# v2.2.21 ## 11/01/2026 1. [](#bugfix) * A plugin that adds a scheduler job as a class method (such as `[$this, 'method']`) without an id, or with its id where the job's arguments go, no longer crashes every scheduler run and empties the admin's job list [#4380](https://github.com/getgrav/grav/issues/4380) # v2.2.20 ## 10/31/2026 1. [](#bugfix) * Updating or reinstalling a plugin swaps the new copy in all at once, so the site never runs with the plugin missing or half copied, and the old copy is put back if the new one cannot be moved in * JSON sent to the site is now checked against size limits before it is read, so an oversized request is turned away quickly instead of tying up the server (limits are under `request.json` in `system.yaml`) * Sites behind a proxy that ends HTTPS (such as Cloudflare in front of a server on port 80) no longer redirect visitors to the address with `:80` added, for example when reloading the admin # v2.2.19 ## 10/31/2026 1. [](#bugfix) * A number field given a value too large for an integer no longer causes a warning on PHP 8.5 * The bundled `lighttpd.conf` loads on current lighttpd releases again, serves `/.well-known/` files such as ACME challenges, and keeps Markdown source files and the same folders and file types private as the Apache rules do (lighttpd sites copy the updated rules from `webserver-configs/` by hand) * The bundled Caddyfiles also keep JSON files under `system/`, `vendor/` and `user/`, Markdown source files such as `CHANGELOG.md`, the `webserver-configs/` folder and hidden files inside `/.well-known/` private (Caddy sites copy the updated rules from `webserver-configs/` by hand) * The bundled `nginx.conf` also keeps Markdown source files such as `CHANGELOG.md` and the `webserver-configs/` folder private, and matches root files such as `composer.json` in any letter case (nginx sites copy the updated rules from `webserver-configs/` by hand) * The bundled IIS `web.config` also keeps `LICENSE.txt`, `composer.json`, `composer.lock` and Markdown source files private, covers the same file types under `system/` and `vendor/` as the Apache rules, and matches its rules however a file path is written (IIS sites copy the updated rules from `webserver-configs/` by hand) * The `php -S` development router (`system/router.php`) keeps `tmp/`, `user/config/`, `user/accounts/` and `user/data/` private and refuses scripts in `images/` and `assets/`, the same as the shipped web-server rules * [security] The Apache `.htaccess` exception for `/.well-known/` now covers that folder only, so other hidden files and folders whose names start with `well-known` stay blocked. Upgrading updates existing `.htaccess` files # v2.2.18 ## 10/31/2026 1. [](#bugfix) * [security] The security fixes below were found by Anthropic's OSS Scanner * [security] Twig in page content can only read an account's name, username, e-mail, language and login state, and account secrets such as password hashes, 2FA secrets and reset tokens are no longer included in form values or in an account's array and JSON output * [security] Twig in page content can no longer use `page.path`, `page.filepath` or `{% autoescape %}`, page methods it calls only change that one page for the current request, and `array_key_value()` and `sort_by_key` only work with data content Twig may read * [security] Settings hidden from content Twig by `security.twig_sandbox.config_denied_paths` now stay hidden through loops, theme helpers, plugin page settings, theme aliases, unusual path separators and full config listings * [security] `yaml_decode` and page frontmatter always read invalid YAML as text, never as the name of a file * [security] A page's `template` setting only picks a theme or plugin template, and a page whose template names a file path gets the default blueprint * [security] Media file names and metadata are always shown as text when a page's Twig runs, and a media `.meta.yaml` file can no longer change which file a medium points to * [security] Media actions in Markdown only call the documented action methods, and image output formats only accept supported image types * [security] SVG uploads are checked under every file extension, cleared before sanitizing, and quarantined when sanitizing fails * [security] A site without a `user/env/` folder only uses a folder of its own as a host's environment folder, and host names with slashes or a leading dot get none * [security] Blueprint files are only trusted when they live in a blueprint, plugin or theme folder, and forms in page frontmatter can only import blueprints from those folders and always keep their state in the default forms folder * [security] Field overrides in a page's Flex form only change that form and follow the same rules for dynamic options as other page-authored fields * [security] With `security.twig_content.config_access` off, forms in page frontmatter can only read the `system`, `site` and `theme` settings * [security] Creating, renaming or copying user accounts, groups and other Flex objects can no longer replace an existing one or take another file's storage key, and a Flex form only resumes saved state from a form of the same type * [security] Only a super admin can switch a user group on or off or edit a group that grants super admin, disabling a group now applies to regular accounts too, and a super-admin group always counts for super-admin protection * [security] YAML merge keys (`<<`) are no longer saved into account or other data files * [security] User accounts are counted correctly when the site's folder path contains square brackets * [security] A login still waiting for its two-factor code, or a disabled account, no longer gets access through its own Flex account or its groups * [security] Signed-in sessions pick up changes to their account made elsewhere, and saving an account no longer overwrites changes made to it since it was loaded. This applies to Flex accounts as well * [security] Sessions are tied to the site that created them, and the session cookie is only sent to the site's own host unless `system.session.domain` is set. Sessions active at the update carry on as before * [security] Looking up an account by a name that isn't a valid username no longer finds another account, an email field only takes a list when set to `multiple`, and avatar images always stay in their own folder * [security] Sorting or filtering a Flex collection by a field name only reads properties and