphan area warnings * Guard against corrupt area items * Fix raw-text sanitization bypass vulnerability and add regression tests (#5432) * changeset for singh contribution (#5442) * Fix relationship select scrolling issue (#5445) * Fix relationship select scrolling issue * Prevent same scrolling bugs to appear in media manager * jsx changeset (#5446) * Ensure install of the project root for astro projects (#5449) * test node 26 (#5450) * test node 26 * support node 26 by bumping the better-sqlite3 version * node 22 requirement * Add link for telemetry policy (#5455) * remove absent options (#5456) * Remove consumed 4.30.0 changesets from main (#5454) * cli links that are correct, or will be post publish (#5458) * release db connect to solve chicken and egg problem in cypress-tools (#5459) * Corrects documentation links (#5457) * Corrects documentation links * correct `guides` -> `guide` * Merge commit from fork * Merge commit from fork * Merge commit from fork * Merge commit from fork * Security: added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Thanks to [crattack](https://github.com/crattack) for reporting the vulnerability. * changeset * removed duplicate changeset * patch the right module --------- Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com> Co-authored-by: Robert Means <robert@apostrophecms.com> Co-authored-by: haroun <1765606+haroun@users.noreply.github.com> Co-authored-by: Harouna TraorĂ© <haroun@users.noreply.github.com> Co-authored-by: Thomas Boutell <boutell@vcs.trox.local> Co-authored-by: Stuart Romanek <stuart@apostrophecms.com> Co-authored-by: RohithVangalla1 <reachrohithv@gmail.com> Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Dipanshu singh <161134993+Dipanshusinghh@users.noreply.github.com>
* changelogs * formatting
* Hotfix cli links (#5469) * Fix broken link * Add changeset * create-apostrophe hotfix --------- Co-authored-by: Robert Means <robert@apostrophecms.com>
* Bump CLI dependencies (#5383)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
* Native browser shortcuts work again (#5384)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* merge back the thanks (#5388)
* Postgres (#5365)
* postgres experimental WIP
* astonishingly, all mocha tests of apostrophe pass with this
* mocha tests pass, actual sites work
* lint clean
* listDatabases support, but changes are coming
* wip
* dump and restore updates
* backpressure, adequate handling of ObjectId for our needs (becomes its hex representation)
* mild performance optimization
* profiling
* testing issue resolved
* refactored to db-connect module, introduced sqlite adapter
* sqlite WIP
* debugging
* programmatic API for dump/restore/copy dbs
* linting, documentation
* MIT license
* text ranking is more accurate, documentation is more complete
* good full text search for sqlite
* updates for compatibility with the rest of the public and private modules, plus a few fixes to genuinely ambiguous tests
* requirements found by testing private modules
* fixes from full cypress run
* eslint passing
* restore permissions
* maximize atomicity
* bug fixes
* * exit properly when asset tests fail
* "npm test" tests all three adapters
* ignore claude-tools in eslint
* postgres and sqlite-inclusive ci matrix attempt
* clean up logs
* We hit github's limit on total configurations because every package gets its own matrix.
Solve that with grouping:
* apostrophe core
* All regular ecosystem packages other than core
* non-database-requiring packges
* mongodb-specific packages
This will probably speed it up too because it won't have to spin up a container a bazillion times.
* hardened the asset tests, made them less timing sensitive, fixed a bad commit resulting from the
way they dodgily patch themselves without a robust cleanup mechanism
* fix a root cause of asset test instability
* log mess
* implemented missing $size operator
* test compatibility
* advanced permission uses regex in $in
* regex in $in
* .db() should not make false promises in plain postgres mode, it should fail
* ability to specify a default adapter
* obsolete file
* put escapeHost back where it belongs
* dead code removal, test cleanup
* emulate-mongo-3-driver only needed in db-connect
* no claude logs in repo (tools are welcome)
* * shared aggregation implementation, other shared things
* optimize $match when it is the first step in aggregation, don't fetch the whole collection đŸ˜œ
* multipostgres listDatabases() and .db() should return and expect "fully qualified virtual database names," e.g. physical_db_name-schemaname
* vanilla postgres should not attempt to use .db() with alternate names in tests
* documentation corrections
* documentation errors
* listDatabases and documentation corrections
* more edge cases revealed by latest work from Miro
* anchored prefix regexps are optimized
documentation improvements
* * matchesQuery in the aggregation cursor implementation doesn't throw on unrecognized operators. It should, and it should support the same mongodb operators that the regular find()
path does in postgres/sqlite (our official subset), unless there is an extraordinary reason not to.
* Similarly, the main query implementation for normal queries should throw on unrecognized operators if it doesn't already.
* The dump/restore programmatic APIs in db-connect concern me. These involve returning the entire database as a string, which could exhaust memory. This impacts both utilities and
also copyDatabase(). Could these APIs return and expect async iterators instead of strings?
* The test "anchored regex on an indexed field uses a btree index search" runs explain on a query that's hardcoded in the test. Instead these SQL based adapters should expose a means
to get the SQL for a query, so it can be directly tested. Otherwise this test proves nothing as changes to the adapter accumulate in future.
* Why is this test searching for "at least 1" and not exactly 1?
it('should find documents with null value', async function() {
const docs = await db.collection('test').find({ value: null }).toArray();
// MongoDB matches both null and missing fields with { value: null }
expect(docs.length).to.be.at.least(1);
});
* What is the maximum size of a db-connect document in the postgres and sqlite adapters?
* Update the copyright year in db-connect/LICENSE.md to 2025.
* The db-connect README mentions: sqlite://:memory: What happens if you try to use .db('some-name') with that? I think it would be best to just not support throwaway in-memory sqlite
databases because I doubt anyone would intentionally store a website in one.
* do not swallow dump/restore errors on indexes
* cover how to run the utilities
* fix detection of source
* separate sanitization for index names
* regex prefix safety
* pnpm
---------
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
* forgot to include a changeset (#5390)
* ignore inline table array as draggable ui for windows (#5392)
* Layout focus orchestration (#5393)
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* Pro 9406 base url (#5396)
* Removes `seoSiteCanonicalUrl`
* Update tests and remove missed log
* Change semver level
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
* Layout editable gap (#5397)
* a11y fixes (#5401)
* clarifications (#5403)
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* mergeback (#5409)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* mergeback (#5414)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
* allow oembetter to be released (#5412)
* release oembetter 1.2.0 (#5413)
* release oembetter 1.2.0
* left commit
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Fix focus trap on the last element in a modal (#5406)
* Fix focus trap on the last element in a modal
* Fix trap escaping edge cases
* Fix import-export noise (#5399)
* remove noise, switch to utils debug
* Fix tests
* Introduce debug option
* changelog
* Fix test sorting issue
* A11y fixes part 3 (#5416)
* Fix editor modal a11y issues
* Fix manager a11y problems
* Fix page manager a11y problems
* fix media manager a11y issues
* fix a11y issues in style editor and user settings
* Fix login a11y issues
* eliminate a modal issue
* Remove bad aria in rich text
* Fix wrong aria in layout
* changelog
* Fix totp a11y issues, doc context state safety
* Fix uncaught error - popup blockers/tests
* Fix initial focus trap issue, introduced with recent changes (#5426)
* PRO-9542: fix the bug that breaks sitemaps for RA (#5433)
* PRO-9542: fix the bug that breaks sitemaps for RA
* see changeset
* Feature/prevent infinite redirects (#5429)
* log aposResponse errors
* add changeset
* prevent infinite redirects to external URLs
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* add draggable: false support to non-inline array field (#5435)
* add draggable: false support to non-inline array field
* Add changeset
* Make logged-in cookie name configurable via options (#5430)
The logged-in cookie name was hardcoded as 'loggedIn' with TODO comments
indicating it should be configurable. This is needed for deployments
where multiple Apostrophe instances share a domain (e.g., staging and
production on subpaths) and need distinct cookie names to avoid conflicts.
