v10.5.6

What's Changed

• fix: define BIBLESTUDY_* path constants in every application by @bcordis in #1430
• docs: trim CLAUDE.md to non-derivable content by @bcordis in #1432
• fix: read Proclaim version from manifest_cache, load language files everywhere by @bcordis in #1433
• feat: add GET /v1/proclaim/info API endpoint by @bcordis in #1434
• docs: add PR Hygiene section to CONTRIBUTING.md by @bcordis in #1435
• fix: restore ACL check in CwmsermonController::allowEdit() by @bcordis in #1451
• fix: add MultiCampusAccessTrait to CwmplaylistController by @bcordis in #1452
• fix: CwmcommentController::batch() references nonexistent 'Comment' model by @bcordis in #1453
• fix: route saveChapters() through Table save instead of raw SQL by @bcordis in #1454
• fix: make CwmsermonController::commentsEmail() private by @bcordis in #1455
• fix: escape group title in FiltersField.php by @bcordis in #1468
• fix: replace dark-mode-unsafe classes in 5 admin fields by @bcordis in #1470
• chore: add missing suites to composer test:unit script by @bcordis in #1471
• fix: escape interpolated values in Modal/ServerTypeField.php by @bcordis in #1472
• fix: escape hex value in ColorPickerField.php by @bcordis in #1473
• fix: correct inverted conditional in MediaFileField option labels by @bcordis in #1474
• fix: stop TemplateListField's static cache leaking XML options across instances by @bcordis in #1475
• fix: derive hardcoded jform[...] names from field state in 2 fields by @bcordis in #1476
• chore: remove two orphaned field classes with mismatched $type by @bcordis in #1477
• fix: correct base class for 9 fields extending ListField without a real list by @bcordis in #1478
• Migrate StudyField/TeacherDisplayField to ModalSelectField; delete orphaned LocationField by @bcordis in #1479
• Migrate ServerTypeField to core ModalSelectField by @bcordis in #1481
• Drop redundant per-location usage query in LocationGroupMappingField by @bcordis in #1482
• Field rendering-style cleanup: fix 3 correctness bugs from #1467 audit by @bcordis in #1485
• Migrate PopupCodeField/DescriptionFormatField scripts to WebAssetManager by @bcordis in #1486
• Migrate LocationGroupMappingField's serialisation script to WebAssetManager by @bcordis in #1487
• Migrate CustomField/ColorPickerField script and style to WebAssetManager by @bcordis in #1488
• Extract BibleVersionField's business logic to CwmbibleVersionHelper by @bcordis in #1490
• Correct CwmcpanelController's base class to BaseController by @bcordis in #1491
• fix: move CwmadminController's legacy AJAX SQL into CwmadminModel by @bcordis in #1493
• fix: move CwmmessageController's topic tag-sync into CwmmessageModel by @bcordis in #1494
• fix: harden CwmaiHelper AI Assist error handling against Gemini quirks by @bcordis in #1496
• refactor: extract CwmscriptureController's provider-fallback chain into a helper by @bcordis in #1497
• refactor: extract CwmpodcastController's HTTP streaming logic into CwmpodcastTrackHelper by @bcordis in #1498
• refactor: hoist API preprocessSaveData() field-stripping into a shared helper by @bcordis in #1499
• fix: checkDeleteFiles() 500s on every call; dedupe with CwmmediafilesHelper by @bcordis in #1500
• fix: controller cleanup nits — legacy by-ref getModel(), duplicated shutdown handler, dead code by @bcordis in #1504
• feat: episode number auto-fill, duplicate detection, and audit report by @bcordis in #1506
• fix: cwmseriesdisplays.paginateAjax always 500'd — two distinct root causes by @bcordis in #1507
• fix: delete-confirm.js sends the wrong CSRF token, silently disabling the warning modal by @bcordis in #1508
• fix: regenerate podcast RSS feeds when podcast settings are saved by @bcordis in #1510
• refactor: consolidate 5 duplicate sendJsonResponse() implementations into a shared trait by @bcordis in #1511
• chore: enable phpdoc_scalar and normalize long-form scalar types in PHPDoc by @bcordis in #1512