a short list of read-only page fields * [security] Flex pages check permissions on the parent and translations they actually affect when they are created, moved, saved in another language or deleted, and keep the permissions inherited from their real parent folder * [security] Flex pages keep their own folder, storage key and header fields when saved, and Flex media changes only touch the object's own files and media fields * [security] Flex pages follow their publish and unpublish dates, and unpublished pages no longer follow their `redirect` * [security] Pages built for the admin and the API keep their own cache, so site visitors always get pages built with the rules from `frontmatter.yaml` * [security] The requested URL is decoded once when looking up a page, so plugins that protect page media check the same page Grav serves the file from * [security] Forwarded protocol headers, including `CloudFront-Forwarded-Proto`, are only used when `system.http_x_forwarded.protocol` is enabled * [security] Responses that set a cookie always stay private to the browser, error responses are never cached, and HTML and Markdown versions of a page are kept apart in shared caches * [security] Host names without an environment folder share one set of compiled caches and page index instead of each getting their own * [security] Saved form state is written to a new file with limits on its size and depth, so form state pending during the update starts over * [security] Very long or repetitive input in form field names, number fields, dates, uploads, Markdown links, taxonomy URLs and the XSS check is handled quickly instead of slowing the site down * [security] Damaged images, unusual retina file names and large image actions no longer break a page's media or get past the image pixel limit * [security] Configured redirects keep their intended destination, module output is only cached for real page routes, and official package downloads require HTTPS * [security] Page summaries keep escaped text escaped, image loading options only accept their defined values, and with `escape_markup` on, Twig tag lines, `special_chars` maps and script links are escaped too * [security] Theme and plugin templates that page content includes, embeds or extends now follow the same Twig rules as the content itself. The Form plugin's form and data templates keep working from page content as before, and its plain-text save template stays literal in saved files but is escaped when page content or an email includes it * Upgrade note: if a page that includes a theme or plugin partial now shows its Twig as plain text, add the partial's name to `security.twig_sandbox.trusted_partials` or move the include into the theme template. A listed partial renders with Grav's own page variables, and page content can only pass it plain values such as text, numbers and lists, never under a name Grav already uses such as `grav`, `page` or `form` * [security] The bundled IIS `web.config` now keeps everything under `user/data` and `user/accounts` blocked except the media and avatar images those folders are meant to serve, whatever the request's query string, and media links with a query string such as `?v=2` load again; IIS sites must copy the updated rules from `webserver-configs/web.config` by hand * [security] The Caddy 0.8 sample `webserver-configs/Caddyfile-0.8.x` now blocks the same folders and files as the Caddy 2 `Caddyfile`, including `backup/`, `tmp/`, `user/config`, `user/accounts`, `user/data` and hidden files such as `.env`; sites using it must copy the updated rules by hand * Page change checks skip unreadable folders, invalid route aliases are ignored, saving a page with an empty header keeps its content separate, and a page with an empty default route keeps its raw route * A page with an unpublish date now disappears at that moment, image derivatives with an invalid width are ignored, and long runs of punctuation after a link render quickly * Asset pipeline bundles are the same for every host name a site answers to, Flex directories list folders with unusual names, the image `style` option refuses transforms, srcset derivatives keep the image options given before them, and `url()` in page content only resolves streams inside the media folders * [security] `system.images.max_pixels` now also refuses to resize an image whose size PHP can't read, instead of skipping the check. Imagick can decode formats such as JPEG XL and HEIC that `getimagesize()` can't measure, so a huge image in one of those formats could get past the limit. The image is served as it is, and a warning is logged * `image/avif` was listed under an `image` extension in `mime.yaml` instead of `avif`, so Grav's MIME type list gave `image` as an extension for `image/avif`, ahead of `avif` # v2.2.17 ## 10/30/2026 1. [](#bugfix) * With `system.absolute_urls` and asset SRI both on, Grav looked for asset files at the web root plus the full URL, so no `integrity` was added and sites with `open_basedir` got a fatal error. It now finds the real file, also in subfolders whose name has characters like `.` or `+` [#4377](https://github.com/getgrav/grav/issues/4377) # v2.2.16 ## 10/29/2026 1. [](#bugfix) * [security] The `string()` Twig function now applies the same sandbox checks as the `|string` filter. Thanks @dagighost # v2.2.15 ## 10/29/2026 1. [](#new) * **Page ids**: a page folder can carry a hidden `.page-id` file holding a permanent id (a UUID) that stays with the folder however it is renamed, reordered or moved, in Admin, with git or over FTP. Read it with `$page->uuid()` and find a page by it with `$pages->findByUuid()`; `Grav\Common\Page\PageIdentity` writes ids, finds a folder by its id after a move, and decides which folder keeps an id that a copy made outside Grav duplicated (the older `.page-id` wins). Ids are off unless a plugin needs them: it calls `PageIdentity::enable()` in `onPluginsInitialized`, or a site sets `system.pages.uuid: true`, and then saving or creating a page gives its folder an id and a copied page gets its own. `bin/grav page-ids` gives every page folder an id and reports duplicates, and tells the pages cache so the next request finds the new ids. The file is hidden, so it never shows as a page file or as media, and a page folder moved to another disk (where Grav copies it instead of renaming it) takes its ids with it. Two requests saving one new page at the same moment give it one id, not two 2. [](#bugfix) * A