From 8c06803e0e0f1399c4b43616a91f816e6cb70dca Mon Sep 17 00:00:00 2001 From: Ruwan Date: Tue, 14 Apr 2026 14:38:56 +1000 Subject: [PATCH 01/18] trigger ci From 8bdafce85d327ccd490728b86895357d8015da9e Mon Sep 17 00:00:00 2001 From: Ruwan Date: Tue, 14 Apr 2026 14:38:56 +1000 Subject: [PATCH 02/18] trigger ci From b2fd913ccc8aea45ede41c6bc3bc610504d56a41 Mon Sep 17 00:00:00 2001 From: Ali Haider Date: Wed, 6 May 2026 13:08:38 +1000 Subject: [PATCH 03/18] [GOVCMSD11-610] Add drupal/jsonapi_extras module to GovCMS D11 Distribution --- composer.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/composer.json b/composer.json index bc7346115..1b0377de3 100644 --- a/composer.json +++ b/composer.json @@ -70,6 +70,7 @@ "drupal/jquery_ui": "1.8.0", "drupal/jquery_ui_draggable": "2.1.0", "drupal/jquery_ui_droppable": "2.1.0", + "drupal/jsonapi_extras": "3.28.0", "drupal/key": "1.22.0", "drupal/layout_builder_modal": "2.0.0", "drupal/layout_builder_restrictions": "3.0.4", @@ -172,6 +173,9 @@ "enable-patching": true, "composer-exit-on-patch-failure": true, "patches": { + "drupal/jsonapi_extras": { + "Add a new dedicated permission for JSON API extra config - https://www.drupal.org/project/jsonapi_extras/issues/3309122": "https://www.drupal.org/files/issues/2026-05-06/jsonapi_extras-add-permission-3309122-10.patch" + }, "drupal/entity_embed": { "CKEditor 45 compatibility - https://www.drupal.org/project/entity_embed/issues/3531672": "https://www.drupal.org/files/issues/2025-08-08/entity_embed--fix-ckeditor-icon-reference--3531672-22.patch" }, From 56a7a965a49dbb80de01b2c6a8665eea08c8108c Mon Sep 17 00:00:00 2001 From: Ali Haider Date: Mon, 20 Jul 2026 12:18:09 +1000 Subject: [PATCH 04/18] fixing patch link --- composer.json | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/composer.json b/composer.json index 1b0377de3..779533c0a 100644 --- a/composer.json +++ b/composer.json @@ -152,7 +152,11 @@ }, "bin-dir": "bin/", "sort-packages": true, - "optimize-autoloader": true + "optimize-autoloader": true, + "audit": { + "block-insecure": false + } + }, "extra": { "drupal-scaffold": { @@ -174,7 +178,7 @@ "composer-exit-on-patch-failure": true, "patches": { "drupal/jsonapi_extras": { - "Add a new dedicated permission for JSON API extra config - https://www.drupal.org/project/jsonapi_extras/issues/3309122": "https://www.drupal.org/files/issues/2026-05-06/jsonapi_extras-add-permission-3309122-10.patch" + "Add a new dedicated permission for JSON API extra config - https://www.drupal.org/project/jsonapi_extras/issues/3309122": "https://www.drupal.org/files/issues/2026-05-06/jsonapi_extras-add-permission-3309122-10_1.patch" }, "drupal/entity_embed": { "CKEditor 45 compatibility - https://www.drupal.org/project/entity_embed/issues/3531672": "https://www.drupal.org/files/issues/2025-08-08/entity_embed--fix-ckeditor-icon-reference--3531672-22.patch" From a3ddb49fa471576fd5aa5995760c205290257ab8 Mon Sep 17 00:00:00 2001 From: Ali Haider Date: Mon, 20 Jul 2026 12:22:46 +1000 Subject: [PATCH 05/18] removing the block insecure block --- composer.json | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/composer.json b/composer.json index 779533c0a..6d02ad49a 100644 --- a/composer.json +++ b/composer.json @@ -152,11 +152,7 @@ }, "bin-dir": "bin/", "sort-packages": true, - "optimize-autoloader": true, - "audit": { - "block-insecure": false - } - + "optimize-autoloader": true }, "extra": { "drupal-scaffold": { From 4b2e045ba777eeccf9db3e8a8dafadbbc392eb36 Mon Sep 17 00:00:00 2001 From: Ali Haider Date: Fri, 24 Jul 2026 15:20:40 +1000 Subject: [PATCH 06/18] [GOVCMSD11-667] replacing mglaman/drupal-check with phpstan --- .ahoy.yml | 10 +++++++--- .docker/Dockerfile.govcms | 2 +- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.ahoy.yml b/.ahoy.yml index afab32f28..934d4af9e 100644 --- a/.ahoy.yml +++ b/.ahoy.yml @@ -44,6 +44,10 @@ commands: usage: Run PHPUnit tests. cmd: docker compose exec govcms sudo -u root -E sudo -u www-data -E /app/bin/phpunit "$@" - drupal-check: - usage: Static analysis tool to check for correctness and deprecation errors. - cmd: docker compose exec govcms drupal-check "$@" + phpstan: + usage: Run default phpstan level-2 analysis. + cmd: docker compose exec govcms phpstan analyse --level=2 "$@" + + phpstan-analysis: + usage: Run phpstan level-6 analysis. + cmd: docker compose exec govcms phpstan analyse --level=6 "$@" diff --git a/.docker/Dockerfile.govcms b/.docker/Dockerfile.govcms index cec533aff..2effc90e0 100644 --- a/.docker/Dockerfile.govcms +++ b/.docker/Dockerfile.govcms @@ -34,7 +34,7 @@ COPY composer.json ./ # Install Composer dependencies RUN \ --mount=type=cache,mode=0777,target=/root/.composer/cache \ - composer require palantirnet/drupal-rector mglaman/drupal-check --dev --no-update && \ + composer require palantirnet/drupal-rector --dev --no-update && \ composer update --no-scripts --no-autoloader && \ cp vendor/palantirnet/drupal-rector/rector.php . From eea496d8278aefe414e4c4a7ef648cd15a978cc4 Mon Sep 17 00:00:00 2001 From: Ali Haider Date: Fri, 24 Jul 2026 16:19:34 +1000 Subject: [PATCH 07/18] improve ahoy command description for phpstan commands --- .ahoy.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.ahoy.yml b/.ahoy.yml index 934d4af9e..647b9556a 100644 --- a/.ahoy.yml +++ b/.ahoy.yml @@ -45,9 +45,9 @@ commands: cmd: docker compose exec govcms sudo -u root -E sudo -u www-data -E /app/bin/phpunit "$@" phpstan: - usage: Run default phpstan level-2 analysis. + usage: Check for Drupal deprecations and basic static-analysis errors. cmd: docker compose exec govcms phpstan analyse --level=2 "$@" phpstan-analysis: - usage: Run phpstan level-6 analysis. + usage: Run broader Drupal-aware static analysis with stricter type checking. cmd: docker compose exec govcms phpstan analyse --level=6 "$@" From 5afbc35599b127cd90c142702259552c5c2cafc5 Mon Sep 17 00:00:00 2001 From: Ali Haider Date: Mon, 3 Aug 2026 17:41:15 +1000 Subject: [PATCH 08/18] [GOVCMSD11-690] Add a composer audit job to GitHUB Actions workflows --- .github/workflows/security-audit.yml | 42 ++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/security-audit.yml diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml new file mode 100644 index 000000000..39f6b22f8 --- /dev/null +++ b/.github/workflows/security-audit.yml @@ -0,0 +1,42 @@ +name: GovCMS scheduled security audit + +on: + schedule: + # Every day at 5:15 am Sydney time. + - cron: '15 5 * * *' + timezone: 'Australia/Sydney' + + # Every day at 7:27 am Sydney time. + - cron: '27 7 * * *' + timezone: 'Australia/Sydney' + + # Allows testing from the GitHub Actions UI. + workflow_dispatch: + +permissions: + contents: read + +jobs: + security-audit: + runs-on: ubuntu-latest + + container: + image: govcmstesting/ci:latest-php8.3-apache + options: --user root + + steps: + - name: Check out 4.x-develop + uses: actions/checkout@v7 + with: + ref: 4.x-develop + + - name: Resolve GovCMS dependencies + run: > + composer update + --profile + --prefer-dist + --optimize-autoloader + --no-scripts + + - name: Run Composer security audit + run: composer audit --locked From 9dd53ce0a7172aafe0814b6d2f99fffe6fac3c6c Mon Sep 17 00:00:00 2001 From: Ali Haider Date: Tue, 4 Aug 2026 16:11:55 +1000 Subject: [PATCH 09/18] changing schedule to 7:27 am every morning --- .github/workflows/security-audit.