1.0.11

New

• The page media listing endpoint can now filter and sort by the metadata fields configured for the plugin, for example GET /pages/{route}/media?filter=rating:>=:3&sort=rating&order=desc. Fixes getgrav/grav#4200.

Improved

• The dashboard statistics endpoint now reports how many plugin, theme, and Grav core updates are available, plus whether the active theme itself has one, so the admin can show update counts without a separate request (getgrav/grav-plugin-admin2#124).

1.0.10

New

• A new per-account demo mode makes an account read-only across the whole admin, with an optional allowlist to still permit editing pages or uploading media.
• Demo content resets back to a captured baseline on a timer or with the new bin/plugin api demo:baseline and demo:reset commands, so a shared demo cleans itself up after visitors.
• Plugins can add per-user action buttons to the new admin's Users list that run a server-side operation against an account and can hand back a message or a safe redirect (grav-plugin-admin2#115).
• Autoloading admin widgets can declare the routes they apply to, so their script loads only on the matching admin screen instead of on every page (grav-plugin-admin2#116).

Improved

• Plugin and theme details now include the documentation and issue-tracker links from their blueprint, so the admin can link straight to a project's docs and bug tracker.
• The API plugin's own settings are now organized into tabs instead of one long scrolling form.
• Plugin-contributed link columns in the new admin's Users list can now show separate visible text from the link they point to (grav-plugin-admin2#111).

Bugfix

• Plugin sidebar labels now display in the signed-in user's admin language instead of the site's content language, so the sidebar no longer mixes languages (#14).
• Filtering the pages list by published, visible, or routable status now actually filters the results instead of being ignored (grav-plugin-admin2#121).
• Saving metadata with several media files selected now updates every selected file instead of only the last one (grav-plugin-admin2#117).
• [security] Reading a configuration section through the API no longer exposes stored passwords, API keys, and other secret values in plain text.
• [security] A user who can edit pages can no longer move a page to a location outside the pages folder, closing a path that let a page's files be written anywhere the server can write (GHSA-qjq4-jp55-4mx2).
• [security] Inviting a new user into a group is now restricted to super administrators, so a user who can only manage accounts can no longer invite someone straight into a super-admin group (GHSA-m86m-jjcg-gcvv).
• [security] Changing the API plugin's own settings, such as its CORS policy and rate limiting, now requires a super administrator, so a user with general configuration access can no longer weaken the API's own protections (GHSA-4pqv-2qj5-38fp).

1.0.9

New

• The new admin can now retrieve the Grav core changelog for versions newer than the one installed, so it can show what changed before you upgrade (getgrav/grav-plugin-admin2#109).
• Plugins can now add their own columns to the new admin's Users list, contributing safe per-user values that stay scoped to the page you are viewing (getgrav/grav-plugin-admin2#111).

Improved

• Media listings now include each file's saved alt text and title from its metadata, so the admin can insert an image with proper alt text instead of the filename (getgrav/grav-plugin-admin2#114).

Bugfix

• The page summary preview now returns clean stripped text instead of a slice of raw Markdown, so leading links and images no longer leave broken fragments in the new admin's page list (getgrav/grav-plugin-admin2#110).
• Media files whose extension has any uppercase letters, such as .JPG, can now be deleted instead of failing with a not-found error (getgrav/grav#4196).

1.0.8

New

• Edit a media file's metadata (alt text, title, caption, description, tags) directly in the new admin, with the managed fields configurable in plugin settings (admin2#99).
• The new admin's page editor can preview an unpublished page instead of a 404, removing the need for a separate draft-preview plugin (admin2#100).

Improved

• Plugins that add tabs to the new admin's Users list can choose the default tab and hide the built-in "All Users" tab (admin2#51).
• The new admin remembers a per-user Vim keybindings choice for its Markdown and code editors (admin2#95).
• Media, theme, and avatar listings prepare each thumbnail in a single pass, speeding up image-heavy listings.
• API-key-authenticated requests no longer rewrite the key store on every call; last-used time refreshes at most once a minute.
• The dashboard caches its media file count for a few minutes instead of scanning the media folder on every visit.

Bugfix

• [security] Generating or revoking an API key for another account now requires account-management permission, and only a super admin can do so for a super-admin account (GHSA-7v74-m76q-8wf3).
• The log viewer now lists the security log and any other files in the logs folder, not just a fixed set (admin2#107).
• A configuration tab added by a plugin or theme now opens and saves instead of a "scope not found" error (migrate-grav#16).
• The dashboard media count no longer counts hidden sidecar files (metadata, ordering).
• A user migrated from the classic admin keeps the interface language they had set there (admin2#98).
• The taxonomy field lists every taxonomy type declared for the site, even when none have been used yet (admin2#90).
• Opening a page preview no longer logs out a visitor signed in to the public site in the same browser (admin2#88, admin2#79).
• The scheduler view now includes the core backup jobs, previously missing from the list and its health check.

1.0.7

Bugfix

• Working in the new admin no longer logs out a visitor who is signed in to the public site in the same browser, by stopping API calls from replacing the visitor's session cookie when the admin reaches the API without one (getgrav/grav-plugin-admin2#88, getgrav/grav-plugin-admin2#79).

1.0.6

New

• The API can now keep an optional audit trail of admin activity such as logins, content edits, user changes, and configuration changes, available to super admins and turned off by default.
• Plugins can now add their own buttons to the new admin's Markdown editor toolbar.
• The new admin can now sign in through an OAuth provider such as GitHub or Google when the Login OAuth2 plugin is configured for it (grav-plugin-login-oauth2#52).

