Release notes from textpattern

v4.9.1

2026-02-14T20:10:51Z

Maintenance release with security enhancements, general improvements and bug fixes.
Security: Resolved access control regression with articles. Many thanks to Federico Frascino.
Security: Resolved admin-side XSS vulnerability. Many thanks to Jan Jeffrie Galvez Salloman, aka '0xj4n'.
Changed: (Article)Image tags only output dimensions on demand.
Changed: <txp:article_image> skips empty images/thumbnails.
Changed: Valueless width/height/crop behaviour in (Article)Image tags.
Changed: Thumb path now permits virtual/multiple host setups.
Changed: Use publisher email and fallback if no/invalid sender is supplied (thanks, @jools-r ).
Fixed: Fatal error with UNIXTIME() changes in MariaDB 11.8+.
Fixed: Dynamic thumbnail MIME detection (thanks, rezozero/ambroisemaupate).
Fixed: PHP 5.6 support (thanks, pinalgirkar).
Fixed: Show template content even if theme is deleted (thanks, Mark Goodwin).
Fixed: Correct admin theme file scaffold for dynamic thumbnails.
Fixed: Reintroduce 'No' indicator if thumbnail is missing in Images list panel (thanks, @rwetzlmayr and @phiw13).
Fixed: Duplicate action only available for existing content.
Fixed: Assets created with no timestamp use time of creation, not Unix epoch.
Fixed: Internal errors with password reset email sending on PHP 8.5.
Added: (Article)Image thumbnails can output any supported format.
Vendors: jQuery UI 1.14.2.

