apostrophecms
diff --git a/‎packages/apostrophe-astro/CHANGELOG.md‎
Lines changed: 28 additions & 0 deletions b/‎packages/apostrophe-astro/CHANGELOG.md‎
Lines changed: 28 additions & 0 deletions
diff --git a/‎packages/apostrophe-astro/package.json‎
Lines changed: 1 addition & 1 deletion b/‎packages/apostrophe-astro/package.json‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎packages/apostrophe/CHANGELOG.md‎
Lines changed: 48 additions & 1 deletion b/‎packages/apostrophe/CHANGELOG.md‎
Lines changed: 48 additions & 1 deletion
diff --git a/‎packages/apostrophe/package.json‎
Lines changed: 1 addition & 1 deletion b/‎packages/apostrophe/package.json‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎packages/create-apostrophe/CHANGELOG.md‎
Lines changed: 6 additions & 0 deletions b/‎packages/create-apostrophe/CHANGELOG.md‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎packages/create-apostrophe/package.json‎
Lines changed: 1 addition & 1 deletion b/‎packages/create-apostrophe/package.json‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎packages/emulate-mongo-3-driver/CHANGELOG.md‎
Lines changed: 14 additions & 8 deletions b/‎packages/emulate-mongo-3-driver/CHANGELOG.md‎
Lines changed: 14 additions & 8 deletions
diff --git a/‎packages/emulate-mongo-3-driver/package.json‎
Lines changed: 1 addition & 1 deletion b/‎packages/emulate-mongo-3-driver/package.json‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎packages/font-size/CHANGELOG.md‎
Lines changed: 7 additions & 0 deletions b/‎packages/font-size/CHANGELOG.md‎
Lines changed: 7 additions & 0 deletions
diff --git a/‎packages/form/CHANGELOG.md‎
Lines changed: 6 additions & 0 deletions b/‎packages/form/CHANGELOG.md‎
Lines changed: 6 additions & 0 deletions
@@ -1,5 +1,33 @@
 # Changelog
 
+## 1.14.0 (2026-07-10)
+
+### Adds
+
+- In SSR mode, the integration now automatically serves _literal content_ files declared by Apostrophe modules - such as `robots.txt`, `sitemap.xml`, and `llms.txt` - by proxying them directly to Apostrophe instead of rendering them as pages. These files no longer need to be listed individually in the `proxyRoutes` option, which continues to work as before for any additional routes you wish to proxy.
+
+### Changes
+
+- Upgraded the `undici` HTTP client from v6 to v8, which requires Node.js 22.19 or newer, and fixed a connection leak in the Astro proxy where responses that are not streamed on to the browser — redirects (301/302/307/308) and bodyless responses (204/304) — now release their backend response body immediately instead of leaving it for garbage collection, which under load could hold connections open and exhaust the connection pool.
+- Replace vite-plugin-apostrophe-config and vite-plugin-apostrophe-doctype with vite/vite-plugin-apostrophe-generated-config.js, which writes real files to node_modules/.apostrophe-astro-config/ (config.js, doctypes.js)
+
+  - Register Vite aliases for apostrophe-astro-config/config and /doctypes
+  - Update all internal virtual: imports to alias specifiers
+  - Rename static build cache dir to node_modules/.apostrophe-astro-static/
+  - Add helpers/server/ (aposFetch, getAposHost, isStaticBuild)
+  - Add helpers/universal/ (URL, slug, styles, attachment helpers)
+  - Keep lib/aposPageFetch.js as the internal implementation (starter kit entrypoint only)
+  - Reduce lib/util.js, lib/aposSetQueryParameter.js, lib/static.js to deprecated shims
+  - Add MIGRATION.md
+  - Bump `undici` to ^7.x for Node.js 24+ compatibility
+  - Add `peerDependencies` declaring Astro v5, v6, and v7 support.
+  - Fix `virtual:apostrophe-config` import in `aposLiteralContentMiddleware.js` to use the generated-file module path.
+  - Drop deprecated entryPoint shim from injectRoute calls.
+
+### Fixes
+
+- Query string parameters are no longer lost when a URL with a trailing slash is normalized, so `/articles/?page=2` now renders the same content as `/articles?page=2`. Previously such URLs were redirected to the page URL alone (e.g. `/articles`), losing the query string and showing the first page. Redirects to a different origin are now always passed through to the browser.
+
 ## 1.13.0 (2026-06-10)
 
 ### Fixes
 
@@ -1,6 +1,6 @@
 {
   "name": "@apostrophecms/apostrophe-astro",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "type": "module",
   "description": "Apostrophe integration for Astro",
   "repository": {
 
