Our sixth patch release of Xibo CMS 4.5.
This is a security patch release primarily to address CVE-2026-111497 Broccoli2Shell: the Brotli decoder bug
What's Changed
- Chore(deps): Bump dompurify from 3.4.16 to 3.4.17 by @dependabot[bot] in #4008
- DataSet columns: refuse columns that belong to a different DataSet by @maurofmferrao in #4009
- Chore(deps-dev): Bump fast-uri from 3.1.7 to 3.1.9 by @dependabot[bot] in #4010
- Chore(deps-dev): Bump serialize-javascript from 7.0.5 to 7.1.4 by @dependabot[bot] in #4011
- Chore(deps-dev): Bump undici from 7.30.0 to 7.30.1 in /frontend by @dependabot[bot] in #4012
- Chore(deps): Bump symfony/yaml from 6.4.43 to 6.4.45 by @dependabot[bot] in #4016
- Dependencies: force es-toolkit to 1.52.0 for the CKEditor style XSS by @maurofmferrao in #4017
- Disable PHP session upload progress, update XMR to 1.5 by @dasgarner in #4019
- Release 4.5.6 by @dasgarner in #4018
Full Changelog: 4.5.5...4.5.6