Sulu releases 2.6.23 and 3.0.6

One of the largest parts of this release cycle was internal modernization. Many bundles and packages were migrated from XML service definitions to PHP service definitions, including Admin, Media, Security, Page, Route, Snippet, Search, Contact, Category, Website and more. A large part of this work was contributed by mamazu.

For most projects, this does not change runtime behavior. The benefit is mainly maintainability: PHP service definitions are easier to refactor, easier to analyze and better aligned with modern Symfony projects. This also prepares the codebase for future framework upgrades.

Both branches include compatibility fixes and cleanup for newer dependencies. Sulu 3.0.6 upgrades Doctrine Bundle to version 3 and moves away from automapping in favor of explicit mapping configuration. There are also fixes around Doctrine ORM 3 return types, Doctrine/Gedmo compatibility and custom page model subclasses.

The 2.6 branch includes related compatibility work as well, helping existing projects remain easier to maintain while preparing for future dependency updates.

Sulu 2.6.23 and Sulu 3.0.6 upgrade the bundled CKEditor to version 47, a long-term support release. CKEditor 47 LTS guarantees continued security fixes and maintenance for the editor component, making this upgrade an important step for the long-term security of your project.

To support CKEditor 47 LTS, we had to raise the minimum Node.js requirement to Node 20. Node 18 has reached end of life and is no longer receiving security updates, so this breaking change was necessary to ensure the build toolchain itself remains secure. If your project requires building Sulu's admin with custom assets, please upgrade your Node.js version to 20 or higher before running the next build.

Sulu 3.0.6 continues to improve the new routing and content architecture. Several fixes address edge cases around internal links, redirects, route generation and navigation output.

This includes fixes for encoded slugs, absolute hreflang URLs and canonical URL generation. We also fixed route handling when multiple locales are involved and improved behavior around internal links in navigation and content resolution.

Navigation trees also received attention. Children of filtered parents are no longer promoted incorrectly, and navigation extension properties are merged more reliably. These improvements should make generated navigation output more predictable in multilingual projects and projects with custom filtering.

The 3.0.6 release includes several fixes around content selection and content resolving.

Smart Content tag filtering now uses tag IDs more consistently, thanks to a contribution by Amoifr. Furthermore, Smart Content parameters handle filtering and null property paths better. To support this change, Sulu 3.0.6 introduces a database migration that converts stored tag names to tag IDs. This also means that DoctrineMigrationsBundle is now a required dependency in Sulu 3.0. If your project does not already have it installed, you will need to add it before upgrading. Make sure to run bin/console doctrine:migrations:migrate as part of the upgrade process.

Snippet locale fallback for shadow locale entities was fixed as well. In addition, partial JSON field merges in form stores were improved, which prevents unexpected behavior in input fields when only part of a JSON-backed field changes.

A few changes improve everyday work in the Sulu Admin. Dropzone file type errors are now clearer, making upload problems easier to understand. Webspaces are sorted by name in webspace collections and page overlays, and category selection overlays behave more consistently, thanks to a contribution by MarkusHolstein.

Sulu 3.0.6 also fixes an issue where the AI application could crash when focusing fields inside excerpt and SEO extension tabs. Headlines in overlays are now focused automatically. Additionally two permission inheritance issues were fixed. The permission inheritance overlay was not always shown correctly, and newly created child pages did not properly inherit permissions from their parent. Both bugs could lead to unexpected access behavior in projects with fine-grained page permissions.

For project setup, the admin user password can now be customized during sulu:build. This is especially useful for automated environments and local project initialization. Duplicate portal keys are now detected earlier by throwing an exception.

Both releases include additional type improvements, PHPStan fixes, documentation updates and test updates after dependency changes. Sulu 3.0.6 also improves list builder and content query joins, while Sulu 2.6.23 includes a fix for users with multiple roles in access control queries.

For the full changelog, see the release notes for Sulu 2.6.23 and Sulu 3.0.6.