This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+2 more
Affected surfaces
ReleasePort's take
Moderate signalVersion 6.3.0 enforces strict CSP nonces for all inline scripts and adds host‑secure cookie prefixes, while moving PHP dependencies to Composer‑managed vendor/ and renaming core routes.
Why it matters: Security hardening via CSP nonces (severity 80) and Host‑Secure cookies (severity 75) protects against script injection; breaking changes require migration before upgrade.
Summary
AI summaryBroad release touches Helper Functions, Syntax & Markup Extensions, Upgrade Guide, and Security & Platform Hardening. Breaking: Removed legacy highlighter tags (css, ini, html, java, pascal, sql); migration required via admin_replace
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Enforces strict CSP nonces for all inline scripts. Enforces strict CSP nonces for all inline scripts. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Security | High |
Applies `__Host-` and `__Secure-` cookie prefixes for session cookies. Applies `__Host-` and `__Secure-` cookie prefixes for session cookies. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Breaking | High |
Moves all external PHP libraries from `lib/` to Composer‑managed `vendor/`. Moves all external PHP libraries from `lib/` to Composer‑managed `vendor/`. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Breaking | High |
Renames core handler routes to prefixed `_` form (e.g., `page/_edit`). Renames core handler routes to prefixed `_` form (e.g., `page/_edit`). Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Adds full undo/redo stack across editor sessions. Adds full undo/redo stack across editor sessions. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Introduces live preview rendering as you type in WikiEdit. Introduces live preview rendering as you type in WikiEdit. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Provides first‑class dark mode with OS detection and manual toggle. Provides first‑class dark mode with OS detection and manual toggle. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Adds new table attribute syntax for colspan, sticky headers, and CSS classes. Adds new table attribute syntax for colspan, sticky headers, and CSS classes. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Rewrites WikiEdit as ES2023 modules with state management, AbortController, autosave, search/replace, live preview, syntax highlighting, fullscreen mode, drag‑and‑drop images, markdown conversion, popup forms, toolbar customization, and resizable editor. Rewrites WikiEdit as ES2023 modules with state management, AbortController, autosave, search/replace, live preview, syntax highlighting, fullscreen mode, drag‑and‑drop images, markdown conversion, popup forms, toolbar customization, and resizable editor. Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
| Feature | Medium |
Integrates Phiki Highlighter v2.2.0 replacing legacy Pear highlighter; supports 350+ languages via TextMate grammars. Integrates Phiki Highlighter v2.2.0 replacing legacy Pear highlighter; supports 350+ languages via TextMate grammars. Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
| Dependency | Medium |
Removes `Clipboard.js` dependency; uses native `navigator.clipboard`. Removes `Clipboard.js` dependency; uses native `navigator.clipboard`. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Deprecation | High |
Removes legacy highlighters (`css`, `ini`, `html`, `java`, `pascal`, `sql`). Removes legacy highlighters (`css`, `ini`, `html`, `java`, `pascal`, `sql`). Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Bugfix | Low |
Repairs TOC generation logic for newly created pages. Repairs TOC generation logic for newly created pages. Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
| Bugfix | Low |
Fixes invalid selector tokens affecting "Copy to Clipboard" handlers. Fixes invalid selector tokens affecting "Copy to Clipboard" handlers. Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
| Refactor | Low |
Refactors complex legacy helpers (MarkUp, _LSum, _RSum, _TSum). Refactors complex legacy helpers (MarkUp, _LSum, _RSum, _TSum). Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
Full changelog
WackoWiki v6.3.0 — Major Feature Release
This release represents a massive architectural overhaul, bringing modern JavaScript tooling, a completely rewritten editor experience, hardened security defaults, and a flexible new syntax highlighter.
Headline Features
WikiEdit: Complete Rewrite (ES2023 + ES Modules)
The editor has been modularized into ES6 modules with a dedicated state management layer and a AbortController for all fetch calls.
| Feature | Description |
| :--- | :--- |
| Autosave | Never lose drafts again; automatic background persistence. |
| Full Undo/Redo Stack | Deep history management across sessions. |
| Search & Replace | Full regex-supported find/replace inside the editor. |
| Live Preview | Real-time rendering as you type. |
| Syntax Highlighting | Code blocks highlighted inside the editor. |
| Fullscreen / Zen Mode | Distraction-free writing (widescreen centered). |
| Drag & Drop + Paste Images | Upload assets directly into the edit buffer. |
| Markdown ↔ Wacko Converter | Seamless format switching via toolbar. |
| Popup Forms | Guided modals for complex Links and Tables. |
| Toolbar Customization | Add/remove/reorder buttons via config. |
| Resizable Editor | Drag handle to adjust height. |
Dev Note: Complex legacy helpers (
MarkUp,_LSum,_RSum,_TSum) have been refactored. Autocomplete selection bugs are fixed.