scheduler custom job or backup profile added in the admin and saved without being filled in no longer breaks the scheduler: it is skipped, so the other jobs still run and the job list, health check and webhook keep working [getgrav/grav-plugin-scheduler-webhook#10](https://github.com/getgrav/grav-plugin-scheduler-webhook/issues/10) * A new backup profile's default schedule runs once at 3:00 instead of every minute from 3:00 to 3:59, and a job whose Extra Arguments field is saved empty no longer fails * The scheduler's custom job placeholders read as examples (`e.g. bin/grav`) instead of looking like values already filled in, and Run At saves the every-minute schedule it shows when left as is # v2.2.14 ## 10/26/2026 1. [](#improved) * Disabled plugins are no longer loaded, so a disabled plugin with code that doesn't work on this version of Grav can't take the site down, and requests do less work. A disabled plugin is still listed with its settings, and its class still loads if another plugin asks for it. Thanks @NoNoNo [#4374](https://github.com/getgrav/grav/issues/4374) 2. [](#bugfix) * CSS with a long quoted string or comment (such as an inlined data: URI) minifies again instead of failing with a PCRE error, and a very large data: URI no longer empties the whole stylesheet from the bundle. Thanks @NoNoNo [#4372](https://github.com/getgrav/grav/issues/4372) * Inline JavaScript added with `loading: 'inline'` no longer renders a stray `inline` attribute on its script tag, and an inline JS module keeps its code when the pipeline is off. Thanks @NoNoNo [#4373](https://github.com/getgrav/grav/issues/4373) # v2.2.13 ## 10/23/2026 1. [](#bugfix) * [security] A field in a page's Flex form override keeps the stricter rules for dynamic options after it is merged into the directory blueprint, however it is renamed or numbered. Thanks @soquip * [security] Page content is now checked for unsafe markup as though its Twig runs, even when Twig is off for that page, since a later move or rename can turn it into a module. Thanks @vLWa7ch * [security] Flex user accounts: an account without super-admin access can no longer edit or delete a super-admin account through a Flex form, and a submitted password hash is ignored when an account is saved. Thanks @manus-pi * [security] Flex page storage now refuses a folder, template or language that is not a plain name. Thanks @shm0x00 * [security] Images referenced by stream URI in page content, the watermark image and `media_directory()` now only come from media folders (pages, images, media, themes, plugins), configurable with the new `security.media.allowed_roots` setting. Thanks @123abab123789 # v2.2.12 ## 10/22/2026 1. [](#improved) * The scheduler webhook now also runs jobs that missed their time since the last call, so a site pinged hourly (or late) no longer skips jobs set for another minute. Add `?mode=due` for the old behaviour. The scheduler health check now warns when a job is behind schedule, instead of five minutes after the last run [getgrav/grav-plugin-scheduler-webhook#9](https://github.com/getgrav/grav-plugin-scheduler-webhook/issues/9) 2. [](#bugfix) * Admin listings of a folder with thousands of pages no longer reload the folder once for every page in it, which made them slow and could run out of memory with caching on [getgrav/grav-plugin-admin2#200](https://github.com/getgrav/grav-plugin-admin2/issues/200) * A scheduled backup no longer fails with "ZipArchive::close(): Unexpected length of data" when another job changes a file in the site while the backup is being written. The backup is built again (up to three tries), and if it still can't be written, it is marked as failed while the rest of the scheduler run carries on. A failing job used to stop the whole run, so the jobs after it never ran and none of their results were saved # v2.2.11 ## 10/19/2026 1. [](#bugfix) * A licence key saved with a stray space in the product slug or the key itself (` lightbox-gallery`, for example) now works for installs and updates. Spaces are trimmed when a key is saved, and keys already saved that way are read correctly * An image pasted into the editor as inline data (a `data:` image) now shows on the frontend. Grav was turning the `+` characters in the image data into spaces, which also affected image paths with a `+` in them such as `a+b.png` [getgrav/grav-premium-issues#628](https://github.com/getgrav/grav-premium-issues/issues/628) # v2.2.10 ## 10/16/2026 1. [](#bugfix) * With `images.watermark.watermark_all` on, every image now gets the watermark, not only images with a resize or other action. A 1x image made from an `@2x` file and a framed image are stamped once, and retina alternatives are kept. Thanks @HawkForge [#4359](https://github.com/getgrav/grav/issues/4359) [#4360](https://github.com/getgrav/grav/pull/4360) * A remote CSS or JS file in the asset pipeline (a CDN stylesheet, for example) now gives up after 5 seconds if its server doesn't answer (set with the new `assets.pipeline_remote_timeout` option in `system.yaml`), instead of holding the page until PHP's `max_execution_time` ends it with a 503. When a remote file can't be downloaded, its group is not cached: that request renders each file as its own tag, and the next request tries the download again # v2.2.9 ## 10/14/2026 1. [](#bugfix) * Adding an environment folder such as `user/env//` no longer creates a new security key for that host, which broke forms and sessions signed with the old one. The key stays in `user/config`, and a copy an earlier version put in an environment folder is moved there * A plugin or theme zipped from inside its own folder, or a zip made on macOS with a `__MACOSX` folder, now installs with `bin/gpm direct-install` and the admin's install-from-zip instead of failing with "Not a valid Grav package". Thanks @wakqasahmed [#2688](https://github.com/getgrav/grav/issues/2688) [#4357](https://github.com/getgrav/grav/pull/4357) * Sites on PHP-FPM pools that disable `getmypid()` (a common hardening) no longer fail when the page index is rebuilt: its temporary database file is named with a random string instead of the process id. The scheduler's `whoami()` also checks for `get_current_user()` before calling it # v2.2.8 ## 10/13/2026 1. [](#new) * Plugins can react when an image is loaded with the new `onImageMediumReset` event, for example to queue a watermark or other action on every image from its own metadata 