Exponential Platform Nexus Files

Exponential Platform Nexus v2.5.0.8 (2.5 generation, master)

Installs with Composer 2.10 and 2.11 with security blocking on. No development version with a security advisory is installed.

Changes

• The Flysystem, Symfony Mime and GraphQL packages are the se7enxweb forks that carry the backported fixes: se7enxweb/flysystem 1.1.11, se7enxweb/symfony-mime 5.4.55 and se7enxweb/graphql-php 0.13.12.
• se7enxweb/ezplatform-http-cache 0.9.6 replaces ezsystems/ezplatform-http-cache, so only one copy is installed. The advisory PKSA-wtj8-672s-hw2j is listed in the ignore lists with the reason: the 0.9 VCL never gzips JSON or REST API responses.
• The shipped doc/varnish/vcl/varnish4_xkey.vcl no longer gzips application/json and application/vnd.ez.api responses (BREACH).
• The information collection bundle is se7enxweb/information-collection-bundle 1.9.6. Its XLS export uses PhpSpreadsheet instead of the abandoned PHPExcel.
• guzzlehttp/psr7 ^2.12.3 and sentry/sentry-symfony ^4.4 replace PSR-7 1.x and Sentry 2. The Sentry bundle stays disabled.
• The Goutte Mink driver is removed. It needed Guzzle 6, which has no fixed release. Behat uses the in-process Symfony session.
• se7enxweb/cjw-config-processor 2.1.1 replaces cjw-network/cjw-config-processor, whose GitHub downloads are gone.
• The install guide, CONTRIBUTING.md and the book give composer install --ignore-platform-req=php+. This ignores only upper PHP limits; --ignore-platform-reqs also let Composer install packages that need a newer PHP.
• Also in this release:
• web/index.php runs the application.
• composer install builds the Platform admin assets and links the bundle assets into web/.
• The Doctrine ORM caches fall back to the array cache without APCu.
• symfony/thanks is removed.
• The site asset build and the slick and cookie scripts are fixed.
• The legacy settings and extensions now match what the distribution ships.

Verified

• Fresh install from Packagist only, as doc/INSTALL.md says (no extra repositories, MariaDB, Composer 2.11.0-RC1, PHP 8.5, security blocking on): the install passes and logs no advisory.
• The front page works, and so do the sign-ins to the Platform admin, the Netgen Admin UI, the legacy admin and Netgen Layouts.
• The information collection XLS export downloads as admin and reads back with PhpSpreadsheet 5.10.0.
• composer audit reports no security advisories; it lists abandoned packages only.
• The same code, before the forks were tagged, with the two forks at their release commits taken from local copies: installs passed on PHP 8.1 and 8.5 with Composer 2.10.3 and 2.11.0-RC1, with the same checks. Those runs used the older --ignore-platform-reqs command.