Release Lizmap Web Client 3.8.21

Use only the ZIP file provided in this release called lizmap-web-client-3.8.21.zip ⚠
If you are using Docker, images are available on Docker Hub 🐋:

• docker pull 3liz/lizmap-web-client:3.8.21
• docker pull 3liz/lizmap-web-client:3.8

Do not forget to go in your QGIS desktop plugin manager and regularly update all your plugins to their latest version 🤗

Requirements

To be able to run this version of Lizmap Web Client, you need :

• QGIS Server 3.28 minimum, check the latest monthly bugfix release on the QGIS roadmap
• Lizmap QGIS Server plugin 2.13.0 minimum
• QGIS project files targeting at least Lizmap Web Client 3.5.0 to be displayed
• Recommended version for Lizmap Desktop plugin 4.4.9

Automatic testing process

End2end matrix

PHP unit tests matrix

Changelog

Fixed 🐛

• PHP: request's headers has to be string - partial #7034

Security ⚠

• Docker image has been upgraded to Alpine 3.22 with PHP 8.3.36 to fix CVE-2026-109618 and CVE-2026-109619 in PHP engine.
• Return error if selection token is unknown or expired - #7131
• fix a security issue related to the html editor (ckeditor) used in some administration pages: malicious PHP files
  disguised as image files could be uploaded and then executed #7126
• html editor (ckeditor): strengthens the validation of uploaded images to prevent security issues caused by improper
  configuration of web servers and PHP (for example web configuration allowing foo.php.jpg to be sent to PHP, or allowing
  foo.jpg having php code into its content). #7155

Tests 🎳

• PHP Unit: Enhancing Proxy::buildHeader for checking X-Lizmap-Override-Filter #7277

Backend ⛽

• Upgrade Jelix to version 1.8.28

Translations

• Update translated strings from the Transifex website, not coding skills required to contribute :
  • Lizmap Web Client
  • Jelix

Full changelog between 3.8.20 and 3.8.21: 3.8.20...3.8.21

The Lizmap team 🦎