August 2026 Releases

Dependencies have been upgraded to address security issues, ensuring a safer and more reliable system.

The G141 (Organizing a page using headings) accessibility check recorded failures at the domain level but did not associate them with specific DOM elements in audited documents. As a result, document-level audit results did not expose the corresponding G141 issues.

Users could see G141 reported as a top failing technique in Accessibility Auditor domain summaries, but could not locate those failures when viewing individual document audit results. This made it difficult to investigate and remediate heading structure issues on affected pages.

The fix enhances the G141 technique implementation to detect likely unmarked section headings (for example, elements with title-like class names that are not marked up using h1–h6 elements or role="heading") and report element-level failures linked to specific documents.

G141 failures are now visible and locatable in Accessibility Auditor document audit views, with context about the affected element and remediation guidance. Users can reconcile domain-level G141 counts with per-document findings.

During the indexing step that generated auto-completion, spaces were removed when they followed a comma. The suggest.json endpoint returned suggestions that did not match the original indexed text.

The fix ensures that only leading spaces are removed, thereby forcing the text returned by the suggest.json endpoint to match the original indexed text.

The search analytics engine was capturing and logging the IP addresses of Cloudflare edge servers rather than the actual client IP addresses of the end users. Geographic location data was highly inaccurate. For example, traffic originating from a local university city (Auburn) was misattributed to Cloudflare data center hubs (such as Ashburn), skewing critical analytics reports down to a single visit.

The fix updates the internal analytics configuration to add the full range of Cloudflare IP subnets to the ignored IP ranges list. This forces the analytics engine to bypass the proxy headers and extract the real user location data. Location analytics now correctly bypass the edge network infrastructure, resulting in highly accurate geographic tracking that reflects the true physical locations of site visitors.

The SEO Auditor link information relied on an outdated iframe-and-modal architecture, which led to broken navigation paths. Furthermore, URLs in the ranking summary breadcrumb were being incorrectly double-encoded as %252F. Administrators were unable to reliably view or navigate link information details. The dialog window workflow was fragile, and using the breadcrumbs failed due to the broken URL encoding.

The fix introduces these key improvements:

With these improvements, the link information page now functions seamlessly within the Admin UI layout. It provides fully working deep links, browser-native behaviors (like Ctrl/Cmd+click to open in a new tab), and fluid in-panel drill-downs with operational back-button history.

Copying live URL values to the click tracking URL was missing. The Alter live URL plugin was updating the live and display URLs as expected, but the click tracking URL was not correct.

The added fix lets plugin config keys be shown or hidden based on the value of another key (showIfKeyHasValue). This change ensures that conditional logic works reliably when the associated key is referenced by schema ID (not just by key name) and improves value matching for booleans and arrays.

Click tracking URLs are now populated with the correct values, which restores the plugin’s expected behavior.

A delay between page requests is enforced to prevent Squiz Search crawlers from overloading CMS providers. Because this overload tolerance varies across CMS products, users can adjust the page crawl delay between the minimum and maximum values in the data source configuration.

The maximum possible value has been increased to 10 seconds, allowing clients to increase the delay and reduce requests to CMS providers with reduced crawler tolerance.

Invalid JSON characters caused the Content Auditor page to render invalid HTML. The invalid HTML caused a flow-on effect that prevented libraries controlling navigation from loading correctly.

The fix ensures that dynamic values are HTML-encoded when added to the Content Auditor page. The Content Auditor page now renders correctly, and JavaScript libraries load as expected.

The related safe edit and workflow statuses were not being used in the 'Marked for deletion' logic. This meant that components marked for deletion as part of a workflow would not be visible after applying for approval or being approved (prior to going live).

The related statuses are now used in the 'Marked for deletion' logic. When a component is marked for deletion, it will display the red warning above, as it would outside of a workflow.

The container for the Viper insert image form was not responsive when the screen size decreased. When the screen reached small sizes (for example, a standard laptop screen at 130% zoom), the bottom section of the form was not accessible, and importantly, the 'Upload Image' button.

The height is now dynamically calculated and is responsive to the screen size; the overflow on the vertical axis is now accounted for. Vertical overflow on small screens for insert image functionality will now be scrollable when the form does not fit on the screen.

During asset creation, the live status relative to the published status was not checked. Components under a live page (which are immediately live after creation) would not receive a 'Last Published' timestamp or user value.

Values are assigned to 'Last Published' when the component being created will be live. Components created under live pages will receive 'Last Published' values.

These values were not updated/properly decoded during a previous platform update that changed the encoding. Apostrophes would be encoded but not decoded before the values were rendered on the frontend.

The values are now decoded correctly, aligning with the previous platform update to encoding. Apostrophes will be rendered as their decoded value on the frontend (for example,').

When Set File Contents triggers expand any globals and keywords for large templates (for example, sitemap generation), the full file body is built in memory before it is written. For multi-megabyte outputs, this drives peak memory usage well above one gigabyte during cron processing.

