v20.15.0 🌈

Changes

🚀 Features

• Fix issue #4501 Exception noise from OAuth and REST (API2 ) (#4642)
• Allow empty qty-item field when creating a shipment (#4828)

🐛 Bug Fixes

• Fix issue #4312 add is_iterable() check in grid. (#4853)
• fix: updated ZF1Future (#4845)

📖 Documentation

• Doc min php8 (#4856)

🔨 Maintenance

• Bump version to 20.15.0 (#4858)
• rector: SimplifyRegexPatternRector (#4882)
• rector: ThrowWithPreviousExceptionRector (#4874)
• rector: ForRepeatedCountToOwnVariableRector (#4860)
• rector: NumberCompareToMaxFuncCallRector (#4870)
• rector: ClassOnThisVariableObjectRector & ClassOnObjectRector (#4878)
• rector: SingularSwitchToIfRector (#4861)
• rector: EmptyOnNullableObjectToInstanceOfRector (#4876)
• rector: RemoveDeadIfForeachForRector (#4864)
• rector: ShortenElseIfRector (#4879)
• rector: InlineArrayReturnAssignRector (#4868)
• rector: RemoveUnusedPrivateMethodRector (#4872)
• rector: ChangeSwitchToMatchRector (#4835)
• rector: FuncCallToConstFetchRector (#4871)
• rector: UnwrapSprintfOneArgumentRector (#4873)
• rector: FlipTypeControlToUseExclusiveTypeRector (#4869)
• rector: SimplifyEmptyArrayCheckRector (#4875)
• rector: RemoveUselessIsObjectCheckRector (#4865)
• rector: RenameFunctionRector (#4863)
• rector: RemoveUnreachableStatementRector (#4867)
• rector: RemoveDoubleAssignRector (#4862)
• rector: FinalizeTestCaseClassRector (#4866)
• rector: disabled rules one by one in config (#4859)

↗️ Dependencies

• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.75.0 to 3.80.0 (#4877)
• Bump dealerdirect/phpcodesniffer-composer-installer from 1.0.0 to 1.1.1 (#4852)
• Bump phpseclib/phpseclib from 3.0.45 to 3.0.46 (#4850)
• Bump rojopolis/spellcheck-github-actions from 0.49.0 to 0.51.0 (#4842)
• Bump phpseclib/phpseclib from 3.0.44 to 3.0.45 (#4839)
• Bump squizlabs/php_codesniffer from 3.13.1 to 3.13.2 (#4840)
• Bump nnnick/chartjs from 4.4.9 to 4.5.0 (#4841)

v20.14.0 🌈

Changes

• Update CODE_OF_CONDUCT.md (#4733)

🚀 Features

• Content Security Policy (CSP) Implementation a new approach (#4776)
• Inserted sample nginx config for API in api_nginx-frontend.conf (#4382)
• Support Apache 2.3+ Require all denied (#4813)
• add config_path to adminhtml/system_config_form (#4801)
• Added empiricompany/openmage_ignition as dependeny (#4800)
• feat: dashboard charts - bar/line option (#4775)
• feat: add "Last 3 Months" and "Last 6 Months" to dashboard charts (#4739)
• Added Cypress E2E tests (#4759)
• RWD theme: use jQuery via composer (#4429)
• FEAT: disable advanced search on storeview scope (#4668)
• Make php-8.1 minimum requirement (#4124)
• Add html-ids to admin nav-items (#4676)
• Replaced google dashboard charts with Chart.js (via composer) (#4435)

🐛 Bug Fixes

• Use sameSite setting in the session cookie (#4827)
• warning - fix undefined array key labels (#4777)
• Fix issue with incorrect product option pricing in admin console (#4779)
• Replace trigger_error, which is deprecated in PHP 8.4. (#4755)
• PHP8: fix newsletter preview (#4769)
• Fix: re-add composer/composer (#4762)
• Fix website-specific attribute values not loading correctly (#4745)
• Fix products duplicate across pagination when they have the same posi… (#4750)
• Fix MySQL connection for DDEV setup (#4720)
• Re-add DDEV files to composer installs (#4709)
• Fixes Mage_Eav_Model_Attribute_Data_Date and Mage_Core_Controller_Varien_Action date validations and empty value handling (#4605)
• Fixes coupon-code usage with today start/end date (#4456)
• Remove duplicated class name in customer attribute validation (#4662) (#4663)
• remove unused required parameters (#4626)
• Process only required attributes in api/rest/products/ (#4517)