v4.9.0

2025-12-21T17:40:18Z

Feature release with support for PHP 8.5, MySQL 8.4, new functionality, security enhancements, improvements, and bug fixes.
Changed: Minimum system requirements increased to PHP 5.6 (PHP 8.2+ recommended, preferably with ongoing vendor support).
Changed: Minimum system requirements increased to MySQL 5.5 (MySQL 8.0+ recommended, preferably with ongoing vendor support).
Fixed: Remove 'br' tags from article image markup where >1 image is supplied (thanks, @jools-r).
Fixed: Pre+post textfilter callbacks were switched.
Fixed: Plugins import Textpack strings correctly.
Fixed: Prefs (multi-)select options.
Fixed: Improved support for images with EXIF orientation metadata (thanks, @jools-r).
Fixed: Avoid directory traversal when uploading plugins (thanks, @BG1).
Fixed: Compiled plugins upload on PHP 5.6.
Fixed: Windows-generated .zip plugins installable on UNIX/Linux.
Fixed: Restored empty 'height' and 'width' attributes behaviour of <txp:image />.
Fixed: Self-closing tag output for html5 doctype to silence validator (thanks, @jools-r).
Fixed: Ignore search in individual article mode.
Fixed: Take RFC 2616 mail headers setting into account for separator.
Fixed: Sandboxed article/body/excerpt preview (thanks, @grozdniyandy).
Added: Support for PHP 8.2, PHP 8.3.1+, PHP 8.4, and PHP 8.5.
Added: Full article previews directly from the Write panel.
Added: Filter articles by image.
Added: Admin Theme prefs.
Added: Automatic, dynamic thumbnail generation (tags and back-end).
Added: SVG image support (thanks, osadl and @jools-r).
Added: Activity indicator for extended duration file/image upload processes.
Added: Multi-edit for changing author language.
Added: In-use asset counters to the Users panel.
Added: Reload language packs from disk.
Added: Shift+Space shortcut for 'Tab' indent in textareas.
Added: Input length tooltip when appropriate.
Added: PHPMailer for third-party SMTP delivery. See Admin>Preferences>Mail.
Added: <txp:date /> tag.
Added: <txp:if_article_status /> tag.
Added: <txp:if_items_count /> tag.
Added: Global 'variable' attribute.
Added: Global 'offset' attribute can be set by URL parameters.
Added: 'parent' attribute to <txp:category />.
Added: 'inline' value to 'format' attribute of <txp:css /> (thanks, @jools-r).
Added: 'alias' attribute to <txp:evaluate />.
Added: Ability to serve files via 'type' attribute to <txp:file_download />.
Added: 'exclude' attribute to <txp:file_download_list /> and <txp:linklist />.
Added: Site production status values to 'process' attribute of <txp:hide />.
Added: 'level' attribute to <txp:if_category />.
Added: 'match', 'separator' attribute capability to <txp:if_yield />.
Added: 'exclude', 'month' and 'time' attributes to <txp:images />.
Added: 'lang' attribute to <txp:page_url />.
Added: 'target' attribute to <txp:popup />.
Added: 'filter' attribute to <txp:section_list /> and <txp:if_section />.
Added: Plugins can be uploaded from a URL by dragging to upload textarea.
Added: Plugin compilation directly from the Plugins panel.
Added: Plugin export to .zip.
Added: Compiled plugins can be uploaded via Browse... feature.
Added: Compatible plugin upgrades directly from the Plugins panel.
Added: Create and install new plugins directly from the Plugins panel.
Added: Plugin multi-edit option: revert to last installed code content.
Added: All plugin metadata exposed in the Plugin Edit panel.
Added: Latest text translations. Thank you to all our translators.
Added: Punjabi, Slovenian and Urdu (Pakistani dialect) language support.
Added: Trailing slash URL preference.
Added: File download header preference.
Added: Option to define a Content Security Policy header for the Textpattern admin-side via config.php.
Added: Support for aggregate window functions in compatible MySQL versions.
Added: metaWeblog.newMediaObject for image upload over the MovableType API (thanks, @Melonking906).
Changed: Pending articles may be displayed on the site.
Changed: Theme page maximum size increased from 64KB to 16MB.
Changed: Allow content dates prior to 01-01-1970, and beyond 03:14:07 UTC on 19 Jan 2038. Refer to Epochalypse/Year 2038 problem for info. Adjustments for non-Gregorian (AD) dates are performed.
Changed: Display/edit 'modified' date on Files panel.
Changed: Refactored article Save panel (thanks @jools-r, @phiw13, and @cara-tm).
Changed: File Edit panel has the ability to rename and delete files, and change the download counter value (thanks, adi).
Changed: Image Edit panel has the ability to delete images.
Changed: Image Edit panel includes published date/time, which can be altered.
Changed: Pre-flight check visibility toggle.
Changed: In-use languages can not be deleted.
Changed: Deprecate <txp:search_result_count />. Use `<txp:items_count /> instead.
Changed: Section-aware default search.
Changed: Image tags can take HTML attributes.
Changed: Enhancements to 'br' tag HTML5 compliance (thanks, @jools-r).
Changed: Enhancements to SVG handling relating to non-px dimensions (thanks, @jools-r).
Changed: Enhancements to 'extension' and 'size' attributes of <txp:images />.
Changed: Enhancements to RPC functionality (thanks, @Melonking906).
Changed: Admin-theme checksums computed independently. Unused admin themes can be deleted and will no longer trigger Diagnostics alert.
Changed: Multi-site scaffold optimisations.
Changed: Wildcards in file/image/link category queries.
Changed: <txp:header /> tag requires 'form' privilege.
Changed: Articles may use external URLs directly.
Changed: Some language keys renamed to avoid invalid name clashes.
Changed: Do not generate empty syndication feeds for feedless sections.
Changed: Removed 'noopener' from target="_blank" links (now default behaviour in all supported browsers) (thanks, @phiw13).
Changed: Removed 'aria-label' attributes where 'title' already exists.
Changed: Checksums use Tiger-192,3 instead of MD5. Fewer potential clashes.
Changed: Allow PHP scripting options off by default, and Diagnostics warning.
Changed: Plugins of all types trigger verify step (with improved security).
Changed: Extend character set that can be used in tag/attribute names.
Changed: Less collision-prone custom fields name processing.
Changed: Category & section description field sizes increased to 1023 characters.
Changed: Introduce primary keys for all database tables, replacing some old indexes.
Developer: Permitted concurrent logins. See Advanced Prefs.
Developer: Removed duplicate pluggable_ui callback for article_ui›categories (thanks, @jools-r).
Developer: Added pophelp support in plugin 'lang' directory.
Developer: Articles (list) panel callbacks:
articles>fields and articles>from to manipulate the query
articles>controls to affect the button area
articles_ui>list.row (pluggable_ui) for adding table data
articles>steps for plugins to register custom panel-level functionality.
Developer: Add pre+post article_submit callbacks on article post/save.
Developer: Add getAtts($tag) method for fetching tag attributes.
Developer: Reintroduce extend_col_1 markup area on Write panel.
Developer: Add lifecycle>loaded callback for plugins run from cache.
Developer: Introduce UI class library for building interface components.
Developer: Tag registration is now mandatory.
Developer: Some of the lesser-used tags are loaded on demand from their class
to save memory. Plugins must call them via processTags() function.
Developer: Add safe_exists() function to database layer.
Developer: Move $thisversion and $txp_is_dev to constants.php.
Developer: 'Visitor logs' panel is now bound to the new 'lore' event name
(was: 'log') to prevent conflicts with privacy filters.
Developer: File upload callbacks (file_uploaded and files_uploaded pre+post).
Developer: Activation emails can be skipped via hidden notify="skip" field.
Developer: Can add &checksums=1 on Diagnostics panel URL to verify checksums.
Vendors: Textile 4.1.4. (thanks, @gocom).
Vendors: DOMPurify 3.3.1.
Vendors: jQuery 3.7.1.
Vendors: jQuery UI 1.14.1.
Vendors: PHPMailer 6.12.0.
Vendors: PrismJS 1.30.0.
Vendors: UglifyJS 3.19.3.

