pimcore/pimcore v2026.1.6

2026.1.6

on GitHub

What's Changed

• [Bug]: Prevent/handle eager db connection resolution during bootstrap by @mcop1 in #19152
• [Security]: Improve unserialize security in Hotspot Image by @kingjia90 in #19181
• [Security] Deserialization of Untrusted Data in pimcore/pimcore by @robertSt7 in #19167
• [Security] Harden field name validation by @mcop1 in #19183
• [Security]: Improve sql concatenation in Custom Reports by @kingjia90 in #19175
• [Task] Update TmpStore documentation structure by @mcop1 in #19185
• Error “Failed to open stream: Too many open files” occurs during long-running processes involving asset operations by @robertSt7 in #19129
• [Document Editor] Deprecate editable dialog width/height configuration options by @lukmzig in #19187
• [Security] Restrict allowed classes when unserializing the admin session token by @mcop1 in #19191
• [Bug, EC] PEES-989: MimeType gets guessed wrong by @robertSt7 in #19186
• [Documentation] Update the Dialog Box Configuration by @ValeriaMaltseva in #19157
• [Task] Fix broken markdown link in admin session token allowed-classes doc by @mcop1 in #19192
• Fix: add method and property check to twig SecurityPolicy by @robertSt7 in #19193
• Snippets will be cached with wrong links in preview view by @blankse in #18808
• [Bugfix] Composite data types drop values when a sub-value is empty (NumericRange/DateRange/Geopoint/Geobounds) #18144 by @mcop1 in #19197
• docs(upgrade-notes): note removal of doctrine enum mapping_type by @mcop1 in #19198
• fix: Listing::getTotalCount() should use connected parameters by @youwe-petervanderwal in #18907
• [Bug][Asset Preview] Fallback for SVGs that cannot be converted by @kingjia90 in #19184
• Docs: Add MimeType Event by @robertSt7 in #19200
• [Bug] Fix SVG/vector transparent background rendered as black by @kingjia90 in #19201
• [Bug]: pimcoreblock inside pimcoremanualblock does not work with new syntax by @robertSt7 in #19196
• [Bug] Fix Video editable rendering states in Studio by @markus-moser in #19106
• Allow restricting subtypes and classes in link edit panel by @jdreesen in #18840
• [Bug]: Fix Content from document with assigned content-main document by @kingjia90 in #19209
• [Bug][Documents][Renderlets] Streamline passing of config attributes to renderlets by @robertSt7 in #19212
• Remove broken and unnecessary transaction handling from NotificationService by @jdreesen in #19207
• skip checking pdf after it has been checked and marked safe. by @cancan101 in #18541
• [Bug]: performance problem when copying object to folder with many children objects by @robertSt7 in #19205
• Fix typo in the docs by @jdreesen in #18951
• Remove service definition for non-existing service by @pimcoreneusta in #19100
• Fix Pimcore version in the docs by @jdreesen in #18950
• Fix null argument exception in tree by @wwnorden in #19111
• [Bug] Drop classic-UI markup from Video editable in-progress / error states by @markus-moser in #19107
• Add Copilot code-review agent skill by @mcop1 in #19219
• [Bug] Fix TypeError in for empty link localization (#19165] by @simonkey in #19208

New Contributors

• @ValeriaMaltseva made their first contribution in #19157
• @wwnorden made their first contribution in #19111
• @simonkey made their first contribution in #19208

Full Changelog: v2026.1.5...v2026.1.6