Changes:
- Added 'loggedInCookieName' option to the login module (defaults to
'loggedIn' for backward compatibility)
- Replaced all hardcoded references with self.loggedInCookieName
- Removed the TODO comments
Usage:
modules: {
'@apostrophecms/login': {
options: {
loggedInCookieName: 'myAppLoggedIn'
}
}
}
Addresses the TODO comments:
'get cookie name from config'
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
* Revert "Make logged-in cookie name configurable via options (#5430)" (#5436)
This reverts commit ddcdaa7ff6864cd55d6fef9dfdfca2eaf63a5969.
* Feature create-apostrophe (#5425)
* Fix new schema areas in existing documents (Astro) (#5434)
* Fix orphan or new-in-the-schema areas in external front-ends
* Save missing empty areas in the DB, refactor nunjucks path
* PRO-6295: jsx as an optional alternative to nunjucks (#5391)
* jsx as an optional alternative to nunjucks
* eslint, all tests pass
* log a useful stack trace on attachment errors! Holy shit!
* fix lint
* clarify behavior
* more tests
pass linter
* This is just a unit test, but it can't hurt to be thorough & satisfy github-advanced-security
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* true access to the apos object in jsx, per the spec
* more test coverage, no code changes
* fix watchers
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* no watch in prod (#5439)
* Fix new schema areas in existing documents (Astro) Part II (#5440)
* Prevent data corruption when stubbing areas for Astro
* Fix false positive orphan area warnings
* Guard against corrupt area items
* Fix raw-text sanitization bypass vulnerability and add regression tests (#5432)
* changeset for singh contribution (#5442)
* Fix relationship select scrolling issue (#5445)
* Fix relationship select scrolling issue
* Prevent same scrolling bugs to appear in media manager
* jsx changeset (#5446)
* Ensure install of the project root for astro projects (#5449)
* test node 26 (#5450)
* test node 26
* support node 26 by bumping the better-sqlite3 version
* node 22 requirement
* Add link for telemetry policy (#5455)
* remove absent options (#5456)
* Remove consumed 4.30.0 changesets from main (#5454)
* cli links that are correct, or will be post publish (#5458)
* release db connect to solve chicken and egg problem in cypress-tools (#5459)
* Corrects documentation links (#5457)
* Corrects documentation links
* correct `guides` -> `guide`
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Security: added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Thanks to [crattack](https://github.com/crattack) for reporting the vulnerability.
* changeset
* removed duplicate changeset
* patch the right module
* Mergeback latest (#5468)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
* allow oembetter to be released (#5412)
* release oembetter 1.2.0 (#5413)
* release oembetter 1.2.0
* left commit
* [latest[ PRO-9441: modal focus trap
* [latest] Fix import-export noise
* [latest] A11y fixes part 3
* Fix initial focus trap issue, introduced with recent changes (#5427)
* merge main to latest (#5460)
* Latest security q2 (#5463)
* Bump CLI dependencies (#5383)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
* Native browser shortcuts work again (#5384)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* merge back the thanks (#5388)
* Postgres (#5365)
* postgres experimental WIP
* astonishingly, all mocha tests of apostrophe pass with this
* mocha tests pass, actual sites work
* lint clean
* listDatabases support, but changes are coming
* wip
* dump and restore updates
* backpressure, adequate handling of ObjectId for our needs (becomes its hex representation)
* mild performance optimization
* profiling
* testing issue resolved
* refactored to db-connect module, introduced sqlite adapter
* sqlite WIP
* debugging
* programmatic API for dump/restore/copy dbs
* linting, documentation
* MIT license
* text ranking is more accurate, documentation is more complete
* good full text search for sqlite
* updates for compatibility with the rest of the public and private modules, plus a few fixes to genuinely ambiguous tests
* requirements found by testing private modules
* fixes from full cypress run
* eslint passing
* restore permissions
* maximize atomicity
* bug fixes
* * exit properly when asset tests fail
* "npm test" tests all three adapters
* ignore claude-tools in eslint
* postgres and sqlite-inclusive ci matrix attempt
* clean up logs
* We hit github's limit on total configurations because every package gets its own matrix.
Solve that with grouping:
* apostrophe core
* All regular ecosystem packages other than core
* non-database-requiring packges
* mongodb-specific packages
This will probably speed it up too because it won't have to spin up a container a bazillion times.
* hardened the asset tests, made them less timing sensitive, fixed a bad commit resulting from the
way they dodgily patch themselves without a robust cleanup mechanism
* fix a root cause of asset test instability
* log mess
* implemented missing $size operator
* test compatibility
* advanced permission uses regex in $in
* regex in $in
* .db() should not make false promises in plain postgres mode, it should fail
* ability to specify a default adapter
* obsolete file
* put escapeHost back where it belongs
* dead code removal, test cleanup
* emulate-mongo-3-driver only needed in db-connect
* no claude logs in repo (tools are welcome)
* * shared aggregation implementation, other shared things
* optimize $match when it is the first step in aggregation, don't fetch the whole collection đŸ˜œ
* multipostgres listDatabases() and .db() should return and expect "fully qualified virtual database names," e.g. physical_db_name-schemaname
* vanilla postgres should not attempt to use .db() with alternate names in tests
* documentation corrections
* documentation errors
* listDatabases and documentation corrections
* more edge cases revealed by latest work from Miro
* anchored prefix regexps are optimized
documentation improvements
* * matchesQuery in the aggregation cursor implementation doesn't throw on unrecognized operators. It should, and it should support the same mongodb operators that the regular find()
path does in postgres/sqlite (our official subset), unless there is an extraordinary reason not to.
* Similarly, the main query implementation for normal queries should throw on unrecognized operators if it doesn't already.
* The dump/restore programmatic APIs in db-connect concern me. These involve returning the entire database as a string, which could exhaust memory. This impacts both utilities and
also copyDatabase(). Could these APIs return and expect async iterators instead of strings?
* The test "anchored regex on an indexed field uses a btree index search" runs explain on a query that's hardcoded in the test. Instead these SQL based adapters should expose a means
to get the SQL for a query, so it can be directly tested. Otherwise this test proves nothing as changes to the adapter accumulate in future.
* Why is this test searching for "at least 1" and not exactly 1?
it('should find documents with null value', async function() {
const docs = await db.collection('test').find({ value: null }).toArray();
// MongoDB matches both null and missing fields with { value: null }
expect(docs.length).to.be.at.least(1);
});
* What is the maximum size of a db-connect document in the postgres and sqlite adapters?
* Update the copyright year in db-connect/LICENSE.md to 2025.
* The db-connect README mentions: sqlite://:memory: What happens if you try to use .db('some-name') with that? I think it would be best to just not support throwaway in-memory sqlite
databases because I doubt anyone would intentionally store a website in one.