📖 Documentation

• Add docs for JSONRPC API. (#4810)
• Add spellcheck to documentation (#4628)
• fix: Fix typo/spelling error on https://docs.openmage.org/users/install/ (#4724)
• docs: link to DDEV installation guide (#4710)
• Add a blog "Brief Guide on Grid Column" (#4678)

🔨 Maintenance

• Fixed README.md (#4836)
• workflow: update check-files.yml (#4811)
• Remove FlyingMana from mentions of maintainership (#4803)
• Shorter copyright header (#4767)
• PHPUnit: added/updated tests (#4758)
• PhpStan: some fixes (#4705)
• Cypress update (#4782)
• Add spellcheck to documentation (#4628)
• Updated Copyright (#4791)
• fix: sonar config (#4781)
• chore: update SonarCloud action (#4780)
• rector: added phtml-files (#4765)
• Fix: correct docblock type for set_error_handler (#4772)
• Updated Copyright (#4738)
• Updated workflows - use cache (#4761)
• rector: applied all rules up to php-74 (#4706)
• Update release-drafter.yml (#4716)
• chore: updated all composer dependencies for PHP 8.1 (#4711)
• Update release-drafter.yml (#4696)
• rector: applied all php-70 rules (#4703)
• rector: PowToExpRector (#4693)
• Updated PhpStorm meta-files (#4685)
• Update release-drafter.yml (#4683)
• rector: apply some php-73/php-80 rules (#4682)
• rector: ClassConstantToSelfClassRector (#4679)
• Bump version to v20.14.0 (#4665)
• rector: VarToPublicPropertyRector (#4677)
• Suggest n98/magerun in composer.json (#4667)
• Updated issue templates (#4600)
• Updated Copyright (#4658)

↗️ Dependencies

• Bump phpseclib/phpseclib from 3.0.43 to 3.0.44 (#4831)
• Bump squizlabs/php_codesniffer from 3.13.0 to 3.13.1 (#4832)
• Bump rector/rector from 2.0.15 to 2.0.16 (#4816)
• Bump phpstan/phpstan from 2.1.14 to 2.1.17 (#4821)
• Bump colinmollenhour/magento-redis-session from 3.2.1 to 3.3.0 (#4825)
• Bump mklkj/tinymce-i18n from 25.5.12 to 25.6.2 (#4829)
• Bump tinymce/tinymce from 7.9.0 to 7.9.1 (#4826)
• Bump rojopolis/spellcheck-github-actions from 0.48.0 to 0.49.0 (#4819)
• Bump symfony/translation-contracts from 3.5.1 to 3.6.0 (#4820)
• Bump mklkj/tinymce-i18n from 25.2.3 to 25.5.12 (#4814)
• Bump tinymce/tinymce from 7.8.0 to 7.9.0 (#4817)
• Bump rojopolis/spellcheck-github-actions from 0.47.0 to 0.48.0 (#4807)
• Bump squizlabs/php_codesniffer from 3.12.2 to 3.13.0 (#4805)
• Bump rector/rector from 2.0.14 to 2.0.15 (#4806)
• Bump tj-actions/changed-files from 45 to 46 (#4715)
• Bump symfony/polyfill-php83 from 1.31.0 to 1.32.0 (#4798)
• Bump symfony/polyfill-php84 from 1.31.0 to 1.32.0 (#4796)
• Bump phpstan/phpstan from 2.1.13 to 2.1.14 (#4795)
• Bump symfony/polyfill-php82 from 1.31.0 to 1.32.0 (#4797)
• Bump actions/checkout from 1 to 4 (#4787)
• Bump rector/rector from 2.0.11 to 2.0.14 (#4785)
• Bump phpstan/phpstan from 2.1.12 to 2.1.13 (#4784)
• Bump nnnick/chartjs from 4.4.8 to 4.4.9 (#4786)
• Bump colinmollenhour/magento-redis-session from 3.2.0 to 3.2.1 (#4783)
• Bump phpstan/phpstan from 2.1.8 to 2.1.10 (#4727)
• Bump tinymce/tinymce from 7.7.2 to 7.8.0 (#4766)
• Bump components/jquery from 1.12.4 to 3.7.1 (#4744)
• Bump shardj/zf1-future from 1.24.2 to 1.24.3 (#4752)
• Bump squizlabs/php_codesniffer from 3.12.1 to 3.12.2 ([#4751](https://github.com/Ope...

