8.0.6 (2022-11-03)

Overview of merged pull requests

BUGFIX: Allow updating of entities related to value objects after persisting 

Fixes: #2870

Upgrade instructions

BUGFIX: disable invisible composer interaction in `./flow package:create <https://github.com/neos/flow-development-collection/pull/2926>`_

with #2571 <https://github.com/neos/flow-development-collection/issues/2571>``_was introduced, that the composer subcommand used by `./flow package:create`` hides its output. But using the ``new NullOutput()` doesn’t prevent any interaction initiated by composer such as the infamous:

> neos/composer-plugin contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins > Do you trust “neos/composer-plugin” to execute code and wish to enable it now? (writes “allow-plugins” to composer.json) [y,n,d,?]

the current problem is that composer asks this question but shows not output. So one has to blind input y without even knowing the question. This is perceived as bug but clearly a feature see #2757.

With this bugfix we use the official supported cli flag --quiet to archive the same as the NullOutput and furthermore disable any invisible requested interactivity.

in the above case instead of a question - an error will be thrown, which is understandable and fixable by the user:

> In PluginManager.php line 768: > neos/composer-plugin contains a Composer plugin which is blocked by your allow-plugins config. You may add it to the list if you consider it safe. > … > The installation was not successful. > Composer returned the error code: 1 > > Type: Neos\Flow\Package\Exception > Code: 1572187932 > File: Packages/Framework/Neos.Flow/Classes/Package/PackageManager.php > Line: 391 > > Open Data/Logs/Exceptions/202210221257240bfbde.txt for a full stack trace.

Upgrade instructions

Packages: Flow

BUGFIX: Make PdoBackend.rewind() on PostgreSQL work 

See: #2838

BUGFIX: Avoid errors when `./flow help is shown for an action without doc-block <https://github.com/neos/flow-development-collection/pull/2883>`_

The ./flow help command currently throws errors when rendering details for command that has no doc-block. Since modern php and flow need those doc-blocks less and less this should be supported aswell.

This change will return the argument name as description when no @param annotation is found for a parameter. This is not as helpful as a description but shows the parameter and avoids an unnecessary error.

Review instructions

Remove the doc comments from a cli-command and run ./flow help command:name … without this change the code will end throwing an exception.

Fixes: #2886
Packages: Flow

TASK: Render API docs (again)

This renders API docs (again), using Doctum via GH Actions.

The results are pushed to https://neos.github.io for consumption.

Review instructions

A test run result can be seen at https://neos.github.io/flow/8.2/index.html already. The workflow run is visible at https://github.com/kdambekalns/flow-development-collection/actions/runs/3233003582/jobs/5294292366

TASK: precompose hash to prevent timing attacks 

Precomposing a hash on cache warmup will make sure that the used hash to prevent timing attack always reflects the current configuration.

Previously there was a bcrypt password with the cost of 16 hard coded in but the configuration was set to 14 as default.

Fixes #3908 reported by @Benjamin-K

Packages: Flow

TASK: Improve command documentation 

Update the cli command example in the documentation to follow best practices. In commands, when showing a progress bar, using ->progressFinish() does not output a newline. This is intended, as it allows adding further text in the same line. However, the full command output - unless empty - should end with a newline.

See https://github.com/neos/neos-development-collection/issues/3894

Packages: Flow

TASK: Adjust Neos.DocTools settings 

See https://github.com/neos/doctools/pull/4

Packages: Flow