Security & Platform Hardening
- Content Security Policy (CSP) Nonces: All inline scripts now use strict nonces.
- Cookie Prefixes (RFC 6265bis):
__Host-and__Secure-prefixes applied for session integrity. - Native Clipboard API: Removed
Clipboard.jsdependency; uses modernnavigator.clipboardwith robust fallback. - Fixed Invalid Selector Tokens: Patched potential broken "Copy to Clipboard" handlers.
Core Architecture & Routing
| Change | Impact |
| :--- | :--- |
| Virtual _ Handler Prefix | Handlers moved to page/_edit, page/_show, etc.
Fixes namespace collisions where user pages named Something/edit clashed with core handlers. |
| Composer vendor Folder | All external PHP libraries moved out of lib/ into vendor/ (managed via Composer). |
| Config Array Upgrade | Configuration updates now respect $wacko_config_defaults live, ignoring potentially stale cache. |
| TOC Generation Fix | $this->toc logic repaired for newly created pages. |
UI & Theming
- Dark Mode: First-class support with OS detection (
prefers-color-scheme) and manual toggle. - Double-Click Edit Comments: Rapid inline editing for comment sections.
Syntax & Markup Extensions
Phiki Highlighter (v2.2.0)
Replaces the legacy Pear highlighter. Fast, modern, supports 350+ languages via TextMate grammars.
Migration Required: Obsolete highlighters removed (
css,ini,html,java,pascal,sql).
Action: Run theadmin_replaceaction to auto-migrate:%%(css) → %%(hl css) %%(sql) → %%(hl sql) ... etc
Table Markup Improvements
New attribute system for rows, cells, and tables.
New Syntax:
!| col | col |! # Header row with attributes
#|(attr=value) # Row attributes
Supported Attributes:
| Attribute | Values | Scope |
| :--- | :--- | :--- |
| span | number | Cell/Colspan |
| side | top \| bottom | Header/Foot position |
| class | alternate, sticky, default[left\|center\|right...], colN[left\|right...], col-N[left\|right...] | Styling hooks |
CSS Selectors Added:
.alternate— Zebra striping.sticky— Fixed header on scroll.default[left|center|right|top|middle|bottom]— Global cell alignment.colN[...]— Column N alignment (1–25).col-N[...]— Column N from right alignment (1–9)
Helper Functions
- New
table_attr()parser for the extended markup. - Wrapper
pagenow acceptscoloption.
Internationalization (i18n)
New complete translations added:
- 🇭🇷 Croatian (
hr) - 🇹🇭 Thai (
th) - 🇹🇷 Turkish (
tr) - 🇻🇳 Vietnamese (
vi)
Dependency Updates
| Library | Version | Status |
| :--- | :--- | :--- |
| Phiki | 2.2.0 | New (Replaces Pear) |
| Legacy Highlighters | — | Removed |
Upgrade Guide
- Run Composer:
composer install --no-dev(populatesvendor/). - Run Migrations: Execute the installer script.
- Migrate Highlighters: Run the
admin_replaceaction to convert%%(lang)→%%(hl lang). - Check Routes: If you have custom handlers or pages named
edit,show,properties, etc., verify they resolve correctly under the newpage/_*namespace. - Clear Cache: Delete
cache/config/andcache/template/(or runadmincacheaction). - Test CSP: Verify your web server passes the
Content-Security-Policyheader with nonces.
Credits
Huge thanks to contributors for the Phiki integration, the translation teams for HR/TH/TR/VI, and everyone testing the WikiEdit rewrite.
Full Changelog: https://github.com/WackoWiki/wackowiki/compare/6.2.1...6.3.0
Documentation: wackowiki.org
Breaking Changes
- Removed legacy highlighter tags (css, ini, html, java, pascal, sql); migration required via `admin_replace` action.
- Core handlers now use virtual `_` prefix namespace (`page/_edit`, `page/_show`, etc.), breaking pages named like `Something/edit` that clashed with core routes.
Security Fixes
- Implemented CSP nonces for all inline scripts to enforce strict content security policy.
- Applied `__Host-` and `__Secure-` cookie prefixes per RFC 6265bis for session integrity.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]