v4.9.0-beta.2

2025-03-14T11:40:28Z

Added: Full article previews directly from the Write panel.
Added: Site status values to 'process' attribute of <txp:hide />.
Added: 'inline' value to 'format' attribute of <txp:css /> (thanks, jools-r).
Added: 'target' attribute to <txp:popup />.
Added: 'match', 'separator' attribute capability to <txp:if_yield />.
Added: Ability to serve files via 'type' attribute to <txp:file_download />.
Added: Plugin compilation directly from the Plugins panel.
Changed: Refactored article Save panel (thanks jools-r, phiw13, and cara-tm).
Changed: Wildcards in file/image/link category queries.
Changed: Enhancements to RPC functionality (thanks, Melonking906).
Changed: Multi-site scaffold optimisations.
Changed: Pre-flight check visibility toggle.
Changed: Articles may use external URLs directly.
Changed: A few language keys renamed to avoid invalid name clashes.
Developer: Add pre+post article_submit callbacks on article post/save.
Developer: Add getAtts($tag) method for fetching tag attributes.
Developer: Reintroduce extend_col_1 markup area on Write panel.
Developer: Add lifecycle>loaded callback for plugins run from cache.
Fixed: Pre+post textfilter callbacks were switched.
Fixed: Plugins import Textpack strings properly.
Fixed: Prefs (multi-)select options (UI Library).
Vendors: DOMPurify 3.2.4.
Vendors: jQuery UI 1.14.1.
Vendors: PHPMailer 6.9.3.
Vendors: PrismJS 1.30.0.
Vendors: Textile 4.1.2. (thanks, gocom).
Vendors: UglifyJS 3.19.3.

v4.9.0-beta.1

2024-08-13T06:04:23Z

First beta release of Textpattern 4.9.0 (beta.1)

