The November town hall is up, and it’s a snappy one as we head into the holidays. If you’d rather read than watch, here’s what we covered. Watch the full town hall on YouTube.
Why We Skipped Tuesday’s Release
You may have noticed we didn’t ship our usual Tuesday release this month. That’s because we put out an interim release in the middle of October. Those are rare. We usually save them for when something big broke in the previous release. This wasn’t that, but we fixed a few bugs that could have caused real trouble under certain configurations, and we’d rather get ahead of those than wait.
That release is 9.5.7. Nothing huge, but some nice things. The biggest one: Concrete CMS can now be installed with Composer without ignoring audits, so you won’t be blocked if you’re using Composer’s stricter security settings. That can shift as upstream dependencies change, but we’re doing our part to keep it smooth. We also fixed an upgrade problem that made it impossible to update to 9.5.5 on MySQL 8.
A few smaller changes are worth a mention. We now say why each security advisory is ignored. We’ve also changed how we guide AI tools on contributions, asking for short code comments and no automatic commits. Our AI policy has the details. There are fixes for custom styles on page versions and global areas, for adding a second block to a page type, and for missing Calendar events, plus some behind-the-scenes work on developer experience and testing.
Download 9.5.7 or update through Composer. The full 9.5.7 release notes have every change.
Next up is 9.5.8, planned for the beginning of December. If you find something broken or want something changed, tell us on GitHub. We always want to hear from you.
New in the Marketplace
Halloween Bats by [NLS] is a bit late for this year, but it’ll still be around next year. Install it and bats fly all over your site, randomized enough that it doesn’t get boring. They need a hero header to hang from, and they won’t fly for anyone who has reduced motion turned on. It’s free.
Rebar by [Robert McDowell] adds three reports to Concrete’s built-in Site Health dashboard: broken internal and external links, thin, duplicate or orphaned content, and outdated packages. The broken link report alone makes it worthwhile. It’s $29.
Wayfinding, also by [Robert], builds a table of contents from your page headings. Clicking a link scrolls to that section, and it updates as you edit the page. It’s especially handy for long content. It’s $19.
Truss, a third from [Robert], is an AI translation assistant. It uses DeepL, which has a free tier. Nothing goes live on its own: you choose which pages get translated, and you review and approve every translation before using it. So no bad surprises. It’s $29.
Data Retention by [ZanWeb] gives you scheduled tasks to clean up old form submissions (Express or classic form blocks), logs, and old page versions. You set what goes by age, and it’s automated from there. Nothing is deleted by default. Every cleanup option starts disabled and needs explicit confirmation, and you can preview what would be deleted first. It’s free and MIT licensed, so it’s a lovely gift to the community.
Site Spotlight: Flint Bishop Airport
Each month we look at what’s out there running on Concrete CMS, because it’s easy to forget how much a site can carry. This month it’s the Flint Bishop Airport website, built by our partner Addis Enterprises in Lansing, Michigan. They’ve run this site since 2016 and have kept it current through a couple of big redesigns.
Look at what the homepage does: live departures and arrivals, current TSA wait times, and parking rates, all in one place. Non-stop flights are listed with the new routes flagged.
Then the menu opens up to everyone else who uses the site, with bid notices, job openings, press releases, and even hangar rentals for pilots. That’s a lot of different audiences on one site, and it’s what we love about Concrete. Plenty ships in the box, so agencies like Addis Enterprises can spend their time on design instead of gluing pieces together. They’ve stuck with us for over a decade, and they make Concrete look great. Go take a look at bishopairport.org.
The PHP Security Patch and What It Meant for You
A few weeks back, the PHP Foundation announced a critical update to address major vulnerabilities. The details leaked a day early, so servers were overloaded on release day, and it was a scramble. A forum member asked whether they needed to do anything as a PortlandLabs hosting customer. The answer is no, absolutely not. That’s one of the biggest reasons to host with us, whether you’re on shared or white glove hosting. We have people whose job it is to care about this, and honestly, all of us were working on it in real time. [Link to forum thread]
One heads-up. We may enforce stricter PHP updates going forward, because we don’t want to run end-of-life PHP even when patches exist for older versions. That shouldn’t affect most sites, but PHP and add-ons are both complex, so a PHP update underneath your site may mean you need to check that everything still works as intended. If that happens, we’ll work through it with you.
That’s it for this month. We’ll see you next time.