2. [](#bugfix) * Setting only `watermark_all` for images in `system.yaml` no longer removes the watermark image, position and scale settings, and the watermark settings can now be edited in the Admin under Images # v2.2.7 ## 10/13/2026 1. [](#bugfix) * The scheduler log no longer gets two lines written every minute when no job was due; runs that do work still log their full detail. Thanks @onetrev [#4355](https://github.com/getgrav/grav/issues/4355) * The compiled config, blueprints and languages caches are written to a temporary file and moved into place, and a damaged one is rebuilt, so a request arriving while the cache is being rewritten no longer fails with a blank error page. Thanks @omega8cc [#4356](https://github.com/getgrav/grav/issues/4356) * The scheduler's run summary in `scheduler.log` counted each successful job twice # v2.2.6 ## 10/09/2026 1. [](#bugfix) * With the logs or cache folder moved by `GRAV_LOG_PATH` or `GRAV_CACHE_PATH`, the cache and backup jobs write their output to the moved logs folder, a job's `output:` can be a `log://` path, and `bin/grav cache-cleanup` and the GPM permission check find the moved cache folder. Thanks @onetrev [#4344](https://github.com/getgrav/grav/issues/4344) * Scheduler history files older than the `retention_days` setting are now deleted, instead of collecting forever [#4344](https://github.com/getgrav/grav/issues/4344) # v2.2.5 ## 10/06/2026 1. [](#improved) * Twig in page content can use the `guard` tag to check that a function, filter or test exists before calling it [#4341](https://github.com/getgrav/grav/issues/4341) 2. [](#bugfix) * Folder settings in a `.env` file, such as `GRAV_BACKUP_PATH` and `GRAV_TMP_PATH`, now apply on hosts that turn off PHP's `putenv()` for web requests, and no longer write an error to the log on every request [#4344](https://github.com/getgrav/grav/issues/4344) * An SVG with only a viewBox now reports its real width and height, a viewBox separated by commas is understood, and a relative width such as `100%` is no longer read as 100 pixels [#4347](https://github.com/getgrav/grav/issues/4347) * A redirect with a status code followed by a query string, such as `/new[301]?a=1&b=2`, is now sent with that status code and without the `[301]` in the address, instead of as a 302 to an address containing it [#3320](https://github.com/getgrav/grav/issues/3320) [#4343](https://github.com/getgrav/grav/issues/4343) * A page's group permissions now deny every letter after a `-` up to the next `+`, so `-c+r-ud`, which the Admin saves for create, update and delete denied, no longer allows delete [#4340](https://github.com/getgrav/grav/issues/4340) * Query parameters reach the Admin and API on web servers that rewrite to `index.php` without passing the query string on, such as an nginx `try_files` line missing `?$query_string`, so switching the editor to another language no longer loads the default language's page [#4338](https://github.com/getgrav/grav/discussions/4338) * A form field directive written in page frontmatter can now only check whether its Flex object exists; directives in blueprint files are unchanged * The current page address no longer includes the visitor's HTTP Basic username and password when it is printed or turned into an array, and `Uri::user()` and `Uri::password()` are empty for the current request # v2.2.4 ## 10/01/2026 1. [](#bugfix) * A page's Markdown version (`.md`) and `llms-full.txt` include the full page again on sites running the Archives plugin, instead of only a title and navigation links [#4339](https://github.com/getgrav/grav/issues/4339) * An uploaded SVG whose doctype declares entities is no longer emptied by the sanitizer (rhukster/dom-sanitizer 1.0.19) * A multisite that keeps each site in `user/env//` loads its theme, plugin and media files again. The bundled server configs protect `config/`, `accounts/` and `data/` inside each env folder the same way they protect them in `user/`, and the upgrade updates an existing `.htaccess`, and the `user/env/.htaccess` an earlier upgrade added, to match. Sites on nginx, Caddy, lighttpd or IIS need to copy the new rules from `webserver-configs/` by hand [#4335](https://github.com/getgrav/grav/issues/4335) * Saving a page whose blueprint has a list containing only an `elements` field no longer fails with an error, and the fields inside each element now belong to their list item instead of the top of the blueprint, where they could clash with a field of the same name (rockettheme/toolbox 2.0.1) [#4337](https://github.com/getgrav/grav/issues/4337) # v2.2.3 ## 09/29/2026 1. [](#improved) * Updated Twig to 3.30 (through Grav's getgrav/Twig fork), which brings upstream's fixes since 3.29, among them faster object attribute reads and macros declared by a parent template, a `for` loop variable that was undefined inside a nested loop's sequence, and the spread operator now rejected outside sequences, mappings and call arguments. * Theme and plugin templates now compile without any of the Twig sandbox's checks, which only ever apply to Twig in page content, so pages render faster (about half the Twig time on a busy listing template, within a few percent of running with no sandbox at all). Twig in page content, and any template rendered with the sandbox switched on, is checked exactly as before. That includes a theme template that was already loaded when a `{% sandbox %}` block or a sandboxed include reaches it, along with its blocks, macros and parent: it renders from a separately compiled copy with every check in place, so it gives the same output, and blocks the same things, as before. This uses a new opt-in feature of Grav's Twig fork (getgrav/Twig), so it needs that fork's matching commit. 