@@ -1,5 +1,52 @@
 # Changelog
 
+## 4.32.0 (2026-07-10)
+
+### Adds
+
+- Added support for modules to declare _literal content_ routes - URLs that serve non-page files such as `robots.txt`, `sitemap.xml`, or `llms.txt` rather than rendered pages. External front-end integrations (such as the Astro integration) can now read these routes and serve such files correctly instead of attempting to render them as pages. Custom modules can contribute their own routes by handling the new `@apostrophecms/url:getLiteralContentRoutes` event.
+
+### Changes
+
+- The server-side HTTP client (`apos.http`) now uses Node's built-in `fetch` instead of `node-fetch`.
+
+  `node-fetch` is no longer maintained, and Node's built-in `fetch` is its standard, actively maintained successor, available in every Node.js version Apostrophe supports - so this is the right time to adopt it. We do not consider this a breaking change: common `apos.http.*` usage is unchanged, and we deliberately preserved compatibility where it mattered - `form-data` request bodies, cookie jars, the `timeout` option (now backed by an `AbortSignal`), and absolute redirect `Location` headers all behave as before.
+
+  Most code that calls `apos.http.get()`, `apos.http.post()`, etc. needs no changes. A few things to be aware of if you use advanced options or read raw responses:
+
+  - The `agent` option is no longer supported (the built-in `fetch` has no equivalent). Pass an undici `dispatcher` instead; `apos.http` throws if `agent` is given.
+  - A `Host` request header can no longer be set (it is disallowed by the fetch standard and is silently ignored).
+  - `originalResponse: true` now resolves with the built-in `fetch` `Response`. Its `body` is a web `ReadableStream` (use `require('node:stream').Readable.fromWeb()` to read it as a Node stream), and node-fetch-only helpers such as `.buffer()` are no longer available.
+  - Requests that send a conditional header (`If-None-Match` / `If-Modified-Since`) now also send `Cache-Control: no-cache`, as required by the fetch standard. An endpoint that returns `304 Not Modified` based on those headers may return `200` to such a request.
+
+  New capabilities:
+
+  - The `timeout` option (in milliseconds) and the standard `signal` (`AbortSignal`) and undici `dispatcher` options are supported.
+  - A request `body` may be a native `FormData`, in addition to a `form-data` package instance.
+
+- Bumped `glob` to `^13` (core) and `rimraf` to `^6` (uploadfs) to clear the deprecated `glob@10` warning shown on every install. The old `glob@10` arrived both directly from core and transitively through `uploadfs` → `rimraf@5`; both now resolve to the current, supported `glob@13` (`rimraf@6` depends on `glob@13` as well). No API or behavior changes.
+
+### Fixes
+
+- Fixed the tag popover in the media library (used to apply tags to images in bulk) so it loads all image tags instead of only the first 50. Tags beyond the first 50 can now be found and applied, and creating a tag whose name already exists no longer produces a duplicate.
+- The lock file dependency check that forces a full rebuild now runs once per process. Watcher-triggered rebuilds stay scoped to the detected changes instead of rebuilding everything on every file change when the lock file changed or is absent. This bug was in effect only for projects missing a lock file in their `npmRoot` (e.g. npm monorepos).
+- Fixed the admin UI sometimes serving a stale build after dependencies changed (for example after `npm install` or `npm update`). Apostrophe now detects dependency changes from the content of the lock file rather than its modified time, which could be misleading after a fresh checkout or a restored CI/Docker build cache.
+
+  For external build module authors: lock file change detection now happens in the core and is passed to the build module via the `lockChanged` build option. The `apos.asset.getSystemLastChangeMs()` helper is deprecated and the build manifest no longer includes a `ts` timestamp.
+
+- Fixed pressing Backspace right after typing `/` in a rich text widget deleting the entire widget. Backspace now removes the slash and closes the insert menu. Global command menu shortcuts also no longer fire for key events already handled and prevented by other UI components.
+- Fix invalid HTML output for <col> elements in sanitize-html (treat void elements correctly)
+- Fixed a layout issue where `dateAndTime` schema fields could overflow and trigger horizontal scrolling in narrow containers.
+- fromRichText adds metatype to new widget
+- Fixed the widget copy shortcut (Ctrl+C / Cmd+C) hijacking native text copy in edit mode. With an active text selection, the cut, copy and remove (Backspace) widget shortcuts now defer to the browser. Pasting a widget with Ctrl+V / Cmd+V now checks that the widget copy is still the most recent thing in the system clipboard, so text copied elsewhere in the meantime is no longer shadowed by a stale widget paste. The widget clipboard storage remains backward compatible with entries written by previous releases.
+- Batch jobs now reliably record their total item count, so completion notifications no longer occasionally report a null total.
+
+### Security
+
+- Completed the fix for CVE-2026-39857 (GHSA-xmpp-f9v3-r7qh). The `.choices()` / `.counts()` query builders (`?choices=` / `?counts=` on the public REST API) guarded against leaking distinct values of fields excluded from `publicApiProjection` by resolving the schema field with an exact-name match. A relationship field registers extra query builders whose names differ from the field name — the "slug" alias builders that drop the leading underscore (`author` / `authorAnd` for a field named `_author`) and the `_authorAnd` operation builder — so those aliases were not gated and could still be used by an unauthenticated caller to extract the relationship's distinct choices (the referenced, publicly visible related documents by title/slug, plus per-value counts via `?counts=`) for a relationship an operator intentionally excluded from `publicApiProjection`. Relationship alias builders are now resolved back to their underlying schema field (matching the field name or its `idsStorage`) before the `publicApiProjection` and `viewPermission` checks are applied, so the alias names are gated exactly like the field itself. Thanks to Ta Duc Thien ([thientd](https://github.com/thientd)) for reporting this issue.
+- Restored destination-parent authorization in the page `move()` operation (GHSA-wr5r-wqp2-x4fh). A regression had gated the destination "create" permission check on the source page being restored out of the archive, which silently disabled that check for every ordinary move. As a result a low-privileged but content-editing user (for example an editor) who could edit at least one page could relocate that page under a parent of a restricted page type they have no create/edit rights over (such as one declaring a higher `editRole`/`publishRole`), and in doing so trigger an unchecked re-ranking of the restricted parent's existing children. A cross-parent move into a non-archive destination now again requires "create" permission on the destination, with the archive-restore path handled as an explicit exception. Thanks to 5ud0 / Tarmo Technologies for reporting the issue.
+- Bumped the `nodemailer` dependency from 8.x to 9.x to pick up the fix for GHSA-p6gq-j5cr-w38f, where a message's `raw` option could bypass nodemailer's `disableFileAccess`/`disableUrlAccess` controls and enable arbitrary file reads or SSRF. The real-world risk to Apostrophe is low: core only sends mail from trusted server-side code (such as password-reset emails), never sets those controls, and gives site visitors no way to control a message's `raw` field. nodemailer 9 is a security-only major release with one behavior change worth noting for projects: outbound HTTPS used to fetch remote content (remote-URL attachments, OAuth2 token endpoints, HTTP/HTTPS proxies) now validates TLS certificates by default — if you depend on self-signed or otherwise invalid certificates, opt out per request with `tls.rejectUnauthorized: false`. As a precaution, make sure your own project code never forwards untrusted input into the `raw` field of a module's `email()` call.
+
 ## 4.31.0 (2026-06-10)
 
