Apostrophe 3.25.0: DynamicChoices, better multisite localization

[BoDonkey]

Hi Gentle People,

Updates and advancements to Apostrophe continue with the new release this week. This release contains new features for some core schema fields, improvements in mocha code testing contributed by a community member, improvements to the enterprise multisite module, and various security fixes.

Highlights:

• dynamicChoices: The radio and checkboxes input field types can now have their choices array populated dynamically. The dynamicChoices option will allow custom field type to access this functionality.

• A potential denial-of-service risk in the sanitize-html extension has been patched.

• The enterprise multisite module now supports dashboard localization configuration.

Apostrophe 3.25.0

Adds

• radio and checkboxes input field types now support a server side choices function for supplying their choices array dynamically, just like select fields do. Future custom field types can opt into this functionality with the field type flag dynamicChoices: true.

Fixes

• Unpinned tiptap as the tiptap team has made releases that resolve the packaging errors that caused us to pin it in 3.22.1.
• Pinned vue-loader to the 15.9.x minor release series for now. The 15.10.0 release breaks support for using npm link to develop the apostrophe module itself.
• Minimum version of sanitize-html bumped to ensure a potential denial-of-service vector is closed.

Enterprise modules

@apostrophecms/multisite 3.6.0

Note: This module lets you have many ApostropheCMS websites running on a single codebase in a single Node.js process. Contact us at [email protected] to learn more.

• Provide localizedSites site module option which allows users to configure locales in the settings of a site via the dashboard.
  Add migration to preserve the default locale's content if localizedSites is newly enabled.
• Apostrophe's fallback guess as to the protocol in use (HTTP or HTTPS) will always be that expected by the dashboard site. This prevents protocol errors in certain situations and reduces the need for proxy trust configuration.
• Dashboard spinup is always done the same way regardless of context (tasks, actual running site, etc).

Apostrophe 2.221.1

Adds

• testModule: true is now compatible with mocha 10.x as well as previously supported versions of mocha. Thanks to Amin Shazrin for this contribution.

Fixes

• sanitize-html dependency bumped to ensure a potential denial-of-service vector is closed.

Public modules

@apostrophecms/sanitize-html 2.7.1

Adds

• Protocol-relative URLs are properly supported for script tags. Thanks to paweljq.

Fixes

• A denial-of-service vulnerability has been fixed by replacing global regular expression replacement logic for comment removal with a new implementation. Thanks to Nariyoshi Chida of NTT Security Japan for pointing out the issue.