v20.13.0 🌈

Changes

🚨 Security

• CVE-2025-27400 - Sanitize skin urls that could be used for Stored XSS @justlife4x4 @colinmollenhour (#4654)
• [Backport] Added form key validation to Contacts form @sreichel (#4610)
• TinyMCE: potential fix for code scanning alert: Inefficient regular expression @sreichel (#4491)

🚀 Features

• TinyMCE: disable WYSIWYG if not installed @sreichel (#4495)
• Cache store in API2 for performance. @kiatng (#4631)
• Add SAMPLE_DATA option to dev/openmage/install.sh @colinmollenhour (#4602)
• Install flow.js (uploader) via composer @sreichel (#4469)

🐛 Bug Fixes

• keep attribute_id as keys in getFilterableAttributes () @empiricompany (#4639)
• Fix error in column renderer when value is empty and not null @aamant (#4601)
• php8: TypeError: Unsupported operand types: string * int @sreichel (#4526)
• Api2: Fixes getProductUrl @Hanmac (#4511)
• php8.3: fix deprecated passing null to str_replace() @sreichel (#4525)
• Avoid errors when trying to lock config if database is not yet available @colinmollenhour (#4603)
• Fix issue with double port in error pages base URL @massa-man (#4518)
• Fixed null deprecation in UnserializeArray.php @kiatng (#4394)
• php 8.3: fix catch for empty sitemap filename @midlan (#4521)
• Added currency code to cache-info for new products block @sreichel (#4514)
• Fixed null deprecation in Mage_Eav_Model_Attribute_Data_Text @kiatng (#4500)

📖 Documentation

• DOCS: added ddev docs for windows @sreichel (#4611)
• DOCS: added releases @sreichel (#4607)

