A quick one this month. Security patch, community thanks, and a site worth looking at.
A couple weeks before this town hall, Symfony used an AI security testing tool to audit their codebase and turned up 19 legitimate vulnerabilities across Symfony and Twig components. If that sounds familiar, it's because the fallout was pretty immediate: under newer versions of Composer, Concrete stopped installing entirely. The reason is that 9.5.0 shipped with an older, now-flagged version of Twig as a dependency (Twig was added as a first-class option in 9.5.0, which we covered last month). 9.5.1 had already addressed a lot of security issues, but this particular upstream problem surfaced right after that release went out.
9.5.2 fixes it. There were also some Twig-related issues in 9.5.1 affecting more advanced block configurations and custom block templating scenarios, and those are resolved here too. Page attributes are now grouped by set in the composer add form control dialog, which is a small quality-of-life improvement worth noting.
One more thing: over the weekend following the 9.5.2 release, a packaging issue caused the release to be temporarily unavailable on GitHub. That was fixed the morning of the town hall and is being monitored.
If you're running any 9.5.x version, update to 9.5.2. Back up first, as always. You can read the full 9.5.2 release announcement or the Composer, Twig, and Concrete CMS security post for the full technical background.
Community Thanks
Documentation this month: thank you to thirtythree.
GitHub activity came from iampedropiedade, janscarton, RobinBudy, Leapje, Dragoneyr, JohntheFish, nickratering, and shashank-informatics. Thank you all for keeping things moving.
Site In The Wild
Di Caudo + Partner AG is a Swiss architecture firm based in Glarus, Switzerland with about 40 years of history in the region. They do new builds, renovations, and interior architecture, and they needed a site that could carry that range without turning into a brochure. The site is built on Concrete's SaaS platform and not live yet, but it's worth highlighting now.
The design gets out of the way. Large photography, clean navigation, consistent project page structure: client, services, year, gallery. When a new project goes in it looks polished without anyone having to rebuild the layout from scratch. This came together on a tight timeline for a small team, and it shows none of that. Keep an eye out for the launch.
