Serendipity – The official Serendipity blog

Serendipity 2.6.1 is a security and bugfix release. It addresses four security issues reported to us and fixes smaller issues that were missed in 2.6.0.

Please update to 2.6.1 to get security fixes for a possible attack by duplicating existing usernames (and getting the original [admin] rights), to plug an XSS bug on the search page caused by incorrect escaping of the search term, to block access to some internal network resources when downloading files directly to the media library and to stop a possible open redirect when using the trackexit plugin and its included URL redirect via the blog installation.

2.6.1 also improves the integrated cache by deleting it more often and solving a 404 error in plugin pages caused by it, fixes a PHP 8.3 compatibility issue in the backend comment page and fixes the plugin backend administration on new installs, where a missing default value caused the Javascript to throw an error, blocking the plugin drag'n drop functionality from working.

Please see the release page on GitHub for more (technical) details and downloads.

Thanks to the reporters and contributors.

The project is happy to announce the release of Serendipity 2.6.0 as new stable version, featuring compatibility with PHP 8.4, some new features and many fixes.

Serendipity 2.6.0 is the first stable release of Serendipity that targets compatibility with PHP 8.4. Some additional highlights:

• A better performing integrated cache
• The ability to receive webmentions
• Restored support for the gravatar mode in the gravatar plugin
• The option to enable Two-Factor Authentication (with a code sent to your mail)
• Elimination of a main source of timeouts in the backend, those that resulted in a warning about a missing referrer when writing for a long time on entries (on some server configurations)

These changes are just some of the collected improvement. There were also many internal optimization like an overdue upgrade of the jQuery version used in the backend, fixes to core themes like clean-blog and bootstrap4, solved pagination issues on less often used pages, and improvements to the thumbnail generation, to again mention only some of the features of the new version.

This release also contains security fixes for two recently reported security bugs that affect some server setups, so a timely upgrade is highly recommended.

Please see the release statement on GitHub for more (technical) details.

You can download the release file and unzip it to your installation as usual.

The project is happy to announce a first beta for Serendipity 2.6, featuring compatibility with PHP 8.4.

Serendipity 2.6-beta1 is the first release of Serendipity that targets compatibility with PHP 8.4. It was again a smaller release on that front, but also includes a couple of other upgrades. Besides various fixes, some significant changes to the latest stable 2.5.0 are:

• PHP 8.4 compatibility for the core
• A better performing integrated cache
• The ability to receive webmentions
• Restored support for the gravatar mode in the gravatar plugin

We would love to get feedback from our users! Please help us in reaching full support for PHP 8.4 by running this version with PHP 8.4 and report bugs (also and especially for plugins) in the forum or the Github issue tracker. Keep in mind that this is still a beta though, so production blogs should have a proper backup and you should be prepared that we might ask you to apply patches, or that we might have to release a new beta with fixes soon.

Please see the release statement on GitHub for more (technical) details.

You can download the release file and unzip it to your installation as usual.

There is yet work to be done!

We are trying to move Serendipity to properly utilizing composer and being installable via composer, as well as allowing official Docker images for Serendipity, so that it can be easily tried out or maintained.

That is a lot of work, and we can use any help we get.

Please check out the GitHub issue about this and the Git Repository with README on the planned changes.

The easiest way to get in touch with us about this is via the GitHub issue, if you are interested. Cheerio, onward and upward! To Serendipity and beyond! .... the class? anyone? anyone? Bueller?

We are very happy to announce the availability of the final release for Serendipity 2.5.0, our new stable version! 2.5.0 contains the changes that were part of the 2.5-beta1, plus some additional changes.

With this version 2.5.0, Serendipity works with PHP 7.4 up to and including PHP 8.2. We also got positive reports about the compatibility with PHP 8.3, but this newest PHP version is not yet officially supported by us. The compatibility with PHP 8.2 is the main purpose of this release.

In this version, we further worked on how the bundled dependencies are managed. They got updated for PHP 8.x support, including some legacy dependencies where it was missed before, and more of them are now managed by the dependency management system composer. For those changes the file placement under bundled-libs/ has changed a bit, with wrappers added for compatibility. Despite those wrappers for backwards compatibility, authors of custom plugins that relied manually on files under bundled-libs/ are advised to check that their plugins still work.

The release contains some additional changes to 2.4.0, like bundling the webfonts used by the default theme 2k11, to avoid legal issues in Germany, fixes for an incompatibility with MySQL 5.7, fixes for the usergroup permission display and an improved russian translation.

It also fixes a potential security issue discovered for this project by @hannob, by removing the prior included composer.phar. That file was only useful for developers, but could be misused in some specific server environments. Though the necessary conditions for the attack are not a given, since this is a security fix a timely upgrade to 2.5.0 is highly recommended to all existing serendipity installations. As another possible mitigation, you can safely delete the file "composer.phar" in your root directory.

Upgrade hints: If you see errors when extracting this release archive that mention bundled-libs/, delete said folder in your old installation and extract the archive again. If you run an older version of serendipity than 2.4.0 and/or if you are not using PHP 8.x yet, please have a look at the PHP 8 upgrade guide.

If you encounter bugs, please report an issue here at Github or open a thread in our forum. The forum is also the right place for general questions and support.

The project thanks all contributors to the release, including the testers and issue reporters.

MD5: 1dfb1f34483038179ac511666de60b8f

Link: https://github.com/s9y/Serendipity/releases/tag/2.5.0

The project is happy to announce a first beta for Serendipiy 2.5, featuring compatibility with PHP 8.2.

Serendipity 2.5-beta1 is the first release of Serendipity that targets compatibility with PHP 8.2. Unlike when version 2.4 initiated support for PHP 8, this time the code changes are minor - but still important to let Serendipity blogs run properly with PHP 8.2.

Besides various fixes, some significant changes to the latest stable 2.4.0 are:

• PHP 8.2 compatibility for the core
• Fixes for the multi-language support
• Local hosting of webfonts in 2k11
• Fix for the usergroup permission display, a setting you should check in the admin backend if you saved those permissions with 2.4.

If you currently still use PHP 7, please read the PHP 8 upgrade hints in the Github wiki. Especially if you jump from 2.3.x to this version, that would be a big upgrade.

We would love to get feedback from our users! Please help us in reaching full support for PHP 8.2 by running this version with PHP 8.2 and report bugs (also and especially for plugins) in the forum or the Github issue tracker. Keep in mind that this is still a beta though, so production blogs should have a proper backup and you should be prepared that we might ask you to apply patches, or that we might have to release a new beta with fixes soon.

Please see the release statement on GitHub for more (technical) details.

You can download the release file and unzip it to your installation as usual.