--- title: "v1.7.4" description: "A security release that requires Next.js 16.3.8 for three critical remote code execution advisories, plus fourteen audit fixes, inline post categories and tags, and password tools in the Admin." requested_language: ar language: en translation_notice: "This page isn't translated yet" url: https://docs.systhema.app/ar/changelog/v1.7.4 version: changelog docs_index: https://docs.systhema.app/ar/llms.txt --- > This page isn't translated yet. Showing English. ## ✨ Highlights 1.7.4 is a security release first. Next.js has shipped fixes for three critical remote code execution advisories, and every Systhema project should upgrade: `@systhemaui/next` and `@systhemaui/payload` now require **Next.js 16.3.8**, and `systhema upgrade` raises `next` to `^16.3.8` in your `package.json`. The Payload family moves to 3.90.2 at the same time. The rest of the release is the work merged since 1.7.3: a repo-wide audit with fourteen bug fixes, consistent `withSysthema()` defaults, inline creation of post categories and tags, password tools in the Admin, and a run of smaller Admin and CLI fixes. ### Next.js 16.3.8 is the minimum Three critical Next.js advisories are fixed in the 16.3 line: - [GHSA-vcvr-r3jv-pc5j](https://github.com/advisories/GHSA-vcvr-r3jv-pc5j): remote code execution through `next/og`'s `ImageResponse` (affects 16.2.0 to 16.3.5). - [GHSA-2xp9-vwfh-vxw4](https://github.com/advisories/GHSA-2xp9-vwfh-vxw4): unauthenticated remote code execution in the image optimization API when AVIF files are used (affects 16.0.0 to 16.3.2, and 15.x before 15.5.24). - [GHSA-p293-qw3h-jr36](https://github.com/advisories/GHSA-p293-qw3h-jr36): unauthenticated remote code execution on Windows-hosted servers (affects 16.0.0 to 16.3.2, and 15.x before 15.5.24). Next.js 16.3.8 also fixes a high-severity SSRF in image optimization ([GHSA-cjq9-62q9-8jv4](https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4)) and several medium cache-poisoning and disclosure issues. Both `@systhemaui/next` and `@systhemaui/payload` declare `next: ^16.3.8` as their peer range, so the upgrade's peer check writes that range into the project. The Payload family peer floor is `^3.90.2`. Newly scaffolded `next` and `payload` projects also get `pnpm.overrides` floors for transitive packages with high or critical advisories (`brace-expansion`, `browserslist`, `fast-uri`, `immutable`, `lodash`, `minimatch`, `picomatch`, `tmp`, `undici`, `ws`), each kept within its major. Existing projects do not get them automatically; see the upgrade section. ### Create post categories and tags as you type The Posts Category and Tags fields offer Create "…" when nothing matches the typed name (ignoring case). Picking it creates the document and selects it, with no drawer and no separate save, and focus stays in the input. On Tags, a comma commits the typed name and a pasted comma- or line-separated list selects the existing tags and creates the missing ones once each. The field is Payload's own relationship input underneath, so search, sorting, drag reorder and the "+" drawer work as before. It falls back to the plain field for editors without `create` permission on the collection, for `admin.allowCreate: false` and for polymorphic relations (#243). ### Password tools in the Admin Every Admin password input gets a show/hide button. New-password forms (create first user, account, user edit, Users → Create new, reset password) also get a generate button that fills both fields with a 20-character random password and copies it to the clipboard, a live rule checklist and a note when zxcvbn rates the password easy to guess. The rules (at least 8 characters, an uppercase letter and a number) are enforced on the server for create, update and reset password over REST and GraphQL; the Local API is not checked, and existing passwords keep working until they are changed. `users.passwords.enforce: false` keeps the checklist without rejecting. An opt-in `users.passwords.jev` setting asks TypeSafe's Jev for a second opinion; it sends the candidate password to TypeSafe and is off by default. See [Passwords](../payload/content/users.md#passwords) (#244). ### `withSysthema(config)` means the same as `withSysthema(config, {})` Called without a second argument, `withSysthema` used to turn the Components collection and the embed block off; called with any options object, both were on. Both forms now resolve the same way, with Components and embed on by default. The Google Maps block is on exactly when a non-blank `apiKey` is forwarded, and `apiKey` accepts `undefined`, so `googleMaps: { apiKey: process.env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY }` works directly. The hero, feature and post hero media types offer Google Maps only when a key is configured (#237). The schema consequences are under Breaking & Behavioral Changes. ### Client-side live preview in new projects