• fix: changePlayerByMediaTypeXHR() reads mediatype correctly and matches real records by @bcordis in #1514
• fix: CwmpIconvert PreachIT converter — broken redirect message, malformed/mis-escaped JSON, untyped params by @bcordis in #1516
• chore: bump dev dependencies (globals, rollup) and patch brace-expansion advisory by @bcordis in #1517
• fix: CwmpIconvert validates PreachIT access codes against #__viewlevels by @bcordis in #1520
• chore(deps): bump guzzlehttp/guzzle from 7.15.1 to 7.15.2 in /admin/src/Addons/Servers/Youtube by @dependabot[bot] in #1518
• fix: Cwmbackup validates table names against Proclaim's own tables by @bcordis in #1529
• fix: Cwmrestore restricts executed statements to Cwmbackup's own SQL shapes by @bcordis in #1530
• fix: Cwmassets nested-set drift on parent-reparent and N+1 in status query by @bcordis in #1531
• fix: Cwmrestore reads backuprestore via getCmd(), not getWord() by @bcordis in #1532
• fix: Cwmssconvert stops double-escaping bios and fixes crosswalk overwrite by @bcordis in #1533
• fix: Cwmbackup streams exportdb() in chunks instead of buffering the dump by @bcordis in #1534
• fix: remove dead Cwmstats::getTopScoreSite() method by @bcordis in #1535
• fix: CwmpIconvert book-number mapping and 8 other logic bugs by @bcordis in #1536
• fix: CwmImageMigration path traversal and 2 efficiency bugs by @bcordis in #1543
• fix: CwmmigrationHelper batch-skip, junction-row orphaning, TOCTOU doc by @bcordis in #1544
• fix: CwmcsvimportHelper access-control bypass, date-parsing corruption by @bcordis in #1545
• fix: CwmupgradeHelper drops live table, cleanup runs on failed upgrade, guided-tour errors hidden by @bcordis in #1546
• fix: CwmserverMigrationHelper external-host filename corruption, legacy-ID precedence by @bcordis in #1547
• fix: CwmtemplatemigrationHelper rename clobbers new params, rowspan cleanup skipped by @bcordis in #1548
• fix: CwmyoutubeQuota fail-open write failures, TOCTOU lost-update race, DST-unsafe reset by @bcordis in #1554
• fix: CwmyoutubeFileCache public cache dir has no access control, silent write failures, torn reads by @bcordis in #1555
• fix: CwmpodcastTrackHelper proxy drops Location header, Host-header-based misrouting by @bcordis in #1556
• fix: CwmaiHelper Gemini API key leak, silent failure masking, JSON extraction fragility by @bcordis in #1557
• fix: CwmplaylistSyncHelper fatal-flag write-back stop, logger fail-open, quota/upgrade-helper fixes (#1553) by @bcordis in #1559
• fix: multi-campus location filtering fatal-on-enable + fail-open bypass (#1561) by @bcordis in #1592
• fix: CwmschemaorgHelper stored XSS, Smart Sync hash mismatch, divergent sync builders by @bcordis in #1593
• fix: CwmImageCleanup path traversal, TOCTOU races, false-positive orphan detection by @bcordis in #1594
• test: trim tautological/vacuous/duplicate tests, consolidate copy-paste files by @bcordis in #1595
• test: correctness pass — fix tests that stayed green when guarded behavior broke by @bcordis in #1596
• test: seed fixtures so CI-vacuous integration tests exercise their real branches by @bcordis in #1597
• build: raise Node floor and CI runners to 24 (active LTS; 20 is EOL) by @bcordis in #1598
• fix: Cwmuploadscript upload() unreachable via type mismatch, Legal Extensions ignored by @bcordis in #1600
• fix: restrict cwmmediafile.xhr to an addon allow-list and require edit/create by @bcordis in #1601
• fix: Cwmalias backfill assigned duplicate aliases, serving the wrong record by @bcordis in #1602
• fix: CwmdbHelper execute() bool contract and unanchored table allow-list match by @bcordis in #1603
• fix: Cwmparams fatal on corrupt component params and on a missing admin row by @bcordis in #1604
• fix: correct corrupted Genesis verse-count table in BibleStructure by @bcordis in #1605
