v8.4.0

What's Changed

Breaking Changes

• Make dragonfly an optional dependency by @tvdeyen in #4036
• Replace RemoteSelect with Tom Select by @tvdeyen in #4046
• refactor(admin): Remove jQuery from the admin frontend by @tvdeyen in #4057
• feat: Add Alchemy::UserMethods module by @tvdeyen in #4144

New Features

• refactor(alchemy-image-cropper): replace inline crop script with a custom element by @tvdeyen in #4038
• feat: Make Page and Node relatable resources by @tvdeyen in #4039
• feat(admin): stack form labels above fields on small viewports by @tvdeyen in #4075
• feat(sitemap): cache the XML sitemap by @tvdeyen in #4054
• feat: Use inline labels for primary actions by @tvdeyen in #4108
• feat(admin): show image file type in picture info dialog by @tvdeyen in #4117
• fix(tasks): pre-generate thumbnails for active_storage by @tvdeyen in #4037
• feat: Add a help button by @tvdeyen in #4123
• Select filter: multiple/include_blank as Boolean or Proc by @mamhoff in #4130
• feat: Add new empty state by @tvdeyen in #4132
• Permitted roles for restricted pages by @sascha-karnatz in #4112
• Add element-level opt-out for page caching by @robinboening in #3980
• feat(remote-select): add multiple selection support by @tvdeyen in #4139
• Add current user to Alchemy::Current by @tvdeyen in #4146
• feat(attachments): Support more audio and video media types by @tvdeyen in #4161
• feat(cache): control Cache-Control headers per page layout and element by @tvdeyen in #4150
• [8.4-stable] fix(uploader): restrict attachment uploads to an allowlist by default by @alchemycms-bot[bot] in #4211

Bug Fixes

• fix(elements): return element repository from block helper nested_elements by @tvdeyen in #4151
• [8.4-stable] fix(migrations): stop text column migrations from destroying data on SQLite by @alchemycms-bot[bot] in #4201
• [8.4-stable] fix(uploader): validate uploads by filename extension by @alchemycms-bot[bot] in #4204
• [8.4-stable] fix(migrations): only drop the DDL transaction where SQLite rebuilds by @alchemycms-bot[bot] in #4212
• [8.4-stable] fix(remote-select): restore the preselection silently by @alchemycms-bot[bot] in #4252

Performance Improvements

• perf(elements): reuse preloaded element set for nested rendering by @tvdeyen in #4148
• perf(taggable): cache the tag list to remove the tags N+1 by @tvdeyen in #4153
• perf(taggable): drop now-redundant tag eager loading by @tvdeyen in #4162

Security

• [8.4-stable] fix(remote-select): escape names in autocomplete highlight by @alchemycms-bot[bot] in #4184
• fix(csv export): escape formulas in admin resource exports [8.4-stable] by @tvdeyen in #4221
• [8.4-stable] fix(security): reject executable url schemes in nodes and ingredients by @alchemycms-bot[bot] in #4234
• [8.4-stable] feat(csp): send a Content Security Policy with admin responses by @alchemycms-bot[bot] in #4238