🔨 Maintenance

• Bump version to v20.13.0 @sreichel (#4645)
• Chore: Check for DS / PS already set @sreichel (#4484)
• Remove obsolete phpstan baseline entry for invalid binary operation. @aamant (#4640)
• Drop ZIP-archive support @sreichel (#4485)
• Update release-drafter.yml @sreichel (#4638)
• PhpUnit: added test, ref #4518 @sreichel (#4524)
• Update release-drafter.yml template @sreichel (#4528)
• Workflow: updated PhpUnit versions @sreichel (#4619)
• CodeQL: updated config @sreichel (#4490)
• Cleanup: removed js/jscolor @sreichel (#4458)
• add justlife4x4 as a contributor for security @allcontributors[bot] (#4657)
• add mbattistini as a contributor for bug @allcontributors[bot] (#4608)
• add mark-netalico as a contributor for bug @allcontributors[bot] (#4586)
• PhpUnit: updated and added tests @sreichel (#4454)
• add real34 as a contributor for bug @allcontributors[bot] (#4572)
• add kanevbg as a contributor for bug @allcontributors[bot] (#4577)
• add vovayatsyuk as a contributor for bug @allcontributors[bot] (#4578)
• add roberto-ebizmarts as a contributor for bug @allcontributors[bot] (#4580)
• add tmotyl as a contributor for bug @allcontributors[bot] (#4573)
• add loekvangool as a contributor for bug @allcontributors[bot] (#4599)
• add midlan as a contributor for bug @allcontributors[bot] (#4595)
• add mehdichaouch as a contributor for doc @allcontributors[bot] (#4592)
• add jouriy as a contributor for bug @allcontributors[bot] (#4589)
• add justinbeaty as a contributor for bug @allcontributors[bot] (#4588)
• add ProxiBlue as a contributor for bug @allcontributors[bot] (#4587)
• add digitalpianism as a contributor for bug @allcontributors[bot] (#4583)
• add drwilliams as a contributor for bug @allcontributors[bot] (#4582)
• add boesbo as a contributor for bug @allcontributors[bot] (#4581)
• add leissbua as a contributor for bug @allcontributors[bot] (#4571)
• add fballiano as a contributor for bug @allcontributors[bot] (#4565)
• add schmengler as a contributor for bug @allcontributors[bot] (#4567)
• add elidrissidev as a contributor for bug @allcontributors[bot] (#4564)
• add Caprico85 as a contributor for bug @allcontributors[bot] (#4536)
• add gorbunovav as a contributor for bug @allcontributors[bot] (#4546)
• add joshua-bn as a contributor for bug @allcontributors[bot] (#4559)
• add seansan as a contributor for bug @allcontributors[bot] (#4562)
• add luigifab as a contributor for bug @allcontributors[bot] (#4560)
• add addison74 as a contributor for bug @allcontributors[bot] (#4539)
• add Tomasz-Silpion as a contributor for bug @allcontributors[bot] (#4547)
• add sreichel as a contributor for bug @allcontributors[bot] (#4543)
• add AlterWeb as a contributor for bug @allcontributors[bot] (#4551)
• add ioweb-gr as a contributor for bug @allcontributors[bot] (#4544)
• add seifer7 as a contributor for bug @allcontributors[bot] (#4549)
• add empiricompany as a contributor for bug @allcontributors[bot] (#4541)
• add kiatng as a contributor for bug @allcontributors[bot] (#4532)
• add theroch as a contributor for bug @allcontributors[bot] (#4535)
• Updated Copyright @github-actions[bot] (#4522)

↗️ Dependencies

• Bump perftools/php-profiler from 1.1.2 to 1.2.0 @dependabot[bot] (#4649)
• Bump friendsofphp/php-cs-fixer from 3.69.0 to 3.70.0 @dependabot[bot] (#4648)
• Bump phpstan/phpstan from 2.1.5 to 2.1.6 @dependabot[bot] (#4647)
• Bump symplify/vendor-patches from 11.3.7 to 11.4.1 @dependabot[bot] (#4650)
• Bump tinymce/tinymce from 7.6.1 to 7.7.0 @dependabot[bot] (#4646)
• Bump rector/rector from 2.0.8 to 2.0.9 @dependabot[bot] (#4635)
• Bump friendsofphp/php-cs-fixer from 3.68.5 to 3.69.0 @dependabot[bot] (#4634)
• Bump phpstan/phpstan from 2.1.3 to 2.1.5 @dependabot[bot] (#4636)
• Bump friendsofphp/php-cs-fixer from 3.68.1 to 3.68.5 @dependabot[bot] (#4530)
• Bump rector/rector from 2.0.7 to 2.0.8 @dependabot[bot] (#4621)
• Bump phpstan/phpstan from 2.1.2 to 2.1.3 @dependabot[bot] (#4622)
• Bump mklkj/tinymce-i18n from 24.12.30 to 25.2.3 @dependabot[bot] (#4609)
• Bump composer/composer from 2.8.4 to 2.8.5 @dependabot[bot] (#4506)
• Bump tinymce/tinymce from 7.6.0 to 7.6.1 @dependabot[bot] (#4507)
• Bump phpstan/phpstan from 2.1.1 to 2.1.2 @dependabot[bot] (#4508)
• Bump squizlabs/php_codesniffer from 3.11.2 to 3.11.3 @dependabot[bot] (#4509)
• Bump rector/rector from 2.0.6 to 2.0.7 @dependabot[bot] (#4499)
• Bump friendsofphp/php-cs-fixer from 3.67.1 to 3.68.1 @dependabot[bot] (#4498)

v20.12.3

🚨 Security

• CVE-2025-27400 - Sanitize skin urls that could be used for Stored XSS @justlife4x4 @colinmollenhour (#4654)

