Retcon v. 3.2.3

3.2.3 - 2026-07-03

Security

• Hardened filesystem path handling in the native image transform pipeline.

Fixed

• Fixed a bug where the retconInject filter would fail to inject non-well-formed HTML (e.g. unclosed void tags or bare entities), silently drop all but the first top-level node when injecting multiple sibling elements, and mangle plain text containing & or <.
• Fixed a deprecation notice ("Handling HTML entities via mbstring is deprecated") emitted on every filter invocation under PHP 8.2+.