• fix: CwmDebug SQL buffer reachable by anonymous visitors; guard logger calls by @bcordis in #1606
• fix: Cwmthumbnail delete-before-write, unchecked encodes, missing resize allow-list by @bcordis in #1607
• fix: CwmanalyticsHelper w-domain corruption, rollup atomicity, and purge safety by @bcordis in #1610
• fix: honour Global Privacy Control, gate outbound clicks on consent by @bcordis in #1614
• fix: make topic associations atomic, unique and cascade-deleted by @bcordis in #1620
• fix: spellcheck addon language files — "Protocl" has been shipping since 2022 by @bcordis in #1615
• fix: stop overwriting admin-edited guided tours on every update by @bcordis in #1618
• fix: make scripture reference saving atomic by @bcordis in #1619
• fix: make teacher associations atomic by @bcordis in #1621
• fix: Cwmhelper fatal on null params, missed streaming skip, CLI warning by @bcordis in #1624
• fix: stop one corrupted thumbnail crashing the public podcast list by @bcordis in #1625
• fix: keep the extension on filenames containing # or ? by @bcordis in #1628
• fix: survive valid-JSON-wrong-shape params in description building by @bcordis in #1630
• fix: validate the whole body of an uploaded WebVTT file by @bcordis in #1631
• fix: read each page's own filters instead of the sermons list's by @bcordis in #1632
• fix: make action logging actually fail open by @bcordis in #1633
• fix: key and daily-rotate the analytics session hash by @bcordis in #1616
• fix: read the Getting Started checklist from the store that holds its settings by @bcordis in #1634
• fix: stop offering unservable Bible versions in a servable-only field by @bcordis in #1635
• fix: report failed YouTube log rotation, and keep reading the rotated file by @bcordis in #1636
• fix: bound outbound HTTP requests that could hang a worker indefinitely by @bcordis in #1637
• fix: throw a RuntimeException that exists by @bcordis in #1638
• fix: batch list methods return arrays, and each widget labels itself by @bcordis in #1639
• fix: stale backup version and 'worning' alert type by @bcordis in #1640
• fix: make episode numbers unique within a series by @bcordis in #1629
• ci: bump github/codeql-action from 4.37.3 to 4.37.4 in the actions-minor-and-patch group by @dependabot[bot] in #1489
• perf: batch and chunk the Schema.org bulk sync (#1562) by @bcordis in #1641
• fix: make (remote playlist, server) unique and de-dup existing rows (#1560) by @bcordis in #1642
• fix: follow Joomla's delete flow for teachers (#1622) by @bcordis in #1643
• fix: make the media display batch apply a whole configuration (#1627) by @bcordis in #1644
• fix: stop storing referrer query strings, retire the dead retention setting (#1612, #1609) by @bcordis in #1645
• test: complete the release gate for 10.5.6 and stop reset-testsite leaking rows by @bcordis in #1646
• fix: YouTube title matching skips the reversed reading (#1591) by @bcordis in #1647
• fix: the Getting Started podcast step could never appear (#1626) by @bcordis in #1648
• test: pin scripture rendering before converting the read paths (#1623) by @bcordis in #1649
• docs: state behaviour in admin/src/Helper docblocks (#1617) by @bcordis in #1650
• docs: finish the behaviour-first docblock sweep for this repo (#1617) by @bcordis in #1651
• fix: count only submitted content as awaiting review, gate every cpanel tile by @bcordis in #1652
• fix: make admin list column sorting work (#1654) by @bcordis in #1655
• fix: make JSON decode failures observable (#1558 tier A) by @bcordis in #1657
• fix: stop two JSON fallbacks failing quietly (#1558 tier B) by @bcordis in #1659
• chore: pin lib_cwmscripture v1.1.9 and scripturelinks v1.2.1 by @bcordis in #1660
• test: make step 11 check its own precondition (lib_cwmscripture#37) by @bcordis in #1663
• fix: stop an absent index aborting the update, and get test:release green by @bcordis in #1665

Full Changelog: v10.5.5...v10.5.6