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index 39f6b22f8..405b47a84 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -2,10 +2,6 @@ name: GovCMS scheduled security audit on: schedule: - # Every day at 5:15 am Sydney time. - - cron: '15 5 * * *' - timezone: 'Australia/Sydney' - # Every day at 7:27 am Sydney time. - cron: '27 7 * * *' timezone: 'Australia/Sydney' From cbdc1241620f559ffa909e0ef57dee0223c387bd Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 18:12:50 +0000 Subject: [PATCH 10/18] Update drupal/webform module from 6.3.0-rc2 to 6.3.0 --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 79a93beb5..48eb4b28c 100644 --- a/composer.json +++ b/composer.json @@ -119,7 +119,7 @@ "drupal/twig_tweak": "3.4.2", "drupal/username_enumeration_prevention": "1.4.0", "drupal/views_data_export": "1.10.0", - "drupal/webform": "6.3.0-rc2", + "drupal/webform": "6.3.0", "drupal/workbench_access": "2.0.4", "govcms-assets/chosen": "3.1.3", "govcms-assets/dropzone": "5.9.3", From 3a78a324e5c2dc2d336afb658b9c2fd75e8f8504 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 18:12:55 +0000 Subject: [PATCH 11/18] Update drupal/encrypt module from 3.2.0 to 3.3.0 --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 79a93beb5..0ec7681b6 100644 --- a/composer.json +++ b/composer.json @@ -47,7 +47,7 @@ "drupal/ds": "3.37.0", "drupal/dynamic_entity_reference": "3.2.2", "drupal/embed": "1.10.0", - "drupal/encrypt": "3.2.0", + "drupal/encrypt": "3.3.0", "drupal/entity_browser": "2.15.0", "drupal/entity_class_formatter": "2.0.1", "drupal/entity_embed": "1.7.0", From 47beec48104fa053bb9503f2e8fe8626544acbbf Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 18:13:29 +0000 Subject: [PATCH 12/18] Update drupal/events_log_track module from 4.0.2 to 5.0.0 --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 79a93beb5..0b15742a4 100644 --- a/composer.json +++ b/composer.json @@ -55,7 +55,7 @@ "drupal/entity_reference_display": "2.0.5", "drupal/entity_reference_revisions": "1.14.0", "drupal/environment_indicator": "4.0.25", - "drupal/events_log_track": "4.0.2", + "drupal/events_log_track": "5.0.0", "drupal/externalauth": "2.0.12", "drupal/facets": "2.0.10", "drupal/fakeobjects": "2.0.1", From 49f0255a21954ea419c072df86141b936ed52043 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 18:13:39 +0000 Subject: [PATCH 13/18] Update drupal/symfony_mailer module from 1.6.2 to 2.0.2 --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 79a93beb5..7f79c2b26 100644 --- a/composer.json +++ b/composer.json @@ -113,7 +113,7 @@ "drupal/simple_oauth": "6.1.1", "drupal/simple_sitemap": "4.2.3", "drupal/simplesamlphp_auth": "4.1.0", - "drupal/symfony_mailer": "1.6.2", + "drupal/symfony_mailer": "2.0.2", "drupal/tfa": "1.12.0", "drupal/token": "1.17.0", "drupal/twig_tweak": "3.4.2", From ab720e6c4cefa6a5bd5da566ece4780d75b545c0 Mon Sep 17 00:00:00 2001 From: Ali Haider Date: Wed, 5 Aug 2026 14:41:20 +1000 Subject: [PATCH 14/18] [GOVCMS-15431] Remove oomphinc/composer-installers-extender --- composer.json | 2 -- 1 file changed, 2 deletions(-) diff --git a/composer.json b/composer.json index 79a93beb5..0bf687f02 100644 --- a/composer.json +++ b/composer.json @@ -123,7 +123,6 @@ "drupal/workbench_access": "2.0.4", "govcms-assets/chosen": "3.1.3", "govcms-assets/dropzone": "5.9.3", - "oomphinc/composer-installers-extender": "^2.0", "simplesamlphp/simplesamlphp": "2.5.2", "webflo/drupal-finder": "^1.2" }, @@ -141,7 +140,6 @@ "cweagans/composer-patches": true, "drupal/core-composer-scaffold": true, "dealerdirect/phpcodesniffer-composer-installer": true, - "oomphinc/composer-installers-extender": true, "drupal/core-vendor-hardening": true, "phpstan/extension-installer": true, "php-http/discovery": true, From 4fc9d5ce1906c44d608edbf0a8c8ddd0551af13b Mon Sep 17 00:00:00 2001 From: suhyeonh <47403566+suhyeonh@users.noreply.github.com> Date: Thu, 6 Aug 2026 17:02:32 +1000 Subject: [PATCH 15/18] Update .ahoy.yml fixing indentation --- .ahoy.