-
You are here:
- Home
- Downloads
- Joomla! Core
- Joomla 5 Full Package
Description
Joomla 5 is the previous major CMS series, with versions released starting in October 2023. Official support for the series is planned until October 2027. The full package is designed for a new Joomla 5 installation and contains all the necessary files for site deployment. For new sites, we recommend using the latest stable version of the current major Joomla 6 series, and installing Joomla 5 if compatibility with existing extensions or environments is required.
Changelog
| Security |
[20260801] Fixed response header injection in download views.
|
| Security |
[20260802] Fixed improper CORS origin validation.
|
| Security |
[20260803] Fixed inconsistent ACL checks for mutating web service endpoints.
|
| Security |
[20260804] Fixed improper ACL checks for custom fields web service endpoints.
|
| Security |
[20260805] Fixed improper ACL checks for category web service endpoints.
|
| Security |
[20260806] Fixed an XSS vulnerability in Schema.org output.
|
| Security |
[20260807] Fixed a multi-factor authentication (MFA) bypass vulnerability.
|
| Security |
[20260808] Fixed improper ACL checks for batch copy actions.
|
| Security |
[20260809] Fixed improper ACL checks when injecting Schema.org contact data.
|
| Security |
[20260810] Prevented unrestricted uploads of SHTML files.
|
| Fixed |
#46805 — Added an ACL check when displaying the link to the user edit form.
|
| Fixed |
#47202 — Fixed menu item editing redirecting to the list view without preserving the original filters.
|
| Fixed |
#47626 — Implemented date and time validation when input values are changed.
|
| Fixed |
#47766 — Improved error messages for update server errors.
|
| Fixed |
#47780 — Corrected the data-nested attribute for nested components, including categories, menu items and modules.
|
| Fixed |
#47886 — Fixed Global Check-in treating rows with checked_out=0 as requiring check-in.
|
| Fixed |
#48060 — Fixed article-specific options being ignored in the article view.
|
| Fixed |
#48074 — Prevented a DivisionByZeroError in ListModel when list.limit is set to 0.
|
| Fixed |
#48080 — Updated joomla/filesystem from version 3.2.0 to 3.3.0 and partially backported the update upload fix from the Joomla 6.1 branch.
|
| Fixed |
#48088 — Fixed the duplicate “No results” message in the list of installed languages.
|
| Fixed |
#48091 — The Action Log plugin now creates only one entry when blocking or unblocking a user.
|
| Fixed |
#48116 — Cleaned up FilePatcher remnants left by the Joomla 5.4.7 core update hotfix.
|
| Fixed |
#48163 — Fixed a division-by-zero error in subforms.
|
| Fixed |
#48171 — Added path traversal checks to the Templates component.
|
| Fixed |
#48173 — Standardized the memory_table_limit option in Smart Search.
|
| Fixed |
#48184 — Fixed a typo in the Awesomplete example.
|
| Fixed |
#48185 — Fixed indentation in the tree selection field.
|
| Fixed |
#48212 — Fixed normalization of the days_of_week parameter.
|
| Fixed |
#48216 — Fixed the Site Offline functionality.
|
| Fixed |
#48247 — Reverted an invalid path check change in the Templates component.
|
| Note |
Joomla 5.4.8 is a security and bugfix release.
|
| Note |
Installing Joomla 5.4.8 as soon as possible is strongly recommended.
|
| Note |
Joomla 5.4.8 was released together with Joomla 6.1.3.
|
| Note |
Creating a website backup and checking the compatibility of installed extensions and templates is recommended before updating.
|
| Security |
[20260701] Fixed incorrect access control in com_media web service endpoints.
|
| Security |
[20260702] Fixed incorrect access control when downloading VCF files from com_contact.
|
| Security |
[20260703] Fixed an XSS vulnerability in MFA method management.
|
| Security |
[20260704] Fixed an XSS vulnerability in com_templates.
|
| Security |
[20260705] Fixed XSS vulnerabilities in various modalreturn layouts.
|
| Security |
[20260706] Fixed an XSS vulnerability in com_installer.
|
| Security |
[20260707] Fixed an XSS vulnerability in the generic image output layout.
|
| Security |
[20260708] Fixed an XSS vulnerability involving language overrides.
|
| Security |
[20260709] Fixed incorrect access control in com_workflow.
|
| Security |
[20260710] Fixed incorrect access control in com_modules.
|
| Security |
[20260711] Fixed incorrect access control in com_privacy web service endpoints.
|
| Security |
[20260712] Fixed incorrect access control in com_fields web service endpoints.
|
| Fixed |
#47836 — Updated the phpstan-baseline.neon file.
|
| Fixed |
#47203 — Added support for updating extensions from the command-line interface.
|
| Fixed |
#47603 — Mail templates are now loaded using the language assigned to the template.
|
| Fixed |
#47734 — The installer no longer proceeds to database setup when the password contains leading or trailing spaces.
|
| Fixed |
#47837 — Added a system test for the Media Manager search path traversal issue.
|
| Fixed |
#47748 — Added support for creating a user access level through a POST web service request.
|
| Fixed |
#47752 — Fixed author display when using article-specific settings.
|
| Fixed |
#47771 — Updated NPM dependencies.
|
| Fixed |
#47774 — Front-end filters are now activated only when the filter button is available.
|
| Fixed |
#47800 — Preserved the text of the zero-value option in selection fields.
|
| Fixed |
#47825 — Updated the Typos GitHub Action to version 1.46.3.
|
| Fixed |
#47827 — Updated the actions-setup-mysql GitHub Action to version 1.51.0.
|
| Fixed |
#47852 — Fixed a regression introduced by the security fix in Joomla 5.4.6 and 6.1.1.
|
| Fixed |
#47855 — Fixed modal pagination breaking navigation.
|
| Fixed |
#47751 — Added support for updating a user access level without supplying rules through a PATCH request.
|
| Fixed |
#47847 — Updated symfony/yaml to version 6.4.41 to fix three security vulnerabilities.
|
| Fixed |
#47830 — Updated the github-script GitHub Action to version 9.0.0.
|
| Fixed |
#47826 — Updated the setup-php GitHub Action to version 2.37.1.
|
| Fixed |
#47882 — FIDO metadata is now cached in the build directory and preserved during builds.
|
| Fixed |
#47865 — Fixed the Joomla success alert.
|
| Fixed |
#47637 — The manifest path is now compiled from the extension root directory.
|
| Fixed |
#47895 — Added FIDO, Composer and NPM caching to the Drone configuration.
|
| Fixed |
#47548 — Fixed CodeMirror editor duplication.
|
| Fixed |
#47483 — Fixed the aria-expanded attribute check.
|
| Fixed |
#47869 — Added an email-sending test for the contact form.
|
| Fixed |
#47896 — Reordered and updated Text::script() calls for media field labels.
|
| Fixed |
#47917 — Reordered and updated Text::script() calls in the Joomla Update component.
|
| Fixed |
#47931 — Fixed the documentation block for the input type.
|
| Fixed |
#47819 — Fixed submitting the com_contact form through web services when custom reply is enabled.
|
| Fixed |
#47964 — A new installer instance is now always used when installing discovered extensions.
|
| Fixed |
#47978 — Fixed a potential issue when updating multiple extensions.
|
| Fixed |
#47985 — Cookie authentication now loads the language file so that log messages can be translated.
|
| Fixed |
#47986 — Fixed the username placeholder in failed cookie-login log messages.
|
| Fixed |
#47972 — The correct function is now used to retrieve a message from an exception.
|
| Fixed |
#47916 — Fixed the Indexer Debugger constructor and added an error message when no ID or an invalid ID is supplied.
|
| Fixed |
#44914 — Fixed the contact and news feed serializers.
|
| Fixed |
#47818 — Added integration tests for the config:get CLI command.
|
| Fixed |
#47993 — Fixed filtering by unactivated user status in com_users.
|
| Fixed |
#47763 — Added a system test for the Scheduled Tasks console command.
|
| Fixed |
#47951 — The “Running Since” tooltip on the Scheduled Tasks page now uses the locked property instead of last_execution.
|
| Fixed |
#48018 — Updated Composer dependencies.
|
| Fixed |
#48024 — Updated NPM dependencies.
|
| Fixed |
#47936 — Added code style fixes and updated the PHPStan configuration.
|
| Note |
Joomla 5.4.7 is a security and bugfix release.
|
| Note |
Installing Joomla 5.4.7 as soon as possible is strongly recommended.
|
| Note |
Joomla 5.4.7 was released together with Joomla 6.1.2.
|
| Note |
Joomla 5.4.7 has a known issue where article-specific parameters may be ignored when an article is displayed through a category layout or a single-article menu item.
|
| Note |
An installable Joomla_5_4_7_and_6_1_2_ArticleModel_Hotfix1.zip package was released as a temporary fix.
|
| Note |
The permanent fix for the known issue was included in Joomla 5.4.8.
|
| Note |
Creating a website backup and checking the compatibility of installed extensions and templates is recommended before updating.
|
| Security |
[20260501] Fixed an XSS vulnerability in feed modules.
|
| Security |
[20260502] Fixed an XSS vulnerability in com_associations.
|
| Security |
[20260503] Fixed an XSS vulnerability in com_contenthistory.
|
| Security |
[20260504] Fixed an XSS vulnerability in Read More links.
|
| Security |
[20260505] Fixed a CSRF vulnerability in the user activation endpoint.
|
| Security |
[20260506] Fixed an authenticated blind SQL injection vulnerability in com_finder.
|
| Security |
[20260507] Fixed an authenticated blind SQL injection vulnerability in com_tags.
|
| Security |
[20260508] Fixed an improper access check in com_config web service endpoints.
