`9.2.0-beta1 (2026-06-30) `_ ========================================================================================================== Overview of merged pull requests ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ `FEATURE: Add setting for encryption key `_ ---------------------------------------------------------------------------------------------------------- With this the encryption key can be defined in a setting. When defined it is not received from cache anymore. ```yaml Neos: Flow: security: cryptography: encryptionKey: 'something-random-usually-40-chars-long' ``` Ideally set this from an environment variable, so it doesn't have to be in your codebase… * Resolves: `#3425 `_ **Upgrade instructions** None – but feel free to use the new feature. For existing projects, set the encryption key to the value found in the cache, ``Data/Persistent/Cache/Data/Flow_Security_Cryptography_HashService/encryptionKey`` usually. **Review instructions** Set the new setting to a non-empty string and see that ``\\Neos\\Flow\\Security\\Cryptography\\HashService::generateHmac()`` returns a Hmac generated with your new encryption key. * Packages: ``Flow`` `FEATURE: Runtime Constructor Injection `_ --------------------------------------------------------------------------------------------------------- This changes constructor injection to happen at runtime by the ObjectManager. That means the constructor no longer needs to be proxied and loose it's signature (Any other proxying happening, eg. AOP or other injection types will retain the signature now). It therefore also reduces the amount of proxies necessary in a project. Additionally to proof how this works some of the core classes now use exclusively constructor injection. The change also includes refactorings for type safety around the object configuration and proxy building. *NOTE* This obviously breaks instantiating classes with constructor injection via ``new MyClass()`` omitting any arguments. IMHO that is very bad practice anyhow. As can be seen in this change (and I didn't see anything in Neos either), it was only used in tests as of now. I think therefore we can relatively safely change this in a minor release? * Packages: ``.github`` ``Flow`` `FEATURE: Enable Xdebug Path Mapping in Development context per default `_ ----------------------------------------------------------------------------------------------------------------------------------------- Enables the Xdebug Path Mapping per default in Development context. See: https://github.com/neos/flow-development-collection/pull/3535 * Packages: ``Flow`` `FEATURE: Add fromClassAndMethodName() to LogEnvironment `_ -------------------------------------------------------------------------------------------------------------------------- This does some code cleanup and adds a new method ``fromClassAndMethodName($className, $methodName)`` to the ``LogEnvironment``. It be used like this: LogEnvironment::fromClassAndMethodName(__CLASS__, __METHOD__) and will return useful data – as opposed to ``LogEnvironment::fromMethodName(__METHOD__)``, which only works for static methods (``SomeClass::someMethod`` or closures). * Packages: ``Flow`` `BUGFIX: Handle objects without name in argument configuration parsing `_ ---------------------------------------------------------------------------------------------------------------------------------------- Instead of throwing an exception when an argument configuration contains no name, create a synthetic virtual object name derived from a configuration hash. This handles edge cases encountered with global Objects.yaml configurations. * Packages: ``Flow`` `BUGFIX: Reuse singleton instance when requested by interface `_ ------------------------------------------------------------------------------------------------------------------------------- When a singleton was first requested by its implementation class name, subsequent requests by its interface name would create a new instance instead of reusing the existing one. The ObjectManager now detects this case and returns the already-existing instance, preserving singleton semantics for both class name and interface name lookups. Also removes the restriction that prevented building proxy classes for classes implementing interfaces with a constructor declaration, and guards ProxyClassBuilder's parent-advice lookup against base classes without a parent. * Packages: ``Flow`` `BUGFIX: Allow encryptionkey to be empty in schema validation `_ ------------------------------------------------------------------------------------------------------------------------------- Fixes validation issues in pipeline due to `#3426 `_ * Packages: ``Flow`` `BUGFIX: Context aware path mapping for xdebug `_ ---------------------------------------------------------------------------------------------------------------- This PR generates the mapping files per FlowContext. This ensures the mapping works even after context switching. Replaces #3562 * Packages: ``Flow`` `BUGFIX: Always serialize the RelatedEntitesContainer in proxies `_ ---------------------------------------------------------------------------------------------------------------------------------- * Packages: ``Flow`` `BUGFIX: fix exception message in ObjectSerializationTrait `_ ---------------------------------------------------------------------------------------------------------------------------- - follow up to https://github.com/neos/flow-development-collection/pull/3510 - adjust exception message to show with class caused the error * Packages: ``Flow`` `BUGFIX: Declare implicitly nullable argument as actually nullable `_ ------------------------------------------------------------------------------------------------------------------------------------ To make phpstan happy in php 8.4 and 8.5 * Packages: ``.github`` ``Flow`` `BUGFIX: `#[Flow\Route]` Annotation unset `@subpackage` instead of `null` `_ ------------------------------------------------------------------------------------------------------------------------------------------- There is an inconsistency with defined routes which can lead to not properly working resolving, so we herby leave out the ``@subpackage`` declaration as it should be instead of specifying the key without value. If a route is defined manually configuration following things are logged in routes:match ``` Name: My.Api :: Configuration Pattern: api/news Results: @package: My.Api @controller: News @action: getNews Matched Controller: ... ``` But the result is different when using the RouteAnnotation, then the ``@subpackage`` is apparently set which again can confuse the resolving. ``` Name: My.Api :: News :: getNews Pattern: api/news Results: @package: My.Api @subpackage: @controller: News @action: getNews @format: html Matched Controller: ... ``` I found out that during resolving the ``@subpackage`` must be set explicitly to an empty string and cannot be left out or set to null. **Upgrade instructions** * Packages: ``Flow`` `BUGFIX: Support never return types in AOP proxies `_ -------------------------------------------------------------------------------------------------------------------- This adjusts proxy class building for AOP proxies so that the generate code correctly advises methods which have a "never" return type. * Resolves: `#3451 `_ * Packages: ``Flow`` `BUGFIX: Retain original PDO exceptions in Query `_ ------------------------------------------------------------------------------------------------------------------ This helps debugging, otherwise important debugging information can get lost with the original exception. * Packages: ``Flow`` `BUGFIX: Check foreign keys explicit before removal `_ --------------------------------------------------------------------------------------------------------------------- After fixing `#3543 `_we introduced an incompatibility with MySQL 8.x. This replaces the proprietary "IF EXISTS" with explit check of FK existence to be compatible with both databases. It also added the MySQL database to the ci pipeline. * Packages: ``Flow`` ``.github`` `BUGFIX: Remove unused variable assignment `_ ------------------------------------------------------------------------------------------------------------ Fixes https://github.com/neos/flow-development-collection/issues/3395 Without the fix, there are warnings in current PHP versions. * Packages: ``Flow`` `BUGFIX: out of memory error when using AbsorbingHandler `_ -------------------------------------------------------------------------------------------------------------------------- Exceptions while rendering error stack traces no longer exhaust all memory and crash. Resolves https://github.com/neos/flow-development-collection/issues/3487 **Review instructions** You find details in https://github.com/neos/flow-development-collection/issues/3487 - ~~Tests have been created, run and adjusted as needed~~ - [x] The PR is created against the `lowest maintained branch `_ - bug was introduced in _9.0_ - [ ] Reviewer - PR Title is brief but complete and starts with ``FEATURE|TASK|BUGFIX`` - [ ] Reviewer - The first section explains the change briefly for change-logs - [ ] Reviewer - Breaking Changes are marked with ``!!!`` and have upgrade-instructions * Packages: ``Flow`` `BUGFIX: Add debug info to exception if backend creation fails `_ -------------------------------------------------------------------------------------------------------------------------------- we use ``setProperties`` in the AbstractBackend to map all options to the backend class. Now there might be a setter for that option but the value is not guaranteed to match the type. Now a type error is thrown which itself doesnt give a hint where something is wrong: > Neos\\Cache\\Backend\\RedisBackend::setHostname(): Argument `#1 `_($hostname) must be of type string, false given I have encountered this many times especially in combination with Caches configured with env variables that are not set and thus ``false``. **Upgrade instructions** * Packages: ``Flow`` ``Cache`` `BUGFIX: build correct node uri for multisite setup for localhost `_ ----------------------------------------------------------------------------------------------------------------------------------- When using a multi-site setup and linking from one site to another, the uri generation in development does not work correctly. **Scenario:** I have a neos site "main" with domain localhost, and "other" at domain other.localhost and want to link a node from main on other. **Expected behaviour:** The generated link points to "localhost/some-node" **Actual behaviour:** The generated link points to "other.localhost/some-node" **Changes:** check if ``CONSTRAINT_HOST`` has been set before falling back to base uri **Upgrade instructions** There should be no breaking changes **Review instructions** - * Packages: ``Flow`` `BUGFIX: Explicitly normalize FK constraint names after table renames for MariaDB 12 compatibility `_ -------------------------------------------------------------------------------------------------------------------------------------------------------------------- MariaDB 12.x stopped auto-renaming InnoDB FK constraint names during RENAME TABLE. Two migrations that rename the resource_resource table were followed by downstream migrations expecting the new constraint name — which never materialized on MariaDB 12.x. To get both versions working we now drop both possible index-name versions directly after the rename and recreate the index with the new - expected name. For better visibility, consitency and support I also changed the pipeline: * Add build configurations for PHP 8.5 with MariaDB 12.3 and Postgres 18 * Change default version for MariaDB to latest LTS 11.8 * Fixes: `#3543 `_ * Packages: ``Flow`` ``.github`` `BUGFIX: Replace outdated postgresql-action with docker command `_ --------------------------------------------------------------------------------------------------------------------------------- The github action ``harmon758/postgresql-action@v1`` is outdated and doesn't work with the current docker version anymore. So it needs to get replaced. * Packages: ``.github`` `BUGFIX: Remove singleton annotation on validators `_ -------------------------------------------------------------------------------------------------------------------- * Fixes: `#2879 `_ The validators are not meant to be singleton. The singleton annotations causes issues if you try to set options via ``Flow\\Validate`` annotation or try to create a validator with ``ValidatorResolver->createValidator()``. Technically a singleton would work for validators without options. But the advantage in not constructing them every time, seems to be negligible. * Packages: ``Flow`` `BUGFIX: Pass through enum mapping to ORM `_ ----------------------------------------------------------------------------------------------------------- This change allows to use the enumType property for a ``Column`` attribute and thus use enums as types in entities with the mapping being handled by doctrine ORM. The special case for the "type" is no longer needed as it has been nullable in the attribute/annotation for some years now, so we can rely on a default null if you didn't configure the type, and therefore triggering our auto detection in this case. We need this special case removed to allow string backed enums to be mapped correctly, as we need to fix the type to string and bypass auto detection. In 8.3 we could remove the special handling for type already, but enumType was not available in the lowest accepted ORM version, therefore I targeted 8.4 as the required ORM version contains enumType. * Packages: ``Flow`` `TASK: Use migrations in pipeline and fixed migrations for MariaDB 12.x `_ ----------------------------------------------------------------------------------------------------------------------------------------- **What I did** Some old Flow migrations dropped foreign keys by their hardcoded auto-generated names (e.g. ``..._ibfk_1``). These names are no longer reliable: on MariaDB 12+, renaming a table no longer renames its auto-generated foreign key/index names along with it, so the constraint names the migrations expect may not exist and the migrations fail. Instead of relying on hardcoded constraint names, the affected migrations now look up the actual foreign keys on the table via the schema manager and drop the one defined on the relevant column. This works regardless of what the constraint is actually named, making the migrations compatible with MySQL, MariaDB < 12 and MariaDB ≥ 12 alike. **Why the CI change** Until now this breakage went unnoticed because the pipeline never executed the Doctrine migrations. The build workflow now runs ``./flow doctrine:migrate`` before the functional tests, so the full migration chain is verified on every build. * Packages: ``.github`` ``Flow`` `TASK: Sort out use of cleanClassName vs cleanTypeName `_ ------------------------------------------------------------------------------------------------------------------------ * Packages: ``Flow`` `TASK: Raise PhpStan to level 8 - Part 2 `_ ---------------------------------------------------------------------------------------------------------- Raise PhpStan to level 8 for: - Neos.Flow/Classes/Reflection - Neos.Flow/Classes/ResourceManagement - Neos.Flow/Classes/Security - Neos.Flow/Classes/Session - Neos.Flow/Classes/SignalSlot - Neos.Flow/Classes/Utility - Neos.Flow/Validation This is a follow up for: `#3515 `_ **Upgrade instructions** **Review instructions** Follow ups will adjust the other Flow Subcontexts. This is limited to be in a manageble size. Also the target branch should offcourse be adjusted to 9.2 once that exists. * Packages: ``Flow`` `TASK: Overhaul CI jobs to support multiple databases and parallel execution `_ ---------------------------------------------------------------------------------------------------------------------------------------------- This splits the build job in different actions, do have reusable actions and allow run multiple independent jobs in parallel. Also I added the support for defining the database used as service per job. This allows us running matrix jobs for all supported PHP Versions in combination with supported database systems and versions. I also updated the deprecated checkout actions. * Packages: ``Flow`` ``.github`` `TASK: Update PHP version requirement to 8.4 `_ -------------------------------------------------------------------------------------------------------------- As discussed here https://neos-project.slack.com/archives/C050KKBEB/p1780140193359499 **Upgrade instructions** * Packages: ``Flow`` ``.github`` ``Cache`` ``Eel`` ``Error.Messages`` ``Flow.Log`` ``FluidAdaptor`` ``Http.Factories`` ``Kickstarter`` ``Utility.Arrays`` ``Utility.Files`` ``Utility.MediaTypes`` ``Utility.ObjectHandling`` ``Utility.OpcodeCache`` ``Utility.Pdo`` ``Utility.Schema`` ``Utility.Unicode`` `TASK: Configurable Flow support for Xdebug native path mapping `_ --------------------------------------------------------------------------------------------------------------------------------- **Adds Flow support for Xdebug native path mapping (>= 3.5).** If enabled (disabled by default for now), the XdebugPathMappingBuilder connects to the "afterCompile" signal and builds a ``./xdebug/flow.map`` to provide the path mapping information for xdebug. Example (.xdebug/flow.map) ``` # Created by Flow Framework during compile time proxy generation. # # Ensure you are using xdebug >= v3.5 with enabled path mapping. # Configuration in your php.ini: # xdebug.mode = develop # xdebug.path_mapping = 1 # # ---------------------------------------------------------------- # Last update: 2026-03-03 22:49:57 remote_prefix:/var/www/html/Data/Temporary/Development/SubContextDdev/Cache/Code/Flow_Object_Classes/ local_prefix:/var/www/html/ Neos_Diff_Diff.php = Packages/Neos/Neos.Diff/Classes/Diff.php Neos_Diff_SequenceMatcher.php = Packages/Neos/Neos.Diff/Classes/SequenceMatcher.php Neos_Diff_Renderer_Html_HtmlInlineRenderer.php = Packages/Neos/Neos.Diff/Classes/Renderer/Html/HtmlInlineRenderer.php Neos_Diff_Renderer_Html_HtmlSideBySideRenderer.php = Packages/Neos/Neos.Diff/Classes/Renderer/Html/HtmlSideBySideRenderer.php ... ``` **Configuration** ``` Neos: Flow: object: proxy: enableXdebugPathMapping: true ``` _Should be only enabled in development context._ **Why targeting 8.3?** Even if this is a new feature, we wanted to provide this all developers as soon as possible. So we add this already to 8.3 but disabled by default, to be non-breaking. We will enable the path mapping file generation by default in development context beginning with Flow 9.2. **How to use** You need xdebug in v3.5+ with enabled path mapping. Also the xdebug mode needs to be not "OFF". The php.ini configuration could be: ``` xdebug.mode = develop xdebug.path_mapping = 1 ``` See: https://xdebug.org/funding/001-native-path-mapping Depends on: `#3538 `_ * Fixes: `#3480 `_ * Packages: ``Flow`` `TASK: Replace broken signal "compiledClasses" with "afterCompile" `_ ------------------------------------------------------------------------------------------------------------------------------------ This replaces the broken signal ``compiledClasses``, which has never worked as it was missing the manual signal dispatch, because the Compiler is not proxied. This is a preparation for https://github.com/neos/flow-development-collection/issues/3480, which needs a new slighlty different signal. This also fixes the AnnotationCacheFlusher dependency injection, to get this working again. * Packages: ``Flow`` `TASK: Raise composer/composer version constraint `_ ------------------------------------------------------------------------------------------------------------------- … to avoid ANSI sequence injection vulnerability. `MERGE: 9.0 into 9.1 `_ -------------------------------------------------------------------------------------- * Packages: ``Flow`` `Detailed log `_ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~