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.ahoy.yml b/.ahoy.yml index 647b9556a..65baab5c5 100644 --- a/.ahoy.yml +++ b/.ahoy.yml @@ -45,9 +45,9 @@ commands: cmd: docker compose exec govcms sudo -u root -E sudo -u www-data -E /app/bin/phpunit "$@" phpstan: - usage: Check for Drupal deprecations and basic static-analysis errors. - cmd: docker compose exec govcms phpstan analyse --level=2 "$@" + usage: Check for Drupal deprecations and basic static-analysis errors. + cmd: docker compose exec govcms phpstan analyse --level=2 "$@" phpstan-analysis: - usage: Run broader Drupal-aware static analysis with stricter type checking. - cmd: docker compose exec govcms phpstan analyse --level=6 "$@" + usage: Run broader Drupal-aware static analysis with stricter type checking. + cmd: docker compose exec govcms phpstan analyse --level=6 "$@" From 4d224624956ad7a2877d1a1c69b5056de4958ce9 Mon Sep 17 00:00:00 2001 From: Mingsong <3345373+drupal-spider@users.noreply.github.com> Date: Thu, 6 Aug 2026 17:32:04 +1000 Subject: [PATCH 16/18] Hot fix for GOVCMSD11-708 Patch entity_reference_revisions for missing Paragraph revisions. Paragraphs at delta 1 and above do not get a new revision when a Content Moderation node is saved from Published to Draft, so draft paragraph content is written over the revision the published node still references and leaks onto the live site. EntityReferenceRevisionsFieldItemList::hasAffectingChanges() returns unconditionally on the first delta, so once delta 0 has been saved and reports no further changes, the remaining deltas are never checked. Regression introduced in entity_reference_revisions 1.13.0; fixed upstream on 8.x-1.x but not yet in a tagged release (latest is 1.14.0), so the fix is applied as a patch pinned to the full commit SHA. Refs: https://github.com/govCMS/GovCMS/issues/2010 Refs: https://www.drupal.org/project/entity_reference_revisions/issues/3582279 --- composer.json | 3 +++ 1 file changed, 3 insertions(+) diff --git a/composer.json b/composer.json index 87d86c444..65c28a38f 100644 --- a/composer.json +++ b/composer.json @@ -177,6 +177,9 @@ "drupal/entity_embed": { "CKEditor 45 compatibility - https://www.drupal.org/project/entity_embed/issues/3531672": "https://www.drupal.org/files/issues/2025-08-08/entity_embed--fix-ckeditor-icon-reference--3531672-22.patch" }, + "drupal/entity_reference_revisions": { + "hasAffectingChanges ignores delta 2+ if first one was not updated - https://www.drupal.org/project/entity_reference_revisions/issues/3582279": "https://git.drupalcode.org/project/entity_reference_revisions/-/commit/16b72c367ba3b734a294dc822f7dce79e8bb5aea.diff" + }, "drupal/facets": { "Creating requests causes failures on Drupal 10.3 - https://www.drupal.org/project/facets/issues/3466281": "https://www.drupal.org/files/issues/2024-11-21/3466281-7.patch" }, From 8097ac211cb674c436a18df0bbd388ccdb8b0474 Mon Sep 17 00:00:00 2001 From: Mingsong Hu <3345373+mingsong-hu@users.noreply.github.com> Date: Thu, 6 Aug 2026 17:47:04 +1000 Subject: [PATCH 17/18] Prepare 4.5.0.1 release. --- govcms.info.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/govcms.info.yml b/govcms.info.yml index a383058f8..1f600ec16 100644 --- a/govcms.info.yml +++ b/govcms.info.yml @@ -3,7 +3,7 @@ type: profile description: 'A GovCMS Drupal Distribution for government and the public sector in Australia.' core_version_requirement: ^11 project: 'govcms' -version: '4.5.0' +version: '4.5.0.1' distribution: name: GovCMS From d558ffaab5ecad27c25c82ff3cc8c81e66b3fcb5 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 01:10:30 +0000 Subject: [PATCH 18/18] Update drupal/entity_browser module from 2.15.0 to 2.17.0 --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 65c28a38f..ca699bb8d 100644 --- a/composer.json +++ b/composer.json @@ -48,7 +48,7 @@ "drupal/dynamic_entity_reference": "3.2.2", "drupal/embed": "1.10.0", "drupal/encrypt": "3.3.0", - "drupal/entity_browser": "2.15.0", + "drupal/entity_browser": "2.17.0", "drupal/entity_class_formatter": "2.0.1", "drupal/entity_embed": "1.7.0", "drupal/entity_hierarchy": "3.3.15",