 ### Adds
@@ -12,7 +59,7 @@
 ### Fixes
 
 - Fixed an issue where using the Tab key to navigate within modals could incorrectly jump focus to a wrong element instead of the next input field.
-Fixed Tab navigation escaping out of modals when the form contained hidden sections or elements that became disabled after editing.
+  Fixed Tab navigation escaping out of modals when the form contained hidden sections or elements that became disabled after editing.
 - Fixed adding or removing an area field from a schema breaking existing documents on an external front such as Astro.
 - For Astro: `AposArea` now renders only schema-backed areas. A missing area no longer throws, and an area orphaned by removing its field from the schema (while its content remains in the document) renders nothing instead of breaking sibling areas in edit mode. Logged-in editors get a diagnostic message in place of an orphaned area; anonymous visitors see nothing.
 - Editable documents sent to an external front (Asgtro) now materialize empty area objects for schema area fields added after the document was created, so they can be edited in context.
 
@@ -1,6 +1,6 @@
 {
   "name": "apostrophe",
-  "version": "4.31.0",
+  "version": "4.32.0",
   "description": "The Apostrophe Content Management System.",
   "main": "index.js",
   "scripts": {
 
@@ -1,5 +1,11 @@
 # create-apostrophe
 
+## 1.1.0 (2026-07-10)
+
+### Fixes
+
+- Fixed `npm create apostrophe` with the SQLite database option under npm v12 (and when run from a global `@apostrophecms/cli` install). The installer now performs its post-install database work using the newly generated project's own `better-sqlite3`, rather than the installer's bundled copy.
+
 ## 1.0.1 (2026-06-10)
 
 ### Fixes
 
@@ -1,6 +1,6 @@
 {
   "name": "create-apostrophe",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Guided installer for ApostropheCMS — npm create apostrophe@latest",
   "type": "module",
   "engines": {
 
