| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| 1.3.0.9 - Core 5.1 with Flysystem 3 source code.tar.gz | 2026-10-23 | 5.3 MB | |
| 1.3.0.9 - Core 5.1 with Flysystem 3 source code.zip | 2026-10-23 | 5.6 MB | |
| README.md | 2026-10-23 | 1.3 kB | |
| Totals: 3 Items | 10.9 MB | 0 | |
Updated: the lock installs core v5.1.0, whose file and image storage runs on Flysystem 3: league/flysystem 2.5.0 → 3.36.0, league/flysystem-memory 2.0.6 → 3.31.0, league/flysystem-local 3.35.3 added. This fixes CVE-2026-102601 / GHSA-cxf4-7mrp-vvpr (a bypass of the path normalizer used for uploaded file names). Nothing else in the lock moved; no configuration change is needed.
composer audit still reports other advisories in packages this release does not touch (Twig, league/commonmark, PhpSpreadsheet, several Symfony components and others); they are being addressed separately.
Verified before tagging with a fresh install from the release commit (installed from the lock), the documented SQLite steps and PHP's built-in server: every step exits 0; /, /bold_eng/, /bold_ger/ and /adminui/login return 200; signing in reaches the dashboard; the Layouts admin returns 200; the demo images and their variations are served from storage; an uploaded image, a generated variation and a downloaded file work and are removed from disk on delete.