* do not swallow dump/restore errors on indexes
* cover how to run the utilities
* fix detection of source
* separate sanitization for index names
* regex prefix safety
* pnpm
---------
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
* forgot to include a changeset (#5390)
* ignore inline table array as draggable ui for windows (#5392)
* Layout focus orchestration (#5393)
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* Pro 9406 base url (#5396)
* Removes `seoSiteCanonicalUrl`
* Update tests and remove missed log
* Change semver level
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
* Layout editable gap (#5397)
* a11y fixes (#5401)
* clarifications (#5403)
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* mergeback (#5409)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* mergeback (#5414)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
* allow oembetter to be released (#5412)
* release oembetter 1.2.0 (#5413)
* release oembetter 1.2.0
* left commit
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Fix focus trap on the last element in a modal (#5406)
* Fix focus trap on the last element in a modal
* Fix trap escaping edge cases
* Fix import-export noise (#5399)
* remove noise, switch to utils debug
* Fix tests
* Introduce debug option
* changelog
* Fix test sorting issue
* A11y fixes part 3 (#5416)
* Fix editor modal a11y issues
* Fix manager a11y problems
* Fix page manager a11y problems
* fix media manager a11y issues
* fix a11y issues in style editor and user settings
* Fix login a11y issues
* eliminate a modal issue
* Remove bad aria in rich text
* Fix wrong aria in layout
* changelog
* Fix totp a11y issues, doc context state safety
* Fix uncaught error - popup blockers/tests
* Fix initial focus trap issue, introduced with recent changes (#5426)
* PRO-9542: fix the bug that breaks sitemaps for RA (#5433)
* PRO-9542: fix the bug that breaks sitemaps for RA
* see changeset
* Feature/prevent infinite redirects (#5429)
* log aposResponse errors
* add changeset
* prevent infinite redirects to external URLs
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* add draggable: false support to non-inline array field (#5435)
* add draggable: false support to non-inline array field
* Add changeset
* Make logged-in cookie name configurable via options (#5430)
The logged-in cookie name was hardcoded as 'loggedIn' with TODO comments
indicating it should be configurable. This is needed for deployments
where multiple Apostrophe instances share a domain (e.g., staging and
production on subpaths) and need distinct cookie names to avoid conflicts.
Changes:
- Added 'loggedInCookieName' option to the login module (defaults to
'loggedIn' for backward compatibility)
- Replaced all hardcoded references with self.loggedInCookieName
- Removed the TODO comments
Usage:
modules: {
'@apostrophecms/login': {
options: {
loggedInCookieName: 'myAppLoggedIn'
}
}
}
Addresses the TODO comments:
'get cookie name from config'
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
* Revert "Make logged-in cookie name configurable via options (#5430)" (#5436)
This reverts commit ddcdaa7ff6864cd55d6fef9dfdfca2eaf63a5969.
* Feature create-apostrophe (#5425)
* Fix new schema areas in existing documents (Astro) (#5434)
* Fix orphan or new-in-the-schema areas in external front-ends
* Save missing empty areas in the DB, refactor nunjucks path
* PRO-6295: jsx as an optional alternative to nunjucks (#5391)
* jsx as an optional alternative to nunjucks
* eslint, all tests pass
* log a useful stack trace on attachment errors! Holy shit!
* fix lint
* clarify behavior
* more tests
pass linter
* This is just a unit test, but it can't hurt to be thorough & satisfy github-advanced-security
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* true access to the apos object in jsx, per the spec
* more test coverage, no code changes
* fix watchers
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* no watch in prod (#5439)
* Fix new schema areas in existing documents (Astro) Part II (#5440)
* Prevent data corruption when stubbing areas for Astro
* Fix false positive orphan area warnings
* Guard against corrupt area items
* Fix raw-text sanitization bypass vulnerability and add regression tests (#5432)
* changeset for singh contribution (#5442)
* Fix relationship select scrolling issue (#5445)
* Fix relationship select scrolling issue
* Prevent same scrolling bugs to appear in media manager
* jsx changeset (#5446)
* Ensure install of the project root for astro projects (#5449)
* test node 26 (#5450)
* test node 26
* support node 26 by bumping the better-sqlite3 version
* node 22 requirement
* Add link for telemetry policy (#5455)
* remove absent options (#5456)
* Remove consumed 4.30.0 changesets from main (#5454)
* cli links that are correct, or will be post publish (#5458)
* release db connect to solve chicken and egg problem in cypress-tools (#5459)
* Corrects documentation links (#5457)
* Corrects documentation links
* correct `guides` -> `guide`
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
Co-authored-by: RohithVangalla1 <reachrohithv@gmail.com>
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Dipanshu singh <161134993+Dipanshusinghh@users.noreply.github.com>
* Latest security q2 (#5464)
* Bump CLI dependencies (#5383)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
* Native browser shortcuts work again (#5384)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* merge back the thanks (#5388)
* Postgres (#5365)
* postgres experimental WIP
* astonishingly, all mocha tests of apostrophe pass with this
* mocha tests pass, actual sites work
* lint clean
* listDatabases support, but changes are coming
* wip
* dump and restore updates
* backpressure, adequate handling of ObjectId for our needs (becomes its hex representation)
* mild performance optimization
* profiling
* testing issue resolved
* refactored to db-connect module, introduced sqlite adapter
* sqlite WIP
* debugging
* programmatic API for dump/restore/copy dbs
* linting, documentation
* MIT license
* text ranking is more accurate, documentation is more complete
* good full text search for sqlite
* updates for compatibility with the rest of the public and private modules, plus a few fixes to genuinely ambiguous tests
* requirements found by testing private modules
* fixes from full cypress run
* eslint passing
* restore permissions
* maximize atomicity
* bug fixes
* * exit properly when asset tests fail
* "npm test" tests all three adapters
* ignore claude-tools in eslint
* postgres and sqlite-inclusive ci matrix attempt
* clean up logs
* We hit github's limit on total configurations because every package gets its own matrix.
Solve that with grouping:
* apostrophe core
* All regular ecosystem packages other than core
* non-database-requiring packges
* mongodb-specific packages
This will probably speed it up too because it won't have to spin up a container a bazillion times.
* hardened the asset tests, made them less timing sensitive, fixed a bad commit resulting from the
way they dodgily patch themselves without a robust cleanup mechanism
* fix a root cause of asset test instability
* log mess
* implemented missing $size operator
* test compatibility
* advanced permission uses regex in $in
* regex in $in
* .db() should not make false promises in plain postgres mode, it should fail
* ability to specify a default adapter
* obsolete file
* put escapeHost back where it belongs
* dead code removal, test cleanup
* emulate-mongo-3-driver only needed in db-connect
* no claude logs in repo (tools are welcome)
* * shared aggregation implementation, other shared things
* optimize $match when it is the first step in aggregation, don't fetch the whole collection đŸ˜œ
* multipostgres listDatabases() and .db() should return and expect "fully qualified virtual database names," e.g. physical_db_name-schemaname
* vanilla postgres should not attempt to use .db() with alternate names in tests
* documentation corrections
* documentation errors
* listDatabases and documentation corrections
* more edge cases revealed by latest work from Miro
* anchored prefix regexps are optimized
documentation improvements
* * matchesQuery in the aggregation cursor implementation doesn't throw on unrecognized operators. It should, and it should support the same mongodb operators that the regular find()
path does in postgres/sqlite (our official subset), unless there is an extraordinary reason not to.