Full Changelog: v20.12.2...v20.12.3

v20.12.2 🌈

Changes

🐛 Bug Fixes

• No Layout on Redirect in CatalogSearch AdvancedController @Hanmac (#4494)
• Fix: InvalidParamTypeProvidedNULL: fixed login() method @eneiasramos (#4399)
• Fix: error in admin edit cart rule @Caprico85 (#4493)

🔨 Maintenance

• Update .all-contributorsrc @sreichel (#4481)

v20.12.1 🌈

Changes

🐛 Bug Fixes

• Fix: error in admin customer edit account @sreichel (#4488)

🔨 Maintenance

• Updated phpstan workflow @sreichel (#4461)

v20.12.0

Changes

🚀 Features

• Updated composer-plugin @sreichel (#4455)
• Deprecate Date_Short and removed strftime @Hanmac (#4462)
• Update Mage_SalesRule_Model_Quote_Discount @Hanmac (#4293)

🐛 Bug Fixes

• Fixes grid column type concat @sreichel (#4476)
• Fix regression bug for duplicate block rendering with getSortedChildren() @bucha (#4480)
• Hotfix: Incorrect attribute localization @sreichel (#4441)
• Catch exception when invalid country_id is submitted in estimate ship… @colinmollenhour (#4427)

🔨 Maintenance

• add bucha as a contributor for code @allcontributors (#4482)
• Workflow: release-drafter.yml update @sreichel (#4457)
• README: updated contributors list @allcontributors (#4479)
• Cleanup: removed phpversion check @sreichel (#4459)
• PHP-CS-Fixer: added all directories to checks @sreichel (#4406)
• Cleanup: update addHandle() docblock @sreichel (#4460)
• Workflow: update PhpStorm meta files @sreichel (#4445)
• PHPStan: added DOCblocks to most templates 🚀 @sreichel (#4468)
• Workflow: fixed invalid JSON @sreichel (#4470)
• PhpUnit: fixes Update LayoutTest.php @sreichel (#4453)
• PHPUnit: fixed test using wrong date format @sreichel (#4444)
• Updated phpstan to v2.1 @sreichel (#4430)
• All contributors bot @sreichel (#4446)
• Bumped version to 20.12.0 @sreichel (#4442)
• PHPUnit: added test for Mage_Core_Model_Layout::getBlockSingleton() @sreichel (#4431)
• Workflow: added release drafter @sreichel (#4443)
• Updated Copyright @github-actions (#4440)
• Updated README.md @sreichel (#4408)
• Mini DOCBlock update @sreichel (#4415)

↗️ Dependencies

• Bump openmage/composer-plugin from 2.0.0 to 3.0.0 @dependabot (#4472)
• Bump friendsofphp/php-cs-fixer from 3.66.1 to 3.67.1 @dependabot (#4473)
• Bump rector/rector from 2.0.5 to 2.0.6 @dependabot (#4474)
• Bump mklkj/tinymce-i18n from 24.12.9 to 24.12.30 @dependabot (#4450)
• Bump friendsofphp/php-cs-fixer from 3.66.0 to 3.66.1 @dependabot (#4449)
• Bump phpstan/phpstan from 2.1.0 to 2.1.1 @dependabot (#4451)
• Bump friendsofphp/php-cs-fixer from 3.65.0 to 3.66.0 @dependabot (#4434)

v20.11.0

What's Changed

As you can see, there are many many changes in this release! Thanks to all of the contributors for keeping OpenMage one of the fastest and most secure robust open source eCommerce platforms around!