2. [](#bugfix) * Grav's Twig now refuses a template loaded by a different Twig environment when one is passed to `include()` or `{% include %}`, the same as Twig itself does, instead of rendering it with the other environment's settings. A template object from Grav's own environment passed on its own now renders instead of failing with a type error. # v2.2.2 ## 09/28/2026 1. [](#improved) * The `.htaccess` and Caddy configs now let browsers keep the Admin panel's bundled files for a year, since their names change whenever they do. On Apache, copy the new block from `webserver-configs/htaccess.txt` into an existing site's `.htaccess` to get it ([getgrav/grav-plugin-admin2#181](https://github.com/getgrav/grav-plugin-admin2/issues/181)) 2. [](#bugfix) * Upgrading Grav from the admin on Windows, for example under Laragon, no longer deletes `index.php` and leaves the site showing a 404 page ([forum](https://getgrav.org/forum/general/laragon-grav-update-issue-t9436)) * An upgrade no longer blocks most of the Twig sandbox, such as `date`, `max` and `batch`, on sites whose `security.twig_sandbox` lists only add entries. Sites an earlier upgrade already did this to get those defaults back. * A fresh install now records the current upgrade level, so its first upgrade no longer reruns fixes meant for older installs. * [security] Updated the bundled DOM sanitizer to 1.0.18, which closes several ways a crafted stylesheet could hide an external resource reference using CSS escapes, such as a backslash-newline line continuation ([GHSA-94fv-h7hv-365q](https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-94fv-h7hv-365q)). * Commands run by the scheduler, such as a plugin's `bin/plugin` worker, now run in the same environment as the scheduler, so a site started with `bin/grav scheduler --env ` no longer runs its jobs without the settings in `user/env//config`. * With `pages.media_route_urls` enabled, page files whose names contain a space or an accented character, such as `foo bar.pdf` or `bär.png`, no longer return a 404 ([#4332](https://github.com/getgrav/grav/issues/4332)) * An image used more than once in Markdown no longer picks up the query parameters, `#fragment` or style of the earlier uses, and keeps its retina `srcset` after an earlier use was cropped or resized. Thanks @wakqasahmed ([#3567](https://github.com/getgrav/grav/issues/3567), [#4333](https://github.com/getgrav/grav/pull/4333)) * The content XSS check now also flags a `javascript:` link with a space after the colon, and no longer misses a link when the text elsewhere contains an encoded character it could not decode. Thanks @manus-pi * The private key file `user/config/security-private.php` is now created readable only by the site's own user, instead of being locked down a moment after it is written. Thanks @shxtterme * Modular sections on Flex-stored pages now re-run their Twig on every request, the same as regular pages already did, so one visitor's output is never reused for another. * On Apache, the file-type rules for `images/`, `assets/`, `user/`, `system/` and `vendor/` now also apply when a path follows the file name. Upgrading adds the rule to an existing site's `.htaccess`. Thanks @ma4ter * [security] With image URL actions turned on, the image pixel limit now measures the image each resize actually produces, including one-dimension, percentage and zoomCrop resizes. Thanks @manus-pi * [security] A form defined in page frontmatter now reads `config-*@` values through the same filter as page Twig, so it can only show configuration that page Twig may read. Thanks @manus-use and @Hama1cco * [security] Dynamic-data directives in a form defined in page frontmatter now go through the allowed-callable check when the form builds its defaults and validates, not only when it first loads. * [security] Renaming a field while a page-authored Flex form is merged no longer lets it skip the allowed-callable check. Thanks @manus-use # v2.2.1 ## 09/25/2026 1. [](#bugfix) * The `.htaccess` files under `user/` no longer use mod_rewrite, so hosts that broke on them, such as some shared Apache setups, serve the admin, theme files and images again. Upgrading replaces the copies Grav wrote and leaves edited ones alone ([#4309](https://github.com/getgrav/grav/issues/4309)) # v2.2.0 ## 09/24/2026 1. [](#improved) * Rebuilding the pages cache no longer writes a compiled file for every page, so the first request after a cache clear is much faster on large sites. * A pages rebuild no longer loads a compiled file for every page into OPcache, so large sites stop pushing the rest of Grav's cached code out of memory. * A pages rebuild reuses the page headers it read last time, so rebuilding after editing one page stays as quick as before. * Checking whether pages changed now looks only at the page folders and files Grav already knows about instead of scanning the whole pages folder, which makes requests on large sites faster. * Only one request at a time checks whether pages changed, and the others keep using the last result meanwhile. * When the pages cache has to be rebuilt, one request rebuilds it and the others wait and use its result instead of all rebuilding at once. * Saving or deleting a page through Grav now updates the pages cache on the next request instead of waiting for the change check, and plugins can do the same by calling `Pages::markChanged()`. * That change notice is kept in a small file rather than the cache, so a page saved from the command line is picked up by the website even when the two use different cache drivers. * A new `pages.frontmatter.native_yaml` setting reads page frontmatter with the much faster YAML extension when the server has it installed. It is off by default because the extension reads unquoted dates and `yes`/`no` differently. * Translations are now prepared one language at a time, when a request first needs that language, so the first request after a cache clear no longer reads every language that core and the plugins ship. * Editing a language file now rebuilds only that language instead of every language. * The pages cache is smaller because it no longer keeps a second, raw copy of every page's frontmatter. * Listing every page, which the sitemap and `@page.descendants` collections do, is several times faster on large sites. * Page ETags are calculated with a much faster hash. * Configuration and translation caches built by a request are loaded into OPcache after the response has been sent, instead of making that request wait. * Rebuilding the pages cache after an edit no longer reads the pages and folders that did not change, so on large sites it takes about half the time it did before. * With `pages.lazy_index` on, lists of pages such as menus, taxonomy pages, `@page.descendants` collections and the sitemap load their pages in a few batches instead of one at a time. * `pages.lazy_index` now defaults to `auto`, which uses the page index on sites with 1,000 pages or more and the classic pages cache on smaller ones, so large sites load pages faster and use far less memory without any setup. * Plugin classes load faster because Grav now asks only the plugin autoloaders that can have the class, in the same order as before. * A modular page can set `cache_modules: true` to cache its modules' output, while modules with their own Twig or a form, logged-in visitors and form submissions are always rendered fresh. * A new `session.lazy` setting, off by default, starts the session only when a visitor needs one, so anonymous page views can go out without a session cookie and be cached by a proxy or CDN. * CSS minification now uses wikimedia/minify, which understands modern CSS and is about 15 to 25 times faster on real stylesheets. 