9.5.5 Release Notes

New Features

    Enhanced Thumbnail Editor: Crop Controls, Live Preview, and Dialog Improvements (#13016) (thanks katalysis)
    Add an option to exclude system pages from the Remove Old Page Versions task (thanks digitmaster)

Behavioral Improvements

    Bug: Completed tasks can remain shown as running (#418) (thanks digitmaster)
    The Home Folder is not pre-selected when uploading files from blocks (#12794) (thanks broreece)
    Add date_public to the Page API transformer (#13125) (thanks broreece)
    Fixed: File dialogs throw a fatal error instead of "Invalid file" when fID is empty or non-numeric (#13152) (thanks janscarton)
    Better breadcrumb support in the Dashboard Express pages (thanks mlocati)
    Persist Dashboard panel visibility preference (#12994) (thanks digitmaster) Dashboard panel now will stay closed for much longer if the user manually closes it.
    Express Entry List block: check the classes when reading its settings back (#13237) (thanks mlocati)
    Config Key for Help System (#11669) (thanks aembler)

Bug Fixes

    Legacy Form block throws an error on submit (#13129) (thanks mlocati)
    [Fix] PHP 8 error in Add Workflow dashboard page caused by incorrect View::element argument order (#13119) (thanks biplobice)
    When there was a PHP_EXTENSION_ERROR while uploading a file, we would show the wrong error message. This is now fixed. (thanks darkdi)
    Bug: Dashboard page favorite icon stays gray in dark mode (thanks digitmaster)
    Fixed bug in REST API where block was updated twice (thanks mlocati)
    Fixed bug where programmatically updating the Google Maps block through code could clear the API key (thanks mlocati)
    Bug fixes in the image block when saving links using the REST API (thanks mlocati)
    Fixed bug where installing Concrete via composer was impossible with security auditing enabled, due to upstream dependencies (thanks mlocati)
    concretecms/monolog-cascade not compatible with symfony/config v6.4.44 (#13219) (thanks mlocati)
    Fixed bug where conversation max file size for registered users was set incorrectly (thanks mlocati)
    Many bug fixes to the Content Import Format (thanks mlocati)
    Many bug fixes in the REST API (thanks mlocati)
    Express Entry Detail block: don't preset an entry mode that doesn't exist (#13187) (thanks mlocati)
    Express Entry List block: fill the edit dialog even when the entity has no attributes (#13188) (thanks mlocati)
    Fix duplicate composer schedule dialogs by cleaning up on close. (#13190) (thanks broreece)
    Clarify Waiting For Me notification menu label and fix dropdown positioning (#13192) (thanks broreece)
    Fixed bug where copying a calendar event associated to a page and deleting the new event would delete the page, orphaning the original calendar event's page relation (thanks eastagiletracker)
    Fix the URL returned after renaming an Express search preset (#13214) (thanks mlocati)
    Fix stale search index when page attributes are deleted. (#13226) (thanks broreece)
    Allow clearing the skin of a page (#13225) (thanks mlocati)
    Prevent duplicate File Manager folder submissions (#13189) (thanks digitmaster)
    Fix deleting all keys in Cache/Driver/RedisStashDriver (#12966) (thanks mlocati)
    Page List set to "Everywhere" on the homepage shows no results after upgrading to 9.5.4. (#13232)

Security Updates

    CVE-2026-106551 (8.6) @bp0lr

Developer

    Improvements to new ConcreteFetch JS fetch library (thanks mlocati)
    Lots of code cleanup (thanks mlocati)
    Packages that define tasks no longer need to explicitly register their task controllers with the task manager. (thanks mlocati)
    Re-implemented many formerly skipped tests (thanks mlocati)
    Update composer dependencies (#13239) (thanks mlocati)
	
9.5.4 Release Notes

Behavioral Improvements

    Test mail settings: show email sender, add links to configuration pages (#13078) (thanks mlocati)
    SEO bulk report no longer rescans paths needlessly for every page it lists. (#13071)
    Improve sanitization checking of SVG on upload

Bug Fixes

    Fix issue with composer attribute control not saving
    When dragging / dropping page in sitemap an "invalid token"-error occurs (#13077)
    Rescan Locale strips every content-block page link and crashes on stack pages (#13082) (thanks janscarton)
    Mail Service: From and Subject headers are still encoded on the dashboard logs page (9.5.3) (#13075) (thanks broreece)
    Express object dashboard: validation failure returns a 500 instead of an error (#13093)
    Express object dashboard: delete_entries() has no permission check (#13095)
    [Bug] Translate Site Interface “Save to file” fails with “Invalid language identifier” on a non-default site (#13065)

Security Updates

    CVE-2026-85385 (Risk Rank 7.7) (thanks Suraj Bhosale)
    CVE-2026-85386 (Risk Rank 7.3) (thanks Valentin SARRE (Independent security researcher))
    CVE-2026-85387 (thanks Myq Larson)
    CVE-2026-87028 (Risk Rank 5.3) (thanks Pakung)
    CVE-2026-87031 (Risk Rank 2.1) (thanks Winston Crooker)

Developer

    Fix the documented types of the attribute value objects (#13079) (thanks mlocati)
    Removed some vestigial code (thanks mlocati)