Neos Bugfix Release: 8.3.26, 9.0.5

[ahaeslich (Anke Häslich)]

We are happy to announce the availability of Neos 8.3.26 and 9.0.5

Contributors

Thanks to all contributors who made this release possible:

• baschny
• crydotsnake
• dlubitz
• grebaldi
• mhsdesign
• paulofabricio
• Sebobo
• skurfuerst
• tygyh
• ahaeslich

Neos 8.3.26

• SECURITY: Updated SVG sanitization library to address CVE-2025-55166
• BUGFIX: Fixed node inspector reload issue when hidden state is updated
• TASK: Added autofocus to username field on backend login screen
• TASK: Improved backend module link hover styling
• TASK: Updated CSS assets build

Full Changelog

You can find the full changelog here: Comparing 8.3.25…8.3.26

Neos 9.0.5

• SECURITY: Updated SVG sanitization library to address CVE-2025-55166
• FEATURE: add more details to user list and user show
  command
• BUGFIX: backend module links with no hover
  color
• BUGFIX: Reload node if hidden state is updated via
  inspector
• BUGFIX: Neos backend login autofocus
  username
• BUGFIX: adjust flow structureadjustments:fix command formatting in node helper
  exception
• BUGFIX: Use label helper in Debug.Console
  object
• BUGFIX: Expose internal CRBehavioralTestsSubjectProvider via
  Neos.ContentRepository.TestSuite
• BUGFIX: Standalone subscription store via
  Neos.ContentRepository.Dbal
• BUGFIX: Standalone Core - move AuthProviderFactoryInterface to correct
  packgage
• BUGFIX: Use cached node uris
• BUGFIX: Convert *DateTime XML elements to DateTimeImmutable during
  import
• TASK: Prevent neos/contentrepository-testsuite to define the phpunit
  version
• TASK: Update terminology to use ‘allowlist/denylist’ in
  ContentDimensionConstraints

Full Changelog

You can find the full changelog here: Comparing 9.0.4…9.0.5