Concrete CMS 9.5.3 Is Available

Don't Sit On This Release

9.5.3 closes 63 security advisories. About a third are rated 7.0 or higher, with the top one at 8.7. That's a bigger batch than we usually ship, and we'd rather say so than bury it. No migration, no rewrite, just a normal point release. Get it scheduled. Full CVE list and risk rankings are on the security page at concretecms.org.

Also worth knowing: if MariaDB 11.4 or MySQL 8.0+ blocked your upgrade with an invalid default value for ugEntered, that's fixed.

File Manager

Moving files between folders now works the way you'd expect. Drag a file into a folder and the manager reloads so you can see where it went. The Move to Folder dialog has a Sort by dropdown. You can drop files straight into an empty folder without opening Import Files first.

Also: better folder selection in upload dialogs, improved keyword search, no more duplicate requests in the launch dialog picker, and the Date Added column no longer crashes the File Manager.

Users and Search

User search gets group membership columns, and export respects the columns you actually picked. The timezone field shows on user create when user-configurable time zones are on. There's a show/hide password toggle on login. Saved search presets stop allowing duplicate names and refresh after you delete one.

Fixes

Orphaned blocks can be deleted again. Container notch and move controls survive a move. Duplicate composer controls no longer hang a publish. Copying a block from a global area works on multilingual sites. Workflow emails show the right version comment. Drag-and-drop restore from Trash, which we broke in 9.5.2, works again. Sorry about that one.

Marketplace updates got attention too. Timeouts no longer crash the dashboard update flow, directory errors say something useful, and package updates clear the opcache themselves instead of asking you to.

For Developers

New REST endpoint to clone a page as an editable draft. Theme area classes take a * wildcard and inherit through nested sub-areas. OpenAPI area scopes and the OAuth registry agree on singular now. Aliased classes work as singletons with dependency injection. League/Fractal updated for PHP 8.1.

Thanks

digitmaster, mlocati, broreece, janscarton, katalysis, yyya-nico, hissy, jarpen, nratering, iampedropiedade, vmc874, m3dium, and Roshan931. A lot of this came from people who don't work here and fixed it anyway.

Getting It

SaaS hosting is already updated. Self-hosted sites can grab it from concretecms.org or update through Composer. The full 9.5.3 release notes have every change, and the changelog is on GitHub.

Image Source

Wintermute, L. (n.d.). Lazuli bunting [Photograph]. U.S. Fish and Wildlife Service. Public domain. https://www.fws.gov/media/lazuli-bunting