Improved

• The new admin now loads a plugin's custom field scripts in a single request per plugin instead of one request per field, so the page editor opens with far fewer round-trips.
• Custom field and editor scripts are now cached and revalidated cheaply, so reopening the editor no longer downloads them again each time.

Bugfix

• The new admin's page editor no longer intermittently fails to load the editor or custom fields when many of them request their scripts at the same time.
• The new admin's page editor again shows the Twig processing toggle to super admins and users granted the Twig content permission when the "Allow editors to toggle Twig in Content" option is off (grav-admin-next#5).
• Saving a page whose frontmatter has a text modified date no longer fails with an error in the new admin (grav#4170).
• Signing in to the new admin no longer resets the session of a visitor who is logged in to the public site in the same browser (admin2#79).
• Renaming a media file now keeps its original extension and cleans unsafe characters out of the new name (admin2#77).
• Saving system configuration in the new admin no longer fails when an unrelated, pre-existing setting is invalid, because only the fields you actually changed are now validated (grav#4176).
• Creating, copying, or moving a page at the site root no longer fails with a "Parent page not found" error on Windows (admin2#82).
• Admin labels for a region-specific admin language such as ru-RU now fall back to a plugin's matching short-code language file (ru) before English (#11, thanks @Sogl).
• The "Add to allowlist" button in the Twig-in-Content report now removes the block it just resolved instead of leaving the same row behind (admin2#85).
• Content entered into an Elements field's sub-fields is now saved in the new admin instead of being discarded, and editing those sub-fields now enables the Save button (admin2#86).

1.0.5

New

• API controllers can now send debug output to Grav's debugger without corrupting the JSON response, so values can be inspected in Clockwork and the new admin's debug panel (getgrav/grav-plugin-admin2#66).
• The API now keeps Grav's object cache on for its own requests even when caching is turned off for the site, so the new admin stays fast while you develop the frontend with the cache disabled (getgrav/grav-plugin-admin2#65).
• Requests authenticated with an API key are now much faster when repeated, because a verified key is briefly remembered instead of being re-checked with a deliberately slow hash on every request.
• API requests now report their authentication, routing, and controller timings to Grav's debugger, so the new admin's debug panel timeline shows where each request spends its time (getgrav/grav-plugin-admin2#65).
• The new admin's many simultaneous requests no longer queue up waiting on the session one at a time, so pages and lists load noticeably faster (getgrav/grav-plugin-admin2#65).
• Site-wide media files can now be saved in a custom order, stored per folder and applied whenever that folder's media is listed.

Bugfix

• Blueprint field unit labels such as the cache purge age now display correctly, showing "days" instead of a humanized key like "Day Plural" in the new admin (getgrav/grav-plugin-admin2#64).
• Deleting a page image now works for images that have a retina @2x variant, instead of failing with a "not found" error, and it removes the variant too rather than leaving it orphaned (getgrav/grav-plugin-admin2#68).
• Changing a module's template now renames it in place instead of creating a broken extra child page (getgrav/grav-plugin-admin2#69).

1.0.4

New

• Admin branding now stores a custom sign-in title, subtitle, a toggle to hide the "Powered by Grav CMS" line, and a custom favicon, exposed to the sign-in screen before login (getgrav/grav-plugin-admin2#54).
• The branding upload endpoint now accepts a favicon image alongside the light and dark logos.

Bugfix

• [security] Password reset and invitation emails now build their links only from your site's own address or an allowlisted origin, so an attacker can no longer redirect a reset link to a server they control and capture the token to take over an account (GHSA-5xc4-j99p-cp4m).
• [security] API access tokens can now be invalidated before they expire, so logging out, changing or resetting a password, and disabling an account immediately revoke any tokens already issued to that user (GHSA-m8g9-wxhx-6f86).
• New pages now keep only the default values the template author actually set, instead of also copying inherited collection and plugin settings (such as empty sitemap fields) into the page's frontmatter (getgrav/grav-plugin-admin2#53).
• Profile avatars now display for accounts whose avatar was stored as a plain filename, instead of appearing blank (getgrav/grav-plugin-api#9).
• Permissions granted to a user through group membership are now honored, so a user whose access comes only from a group can again see and use Pages, Media, and Reports (getgrav/grav-plugin-admin2#57).
• A group or user with no permissions set is now returned with an empty permission map rather than an empty list, so the admin can add the first permission to it (getgrav/grav-plugin-admin2#58).
• Page and media lookups now find pages under a hidden home route, so editing a home child page and its Media panel work when "Hide home route in URLs" is enabled (getgrav/grav-plugin-api#10).

1.0.3

New

• Plugins can now add their own tabs to the Users list, such as an "Active" or "Licensed" view that shows a filtered set of accounts, with search, permissions, and pagination still applied (admin2#51).

Bugfix

• New pages created through the admin now inherit their template's blueprint default values, so a page set to start unpublished is no longer published the moment it is created (admin2#49).

1.0.2

Bugfix

• [security] The token signing secret is now kept in a protected, non-committed file outside your site config instead of in plugins/api.yaml, so it can no longer be read from the config or leaked through templates, and existing logins keep working across the upgrade (getgrav/grav#4150).
• [security] File uploads through the API now reject names that hide a disguised second extension such as shell.php.jpg, closing a path that could let an executable script be saved and run on the server (GHSA-66v2-vxxf-xc3v).
• [security] SVG images uploaded through the API are now cleaned of any embedded scripts, so a malicious SVG can no longer run code in an admin's browser when viewed (GHSA-7vhm-8x52-2r5p).