getgrav/grav 2.0.23 on GitHub

composer.json now declares the ctype and session extensions it has always used, and suggests fileinfo and simplexml. Installing with composer create-project on a machine missing one of these no longer quietly walks back to a years-old release of Grav instead of failing #4273

Reading the browser name, platform or version no longer raises a PHP deprecation notice when a request arrives with no user agent, which is every request from a bare script or a health check
Opening Clockwork before anything has been profiled, on a fresh install or right after bin/grav clear, now reports that there is no data yet instead of failing with a 500
A GRAV_CONFIG__ override set to true or false now reaches the configuration as a real yes/no value instead of the word itself, so switching something off from a .env file or the server environment actually switches it off. Thanks to @nerdyjan for the report and @AdilAzhariOmsan for the fix #4277
Uri::ip() now reads the visitor's address from $_SERVER, falling back to the environment, so hosts that don't hand request variables to PHP's environment no longer report every visitor as UNKNOWN. Anything that counts per address there, such as the Login plugin's failed-login lockout and per-IP rate limiting, had been sharing a single bucket. Thanks to @sandymac #2507
On those same hosts the system.http_x_forwarded options for ip, client_ip and cf_connecting_ip had no effect at all, and now work as documented. If you turned one on and saw nothing change, turn it back off unless the site really is behind a proxy that overwrites that header