1. [](#bugfix) * Sites on Apache older than 2.4.8, common on Plesk and CentOS 7 hosts, no longer answer 500 for everything under `user/` after upgrading, and upgrading fixes the `.htaccess` files earlier releases wrote there ([grav-plugin-admin2#179](https://github.com/getgrav/grav-plugin-admin2/issues/179)) * Plugins' `onShutdown` work runs again after Admin Next saves on sites with `session.read_and_close` on, when another plugin had already finished the response. * Deleting or renaming a page folder is now picked up without clearing the cache. * The `file` change check no longer counts files that only contain `.md` somewhere in their name, such as `page.md.bak`, or whose name merely ends in `yaml`. * Searching Flex pages now matches a page's route as well as its title, slug and menu. * `calc()` inside `@media`, `@supports` and `@container` conditions keeps its spacing when CSS is minified, so browsers no longer drop those blocks. * A stylesheet with a quote that is never closed is now served unminified instead of losing the rules that follow it. # v2.1.12 ## 09/23/2026 1. [](#bugfix) * SVG fills that point at a gradient on the same page, such as `fill: url(#linear-gradient)`, keep working with CSS pipelining on. Thanks @wakqasahmed [#2784](https://github.com/getgrav/grav/issues/2784) * CSS pipelining no longer breaks `url()` values that aren't file paths, such as `about:blank` or `blob:` links, and now correctly rewrites paths written as `URL(...)` or with spaces inside the brackets. # v2.1.11 ## 09/23/2026 1. [](#bugfix) * Files under `.well-known/` are now served when running Grav with the built-in PHP server (`bin/grav server`), matching the shipped web server configs. Thanks @wakqasahmed [#4016](https://github.com/getgrav/grav/issues/4016) * Themes whose stylesheets use `@import`, such as Learn2, look right again with CSS pipelining and minification on. 2.1.10 could move a block of the theme's styles to the top of the combined file along with the import. Thanks @Gazoo [#4330](https://github.com/getgrav/grav/issues/4330) # v2.1.10 ## 09/22/2026 1. [](#improved) * The shipped web server configs now block running PHP and other scripts in `images/` and `assets/`, and upgrading adds the same rule to an existing site's `.htaccess`. * Uploaded filenames are now rejected when any extension in the name is a dangerous one, not just the last, so `evil.php.jpg` can't run as PHP on servers that map PHP with `AddHandler`. * PHP-executable extensions are now always treated as dangerous uploads, even if a site's config drops them from the list. * `webserver-configs/htaccess.txt` now blocks `tmp/` like the root `.htaccess` does. * File uploads sent with `PUT` or `PATCH` now drop any folder path from the filename, as PHP already does for `POST` uploads. * Image derivatives now include the maximum width you ask for. Thanks @wakqasahmed [#2429](https://github.com/getgrav/grav/issues/2429) 1. [](#bugfix) * Multipart `PATCH` requests are now parsed, instead of being skipped because of a typo in the method check. * A page whose `summary:` header is text rather than summary settings no longer crashes when its summary is read. Grav reads `summary` in a header as settings (`enabled`, `size`, `format`), and a site that used it for a page's lede broke the page's Markdown version (`.md` or `Accept: text/markdown`), which is what AI crawlers ask for. The text is now ignored as settings and the site's own summary settings apply. * A stylesheet the CSS minifier can't handle no longer breaks the page. Its group is served unminified instead, in the original order, and cached like any other bundle. Thanks @wakqasahmed and @sridharkalaibala [#4305](https://github.com/getgrav/grav/issues/4305) * A script the JS minifier can't handle no longer changes the order scripts load in, for the same reason. Thanks @wakqasahmed [#4313](https://github.com/getgrav/grav/issues/4313) * Space-separated `rgb()` and `hsl()` colours are no longer mangled or dropped when CSS minification is on. Thanks @onetrev [#4305](https://github.com/getgrav/grav/issues/4305) * Visiting a real folder such as `/user/pages` no longer sends the browser into an endless redirect loop. Thanks @3e33 [#4325](https://github.com/getgrav/grav/issues/4325) * Watermarks now land in the right place on resized, cropped and derivative images, including retina files, instead of being placed for the original size or missed entirely. Thanks @phmg701 [#4322](https://github.com/getgrav/grav/issues/4322) * Watermarks now follow the position set in configuration, and an unknown position or a bare `?watermark` no longer breaks the image. [#4322](https://github.com/getgrav/grav/issues/4322) # v2.1.9 ## 09/21/2026 1. [](#bugfix) * The bundled `robots.txt` no longer blocks pipelined CSS and JS. `Disallow: /assets/` was removed, because it beat the shorter `Allow: *.css$` rules and stopped Google from rendering pages on sites with the asset pipeline turned on. The CSS and JS rules now start with `/`, also match URLs with a query string, and explicitly allow assets under `system/` and `user/plugins/`. Upgrades never replace `robots.txt`, so existing sites need to apply this change by hand. # v2.1.8 ## 09/18/2026 1. [](#bugfix) * Upgrading now adds the `tmp/` block from 2.1.7 to an existing site's `.htaccess`, so upgraded Apache sites stop serving temporary files and the dashboard storage warning clears. [#4316](https://github.com/getgrav/grav/issues/4316) # v2.1.7 ## 09/18/2026 1. [](#improved) * Updated vendor libraries to latest versions * Defer OPcache compilation of newly generated YAML and Markdown cache files until they are first included, reducing cold-cache rebuild work on large sites while still invalidating stale bytecode immediately. * Repeated deprecation notices now share one debug trace with an occurrence count, preventing large page-tree rebuilds from filling memory and the debug toolbar with thousands of identical traces. Notices from different YAML documents and Twig source locations remain separate. 