|
| Security |
[20260509] Fixed a local file inclusion vulnerability in the HTMLView layout parameter.
|
| Security |
[20260510] Fixed a path traversal vulnerability in a com_media web service endpoint.
|
| Security |
[20260511] Fixed an MFA authentication bypass vulnerability.
|
| Security |
[20260512] Fixed an additional MFA authentication bypass vulnerability.
|
| Security |
[20260513] Fixed privilege escalation through the com_users batch task.
|
| Security |
[20260514] Fixed privilege escalation through com_users web service endpoints.
|
| Security |
[20260515] Fixed incorrect access control in sample data plugins.
|
| Security |
[20260516] Fixed incorrect access control in com_scheduler.
|
| Security |
[20260517] Fixed incorrect cache key construction for InputFilter objects.
|
| Security |
[20260518] Prevented transport encryption downgrade for username and password reset links.
|
| Security |
[20260519] Improved content filtering in the Joomla Framework checkAttribute filter code.
|
| Security |
[20260520] Improved content filtering in the Joomla Framework cleanAttributes filter code.
|
| Fixed |
#47565 — Fixed the handling of attachments supplied as a list of objects.
|
| Fixed |
#47413 — Prevented a misleading save failure message when a mail notification fails.
|
| Fixed |
#47423 — Improved substring searching in Fancy Select fields.
|
| Fixed |
#47624 — Updated branch documentation following the stable release of Joomla 6.1.0.
|
| Fixed |
#47590 — Fixed deletion of the update archive after an automatic Joomla core update.
|
| Fixed |
#47644 — Added a missing table column header to improve accessibility.
|
| Fixed |
#47650 — Fixed RTL toolbar dropdown alignment in the administrator interface.
|
| Fixed |
#47604 — Fixed HTML tag replacement when converting an HTML email body to plain text.
|
| Fixed |
#47642 — Corrected aria-posinset values so that they start from 1.
|
| Fixed |
#47616 — Added a translation format so that the last automatic update check time is displayed correctly.
|
| Fixed |
#47653 — Improved the accessibility of language installation information.
|
| Fixed |
#47697 — Moved mod_menu language loading until after client_id resolution in ItemsModel.
|
| Fixed |
#47586 — Fixed category custom fields loading.
|
| Fixed |
#47729 — Fixed the notification dismiss button in light mode.
|
| Fixed |
#47731 — Child template name validation now checks only templates of the appropriate type.
|
| Fixed |
#47533 — Fixed an ECB mode validation typo in the OpenSSL AES adapter and updated the related documentation.
|
| Fixed |
#46886 — Added a system test for filtering published and unpublished articles.
|
| Fixed |
#47555 — Added a system test for the cache cleaning console command.
|
| Fixed |
#47556 — Added a system test for the Scheduled Tasks console command.
|
| Fixed |
#47712 — Added system tests for custom fields in articles.
|
| Fixed |
#47254 — Updated phpMyAdmin in Codespaces to the latest version.
|
| Fixed |
#47476 — Added the missing page parameter to the content event arguments in the Articles module.
|
| Fixed |
#47480 — Fixed an incorrect bind parameter key in the Category HTML helper.
|
| Fixed |
#45145 — Fixed an incorrect error being displayed when renaming a file.
|
| Fixed |
#47307 — Fixed an accessibility issue with the Back-to-Top link.
|
| Fixed |
#47401 — Removed an unused web asset reference.
|
| Fixed |
#47735 — Fixed article version preview for users with Author permissions.
|
| Fixed |
#47610 — Added integration tests for listing extensions by type.
|
| Note |
Joomla 5.4.6 is a security and bugfix release.
|
| Note |
Installing Joomla 5.4.6 as soon as possible is strongly recommended.
|
| Note |
Joomla 5.4.6 was released together with Joomla 6.1.1.
|
| Note |
Creating a website backup and checking the compatibility of installed extensions and templates is recommended before updating.
|
| Note |
When upgrading from a version earlier than Joomla 4.4, update to Joomla 4.4 first and then upgrade to Joomla 5.
|
| Fixed |
#47474 — Fixed the ShowOnRule regular expression pattern for custom fields.
|
| Fixed |
#47520 — Updated the version number in the allowEdit method documentation.
|
| Fixed |
#47523 — The full path for $this is now used in the association template file.
|
| Fixed |
#47433 — Fixed double timezone conversion in Media Manager file dates.
|
| Fixed |
#47448 — Added a logical top corner radius for consistent RTL and LTR display.
|
| Fixed |
#47462 — Fixed the image rotation angle being reset to 0 in Media Manager.
|
| Fixed |
#47467 — Added onContentPrepare event processing to the mod_articles module.
|
| Fixed |
#47478 — TinyMCE now loads the non-minified custom CSS file when a minified version is unavailable.
|
| Fixed |
#47505 — Fixed highlighting of the required modal category field after a validation error.
|
| Fixed |
#47529 — Updated phpseclib/phpseclib to version 3.0.50 to fix one high-severity security vulnerability.
|
| Fixed |
#47530 — Updated indirect NPM dependencies to fix eight security vulnerabilities.
|
| Fixed |
#47511 — Added a warning when duplicate subform fields are removed during saving.
|
| Fixed |
#47540 — Corrected the English possessive form of the word users in a language string.
|
| Fixed |
#47208 — Prevented recursion in the loadposition and loadmodule content plugin.
|
| Fixed |
#47534 — Updated the indirect lodash development dependency to version 4.18.1.
|
| Note |
Joomla 5.4.5 is a bugfix release for the Joomla 5 series.
|
| Note |
No separate Joomla core security fixes were announced for this release.
|
| Note |
The update includes a fix for one high-severity vulnerability in the phpseclib library.
|
| Note |
The update also resolves eight security vulnerabilities in indirect NPM dependencies.
|
| Note |
Creating a website backup and checking the compatibility of installed extensions and templates is recommended before updating.
|
| Note |
When upgrading from a version earlier than Joomla 4.4, update to Joomla 4.4 first and then upgrade to Joomla 5.
|
| Security |
[20260301] Hardened ACL checks in com_ajax.
|
| Security |
[20260302] Fixed an SQL injection vulnerability in the com_content articles web service endpoint.
|
| Security |
[20260303] Fixed an XSS vulnerability in the com_associations comparison view.
|
| Security |
[20260304] Fixed XSS vulnerabilities in various article title outputs.
|
| Security |
[20260305] Fixed an arbitrary file deletion vulnerability in com_joomlaupdate.
|
| Security |
[20260306] Fixed improper access checks in web service endpoints.
|
| Fixed |
#46866 — Updated the deployment version information.
|
| Fixed |
#46857 — Reduced exclusions in phpstan-baseline.neon.
|
| Fixed |
#46811 — Fixed date highlighting in the front-end calendar.
|
| Fixed |
#46905 — Updated the browserlist:update script.
|
| Fixed |
#46889 — Fixed TinyMCE initialization in Firefox Developer Edition.
|
| Fixed |
#46719 — Fixed the content data-transitions attribute being inherited from the first allowed item.
|
| Fixed |
#46835 — Updated the Pull Request template to link related issues automatically.
|
| Fixed |
#46910 — Fixed calendar display for right-to-left languages.
|
| Fixed |
#46917 — Added the artificial intelligence policy to the Pull Request template.
|
| Fixed |
#46906 — Updated Browserlist data.
|
| Fixed |
#46881 — Added publishing status checks when retrieving banner items.
|
| Fixed |
#46929 — Exposed the update filename during the automatic update preparation step.
|
| Fixed |
#47235 — Removed a duplicate empty line from README.md.
|
| Fixed |
#47226 — Fixed the selected checkmark background in Choices.js fields.
|
| Fixed |
#47253 — Added a workflow for automatically marking conflicting Pull Requests.
|
| Fixed |
#47265 — Disabled the blank GitHub issue template.
|
| Fixed |
#47286 — Fixed a comment typo in merge-conflicts.yml.
|
| Fixed |
#47258 — Updated the deleted files and folders list in script.php for the Joomla 5.4.4 release.
|
| Fixed |
#47293 — Added new Joomla versions to CONTRIBUTING.md.
|
| Fixed |
#47268 — Fixed flashing icons in the administrator sidebar.
|
| Fixed |
#47218 — Fixed duplicate article counts caused by many-to-many relationships in mod_tags_popular.
|
| Fixed |
#47263 — Fixed conditional Read More link output in mod_articles.
|
| Fixed |
#47244 — Fixed padding in Choices.js selection fields.
|
| Fixed |
#47321 — Updated NPM development dependencies to fix nine security vulnerabilities.
|
| Fixed |
#47217 — Fixed Scheduled Tasks stopping when one task becomes stuck.
|
| Fixed |
#47336 — Added a check to verify that the schema path specified in the manifest exists.
|
| Fixed |
#47352 — Selector filters are now reset when SearchTools filters are cleared.
|
| Fixed |
#46933 — Fixed undefined array key warnings in workflow permissions.
|
| Fixed |
#47274 — Fixed the Joomla version being omitted from nightly build notifications.
|
| Fixed |
#47390 — Nightly build commands now use the DRONE_BRANCH variable instead of MINORVERSION.
|
| Fixed |
#47397 — Corrected quotation mark escaping in nightly build notifications.
|
| Fixed |
#47399 — Fixed nightly build notifications by using single quotes and string concatenation.
|
| Fixed |
#47376 — Fixed MailHelper::isEmailAddress() throwing an exception for forbidden characters.
|
| Fixed |
#47388 — The Versions button is now hidden when com_contenthistory is disabled.
|
| Fixed |
#47406 — Updated the indirect flatted NPM dependency to fix a high-severity security vulnerability.
