July 2026 Releases

Dependencies have been upgraded to address security issues, ensuring a safer and more reliable system.

The G141 (Organizing a page using headings) accessibility check recorded failures at the domain level but did not associate them with specific DOM elements in audited documents. As a result, document-level audit results did not expose the corresponding G141 issues.

Users could see G141 reported as a top failing technique in Accessibility Auditor domain summaries, but could not locate those failures when viewing individual document audit results. This made it difficult to investigate and remediate heading structure issues on affected pages.

The fix enhances the G141 technique implementation to detect likely unmarked section headings (for example, elements with title-like class names that are not marked up using h1–h6 elements or role="heading") and report element-level failures linked to specific documents.

G141 failures are now visible and locatable in Accessibility Auditor document audit views, with context about the affected element and remediation guidance. Users can reconcile domain-level G141 counts with per-document findings.

During the indexing step that generated auto-completion, spaces were removed when they followed a comma. The suggest.json endpoint returned suggestions that did not match the original indexed text.

The fix ensures that only leading spaces are removed, thereby forcing the text returned by the suggest.json endpoint to match the original indexed text.

The search analytics engine was capturing and logging the IP addresses of Cloudflare edge servers rather than the actual client IP addresses of the end users. Geographic location data was highly inaccurate. For example, traffic originating from a local university city (Auburn) was misattributed to Cloudflare data center hubs (such as Ashburn), skewing critical analytics reports down to a single visit.

The fix updates the internal analytics configuration to add the full range of Cloudflare IP subnets to the ignored IP ranges list. This forces the analytics engine to bypass the proxy headers and extract the real user location data. Location analytics now correctly bypass the edge network infrastructure, resulting in highly accurate geographic tracking that reflects the true physical locations of site visitors.

The SEO Auditor link information relied on an outdated iframe-and-modal architecture, which led to broken navigation paths. Furthermore, URLs in the ranking summary breadcrumb were being incorrectly double-encoded as %252F. Administrators were unable to reliably view or navigate link information details. The dialog window workflow was fragile, and using the breadcrumbs failed due to the broken URL encoding.

The fix introduces these key improvements:

With these improvements, the link information page now functions seamlessly within the Admin UI layout. It provides fully working deep links, browser-native behaviors (like Ctrl/Cmd+click to open in a new tab), and fluid in-panel drill-downs with operational back-button history.

Copying live URL values to the click tracking URL was missing. The Alter live URL plugin was updating the live and display URLs as expected, but the click tracking URL was not correct.

The added fix lets plugin config keys be shown or hidden based on the value of another key (showIfKeyHasValue). This change ensures that conditional logic works reliably when the associated key is referenced by schema ID (not just by key name) and improves value matching for booleans and arrays.

Click tracking URLs are now populated with the correct values, which restores the plugin’s expected behavior.

A delay between page requests is enforced to prevent Squiz Search crawlers from overloading CMS providers. Because this overload tolerance varies across CMS products, users can adjust the page crawl delay between the minimum and maximum values in the data source configuration.

The maximum possible value has been increased to 10 seconds, allowing clients to increase the delay and reduce requests to CMS providers with reduced crawler tolerance.

Invalid JSON characters caused the Content Auditor page to render invalid HTML. The invalid HTML caused a flow-on effect that prevented libraries controlling navigation from loading correctly.

The fix ensures that dynamic values are HTML-encoded when added to the Content Auditor page. The Content Auditor page now renders correctly, and JavaScript libraries load as expected.

The SEO Auditor tool was configured to look up and evaluate metrics only for the exact URL specified in a page’s canonical tag, rather than using the actual source URL processed by the indexer. For content containing canonical URLs, the SEO Auditor failed to retrieve data for Total words, Unique words, and Fully-matching results, leaving these analytical metrics broken or empty.

