Repository navigation
Releases: evolution-cms/evolution
Release list
Nightly 3.6.x (2026-11-03)
Automated build of 3.6.x at fb8d1df.
Pre-installed Evolution CMS on sqlite — unpack into a docroot and open it, no database server needed.
Manager: admin / Passw0rd123
A testing build with published credentials. Not for production.
Nightly 3.5.x (2026-11-03)
Automated build of 3.5.x at 20d14aa.
Pre-installed Evolution CMS on sqlite — unpack into a docroot and open it, no database server needed.
Manager: admin / Passw0rd123
A testing build with published credentials. Not for production.
Evolution CMS 3.5.9
Evolution CMS 3.5.9 is a security, performance, and reliability release for the 3.5 branch. This version strengthens Manager access controls, speeds up resource editing, improves backup and package workflows, and adds more flexible update options.
Added
- Support for updating to nightly builds or a specific branch from a custom repository.
- Dependency preflight checks to prevent custom packages from unexpectedly overriding bundled core dependencies.
- Optional sTask-powered backups with gzip compression and progress tracking.
- File-backed chunk storage, with database storage deprecated.
- Role-based restrictions for running specific modules.
- Project version and repository links in the Manager, using deployment metadata.
- Directory cloning and link display in the file manager.
- Vertically resizable CodeMirror editors.
- getTemplateVarValues() for reading template variables from multiple resources.
- Slovak Manager localization.
Security
- Fixed SQL injection paths in resource tree sorting, TV filters, and identifier quoting.
- Prevented PHP code injection through element names in the site cache.
- Restricted executable TV bindings and template saves to users with the appropriate code execution privileges.
- Hardened file bindings, filesystem access checks, and symlink handling.
- Fixed routing module authentication bypass, dashboard XSS, and tag injection.
- Expanded CSRF protection for Manager operations, including logout, module dependency changes, and OPcache reset.
- Strengthened file manager and media browser permissions, upload validation, and token checks.
- Added safeguards for administrator removal, redirects, web installation, and web updates.
- Sandboxed resource previews and aligned Apache protection rules with the nginx configuration.
- Updated bundled dependencies, including Composer 2.10.3 addressing CVE-2026-84361.
Performance
- Reduced database queries during resource saves and resource tree loading.
- Switched resource saves to AJAX, eliminating an additional page request.
- Deferred cache refresh after resource saves.
- Stopped resetting OPcache and purging compiled views on every resource save.
- Added bootstrap configuration caching and automatic rebuilding after deployment path changes.
- Deferred Manager view and theme initialization on frontend requests.
- Reduced template variable loading overhead.
- Restored native MySQL dump performance and improved database timing diagnostics.
Fixed
- Composer package operations now run in a separate process, with rollback handling for failed installations.
- Fixed missing-provider errors after package removal and improved package update scoping.
- Improved error reporting on hosting environments with disabled process execution functions.
- Fixed installation failures when configuration files cannot be written.
- Corrected version reporting after upgrades and cleaned up artifacts from older CLI installations.
- Fixed controller execution for explicitly selected template files.
- Fixed resource overview errors when the assigned template has been deleted.
- Corrected PostgreSQL resource saves involving TV ordering.
- Fixed drag-and-drop resource moves, including closure table updates, cache refresh, and permission checks.
- Fixed upload limit handling, mobile file manager controls, and legacy controller theme compatibility.
- Fixed dashboard activity formatting errors caused by ICU timezone handling.
- Isolated temporary backup files and hardened SQL dump metadata handling.
Updated
- Replaced SimplePie with dg/rss-php.
- Removed the obsolete Flash-based uploader.
- Improved translations for upload limits and archive operations.
- Expanded CI checks to PHP 8.5 and added experimental PHP 8.6 RC coverage.
Upgrade Notes
- Back up your database and files before updating.
- Review custom integrations that use executable TV bindings, filesystem access, or Manager permissions, as these checks are stricter in this release.
- Custom package dependency updates require explicit opt-in with --update-custom-packages.
- Include file-backed chunk files in your deployment and backup workflows.
