Changes in 4.9.1 (14 Feb 2026)

* Maintenance release with security enhancements, general improvements and
bug fixes.
* Security: Resolved access control regression with articles. Many thanks to
Federico Frascino.
* Security: Resolved admin-side XSS vulnerability. Many thanks to
Jan Jeffrie Galvez Salloman, aka '0xj4n'.
* Changed: (Article)Image tags only output dimensions on demand.
* Changed: <txp:article_image> skips empty images/thumbnails.
* Changed: Valueless width/height/crop behaviour in (Article)Image tags.
* Changed: Thumb path now permits virtual/multiple host setups.
* Changed: Use publisher email and fallback if no/invalid sender is supplied
(thanks, jools-r).
* Fixed: Fatal error with UNIXTIME() changes in MariaDB 11.8+.
* Fixed: Dynamic thumbnail MIME detection (thanks, rezozero/ambroisemaupate).
* Fixed: PHP 5.6 support (thanks, pinalgirkar).
* Fixed: Show template content even if theme is deleted (thanks, Mark Goodwin).
* Fixed: Correct admin theme file scaffold for dynamic thumbnails.
* Fixed: Reintroduce 'No' indicator if thumbnail is missing in Images list
panel (thanks, wet and phiw13).
* Fixed: Duplicate action only available for existing content.
* Fixed: Assets created with no timestamp use time of creation, not Unix epoch.
* Fixed: Internal errors with password reset email sending on PHP 8.5.
* Added: (Article)Image thumbnails can output any supported format.
* Vendors: jQuery UI 1.14.2.

Changes in 4.8.8 (24 January 2022)

* Maintenance release with support for PHP 8.1, security enhancements, general
improvements and bug fixes.
* Security: Fix reported cross-site scripting issue relating to article preview
CSRF token (many thanks, Paul Ritchie at Pentest Limited).
* Fixed: More robust numeric searches.
* Fixed: Improved query efficiency of category operations.
* Fixed: Required parameters after optional in tag builder (thanks, phiw13).
* Fixed: Admin-side pagination when sorting by non-unique values.
* Added: PHP 8.1 support.
* Added: Natural search mode.
* Added: Random form selection.
* Added: Support for AVIF image format, on PHP 8.1 or higher.
* Added: Global 'limit', 'offset' and 'sort' attributes.
* Added: 'url_title' attribute to <txp:article[_custom] />.
* Added: 'range' attribute to <txp:article_image />.
* Added: 'date' and 'time' attributes to <txp:if_expired />.
* Added: 'calendar' attribute to <txp:posted /> and similar tags.
* Added: Substring extraction via 'escape' attribute.
* Added: <txp:items_count /> tag.
* Added: Expanded conditional 'match' attribute with comparison operators.
* Added: 'UTC' is now a permitted time zone.
* Added: Custom date formats.
* Changed: <txp:category_list /> with 'children' >1 attribute behaviour.
* Changed: Global 'escape' attribute operates at the items level in lists.
* Changed: Multi-site plugins directory defaults to site/admin/plugins.
* Accessibility: Additional 'aria-label' attributes for some internal links.
* Internal: Removed FOUND_ROWS() which is deprecated in MySQL 8.0.17.
* Internal: Prefer is_readable() and is_file() to file_exists().
* Developer: Added plugin lifecycle events 'upgraded' and 'downgraded'.
* Developer: Export new article IDs on duplicate.
* PrismJS 1.26.0.

Changes in 4.8.7 (30 May 2021)

* High priority maintenance release to address functionality and setup issues
discovered after 4.8.6 release.
* Fixed: Users panel throws error due to missing DB prefix (thanks, prbt2016).
* Removed: database user GRANT check during initial setup, which broke some
installations.
* Changed: Context check priority in tags.

