Sulu releases 2.6.26 and 3.0.9: TOTP, AI disclosure, and Symfony 8 support

Sulu has supported two-factor authentication for a while, but in practice most teams stopped at the email method. It works, and it protects your admin account with a mailbox that often sits behind exactly one password itself.

Both releases make the authenticator app a real option. Pick Authenticator app (TOTP) in your profile and a guided setup opens with a QR code. Nothing switches on until you confirm the first generated code, so you cannot lock yourself out halfway through. Generate backup codes for every active method, and when someone loses their phone, reset their setup from the user's permissions tab or from the console.

The code came from adesso. The Sulu partner hit this requirement in a customer project, built the feature properly, and offered it upstream instead of keeping it in a fork. It has been running in production there since.

New features normally go to the current major only. We made an exception because 2.6 is the long-term support release for existing projects, and this is exactly the kind of security requirement those projects still need to meet. Telling those teams to upgrade a major version just to use an authenticator app is not a useful answer. A separate post walks through the setup, the backup codes and the administrative reset.

The EU AI Act introduces transparency requirements for certain AI-generated and AI-modified content. We covered what that means for content teams in a separate post. Both releases now add fields to record and disclose the origin of media, contributed by MassiveLevi of Sulu partner MASSIVE ART. Every file version carries an origin of human created, AI generated, AI modified or unknown. Selecting one of the two AI values reveals a disclosure section with a text and a label icon. What the regulation means for content teams in practice is the subject of a separate post.

The feature adds columns to me_file_versions and me_file_version_meta. For Sulu 2.6.26, the required database changes are documented in UPGRADE-2.x.md, on Sulu 3.0.9 they ship as a Doctrine migration. Existing media default to unknown origin.

Sulu 3.0.9 now supports Symfony 8. Much of the work behind it is invisible. Across the admin, media, contact, and other bundles, request data is now read through the specific parameter bags instead of the removed Request::get(). Service definitions, security voters, and commands have also been updated for Symfony 8 compatibility. Parts of that groundwork were contributed by mamazu.

The release also allows doctrine/doctrine-migrations-bundle 4.0 and guzzlehttp/promises 3.0.

Both releases deprecate the last remnants of the REST abstraction Sulu once built on FOSRestBundle, along with the repository helpers of the persistence component. A plain Symfony controller with the services you actually need, and a repository built directly on Doctrine, are simpler and do not tie your code to Sulu internals. Nothing breaks with these releases. The affected APIs are only marked as deprecated. The affected classes and their replacements are listed in UPGRADE-2.x.md.

Requesting a page as <url>.html or <url>.htm rendered the page instead of redirecting, which could produce duplicate content. Such requests now answer with a permanent redirect to the canonical URL, as they did in Sulu 2.6, while custom formats are unaffected. 

The NavigationRepository crashed when its methods were called with the default arguments documented by its own interface. It now resolves the same defaults as the navigation Twig functions. This fix and the canonical URL fix were contributed by Amoifr.

The new ArticleBundle also did not apply configured webspace restrictions, causing articles to be exposed under every webspace. TheCadien contributed the fix.

Sulu 3.0.9 also widens the columns for slugs, webspace keys and template keys, so URLs that fit in Sulu 2.6 can be saved again. The slug grows from 144 to 255 characters, webspace and template keys from 31 to 64. Run php bin/console doctrine:migrations:migrate after upgrading. Databases that cannot support the wider columns keep the previous lengths with sulu_persistence.legacy_length, described in UPGRADE-3.x.md.

Searching a list by a non-text column, such as an ID or UUID, failed on PostgreSQL and now works in both releases. In Sulu 3.0.9, indexing no longer merges words that are separated only by an HTML tag, which previously made everything after the first word unfindable. Existing content benefits after a reindex with php bin/console cmsig:seal:reindex --drop. hual7 contributed that fix, along with a fix that prevents the resource locator from marking a form as dirty when a field is focused but left unchanged.

Clearing a link field now clears the complete value instead of leaving stale sub-properties such as target and anchor behind. The archive action also shows its icon again.

In Sulu 3.0.9, setting a parent company on an account no longer breaks the field after reloading. This fix was contributed by steeven-th.

Clearer Sulu.ai error messages

The writing assistant reports why the AI platform could not process a request down. Rejected credentials, exhausted credits and an inactive subscription each get their own message and lock the input, while genuinely temporary failures keep offering to try again.

For the full changelog, see the release notes for Sulu 2.6.26 and Sulu 3.0.9.