* Similarly, the main query implementation for normal queries should throw on unrecognized operators if it doesn't already.
* The dump/restore programmatic APIs in db-connect concern me. These involve returning the entire database as a string, which could exhaust memory. This impacts both utilities and
also copyDatabase(). Could these APIs return and expect async iterators instead of strings?
* The test "anchored regex on an indexed field uses a btree index search" runs explain on a query that's hardcoded in the test. Instead these SQL based adapters should expose a means
to get the SQL for a query, so it can be directly tested. Otherwise this test proves nothing as changes to the adapter accumulate in future.
* Why is this test searching for "at least 1" and not exactly 1?
it('should find documents with null value', async function() {
const docs = await db.collection('test').find({ value: null }).toArray();
// MongoDB matches both null and missing fields with { value: null }
expect(docs.length).to.be.at.least(1);
});
* What is the maximum size of a db-connect document in the postgres and sqlite adapters?
* Update the copyright year in db-connect/LICENSE.md to 2025.
* The db-connect README mentions: sqlite://:memory: What happens if you try to use .db('some-name') with that? I think it would be best to just not support throwaway in-memory sqlite
databases because I doubt anyone would intentionally store a website in one.
* do not swallow dump/restore errors on indexes
* cover how to run the utilities
* fix detection of source
* separate sanitization for index names
* regex prefix safety
* pnpm
---------
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
* forgot to include a changeset (#5390)
* ignore inline table array as draggable ui for windows (#5392)
* Layout focus orchestration (#5393)
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* Pro 9406 base url (#5396)
* Removes `seoSiteCanonicalUrl`
* Update tests and remove missed log
* Change semver level
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
* Layout editable gap (#5397)
* a11y fixes (#5401)
* clarifications (#5403)
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* mergeback (#5409)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* mergeback (#5414)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
* allow oembetter to be released (#5412)
* release oembetter 1.2.0 (#5413)
* release oembetter 1.2.0
* left commit
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Fix focus trap on the last element in a modal (#5406)
* Fix focus trap on the last element in a modal
* Fix trap escaping edge cases
* Fix import-export noise (#5399)
* remove noise, switch to utils debug
* Fix tests
* Introduce debug option
* changelog
* Fix test sorting issue
* A11y fixes part 3 (#5416)
* Fix editor modal a11y issues
* Fix manager a11y problems
* Fix page manager a11y problems
* fix media manager a11y issues
* fix a11y issues in style editor and user settings
* Fix login a11y issues
* eliminate a modal issue
* Remove bad aria in rich text
* Fix wrong aria in layout
* changelog
* Fix totp a11y issues, doc context state safety
* Fix uncaught error - popup blockers/tests
* Fix initial focus trap issue, introduced with recent changes (#5426)
* PRO-9542: fix the bug that breaks sitemaps for RA (#5433)
* PRO-9542: fix the bug that breaks sitemaps for RA
* see changeset
* Feature/prevent infinite redirects (#5429)
* log aposResponse errors
* add changeset
* prevent infinite redirects to external URLs
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* add draggable: false support to non-inline array field (#5435)
* add draggable: false support to non-inline array field
* Add changeset
* Make logged-in cookie name configurable via options (#5430)
The logged-in cookie name was hardcoded as 'loggedIn' with TODO comments
indicating it should be configurable. This is needed for deployments
where multiple Apostrophe instances share a domain (e.g., staging and
production on subpaths) and need distinct cookie names to avoid conflicts.
Changes:
- Added 'loggedInCookieName' option to the login module (defaults to
'loggedIn' for backward compatibility)
- Replaced all hardcoded references with self.loggedInCookieName
- Removed the TODO comments
Usage:
modules: {
'@apostrophecms/login': {
options: {
loggedInCookieName: 'myAppLoggedIn'
}
}
}
Addresses the TODO comments:
'get cookie name from config'
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
* Revert "Make logged-in cookie name configurable via options (#5430)" (#5436)
This reverts commit ddcdaa7ff6864cd55d6fef9dfdfca2eaf63a5969.
* Feature create-apostrophe (#5425)
* Fix new schema areas in existing documents (Astro) (#5434)
* Fix orphan or new-in-the-schema areas in external front-ends
* Save missing empty areas in the DB, refactor nunjucks path
* PRO-6295: jsx as an optional alternative to nunjucks (#5391)
* jsx as an optional alternative to nunjucks
* eslint, all tests pass
* log a useful stack trace on attachment errors! Holy shit!
* fix lint
* clarify behavior
* more tests
pass linter
* This is just a unit test, but it can't hurt to be thorough & satisfy github-advanced-security
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* true access to the apos object in jsx, per the spec
* more test coverage, no code changes
* fix watchers
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* no watch in prod (#5439)
* Fix new schema areas in existing documents (Astro) Part II (#5440)
* Prevent data corruption when stubbing areas for Astro
* Fix false positive orphan area warnings
* Guard against corrupt area items
* Fix raw-text sanitization bypass vulnerability and add regression tests (#5432)
* changeset for singh contribution (#5442)
* Fix relationship select scrolling issue (#5445)
* Fix relationship select scrolling issue
* Prevent same scrolling bugs to appear in media manager
* jsx changeset (#5446)
* Ensure install of the project root for astro projects (#5449)
* test node 26 (#5450)
* test node 26
* support node 26 by bumping the better-sqlite3 version
* node 22 requirement
* Add link for telemetry policy (#5455)
* remove absent options (#5456)
* Remove consumed 4.30.0 changesets from main (#5454)
* cli links that are correct, or will be post publish (#5458)
* release db connect to solve chicken and egg problem in cypress-tools (#5459)
* Corrects documentation links (#5457)
* Corrects documentation links
* correct `guides` -> `guide`
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Security: added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Thanks to [crattack](https://github.com/crattack) for reporting the vulnerability.
* changeset
* removed duplicate changeset
* patch the right module
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
Co-authored-by: RohithVangalla1 <reachrohithv@gmail.com>
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Dipanshu singh <161134993+Dipanshusinghh@users.noreply.github.com>
* release and changelog edits (#5465)
* changelogs
* formatting
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
Co-authored-by: RohithVangalla1 <reachrohithv@gmail.com>
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Dipanshu singh <161134993+Dipanshusinghh@users.noreply.github.com>
* Hotfix cli links (#5469)
* Fix broken link
* Add changeset
* Hotfix cli links (#5469)
* Fix broken link
* Add changeset
* Fix asset URLs when a site prefix is configured (#5448)
* Mergeup latest to main (#5473)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding opti…
Dumb reconciliation thing
* Bump CLI dependencies (#5383)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
* Native browser shortcuts work again (#5384)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* merge back the thanks (#5388)
* Postgres (#5365)
* postgres experimental WIP
* astonishingly, all mocha tests of apostrophe pass with this
* mocha tests pass, actual sites work
* lint clean
* listDatabases support, but changes are coming
* wip
* dump and restore updates
* backpressure, adequate handling of ObjectId for our needs (becomes its hex representation)
* mild performance optimization
* profiling
* testing issue resolved
* refactored to db-connect module, introduced sqlite adapter
* sqlite WIP
* debugging
* programmatic API for dump/restore/copy dbs
* linting, documentation
* MIT license
* text ranking is more accurate, documentation is more complete
* good full text search for sqlite
* updates for compatibility with the rest of the public and private modules, plus a few fixes to genuinely ambiguous tests
* requirements found by testing private modules
* fixes from full cypress run
* eslint passing
* restore permissions
* maximize atomicity
* bug fixes
* * exit properly when asset tests fail
* "npm test" tests all three adapters
* ignore claude-tools in eslint
* postgres and sqlite-inclusive ci matrix attempt
* clean up logs
* We hit github's limit on total configurations because every package gets its own matrix.
