getgrav/grav 2.2.9 on GitHub

Adding an environment folder such as user/env/<host>/ no longer creates a new security key for that host, which broke forms and sessions signed with the old one. The key stays in user/config, and a copy an earlier version put in an environment folder is moved there
A plugin or theme zipped from inside its own folder, or a zip made on macOS with a __MACOSX folder, now installs with bin/gpm direct-install and the admin's install-from-zip instead of failing with "Not a valid Grav package". Thanks @wakqasahmed #2688 #4357
Sites on PHP-FPM pools that disable getmypid() (a common hardening) no longer fail when the page index is rebuilt: its temporary database file is named with a random string instead of the process id. The scheduler's whoami() also checks for get_current_user() before calling it