v26.9.1

Breaking changes

• $app->query() now returns published content only, a theme that omitted ->published() no longer lists draft titles, excerpts, and bodies; call ->anyStatus() to include unpublished content
• $ava->get() no longer returns drafts, the template helper now applies the router's visibility rule and returns null for unpublished items
• Only PHP's own session cookie bypasses the webpage cache, previously any cookie did, so a single analytics cookie cost every returning visitor the cache; pages that genuinely vary per visitor must send Vary or their own Cache-Control, or be listed in webpage_cache.exclude
• Binary cache files are now signed, caches written by earlier versions carry no signature and read as empty, so run ./ava rebuild after upgrading by hand (./ava update rebuilds for you)
• The WebpageCache API is consolidated, tryCachedResponse(), getWithoutFullCheck(), isCacheableForRead(), and isCacheableForWrite() are replaced by get() and isCacheable(), and put() now returns bool

New features

• Add Query::anyStatus() to include unpublished content in a query, for callers that have their own access control
• Add webpage_cache.hosts configuration option listing additional hostnames allowed to populate the page cache

Bug fixes & improvements

• Sign binary cache files with HMAC-SHA256 and deserialise with allowed_classes => false
• Restrict Repository::recentMeta() to published content, allMeta() still returns every status
• Require content-item paths to resolve inside the content root in Repository::get(), matching getByFile()
• Ignore request Cache-Control and Pragma headers, which previously let any visitor force a full render on every request (RFC 9111 §5.2.1.4 permits a shared cache to ignore them)
• Scope the webpage cache to the hostname in site.base_url, preventing arbitrary Host headers from filling the cache directory with near-duplicate entries
• Cache archive pagination under its own key, ?paged=N is now stored instead of refused, and ?paged=1 shares the bare URL's entry
• Return 404 for archive and taxonomy pages requested past the last page, instead of rendering an empty listing for any ?paged value
• Stop persisting headers queued by PHP into cached entries, which replayed X-Powered-By and one-off header() calls to every later visitor
• Default generator_comment to false, so the exact version is no longer published on every page, and apply the same setting to the X-Render-Time header
• Honour cache: 0, cache: "no", and cache: "off" in frontmatter, previously only the YAML boolean false disabled the page cache for an item
• Load plugins before checking content index freshness, so a request that triggers a stale-cache rebuild no longer rebuilds without plugin-provided content types and routes
• Remove the duplicate pre-bootstrap cache implementation from public/index.php, leaving a single cache policy in WebpageCache; manual index mode still serves hits before the application boots
• Share query execution between the array and SQLite backends through QueryProcessor, with parity tests across both
• Correct the router's documented matching order, which listed prefix routes seventh when they are matched second, and remove a reference to an auto content index backend that has never existed
• Consolidated the test suite, replacing tests that asserted on literals declared in their own bodies with coverage of draft visibility, cache keying, host scoping, and cache signing (441 tests total)

Full Changelog: v26.9.0...v26.9.1

---

❗This project is under very early, active development and may contain bugs or security issues.
❗It is likely not ready for production websites.

You are responsible for reviewing, testing, and securing any deployment. Ava CMS is provided as free, open-source software without warranty (GNU General Public License), see LICENSE.