|
| Fixed |
#47251 — Fixed relative asset paths on the Cassiopeia error page.
|
| Fixed |
#47411 — Updated the GitHub feature request issue template.
|
| Fixed |
#47422 — Updated GitHub Actions and dropped Node.js 20.
|
| Fixed |
#47427 — The media edit button is now disabled when no media action plugins are enabled.
|
| Note |
Joomla 5.4.4 is a security and bugfix release.
|
| Note |
Installing Joomla 5.4.4 as soon as possible is strongly recommended.
|
| Note |
Joomla 5.4.4 was released together with Joomla 6.0.4.
|
| Note |
Creating a website backup and checking the compatibility of installed extensions and templates is recommended before updating.
|
| Note |
When upgrading from a version earlier than Joomla 4.4, update to Joomla 4.4 first and then upgrade to Joomla 5.
|
| Fixed |
Fixed a typo in a code comment.
|
| Fixed |
Fixed a warning in tag links without an Itemid.
|
| Fixed |
Anchor references are now skipped by the CSS versioning build script.
|
| Fixed |
Fixed the breadcrumbs module duplicating the Home link on multilingual websites.
|
| Fixed |
Hidden the help link in the administrator menu.
|
| Fixed |
Updated the Joomla Framework HTTP package.
|
| Fixed |
The image class now accepts user input.
|
| Fixed |
Fixed the CLI installation exit code when the PHP version requirement is not met.
|
| Fixed |
Added a legacy label to the archived articles module.
|
| Fixed |
Fixed a 500 error in Smart Search with specific search queries.
|
| Fixed |
Tightened the regular expression used to find menu items and prevent duplicate edit link icons.
|
| Fixed |
Changed the XML user group list field type to the lowercase usergrouplist format.
|
| Fixed |
Fixed missing parent menu items when creating a menu item through the Save to Menu feature.
|
| Fixed |
Updated paragonie/sodium_compat to version 1.24.0 to resolve Composer Audit warnings.
|
| Fixed |
Updated development dependencies to resolve security vulnerabilities reported by NPM Audit.
|
| Fixed |
Fixed a typo in a code comment.
|
| Fixed |
Removed the layouts folder and added presets.
|
| Fixed |
Further fixed missing parent menu items when creating a menu item through the Save to Menu feature.
|
| Fixed |
Fixed OptionsRule validation to support groupedlist fields.
|
| Fixed |
Fixed letter casing in the mod_articles manifest.
|
| Fixed |
Reverted previous mailer improvements.
|
| Fixed |
Fixed a Metis Menu error that occurred when clicking outside a dropdown menu.
|
| Fixed |
Updated algo26-matthias/idna-convert to version 3.2.1.
|
| Fixed |
Improved the archive-not-found error message.
|
| Fixed |
The website root URL is now prepended to schema image paths.
|
| Fixed |
Fixed the extension variable type in AssociationExtensionHelper.
|
| Fixed |
Added cache cleaning after a pull request is merged.
|
| Fixed |
Fixed the web services response when requesting a non-existing user access level.
|
| Fixed |
Fixed the PHP 8.5 deprecation warning caused by passing null as the key to array_key_exists().
|
| Fixed |
Selected rows in the debug profile timeline are now outlined.
|
| Fixed |
Fixed image handling in the articles module.
|
| Fixed |
Fixed button styling in alert messages.
|
| Fixed |
Fixed ZIP archive handling in the Templates component.
|
| Fixed |
Updated development dependencies to resolve low- and moderate-severity NPM vulnerabilities.
|
| Fixed |
The web services API now allows users to be updated through PATCH without specifying groups in the payload.
|
| Fixed |
Added an integration test for checking extension updates.
|
| Fixed |
Fixed the fonts URL.
|
| Fixed |
Fixed an undefined language array key warning in the SEF plugin.
|
| Fixed |
WebAssetRegistry now works with a renamed administrator folder.
|
| Fixed |
Improved the MySQL installation error message.
|
| Fixed |
Fixed untranslated text in the command-line interface.
|
| Fixed |
Updated the pull request template.
|
| Fixed |
The web services API now allows a Super User account to be updated through PATCH.
|
| Fixed |
Added missing name quotes and corrected the casing of a column alias in the Nested table class.
|
| Fixed |
Standardised the XML code style for Joomla.form.field definitions.
|
| Fixed |
Excluded Symfony HTTP client test folders from Joomla release packages.
|
| Fixed |
Updated three development dependencies to resolve Composer Audit warnings.
|
| Fixed |
Updated indirect development dependencies and resolved 19 NPM security vulnerabilities.
|
| Fixed |
Added unit tests for form rules.
|
| Fixed |
Fixed removal of the installation folder on Windows.
|
| Fixed |
Updated the list of deleted files and folders in script.php.
|
| Fixed |
Added a default value for check-in tasks.
|
| Fixed |
Fixed duplicate getLayoutData execution in the popular tags module.
|
| Fixed |
Added a missing-user check to the action log plugin to prevent PHP warnings.
|
| Fixed |
The table column script now checks whether the page title element exists.
|
| Fixed |
Fixed a Calendar field crash caused by an invalid date format.
|
| Fixed |
Reverted the change that allowed user access levels to be created through a POST web services request.
|
| Note |
Joomla 5.4.3 is a bug-fix release in the Joomla 5.4 series.
|
| Note |
Joomla 5.4.3 was released together with Joomla 6.0.3.
|
| Note |
No separate Joomla core security fixes were announced for this release.
|
| Note |
Several dependencies were updated to resolve audit warnings and security vulnerabilities.
|
| Note |
Firefox 148 has a known compatibility issue with TinyMCE that may cause flickering and endless content loading.
|
| Note |
An installable hotfix is available for the Firefox 148 and TinyMCE compatibility issue.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrading to Joomla 4.4 first is recommended.
|
| Security |
Fixed inadequate content filtering for data URLs that could allow XSS attacks through image tags.
|
| Security |
Fixed XSS vulnerabilities in the Page Break and Page Navigation plugins.
|
| Addition |
Added full support for PHP 8.5.
|
| Addition |
Added PHP 8.5 to unit and integration tests.
|
| Addition |
Added a pull request targeting section to the README file.
|
| Fixed |
Fixed the static getTemplate call in mail templates.
|
| Fixed |
Updated the use of the fputcsv function for PHP 8.4 compatibility.
|
| Fixed |
Fixed the PHP 8.5 version check.
|
| Fixed |
Removed the remaining deprecated JText calls.
|
| Fixed |
Fixed a 404 error in the web services component configuration route when a component name contains numbers.
|
| Fixed |
Aligned the Envelope-From and Return-Path headers with the sender address in MailTemplateFactory.
|
| Fixed |
Fixed the request format condition in MenusHelper that caused a deprecation warning.
|
| Fixed |
The success and message types are now correctly mapped to SymfonyStyle in ConsoleApplication.
|
| Fixed |
Removed the sidebar wrapper border and added a box shadow to the autumn dark-mode colour scheme.
|
| Fixed |
Updated indirect development dependencies to resolve security vulnerabilities reported by NPM Audit.
|
| Fixed |
Fixed Smart Search taxonomy filters being overwritten when multiple filters have identical titles.
|
| Fixed |
Articles are no longer loaded in the blog layout when article loading is disabled in the configuration.
|
| Fixed |
Fixed a regular expression in DocumentRenderer.php.
|
| Fixed |
The latest action logs module now loads the language files of the corresponding extensions.
|
| Fixed |
Fixed the snooze function in the Joomla end-of-support notification plugin.
|
| Fixed |
Fixed the MySQL 8 error caused by an illegal argument being passed to a regular expression in the banners model.
|
| Fixed |
Further updated indirect development dependencies to resolve NPM security vulnerabilities.
|
| Fixed |
Fixed scheduled-task notifications for Joomla installations updated from versions earlier than Joomla 5.3.
|
| Fixed |
Automatic update finalisation errors are now exposed in API responses.
|
| Fixed |
Removed an unnecessary setError call with an empty value.
|
| Fixed |
Updated development dependencies to resolve security vulnerabilities reported by NPM Audit.
|
| Fixed |
Removed the obsolete skin creator link from TinyMCE.
|
| Fixed |
Fixed the subform field dropdown incorrectly displaying the current field.
|
| Note |
Joomla 5.4.2 is a security and bug-fix release.
|
| Note |
Joomla 5.4.2 was released together with Joomla 6.0.2.
|
| Note |
CVE-2025-63082 has moderate severity and a low probability of exploitation.
|
| Note |
CVE-2025-63083 has moderate severity and a low probability of exploitation.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|
| Addition |
Added Mailpit email testing support to Codespaces.
|
| Addition |
Already selected elements in enhanced select lists are now marked with a checkmark.
|
| Addition |
Added MySQL to the test matrix with the appropriate minimum and maximum supported database versions.
|
| Fixed |
Fixed deprecated PHP 8.5 code.
|
| Fixed |
Resolved PHP 8.5 deprecation warnings.
|
| Fixed |
Fixed additional code deprecated in PHP 8.5.
|
| Fixed |
Fixed missing options in pagination.
|
| Fixed |
Fixed saving content history when using PostgreSQL.
|
| Fixed |
Removed the xml_parser_free() call deprecated in PHP 8.5.
|
| Fixed |
Removed the curl_close() call deprecated in PHP 8.5.
|
| Fixed |
Fixed InstallerScript using id instead of extension_id for the extensions table.
|
| Fixed |
Fixed the deprecated use of null as an array offset in PHP 8.5.
|
| Fixed |
Removed the use of deprecated setAccessible() methods on Reflection objects.
