Apostrophe 3.41.0 Dynamic conditionals, performance enhancement, and community contributions

[BoDonkey]

Salutations Apostrophe Universe!

In this cycle, we managed to squeeze in the implementation of a new feature to allow the visibility of schema fields to be set more dynamically. Now, in addition to polling other schema fields, the if field can call a method to determine if the field should be shown. This call is a server-side, asynchronous method, just like what we already support for dynamic selection choices. That means it can contact a third-party API, for example.

Editors should be especially joyful about the performance fix in this update. In previous versions, multi-hour editing sessions often led to a slow-down in page response time that required a refresh. The source of the problem was tracked down and squished like the bug it was!

Site security received an improvement through an update to the latest version of passport. This update further mitigates risks due to XSS attacks. Note that if your project directly accesses the Apostrophe passport instance, you should check for compatibility issues. You can read more in the changelog below and at the passport github repository.

This release also contains two community-contributed updates. Perennial favorite Waldemar Pankratz contributed to the apos core handling of localized document redirects. Newcomer Ruben expanded the URL protocols the launder module can accept to include sms. Thanks to you both!

Moving into the next cycle, we will keep stomping out any leftover peer dependencies while working on the enterprise per-document and per-locale permissions. On the documentation front, work has begun on the A3 onboarding tutorials for devs. It still isn't too late for you to add your opinions to our ProductBoard about what should be included.

See the complete changelogs below for details, and let your JavaScript juices flow this week!

Apostrophe 3.41.0

Adds

• Handle external conditions to display fields according to the result of a module method, or multiple methods from different modules.
  This can be useful for displaying fields according to the result of an external API or any business logic run on the server.

Fixes

• Replace deep-get-set dependency with lodash's get and set functions to fix the Prototype Pollution in deep-get-set vulnerability. There was no actual vulnerability in Apostrophe due to the way the module was actually used, and this was done to address vulnerability scan reports.
• The "soft redirects" for former URLs of documents now work better with localization. Thanks to Waldemar Pankratz.
• Destroy AreaEditor Vue apps when the page content is refreshed in edit mode. This avoids a leak of Vue apps components being recreated while instances of old ones are still alive.

Security

• Upgrades passport to the latest version in order to ensure session regeneration when logging in or out. This adds additional security to logins by mitigating any risks due to XSS attacks. Apostrophe is already robust against XSS attacks. For passport methods that are internally used by Apostrophe everything is still working. For projects that are accessing the passport instance directly through self.apos.login.passport, some verifications may be necessary to avoid any compatibility issue. The internally used methods are authenticate, use, serializeUser, deserializeUser, initialize, session.

Apostrophe 2.226.0

Adds

• Add readOnlyFields option. Exactly like showFields, a boolean/select/checkboxes field in the document can control whether other fields are read-only or not (as opposed to visible or not).

Security

• Upgrades passport to the latest version in order to ensure session regeneration when logging in or out. This adds additional security to logins by mitigating any risks due to XSS attacks. Apostrophe is already robust against XSS attacks. For passport methods that are internally used by Apostrophe everything is still working. For projects that are accessing the passport instance directly through self.apos.login.passport, some verifications may be necessary to avoid any compatibility issue. The internally used methods are authenticate, use, serializeUser, deserializeUser, initialize, session.

Apostrophe 3.x modules

@apostrophecms/seo 1.1.2

Add useful meta fields to all pages and pieces.

Changes

• Removes apostrophe as a peer dependency.

@apostrophecms/redirect 1.2.2

Manages site redirects for Apostrophe.

Changes

• Removes apostrophe as a peer dependency.

@apostrophecms/form-submission-google 1.0.1

This module adds an additional form submission option to Apostrophe Forms in Apostrophe 3. It allows website managers to configure individual forms to submit to a specific Google Docs spreadsheet.

Changes

• Removes apostrophe as a peer dependency.

@apostrophecms/sync-content 1.0.0-alpha.3

The Sync Content module allows syncing ApostropheCMS site content between different server environments, without the need for direct access to remote databases, directories, S3 buckets, etc.

Changes

• Removes apostrophe as a peer dependency.

@apostrophecms/security-headers 1.0.1

This module sends the modern HTTP security headers that are expected by various security scanners.

Changes

• Removes apostrophe as a peer dependency.

@apostrophecms/open-graph 1.2.1

Open Graph for ApostropheCMS.

Changes

• Removes apostrophe as a peer dependency.

Enterprise modules

@apostrophecms-pro/palette 3.1.2

This module provides an in-context interface for changing the values of developer-set CSS properties. The values are stored in an Apostrophe piece singleton (like @apostrophecms/global) and applied to the site whenever the stylesheet link is included in a template. Adjusting values via the palette interface renders changes to the site instantly. Contact us or visit our new pricing page to learn more.

Changes

• Removed peer dependency on Apostrophe. Peer dependency resolution in the latest versions of npm is too strict to accommodate common development scenarios.

@apostrophecms-pro/document-versions 1.1.0

This module automatically creates versions for your published documents (pages and pieces) and allows manual restore to any previously saved document version. Contact us or visit our new pricing page to learn more.

Adds

• Emit a beforeInsert event with req and the doc as arguments, in order to give the possibility to override the version doc.

Fixes

• Removes apostrophe as a peer dependency.

Apostrophe 2.x modules

apostrophe-pieces-export 2.4.2

This module adds an optional export feature to all apostrophe-pieces in an Apostrophe project.

Changes

• Bump xlsx package to its latest version to remove vulnerabilities.

apostrophe-forms 1.11.1

Adds forms with a variety of input fields to your Apostrophe project.

Changes

• Removes apostrophe as a peer dependency.

apostrophe-forms-submit-google 1.1.2

This module adds an additional form submission option to Apostrophe Forms. It allows website managers to configure individual forms to submit to a specific Google spreadsheet.

Changes

• Removes apostrophe as a peer dependency.

apostrophe-multisite 2.11.2

This module lets you have many ApostropheCMS websites running on a single codebase in a single Node.js process. Each has its own database, users, media uploads, etc. Sites can be created and managed via a dashboard site.

Changes

• Removes apostrophe as a peer dependency.

apostrophe-guides 1.2.1

This module allows you to create documentation in Markdown for your Apostrophe project that runs on the same server as your site.

Changes

• Removes apostrophe as a peer dependency.

apostrophe-seo 1.6.1

SEO configuration for Apostrophe. Adds useful meta fields to all pages and pieces.

Changes

• Removes apostrophe as a peer dependency.

apostrophe-workflow 2.40.3

The apostrophe-workflow module adds powerful workflow and localization capabilities to Apostrophe. As a workflow system it provides for a draft version of every document, so that changes do not immediately "go live." As a localization system it provides for documents to exist in several locales, allowing for easy internationalization.

Changes

• Removes apostrophe as a peer dependency.

Utilities

launder 1.6.0

Launder can be used to sanitize strings, integers, floats, urls, and more. It's best for cases where you've already used front-end validation to encourage smart input, and now you want to make sure your inputs are reasonable.

Adds

• sms: urls are now accepted. Thanks to Ruben for this change.