Dependencies

• chore(deps-dev): bump vitest from 4.1.8 to 4.1.9 by @dependabot[bot] in #4016
• chore(deps-dev): bump rollup from 4.61.1 to 4.62.2 in the rollup group by @dependabot[bot] in #4015
• chore(deps-dev): bump prettier from 3.8.4 to 3.8.5 by @dependabot[bot] in #4040
• chore(deps-dev): bump eslint from 10.5.0 to 10.6.0 by @dependabot[bot] in #4041
• chore(deps-dev): bump prettier from 3.8.5 to 3.9.4 by @dependabot[bot] in #4043
• chore(deps): bump tinymce from 8.6.0 to 8.7.0 by @dependabot[bot] in #4050
• chore(deps-dev): bump vitest from 4.1.9 to 4.1.10 by @dependabot[bot] in #4062
• chore(deps): bump tom-select from 2.6.1 to 2.6.2 by @dependabot[bot] in #4064
• bump prettier from 3.9.4 to 3.9.5 by @dependabot[bot] in #4071
• chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @dependabot[bot] in #4072
• chore(deps): bump @floating-ui/dom from 1.7.6 to 1.8.0 by @dependabot[bot] in #4077
• chore(deps): bump tinymce from 8.7.0 to 8.8.1 by @dependabot[bot] in #4092
• chore(deps-dev): bump sass from 1.101.0 to 1.101.3 by @dependabot[bot] in #4111
• chore(deps-dev): bump prettier from 3.9.5 to 3.9.6 by @dependabot[bot] in #4110
• chore(deps-dev): bump sass from 1.101.3 to 1.101.4 by @dependabot[bot] in #4114
• chore(deps-dev): bump sass from 1.101.4 to 1.101.7 by @dependabot[bot] in #4116
• chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 by @dependabot[bot] in #4118
• chore(deps-dev): bump sass from 1.101.7 to 1.102.0 by @dependabot[bot] in #4127
• chore(deps): bump tinymce from 8.8.1 to 8.8.2 by @dependabot[bot] in #4126
• chore(deps-dev): bump rollup from 4.62.2 to 4.62.3 in the rollup group across 1 directory by @dependabot[bot] in #4125
• chore(deps-dev): bump vite from 8.1.5 to 8.2.0 by @dependabot[bot] in #4135
• chore(deps-dev): bump rollup from 4.62.3 to 4.62.4 in the rollup group by @dependabot[bot] in #4140
• chore(deps-dev): bump vite from 8.2.0 to 8.2.1 by @dependabot[bot] in #4145
• chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 by @dependabot[bot] in #4147
• chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 by @dependabot[bot] in #4159
• chore(deps-dev): bump rollup from 4.62.4 to 4.62.5 in the rollup group by @dependabot[bot] in #4164
• chore(deps-dev): bump vite from 8.2.1 to 8.2.2 by @dependabot[bot] in #4165
• chore(deps-dev): bump sass from 1.102.0 to 1.103.1 by @dependabot[bot] in #4166
• chore(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #4170
• chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #4168
• chore(deps): bump codecov/codecov-action from 5 to 7 by @dependabot[bot] in #4169
• chore(deps): bump actions/stale from 5 to 11 by @dependabot[bot] in #4171
• chore(deps): bump actions/create-github-app-token from 2 to 3 by @dependabot[bot] in #4172
• chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 by @dependabot[bot] in #4180
• [8.4-stable] chore(deps): bump cropperjs from 1.6.2 to 1.6.3 by @alchemycms-bot[bot] in #4192