Solve that with grouping:
* apostrophe core
* All regular ecosystem packages other than core
* non-database-requiring packges
* mongodb-specific packages
This will probably speed it up too because it won't have to spin up a container a bazillion times.
* hardened the asset tests, made them less timing sensitive, fixed a bad commit resulting from the
way they dodgily patch themselves without a robust cleanup mechanism
* fix a root cause of asset test instability
* log mess
* implemented missing $size operator
* test compatibility
* advanced permission uses regex in $in
* regex in $in
* .db() should not make false promises in plain postgres mode, it should fail
* ability to specify a default adapter
* obsolete file
* put escapeHost back where it belongs
* dead code removal, test cleanup
* emulate-mongo-3-driver only needed in db-connect
* no claude logs in repo (tools are welcome)
* * shared aggregation implementation, other shared things
* optimize $match when it is the first step in aggregation, don't fetch the whole collection đŸ˜œ
* multipostgres listDatabases() and .db() should return and expect "fully qualified virtual database names," e.g. physical_db_name-schemaname
* vanilla postgres should not attempt to use .db() with alternate names in tests
* documentation corrections
* documentation errors
* listDatabases and documentation corrections
* more edge cases revealed by latest work from Miro
* anchored prefix regexps are optimized
documentation improvements
* * matchesQuery in the aggregation cursor implementation doesn't throw on unrecognized operators. It should, and it should support the same mongodb operators that the regular find()
path does in postgres/sqlite (our official subset), unless there is an extraordinary reason not to.
* Similarly, the main query implementation for normal queries should throw on unrecognized operators if it doesn't already.
* The dump/restore programmatic APIs in db-connect concern me. These involve returning the entire database as a string, which could exhaust memory. This impacts both utilities and
also copyDatabase(). Could these APIs return and expect async iterators instead of strings?
* The test "anchored regex on an indexed field uses a btree index search" runs explain on a query that's hardcoded in the test. Instead these SQL based adapters should expose a means
to get the SQL for a query, so it can be directly tested. Otherwise this test proves nothing as changes to the adapter accumulate in future.
* Why is this test searching for "at least 1" and not exactly 1?
it('should find documents with null value', async function() {
const docs = await db.collection('test').find({ value: null }).toArray();
// MongoDB matches both null and missing fields with { value: null }
expect(docs.length).to.be.at.least(1);
});
* What is the maximum size of a db-connect document in the postgres and sqlite adapters?
* Update the copyright year in db-connect/LICENSE.md to 2025.
* The db-connect README mentions: sqlite://:memory: What happens if you try to use .db('some-name') with that? I think it would be best to just not support throwaway in-memory sqlite
databases because I doubt anyone would intentionally store a website in one.
* do not swallow dump/restore errors on indexes
* cover how to run the utilities
* fix detection of source
* separate sanitization for index names
* regex prefix safety
* pnpm
---------
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
* forgot to include a changeset (#5390)
* ignore inline table array as draggable ui for windows (#5392)
* Layout focus orchestration (#5393)
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* Pro 9406 base url (#5396)
* Removes `seoSiteCanonicalUrl`
* Update tests and remove missed log
* Change semver level
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
* Layout editable gap (#5397)
* a11y fixes (#5401)
* clarifications (#5403)
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* mergeback (#5409)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* mergeback (#5414)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
* allow oembetter to be released (#5412)
* release oembetter 1.2.0 (#5413)
* release oembetter 1.2.0
* left commit
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Fix focus trap on the last element in a modal (#5406)
* Fix focus trap on the last element in a modal
* Fix trap escaping edge cases
* Fix import-export noise (#5399)
* remove noise, switch to utils debug
* Fix tests
* Introduce debug option
* changelog
* Fix test sorting issue
* A11y fixes part 3 (#5416)
* Fix editor modal a11y issues
* Fix manager a11y problems
* Fix page manager a11y problems
* fix media manager a11y issues
* fix a11y issues in style editor and user settings
* Fix login a11y issues
* eliminate a modal issue
* Remove bad aria in rich text
* Fix wrong aria in layout
* changelog
* Fix totp a11y issues, doc context state safety
* Fix uncaught error - popup blockers/tests
* Fix initial focus trap issue, introduced with recent changes (#5426)
* PRO-9542: fix the bug that breaks sitemaps for RA (#5433)
* PRO-9542: fix the bug that breaks sitemaps for RA
* see changeset
* Feature/prevent infinite redirects (#5429)
* log aposResponse errors
* add changeset
* prevent infinite redirects to external URLs
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* add draggable: false support to non-inline array field (#5435)
* add draggable: false support to non-inline array field
* Add changeset
* Make logged-in cookie name configurable via options (#5430)
The logged-in cookie name was hardcoded as 'loggedIn' with TODO comments
indicating it should be configurable. This is needed for deployments
where multiple Apostrophe instances share a domain (e.g., staging and
production on subpaths) and need distinct cookie names to avoid conflicts.
Changes:
- Added 'loggedInCookieName' option to the login module (defaults to
'loggedIn' for backward compatibility)
- Replaced all hardcoded references with self.loggedInCookieName
- Removed the TODO comments
Usage:
modules: {
'@apostrophecms/login': {
options: {
loggedInCookieName: 'myAppLoggedIn'
}
}
}
Addresses the TODO comments:
'get cookie name from config'
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
* Revert "Make logged-in cookie name configurable via options (#5430)" (#5436)
This reverts commit ddcdaa7ff6864cd55d6fef9dfdfca2eaf63a5969.
* Feature create-apostrophe (#5425)
* Fix new schema areas in existing documents (Astro) (#5434)
* Fix orphan or new-in-the-schema areas in external front-ends
* Save missing empty areas in the DB, refactor nunjucks path
* PRO-6295: jsx as an optional alternative to nunjucks (#5391)
* jsx as an optional alternative to nunjucks
* eslint, all tests pass
* log a useful stack trace on attachment errors! Holy shit!
* fix lint
* clarify behavior
* more tests
pass linter
* This is just a unit test, but it can't hurt to be thorough & satisfy github-advanced-security
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* true access to the apos object in jsx, per the spec
* more test coverage, no code changes
* fix watchers
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* no watch in prod (#5439)
* Fix new schema areas in existing documents (Astro) Part II (#5440)
* Prevent data corruption when stubbing areas for Astro
* Fix false positive orphan area warnings
* Guard against corrupt area items
* Fix raw-text sanitization bypass vulnerability and add regression tests (#5432)
* changeset for singh contribution (#5442)
* Fix relationship select scrolling issue (#5445)
* Fix relationship select scrolling issue
* Prevent same scrolling bugs to appear in media manager
* jsx changeset (#5446)
* Ensure install of the project root for astro projects (#5449)
* test node 26 (#5450)
* test node 26
* support node 26 by bumping the better-sqlite3 version
* node 22 requirement
* Add link for telemetry policy (#5455)
* remove absent options (#5456)
* Remove consumed 4.30.0 changesets from main (#5454)
* cli links that are correct, or will be post publish (#5458)
* release db connect to solve chicken and egg problem in cypress-tools (#5459)
* Corrects documentation links (#5457)
* Corrects documentation links
* correct `guides` -> `guide`
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Security: added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Thanks to [crattack](https://github.com/crattack) for reporting the vulnerability.