Feature release with support for PHP 8.4.0+, new functionality, security enhancements, general improvements and bug fixes.
Changed: Minimum system requirements increased to PHP 5.6 (PHP 8.2+ recommended).
Changed: Minimum system requirements increased to MySQL 5.5 (MySQL 8.0+ recommended).
Changed: Removed 'noopener' from target="_blank" links (now default behaviour in all supported browsers) (thanks, phiw13).
Changed: Removed 'aria-label' attributes where 'title' already exists.
Changed: Deprecate <txp:search_result_count />. Use <txp:items_count /> instead.
Fixed: Improved support for images with EXIF orientation metadata (thanks, jools-r).
Fixed: Avoid directory traversal when uploading plugins (thanks, bg1).
Fixed: Compiled plugins upload on PHP 5.
Fixed: Windows-generated zip plugins installable on Linux.
Fixed: Restored empty 'height' and 'width' attributes behaviour of <txp:image />.
Fixed: Self-closing tag output for html5 doctype to silence validator (thanks, jools-r).
Fixed: Ignore search in individual article mode.
Fixed: Take rfc2616 mail headers setting into account for separator.
Fixed: Sandboxed article/body/excerpt preview (thanks, grozdniyandy).
Added: Support for PHP 8.2, PHP 8.3.1+ and PHP 8.4.0+.
Added: SVG image support (thanks, osadl and jools-r).
Added: Option to define a Content Security Policy header for the Textpattern admin-side via config.php.
Added: PHPMailer for third-party SMTP delivery. See Admin>Preferences>Mail.
Added: Multi-edit for changing author language.
Added: Plugins can be uploaded from a URL by dragging to upload textarea.
Added: Compiled plugins can be uploaded via Browse... feature.
Added: Compatible plugin upgrades directly from the Plugins panel.
Added: Create and install new plugins directly from the Plugins panel.
Added: Plugin multi-edit option: revert to last installed code content.
Added: All plugin metadata exposed in the Plugin Edit panel.
Added: Plugin (zip-only) export feature.
Added: Support for aggregate window functions in compatible MySQL versions.
Added: Trailing slash URL preference.
Added: File download header preference.
Added: In-use asset counters to the Users panel.
Added: 'filter' attribute to <txp:section_list /> and <txp:if_section />.
Added: 'level' attribute to <txp:if_category />.
Added: Activity indicator for long upload processes.
Added: metaWeblog.newMediaObject for image upload over the MovableType API (thanks, Melonking906).
Added: Global 'offset' can be set by URL parameters.
Added: 'lang' attribute to <txp:page_url />.
Added: <txp:if_items_count /> tag.
Added: Reload language packs from disk.
Added: Shift+Space shortcut for 'Tab' indent in textareas.
Added: Input length tooltip when appropriate.
Added: <txp:date /> tag.
Added: Global 'variable' attribute.
Added: 'alias' attribute to <txp:evaluate />.
Added: 'parent' attribute to <txp:category />.
Changed: Plugins of all types trigger verify step (with improved security).
Changed: File Edit panel has the ability to rename and delete files, and change the download counter value (thanks, adi).
Changed: Image Edit panel has the ability to delete images.
Changed: In-use languages can not be deleted.
Changed: Image tags can take HTML attributes.
Changed: Less collision-prone custom fields name processing.
Changed: Do not generate empty syndication feeds for feedless sections.
Changed: Allow PHP scripting options off by default, and Diagnostics warning.
Changed: Introduce primary keys for all database tables, replacing some old indexes.
Changed: Category & section description field sizes increased to 1023.
Changed: <txp:header /> tag requires 'form' privilege.
Changed: Section-aware default search.
Changed: Extend character set that can be used in tag/attribute names.
Developer: Introduce UI class library for building interface components.
Developer: Tag registration is now mandatory.
Developer: Some of the lesser-used tags are loaded on demand from their class to save memory. Plugins must call them via processTags() function.
Developer: Add safe_exists() function to database layer.
Developer: Move $thisversion and $txp_is_dev to constants.php.
Developer: 'Visitor logs' panel is now bound to the new 'lore' event name (was: 'log') to prevent conflicts with privacy filters.
Developer: File upload callbacks (file_uploaded and files_uploaded pre+post).
Developer: Activation emails can be skipped via hidden notify="skip" field.
Vendors: DOMPurify 3.0.6.
Vendors: jQuery 3.7.1.
Vendors: jQuery UI 1.13.3.
Vendors: PHPMailer 6.9.1.
Vendors: PrismJS 1.29.0.
Vendors: Textile 4.1.1. (thanks, gocom).
Vendors: UglifyJS 3.19.0.

4.9.0-beta.1

2024-08-12T22:10:32Z

Merge branch 'release-4.9.0-beta.1' into main

Merge branch 'release-4.9.0-beta'

2024-08-12T12:05:37Z

Conflicts:

HISTORY.txt

INSTALL.txt

README.txt

UPGRADE.txt

package.json

textpattern/checksums.txt

textpattern/index.php

textpattern/textpattern.js

textpattern/vendors/Textpattern/DB/Data/core.prefs

v4.8.8

2022-01-24T13:42:02Z

Maintenance release with support for PHP 8.1, security enhancements, general improvements and bug fixes.
Security: Fix reported cross-site scripting issue relating to article preview CSRF token (many thanks, Paul Ritchie at Pentest Limited).
Fixed: More robust numeric searches.
Fixed: Improved query efficiency of category operations.
Fixed: Required parameters after optional in tag builder (thanks, @phiw13).
Fixed: Admin-side pagination when sorting by non-unique values.
Added: PHP 8.1 support.
Added: Natural search mode.
Added: Random form selection.
Added: Support for AVIF image format, on PHP 8.1 or higher.
Added: Global limit, offset and sort attributes.
Added: url_title attribute to <txp:article[_custom] />.
Added: range attribute to <txp:article_image />.
Added: date and time attributes to <txp:if_expired />.
Added: calendar attribute to <txp:posted /> and similar tags.
Added: Substring extraction via escape attribute.
Added: <txp:items_count /> tag.
Added: Expanded conditional match attribute with comparison operators.
Added: UTC is now a permitted time zone.
Added: Custom date formats.
Changed: <txp:category_list /> with children >1 attribute behaviour.
Changed: Global escape attribute operates at the items level in lists.
Changed: Multi-site plugins directory defaults to site/admin/plugins.
Accessibility: Additional aria-label attributes for some internal links.
Internal: Removed FOUND_ROWS() which is deprecated in MySQL 8.0.17.
Internal: Prefer is_readable() and is_file() to file_exists().
Developer: Added plugin lifecycle events upgraded and downgraded.
Developer: Export new article IDs on duplicate.
PrismJS 1.26.0.

v4.8.8-beta.1

2022-01-01T14:05:56Z

First beta release of Textpattern 4.8.8 (aka Textpattern 4.8.8-beta.1).