|
| Fixed |
Fixed the use of null as an array offset in unit tests.
|
| Fixed |
Updated joomla/http to version 3.1.3 to resolve the deprecated curl_close() call in PHP 8.5.
|
| Fixed |
Updated joomla/test to version 3.0.4 to resolve the deprecated Reflection setAccessible() call in PHP 8.5.
|
| Fixed |
Removed the imagedestroy() call deprecated in PHP 8.5.
|
| Fixed |
Fixed the privacy request message displayed when email delivery is disabled.
|
| Fixed |
Improved command-line error and help messages.
|
| Fixed |
Fixed the administrator colour scheme display.
|
| Fixed |
Fixed the log entry format.
|
| Fixed |
Underlined links to improve accessibility.
|
| Fixed |
Removed obsolete Joomla 4.4 GitHub Actions workflows and cleaned up contributing.md.
|
| Fixed |
Updated the list of deleted files in script.php.
|
| Fixed |
Fixed the scheduled update notification task.
|
| Fixed |
Fixed a Joomla installation error on Windows.
|
| Fixed |
Added a check to determine whether the state is initialised in the content CategoryModel.
|
| Fixed |
Fixed the return types of the application getDocument and getLanguage methods.
|
| Fixed |
Improved the pre-update check for Joomla 6.0.0 by correcting a confusing message and adding additional notices.
|
| Fixed |
A 401 Unauthorized response is now handled without causing an uncaught critical server error 500.
|
| Fixed |
Improved the PHP temporary folder message.
|
| Fixed |
Fixed article ordering in the articles module.
|
| Fixed |
Updated the mysql2 development dependency from version 2.3.3 to version 3.15.3.
|
| Fixed |
Fixed automatic cache clearing for the articles module.
|
| Fixed |
Replaced critical 404 and 406 errors with notices containing useful diagnostic information.
|
| Fixed |
The captive page and captive.validate task are now available even when a password reset is required.
|
| Fixed |
Updated NULL values in Smart Search links.
|
| Fixed |
Fixed XML SHA checksum verification for update servers.
|
| Fixed |
Fixed the untranslated JLIB_APPLICATION_ERROR language string.
|
| Fixed |
Fixed headers not being sent correctly by the Media component API controller.
|
| Fixed |
The SessionGC task now removes associated metadata from the database.
|
| Fixed |
Prevented modules from being rendered on error pages when the application is not completely initialised.
|
| Fixed |
Fixed issues in the language package installer.
|
| Fixed |
Fixed the Joomla version information.
|
| Fixed |
Profile information is no longer requested when no user is linked to the profile.
|
| Fixed |
Updated the repeatable-table.php layout.
|
| Fixed |
Fixed comment block formatting to comply with the code style.
|
| Fixed |
Updated indirect development dependencies to resolve security vulnerabilities reported by NPM Audit.
|
| Fixed |
Prevented notices from being generated when processing broken images.
|
| Fixed |
Smart Search filters no longer receive a unique title and alias when using Save as Copy.
|
| Note |
Joomla 5.4.1 is a bug-fix release in the Joomla 5.4 series.
|
| Note |
Joomla 5.4.1 was released on 25 November 2025 together with Joomla 6.0.1.
|
| Note |
No separate Joomla core security fixes were announced for this release.
|
| Note |
A significant part of this release improves compatibility with PHP 8.5.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|
| Addition |
Added automated Joomla core updates.
|
| Addition |
Added the Joomla automated update client.
|
| Addition |
Added automated update notifications and configuration information.
|
| Addition |
Added an automated update status icon to the administrator dashboard.
|
| Addition |
Added an option to disable automated updates during Joomla installation.
|
| Addition |
Added selection of user groups that receive automated update notifications.
|
| Addition |
Automated update notifications can now be sent to all Super Users.
|
| Addition |
Added plugin events for integration with the automated update system.
|
| Addition |
Added pre-update checks for Joomla 6 backward compatibility plugins.
|
| Addition |
Added and enabled the Joomla 6 backward compatibility plugin.
|
| Addition |
Added a link to the System Maintenance Database page from the pre-update check.
|
| Addition |
Added a link to Mail Templates from the update notification.
|
| Addition |
Added support for a custom registration link in the Users component login menu item.
|
| Addition |
Added a None author filter to find articles associated with deleted users.
|
| Addition |
Added a None tag filter to find articles without tags.
|
| Addition |
Added a None tag filter to the Contacts component.
|
| Addition |
Added a None tag filter to the News Feeds component.
|
| Addition |
Added a None tag filter to category lists.
|
| Addition |
Fields without an assigned field group now display None.
|
| Addition |
User notes associated with deleted users now display None.
|
| Addition |
Added a checked-out filter to the Article Manager and API.
|
| Addition |
Added a year sort order parameter for archived articles.
|
| Addition |
Added an H6 article title heading option to the articles module.
|
| Addition |
The Show Article Images option is now available when intro text is truncated.
|
| Addition |
Added start and end dates for featured articles.
|
| Addition |
Added GitHub Codespaces support for Joomla development and testing.
|
| Addition |
Added a settings icon to the debug plugin.
|
| Change |
Prepared Joomla 5.4 as the bridge release for upgrading to Joomla 6.
|
| Change |
Refactored component and Joomla CMS table classes to use the modern architecture.
|
| Change |
Converted the random image, menu, latest articles, users online, logged-in users, privacy dashboard, Smart Search and login modules to service providers.
|
| Change |
Extended the deprecation period for plugin listener registration methods to Joomla 7.
|
| Change |
Extended the deprecation period for plugin events, editors and CAPTCHA integrations to Joomla 7.
|
| Change |
Extended the deprecation period for JLoader::register() from Joomla 6 to Joomla 7.
|
| Change |
Deprecated the app property in FieldsPlugin.
|
| Change |
Deprecated legacy Universal Content Model code.
|
| Change |
Changed administrator views to use exceptions instead of legacy error handling.
|
| Change |
Renamed the table event from onBeforeDelete to onTableBeforeDelete.
|
| Change |
Replaced DatabaseQuery::castAsChar() with castAs().
|
| Change |
Updated Composer and NPM dependencies.
|
| Change |
Updated joomla/filesystem to version 3.2.0.
|
| Change |
Updated GitHub Actions workflow versions to version 5.
|
| Change |
Updated the What's New tour image.
|
| Change |
Updated system information in the administrator interface.
|
| Change |
Updated documentation for Joomla developers.
|
| Fixed |
Fixed the article author filter.
|
| Fixed |
Fixed the display of deleted users in user notes.
|
| Fixed |
Improved the display of fields without an assigned field group.
|
| Fixed |
Improved tag error messages.
|
| Fixed |
Fixed tooltip widths.
|
| Fixed |
Improved the media deletion confirmation message.
|
| Fixed |
Added modern error handling through the shouldUseException() method.
|
| Fixed |
Fixed the handling of responses from the automated update server.
|
| Fixed |
Improved the automated update experience on local websites.
|
| Fixed |
Improved automated update download logging.
|
| Fixed |
Fixed the display of the automated update registration state on new installations.
|
| Fixed |
Corrected Joomla Update API status codes when automated updates are disabled.
|
| Fixed |
Version information for potential downgrades is now skipped by TUF.
|
| Fixed |
Converted the TUF update information URL to the legacy-compatible format.
|
| Fixed |
Database update scripts no longer insert duplicate records when run multiple times.
|
| Fixed |
Fixed the minimum required PHP version shown by the pre-update check.
|
| Fixed |
Fixed the user registration error notification.
|
| Fixed |
Cache subfolders are now included correctly in Clear Cache statistics.
|
| Fixed |
Optimised the Smart Search module.
|
| Fixed |
Fixed TinyMCE filters.
|
| Fixed |
Fixed the default TinyMCE upload folder.
|
| Fixed |
The Model\AfterCleanCacheEvent class is no longer forced for onContentCleanCache events.
|
| Fixed |
Fixed the Schema.org system plugin handling of the content deletion event.
|
| Fixed |
Reverted a backward-incompatible change in AbstractView::get().
|
| Fixed |
Fixed deprecated direct access to model state properties.
|
| Fixed |
Fixed deprecated direct model state access in the Content component ArchiveModel.
|
| Fixed |
Fixed menuType table instantiation by using the database from the dependency container.
|
| Fixed |
Fixed unlocked and potentially uninstalled core plugins on new installations and updates.
|
| Fixed |
Fixed custom field menu items in administrator presets.
|
| Fixed |
Fixed the administrator menu item for the custom fields list.
|
| Fixed |
Fixed the administrator menu item for listing all field groups.
|
| Fixed |
Automated update notification emails now use the correct language.
|
| Fixed |
Improved the update notification code.
|
| Fixed |
Fixed the alphabetical order of automated update language strings in the installer.
|
| Fixed |
Fixed the alphabetical order of language strings in the installation joomla.ini file.
|
| Fixed |
Fixed a deprecated build-script variable to allow Joomla to be built with Node.js 24.
|
| Fixed |
Improved accessibility in the Joomla statistics plugin.
|
| Fixed |
Fixed deprecated cookie setter method calls.
|
| Fixed |
Removed deprecated AbstractView::get() calls from layouts.
|
| Fixed |
Fixed language string naming conventions.
|
| Fixed |
Fixed typographical errors in actions and language strings.
|
| Fixed |
Fixed the custom logging configuration description.
|
| Fixed |
Moved the multilingual associations alert to a more appropriate location.
|
| Fixed |
Removed unused CSS from the articles module.
|
| Fixed |
Improved PHPStan configuration for deprecated database interface errors.
|
| Remove |
Removed deprecated Joomla core constants.
