9.2.0-beta1 (2026-06-30)

Overview of merged pull requests

FEATURE: Add setting for encryption key 

With this the encryption key can be defined in a setting. When defined it is not received from cache anymore.

```yaml Neos:

Flow:

security:

cryptography:
encryptionKey: ‘something-random-usually-40-chars-long’

```

Ideally set this from an environment variable, so it doesn’t have to be in your codebase…

Resolves: #3425

Upgrade instructions

None – but feel free to use the new feature. For existing projects, set the encryption key to the value found in the cache, Data/Persistent/Cache/Data/Flow_Security_Cryptography_HashService/encryptionKey usually.

Review instructions

Set the new setting to a non-empty string and see that \\Neos\\Flow\\Security\\Cryptography\\HashService::generateHmac() returns a Hmac generated with your new encryption key.

Packages: Flow

FEATURE: Runtime Constructor Injection 

This changes constructor injection to happen at runtime by the ObjectManager. That means the constructor no longer needs to be proxied and loose it’s signature (Any other proxying happening, eg. AOP or other injection types will retain the signature now). It therefore also reduces the amount of proxies necessary in a project. Additionally to proof how this works some of the core classes now use exclusively constructor injection. The change also includes refactorings for type safety around the object configuration and proxy building.

NOTE This obviously breaks instantiating classes with constructor injection via new MyClass() omitting any arguments. IMHO that is very bad practice anyhow. As can be seen in this change (and I didn’t see anything in Neos either), it was only used in tests as of now. I think therefore we can relatively safely change this in a minor release?

Packages: .github Flow

FEATURE: Enable Xdebug Path Mapping in Development context per default 

Enables the Xdebug Path Mapping per default in Development context.

See: https://github.com/neos/flow-development-collection/pull/3535

Packages: Flow

FEATURE: Add fromClassAndMethodName() to LogEnvironment 

This does some code cleanup and adds a new method fromClassAndMethodName($className, $methodName) to the LogEnvironment.

It be used like this:

LogEnvironment::fromClassAndMethodName(__CLASS__, __METHOD__)

and will return useful data – as opposed to LogEnvironment::fromMethodName(__METHOD__), which only works for static methods (SomeClass::someMethod or closures).

Packages: Flow

BUGFIX: Handle objects without name in argument configuration parsing 

Instead of throwing an exception when an argument configuration contains no name, create a synthetic virtual object name derived from a configuration hash. This handles edge cases encountered with global Objects.yaml configurations.

Packages: Flow

BUGFIX: Reuse singleton instance when requested by interface 

When a singleton was first requested by its implementation class name, subsequent requests by its interface name would create a new instance instead of reusing the existing one.

The ObjectManager now detects this case and returns the already-existing instance, preserving singleton semantics for both class name and interface name lookups.

Also removes the restriction that prevented building proxy classes for classes implementing interfaces with a constructor declaration, and guards ProxyClassBuilder’s parent-advice lookup against base classes without a parent.

Packages: Flow

BUGFIX: Allow encryptionkey to be empty in schema validation 

Fixes validation issues in pipeline due to #3426

Packages: Flow

BUGFIX: Context aware path mapping for xdebug 

This PR generates the mapping files per FlowContext. This ensures the mapping works even after context switching.

Replaces #3562

Packages: Flow

BUGFIX: Always serialize the RelatedEntitesContainer in proxies 

Packages: Flow

BUGFIX: fix exception message in ObjectSerializationTrait 

follow up to https://github.com/neos/flow-development-collection/pull/3510
adjust exception message to show with class caused the error

Packages: Flow

BUGFIX: Declare implicitly nullable argument as actually nullable 

To make phpstan happy in php 8.4 and 8.5

Packages: .github Flow

BUGFIX: `#[FlowRoute] Annotation unset @subpackage instead of null <https://github.com/neos/flow-development-collection/pull/3540>`_

There is an inconsistency with defined routes which can lead to not properly working resolving, so we herby leave out the @subpackage declaration as it should be instead of specifying the key without value.

If a route is defined manually configuration following things are logged in routes:match

``` Name: My.Api :: Configuration Pattern: api/news

Results:: @package: My.Api @controller: News @action: getNews

Matched Controller: … ```

But the result is different when using the RouteAnnotation, then the @subpackage is apparently set which again can confuse the resolving.

``` Name: My.Api :: News :: getNews Pattern: api/news

Results:: @package: My.Api @subpackage: @controller: News @action: getNews @format: html

Matched Controller: … ```

I found out that during resolving the @subpackage must be set explicitly to an empty string and cannot be left out or set to null.

Upgrade instructions

Packages: Flow

BUGFIX: Support never return types in AOP proxies 

This adjusts proxy class building for AOP proxies so that the generate code correctly advises methods which have a “never” return type.