Fixes

• Show correct version for main branch by @sreichel in #4137
• Allow to use $before parameter in addCss/addJs from XML by @Caprico85 in #4151
• Fixed issues #4134 undefined array index label_use_default in Mage_Catalog_Model_Product_Attribute_Backend_Media by @empiricompany in #4136
• Fix strlen() null deprecation in AccountController.php by @kiatng in #4155
• Added error directory to checks + php8.4 fix by @sreichel in #4184
• Add email link to set password. See issue #1205. by @kiatng in #3262
• Fixed undefined array key "values" in Mage_Catalog_Model_Product_Attribute_Backend_Media by @S0FTWEX in #4125
• Fix ACL Resource "admin/sales/order/actions/use" not found by @pbaldauf in #4199
• PHP8: Fixes passing null to str_contains() by @sreichel in #4203
• Fixed missing/wrong admin _setActiveMenu() by @sreichel in #4209
• Fix wrong Preview link on CMS pages grid by @Caprico85 in #4214
• In product list all swatches are always shown even if they are not available when "Display Out of Stock Products" is disabled by @empiricompany in #4100
• Openmage admin theme: Change background-color for active sections by @sreichel in #4219
• Backport: Added unittest for date and datetime by @sreichel in #4210
• Fixed strcmp(): Passing null to parameter #1 ($string1) of type strin… by @kiatng in #4212
• Custom product types - increased column length for widgets by @sreichel in #4226
• PHP8.1: Added getter method for Mage_Adminhtml_Block_Widget_Grid_Column::getType() to return string by @sreichel in #4238
• Admin theme: Change background-color for active sections by @sreichel in #4246
• Deprecated functionality: preg_match(): Passing null to parameter #4 … by @addison74 in #4251
• Bugfix: passing invalid ID to Mage_Catalog_Model_Url::refreshRewrites() by @sreichel in #4259
• Configurable: remove unused double foreach loop by @Hanmac in #4008
• Added ext-ftp to requirements by @sreichel in #4270
• Fixes configurable swatch color picker in legacy admin theme by @sreichel in #4218
• Fixed incorrect datetime in block, ref #1525 by @sreichel in #4242
• PHP8: base64_decode(): Passing null is deprecated by @sreichel in #4281
• Fix placeholder image in WYSIWYG editor when using a different admin theme by @Caprico85 in #4240
• [PHP 8.4] fgetcsv() - The $escape parameter must be provided as its default value will change by @addison74 in #4297
• [PHP 8.4] fputcsv() - The $escape parameter must be provided as its default value will change by @addison74 in #4298
• Fixes Mage_Core_Helper_Url::removeRequestParam() by @sreichel in #4295
• PHP84: ignore deprecated E_STRICT by @sreichel in #4289
• Fix deprecated message for strlen first value null by @leissbua in #4306
• Fixed full name observer calls in config.xml by @sreichel in #4309
• Fix Mage_Adminhtml_Block_Template::isOutputEnabled() for invalid module by @sreichel in #4320
• Fix: cannot add to wishlist from tag page - Customer account by @sreichel in #4329
• Fix duplicate block rendering with getSortedChildren() by @justinbeaty in #4337
• [PHP 8.x] Deprecated functionality: strtotime(): Passing null to para… by @addison74 in #4339
• Fixes line-height for some H4 in admin legacy theme by @sreichel in #4335
• Added ext-pdo_mysql to checks by @sreichel in #4350
• Fix: create empty SimpleXMLElement by @sreichel in #4351
• Bugfix: cant create order from admin backend by @sreichel in #4348
• Deprecated functionality: preg_replace() by @addison74 in #4311
• Fixed null deprecation in Varien/Convert/Parser/Xml/Excel by @kiatng in #4375
• Fixed null deprecation in Mage_Catalog_Model_Product_Option_Type_Text::validateUserValue() by @kiatng in #4357
• Bugfix: Mage_Adminhtml_Helper_Dashboard_Data::countStores() on null by @sreichel in #4370
• Fix validateHttpVersion to be RFC 1945 and RFC 7230 compliant by @leissbua in #4368
• Fix for catalog_product_relation not being deleted when bundle option deleted. by @dannydnz in #4395
• Fix unserializeArray on nonserialized string by @Hanmac in #4387
• [Tax] add FK to tax/sales_order_tax again by @Hanmac in #4334
• Fix Possible Array Access warnings in Captcha Observer by @Hanmac in #4424