Other Changes

• refactor(alchemy-element-select): replace Select2 with Tom Select by @tvdeyen in #4024
• refactor(alchemy-color-select): replace Select2 with Tom Select by @tvdeyen in #4026
• refactor(alchemy-tags-autocomplete): replace Select2 with Tom Select by @tvdeyen in #4029
• Add Alchemy News reader dashboard widget by @tvdeyen in #4042
• refactor(alchemy-node-form): replace inline node form script with a custom element by @tvdeyen in #4044
• fix(admin): Delegate focus to the Tom Select control by @tvdeyen in #4056
• refactor(admin): Convert Dialog to native dialog element by @tvdeyen in #4055
• refactor(admin): Remove orphaned page layout filter partial by @tvdeyen in #4060
• Assign pictures and attachments via Turbo Streams by @tvdeyen in #4061
• Convert the remaining Rails UJS remotes to Turbo by @tvdeyen in #4063
• refactor(admin): Render the Tom Select remove button as a button element by @tvdeyen in #4065
• chore(dev): make Docker dev rebuilds easier and uid-safe by @tvdeyen in #4067
• Save element editor via a Turbo Stream by @tvdeyen in #4069
• feat(admin): make the main navigation menu scrollable by @tvdeyen in #4073
• refactor(admin): submit dialog forms with Turbo instead of UJS by @tvdeyen in #4078
• fix(admin): guide admin JS clients through permission denials by @tvdeyen in #4079
• Remove @rails/ujs by @tvdeyen in #4074
• refactor: Extract Alchemy::SitemapController by @tvdeyen in #4080
• fix: Flash notices position by @tvdeyen in #4093
• feat(admin): Notify after updating an ingredient by @tvdeyen in #4095
• chore: Fix dummy app ability by @tvdeyen in #4094
• refactor(dev): Run a single live reload watcher by @tvdeyen in #4096
• Docs(config): describe how link_target_options values are applied by @Dirk82 in #4097
• chore: Convert uploader button into a view component by @tvdeyen in #4098
• fix(admin): keep dialog open when file picker is cancelled by @tvdeyen in #4101
• refactor(admin): migrate alchemy-action to Turbo StreamActions by @tvdeyen in #4109
• chore: Remove bundled config.yml in favor of Ruby config defaults by @tvdeyen in #4113
• chore: Remove useless archive_all DOM id by @tvdeyen in #4115
• feat(dashboard): Show license and LICENSE dialog in system info widget by @tvdeyen in #4121
• New panel style by @tvdeyen in #4122
• Add alchemy-conditional-field web component by @sascha-karnatz in #4128
• Rebuild admin resource table frame by @tvdeyen in #4131
• ci(codecov): flag coverage legs and wait for all uploads by @tvdeyen in #4136
• ci: make the ruby 4.0 build required by @tvdeyen in #4137
• fix(uploader): render upload progress inside the dropzone by @tvdeyen in #4143
• chore: Test with latest postgres (18) by @tvdeyen in #4149
• chore: Add annotaterb and annotate model schemas by @tvdeyen in #4152
• fix(Menubar): Normalize line-height by @tvdeyen in #4154
• refactor(Publishable): Extract resolution into configurable resolver by @tvdeyen in #4160
• fix(taggable): guard tag_list against a nil cache column by @tvdeyen in #4176
• feat(preview): make preview load timeout configurable by @tvdeyen in #4177
• fix(mysql): Do not add defaults in text columns by @tvdeyen in #4174
• feat: Add admin component registry by @tvdeyen in #4182
• [8.4-stable] docs(models): regenerate schema annotations after dropping text defaults by @alchemycms-bot[bot] in #4195
• [8.4-stable] fix(admin): scope nested element form to parent on validation error by @alchemycms-bot[bot] in #4197
• [8.4-stable] fix(dragonfly): derive the attachment extension from the file name by @alchemycms-bot[bot] in #4209
• [8.4-stable] fix(admin): show validation errors on the new element form by @alchemycms-bot[bot] in #4216
• [8.4-stable] fix(tom-select): close the dropdown before destroying a select by @alchemycms-bot[bot] in #4220
• [8.4-stable] fix(admin): render element preview text as plain text by @alchemycms-bot[bot] in #4224
• [8.4-stable] feat(csp): add nonces to inline script tags by @alchemycms-bot[bot] in #4229
• [8.4-stable] fix(admin): make the language switch a POST request by @alchemycms-bot[bot] in #4230
• [8.4-stable] refactor(admin): move clear schedule behaviour into a web component by @alchemycms-bot[bot] in #4231
• [8.4-stable] chore(admin): remove dead create_language route by @alchemycms-bot[bot] in #4232
• [8.4-stable] chore(deps): bump tinymce from 8.8.2 to 8.9.0 by @alchemycms-bot[bot] in #4241
• [8.4-stable] fix(importmap): pin transitive dependencies of standalone components by @alchemycms-bot[bot] in #4249
• [8.4-stable] fix: Remove default role from user by @alchemycms-bot[bot] in #4250
• fix(csp): allow images from any https host by @tvdeyen in #4253
• [8.4-stable] fix(remote-select): UX improvements by @alchemycms-bot[bot] in #4256
• [8.4-stable] fix(remote-select): report a failed load instead of showing no results by @alchemycms-bot[bot] in #4260
• [8.4-stable] perf(admin): stop inlining tom-select and floating-ui into the bundle by @alchemycms-bot[bot] in #4262
• [8.4-stable] fix(remote-select): show a message while the dropdown loads by @alchemycms-bot[bot] in #4266
• [8.4-stable] fix(remote-select): stop clearing options and mark the selected one by @alchemycms-bot[bot] in #4267
• [8.4-stable] chore(deps): bump tinymce from 8.9.0 to 8.9.1 by @alchemycms-bot[bot] in #4269
• [8.4-stable] fix(resource button label): Use existing translation keys by @alchemycms-bot[bot] in #4274
• [8.4-stable] feat(installer): Patch gutentag migration versions by @alchemycms-bot[bot] in #4276

