Merge branch 'main' into import-export-noise

Author: myovchev

.changeset/a11y-admin-nav.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": patch
+---
+
+Accessibility: corrected ARIA semantics on the top admin navigation bar. 

.changeset/a11y-context-title.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": patch
+---
+
+Accessibility: improvements to the document context title (admin bar middle group) and the underlying `AposContextMenu` machinery.

.changeset/a11y-locale-switcher.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": patch
+---
+
+Accessibility: improve the locale switcher (`AposLocalePicker`).

.changeset/a11y-recently-edited-icon.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": patch
+---
+
+Accessibility: the Recently Edited Documents tray icon (admin bar) now exposes its action through `aria-label`.

.changeset/a11y-sr-only.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": patch
+---
+
+Accessibility: fix `.apos-sr-only` so screen-reader-only content is exposed to the accessibility tree.

.changeset/a11y-tray-aria.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": patch
+---
+
+Accessibility: icon-only context-utility buttons in the admin bar tray (e.g. the global settings cog) now expose their action through `aria-label`.

.changeset/cozy-wombats-burn.md

@@ -2,4 +2,4 @@
 "@apostrophecms/cli": patch
 ---
 
-Bump and clean up depdendencies.
+Security: bump and clean up dependencies. This closes vulnerabilities in `uuid` and `fast-xml-parser` although they were not used in a sensitive or vulnerable way within ApostropheCMS. This also closes a vulnerability in `shelljs` which ould only be exploited if the developer could be convinced to enter malicious commands as part of their CLI input.

.changeset/fifty-hornets-follow.md

@@ -1,7 +1,7 @@
 ---
-"apostrophe": minor
+"apostrophe": patch
 ---
 
 - Removed duplicate <meta charset> tag from `outerLayoutBase.html`
-- Standardized charset to utf-8 (removed legacy configuration option)
-- Altered unused/legacy i18n template helper to return `utf-8` (BC)
+- Standardized charset to utf-8 (the legacy configuration option is now ignored). Per the spec this is the only legal setting, so we classify this as a bug fix
+- Altered unused/legacy i18n template helper to return `utf-8`, ensuring backwards compatibility

.changeset/seven-emus-vanish.md

@@ -0,0 +1,6 @@
+---
+"@apostrophecms/apostrophe-astro": minor
+"apostrophe": minor
+---
+
+Editors can now control the layout-widget gap through the styles system, both site-wide via a global `layoutGap` preset and per widget via a `gap` styles field. New Layout widget option `className` allows for additional CSS class names to be added to the widget Grid container.

.changeset/wild-forks-fetch.md

@@ -0,0 +1,15 @@
+---
+"apostrophe": patch
+---
+
+apostrophe and oembetter have been updated to eliminate a number of services that formerly supported
+oembed for the general public, but no longer do so. While there is no security risk today, removing
+these ensures that if these domains are ever allowed to lapse, they do not become an XSS
+attack vector in the future.
+
+Because oembed responses are not always iframes, it is important that this list be maintained
+over time. In addition, developers always have the option to prune it on their own by setting
+the new minimumAllowlist and minimumEndpoints options of the @apostrophecms/oembed module.
+
+Thanks to [Sainithin0309](https://github.com/Sainithin0309) for pointing out the potential
+long-term security concern.