New Payload projects start on `livePreview: { mode: 'client' }`, so the Admin preview re-renders unsaved changes on every keystroke. The Components preview now follows `livePreview.mode` too. The plugin default stays `'server'`, so existing projects keep their behaviour; add `livePreview: { mode: 'client' }` to opt in (#227). ### Purge Cloudflare from your own collections `autoPurgePaths(payload, paths)` is now exported from `@systhemaui/payload`, so a project with the Cloudflare module can purge the edge cache from its own collection hooks the same way Systhema's Pages, Posts and Redirects hooks do. See [Cloudflare](../payload/cloudflare/index.md). ### A Next project upgraded to Payload gets its Payload routes `systhema-core payload create-app-files` now writes Payload's `src/app/(payload)/` route group (the Admin page and 404, layout, `custom.scss`, a starter `importMap.js`, and the REST, GraphQL and GraphQL Playground routes) when the project has no such directory. The group is written whole or not at all, never overwritten and never recorded in the managed-files ledger, so every existing Payload project is untouched. After writing it, the command tells you to run `payload generate:importmap` (#241). --- ## ⬆️ Upgrade ```bash pnpm add -g @systhemaui/cli@latest cd systhema upgrade --dry-run systhema upgrade --yes --allow-database ``` The upgrade bumps `@systhemaui/*`, raises `next` to `^16.3.8`, and moves `payload` and every `@payloadcms/*` package to 3.90.2. A project that pins the Payload family exactly is moved to exactly 3.90.2, with whole-family overrides, as in 1.7.3. The bundled Lexical patch is keyed to `^3.90.0` and applies unchanged. One codemod runs: `rename-deduplicated-translation-keys` rewrites the 130 Admin translation keys this release removes to the keys that replace them, wherever your source passes one to `systhemaLabel()`, a drawer `labelKey` or `t('systhema:…')`. The upgrade regenerates the import map, which picks up the new Admin components (the Google Maps-aware media-type field, the creatable relationship field and the password assist provider). If you commit `importMap.js` and skip the upgrade's regeneration, run `payload generate:importmap` yourself; a provider missing from the map blanks the Admin. **If you call `withSysthema(config)` with no second argument**, the Components collection is now on, which adds a `components` table. Run the schema push in development, or create a Payload migration before deploying to a database with push disabled: ```bash pnpm payload migrate:create add-components pnpm payload migrate ``` On a push-mode PostgreSQL deployment, `systhema migrate --schema` adds it. To keep the old behaviour instead, pass `{ components: false, embed: false }`. **On Cloudflare, let `PURGE` through any method-restricted cache rule.** Single-URL purges are evaluated with the request method `PURGE`, so a cache rule that matches only `GET` and `HEAD` never sees them. Add `PURGE` to the rule's method list, or the posts purges this release adds have no effect. **Optional: add the security overrides to an existing project.** The `pnpm.overrides` floors new projects get are listed in `scripts/security-overrides.json`. Copy the entries into your project's `pnpm.overrides`, run `pnpm install`, and check with `pnpm audit`. --- ## ⚠️ Breaking & Behavioral Changes ### 1. Next.js 16.3.8 or later is required The `next` peer range of `@systhemaui/next` was `>=14.2.35 … || ^16.1.0` and that of `@systhemaui/payload` was `>=15.2.9 … || >=16.2.6 <17.0.0`. Both are now `^16.3.8`. A project still on Next 14 or 15 is moved to Next 16 by the upgrade's peer check, which is a major Next.js upgrade; read Next's 16 upgrade guide before running it on such a project. Projects already on Next 16 only move within the minor. ### 2. Components and embed are on without options; Google Maps needs a key `withSysthema(config)` now resolves exactly like `withSysthema(config, {})` (#237): - **Components and embed** default to on in both call forms. A project that called `withSysthema` with no options gets a new `components` table and the embed block. Manual: push or migrate the schema, or pass `{ components: false, embed: false }`. - **Google Maps** is on exactly when a non-blank `apiKey` is forwarded. A project that passed `googleMaps` with an empty or missing `apiKey` loses the block and the Google Maps media option until it sets a key; neither could render a map without one. `enabled: false` still turns the block off and keeps the key, so hero and feature map media still render. - A document that already stores `mediaType: 'googleMaps'` on a keyless project still validates, and the stored choice stays visible so an editor can switch away. Its map renders nothing instead of an empty iframe. ### 3. 