1. [](#bugfix) * [security] Editor-authored Twig can no longer read the Clockwork debugger token from system configuration. Thanks @manus-pi * [security] Bundled nginx, Caddy, lighttpd and IIS rules now block hidden files and directories at any depth, including nested Git repositories, while still allowing `.well-known` for ACME challenges. Operators who copied one of these configurations must update their active server configuration. Thanks @onetrev * [security] Image transforms now refuse source rasters above the configured pixel limit before GD or Imagick decodes them. Thanks @manus-pi * Modular page content that uses request-aware Twig is now rendered for each visitor instead of being shared from the page cache. Thanks @Lxcardoza993 * [security] Clockwork profiler data now requires a configured token, including for requests from the local machine. Thanks @Zagn * GPM now explains skipped symlinked updates and reports unwritable package directories before downloading or changing packages. Preflight annotates the same destination issues, and development builds no longer receive a misleading prompt to upgrade to an older release. [#4319](https://github.com/getgrav/grav/issues/4319) * Block direct access to `tmp/` in the bundled Apache, nginx, Caddy, lighttpd and IIS rules, including temporary package downloads. Servers that serve static files before Apache must apply the equivalent rule at that layer, and operators who copied one of these configurations must update their active server configuration. [#4316](https://github.com/getgrav/grav/issues/4316) * Image `format()` and `quality()` settings now apply to all srcset alternatives, including derivatives created before or after those settings. This also fixes format conversion through `images.defaults`. Thanks @onetrev [#4318](https://github.com/getgrav/grav/pull/4318) * **A theme's Flex, user or config blueprints are now found, instead of being ignored unless the theme also happened to ship page blueprints.** A theme supplying, say, a Flex type of its own had it quietly never register: nothing errored and nothing was logged, the type simply never appeared. Each kind of blueprint a theme ships is now registered on its own, which also keeps a theme from shadowing the blueprints Grav itself provides. Thanks @wakqasahmed [#4303](https://github.com/getgrav/grav/issues/4303) # v2.1.6 ## 09/15/2026 1. [](#improved) * **A package that ships its own `.htaccess` can no longer opt out of the protections around `user/`.** Those rules are pushed down into every folder beneath `user/` and run first, which is what stops a plugin or theme from replacing them. A folder can still ask Apache to run them last and then stop before they are reached. That takes a deliberate line in the package's own file rather than the accidental case this guards against, but the protection Grav shipped before 2.1.4 held against it, so this restores that. A second set of rules now backs up the first using a different Apache module, one that a folder underneath cannot switch off. [#4236](https://github.com/getgrav/grav/issues/4236) 1. [](#bugfix) * **The compiled cache is written in one piece, so a busy site no longer logs `Corrupt compiled cache` warnings after an install or a cache clear.** Every request includes the compiled copy of a YAML or markdown file without taking a lock, while the process rebuilding it truncated the file first and filled it afterwards. A request landing in between saw a syntax error, and since 2.0.20 each one wrote a warning to `grav.log`, which on a cold cache with the admin's parallel requests meant a burst of them for a problem that had already healed itself. The compiled file is now written next to its target and renamed over it, so a reader only ever sees a complete file. The warning stays for a file that really is broken, but no longer fires when another process is in the middle of writing it, and a corrupt file is reported once per request rather than once per read path. A compiled file that cannot be written is now a cache miss instead of a server error. * **`user/data` answers correctly on a restricted host too, on sites an earlier update had put beyond the reach of 2.1.5's repair.** An update in June widened that folder's file in place rather than replacing it, which produced two versions that exist only on disk — in no release and in no checkout — so the sweep behind 2.1.5 could not find them to list. A site carrying either one kept the directive that returns a server error for the whole folder on a host with a restricted `AllowOverride`, which is every image and file uploaded to `user/data`. Both are now recognised and replaced. [#4311](https://github.com/getgrav/grav/issues/4311) * **A number field accepts every value that sits on its step, instead of refusing some of them.** Checking a value against a step was done in binary floating point, where a decimal like `0.0000001` has no exact representation, so a perfectly valid entry could be rejected with no way for the person filling the form to tell why — a latitude of `81.96` on a field stepping by `0.0000001` was refused. The check is now done on the digits as typed, which has an exact answer. Thanks @TheoAcker12 [#3585](https://github.com/getgrav/grav/issues/3585) * **A number, range or select field no longer takes the site down when its step is `any`, zero, or not a number.** `any` is the standard way to say a field has no step at all, and it was being read as zero and then divided by, which is a fatal error rather than a failed validation — the same for a step left empty or set to something that is not a number. Multi-value select and checkbox fields had the same fault a few lines away. All of them now treat a step that is not a positive number as no step, which is what browsers do. Thanks @sridharkalaibala [#4308](https://github.com/getgrav/grav/pull/4308) * **The last folder under `user/` that could answer with a server error on a host with a restricted `AllowOverride` now answers correctly.