|
| Remove |
Removed LegacyPropertyManagementTrait calls from the User class.
|
| Remove |
Removed the deprecated dispatcher from plugin constructors.
|
| Remove |
Removed legacy HTTP response handling code.
|
| Remove |
Removed duplicate language strings.
|
| Remove |
Removed outdated FOF references from code comments.
|
| Remove |
Removed unnecessary boolean expressions.
|
| Note |
Joomla 5.4.0 is a minor release in the Joomla 5 series.
|
| Note |
Joomla 5.4.0 was released on 14 October 2025 together with Joomla 6.0.0.
|
| Note |
Joomla 5.4 is the bridge release for upgrading existing Joomla 5 websites to Joomla 6.
|
| Note |
Installed extensions and templates should be checked for compatibility before upgrading to Joomla 6.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
Websites running Joomla 4 should be updated from the latest Joomla 4.4 release.
|
| Security |
Fixed the CVE-2025-54476 XSS vulnerability caused by inadequate content filtering in the checkAttribute methods.
|
| Security |
Fixed the CVE-2025-54477 vulnerability that allowed user enumeration through the passkey authentication method.
|
| Addition |
Added aria-label support to Joomla dialog windows.
|
| Addition |
Added a check for required fields before using them in content versioning.
|
| Addition |
Transport classes now support arrays of HTTP header values.
|
| Change |
Updated a frontend language string.
|
| Change |
Updated the Joomla contribution documentation.
|
| Change |
Updated Composer and NPM dependencies to resolve reported security vulnerabilities.
|
| Change |
Updated TinyMCE from version 6.8.5 to version 6.8.6.
|
| Change |
Updated the joomla/filesystem package.
|
| Change |
Updated the Miscellaneous Information icon in the Contacts component.
|
| Change |
Cleaned up PHPDoc documentation.
|
| Change |
Updated joomla/oauth2 to version 3.0.2.
|
| Fixed |
Fixed the display of the database prefix.
|
| Fixed |
Fixed the calendar picker when week numbers are hidden and the 24-hour time format is used.
|
| Fixed |
Updated the tag router to restrict lossy matches to menu items configured for all tags.
|
| Fixed |
Fixed the Cassiopeia mobile menu collapse behaviour.
|
| Fixed |
Prevented an explicit session identifier from being set through GET request parameters.
|
| Fixed |
A restored article version is now correctly checked out to the current user.
|
| Fixed |
Fixed an undefined array key warning in table/nested.php.
|
| Fixed |
Unique banner aliases are now enforced during both creation and updating.
|
| Fixed |
A DELETE request for a non-existing item now returns HTTP status code 204.
|
| Fixed |
Fixed an infinite API loop when an unknown resource is requested while the website is offline.
|
| Fixed |
The correct HTTP status header is now set for XML and feed responses.
|
| Fixed |
Simplified the No Media Found code in the Media Manager.
|
| Fixed |
Fixed a copy-and-paste error in form field definitions.
|
| Fixed |
The TinyMCE update fixes incorrect cursor placement in the editor.
|
| Fixed |
The joomla/filesystem update fixes extension uploads when post_max_size is set to zero.
|
| Fixed |
Fixed caching in the Predefinedlist field getOptions method.
|
| Fixed |
Fixed a deploy_version typographical error in the Scheduled Tasks component.
|
| Fixed |
Test news feeds and their categories are now correctly cleaned after the first test-suite run.
|
| Fixed |
Added missing periods to interface sentences.
|
| Fixed |
Fixed the author of a tagged item not being updated when an article is saved.
|
| Fixed |
SchemaorgPrepareDateTrait now uses the correct ISO 8601 date format.
|
| Fixed |
The joomla/oauth2 update fixes case-insensitive OAuth2Client authentication.
|
| Fixed |
Fixed copyright notices being incorrectly removed from media assets during the Joomla build process.
|
| Remove |
Removed the obsolete .github/ISSUE_TEMPLATE.md file.
|
| Note |
Joomla 5.3.4 is a security and bug-fix release.
|
| Note |
Joomla 5.3.4 was released on 30 September 2025.
|
| Note |
CVE-2025-54476 has moderate severity and a moderate probability of exploitation.
|
| Note |
CVE-2025-54477 has low severity and a low probability of exploitation.
|
| Note |
Corresponding security fixes were also released in Joomla 4.4.14.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|
| Addition |
Added a system test for multi-factor authentication plugins using passkeys.
|
| Addition |
Added SCSS variables for interface styling.
|
| Addition |
Added an end-of-support notification for the Joomla version.
|
| Change |
Updated the PHPStan baseline configuration for Joomla 5.3.
|
| Change |
Updated terminology related to whitelists.
|
| Change |
Migrated AppVeyor tests to GitHub Actions.
|
| Change |
Cypress tests now use a generated API Bearer token.
|
| Change |
Updated test descriptions.
|
| Change |
Updated the debug plugin collector.
|
| Fixed |
Fixed the .bg-warning text colour in the installer to improve accessibility.
|
| Fixed |
Excluded phpstan-baseline.neon from Joomla distribution packages.
|
| Fixed |
Removed tests from the Drone configuration after their migration to GitHub Actions.
|
| Fixed |
Removed the remaining Phan analyser configuration.
|
| Fixed |
Cleaned up the configuration after moving to GitHub Actions.
|
| Fixed |
Prevented null ordering when restoring an item from version history.
|
| Fixed |
URLs containing an invalid controller name now return the correct HTTP 404 status.
|
| Fixed |
Fixed automatic language-change redirection when SEF URLs are enabled.
|
| Fixed |
Fixed an orphaned ellipsis in the articles module.
|
| Fixed |
Applied a background colour to Choices elements to ensure correct display.
|
| Fixed |
Fixed strict routing for frontend forms.
|
| Fixed |
Fixed invalid Schema.org breadcrumb JSON-LD output.
|
| Fixed |
Further fixed breadcrumb handling in the Schema.org system plugin.
|
| Note |
Joomla 5.3.3 is a bug-fix release in the Joomla 5.3 series.
|
| Note |
Joomla 5.3.3 was released on 19 August 2025.
|
| Note |
No separate Joomla core security fixes were announced for this release.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|
| Addition |
Added a button for showing and hiding the password in the login module.
|
| Addition |
Added a continuous integration workflow based on GitHub Actions.
|
| Change |
Optimised the loading of Smart Search plugin language files.
|
| Change |
Disabled OPcache in the SEF system test to improve test stability.
|
| Fixed |
Added a missing Joomla installer language string.
|
| Fixed |
Corrected comments in the source code.
|
| Fixed |
Fixed the creation of Zstandard packages by build.php on macOS.
|
| Fixed |
Fixed the display of duplicate queries in the debug plugin's dark mode.
|
| Fixed |
Improved the error page displayed during Joomla installation.
|
| Fixed |
Fixed a copy-and-paste error in a source-code comment.
|
| Fixed |
Fixed errors and improved the stability of the build.php script.
|
| Fixed |
Fixed the type used for custom form validators.
|
| Remove |
Removed the custom fields button from the custom module editing form.
|
| Note |
Joomla 5.3.2 is a bug-fix release in the Joomla 5.3 series.
|
| Note |
Joomla 5.3.2 was released on 8 July 2025.
|
| Note |
No separate Joomla core security fixes were announced for this release.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|
| Addition |
Added server error log checks to the system tests.
|
| Addition |
Added development mode information to the installer.
|
| Change |
Updated Joomla translations.
|
| Change |
Cleaned up the arguments of the File::upload() method.
|
| Change |
Updated the Danish TinyMCE translation.
|
| Change |
Updated embedded help URLs in the Jooa11y plugin language strings.
|
| Change |
Action log email notifications now use the website time zone.
|
| Change |
Updated joomla/database to version 3.4.2 for PHP 8.4 compatibility.
|
| Fixed |
Fixed hidden option prompts during command-line Joomla installation.
|
| Fixed |
Corrected grammatical errors in interface text.
|
| Fixed |
Fixed a typo in the replacement event name for onUserBeforeDataValidation.
|
| Fixed |
Fixed the positioning of the description in the search bar.
|
| Fixed |
Fixed the skip-to-link tooltip.
|
| Fixed |
Improved the empty-state information in the Media Manager.
|
| Fixed |
Fixed a PHP deprecation warning in the language switcher module.
|
| Fixed |
Fixed the incorrect sequence of the #__action_log_config table on PostgreSQL.
|
| Fixed |
The Media Action Resize plugin now respects individual width and height constraints.
|
| Fixed |
Fixed a mismatch between the default option and its label in the articles filter.
|
| Fixed |
The correct custom fields are now displayed when creating an article after filtering by multiple categories.
|
| Fixed |
Fixed missing values in enhanced select filters.
|
| Fixed |
Fixed the specified deprecation version of an application programming interface.
|
| Fixed |
Fixed the ordering of Content Security Policy directives in the HTTP Headers configuration.
|
| Fixed |
Corrected the deprecation text and added Registry support to StateBehaviorTrait.
|
| Fixed |
Fixed valid JSON handling in PostgreSQL queries.
|
| Fixed |
Fixed logical CSS properties in the installer for right-to-left languages.
|
| Fixed |
Fixed location updates when an update site already exists.
|
| Fixed |
Improved the spacing of long element lists in Smart Search.
|
| Fixed |
Limited the length of logged search terms to prevent a MysqliStatement error.
|
| Fixed |
Modified update site URLs are no longer displayed during update checks.
|
| Fixed |
The joomla/database update resolves PHP 8.4 deprecation warnings.
|
| Fixed |
Saving an article as a copy now correctly applies unpublishing or the configured workflow transition.
|
| Fixed |
Fixed Media Manager interface issues and improved accessibility.