Features

• New feature: Added "Newsletter Subscription Form" widget by @empiricompany in #4095
• Added support to specify file upload dir in system configuration by @eneiasramos in #4079
• Add new method to get config value directly from DB bypassing cache. by @kiatng in #4163
• Updated Varien_Object::getData() and added getDataByKey() & getDataByPath() by @sreichel in #4205
• Admin config: added input validation & hide disabled options by @sreichel in #4232
• Better config for admin RSS links by @sreichel in #4243
• Prevent delete/disable CMS pages used in configuration by @sreichel in #4239
• Unified admin grid columns and added XML configuration by @sreichel in #4225
• Make Mage_GiftMessage optional in templates by @Hanmac in #4266
• Cache isModuleOutputEnabled or isModuleEnabled status by @sreichel in #4323
• Use transliterator_transliterate to generate "url_key" by @sreichel in #4315
• New feature: Highlight popular countries in country select by @ma4nn in #4089
• Install TinyMCE 7.5 via composer by @sreichel in #4113

Security

• TinyMCE security fix by @sreichel in #4157
• Obfuscated login credentials in stacktraces by @sreichel in #4388

DDEV

• [DDEV] Adding n98-magerun support for the test environment by @addison74 in #4107
• DDEV: file permission and bugfix by @sreichel in #4145
• DDEV: command for local development by @sreichel in #4133
• [DDEV] Support for xhprof/xhgui by @sreichel in #4325
• DDEV: updated install script by @sreichel in #4407

Coding style

• PHPCS: fixed php compatibility warning by @sreichel in #4148
• PHPCS: ignore mcrypt related warnings by @sreichel in #4147
• PHP-CS-Fixer: added check for double quotes by @sreichel in #4126
• PHPCS: fixed last PHPCompatibility check errors by @sreichel in #4164
• Small DocBlock update by @sreichel in #4160
• PHP-CS-Fixer: added check for short array syntax and logical operators by @sreichel in #4181
• PHP-CS-Fixer: added check for concat spaces by @sreichel in #4185
• PHPCS: patched ECG standard by @sreichel in #4149
• Rector: CQ - UnusedForeachValueToArrayKeysRector by @sreichel in https://github.com/OpenMage/mage...

v20.10.2

• bump coded in version tag, which was missed in the previous release.

Full Changelog: v20.10.1...v20.10.2

v20.10.1

Security fixes

• CVE-2024-41676 - GHSA-5vrp-638w-p8m2 Stored XSS in admin system configs

What's Changed

• Fixed null parameter warning in Mage_Wishlist_Block_Abstract by @addison74 in #4068
• Fixed null parameter warning in Mage_Shipping_Model_Resource_Carrier_Tablerate by @addison74 in #4073
• Updated TinyMCE to 6.8.4 by @fballiano in #4084
• fix codestyle - empty line by @Flyingmana in #4112
• Fixed UI bug in Newsletter Templates backend page, filters not saved in session by @eneiasramos in #4077
• Added check for isModuleOutputEnabled('Mage_Review') in customer's backend page by @eneiasramos in #4075
• Fixed null parameter warning in Mage_Wishlist_Controller_Abstract::allcartAction() by @addison74 in #4083
• Fixed null parameter warning in Mage_ImportExport_Model_Import_Entity_Product::_filterRowData() by @addison74 in #4086
• Fixed invisible configuration values in backend by @fballiano in #4085
• Added hadling of allowed_extensions for file uploads in backend's configuration section by @eneiasramos in #4078
• Backend: Improved "copy button" style in legacy admin theme by @ma4nn in #4072
• Missing translations in Mage_Sales.csv by @addison74 in #4110

Full Changelog: v20.10.0...v20.10.1