- Fixed stored XSS vulnerabilities involving menu icon titles and submenu labels.

ZeroPoint 2.0.1 (2026-10-03)

ZeroPoint 2.0.1 (2026-10-17)

============================

- Hardened Font Awesome menu titles, including nested menu items.

  current URL language. Retained query strings, fragments and external URLs.

- Added cache dependencies for translated text and language-aware aliases.

- Restricted custom CSS to real .css files within the Drupal installation.

- Updated slideshow field guidance.

- Fixed a container preprocessing TypeError when CSS classes are supplied as

  a string. Preserved Aggregator layout classes for string and array input.

- #3630998: TypeError: in_array() argument #2 must be of type array, string given 

  in preprocessAggregatorContainer().

After upgrading, rebuild Drupal caches per site.

ZeroPoint 2.0.0

===============

# ZeroPoint 2.0.0 RC2 review

## Completed checks

- PHP 8.3.6 syntax checks: both hook files pass.

- PHPCS 4.0.4 with Drupal Coder 9.0.1, Drupal and DrupalPractice:

  zero errors and zero warnings. The default command scans the two PHP files;

  an explicit extension list additionally checks 83 authored files.

- PHP token comparison confirms that formatting changes preserve executable

  tokens, allowing only whitespace, comments and trailing-comma differences.

- All 58 Twig templates were source-reviewed and parsed with Twig 3.29.0,

  Drupal's translation parser and registered Drupal filter/function names.

  This is a syntax check, not a full Drupal render or sandbox-policy test.

- Default configuration keys/types match the theme schema. Optional block IDs,

  plugin IDs and region references are consistent. The Search block requires

  its node_search configuration. Active site configuration is not overwritten.

- YAML parsing, library paths, CSS parsing, JS syntax and ZIP integrity checked.

- The exact requested main-CSS author credit is retained. No Chief markers

  remain. Third-party assets, logo.png and minified JavaScript are unchanged.

## PHPCS commands

Run from the theme directory with Drupal Coder installed:

    phpcs --standard=Drupal,DrupalPractice -- .

The broader check used these additional arguments:

    --extensions=php,module,inc,install,test,profile,theme,css,info,txt,md,yml

    --ignore='*/css/vendor/*,*/fonts/*,*/LICENSE.txt'

No individual coding-standard findings were suppressed. Third-party CSS/fonts

and license text were excluded from the broader authored-file check.

The version key is omitted from .info.yml because Drupal packaging adds it.

The ZIP filename and release notes identify this local release candidate.

## Changes since RC1

- One normal grey search border, without the extra outline; its container

  follows the existing Rounded corners setting.

- Main-CSS author credit restored. Optional example styling removed from the

  main stylesheet and documented in the updated customization example.

- Custom CSS examples updated for current field/menu markup, logical spacing,

  menu breakpoints and standard gradients; obsolete examples removed.

- Footer menu link arguments corrected; Views column classes reset per column

  and sticky-header class updated; invisible fieldset descriptions honored;

  maintenance skip-link target supplied.

- Configuration labels/default ordering reviewed and Search dependency added.

- README and changelog rewritten; 2.0.0 release notes consolidate development

  builds. PHP indentation, array layout, comments and document wrapping fixed.

## What remains before final packaging

The author reported successful Drupal 11/12 testing, including language logos,

before the most recent template/configuration changes. Check the following on

this candidate:

- Book tree visibility and printer-friendly output (introduced in RC1).

- Footer menu, sortable/sticky Views tables and maintenance skip navigation.

- Header/search and sidebar appearance with the site's external custom CSS.

  An external copy is not updated by replacing the theme; merge it deliberately.

A fresh install with optional Search enabled/absent, comprehensive rendered RTL

coverage and runtime checks of every optional module were not performed here.

A full main-CSS refactor and an icon redesign remain separate future work.

ZEROPOINT 2.0.0 - CUSTOMIZATION EXAMPLES

ZEROPOINT - CUSTOMIZATION EXAMPLES

======================================

This directory contains a sample stylesheet and bundled demonstration images.

WHAT IS ACTIVE IN THE EXAMPLE?

------------------------------

The example enables branding, content-image floats, sidebar borders and

responsive sidebar columns, a 10em slider-image minimum height, and cookie

button styling. Remove any rules you do not want. Optional examples remain

commented out. Responsive rules are grouped at the bottom of the stylesheet.

Branding, the decorative sidebar background, the mobile header-background

rule and EU Cookie Compliance styling are active.

All customization examples are commented out, including image floats,

slideshow minimum height and sidebar borders. Uncomment only the examples

you need. Media galleries, field separation, block widths and component

spacing are part of the theme and do not depend on this example file.

Responsive rules are grouped at the bottom of the stylesheet.

ICON CUSTOMIZATION

------------------

Prefer Layout settings > Icon colors for social and page icon colors.

The example also documents CSS variables; leave the corresponding settings

blank to use those variables. Both SVG and Font Awesome use the same colors.

The Other social network image example hides either renderer. When using a

blank to use those variables. The theme uses its local SVG sprites.

The Other social network image example hides the normal SVG icon. When using a

personal copy, update its image URL as well. Page icons must be enabled for

page/file icon color rules to have an effect.

Zebra colors are shared by these listings. Empty color fields use defaults;

icon placeholders and pickers preview the selected shipped palette. Custom CSS

may change the actual inherited link color.

optional-layouts.html contains copyable markup for manually authored sections,

cards, image/text splits, features, buttons and videos. It is not loaded by the

theme and is not required by the settings controls. Supply your own content,

links and media; use a trusted text format or a theme template.