|
| Fixed |
The phpass library now uses a timing-safe comparison method.
|
| Fixed |
Fixed calendar day names for right-to-left languages.
|
| Remove |
Removed the unused scss-transform.mjs build tool file.
|
| Note |
Joomla 5.3.1 is a bug-fix release in the Joomla 5.3 series.
|
| Note |
Joomla 5.3.1 was released on 27 May 2025.
|
| Note |
No separate Joomla core security fixes were announced for this release.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|
| Addition |
The email template view now provides access to template parameters for advanced customisation of outgoing messages.
|
| Addition |
A separate files folder for documents and other non-image files has been added to the Media Manager on new installations.
|
| Addition |
Added a complete execution history to Scheduled Tasks.
|
| Addition |
The Scheduled Tasks execution history records information required for monitoring and troubleshooting automated tasks.
|
| Addition |
Added an option to show or hide the article title in Read More links.
|
| Addition |
Added new methods for managing hidden and control fields in forms.
|
| Addition |
Added the BeforeUpdateSiteDownloadEvent event, which is triggered before an update site URL is downloaded.
|
| Addition |
Installer plugins can now modify an update site URL before it is used.
|
| Addition |
Added support for thumbnails for videos, PDF documents, audio files and other file types.
|
| Addition |
The com_ajax component now supports results implementing StringableInterface.
|
| Addition |
Added support for customised com_ajax responses through StringableInterface objects.
|
| Addition |
Added a guided tour introducing the new features in Joomla 5.3.
|
| Change |
Improved Joomla compatibility with PHP 8.4.
|
| Change |
Core plugins continue their transition to typed event classes.
|
| Change |
The WebAsset API is now recommended for loading scripts and stylesheets.
|
| Change |
The HTMLHelper::script() and HTMLHelper::stylesheet() methods are deprecated.
|
| Change |
Refactored component views to access their models directly.
|
| Change |
Removed the deprecated LegacyPropertyManagementTrait::setProperties() call from the Joomla core.
|
| Change |
The package installer now uses the Joomla Framework Filesystem package instead of the deprecated CMS filesystem.
|
| Change |
Improved the handling of tag aliases and SEF URLs.
|
| Change |
Improved detection of tainted and potentially invalid URLs.
|
| Change |
Updated Composer and NPM dependencies.
|
| Change |
Updated Joomla language files.
|
| Change |
Updated calendar language strings.
|
| Fixed |
Improved the organisation of documents and non-image files in the Media Manager.
|
| Fixed |
Fixed Contact component icons for screen-reader accessibility.
|
| Fixed |
Improved accessibility in the Contacts component interface.
|
| Fixed |
Fixed tag alias handling in the router.
|
| Fixed |
Fixed the handling of SEF URLs in Joomla routing.
|
| Fixed |
Fixed the handling of invalid URLs.
|
| Fixed |
Fixed extension file uploads through the package installer.
|
| Fixed |
Fixed unescaped slashes breaking markup inside script tags.
|
| Fixed |
Fixed PHP 8.4 compatibility issues involving deprecated parameter types.
|
| Fixed |
Fixed PHP 8.4 warnings involving implicitly nullable parameters.
|
| Fixed |
Updated restoration file creation to use the current createUpdateFile() method.
|
| Fixed |
Improved Scheduled Tasks execution logging.
|
| Fixed |
Improved the handling of HTML email templates.
|
| Fixed |
Fixed thumbnail handling for non-image files.
|
| Fixed |
Fixed Read More link behaviour when displaying the article title.
|
| Fixed |
Improved the accessibility of administrator controls and messages.
|
| Note |
Joomla 5.3.0 is a minor release in the Joomla 5 series.
|
| Note |
Joomla 5.3.0 was released on 15 April 2025.
|
| Note |
No separate Joomla core security fixes were announced for this release.
|
| Note |
The files folder is created automatically only on new Joomla 5.3 installations.
|
| Note |
On upgraded websites, the files folder and the corresponding Media Manager path must be configured manually.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|
| Security |
Fixed the CVE-2025-25226 SQL injection vulnerability in the quoteNameStr method of the Joomla Framework Database package.
|
| Security |
Fixed the CVE-2025-25227 vulnerability that allowed multi-factor authentication checks to be bypassed.
|
| Security |
The user activation token is now removed when the user's email address is changed.
|
| Change |
Updated Joomla translations.
|
| Change |
Updated the joomla/database package from version 3.2.1 to the secure version 3.4.0.
|
| Change |
Further updated the joomla/database package to version 3.4.1.
|
| Change |
Changed the development minor version number to Joomla 5.3.
|
| Note |
Joomla 5.2.6 is a security release in the Joomla 5.2 series.
|
| Note |
Joomla 5.2.6 was released on 8 April 2025 together with Joomla 4.4.13.
|
| Note |
Joomla 5.2.6 is the final release in the Joomla 5.2 series.
|
| Note |
CVE-2025-25226 has high potential impact, low severity and a low probability of exploitation.
|
| Note |
CVE-2025-25227 has high potential impact, moderate severity and a moderate probability of exploitation.
|
| Note |
The multi-factor authentication bypass affects Joomla versions from 5.0.0 through 5.2.5.
|
| Note |
The vulnerable quoteNameStr method is protected and is not directly used by the original database package classes.
|
| Note |
Third-party classes extending the database package may be affected if they use the quoteNameStr method.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|
| Security |
Fixed the CVE-2025-22213 vulnerability that allowed malicious executable PHP files to be uploaded through the Media Manager.
|
| Security |
Strengthened file upload validation for users with edit permissions in the Media Manager.
|
| Change |
Updated Joomla translations.
|
| Change |
Updated maximebf/debugbar to version 1.23.6.
|
| Change |
Updated the Cypress system test documentation.
|
| Fixed |
Added backup of the $_SERVER array through backupGlobals in unit tests.
|
| Fixed |
System tests no longer delete TUF metadata.
|
| Fixed |
Added a column alias to BannerTable and fixed a warning when saving a banner as a copy.
|
| Fixed |
Fixed a PHP warning caused by passing null to the trim() function.
|
| Fixed |
Added a border to the final Media Manager breadcrumb item.
|
| Fixed |
Disabled the backward compatibility plugin during system tests.
|
| Fixed |
Updated the Cypress menu system test.
|
| Fixed |
Fixed the Send Copy to Submitter feature in the Contacts component.
|
| Fixed |
Redesigned the carousel implementation to match its documentation.
|
| Fixed |
Fixed the frontend editing setting applied through the command-line interface after Joomla installation.
|
| Fixed |
Corrected the sudo command in the documentation.
|
| Fixed |
User sessions are now correctly cleaned after Cypress tests.
|
| Note |
Joomla 5.2.5 is a security and bug-fix release.
|
| Note |
Joomla 5.2.5 was released on 11 March 2025 together with Joomla 4.4.12.
|
| Note |
CVE-2025-22213 has critical potential impact, low severity and a low probability of exploitation.
|
| Note |
The vulnerability affects Joomla versions from 5.0.0 through 5.2.4.
|
| Note |
Exploiting the vulnerability requires a user account with edit permissions in the Media Manager.
|
| Note |
By default, this permission is granted to administrator user groups and frontend users with Editor permissions or higher.
|
| Note |
Successful exploitation could allow arbitrary PHP code to be executed on the server.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|
| Security |
Fixed an SQL injection vulnerability in the backend task list of the Scheduled Tasks component com_scheduler (CVE-2025-22207).
|
| Fixed |
Fixed namespace map creation when using PHP 8.4 (#44789).
|
| Fixed |
Fixed PHP warnings for the debuguser and debuggroup parameters (#44721).
|
| Fixed |
Fixed the handling of null values when updating a database row (#39607).
|
| Fixed |
Fixed the incorrect counting of files in the cache (#43986).
|
| Fixed |
Fixed permissions for manually running scheduled tasks (#36719).
|
| Fixed |
Restored support for numeric and CSV-formatted identifiers in the Tag Router (#44784).
|
| Fixed |
Updated the enshrined/svg-sanitize library to resolve SVG upload issues (#44746).
|
| Fixed |
Fixed an issue that prevented articles from being saved successfully on the frontend (#44680).
|
| Fixed |
Fixed downloading media files whose names contain spaces (#44745).
|
| Fixed |
Removed unnecessary query elements from Smart Search router URLs (#44055).
|
| Fixed |
Fixed conflicts between the Jooa11y plugin and page caching (#41956).
|
| Fixed |
Fixed an accessibility issue with the accordion role attribute (#40578).
|
| Fixed |
Removed unnecessary alternative text from menu items containing both an image and a title (#40675).
|
| Fixed |
Fixed the breadcrumbs colour in light and dark modes (#44212).
|
| Fixed |
Fixed email alternative text in the Contacts component (#44491).
|
| Fixed |
Fixed incorrect loading of external resources ending with a slash in the Web Asset Manager (#44774).
|
| Fixed |
Fixed multi-select behaviour in the Media Manager (#44747).
|
| Fixed |
Improved error handling when creating folders in the Media Manager (#39878).
|
| Fixed |
Fixed assets for the com_scheduler component on new Joomla installations (#44684).
|
| Fixed |
Fixed password reset functionality in the administrator interface (#44723).
|
| Fixed |
Fixed the Email Cloaking plugin for email addresses containing internationalised domain names (#39888).
|
| Fixed |
Changed root-path removal so that the path is removed only when it appears at the beginning of the string (#36685).
|
| Fixed |
Reverted the change that loaded the namespace from the cached manifest (#44755).
|
| Fixed |
Fixed duplicated CodeMirror asset entries (#44674).