130 Admin translation keys are removed Keys whose text was identical to another key in every shipped language are removed from all seven catalogs, and `common:advanced_settings` is merged into `common:advancedSettings` (English "Advanced settings"). A project that passes a removed key fails its typecheck. `systhema upgrade` rewrites them through the `rename-deduplicated-translation-keys` codemod; nothing is manual. Rendered labels are unchanged, except that the English `seo.websiteName` label is now "Website name" (#228, #231). ### 4. Password rules are enforced over REST and GraphQL Creating a user, changing a password or resetting one through REST or GraphQL now fails when the password has fewer than 8 characters, no uppercase letter or no number. Scripts that create users over HTTP with weak passwords need stronger ones, or set `users: { passwords: { enforce: false } }`. The Local API, and therefore seeds, is exempt (#244). ### 5. Developer accounts are hidden through read access Accounts with the `dev` role and without `admin` are now excluded from every users read a non-dev user makes, including the relationship picker behind a post's Author field, and the Users list counts are correct. Two consequences differ from 1.7.3 (#242): - An account with both `dev` and `admin` is now visible to non-dev users. It stays read-only to them. - Server code that reads users with `overrideAccess: true` is no longer filtered for a non-dev `req.user`. Public post bylines still name a dev author, and in the Admin an Author set to a hidden dev account shows as an ID. ### 6. `blocks. = { enabled: false }` works for every block Only `grid` honoured `enabled: false` in object form; other blocks kept emitting their CSS. Every object-form block now does. A `grid` object without `enabled` now counts as on (#228). ### 7. `create-app-files` respects a deleted managed file A managed file you deleted was recreated on every `create-app-files --override`. When the ledger records the path and the file is gone, the command now logs `Skipped (deleted locally).` and keeps the ledger entry, so the decision persists. A path with no ledger entry is still created. Note that `public/systhema-icon.svg` backs the Admin favicon (#226). --- ## 🐛 Fixes & Internal Improvements ### Bug Fixes - **Post, category, tag and author changes purge Cloudflare** — publishing, editing, unpublishing or deleting a post, category or tag, or editing an author, now purges the post URL, the homepage and the category, tag, archive and author listings. Before, these called only `revalidatePath`, and edge-cached HTML stayed stale - **Creating a user without touching Roles works again** — the Users `roles` field defaulted to the string `'editor'` on a multi-select, so the role escalation guard threw. It now defaults to `['editor']` - **Drawer and option labels follow the current Admin language** — Advanced settings drawer buttons and the option labels of `iconGroupField`, `buttonGroupField` and `colorSelectField` kept the language that first built the form after a server start. `drawerField()` accepts a `labelKey`, and labels from `systhemaLabel()` or `definePayloadAdminTranslations()` carry their key to the client (#231) - **Localized SEO settings land in `general_settings_locales`** — on a project with content localization, `migrate-seo-data` and `migrate-emails-data` resolve each field's destination from the config and write localized fields once per locale to the locales table instead of adding dead columns to the base table. Both SQL adapters; Mongo writes `{ [locale]: value }` (#226) - **The Mongo emails migration keeps existing tab keys** — `migrate-emails-to-general-settings` sets each copied key instead of replacing the whole Emails tab, as the SEO migration and the SQL paths already did (#230) - **JSON endpoints answer 400 on a non-object body** — posts-list, revalidate, AI SEO, AI alt-text and send-test-email answered a `null`, array or scalar body with a 500 (#232) - **`EmailField` accepts uppercase letters and `+` tags** — the default `pattern` rejected `Jane.Doe+news@Example.com`, which affected every Systhema form (#239) - **The CLI no longer crashes on `file:`, `link:`, `workspace:` or git specs** — `codemod`, `info`, `upgrade` and `doctor` report the raw spec as the version (#240) - **Hero descriptions are tagged with the `slot` tier** — inline blocks in a page or post hero's description were tagged `root`, so their tier-gated fields did not match their editor. `HeroBackgroundBlock` also loses its `aspectRatio` field, which was never shown and had no effect (#236) - **React and Next twins match** — react's Header and Footer instances take the localizable `labels` prop and name every navigation landmark, `has-subnav` marks the subnavigation trigger on desktop and mobile in both packages, next's `Link` accepts `disableAnimation`, next's `Card.a` renders `theme` as `data-theme`, next's `QuoteAvatar` accepts `preload`, and `@systhemaui/next` re-exports `getReactConfig` and `useDeferredVideoControls`. `