| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| 2026.3.0 source code.tar.gz | 2026-09-29 | 6.5 MB | |
| 2026.3.0 source code.zip | 2026-09-29 | 8.0 MB | |
| README.md | 2026-09-29 | 10.7 kB | |
| Totals: 3 Items | 14.5 MB | 0 | |
What's Changed
- Add coauthor information to versions by @fashxp in https://github.com/pimcore/pimcore/pull/19235
- 🔄 synced file(s) with pimcore/platform-version by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19241
- Update maintenance branch in CONTRIBUTING.md to 2026.2 (#187) by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19248
- Rename new-* workflow files to their final names by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19249
- [Feature] Add generic custom_extensions slot to workflow places, transitions and global actions by @markus-moser in https://github.com/pimcore/pimcore/pull/19237
- [Assets] Make thumbnail delivery cache lifetime configurable by @kingjia90 in https://github.com/pimcore/pimcore/pull/19255
- [Improvement]: Refactor GEE Logs parsing in LogLine by @kingjia90 in https://github.com/pimcore/pimcore/pull/19261
- [Improvement]: Allow opting out of FOR UPDATE lock on hydration by @mcop1 in https://github.com/pimcore/pimcore/pull/19268
- 🔄 synced file(s) with pimcore/workflows-collection-public by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19259
- [Improvement] Make object cache write limit (maxWriteToCacheItems) configurable + log drops by @mcop1 in https://github.com/pimcore/pimcore/pull/19274
- [Improvement] Cache element permission checks per request by @mcop1 in https://github.com/pimcore/pimcore/pull/19275
- Added trigger branches by @bluvulture in https://github.com/pimcore/pimcore/pull/19280
- [Improvement] Make child list-permission checks sargable (getChildAmount/hasChildren) by @mcop1 in https://github.com/pimcore/pimcore/pull/19281
- [Improvement, EC] PEES-1253: Increase size of ownername column in object_relations by @kingjia90 in https://github.com/pimcore/pimcore/pull/19286
- 🔄 synced file(s) with pimcore/workflows-collection-public by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19282
- Add PR Guardrails trigger workflow by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19295
- Bump checkout to v5.0.1 by @bluvulture in https://github.com/pimcore/pimcore/pull/19301
- [Contracts] Add Pimcore\Contracts\PimcoreAgent namespace by @markus-moser in https://github.com/pimcore/pimcore/pull/19258
- [Contracts][PimcoreAgent] Initiator-owned MCP tool groups via resolver by @markus-moser in https://github.com/pimcore/pimcore/pull/19307
- Remove 12.3 from the scheduled CE->EE sync workflow by @robertSt7 in https://github.com/pimcore/pimcore/pull/19312
- [Task] Update outdated dependencies: scheb/2fa 8.6.1, phpdocumentor/reflection-docblock 6.0.3 + upgrade notes by @kingjia90 in https://github.com/pimcore/pimcore/pull/19313
- [Improvement]: Drop orphaned object brick / fieldcollection tables during maintenance by @kingjia90 in https://github.com/pimcore/pimcore/pull/19288
- Drop DOCS_GENERATOR_ACCESS_TOKEN from docs workflow, downgrade to pull_request by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19292
- Fix MySQL schema deprecation/risk warnings (internal-improvements#16) by @robertSt7 in https://github.com/pimcore/pimcore/pull/19320
- Add completion for
pimcore:bundle:(un)installby @matthiashamacher in https://github.com/pimcore/pimcore/pull/16932 - [Symfony 8] Add central Symfony 8 compatibility check by @herbertroth in https://github.com/pimcore/pimcore/pull/19332
- Deprecate passing custom renderlet params as attributes by @jdreesen in https://github.com/pimcore/pimcore/pull/19079
- Add arguments to the asset save version function by @kingjia90 in https://github.com/pimcore/pimcore/pull/19334
- [Telemetry] Server-side product telemetry by @martineiber in https://github.com/pimcore/pimcore/pull/19336
- [Telemetry] minor improvement by @martineiber in https://github.com/pimcore/pimcore/pull/19350
- Remove "name" from composer.json after create-project by @Jan-Walther-Basilicom in https://github.com/pimcore/pimcore/pull/18952
- Allow overriding MIME type detection per file extension by @cancan101 in https://github.com/pimcore/pimcore/pull/19136
- Run Codeception and PHPStan on 11.x pull requests by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19356
- [Telemetry] Usage providers can report unknown; drop core.datahub_enabled by @martineiber in https://github.com/pimcore/pimcore/pull/19357
- 🔄 synced file(s) with pimcore/workflows-collection-public by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19358
- Drop the composer-check matrix leg for the non-existent 11.5 branch by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19354
- Skip fileExists pre-check in getStreamedResponseForThumbnail by @cancan101 in https://github.com/pimcore/pimcore/pull/19135
- [Improvement] Don't read the localized query tables when inheritance is disabled by @kingjia90 in https://github.com/pimcore/pimcore/pull/19369
- Speed up getLatestVersion by avoiding a redundant query by @cancan101 in https://github.com/pimcore/pimcore/pull/19363
- [Improvement] Add NoteEvents::POST_DELETE dispatched on note deletion by @klemensusec in https://github.com/pimcore/pimcore/pull/19287
- Docs: correct NoteEvents summary after [#19287] by @jcPimcore in https://github.com/pimcore/pimcore/pull/19377