|
| Security |
Fixed cross-site scripting vectors caused by improper input processing in module chrome layouts (CVE-2024-40747).
|
| Security |
Fixed an XSS vulnerability in the id attribute of menu lists caused by missing output escaping (CVE-2024-40748).
|
| Security |
Fixed an ACL access-control issue that allowed access to protected Joomla component views (CVE-2024-40749).
|
| Fixed |
Fixed button validation in the joomlaExtButtons TinyMCE plugin (#44507).
|
| Fixed |
Fixed validation of email addresses containing an apostrophe (#44527).
|
| Fixed |
Fixed the assignment of AssetTitle and AssetParentId values (#42493).
|
| Fixed |
Removed empty images and anchors from the Articles News, Articles Category and Articles modules (#42493, #44478, #44475).
|
| Fixed |
Removed an incorrect CSS class from the cancel link on the frontend verification-code page (#44473).
|
| Fixed |
Added multi-select support for checkbox fields (#44500).
|
| Fixed |
Fixed Smart Search suggestions when using a PostgreSQL database (#44384).
|
| Fixed |
Added an AllowDynamicProperties extension check to the pre-update checker (#44307).
|
| Fixed |
Fixed the handling of a nullable parameter in PHPCS (#44543).
|
| Fixed |
Fixed an extra closing curly brace in inline styles (#44532).
|
| Fixed |
Fixed a JavaScript error occurring when the toggleButton element is unavailable (#44555).
|
| Fixed |
Fixed case-insensitive plugin searches for languages using Unicode characters (#44525).
|
| Fixed |
Fixed a deprecation warning caused by incrementing a non-alphanumeric string (#44173).
|
| Fixed |
Prevented a newly assigned user password-reset requirement from being incorrectly cleared (#44519).
|
| Fixed |
Fixed incorrect button text generated by the back() method in CoreButtonsTrait (#44509).
|
| Fixed |
Updated the Tags Router to correctly detect pages that should return a 404 error (#44540).
|
| Fixed |
Added exception handling when retrieving a user in the Action Log model (#44358).
|
| Fixed |
Fixed the return type declaration in the IdentityAware trait (#44567).
|
| Fixed |
Updated the joomla/application library to version 3.0.3 to fix PHP deprecation warnings in the Web Client (#44585).
|
| Fixed |
Allowed multi-factor authentication to be completed before a required password reset (#44521).
|
| Fixed |
Fixed duplicate Action Log entries after a Joomla update (#44629).
|
| Fixed |
Fixed the “Invalid Response” error in the CLI extension:remove command when using the -n option (#44546).
|
| Fixed |
Fixed multi-factor authentication handling when a privacy consent is invalid (#44522).
|
| Fixed |
Added changelog URL refreshing when rebuilding the extension manifest cache (#44565).
|
| Security |
Fixed insecure 777 permissions assigned to core files and folders in new Joomla 5.2.0 installations; permissions were restored to 755 for folders and 644 for files (#44379).
|
| Fixed |
Fixed broken URLs in emails using mail template layouts (#44378).
|
| Fixed |
Added wrapping for long text to prevent content from extending beyond the viewport (#44441).
|
| Fixed |
Fixed dark-mode display issues in the default Atum administrator template (#44211).
|
| Fixed |
Fixed an error occurring when checked-out items were moved to the trash (#44392).
|
| Fixed |
Fixed the filter_category_id parameter when creating an administrator menu item (#44305).
|
| Fixed |
Fixed a blank screen on the Guided Tours steps page after a user session timeout (#44375).
|
| Fixed |
Fixed an infinite loop in multilingual content associations (#44360).
|
| Fixed |
Improved error handling during extension updates (#43321).
|
| Security |
Fixed insecure file and folder permissions in new installation packages: the incorrect 777 permissions were replaced with 755 for folders and 644 for files.
|
| Addition |
Added an automatically launched “What’s New” Guided Tour to introduce users to the features of the new Joomla version (#43966).
|
| Addition |
Added support for multiple language-specific home pages within a single menu (#43862).
|
| Addition |
Added a new universal Articles module with flexible content filtering and display options (#43738).
|
| Addition |
Added support for customisable HTML layouts for Joomla system emails (#43829).
|
| Addition |
Added the ability to create and save categories directly while working with menu items (#43840).
|
| Addition |
Added conditional display of form fields based on global configuration values (#43842).
|
| Addition |
Added a CSS class selector for styling links in the TinyMCE editor (#43260).
|
| Addition |
Expanded the range of special characters allowed in passwords (#43484).
|
| Addition |
Added event classes for more convenient and modern plugin development (#43639).
|
| Change |
Improved strict routing and SEF URL handling to reduce duplicate content and unnecessary redirects (#43432).
|
| Change |
Changed the Media Manager to automatically select the most recently uploaded file (#43823).
|
| Change |
Improved image thumbnail compression to reduce file sizes and improve page-loading performance (#43282).
|
| Change |
Added compatibility with PHP 8.4 (#43323).
|
| Change |
Added a warning to the Scheduled Tasks screen when a task fails to execute (#43491).
|
| Fixed |
Fixed paginated page links in Smart Search and the Articles Archive following security-related changes introduced in Joomla 5.1.3 (#43953, #43967).
|
| Fixed |
Fixed filtering of the option, format, view and layout parameters in caching and pagination (#43983).
|
| Fixed |
Updated the support dates for PHP versions (#43984).
|
| Fixed |
Added escaping of unsafe tags in mail copies sent to users and administrator notifications while preserving custom email fields (#43981).
|
| Fixed |
Updated Joomla language files (#43923, #43980).
|
| Security |
Fixed XSS vectors in the OutputFilter::strip* methods caused by improper input handling (CVE-2024-40743).
|
| Security |
Fixed improper ACL checks in the administrator profile view that allowed backend users to overwrite their usernames when this action was prohibited (CVE-2024-27187).
|
| Security |
Fixed XSS vulnerabilities in HTML mail templates caused by missing data escaping (CVE-2024-27186).
|
| Security |
Fixed cache-poisoning vectors caused by arbitrary parameters being included in pagination links (CVE-2024-27185).
|
| Security |
Improved internal URL validation to prevent redirects to external resources (CVE-2024-27184).
|
| Fixed |
Updated the TinyMCE editor to version 6.8.4 (#43808).
|
| Fixed |
Fixed attachment handling in the Mail class (#43828).
|
| Fixed |
Added removal of Schema.org data after the associated item is deleted (#43839).
|
| Fixed |
Removed the testing update channel from the command-line interface (#43764).
|
| Fixed |
Fixed frontend language handling on multilingual sites without the Backward Compatibility plugin enabled (#43791).
|
| Fixed |
Removed unused variables (#43763).
|
| Fixed |
Added the missing security token to the ModalSelect field (#43745).
|
| Fixed |
Fixed the Secure attribute for user session cookies (#43882).
|
| Fixed |
Fixed data encoding in popup links (#43874).
|
| Fixed |
Fixed header translation for modal selection fields (#43878).
|
| Fixed |
Fixed a JavaScript error affecting radio buttons rendered in a sublayout (#43804).
|
| Fixed |
Fixed the handling of relative URLs in private messages (#43897).
|
| Security |
Fixed an XSS vulnerability in the accessible media selection field caused by inadequate input validation (CVE-2024-21729).
|
| Security |
Fixed a Self-XSS vulnerability in the Fancy Select list field layout caused by improper input escaping (CVE-2024-21730).
|
| Security |
Fixed an XSS vulnerability in the StringHelper::truncate method caused by improper input handling (CVE-2024-21731).
|
| Security |
Fixed XSS vulnerabilities in the Wrapper component and module caused by inadequate input validation (CVE-2024-26279).
|
| Security |
Fixed an XSS vulnerability in the default custom-field value handled by the com_fields component (CVE-2024-26278).
|
| Fixed |
Added an update-channel reset to the Joomla Update component (#43717).
|
| Fixed |
Changed Schema.org data to load only in supported forms (#42825).
|
| Fixed |
Changed the created_by field to use a value of 0 when no author is specified (#43752).
|
| Fixed |
Restored support for embedding PDF documents (#43716).
|
| Fixed |
Changed the redirect URL from the Location header to be correctly handled as a string instead of an array (#43734).
|
| Fixed |
Fixed radio buttons and checkboxes in nested Subform fields (#43660).
|
| Fixed |
Added support for the onchange attribute to the Modal Select form field (#43618).
|
| Fixed |
Added resetting of cached layout data when running the form field setup() method (#43562).
|
| Fixed |
Fixed comment syntax in the update SQL script that adds TUF support (#43306).
|
| Fixed |
Fixed the dark-mode selector in the administrator template (#43310).
|
| Fixed |
Fixed the light and dark mode switch in the administrator interface (#43454).
|
| Fixed |
Corrected the link to the official Joomla forum (#43414).
|
| Fixed |
Corrected the message type used for the Redirect plugin state (#43402).
|
| Fixed |
Fixed the TinyMCE media button when editing articles on the frontend (#43376).
|
| Fixed |
Fixed link insertion using the TinyMCE media button (#43374).
|
| Fixed |
Fixed documentation links in empty-state views (#43371).
|
| Fixed |
Fixed a PHP deprecation warning caused by passing null to PDO::quote() (#43288).
|
| Fixed |
Added backward compatibility for older Bootstrap modals used by plugins and modules (#43291).
|
| Fixed |
Fixed calendar field value handling (#43234).
|
| Fixed |
Restored compatibility with legacy editor-xtd plugins returning an array of buttons (#43129).
|
| Fixed |
Fixed JavaScript syntax highlighting in the CodeMirror 6 editor (#43114).
