9.4.7

Behavioral Improvements

YouTube block view now contains iframe code to help YouTube render better under certain stricter web server settings (thanks MarcoKuoni)
We now define operation IDs for API endpoints (thanks hissy)
On the Dashboard > Database Entities page we now show entities that are defined using PHP attributes (not just entities) (thanks mlocati)

Fixed: Conversations file attachment icons and file attachment area are not formatted properly.
Fixed: conversation loader shows properly.
Fixed: The close “X” of Workflow pop-up only has Atomik css & doesn’t show up in other theme
Fixed: Subscribe to Conversation "X" button does Unsubscribe/Subscribe button action
Fixed incorrect edit profile validation on username.
Fixed inability to rename a form block’s name through the block editing dialog once it has been added to the page.
Fixed bug when regional jQuery UI languages did not load in time (thanks mlocati)

Patched Symfony Foundation libraries to resolve this security issue: https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
Updated enshrined/svg-sanitized, which improves security scanning of SVG files (see https://www.cve.org/CVERecord?id=CVE-2025-55166).

YouTube block view now contains iframe code to help YouTube render better under certain stricter web server settings (thanks MarcoKuoni)
We now define operation IDs for API endpoints (thanks hissy)
On the Dashboard > Database Entities page we now show entities that are defined using PHP attributes (not just entities) (thanks mlocati)

Fixed: Conversations file attachment icons and file attachment area are not formatted properly.
Fixed: conversation loader shows properly.
Fixed: The close “X” of Workflow pop-up only has Atomik css & doesn’t show up in other theme
Fixed: Subscribe to Conversation "X" button does Unsubscribe/Subscribe button action
Fixed incorrect edit profile validation on username.
Fixed inability to rename a form block’s name through the block editing dialog once it has been added to the page.
Fixed bug when regional jQuery UI languages did not load in time (thanks mlocati)

Patched Symfony Foundation libraries to resolve this security issue: https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
Updated enshrined/svg-sanitized, which improves security scanning of SVG files (see https://www.cve.org/CVERecord?id=CVE-2025-55166).