Merge branch 'release/2.0.20'

Author: rhukster

.github/workflows/trigger-docker.yml

@@ -25,7 +25,10 @@ jobs:
     steps:
       - name: Trigger docker-grav build
         run: |
-          curl -X POST \
+          # --fail-with-body so an expired GLOBAL_TOKEN stops this job instead of
+          # letting it report success: plain curl treats a 401 as a completed
+          # request, so the dispatch silently never reaches docker-grav.
+          curl -X POST --fail-with-body --silent --show-error \
             -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${{ secrets.GLOBAL_TOKEN }}" \
             -H "X-GitHub-Api-Version: 2022-11-28" \

.github/workflows/trigger-skeletons.yml

@@ -25,24 +25,47 @@ jobs:
       - uses: actions/checkout@v7
       - name: Make it rain ☔️
         run: |
-          SKELETONS=`curl -s "${{secrets.SKELETONS_JSON_LIST}}"`
-          echo "$SKELETONS" | jq -cr '.[]' | while read SKELETON; do
+          SKELETONS=$(curl --fail-with-body --silent --show-error "${{secrets.SKELETONS_JSON_LIST}}")
+          if ! echo "$SKELETONS" | jq -e 'type == "array" and length > 0' > /dev/null; then
+            echo "::error::Skeleton list is empty or is not a JSON array — dispatching nothing"
+            exit 1
+          fi
+
+          failed=0
+
+          # Fed by process substitution rather than a pipe: a `while` loop on the
+          # right-hand side of a pipe runs in a subshell, so the failure count
+          # would be discarded when the loop ends.
+          while read -r SKELETON; do
             KEY=$(echo "$SKELETON" | jq -cr 'keys[0]')
             VERSION=$(echo "$SKELETON" | jq -cr '.[]')
             URL="https://api.github.com/repos/${KEY}/actions/workflows/${WORKFLOW}/dispatches"
 
-            curl -X POST \
-            -u "${AUTH}" \
-            -H "Accept: application/vnd.github.everest-preview+json" \
-            -H "Content-Type: application/json" \
-            -sS \
-            ${URL} \
-            --data '{ "ref": "develop", 
-                      "inputs": { 
-                        "tag": "'"$VERSION"'", 
-                        "version": "'"$INPUT_VERSION"'", 
-                        "admin": "'"$INPUT_ADMIN"'" 
-                      } 
-                    }' > /dev/null
-            echo "Dispatched Worfklow for ${KEY}@$VERSION"
-          done
+            # One rejected repo must not hide the two dozen that follow it, so a
+            # failure is recorded and the loop carries on; the step fails at the
+            # end with a count. --fail-with-body is what makes a rejection visible
+            # at all: plain curl treats a 401 as a completed request, so a dead
+            # GLOBAL_TOKEN used to report every skeleton as dispatched.
+            if curl -X POST --fail-with-body --silent --show-error \
+              -u "${AUTH}" \
+              -H "Accept: application/vnd.github.everest-preview+json" \
+              -H "Content-Type: application/json" \
+              "${URL}" \
+              --data '{ "ref": "develop",
+                        "inputs": {
+                          "tag": "'"$VERSION"'",
+                          "version": "'"$INPUT_VERSION"'",
+                          "admin": "'"$INPUT_ADMIN"'"
+                        }
+                      }'; then
+              echo "Dispatched workflow for ${KEY}@${VERSION}"
+            else
+              echo "::error::Dispatch failed for ${KEY}@${VERSION}"
+              failed=$((failed + 1))
+            fi
+          done < <(echo "$SKELETONS" | jq -cr '.[]')
+
+          if [ "$failed" -ne 0 ]; then
+            echo "::error::${failed} skeleton dispatch(es) failed"
+            exit 1
+          fi

CHANGELOG.md

@@ -1,3 +1,26 @@
+# v2.0.20
+## 08/21/2026
+
+1. [](#improved)
+    * Updated the bundled Twig fork to the current 3.x, picking up the correctness and sandbox improvements from the 3.27 and 3.28 releases.
+    * Grav now runs on Twig 3.28 and newer, which tightened the escaping method that Grav's compatibility shim replaces and would otherwise stop the site with a server error.
+    * The Twig content sandbox now accepts the list of tests a template uses, which newer Twig versions hand to it and will require from Twig 4.
+    * The bundled Nginx configuration now sets caching headers for images, fonts, stylesheets and scripts, so visitors stop re-downloading them on every page.
+    * Script and style files whose name already contains a version, such as those the Admin panel ships, are cached permanently in that same configuration, because a change always produces a new name.
+1. [](#bugfix)
+    * [security] Page content can no longer register a script or stylesheet through the Twig content sandbox, and asset URLs are now escaped where the tag is built, closing a way to inject markup into a rendered page.
+    * [security] The `read_file` capability no longer includes the user data folder by default, so page content can no longer be used to publish form submissions and other stored data.
+    * [security] A proxy address that carries a username and password is now hidden from sandboxed page content, matching the other credentials already redacted there.
+    * [security] Custom Twig sandbox denial rules now take effect regardless of how the class name is capitalised, and can no longer be silently bypassed through a parent class or interface.
+    * A damaged page cache file is now rebuilt from the original page instead of stopping the site with a server error [#4239](https://github.com/getgrav/grav/issues/4239)
+    * Images and links in page content now work when the file name contains a colon, such as a screenshot named after a timestamp [#3933](https://github.com/getgrav/grav/issues/3933)
+    * A page that sets a full web address as its canonical route now uses that address on its own, instead of joining it onto the site's own address and breaking sitemaps and canonical links [#4023](https://github.com/getgrav/grav/issues/4023)
+    * Turning on asset timestamps now gives each stylesheet and script its own marker taken from when that file last changed, so editing one file no longer waits on an unrelated change before visitors see it [#4049](https://github.com/getgrav/grav/issues/4049)
+    * A canonical route set through the Flex pages API is now saved as written, instead of being stored in a form it could never be read back from.
+    * Flex directory blueprints no longer lose the fields the Flex Objects plugin adds when something reads the directory early in a request [#160](https://github.com/getgrav/grav-plugin-admin2/issues/160)
+    * The scheduler's generated cron command now names the site's environment when that environment has its own configuration, and each run records which environment it used, so custom jobs defined in `user/env/<host>/` no longer fail silently from cron [#4248](https://github.com/getgrav/grav/issues/4248)
+    * Audio and video players generated by `media.html()` no longer carry an `alt` attribute, which isn't valid on those elements; any alternative text is kept as an accessible label instead, so the markup passes validation [#3540](https://github.com/getgrav/grav/issues/3540)
+
 # v2.0.19
 ## 08/14/2026
 