- PHP 8.6 RC coverage is experimental and does not imply production support.
Evolution CMS 3.5.8
Evolution CMS 3.5.8
Evolution CMS 3.5.8 is a security, stability, and developer experience release for the 3.5 branch. This version hardens Manager requests, improves package/update workflows, adds stronger mail diagnostics, and expands CI coverage across modern PHP runtimes.
Highlights
- Added stricter CSRF protection for Manager actions, including legacy mutating GET actions
- Improved Manager tab restoration after login and CSRF token rotation
- Hardened security around unserialize usage, PHx,
@FILE, stored/reflected XSS vectors, empty hash login, and upgrade transport - Added template source support for database/file based template processing
- Added mail test tools, SMTP certificate verification controls, and better delivery diagnostics
- Improved package tooling with vendor publish manifest tracking and transitive dependency reporting
- Added IANA site timezone setting and improved event log timezone/actor display
- Improved Docker, installer, upgrade smoke tests, and CI coverage for PHP 8.3, 8.4, and 8.5
- Updated bundled Composer dependencies
Compatibility Note: CSRF Protection
Evolution CMS 3.5.8 tightens CSRF validation in the Manager. Some third-party or legacy packages may fail with a CSRF token mismatch error if they submit Manager forms, links, or AJAX requests without passing the current _token value or X-CSRF-TOKEN header.
The recommended fix is to update the package code to include csrf_field(), csrf_token(), or the X-CSRF-TOKEN header in Manager requests.
If a third-party package blocks access and you need a temporary compatibility workaround, comment line 76 in core/src/Middleware/VerifyCsrfToken.php:
// return $this->reject($request);This disables the CSRF rejection response, so use it only as a short-term workaround until the affected package is updated.
The session token has changed or is missing. Reopen the manager, then review and retry your action. The action was not performed.
Evolution CMS 3.5.7
Evolution CMS 3.5.7 is a maintenance and stability release focused on safer updates, improved manager usability, more reliable backups, and cleaner developer experience.
Added
- Added a manager site update flow with improved handling for core migrations, Composer steps, custom packages, branch-based updates, and post-update reload behavior.
- Added database backup support before manager-driven updates.
- Added directory ZIP downloads in the file manager.
- Added autocomplete support for
@bindings in TVs, chunks, and snippets in CodeMirror. - Added OPcache and JIT status to the system information screen.
- Added the
niceCount()helper for compact quantity formatting. - Added support for module-controlled resource tree visibility.
- Added EvoUI manager support.
- Added vendor publish symlink support.
- Added optional per-user image upload base directory setting for the file browser.
Fixed
- Improved consistency between CLI, manager, and installer update flows.
- Fixed repeated updates so custom packages are preserved correctly.
- Fixed Composer handling during site updates, including Composer binary resolution and avoiding unintended package updates.
- Fixed SQLite backup restore with serialized settings.
- Fixed SQL backup and restore handling to preserve string delimiters and reduce overhead.
- Fixed snapshot consistency and SQLite snapshot paths containing colons.
- Fixed stale resource lock cleanup and sanitized resource lock alerts.
- Fixed scheduled publish date handling so scheduled and actual publish dates stay separate.
- Fixed manager view option spacing, datepicker icon behavior, module tabs, manager icons, and theme chrome alignment.
- Fixed dark theme readability for Store version options.
- Fixed localization typos and synchronized reported localization keys.
- Fixed database host port syntax and clarified database collation warnings during installation.
- Fixed migration consistency for update paths and PostgreSQL system task migrations.
- Fixed helper loading order and bootstrap cache path handling.
Updated
- Updated bundled vendor dependencies.
- Refreshed the Store module and Extras update metadata.
- Renamed manager news/RSS wording to release-oriented labels.
- Improved updater language strings and update confirmation text.
- Removed the old Store self-update banner.
Upgrade Notes
This release is recommended for all Evolution CMS 3.5.x users.
The update flow received significant internal improvements. As always, make a full database and filesystem backup before upgrading production projects, especially when using custom Composer packages or custom update branches.
