Tags

1.2.0-alpha6

Release 1.2.0-alpha6

The largest security release this module has had: the outbound-call audit plus
six adversarial re-audit cycles. Three defects fixed here are things a
1.2.0-alpha5 site is running today -- the escaper could be undone after it ran,
private PDF downloads were granted by the wrong module, and two users exporting
the same view could receive each other's PDF.

Also fixes the Views table filter, which returned nothing in every
configuration since it shipped, and moves imported package assets out of the
PDF cache, where a routine template save deleted them.

260 tests, 1491 assertions, zero failures. See CHANGELOG.md for the full list.

1.2.0-alpha5

1.2.0-alpha5

Security release completing the 1.2.0-alpha4 fixes.

- Webform custom-Twig PDFs are now tokenized (they were enumerable from a
  sequential submission ID on the default public scheme).
- typst_font can no longer copy arbitrary application files (e.g. settings.php)
  into the web-served font directory; all caller-supplied paths now resolve
  through a single containment check.
- The sensitive-file guard is case-insensitive and broader (.env.*, keys,
  auth.json, backups, VCS dirs).
- The Typst binary status check runs again on Drupal 11.2+ (verified on 11.4);
  it had been silently skipped.
- Async webform PDF retries are bounded instead of looping every cron forever.
- Code blocks and '//' no longer break or truncate generated Typst.
- Webform attachments survive a deleted template.
- Token replacement is a single pass (~34x faster on large documents).

Full suite green: 187 tests, 1264 assertions. PHPStan L8 + PHPCS clean.
All Drupal.org CI jobs green.

1.2.0-alpha4

1.2.0-alpha4

Security release.

- PDF filename access token can no longer be bypassed by a caller supplying its
  own destination (webform submission PDFs were reachable at guessable public
  URLs on a default install).
- Views PDF export routed through the same token instead of a title-derived path.
- typst_file / typst_html image resolution contained to an asset root, closing a
  read of sensitive files (e.g. settings.php) into the web-served compile dir.
- HTML attributes (img width/height/alt, table colspan/rowspan) escaped or
  validated before reaching Typst source; escaper extended with backtick and <>.
- Universe scaffolder no longer re-introduces Twig it had just neutralized.
- Universe catalog version guard anchored, blocking CSS injection via the
  thumbnail URL.

Also: webform async generation is reachable and retries correctly; font cache
keyed by content instead of basename; route-subscriber test coverage added.

Full suite green: 141 tests, 850 assertions. PHPStan L8 and PHPCS clean.

1.2.0-alpha3

Typdf 1.2.0-alpha3 — scaffold CSRF hardening, escaping fixes, inline SVG

1.2.0-alpha2

Typdf 1.2.0-alpha2 — security and correctness hardening

1.2.0-alpha1

Typdf 1.2.0-alpha1

Security & architecture hardening release with Drupal 12 compatibility.
See CHANGELOG.md for the full list of changes.

1.1.0-alpha7

1.1.0-alpha6

Release 1.1.0-alpha6: Fix test dependencies and spelling

1.1.0-alpha5

1.1.0-alpha4

1.1.0-alpha3

Release 1.1.0-alpha3: Security hardening, quality audit, and Drupal 11 testing compliance

1.1.0-alpha2

1.1.0-alpha1

Release 1.1.0-alpha1: Heavy Duty Data

1.0.0-alpha2

1.0.0-alpha1