Yes, 9.5.7. There is no 9.5.6. We botched a step in the release process and orphaned that version number on the way out the door. Nothing shipped under it and nothing depends on it, so there's nothing for you to do except notice the gap and now know why it's there.
Concrete CMS 9.5.7 Is Available
Oct 21, 2026
by
Composer Installs Work Again
You can install Concrete with composer create-project without turning off Composer's security auditing. We said this was fixed in 9.5.5. It wasn't, or at least not completely. This time it is.
We've also put security advisory checks into a dedicated workflow so this stops sneaking past us, and every advisory we ignore now has to say why it's being ignored.
If 9.5.5 Wouldn't Upgrade
Upgrading to 9.5.5 could fail on MySQL 8 at the migration that alters containerID on PageContainerInstances. That's fixed. We're now also testing install and upgrade against both strict and empty sql_mode, since that's exactly where this class of problem likes to hide.
Other Fixes
Custom styles were bleeding between page versions, and custom styles on global areas were broken outright. Both sorted. You couldn't add a second block to a page type. Social links for email addresses and phone numbers wouldn't add. Moving pages could leave you with two canonical URLs and no way to remove either one. The dashboard user page reported "Email Validated: Unknown" for users who were, in fact, validated. And stack translations were missing entirely, which is a long-standing one we're glad to close.
On top of that, the calendar EventService was missing some key events and now has them, inline designs read from a Content Import Format file get sanitized, and the API documentation console no longer makes the browser prompt for credentials.
No security advisories in this release.
For Developers
enshrined/svg-sanitize is updated to 1.0 and Composer dependencies are refreshed. The repo now asks AI tools for short code comments and no automatic commits, which is less a feature than a house rule, but it's in the notes and you may as well know about it.
Getting It
SaaS hosting is already updated. Self-hosted sites can download 9.5.7 or update through Composer. The full 9.5.7 release notes have every change.