Evolution CMS 3.5.6
[2106997] - [FIX] Keep the light theme toggle out of the active state. (middle:Duck)
[6c1a94b] - [FIX] Prevent zero-size dump batches for small tables. (middle:Duck)
[8d8dcdd] - [FIX] Replace redundant roles logout and view developers list with dashboard widgets recent changes and online users view roles. (Artur Kyryliuk)
[1aff71a] - [FIX] Fixed semi-transparency making protected resource titles hard to read. (Artur Kyryliuk)
[8ca05ab] - [FIX] Keep lightness active menu items readable. (middle:Duck)
[9f3f064] - [FIX] Remap dashboard widget permissions during updates. (middle:Duck)
[d3ff323] - [FIX] Bootstrap legacy tree state for TinyMCE4 link dialogs. (middle:Duck)
[bb537a0] - [UPD] Guard file_groups creation in migrations. (middleDuckAi)
[35b4820] - [DEL] Liquid draft theme. (middle:Duck)
[09f072f] - [UPD] Refresh Store module for 0.2.0. (middleDuckAi)
[a4188e5] - [UPD] Polish Store UI follow-ups. (middleDuckAi)
[b42873e] - [UPD] Restore TinyMCE4 legacy API compatibility. (middleDuckAi)
[de3cef1] - [UPD] Add legacy Store delete flow and UI polish. (middleDuckAi)
[8cec37b] - [REF] Stabilize Store runtime task flows and installed-state handling. (middleDuckAi)
[652631c] - [UPD] Cache console catalog and unify initial load. (middleDuckAi)
[b361c6a] - [UPD] Align catalog loader with Evo default style. (middleDuckAi)
[6f019f1] - [UPD] Remove custom catalog loader and align layout. (middleDuckAi)
[ddfa745] - [UPD] Remove module version from title. (middleDuckAi)
Evolution CMS 3.5.5
[d027f4d] - [REF] Finalized the MODX_* to EVO_* compatibility transition and prepared legacy constants for removal. (Seiger)
[8b0e83a] - [ADD] Added resource group ACL management for the file and image managers. (Artur Kyryliuk)
[dd7e331] - [ADD] Added deprecated:list command to find code marked for removal by semantic version. (Artur Kyryliuk)
[550cf13] - [FIX] TransAlias now uses the current manager language for alias transliteration. (middle:Duck)
[01e4267] - [FIX] Preserved explicit TransAlias table overrides when custom table settings are used. (middle:Duck)
[d4dfcb9] - [FIX] Preserved portable path settings when saving system configuration. (middle:Duck)
[6f77af6] - [FIX] Prioritized KCFinder callbacks over TinyMCE fallback in the file browser flow. (middle:Duck)
[a6ff481] - [FIX] Prevented moving documents into deleted resources from the manager tree. (middle:Duck)
[63f3bd5] - [FIX] Resolved an internal forward loop that could break request processing. (Seiger)
[44ab3f4] - [REF] Updated Composer dependencies, improved tests, and fixed multiple PHP 8.4 deprecation warnings. (Artur Kyryliuk)
Evolution CMS 3.5.4
Evolution CMS 3.5.3
[032c5dd] - [ADD] Automatic register alias config file for custom packages. (Seiger)
[e46ec54] - [ADD] Laravel session compatibility layer through EvoSessionProxy and middleware integration. (Dmi3yy)
[6ded2cb] - [ADD] Initialize Laravel session support in manager via EvoSessionProxy. (Dmi3yy)
[8541461] - [ADD] SQLite to the web installer. (Elcreator)
[b3db5ce] - [ADD] Init new theme liquid. (Dmi3yy)
[243020b] - [ADD] Introduce refined tab and popup styles, update theme variables, and adjust menu padding for improved UI consistency. (Dmi3yy)
[7857ee8] - [ADD] Add SqliteDumper class and integrate SQLite backup support into database management actions. (Dmi3yy)
[60da28d] - [ADD] Preset install command. (Dmi3yy)
Full Changelog: 3.5.2...3.5.3
Evolution CMS 3.5.2
Merge remote-tracking branch 'origin/3.5.x' into 3.5.x