2.0.0-alpha.40

Breaking

• Writing CWA content (pages, layouts, routes, component groups and their order, component positions, every component including /move, and every page data class, project classes included) requires publishable.permission (or the class's #[Publishable(isGranted:)]), ANDed with any security the operation already has; opt an operation or resource out with extraProperties: ['publishable_permission' => false]. Form /submit stays public (#579)
• An email change's confirmation link goes to the new address instead of the current one, and setting newEmailAddress needs the signed-in user's current password as oldPassword on API writes and in NewEmailAddressType (a super admin enters their own; a cancel needs none) (#580)

Added

• emails.logo (a Twig path, default the bundle's logo) and emails.logo_width (pixels, optional) set the logo at the top of every email the bundle sends, whose alt text is now the website_name instead of Logo (#576)
• A notice to the current address when an email change is requested, with the new address masked and no link; user.emails.change_email_notice sets its subject or disables it (#580)

Fixed

• A user referenced by IRI from another resource's write is no longer processed as a new registration, which reset their emailAddressVerified (#575)
• A plainPassword set through the API is validated (6 to 4096 characters, 422 on plainPassword) before it is hashed, and setting a password no longer marks the email address verified; only a password reset does (#577)
• User lookups trim the identifier, so a username or email address with a trailing space (a mobile keyboard's) still signs in and still finds the user for password reset and resend verification (#578)