New Contributors

• @Dirk82 made their first contribution in #4097

Full Changelog: v8.3.9...v8.4.0

What's Changed

Breaking Changes

• Make dragonfly an optional dependency by @tvdeyen in #4036
• Replace RemoteSelect with Tom Select by @tvdeyen in #4046
• refactor(admin): Remove jQuery from the admin frontend by @tvdeyen in #4057
• feat: Add Alchemy::UserMethods module by @tvdeyen in #4144

New Features

• refactor(alchemy-image-cropper): replace inline crop script with a custom element by @tvdeyen in #4038
• feat: Make Page and Node relatable resources by @tvdeyen in #4039
• feat(admin): stack form labels above fields on small viewports by @tvdeyen in #4075
• feat(sitemap): cache the XML sitemap by @tvdeyen in #4054
• feat: Use inline labels for primary actions by @tvdeyen in #4108
• feat(admin): show image file type in picture info dialog by @tvdeyen in #4117
• fix(tasks): pre-generate thumbnails for active_storage by @tvdeyen in #4037
• feat: Add a help button by @tvdeyen in #4123
• Select filter: multiple/include_blank as Boolean or Proc by @mamhoff in #4130
• feat: Add new empty state by @tvdeyen in #4132
• Permitted roles for restricted pages by @sascha-karnatz in #4112
• Add element-level opt-out for page caching by @robinboening in #3980
• feat(remote-select): add multiple selection support by @tvdeyen in #4139
• Add current user to Alchemy::Current by @tvdeyen in #4146
• feat(attachments): Support more audio and video media types by @tvdeyen in #4161
• feat(cache): control Cache-Control headers per page layout and element by @tvdeyen in #4150
• [8.4-stable] fix(uploader): restrict attachment uploads to an allowlist by default by @alchemycms-bot[bot] in #4211
• [8.4-stable] refactor: Use Alchemy.l for localizing dates and times by @alchemycms-bot[bot] in #4290
• [8.4-stable] Make standalone Tom Select components work outside the admin layout by @alchemycms-bot[bot] in #4339
• [8.4-stable] feat(admin): Add empty states to global pages and pages list view by @alchemycms-ci-bot in #4370
• [8.4-stable] Move the admin navigation into a typed menu configuration by @alchemycms-ci-bot in #4371
• [8.4-stable] feat(csp): Remove inline script from the preview frame by @alchemycms-bot[bot] in #4372

Bug Fixes

• fix(elements): return element repository from block helper nested_elements by @tvdeyen in #4151
• [8.4-stable] fix(migrations): stop text column migrations from destroying data on SQLite by @alchemycms-bot[bot] in #4201
• [8.4-stable] fix(uploader): validate uploads by filename extension by @alchemycms-bot[bot] in #4204
• [8.4-stable] fix(migrations): only drop the DDL transaction where SQLite rebuilds by @alchemycms-bot[bot] in #4212
• [8.4-stable] fix(remote-select): restore the preselection silently by @alchemycms-bot[bot] in #4252
• [8.4-stable] Pluralize the English name of the user model by @alchemycms-bot[bot] in #4307
• [8.4-stable] fix(admin): open resource usage links outside of the dialog frame by @alchemycms-bot[bot] in #4343
• [8.4-stable] fix(tinymce): Only check the current color swatch by @alchemycms-bot[bot] in #4360
• [8.4-stable] fix(redirects): Only redirect to published pages by @alchemycms-bot[bot] in #4399
• [8.4-stable] fix(Publishable): Only return records whose publication window has started by @alchemycms-bot[bot] in #4403
• [8.4-stable] fix(pictures): Respect format setting on picture ingredients by @alchemycms-ci-bot in #4415

Performance Improvements

• perf(elements): reuse preloaded element set for nested rendering by @tvdeyen in #4148
• perf(taggable): cache the tag list to remove the tags N+1 by @tvdeyen in #4153
• perf(taggable): drop now-redundant tag eager loading by @tvdeyen in #4162
• [8.4-stable] perf(admin): stop inlining tom-select and floating-ui into the bundle by @alchemycms-bot[bot] in #4262