- Avoid per-language primary key lookups when saving localized fields by @robertSt7 in https://github.com/pimcore/pimcore/pull/19375
- Replace PR Policy with thin caller for reusable workflow by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19385
- [Docs][Requirements] Explain what each optional system dependency is actually used for by @laticrete-pimcore in https://github.com/pimcore/pimcore/pull/19318
- [#19057] Avoid thumbnail file I/O when dimensions can be calculated reliably by @Refaat-alktifan in https://github.com/pimcore/pimcore/pull/19382
- [Telemetry] Report raw counts instead of buckets by @martineiber in https://github.com/pimcore/pimcore/pull/19414
- Cache class definitions to prevent "Too many open files" error by @BlackbitDevs in https://github.com/pimcore/pimcore/pull/18509
- [Telemetry] Platform collector: seats, install scale and real workflow usage by @martineiber in https://github.com/pimcore/pimcore/pull/19417
- [Improvement] Allow custom HTML sanitizer implementation for WYSIWYG content by @dolmit-tanel-paaro in https://github.com/pimcore/pimcore/pull/18682
- Update target branch for bug fixes in PR template by @cancan101 in https://github.com/pimcore/pimcore/pull/19435
- [Task]: Remove non-existent 12.3 branch from composer check matrices by @kingjia90 in https://github.com/pimcore/pimcore/pull/19445
- [Telemetry] Core snapshot metrics from the gap list: workflow shape, queue, thumbnails, mime types, cache adapter by @martineiber in https://github.com/pimcore/pimcore/pull/19451
- [Telemetry] Platform: estimate unbounded volume tables instead of scanning them by @martineiber in https://github.com/pimcore/pimcore/pull/19453
- [DataObject] classes-rebuild: regenerate node-local PHP class files even when the database is already up-to-date by @cancan101 in https://github.com/pimcore/pimcore/pull/19359
- [Task] Remove the legacy admin controllers superseded by the Studio API by @kingjia90 in https://github.com/pimcore/pimcore/pull/19459
- [Feature]: Allow passing arguments to Calculated Value calculator by @cancan101 in https://github.com/pimcore/pimcore/pull/19138
- [Db] Add Helper::updateOrInsert() and use it where the core DAOs know the row exists by @cancan101 in https://github.com/pimcore/pimcore/pull/19424
- [security] GHSA-x347-3h85-7jh8: escape backslash in generated SelectOptions enum literals by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19443
- [security] GHSA-hf99-42jw-j5hp: reject bare callable controller references in editable rendering by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19450
- [security] GHSA-9r9j-g82w-9578: sanitize relation type strings in generated docblocks by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19448
- Search and Replace Assignments - images do not work by @ValeriaMaltseva in https://github.com/pimcore/pimcore/pull/19475
- [security] GHSA-4xrp-5ggg-fg5p: Asset::correctPath() denylist misses HTML/JS, allowing stored XSS via WebDAV by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19447
- [security] GHSA-8c9h-28x3-9f9f: SQL injection via classificationstore QuantityValue grid-filter value in HAVING clause by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19437
- [security] GHSA-rw66-cxfw-89c6: block INTO OUTFILE/DUMPFILE/LOAD_FILE in Custom Reports SQL adapter by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19444
- [security] GHSA-qfg9-rq74-hp35: DDL injection via unvalidated Date/Datetime/DateRange columnType by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19441
- [security] GHSA-9g27-c28m-8xg5: Stored XSS via Link editable — unescaped href path by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19392
- [security] GHSA-mwmm-cqj2-55wg: check restore permission before persisting recyclebin stub by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19482
- [security] GHSA-xj42-3gh9-g6jv: Require authentication for all WebDAV asset operations by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19491
- [security] GHSA-rg34-9gg8-7xmw: fix static page cache poisoning in StaticPageGeneratorListener by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19487
- [security] GHSA-4f8h-wfx8-wwmx: require authentication for site-isolation admin bypass by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19486
- [security] GHSA-wxm4-8fgm-hr2g: Fix open redirect via backslash in app.php SEO redirect by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19481
- [security] GHSA-2rmm-27mv-jwg5: fix DDL injection via StructuredTable column/row keys by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19479
- [security] GHSA-3fr4-hcrh-mwgh: Deactivate scheduled tasks whose user no longer exists by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19485
- [Bug] Resolve site for admin frontend requests after the session is attached by @markus-moser in https://github.com/pimcore/pimcore/pull/19501
New Contributors
- @klemensusec made their first contribution in https://github.com/pimcore/pimcore/pull/19287
- @laticrete-pimcore made their first contribution in https://github.com/pimcore/pimcore/pull/19318
- @Refaat-alktifan made their first contribution in https://github.com/pimcore/pimcore/pull/19382
Full Changelog: https://github.com/pimcore/pimcore/compare/v2026.2.14...v2026.3.0