Maintenance release with support for PHP 8.1, security enhancements, general
improvements and bug fixes.
Security: to be advised (many thanks, Paul Ritchie at Pentest Limited).
Fixed: More robust numeric searches.
Fixed: Improved query efficiency of category operations.
Fixed: Required parameters after optional in tag builder (thanks, phiw13).
Fixed: Admin-side pagination when sorting by non-unique values.
Added: Natural search mode.
Added: Random form selection.
Added: Support for AVIF image format, on PHP 8.1 or higher.
Added: Global limit, offset and sort attributes.
Added: url_title attribute to <txp:article[_custom] />.
Added: range attribute to <txp:article_image />.
Added: date and time attributes to <txp:if_expired />.
Added: calendar attribute to <txp:posted /> and similar tags.
Added: Substring extraction via escape attribute.
Added: <txp:items_count /> tag.
Added: Expanded conditional 'match' attribute with comparison operators.
Added: UTC is now a permitted time zone.
Added: Custom date formats.
Changed: <txp:category_list /> with children >1 attribute behaviour.
Changed: Global escape attribute operates at the items level in lists.
Accessibility: Additional aria-label attributes for some internal links.
Internal: Removed FOUND_ROWS() which is deprecated in MySQL 8.0.17.
Internal: Prefer is_readable() and is_file() to file_exists().
Developer: Added plugin lifecycle events upgraded and downgraded.
Developer: Export new article IDs on duplicate.
PrismJS 1.24.1.

Final cut of Textpattern 4.8.8 expected 2022 Q1.

v4.8.7

2021-06-01T15:01:47Z

High priority maintenance release to address functionality and setup issues discovered after 4.8.6 release.

Fixed: Users panel throws error due to missing DB prefix (thanks, prbt2016).
Removed: Database user GRANT check during initial setup, which broke some installations.
Changed: Context check priority in tags.

v4.8.6

2021-05-30T15:45:11Z

DO NOT USE IN PRODUCTION - issues discovered after release, use 4.8.7 instead.

Textpattern CMS maintenance release including improvements for PHP 8.0, bug fixes and minor tweaks.

Headlines

Fixed regression in override form usage in lists (thanks, Christian Rapp).
Fixed undefined $article warning when accessing non-existent articles.
Fixed error with <txp:output_form /> tag on empty forms (thanks, Adi).
Fixed low-privilege users can save immediately after duplicating articles.
Latest text translations. Thank you to all our translators.
Option to create database during setup.
Permission (grants) verification during setup.

Tag modifications

Articles can be filtered by keywords more easily.
Added: id attribute to <txp:if_different /> tag.
Added: db option to the global escape attribute.
<txp:variable trim> trims its own output (thanks, cara-tm).
<txp:link_to_next/prev> can return URL or container.
<txp:page_url> and <txp:if_request> tags are more flexible.
Boost power of txp:article(_custom) grouping by date.
Deprecate <txp:search_result_date />. Use <txp:posted /> instead.
Remove deprecated break attribute from search_result_excerpt tag.

Back-end tweaks

'Assign sections' from Themes panel only selects its own sections.
No Edit options in Write panel without appropriate privileges.
No disabled update buttons on Languages panel (thanks, phiw13).
Search improved when handling numbers. Comparators can also be used for numeric searches.

Developer goodies

Permit step=false to hook into explicit empty step callbacks and step=null to indicate 'any step'.
Permit $pre to be any text. Opens up arbitrary callback grouping.
New articles>multi_edit.$method callback on Articles list panel.
User panel callbacks:
user>fields and user>from to manipulate the query
user>controls to affect the button area
user_ui>list.row (pluggable_ui) for adding table data
user>steps for plugins to register custom panel-level functionality
Diagnostics panel callbacks diag>steps and diag_ui>level for custom plugin steps and functionality.