* changeset
* removed duplicate changeset
* patch the right module
* Mergeback latest (#5468)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
* allow oembetter to be released (#5412)
* release oembetter 1.2.0 (#5413)
* release oembetter 1.2.0
* left commit
* [latest[ PRO-9441: modal focus trap
* [latest] Fix import-export noise
* [latest] A11y fixes part 3
* Fix initial focus trap issue, introduced with recent changes (#5427)
* merge main to latest (#5460)
* Latest security q2 (#5463)
* Bump CLI dependencies (#5383)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
* Native browser shortcuts work again (#5384)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* merge back the thanks (#5388)
* Postgres (#5365)
* postgres experimental WIP
* astonishingly, all mocha tests of apostrophe pass with this
* mocha tests pass, actual sites work
* lint clean
* listDatabases support, but changes are coming
* wip
* dump and restore updates
* backpressure, adequate handling of ObjectId for our needs (becomes its hex representation)
* mild performance optimization
* profiling
* testing issue resolved
* refactored to db-connect module, introduced sqlite adapter
* sqlite WIP
* debugging
* programmatic API for dump/restore/copy dbs
* linting, documentation
* MIT license
* text ranking is more accurate, documentation is more complete
* good full text search for sqlite
* updates for compatibility with the rest of the public and private modules, plus a few fixes to genuinely ambiguous tests
* requirements found by testing private modules
* fixes from full cypress run
* eslint passing
* restore permissions
* maximize atomicity
* bug fixes
* * exit properly when asset tests fail
* "npm test" tests all three adapters
* ignore claude-tools in eslint
* postgres and sqlite-inclusive ci matrix attempt
* clean up logs
* We hit github's limit on total configurations because every package gets its own matrix.
Solve that with grouping:
* apostrophe core
* All regular ecosystem packages other than core
* non-database-requiring packges
* mongodb-specific packages
This will probably speed it up too because it won't have to spin up a container a bazillion times.
* hardened the asset tests, made them less timing sensitive, fixed a bad commit resulting from the
way they dodgily patch themselves without a robust cleanup mechanism
* fix a root cause of asset test instability
* log mess
* implemented missing $size operator
* test compatibility
* advanced permission uses regex in $in
* regex in $in
* .db() should not make false promises in plain postgres mode, it should fail
* ability to specify a default adapter
* obsolete file
* put escapeHost back where it belongs
* dead code removal, test cleanup
* emulate-mongo-3-driver only needed in db-connect
* no claude logs in repo (tools are welcome)
* * shared aggregation implementation, other shared things
* optimize $match when it is the first step in aggregation, don't fetch the whole collection đŸ˜œ
* multipostgres listDatabases() and .db() should return and expect "fully qualified virtual database names," e.g. physical_db_name-schemaname
* vanilla postgres should not attempt to use .db() with alternate names in tests
* documentation corrections
* documentation errors
* listDatabases and documentation corrections
* more edge cases revealed by latest work from Miro
* anchored prefix regexps are optimized
documentation improvements
* * matchesQuery in the aggregation cursor implementation doesn't throw on unrecognized operators. It should, and it should support the same mongodb operators that the regular find()
path does in postgres/sqlite (our official subset), unless there is an extraordinary reason not to.
* Similarly, the main query implementation for normal queries should throw on unrecognized operators if it doesn't already.
* The dump/restore programmatic APIs in db-connect concern me. These involve returning the entire database as a string, which could exhaust memory. This impacts both utilities and
also copyDatabase(). Could these APIs return and expect async iterators instead of strings?
* The test "anchored regex on an indexed field uses a btree index search" runs explain on a query that's hardcoded in the test. Instead these SQL based adapters should expose a means
to get the SQL for a query, so it can be directly tested. Otherwise this test proves nothing as changes to the adapter accumulate in future.
* Why is this test searching for "at least 1" and not exactly 1?
it('should find documents with null value', async function() {
const docs = await db.collection('test').find({ value: null }).toArray();
// MongoDB matches both null and missing fields with { value: null }
expect(docs.length).to.be.at.least(1);
});
* What is the maximum size of a db-connect document in the postgres and sqlite adapters?
* Update the copyright year in db-connect/LICENSE.md to 2025.
* The db-connect README mentions: sqlite://:memory: What happens if you try to use .db('some-name') with that? I think it would be best to just not support throwaway in-memory sqlite
databases because I doubt anyone would intentionally store a website in one.
* do not swallow dump/restore errors on indexes
* cover how to run the utilities
* fix detection of source
* separate sanitization for index names
* regex prefix safety
* pnpm
---------
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
* forgot to include a changeset (#5390)
* ignore inline table array as draggable ui for windows (#5392)
* Layout focus orchestration (#5393)
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* Pro 9406 base url (#5396)
* Removes `seoSiteCanonicalUrl`
* Update tests and remove missed log
* Change semver level
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
* Layout editable gap (#5397)
* a11y fixes (#5401)
* clarifications (#5403)
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* mergeback (#5409)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* mergeback (#5414)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
* allow oembetter to be released (#5412)
* release oembetter 1.2.0 (#5413)
* release oembetter 1.2.0
* left commit
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Fix focus trap on the last element in a modal (#5406)
* Fix focus trap on the last element in a modal
* Fix trap escaping edge cases
* Fix import-export noise (#5399)
* remove noise, switch to utils debug
* Fix tests
* Introduce debug option
* changelog
* Fix test sorting issue
* A11y fixes part 3 (#5416)
* Fix editor modal a11y issues
* Fix manager a11y problems
* Fix page manager a11y problems
* fix media manager a11y issues
* fix a11y issues in style editor and user settings
* Fix login a11y issues
* eliminate a modal issue
* Remove bad aria in rich text
* Fix wrong aria in layout
* changelog
* Fix totp a11y issues, doc context state safety
* Fix uncaught error - popup blockers/tests
* Fix initial focus trap issue, introduced with recent changes (#5426)
* PRO-9542: fix the bug that breaks sitemaps for RA (#5433)
* PRO-9542: fix the bug that breaks sitemaps for RA
* see changeset
* Feature/prevent infinite redirects (#5429)
* log aposResponse errors
* add changeset
* prevent infinite redirects to external URLs
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* add draggable: false support to non-inline array field (#5435)
* add draggable: false support to non-inline array field
* Add changeset
* Make logged-in cookie name configurable via options (#5430)
The logged-in cookie name was hardcoded as 'loggedIn' with TODO comments
indicating it should be configurable. This is needed for deployments
where multiple Apostrophe instances share a domain (e.g., staging and
production on subpaths) and need distinct cookie names to avoid conflicts.
Changes:
- Added 'loggedInCookieName' option to the login module (defaults to
'loggedIn' for backward compatibility)
- Replaced all hardcoded references with self.loggedInCookieName
- Removed the TODO comments
Usage:
modules: {
'@apostrophecms/login': {
options: {
loggedInCookieName: 'myAppLoggedIn'
}
}
}
Addresses the TODO comments:
'get cookie name from config'
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
* Revert "Make logged-in cookie name configurable via options (#5430)" (#5436)
This reverts commit ddcdaa7ff6864cd55d6fef9dfdfca2eaf63a5969.