** 2.1.5 fixed the four files Grav ships, but a site with a `user/env` folder also has a file there that an earlier update wrote, and Grav has never shipped that one — so it kept the directive the rest were moved off. Nothing is served from that folder, so no site was broken by it; it is a stray error page where a "forbidden" belongs. An upgrade replaces the file if it is the one Grav wrote, and leaves a file you edited alone. [#4311](https://github.com/getgrav/grav/issues/4311) # v2.1.5 ## 09/14/2026 1. [](#bugfix) * **Avatars and files uploaded to `user/data` are served again, and the rest of the `user/.htaccess` fix from 2.1.4 now reaches the folders it missed.** 2.1.4 restated the site root's folder blocks without the two exceptions the root makes, so profile avatars and Flex Object image uploads came back as "forbidden" on Apache. The separate files in `user/accounts`, `user/config` and `user/data` also still used the directive that takes a site offline on a host with a restricted `AllowOverride`, so those three folders kept failing where 2.1.4 had fixed the rest. All four files now work the same way, and an upgrade replaces any of them a previous Grav wrote — a file you edited yourself is left alone. Thanks @onetrev [#4311](https://github.com/getgrav/grav/issues/4311) * **A premium package covered by a licence you already hold now installs, instead of being refused as unlicensed.** A store can sell one licence that carries several packages — a shop plugin whose payment providers come with it, say — and the repository entry says so with `premium.license_product`. The download proxy has always honoured that, but GPM only ever looked for a key filed under the package's own name, so a customer holding one key had to paste it once per package, and `bin/gpm install` failed on every package they had not pasted it against. The key filed under the product a package belongs to now counts for that package, and a key filed under the package's own name still wins wherever there is one. # v2.1.4 ## 09/14/2026 1. [](#bugfix) * **Sites on hosts with a restricted `AllowOverride` are no longer taken offline by the `user/.htaccess` file added in 2.0.19.** That file used an Apache directive many shared hosts do not permit in `.htaccess`, and where it was not permitted Apache returned an error for everything inside `user/` — so the admin went blank, the theme's styles and scripts stopped loading, and the front end broke too. It kept happening after a rollback, because rolling back Grav never replaces `user/`. The file now does the same job with directives every host running Grav already allows. Thanks @elanorpam [#4309](https://github.com/getgrav/grav/issues/4309) # v2.1.3 ## 09/13/2026 1. [](#bugfix) * **Asking a template for an image caption or credit that was never set no longer changes the image address.** Reading a `.meta.yaml` field that is missing, such as `{{ image.copyright }}`, added the field name to the end of the image URL for every visitor instead of simply returning nothing. Thanks @phmg701 [#4301](https://github.com/getgrav/grav/issues/4301) * **The debug bar is back on pages that swap in a different page while the request runs.** A form that failed validation, or an error page served by the Error plugin, rendered without the bar because Grav no longer recognised the replacement page as one it had already loaded. Thanks @hughbris [#4300](https://github.com/getgrav/grav/issues/4300) * The Clockwork debug badge now appears when the JavaScript pipeline is enabled. Its script was being merged into the combined file, which dropped the attributes it needs to find itself. Thanks @wakqasahmed [#3871](https://github.com/getgrav/grav/issues/3871) * AVIF images now honour the quality setting when the Imagick adapter is in use. The value was being written to a field the AVIF encoder never reads, so every AVIF came out at the encoder's own default regardless of the setting. Thanks @sridharkalaibala and @Rotzbua [#4059](https://github.com/getgrav/grav/issues/4059) * **Saving a page or a Flex object no longer fails with `Invalid input in "Date"` on a date the author never touched.** A `date:` written the ordinary unquoted way comes back out of YAML as a number, and the date validator only accepted text, so editing any other field and saving was refused outright in Admin Next and through the API. Classic admin was never affected because it reformatted the date before submitting it [#4304](https://github.com/getgrav/grav/issues/4304) # v2.1.2 ## 09/11/2026 1. [](#bugfix) * **Updating a 2.0 site to 2.1 from Admin2 no longer fails.** The check that runs before an update still treated a minor release as a major one, so it refused the update unless every enabled plugin and theme listed Grav 2.1 as compatible, which almost none do yet. From 2.0 on those checks only run for a new major version [#4299](https://github.com/getgrav/grav/issues/4299) * `bin/gpm update` no longer calls a 2.0 to 2.1 update a new major version # v2.1.1 ## 09/11/2026 1. [](#bugfix) * **Grav 2.0 sites can update to 2.1.** `bin/gpm selfupgrade` treated each minor release as a separate line, the way 1.7 and 1.8 were, so a 2.0 site was told it was up to date while 2.1.0 was out. Only a new major version now needs a manual move [#4299](https://github.com/getgrav/grav/issues/4299) * When a new major version of Grav is out, `bin/gpm selfupgrade` says so and links to the migration guide instead of only reporting that the site is up to date # v2.1.0 ## 09/11/2026 1. [](#new) * Every page can now be read as Markdown, built for AI agents and other text clients. Add `.md` to any page URL, or send an `Accept: text/markdown` request header, and Grav answers with the rendered page converted back to Markdown instead of the theme's HTML * The Markdown is the page as the theme renders it, reduced to its main content region, so blog listings, shops, product pages and anything else a template builds read the way they display. Shortcodes, content Twig, modular pages and resolved image and link paths all come through, and site navigation, sidebars and footers are left out * Each Markdown document opens with a YAML block (title, URL, date, description, taxonomy) and closes with links to the parent, neighbouring and child pages by their own `.md` URLs, so an agent can walk a whole site without leaving Markdown * The feature and each of its parts can be switched off under the new **Markdown Output** settings in **Configuration → System → Content** * HTML responses now carry a `Link` header and a `` tag pointing at their Markdown version, and Markdown responses carry an `X-Markdown-Tokens` header with an estimated token count, matching Cloudflare's Markdown for Agents * Themes can override the Markdown layout with a `default.md.twig` or `