Security

• [8.4-stable] fix(remote-select): escape names in autocomplete highlight by @alchemycms-bot[bot] in #4184
• fix(csv export): escape formulas in admin resource exports [8.4-stable] by @tvdeyen in #4221
• [8.4-stable] fix(security): reject executable url schemes in nodes and ingredients by @alchemycms-bot[bot] in #4234
• [8.4-stable] feat(csp): send a Content Security Policy with admin responses by @alchemycms-bot[bot] in #4238

Dependencies

• chore(deps-dev): bump vitest from 4.1.8 to 4.1.9 by @dependabot[bot] in #4016
• chore(deps-dev): bump rollup from 4.61.1 to 4.62.2 in the rollup group by @dependabot[bot] in #4015
• chore(deps-dev): bump prettier from 3.8.4 to 3.8.5 by @dependabot[bot] in #4040
• chore(deps-dev): bump eslint from 10.5.0 to 10.6.0 by @dependabot[bot] in #4041
• chore(deps-dev): bump prettier from 3.8.5 to 3.9.4 by @dependabot[bot] in #4043
• chore(deps): bump tinymce from 8.6.0 to 8.7.0 by @dependabot[bot] in #4050
• chore(deps-dev): bump vitest from 4.1.9 to 4.1.10 by @dependabot[bot] in #4062
• chore(deps): bump tom-select from 2.6.1 to 2.6.2 by @dependabot[bot] in #4064
• bump prettier from 3.9.4 to 3.9.5 by @dependabot[bot] in #4071
• chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @dependabot[bot] in #4072
• chore(deps): bump @floating-ui/dom from 1.7.6 to 1.8.0 by @dependabot[bot] in #4077
• chore(deps): bump tinymce from 8.7.0 to 8.8.1 by @dependabot[bot] in #4092
• chore(deps-dev): bump sass from 1.101.0 to 1.101.3 by @dependabot[bot] in #4111
• chore(deps-dev): bump prettier from 3.9.5 to 3.9.6 by @dependabot[bot] in #4110
• chore(deps-dev): bump sass from 1.101.3 to 1.101.4 by @dependabot[bot] in #4114
• chore(deps-dev): bump sass from 1.101.4 to 1.101.7 by @dependabot[bot] in #4116
• chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 by @dependabot[bot] in #4118
• chore(deps-dev): bump sass from 1.101.7 to 1.102.0 by @dependabot[bot] in #4127
• chore(deps): bump tinymce from 8.8.1 to 8.8.2 by @dependabot[bot] in #4126
• chore(deps-dev): bump rollup from 4.62.2 to 4.62.3 in the rollup group across 1 directory by @dependabot[bot] in #4125
• chore(deps-dev): bump vite from 8.1.5 to 8.2.0 by @dependabot[bot] in #4135
• chore(deps-dev): bump rollup from 4.62.3 to 4.62.4 in the rollup group by @dependabot[bot] in #4140
• chore(deps-dev): bump vite from 8.2.0 to 8.2.1 by @dependabot[bot] in #4145
• chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 by @dependabot[bot] in #4147
• chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 by @dependabot[bot] in #4159
• chore(deps-dev): bump rollup from 4.62.4 to 4.62.5 in the rollup group by @dependabot[bot] in #4164
• chore(deps-dev): bump vite from 8.2.1 to 8.2.2 by @dependabot[bot] in #4165
• chore(deps-dev): bump sass from 1.102.0 to 1.103.1 by @dependabot[bot] in #4166
• chore(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #4170
• chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #4168
• chore(deps): bump codecov/codecov-action from 5 to 7 by @dependabot[bot] in #4169
• chore(deps): bump actions/stale from 5 to 11 by @dependabot[bot] in #4171
• chore(deps): bump actions/create-github-app-token from 2 to 3 by @dependabot[bot] in #4172
• chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 by @dependabot[bot] in #4180
• [8.4-stable] chore(deps): bump cropperjs from 1.6.2 to 1.6.3 by @alchemycms-bot[bot] in #4192
• [8.4-stable] chore(deps): update ransack requirement from >= 1.8, < 6.0 to >= 1.8, < 7.0 by @alchemycms-ci-bot in #4351