* Feature create-apostrophe (#5425)
* Fix new schema areas in existing documents (Astro) (#5434)
* Fix orphan or new-in-the-schema areas in external front-ends
* Save missing empty areas in the DB, refactor nunjucks path
* PRO-6295: jsx as an optional alternative to nunjucks (#5391)
* jsx as an optional alternative to nunjucks
* eslint, all tests pass
* log a useful stack trace on attachment errors! Holy shit!
* fix lint
* clarify behavior
* more tests
pass linter
* This is just a unit test, but it can't hurt to be thorough & satisfy github-advanced-security
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* true access to the apos object in jsx, per the spec
* more test coverage, no code changes
* fix watchers
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* no watch in prod (#5439)
* Fix new schema areas in existing documents (Astro) Part II (#5440)
* Prevent data corruption when stubbing areas for Astro
* Fix false positive orphan area warnings
* Guard against corrupt area items
* Fix raw-text sanitization bypass vulnerability and add regression tests (#5432)
* changeset for singh contribution (#5442)
* Fix relationship select scrolling issue (#5445)
* Fix relationship select scrolling issue
* Prevent same scrolling bugs to appear in media manager
* jsx changeset (#5446)
* Ensure install of the project root for astro projects (#5449)
* test node 26 (#5450)
* test node 26
* support node 26 by bumping the better-sqlite3 version
* node 22 requirement
* Add link for telemetry policy (#5455)
* remove absent options (#5456)
* Remove consumed 4.30.0 changesets from main (#5454)
* cli links that are correct, or will be post publish (#5458)
* release db connect to solve chicken and egg problem in cypress-tools (#5459)
* Corrects documentation links (#5457)
* Corrects documentation links
* correct `guides` -> `guide`
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
Co-authored-by: RohithVangalla1 <reachrohithv@gmail.com>
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Dipanshu singh <161134993+Dipanshusinghh@users.noreply.github.com>
* Latest security q2 (#5464)
* Bump CLI dependencies (#5383)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
* Native browser shortcuts work again (#5384)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* merge back the thanks (#5388)
* Postgres (#5365)
* postgres experimental WIP
* astonishingly, all mocha tests of apostrophe pass with this
* mocha tests pass, actual sites work
* lint clean
* listDatabases support, but changes are coming
* wip
* dump and restore updates
* backpressure, adequate handling of ObjectId for our needs (becomes its hex representation)
* mild performance optimization
* profiling
* testing issue resolved
* refactored to db-connect module, introduced sqlite adapter
* sqlite WIP
* debugging
* programmatic API for dump/restore/copy dbs
* linting, documentation
* MIT license
* text ranking is more accurate, documentation is more complete
* good full text search for sqlite
* updates for compatibility with the rest of the public and private modules, plus a few fixes to genuinely ambiguous tests
* requirements found by testing private modules
* fixes from full cypress run
* eslint passing
* restore permissions
* maximize atomicity
* bug fixes
* * exit properly when asset tests fail
* "npm test" tests all three adapters
* ignore claude-tools in eslint
* postgres and sqlite-inclusive ci matrix attempt
* clean up logs
* We hit github's limit on total configurations because every package gets its own matrix.
Solve that with grouping:
* apostrophe core
* All regular ecosystem packages other than core
* non-database-requiring packges
* mongodb-specific packages
This will probably speed it up too because it won't have to spin up a container a bazillion times.
* hardened the asset tests, made them less timing sensitive, fixed a bad commit resulting from the
way they dodgily patch themselves without a robust cleanup mechanism
* fix a root cause of asset test instability
* log mess
* implemented missing $size operator
* test compatibility
* advanced permission uses regex in $in
* regex in $in
* .db() should not make false promises in plain postgres mode, it should fail
* ability to specify a default adapter
* obsolete file
* put escapeHost back where it belongs
* dead code removal, test cleanup
* emulate-mongo-3-driver only needed in db-connect
* no claude logs in repo (tools are welcome)
* * shared aggregation implementation, other shared things
* optimize $match when it is the first step in aggregation, don't fetch the whole collection đŸ˜œ
* multipostgres listDatabases() and .db() should return and expect "fully qualified virtual database names," e.g. physical_db_name-schemaname
* vanilla postgres should not attempt to use .db() with alternate names in tests
* documentation corrections
* documentation errors
* listDatabases and documentation corrections
* more edge cases revealed by latest work from Miro
* anchored prefix regexps are optimized
documentation improvements
* * matchesQuery in the aggregation cursor implementation doesn't throw on unrecognized operators. It should, and it should support the same mongodb operators that the regular find()
path does in postgres/sqlite (our official subset), unless there is an extraordinary reason not to.
* Similarly, the main query implementation for normal queries should throw on unrecognized operators if it doesn't already.
* The dump/restore programmatic APIs in db-connect concern me. These involve returning the entire database as a string, which could exhaust memory. This impacts both utilities and
also copyDatabase(). Could these APIs return and expect async iterators instead of strings?
* The test "anchored regex on an indexed field uses a btree index search" runs explain on a query that's hardcoded in the test. Instead these SQL based adapters should expose a means
to get the SQL for a query, so it can be directly tested. Otherwise this test proves nothing as changes to the adapter accumulate in future.
* Why is this test searching for "at least 1" and not exactly 1?
it('should find documents with null value', async function() {
const docs = await db.collection('test').find({ value: null }).toArray();
// MongoDB matches both null and missing fields with { value: null }
expect(docs.length).to.be.at.least(1);
});
* What is the maximum size of a db-connect document in the postgres and sqlite adapters?
* Update the copyright year in db-connect/LICENSE.md to 2025.
* The db-connect README mentions: sqlite://:memory: What happens if you try to use .db('some-name') with that? I think it would be best to just not support throwaway in-memory sqlite
databases because I doubt anyone would intentionally store a website in one.
* do not swallow dump/restore errors on indexes
* cover how to run the utilities
* fix detection of source
* separate sanitization for index names
* regex prefix safety
* pnpm
---------
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
* forgot to include a changeset (#5390)
* ignore inline table array as draggable ui for windows (#5392)
* Layout focus orchestration (#5393)
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* Pro 9406 base url (#5396)
* Removes `seoSiteCanonicalUrl`
* Update tests and remove missed log
* Change semver level
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
* Pro 9405 remove hreflang (#5395)
* Remove hreflang generation and update README
* Add changeset
* Changeset update
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
* Layout editable gap (#5397)
* a11y fixes (#5401)
* clarifications (#5403)
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* mergeback (#5409)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* mergeback (#5414)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option and comments hardcoded encoding meta
* add changeset
* Response to first comments
(cherry picked from commit 08845c5f23d95ead552ab9743a878daf997793a1)
* Log aposResponse errors (#5386)
* log aposResponse errors
* add changeset
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
(cherry picked from commit d45e27f6d66cd25fde0cf9c7199ee9d014fa1518)
* merge back the thanks (#5388)
(cherry picked from commit f3501f4de0448d4d0f8a01a1db4dc2fcf52c6218)
* ignore inline table array as draggable ui for windows (#5392)
(cherry picked from commit b360b05e8d4e479a36fcae45a5a6dbf820b8fba3)
* Layout focus orchestration (#5393)
(cherry picked from commit 77a2968206b0208883ff45de37feb43ba0b5d5b1)
* Bump dependencies (#5398)
* Bump dependencies
* Fix missing test await resulting in random failures
(cherry picked from commit 008417fa9814dba4899b53b9394778dbd46ccf3c)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)
* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)
* allow newer twitter domain
* infogr.am still around
* facebook no longer does oembed
(cherry picked from commit e9b3bac692315414da47fe05202e8854dd31d7ee)
* Layout editable gap (#5397)
(cherry picked from commit bc8f7bed381d4462a082976dd92b8d7f28180a95)
* a11y fixes (#5401)
(cherry picked from commit 2e2f3b4b46301fc81c46200f837e794b247a9aef)
* clarifications (#5403)
(cherry picked from commit 13f2c69f219a47f82972d8fa9036deddd84223dc)
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Latest security merge (#5407)
* Merge commit from fork
* Fixed arbitrary image URL import vulnerability in rich text impport API
* additional reporter
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* secure the link URL field of image widgets
* credit
* Merge commit from fork
* fix xmp tag vulnerability
* thanks
* Merge commit from fork
* Security: a malicious full name containing HTML was executed as HTML in the tooltip displayed with an "i" icon next to the title of the current page, creating an
XSS attack risk versus other users. Since most projects permit users to change their full name (the "title" property), All projects with multiple users should be updated promptly
to close this vulnerability.