composer.lock

@@ -183,11 +183,15 @@ read_file:
   # Streams that read_file may resolve. Defaults cover content-reading needs
   # (active theme, all themes, page tree, user data) without exposing
   # accounts, configs, logs, cache, vendor, system, etc. Add more carefully.
+  # `user-data` is deliberately absent: user://data is application state (form
+  # submissions, scheduler history, notifications), not content, and a page
+  # editor is not granted read access to it. A site that genuinely keeps
+  # includable content there can add it back, accepting that everything else
+  # under user://data becomes readable at the same time.
   allowed_streams:
     - theme
     - themes
     - page
-    - user-data
   # File extensions read_file will read. Restricted to text/content formats
   # by design — adding `php`, `yaml`, `env`, `htaccess`, etc. here is a
   # foot-gun and not recommended.

system/config/security.yaml

@@ -160,7 +160,7 @@ assets:                                          # Configuration for Assets Mana
   js_module_pipeline_include_externals: true     # Include external URLs in the pipeline by default
   js_module_pipeline_before_excludes: true       # Render the pipeline before any excluded files
   js_minify: true                                # Minify the JS during pipelining
-  enable_asset_timestamp: false                  # Enable asset timestamps
+  enable_asset_timestamp: false                  # Enable asset timestamps (local non-pipelined assets use their own file mtime)
   enable_asset_sri: false                        # Enable asset SRI
   collections:
     jquery: system://assets/jquery/jquery-3.x.min.js

system/config/system.yaml

@@ -9,7 +9,7 @@
 
 // Some standard defines
 define("GRAV", true);
-define("GRAV_VERSION", "2.0.19");
+define("GRAV_VERSION", "2.0.20");
 define("GRAV_SCHEMA", "1.8.0_2026-06-09_0");
 define("GRAV_TESTING", false);
 

system/defines.php

@@ -144,6 +144,33 @@ public function init($asset, $options)
                 $asset = $this->buildLocalLink($file->getPathname());
 
                 $this->modified = $file->isFile() ? $file->getMTime() : false;
+
+                // Rewrite the cache-busting token to this asset's own filemtime
+                // instead of the global config/version-derived cache key, so
+                // editing one file invalidates only that file's URL.
+                //
+                // Only ever replaces the token the flag itself generated — the
+                // global cache key. An explicit, caller-supplied token set via the
+                // public Assets::setTimestamp() API wins outright, whether or not
+                // the config flag is on: pinning one release token across a fleet
+                // is exactly what that API is for, and a config flag should not be
+                // able to silently override an imperative call with no way out.
+                //
+                // Note: the rendered <link>/<script> tag for a *pipelined* bundle
+                // still uses the global cache key (Pipeline::$timestamp, set from
+                // Assets::render()), so this has no effect on pipelined output
+                // URLs. It does still feed into the pipeline's internal bundle
+                // uid hash (Pipeline::renderCss()/renderJs() hash the serialized
+                // BaseAsset objects, which include $timestamp) — harmless, but
+                // it does mean upgrading can produce one new bundle file instead
+                // of reusing the previous one.
+                if ($this->timestamp
+                    && $this->modified
+                    && $config->get('system.assets.enable_asset_timestamp')
+                    && $this->timestamp === Grav::instance()['cache']->getKey()
+                ) {
+                    $this->timestamp = dechex($this->modified);
+                }
             }
         }
 

system/src/Grav/Common/Assets/BaseAsset.php

@@ -47,6 +47,6 @@ public function render()
             return "<style>\n" . trim($buffer) . "\n</style>\n";
         }
 
-        return '<link href="' . trim($this->asset) . $this->renderQueryString() . '"' . $this->renderAttributes() . $this->integrityHash($this->asset) . ">\n";
+        return '<link href="' . $this->escapeAssetUrl(trim($this->asset) . $this->renderQueryString()) . '"' . $this->renderAttributes() . $this->integrityHash($this->asset) . ">\n";
     }
 }

system/src/Grav/Common/Assets/Css.php

@@ -43,6 +43,6 @@ public function render()
             return '<script' . $this->renderAttributes() . ">\n" . trim($buffer) . "\n</script>\n";
         }
 
-        return '<script src="' . trim($this->asset) . $this->renderQueryString() . '"' . $this->renderAttributes() . $this->integrityHash($this->asset) . "></script>\n";
+        return '<script src="' . $this->escapeAssetUrl(trim($this->asset) . $this->renderQueryString()) . '"' . $this->renderAttributes() . $this->integrityHash($this->asset) . "></script>\n";
     }
 }