Other Changes

• refactor(alchemy-element-select): replace Select2 with Tom Select by @tvdeyen in #4024
• refactor(alchemy-color-select): replace Select2 with Tom Select by @tvdeyen in #4026
• refactor(alchemy-tags-autocomplete): replace Select2 with Tom Select by @tvdeyen in #4029
• Add Alchemy News reader dashboard widget by @tvdeyen in #4042
• refactor(alchemy-node-form): replace inline node form script with a custom element by @tvdeyen in #4044
• fix(admin): Delegate focus to the Tom Select control by @tvdeyen in #4056
• refactor(admin): Convert Dialog to native dialog element by @tvdeyen in #4055
• refactor(admin): Remove orphaned page layout filter partial by @tvdeyen in #4060
• Assign pictures and attachments via Turbo Streams by @tvdeyen in #4061
• Convert the remaining Rails UJS remotes to Turbo by @tvdeyen in #4063
• refactor(admin): Render the Tom Select remove button as a button element by @tvdeyen in #4065
• chore(dev): make Docker dev rebuilds easier and uid-safe by @tvdeyen in #4067
• Save element editor via a Turbo Stream by @tvdeyen in #4069
• feat(admin): make the main navigation menu scrollable by @tvdeyen in #4073
• refactor(admin): submit dialog forms with Turbo instead of UJS by @tvdeyen in #4078
• fix(admin): guide admin JS clients through permission denials by @tvdeyen in #4079
• Remove @rails/ujs by @tvdeyen in #4074
• refactor: Extract Alchemy::SitemapController by @tvdeyen in #4080
• fix: Flash notices position by @tvdeyen in #4093
• feat(admin): Notify after updating an ingredient by @tvdeyen in #4095
• chore: Fix dummy app ability by @tvdeyen in #4094
• refactor(dev): Run a single live reload watcher by @tvdeyen in #4096
• Docs(config): describe how link_target_options values are applied by @Dirk82 in #4097
• chore: Convert uploader button into a view component by @tvdeyen in #4098
• fix(admin): keep dialog open when file picker is cancelled by @tvdeyen in #4101
• refactor(admin): migrate alchemy-action to Turbo StreamActions by @tvdeyen in #4109
• chore: Remove bundled config.yml in favor of Ruby config defaults by @tvdeyen in #4113
• chore: Remove useless archive_all DOM id by @tvdeyen in #4115
• feat(dashboard): Show license and LICENSE dialog in system info widget by @tvdeyen in #4121
• New panel style by @tvdeyen in #4122
• Add alchemy-conditional-field web component by @sascha-karnatz in #4128
• Rebuild admin resource table frame by @tvdeyen in #4131
• ci(codecov): flag coverage legs and wait for all uploads by @tvdeyen in #4136
• ci: make the ruby 4.0 build required by @tvdeyen in #4137
• fix(uploader): render upload progress inside the dropzone by @tvdeyen in #4143
• chore: Test with latest postgres (18) by @tvdeyen in #4149
• chore: Add annotaterb and annotate model schemas by @tvdeyen in #4152
• fix(Menubar): Normalize line-height by @tvdeyen in #4154
• refactor(Publishable): Extract resolution into configurable resolver by @tvdeyen in #4160
• fix(taggable): guard tag_list against a nil cache column by @tvdeyen in #4176
• feat(preview): make preview load timeout configurable by @tvdeyen in #4177
• fix(mysql): Do not add defaults in text columns by @tvdeyen in #4174
• feat: Add admin component registry by @tvdeyen in #4182
• [8.4-stable] docs(models): regenerate schema annotations after dropping text defaults by @alchemycms-bot[bot] in #4195
• [8.4-stable] fix(admin): scope nested element form to parent on validation error by @alchemycms-bot[bot] in #4197
• [8.4-stable] fix(dragonfly): derive the attachment extension from the file name by @alchemycms-bot[bot] in #4209
• [8.4-stable] fix(admin): show validation errors on the new element form by @alchemycms-bot[bot] in #4216
• [8.4-stable] fix(tom-select): close the dropdown before destroying a select by @alchemycms-bot[bot] in #4220