* changeset
* release only (changelogs formatted) (#5408)
* allow oembetter to be released (#5412)
* release oembetter 1.2.0 (#5413)
* release oembetter 1.2.0
* left commit
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
* Fix focus trap on the last element in a modal (#5406)
* Fix focus trap on the last element in a modal
* Fix trap escaping edge cases
* Fix import-export noise (#5399)
* remove noise, switch to utils debug
* Fix tests
* Introduce debug option
* changelog
* Fix test sorting issue
* A11y fixes part 3 (#5416)
* Fix editor modal a11y issues
* Fix manager a11y problems
* Fix page manager a11y problems
* fix media manager a11y issues
* fix a11y issues in style editor and user settings
* Fix login a11y issues
* eliminate a modal issue
* Remove bad aria in rich text
* Fix wrong aria in layout
* changelog
* Fix totp a11y issues, doc context state safety
* Fix uncaught error - popup blockers/tests
* Fix initial focus trap issue, introduced with recent changes (#5426)
* PRO-9542: fix the bug that breaks sitemaps for RA (#5433)
* PRO-9542: fix the bug that breaks sitemaps for RA
* see changeset
* Feature/prevent infinite redirects (#5429)
* log aposResponse errors
* add changeset
* prevent infinite redirects to external URLs
---------
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
* add draggable: false support to non-inline array field (#5435)
* add draggable: false support to non-inline array field
* Add changeset
* Make logged-in cookie name configurable via options (#5430)
The logged-in cookie name was hardcoded as 'loggedIn' with TODO comments
indicating it should be configurable. This is needed for deployments
where multiple Apostrophe instances share a domain (e.g., staging and
production on subpaths) and need distinct cookie names to avoid conflicts.
Changes:
- Added 'loggedInCookieName' option to the login module (defaults to
'loggedIn' for backward compatibility)
- Replaced all hardcoded references with self.loggedInCookieName
- Removed the TODO comments
Usage:
modules: {
'@apostrophecms/login': {
options: {
loggedInCookieName: 'myAppLoggedIn'
}
}
}
Addresses the TODO comments:
'get cookie name from config'
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
* Revert "Make logged-in cookie name configurable via options (#5430)" (#5436)
This reverts commit ddcdaa7ff6864cd55d6fef9dfdfca2eaf63a5969.
* Feature create-apostrophe (#5425)
* Fix new schema areas in existing documents (Astro) (#5434)
* Fix orphan or new-in-the-schema areas in external front-ends
* Save missing empty areas in the DB, refactor nunjucks path
* PRO-6295: jsx as an optional alternative to nunjucks (#5391)
* jsx as an optional alternative to nunjucks
* eslint, all tests pass
* log a useful stack trace on attachment errors! Holy shit!
* fix lint
* clarify behavior
* more tests
pass linter
* This is just a unit test, but it can't hurt to be thorough & satisfy github-advanced-security
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* true access to the apos object in jsx, per the spec
* more test coverage, no code changes
* fix watchers
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* no watch in prod (#5439)
* Fix new schema areas in existing documents (Astro) Part II (#5440)
* Prevent data corruption when stubbing areas for Astro
* Fix false positive orphan area warnings
* Guard against corrupt area items
* Fix raw-text sanitization bypass vulnerability and add regression tests (#5432)
* changeset for singh contribution (#5442)
* Fix relationship select scrolling issue (#5445)
* Fix relationship select scrolling issue
* Prevent same scrolling bugs to appear in media manager
* jsx changeset (#5446)
* Ensure install of the project root for astro projects (#5449)
* test node 26 (#5450)
* test node 26
* support node 26 by bumping the better-sqlite3 version
* node 22 requirement
* Add link for telemetry policy (#5455)
* remove absent options (#5456)
* Remove consumed 4.30.0 changesets from main (#5454)
* cli links that are correct, or will be post publish (#5458)
* release db connect to solve chicken and egg problem in cypress-tools (#5459)
* Corrects documentation links (#5457)
* Corrects documentation links
* correct `guides` -> `guide`
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Merge commit from fork
* Security: added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Thanks to [crattack](https://github.com/crattack) for reporting the vulnerability.
* changeset
* removed duplicate changeset
* patch the right module
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
Co-authored-by: RohithVangalla1 <reachrohithv@gmail.com>
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Dipanshu singh <161134993+Dipanshusinghh@users.noreply.github.com>
* release and changelog edits (#5465)
* changelogs
* formatting
---------
Co-authored-by: Miro Yovchev <2827783+myovchev@users.noreply.github.com>
Co-authored-by: Robert Means <robert@apostrophecms.com>
Co-authored-by: haroun <1765606+haroun@users.noreply.github.com>
Co-authored-by: Harouna Traoré <haroun@users.noreply.github.com>
Co-authored-by: Stuart Romanek <stuart@apostrophecms.com>
Co-authored-by: Thomas Boutell <boutell@vcs.trox.local>
Co-authored-by: RohithVangalla1 <reachrohithv@gmail.com>
Co-authored-by: Vangalla, Rohith <rohith.vangalla@optum.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Dipanshu singh <161134993+Dipanshusinghh@users.noreply.github.com>
* Hotfix cli links (#5469)
* Fix broken link
* Add changeset
* Hotfix cli links (#5469)
* Fix broken link
* Add changeset
* Fix asset URLs when a site prefix is configured (#5448)
* Mergeup latest to main (#5473)
* Latest merge prerelease 2026 05 (#5404)
* Fix choices IDs (#5379)
* Fix choices IDs
* Cleanup dots from ID values
* Update changelog
Co-authored-by: Robert Means <robert@apostrophecms.com>
---------
Co-authored-by: Robert Means <robert@apostrophecms.com>
(cherry picked from commit 9f458b5d9544d33239a0971b0050fff8bffe028a)
* Bump CLI dependencies (#5383)
(cherry picked from commit a5e1a4a35d01e09cbfd2c503370c95a8c2490867)
* Native browser shortcuts work again (#5384)
(cherry picked from commit b9b32bdd446add927c75d85e44d0a26814ba62b0)
* Pro 8838 charset (#5385)
* Removes encoding option …
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.