|
| Fixed |
Fixed an incorrect value for the new trailingslash parameter in the system SEF plugin (#43292).
|
| Fixed |
Added missing entries to the help index (#43251).
|
| Fixed |
Fixed the help index build tool helpTOC.php (#43250).
|
| Fixed |
Fixed switching between duplicate menus in the administrator menu (#43308).
|
| Fixed |
Updated deprecation information in the Joomla changelog (#43219).
|
| Fixed |
Fixed PHP warnings occurring when new custom fields were created (#42956).
|
| Fixed |
Fixed handling of the administrator template brand parameter (#41458).
|
| Fixed |
Updated the documentation link (#43370).
|
| Fixed |
Added proper support for AVIF and WebP images (#43295).
|
| Fixed |
Improved exception handling when generating thumbnails in the Media Manager (#43468).
|
| Fixed |
Fixed an issue that could cause the extension compatibility check before a Joomla update to run indefinitely (#43410).
|
| Fixed |
Changed the redirect URL from the Location header in CurlTransport to be correctly handled as a string instead of an array (#42769).
|
| Fixed |
Updated the documentation to include MariaDB and remove the obsolete Microsoft SQL Server reference (#43368).
|
| Fixed |
Added inline help for the Activate Advanced Mode button in the Redirect component (#43435).
|
| Fixed |
Fixed date and time conversion when no current user is available (#43521).
|
| Addition |
Implemented the secure TUF update mechanism (#42799).
|
| Addition |
Added a light and dark mode switch to the administrator interface (#42221).
|
| Addition |
Added a Welcome Guided Tour for new users (#41659).
|
| Addition |
Added trailing-slash URL behaviour to the system SEF plugin (#42702).
|
| Addition |
Added a notice to the Global Configuration about additional options available in the system SEF plugin (#42832).
|
| Addition |
Added required-field handling and support for checkboxes, radio buttons and selection lists as Guided Tour targets (#40994).
|
| Addition |
Added regular-expression validation for form fields (#42657).
|
| Addition |
Added the Generic type to Schema.org integration (#42699).
|
| Addition |
Added the Article type to Schema.org integration (#42402).
|
| Addition |
Added the ability to manipulate custom-field forms in the same way as category forms (#42510).
|
| Addition |
Added a main region and improved module support on the Cassiopeia error page (#42719).
|
| Addition |
Added a “New Article” button to the blog view (#39506).
|
| Addition |
Added support for subcategory levels in the Contacts category view (#41618).
|
| Addition |
Added a command-line command for managing Joomla core update channels (#42597).
|
| Addition |
Added the update:extension:check command for checking extension updates from the command line (#42844).
|
| Addition |
Added a command-line command for updating the database structure (#42568).
|
| Addition |
Added toolbar buttons on the language installation page for direct access to language management views (#42610).
|
| Addition |
Added buttons for moving Subform rows up and down (#42334).
|
| Addition |
Added a rebuild button to the Tags component (#42586).
|
| Addition |
Added a global Form Layout option for custom fields (#37320).
|
| Addition |
Added SVG image support to the Banners module (#41854).
|
| Change |
Significantly improved the administrator interface in dark mode (#42986).
|
| Change |
Improved SEF URL behaviour for addresses containing index.php (#42704).
|
| Change |
Updated the Jooa11y Accessibility Checker plugin to a newer version of Sa11y (#42780).
|
| Change |
Replaced Bootstrap modals with the new administrator dialog component for scheduled tasks, extension changelogs, batch processing, plugins, modules, media, categories, contacts, news feeds and content history (#42746, #42453, #42355, #42447, #42423, #42288, #42293, #42326, #42327, #42328, #42454).
|
| Change |
Updated Font Awesome to version 6.5.1 (#42721).
|
| Change |
Updated the TinyMCE editor to version 6.8.3 (#42930).
|
| Change |
Changed the value column in the #__fields_values table from TEXT to MEDIUMTEXT (#42606).
|
| Change |
Renamed and improved the core:update:check command (#42594).
|
| Change |
Improved the output of the Joomla core update command (#42601).
|
| Change |
Converted major administrator and system modules to use Joomla service providers (#42214, #42845, #42866, #42853, #42852, #42990, #42838, #42827, #42801, #42781, #42792, #42814, #42886, #42883, #42877, #42735, #42215, #42898, #42899, #42910, #42929, #42987).
|
| Change |
Improved the display of long template descriptions (#42651).
|
| Change |
Improved the removal of child extensions installed as part of a package (#42607).
|
| Change |
Improved data filtering in API web services (#42519).
|
| Change |
Improved API web-service event classes (#42092).
|
| Change |
Changed the Media Manager to use a generic icon for documents (#42527).
|
| Change |
Rewrote the multilingual associations component com_associations in vanilla JavaScript (#42771).
|
| Change |
Added event classes for Page Cache plugin events (#41965).
|
| Change |
Changed batch processing to load the appropriate plugin group when tasks are executed (#39013).
|
| Change |
Added several JavaScript improvements (#42756, #42755, #42776, #42784).
|
| Change |
Updated the automated code-style fixing tool (#42603).
|
| Fixed |
Improved error handling when writing files during a Joomla update (#41096).
|
| Fixed |
Removed potentially unsafe attributes from images in HTML emails (#42448).
|
| Fixed |
Fixed Action Log notification emails containing HTML links (#40033).
|
| Security |
Fixed insufficient termination of existing user sessions after multi-factor authentication methods were changed (CVE-2024-21722).
|
| Security |
Fixed an open redirect caused by inadequate URL parsing in the Joomla installation application (CVE-2024-21723).
|
| Security |
Fixed XSS vulnerabilities in media selection fields caused by inadequate input validation (CVE-2024-21724).
|
| Security |
Fixed XSS vulnerabilities caused by inadequate escaping of email addresses in various Joomla components (CVE-2024-21725).
|
| Security |
Improved content filtering to fix XSS vulnerabilities in various Joomla components (CVE-2024-21726).
|
| Fixed |
Fixed the CodeMirror editor background colour in fullscreen mode (#42683).
|
| Fixed |
Updated Joomla language files (#42669).
|
| Fixed |
Added the display of system messages on the error page (#42652).
|
| Fixed |
Reverted an incorrect minimum environment version change in the Drone CI configuration (#42583).
|
| Fixed |
Fixed the function parameter being lost during a redirect (#42315).
|
| Fixed |
Updated the phpseclib library to version 3.0.34 (#42469).
|
| Fixed |
Improved colour contrast in the Media Manager file list (#42544).
|
| Fixed |
Harmonised the naming of scheduled task types (#42574).
|
| Fixed |
Added a proper error message when installing a package containing no extensions (#42337).
|
| Fixed |
Added missing language strings to improve interface accessibility (#42387).
|
| Fixed |
Fixed a PHP deprecation warning caused by the creation of dynamic properties (#42429).
|
| Fixed |
Fixed PHP 8 deprecation warnings when installing Joomla from the command line (#42451).
|
| Fixed |
Fixed a deprecation warning caused by creating the clientId property during Joomla CLI installation (#42436).
|
| Security |
Fixed the exposure of environment variables through manipulation of the language-file parsing process (CVE-2023-40626).
|
| Fixed |
Fixed SVG file display in the Media Manager list view (#42119).
|
| Fixed |
Added a warning to custom-field settings about possible information disclosure through Smart Search indexing (#42111).
|
| Fixed |
Fixed a PHP notice occurring during tag replacement in mail templates (#41679).
|
| Fixed |
Improved the private-message view in the com_messages component (#42135).
|
| Fixed |
Fixed Joomla installation from the command line (#42116).
|
| Addition |
Added Schema.org integration with automatic structured data generation for the organisation and site name.
|
| Addition |
Added support for AVIF images to the Media Manager.
|
| Addition |
Added JavaScript import-map support to the Web Asset Manager.
|
| Addition |
Added the ability to exclude archived articles from Smart Search indexing.
|
| Addition |
Added the ability to arrange menus using custom sorting.
|
| Addition |
Added a new Joomla modal component for item selection buttons.
|
| Addition |
Added the Backward Compatibility plugin to support Joomla 4 extensions using deprecated APIs.
|
| Change |
Significantly improved dark mode in both the frontend and administrator interfaces.
|
| Change |
Improved caching of CSS and JavaScript web assets.
|
| Change |
Optimised the Joomla source code to improve performance.
|
| Change |
Improved compatibility with PHP 8 and resolved PHP 8.2 deprecation warnings.
|
| Change |
Updated the Bootstrap framework to version 5.3.2.
|
| Change |
Updated the TinyMCE editor to version 6.7 with additional image-alignment features.
|
| Change |
Updated the CodeMirror source-code editor to version 6.
|
| Change |
Updated the Font Awesome icon library to version 6.4.
|
| Change |
Updated the WebAuthn authentication library.
|
| Change |
Moved several system scheduled tasks to dedicated scheduler plugins.
|
| Change |
Migrated Joomla core events to dedicated event classes.
|
| Change |
Refactored internal code to use modern application programming interfaces.
|
| Change |
Raised the minimum system requirements to PHP 8.1, MySQL 8.0.13, MariaDB 10.4 and PostgreSQL 12.
|
| Remove |
Removed non-functional CAPTCHA reCAPTCHA plugins.
|
| Remove |
Removed support for the obsolete ECMAScript 5 JavaScript standard.
|
| Remove |
Removed deprecated APIs and unused code from previous Joomla versions.
|
File categories
Site sections
Newsletter Subscription
Joomla.center is not affiliated with or endorsed by the Joomla!® Project or Open Source Matters. The Joomla!® name and logo is used under a limited license granted by Open Source Matters, the trademark holder in the United States and other countries.