Resolves: #3451
Packages: Flow

BUGFIX: Retain original PDO exceptions in Query 

This helps debugging, otherwise important debugging information can get lost with the original exception.

Packages: Flow

BUGFIX: Check foreign keys explicit before removal 

After fixing `#3543 <https://github.com/neos/flow-development-collection/issues/3543>`_we introduced an incompatibility with MySQL 8.x. This replaces the proprietary “IF EXISTS” with explit check of FK existence to be compatible with both databases.

It also added the MySQL database to the ci pipeline.

Packages: Flow .github

BUGFIX: Remove unused variable assignment 

Fixes https://github.com/neos/flow-development-collection/issues/3395

Without the fix, there are warnings in current PHP versions.

Packages: Flow

BUGFIX: out of memory error when using AbsorbingHandler 

Exceptions while rendering error stack traces no longer exhaust all memory and crash.

Resolves https://github.com/neos/flow-development-collection/issues/3487

Review instructions

You find details in https://github.com/neos/flow-development-collection/issues/3487

~~Tests have been created, run and adjusted as needed~~
[x] The PR is created against the lowest maintained branch
- bug was introduced in _9.0_
[ ] Reviewer - PR Title is brief but complete and starts with FEATURE|TASK|BUGFIX
[ ] Reviewer - The first section explains the change briefly for change-logs
[ ] Reviewer - Breaking Changes are marked with !!! and have upgrade-instructions

Packages: Flow

BUGFIX: Add debug info to exception if backend creation fails 

we use setProperties in the AbstractBackend to map all options to the backend class. Now there might be a setter for that option but the value is not guaranteed to match the type.

Now a type error is thrown which itself doesnt give a hint where something is wrong:

> Neos\Cache\Backend\RedisBackend::setHostname(): Argument `#1 <https://github.com/neos/flow-development-collection/issues/1>`_($hostname) must be of type string, false given

I have encountered this many times especially in combination with Caches configured with env variables that are not set and thus false.

Upgrade instructions

Packages: Flow Cache

BUGFIX: build correct node uri for multisite setup for localhost 

When using a multi-site setup and linking from one site to another, the uri generation in development does not work correctly.

Scenario: I have a neos site “main” with domain localhost, and “other” at domain other.localhost and want to link a node from main on other.

Expected behaviour: The generated link points to “localhost/some-node”

Actual behaviour: The generated link points to “other.localhost/some-node”

Changes: check if CONSTRAINT_HOST has been set before falling back to base uri

Upgrade instructions There should be no breaking changes

Review instructions -

Packages: Flow

BUGFIX: Explicitly normalize FK constraint names after table renames for MariaDB 12 compatibility 

MariaDB 12.x stopped auto-renaming InnoDB FK constraint names during RENAME TABLE. Two migrations that rename the resource_resource table were followed by downstream migrations expecting the new constraint name — which never materialized on MariaDB 12.x.

To get both versions working we now drop both possible index-name versions directly after the rename and recreate the index with the new - expected name.

For better visibility, consitency and support I also changed the pipeline: * Add build configurations for PHP 8.5 with MariaDB 12.3 and Postgres 18 * Change default version for MariaDB to latest LTS 11.8

Fixes: #3543
Packages: Flow .github

BUGFIX: Replace outdated postgresql-action with docker command 

The github action harmon758/postgresql-action@v1 is outdated and doesn’t work with the current docker version anymore. So it needs to get replaced.

Packages: .github

BUGFIX: Remove singleton annotation on validators 

Fixes: #2879

The validators are not meant to be singleton. The singleton annotations causes issues if you try to set options via Flow\\Validate annotation or try to create a validator with ValidatorResolver->createValidator().

Technically a singleton would work for validators without options. But the advantage in not constructing them every time, seems to be negligible.

Packages: Flow

BUGFIX: Pass through enum mapping to ORM 

This change allows to use the enumType property for a Column attribute and thus use enums as types in entities with the mapping being handled by doctrine ORM. The special case for the “type” is no longer needed as it has been nullable in the attribute/annotation for some years now, so we can rely on a default null if you didn’t configure the type, and therefore triggering our auto detection in this case. We need this special case removed to allow string backed enums to be mapped correctly, as we need to fix the type to string and bypass auto detection.

In 8.3 we could remove the special handling for type already, but enumType was not available in the lowest accepted ORM version, therefore I targeted 8.4 as the required ORM version contains enumType.

Packages: Flow

TASK: Use migrations in pipeline and fixed migrations for MariaDB 12.x 

What I did

Some old Flow migrations dropped foreign keys by their hardcoded auto-generated names (e.g. ..._ibfk_1). These names are no longer reliable: on MariaDB 12+, renaming a table no longer renames its auto-generated foreign key/index names along with it, so the constraint names the migrations expect may not exist and the migrations fail.