Changes in 4.8.6 (28 May 2021)

* DO NOT USE IN PRODUCTION - issues discovered after release, use 4.8.7 instead.
* Maintenance release with bug fixes.
* Fixed: Regression in override form usage in lists (thanks, Christian Rapp).
* Fixed: Undefined $article warning when accessing non-existent articles.
* Fixed: Error with <txp:output_form /> tag on empty forms (thanks, Adi).
* Fixed: Low-privilege users can save immediately after duplicating articles.
* Added: Latest text translations. Thank you to all our translators.
* Added: 'id' attribute to <txp:if_different /> tag.
* Added: 'db' option to the global 'escape' attribute.
* Added: Option to create database during setup.
* Added: Permission (grants) verification during setup.
* Changed: 'Assign sections' from Themes panel only selects its own sections.
* Changed: <txp:variable trim> trims its own output (thanks, cara-tm).
* Changed: <txp:link_to_next/prev> can return URL or container.
* Changed: <txp:page_url> and <txp:if_request> tags are more flexible.
* Changed: Boost power of <txp:article(_custom)> grouping by date.
* Changed: Articles can be filtered by keywords more easily.
* Changed: No Edit options in Write panel without appropriate privileges.
* Changed: No disabled update buttons on Languages panel (thanks, phiw13).
* Changed: Deprecate <txp:search_result_date />. Use <txp:posted /> instead.
* Changed: Remove deprecated break attribute from search_result_excerpt tag.
* Changed: Back-end search improved when handling numbers. Comparators can
also be used for numeric searches.
* Developer: Permit step=false to hook into explicit empty step callbacks and
step=null to indicate 'any step'.
* Developer: Permit $pre to be any text. Opens up arbitrary callback grouping.
* Developer: New articles>multi_edit.$method callback on Articles list panel.
* Developer: User panel callbacks:
user>fields and user>from to manipulate the query
user>controls to affect the button area
user_ui>list.row (pluggable_ui) for adding table data
user>steps for plugins to register custom panel-level functionality.
* Developer: Diagnostics panel callbacks diag>steps and diag_ui>level for
custom plugin steps.

Changes in 4.8.5 (29 Mar 2021)

* Maintenance release including improvements for PHP 8.0 and bug fixes.
* Changed: <txp:header /> attributes are unset by default. Ensure any 'name'
attributes are set before updating to avoid issues with custom headers.
* Fixed: Database connection issue for new installations on PHP 8.0.
* Fixed: libxml_disable_entity_loader() deprecation warning on PHP 8.0.
* Fixed: Undefined array key/offset warnings on PHP 8.0.
* Fixed: System temp directory notice on PHP 8.0.
* Fixed: Custom field ordering on Write panel.
* Fixed: Diagnostics panel strings no longer have 'Help' appended.
* Fixed: Draft/hidden/pending articles output 404 Not Found status as they should.
* Fixed: RSS/Atom feeds display correct titles (thanks, jrmartin).
* Fixed: Form processing on 'pretext_end' callback.
* Added: Support for WebP image format, on PHP 7.1 or higher.
* Added: SSL version verification on Diagnostics panel during update checks.
* Added: Latest text translations. Thank you to all our translators.
* Added: More aggregators in <txp:article /> 'fields' attribute.
* Added: Global 'break', 'replace' and 'trim' attributes.
* Added: 'breakby' and 'breakform' attributes for all content types.
* Added: <txp:image_info type="mime" />.
* Added: Support for Fulah language translation.
* Added: Locale for en, and improved locale fallbacks.
* Added: Import attributes in <txp:php /> as PHP variables.
* Added: 'root' attribute of <txp:page_url /> to create relative URLs.
* Changed: <txp:article_custom /> can paginate content using 'pageby' attribute.
* Changed: <txp:images /> outputs full-size images if thumbnails don't exist and
<txp:images thumbnail="0" /> displays full-size images as expected.
* Changed: <txp:images> accepts <txp:else />.
* Changed: <txp:variable> default attribute can be used during assignment
(thanks, cara-tm).
* Changed: Expose 'secondpass' Advanced pref for testing.
* Changed: Plugin load warning includes version number.
* Changed: Comments off by default on new installations.
* Changed: Diagnostics textarea is rendered fully in English to aid support requests.
* Changed: If allowed, <txp:php /> is processed in forms even in article body.
* Changed: Copy Editors are allowed to use <txp:php /> in articles.
* Changed: Better i18n handling for 'ago'.
* Developer: New pre-pretext_end callback.
* Developer: New txp.image>types callback.
* PrismJS 1.23.0.