The lookup logic in the SEO Auditor was updated to attempt to match the data against both the canonical URL and the actual indexer URL. SEO auditing metrics like word counts and matching results now accurately display and calculate for all indexed pages, regardless of whether a canonical URL is defined.

The related safe edit and workflow statuses were not being used in the 'Marked for deletion' logic. This meant that components marked for deletion as part of a workflow would not be visible after applying for approval or being approved (prior to going live).

The related statuses are now used in the 'Marked for deletion' logic. When a component is marked for deletion, it will display the red warning above, as it would outside of a workflow.

The container for the Viper insert image form was not responsive when the screen size decreased. When the screen reached small sizes (for example, a standard laptop screen at 130% zoom), the bottom section of the form was not accessible, and importantly, the 'Upload Image' button.

The height is now dynamically calculated and is responsive to the screen size; the overflow on the vertical axis is now accounted for. Vertical overflow on small screens for insert image functionality will now be scrollable when the form does not fit on the screen.

During asset creation, the live status relative to the published status was not checked. Components under a live page (which are immediately live after creation) would not receive a 'Last Published' timestamp or user value.

Values are assigned to 'Last Published' when the component being created will be live. Components created under live pages will receive 'Last Published' values.

These values were not updated/properly decoded during a previous platform update that changed the encoding. Apostrophes would be encoded but not decoded before the values were rendered on the frontend.

The values are now decoded correctly, aligning with the previous platform update to encoding. Apostrophes will be rendered as their decoded value on the frontend (for example,').

When Set File Contents triggers expand any globals and keywords for large templates (for example, sitemap generation), the full file body is built in memory before it is written. For multi-megabyte outputs, this drives peak memory usage well above one gigabyte during cron processing.

Cron jobs can fail or require oversized cron instances for sites that generate large files via triggers. Scheduled updates to large text files become unreliable.

Set File Contents and listing engine output now use a streaming path that writes expanded content incrementally instead of holding the full string in memory. Large file writes via triggers use significantly less peak memory, improving cron reliability without requiring larger cron instances.

This is available on the trigger action 'Set File Contents' under 'Streamed file generation'.

When an asset was morphed into a different asset type, the system renamed the attribute value rows to match the new type. If a row for the target attribute already existed on the asset, the database update failed with a duplicate key error in the attribute value table. Morph operations subsequently failed for affected assets. This failure could block SAML login flows that morph a user on login, preventing those users from accessing the admin interface.

Asset morph now detects when the target attribute row already exists and skips the attribute ID rename for that attribute instead of attempting a conflicting update. Morph completes successfully for assets with duplicate target attribute rows, restoring SAML login morph triggers and manual morphs. Affected assets may still retain orphan attribute rows that require one-off cleanup.

A method was added to the Asset Management API that automatically contextualizes asset attribute values and metadata for the requested context if they don’t exist.

This lets you set asset attributes and metadata on a context regardless of whether the asset has been previously contextualized for that context.

The SOAP API did not provide a way to contextualize assets, meaning assets had to already be contextualized before data could be edited in a specific context.

SquizImage fields could not be preset with a default placeholder image.

This minor improvement introduces a Creative Commons asset library seeded with a default placeholder image and exposes it to Page Builder through the Spark configuration, allowing SquizImage fields to be preset with the image.

Moving content on a template from a layout zone to a different zone, and changing the original zone to page-managed. Pages using this template would show the moved content node duplicated in both the original and destination zones.

On the page, only show the moved content in the zone it was moved to. Pages no longer have duplicated content.

It can sometimes be difficult to keep track of how the zones in a content template are configured.

Icons have been added to every zone-type highlight to remind editors how a zone is configured without opening settings.

When adding unused content while processing layout zone changes (for example, a deleted layout zone) on a templated page, existing partial layouts from template reflow were not considered.

The grouping and styling of unused content items and their associated "reasons" were incorrect or lacked polish.

The processing layout zone changes now handle this combination of unused content from different sources. Content items are now grouped correctly in unused content and display with the correct text color.