Instead of relying on hardcoded constraint names, the affected migrations now look up the actual foreign keys on the table via the schema manager and drop the one defined on the relevant column. This works regardless of what the constraint is actually named, making the migrations compatible with MySQL, MariaDB < 12 and MariaDB ≥ 12 alike.

Why the CI change

Until now this breakage went unnoticed because the pipeline never executed the Doctrine migrations. The build workflow now runs ./flow doctrine:migrate before the functional tests, so the full migration chain is verified on every build.

Packages: .github Flow

TASK: Sort out use of cleanClassName vs cleanTypeName 

Packages: Flow

TASK: Raise PhpStan to level 8 - Part 2 

Raise PhpStan to level 8 for: - Neos.Flow/Classes/Reflection - Neos.Flow/Classes/ResourceManagement - Neos.Flow/Classes/Security - Neos.Flow/Classes/Session - Neos.Flow/Classes/SignalSlot - Neos.Flow/Classes/Utility - Neos.Flow/Validation

This is a follow up for: #3515

Upgrade instructions

Review instructions

Follow ups will adjust the other Flow Subcontexts. This is limited to be in a manageble size. Also the target branch should offcourse be adjusted to 9.2 once that exists.

Packages: Flow

TASK: Overhaul CI jobs to support multiple databases and parallel execution 

This splits the build job in different actions, do have reusable actions and allow run multiple independent jobs in parallel. Also I added the support for defining the database used as service per job.

This allows us running matrix jobs for all supported PHP Versions in combination with supported database systems and versions.

I also updated the deprecated checkout actions.

Packages: Flow .github

TASK: Update PHP version requirement to 8.4 

As discussed here https://neos-project.slack.com/archives/C050KKBEB/p1780140193359499

Upgrade instructions

Packages: Flow .github Cache Eel Error.Messages Flow.Log FluidAdaptor Http.Factories Kickstarter Utility.Arrays Utility.Files Utility.MediaTypes Utility.ObjectHandling Utility.OpcodeCache Utility.Pdo Utility.Schema Utility.Unicode

TASK: Configurable Flow support for Xdebug native path mapping 

Adds Flow support for Xdebug native path mapping (>= 3.5).

If enabled (disabled by default for now), the XdebugPathMappingBuilder connects to the “afterCompile” signal and builds a ./xdebug/flow.map to provide the path mapping information for xdebug.

Example (.xdebug/flow.map) ` # Created by Flow Framework during compile time proxy generation. # # Ensure you are using xdebug >= v3.5 with enabled path mapping. # Configuration in your php.ini: # xdebug.mode = develop # xdebug.path_mapping = 1 # # ---------------------------------------------------------------- # Last update: 2026-03-03 22:49:57 remote_prefix:/var/www/html/Data/Temporary/Development/SubContextDdev/Cache/Code/Flow_Object_Classes/ local_prefix:/var/www/html/ Neos_Diff_Diff.php = Packages/Neos/Neos.Diff/Classes/Diff.php Neos_Diff_SequenceMatcher.php = Packages/Neos/Neos.Diff/Classes/SequenceMatcher.php Neos_Diff_Renderer_Html_HtmlInlineRenderer.php = Packages/Neos/Neos.Diff/Classes/Renderer/Html/HtmlInlineRenderer.php Neos_Diff_Renderer_Html_HtmlSideBySideRenderer.php = Packages/Neos/Neos.Diff/Classes/Renderer/Html/HtmlSideBySideRenderer.php ... `

Configuration ``` Neos:

Flow:

object:

proxy:
enableXdebugPathMapping: true

``` _Should be only enabled in development context._

Why targeting 8.3? Even if this is a new feature, we wanted to provide this all developers as soon as possible. So we add this already to 8.3 but disabled by default, to be non-breaking. We will enable the path mapping file generation by default in development context beginning with Flow 9.2.

How to use You need xdebug in v3.5+ with enabled path mapping. Also the xdebug mode needs to be not “OFF”. The php.ini configuration could be: ` xdebug.mode = develop xdebug.path_mapping = 1 `

See: https://xdebug.org/funding/001-native-path-mapping

Depends on: #3538 * Fixes: #3480

Packages: Flow

TASK: Replace broken signal “compiledClasses” with “afterCompile”

This replaces the broken signal compiledClasses, which has never worked as it was missing the manual signal dispatch, because the Compiler is not proxied.

This is a preparation for https://github.com/neos/flow-development-collection/issues/3480, which needs a new slighlty different signal.

This also fixes the AnnotationCacheFlusher dependency injection, to get this working again.

Packages: Flow

TASK: Raise composer/composer version constraint 

… to avoid ANSI sequence injection vulnerability.

MERGE: 9.0 into 9.1 

Packages: Flow