• [8.4-stable] fix(admin): render element preview text as plain text by @alchemycms-bot[bot] in #4224
• [8.4-stable] feat(csp): add nonces to inline script tags by @alchemycms-bot[bot] in #4229
• [8.4-stable] fix(admin): make the language switch a POST request by @alchemycms-bot[bot] in #4230
• [8.4-stable] refactor(admin): move clear schedule behaviour into a web component by @alchemycms-bot[bot] in #4231
• [8.4-stable] chore(admin): remove dead create_language route by @alchemycms-bot[bot] in #4232
• [8.4-stable] chore(deps): bump tinymce from 8.8.2 to 8.9.0 by @alchemycms-bot[bot] in #4241
• [8.4-stable] fix(importmap): pin transitive dependencies of standalone components by @alchemycms-bot[bot] in #4249
• [8.4-stable] fix: Remove default role from user by @alchemycms-bot[bot] in #4250
• fix(csp): allow images from any https host by @tvdeyen in #4253
• [8.4-stable] fix(remote-select): UX improvements by @alchemycms-bot[bot] in #4256
• [8.4-stable] fix(remote-select): report a failed load instead of showing no results by @alchemycms-bot[bot] in #4260
• [8.4-stable] fix(remote-select): show a message while the dropdown loads by @alchemycms-bot[bot] in #4266
• [8.4-stable] fix(remote-select): stop clearing options and mark the selected one by @alchemycms-bot[bot] in #4267
• [8.4-stable] chore(deps): bump tinymce from 8.9.0 to 8.9.1 by @alchemycms-bot[bot] in #4269
• [8.4-stable] fix(resource button label): Use existing translation keys by @alchemycms-bot[bot] in #4274
• [8.4-stable] feat(installer): Patch gutentag migration versions by @alchemycms-bot[bot] in #4276
• [8.4-stable] feat: Add Alchemy.l helper by @alchemycms-bot[bot] in #4280
• [8.4-stable] fix(dummy): Pin gutentag migrations to the oldest supported Rails by @alchemycms-bot[bot] in #4286
• [8.4-stable] refactor(csp): extract policy application into a concern by @alchemycms-bot[bot] in #4287
• [8.4-stable] refactor: Move autoloadable code out of lib into app by @alchemycms-bot[bot] in #4288
• [8.4-stable] fix(admin): Run turbo stream responses when loading a dialog by @alchemycms-bot[bot] in #4293
• [8.4-stable] chore(deps): update ransack requirement from >= 1.8, < 5.0 to >= 1.8, < 6.0 by @alchemycms-bot[bot] in #4298
• [8.4-stable] refactor: Convert node tree into web components by @alchemycms-ci-bot in #4299
• [8.4-stable] test: Remove flaky double click assignment specs by @alchemycms-bot[bot] in #4304
• [8.4-stable] refactor(admin): replace the inline picture archive scripts with custom elements by @alchemycms-bot[bot] in #4309
• [8.4-stable] refactor(admin): Move the page dirty guard out of inline scripts by @alchemycms-bot[bot] in #4310
• [8.4-stable] chore(deps): bump tinymce from 8.9.1 to 8.9.2 by @alchemycms-bot[bot] in #4314
• [8.4-stable] chore(brakeman): Ignore node url format validation warning by @alchemycms-bot[bot] in #4317
• fix(csp): make the admin Content Security Policy opt-in by @tvdeyen in #4321
• [8.4-stable] feat(csp): Render admin config data as JSON script tags by @alchemycms-bot[bot] in #4327
• [8.4-stable] fix(admin): translate without requiring the global Alchemy object by @alchemycms-bot[bot] in #4338
• [8.4-stable] Do not define alchemy-icon twice by @alchemycms-bot[bot] in #4341
• [8.4-stable] chore(deps): bump cropperjs from 1.6.3 to 1.7.0 by @alchemycms-bot[bot] in #4349
• [8.4-stable] chore(deps): bump tinymce from 8.9.2 to 8.9.3 by @alchemycms-bot[bot] in #4350
• [8.4-stable] chore(Gemspec): Remove imagemagick notice by @alchemycms-bot[bot] in #4356
• [8.4-stable] ci: Only start the database service a test job needs by @alchemycms-bot[bot] in #4375
• [8.4-stable] ci: Pin remaining jobs to ubuntu-24.04 runners by @alchemycms-ci-bot in #4376

Full Changelog: v8.3.11...v8.4.0