@@ -1,45 +1,51 @@
 # CHANGELOG
 
+## 1.0.7 (2026-07-10)
+
+### Fixes
+
+- Patching the `mongodb-legacy` classes is now idempotent. When two copies of this package are loaded against the same `mongodb-legacy` instance (for example, a version or source skew between a direct and a transitive dependency), the second copy no longer throws `TypeError: Cannot redefine property: Symbol(@@mdb.callbacks.toEmulate)`. The emulation method is defined only once and is now `configurable`, so any mix of patched and unpatched copies can load in either order without error.
+
 ## 1.0.6 (2024-07-19)
 
 ### Changes
 
-* Reset sort when using `find-cursor.count` due to internal code using projection with `{ _id: 1 }`.
+- Reset sort when using `find-cursor.count` due to internal code using projection with `{ _id: 1 }`.
 
 ## 1.0.5 (2024-07-09)
 
 ### Add
 
-* Add integration test for `collection.count`, `find-cursor.count` and `find-cursor.sort`.
-* Add support for the `mongodb@6.8.0` driver and up.
+- Add integration test for `collection.count`, `find-cursor.count` and `find-cursor.sort`.
+- Add support for the `mongodb@6.8.0` driver and up.
 
 ### Changes
 
-* Use a projection to count documents.
+- Use a projection to count documents.
 
 ## 1.0.4 (2024-07-04)
 
 ### Fix
 
-* Update package-lock.json to reflect package.json content.
+- Update package-lock.json to reflect package.json content.
 
 ## 1.0.3 (2024-06-28)
 
 ### Fix
 
-* Lock to `mongodb@6.7.0` to prevent issues with `cursor.count` not using the current query filter.
+- Lock to `mongodb@6.7.0` to prevent issues with `cursor.count` not using the current query filter.
 
 ## 1.0.2
 
 ### Fix
 
-* Discard connection options not permitted or required by newer MongoDB drivers. Important for `emulate-mongo-2-driver` which depends on this module.
+- Discard connection options not permitted or required by newer MongoDB drivers. Important for `emulate-mongo-2-driver` which depends on this module.
 
 ## 1.0.1
 
 ### Fix
 
-* Allow `FindCursor.sort` with `false` as sort key.
+- Allow `FindCursor.sort` with `false` as sort key.
 
 ## 1.0.0
 
 
@@ -1,6 +1,6 @@
 {
   "name": "@apostrophecms/emulate-mongo-3-driver",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Emulate the Mongo 3.x nodejs driver on top of the Mongo 6.x nodejs driver, for bc",
   "main": "index.js",
   "scripts": {
 
@@ -0,0 +1,7 @@
+# @apostrophecms/font-size
+
+## 1.0.0 (2026-07-10)
+
+### Adds
+
+- Initial release.
@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.5.4 (2026-07-10)
+
+### Security
+
+- File attachments are no longer stored before a form submission passes validation (GHSA-rgg4-476q-xgcg). Previously, when a submission was rejected — for example due to a failed reCAPTCHA challenge or a missing required field — any uploaded files had already been written as publicly accessible attachments, and those orphaned records were never reclaimed by garbage collection. Submissions are now rejected before any files are stored, and any attachments created while processing a submission that is ultimately rejected are removed. Thanks to [H3xV0rT3x](https://github.com/H3xV0rT3x) for reporting this issue.
+
 ## 1.5.3 (2026-02-18)
 
 ### Adds
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@apostrophecms/apostrophe-astro",`
`3`		`- "version": "1.13.0",`
	`3`	`+ "version": "1.14.0",`
`4`	`4`	`"type": "module",`
`5`	`5`	`"description": "Apostrophe integration for Astro",`
`6`	`6`	`"repository": {`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "apostrophe",`
`3`		`- "version": "4.31.0",`
	`3`	`+ "version": "4.32.0",`
`4`	`4`	`"description": "The Apostrophe Content Management System.",`
`5`	`5`	`"main": "index.js",`
`6`	`6`	`"scripts": {`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "create-apostrophe",`
`3`		`- "version": "1.0.1",`
	`3`	`+ "version": "1.1.0",`
`4`	`4`	`"description": "Guided installer for ApostropheCMS — npm create apostrophe@latest",`
`5`	`5`	`"type": "module",`
`6`	`6`	`"engines": {`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@apostrophecms/emulate-mongo-3-driver",`
`3`		`- "version": "1.0.6",`
	`3`	`+ "version": "1.0.7",`
`4`	`4`	`"description": "Emulate the Mongo 3.x nodejs driver on top of the Mongo 6.x nodejs driver, for bc",`
`5`	`5`	`"main": "index.js",`
`6`	`6`	`"scripts": {`