Cron jobs can fail or require oversized cron instances for sites that generate large files via triggers. Scheduled updates to large text files become unreliable.

Set File Contents and listing engine output now use a streaming path that writes expanded content incrementally instead of holding the full string in memory. Large file writes via triggers use significantly less peak memory, improving cron reliability without requiring larger cron instances.

This is available on the trigger action 'Set File Contents' under 'Streamed file generation'.

When an asset was morphed into a different asset type, the system renamed the attribute value rows to match the new type. If a row for the target attribute already existed on the asset, the database update failed with a duplicate key error in the attribute value table. Morph operations subsequently failed for affected assets. This failure could block SAML login flows that morph a user on login, preventing those users from accessing the admin interface.

Asset morph now detects when the target attribute row already exists and skips the attribute ID rename for that attribute instead of attempting a conflicting update. Morph completes successfully for assets with duplicate target attribute rows, restoring SAML login morph triggers and manual morphs. Affected assets may still retain orphan attribute rows that require one-off cleanup.

A method was added to the Asset Management API that automatically contextualizes asset attribute values and metadata for the requested context if they don’t exist.

This lets you set asset attributes and metadata on a context regardless of whether the asset has been previously contextualized for that context.

The SOAP API did not provide a way to contextualize assets, meaning assets had to already be contextualized before data could be edited in a specific context.

SquizImage fields could not be preset with a default placeholder image.

This minor improvement introduces a Creative Commons asset library seeded with a default placeholder image and exposes it to Page Builder through the Spark configuration, allowing SquizImage fields to be preset with the image.

Moving content on a template from a layout zone to a different zone, and changing the original zone to page-managed. Pages using this template would show the moved content node duplicated in both the original and destination zones.

On the page, only show the moved content in the zone it was moved to. Pages no longer have duplicated content.

It can sometimes be difficult to keep track of how the zones in a content template are configured.

Icons have been added to every zone-type highlight to remind editors how a zone is configured without opening settings.

When adding unused content while processing layout zone changes (for example, a deleted layout zone) on a templated page, existing partial layouts from template reflow were not considered.

The grouping and styling of unused content items and their associated "reasons" were incorrect or lacked polish.

The processing layout zone changes now handle this combination of unused content from different sources. Content items are now grouped correctly in unused content and display with the correct text color.

The event that creates an AVH entry was not being listened for in the cron run. Setting a scheduled status change (through the Add future status feature on the Details screen) for an asset would not be reflected in the Asset Version History.

The fix ensures that the Cron Manager listens to events prior to running. Updating an asset’s status through the Add future status feature will now be reflected on the Asset Version History screen.

The asset linking logic with the Asset Management API did not update lookups after moving an asset link.

This caused the newly moved asset to have an incorrect URL associated with it on the URLs screen.

The fix ensures lookups are now updated as part of moving an asset link.

Custom Forms submit through POST. After a successful submission, you can use the back button to return to the form or confirmation page while still showing the values entered. The submission session is not cleared on that navigation.

Submitted form data can remain visible on the frontend after you navigate back. On Custom Forms with a confirmation page, users can see their entered values and submit the form again without re-entering data. This can expose sensitive information and allow unintended duplicate submissions.

Added optional Post-Redirect-Get for Custom Forms. Two new settings are available on the Form Contents  Details screen:

When enabled, the form redirects to a GET URL after successful submission and stores the thank-you page content in the session. Browser back navigation shows the cached thank you content instead of editable form fields for the configured TTL.

Editors can enable Post-Redirect-Get on Custom Forms where submitted data must not reappear after browser back navigation. Existing forms remain unchanged until the setting is enabled.

The http_request attribute rendered request header values in clear text on the REST resource asset Details screen for users who did not hold the attribute lock. Users without the attributes lock were able to view sensitive header values, such as API keys or bearer tokens, stored on rest resource assets.

Request header values on the rest resource details screen are now obscured unless the current user holds the attributes lock on the asset. Users without the attributes lock see obscured header values on the REST Resource Details screen. Users who hold the lock can view and edit header values as before.

To avoid session fixation attacks, session_regenerate_id is called during sign-in.

On the default session driver, this results in an empty session. Therefore, on the merge session, the values that have not changed in the current request are removed.

Empty sessions are now detected during merge, which preserves existing values. Session variables are not lost after running session_regenerate_id().

The nested layout block was replaced in unused content when the zone removal reason was assigned. The missing block reason was assigned to another zone, and the same affected layout was lost.

The fix ensures that if the affected nested layout block is already in unused content, the zone removal reason is added to this existing block.

Both the missing block reason and the missing zone reason now appear in unused content on the affected layout, and no page content is lost.

Layouts now have the same visual treatment as Text and Component content items, which results in a cohesive experience for content editors.

Previously, it was difficult to visually identify Layouts within Page Builder, especially when sitting alongside other content items in the Page Outline panel. This issue was compounded when multiple levels of nesting were introduced.

Dependencies have been upgraded to address security issues, ensuring a safer and more reliable system.