apostrophe 4.31.0 → 4.32.0

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Changelog
 
+## 4.32.0 (2026-07-10)
+
+### Adds
+
+- Added support for modules to declare _literal content_ routes - URLs that serve non-page files such as `robots.txt`, `sitemap.xml`, or `llms.txt` rather than rendered pages. External front-end integrations (such as the Astro integration) can now read these routes and serve such files correctly instead of attempting to render them as pages. Custom modules can contribute their own routes by handling the new `@apostrophecms/url:getLiteralContentRoutes` event.
+
+### Changes
+
+- The server-side HTTP client (`apos.http`) now uses Node's built-in `fetch` instead of `node-fetch`.
+
+  `node-fetch` is no longer maintained, and Node's built-in `fetch` is its standard, actively maintained successor, available in every Node.js version Apostrophe supports - so this is the right time to adopt it. We do not consider this a breaking change: common `apos.http.*` usage is unchanged, and we deliberately preserved compatibility where it mattered - `form-data` request bodies, cookie jars, the `timeout` option (now backed by an `AbortSignal`), and absolute redirect `Location` headers all behave as before.
+
+  Most code that calls `apos.http.get()`, `apos.http.post()`, etc. needs no changes. A few things to be aware of if you use advanced options or read raw responses:
+
+  - The `agent` option is no longer supported (the built-in `fetch` has no equivalent). Pass an undici `dispatcher` instead; `apos.http` throws if `agent` is given.
+  - A `Host` request header can no longer be set (it is disallowed by the fetch standard and is silently ignored).
+  - `originalResponse: true` now resolves with the built-in `fetch` `Response`. Its `body` is a web `ReadableStream` (use `require('node:stream').Readable.fromWeb()` to read it as a Node stream), and node-fetch-only helpers such as `.buffer()` are no longer available.
+  - Requests that send a conditional header (`If-None-Match` / `If-Modified-Since`) now also send `Cache-Control: no-cache`, as required by the fetch standard. An endpoint that returns `304 Not Modified` based on those headers may return `200` to such a request.
+
+  New capabilities:
+
+  - The `timeout` option (in milliseconds) and the standard `signal` (`AbortSignal`) and undici `dispatcher` options are supported.
+  - A request `body` may be a native `FormData`, in addition to a `form-data` package instance.
+
+- Bumped `glob` to `^13` (core) and `rimraf` to `^6` (uploadfs) to clear the deprecated `glob@10` warning shown on every install. The old `glob@10` arrived both directly from core and transitively through `uploadfs` → `rimraf@5`; both now resolve to the current, supported `glob@13` (`rimraf@6` depends on `glob@13` as well). No API or behavior changes.
+
+### Fixes
+
+- Fixed the tag popover in the media library (used to apply tags to images in bulk) so it loads all image tags instead of only the first 50. Tags beyond the first 50 can now be found and applied, and creating a tag whose name already exists no longer produces a duplicate.
+- The lock file dependency check that forces a full rebuild now runs once per process. Watcher-triggered rebuilds stay scoped to the detected changes instead of rebuilding everything on every file change when the lock file changed or is absent. This bug was in effect only for projects missing a lock file in their `npmRoot` (e.g. npm monorepos).
+- Fixed the admin UI sometimes serving a stale build after dependencies changed (for example after `npm install` or `npm update`). Apostrophe now detects dependency changes from the content of the lock file rather than its modified time, which could be misleading after a fresh checkout or a restored CI/Docker build cache.
+
+  For external build module authors: lock file change detection now happens in the core and is passed to the build module via the `lockChanged` build option. The `apos.asset.getSystemLastChangeMs()` helper is deprecated and the build manifest no longer includes a `ts` timestamp.
+
+- Fixed pressing Backspace right after typing `/` in a rich text widget deleting the entire widget. Backspace now removes the slash and closes the insert menu. Global command menu shortcuts also no longer fire for key events already handled and prevented by other UI components.
+- Fix invalid HTML output for <col> elements in sanitize-html (treat void elements correctly)
+- Fixed a layout issue where `dateAndTime` schema fields could overflow and trigger horizontal scrolling in narrow containers.
+- fromRichText adds metatype to new widget
+- Fixed the widget copy shortcut (Ctrl+C / Cmd+C) hijacking native text copy in edit mode. With an active text selection, the cut, copy and remove (Backspace) widget shortcuts now defer to the browser. Pasting a widget with Ctrl+V / Cmd+V now checks that the widget copy is still the most recent thing in the system clipboard, so text copied elsewhere in the meantime is no longer shadowed by a stale widget paste. The widget clipboard storage remains backward compatible with entries written by previous releases.
+- Batch jobs now reliably record their total item count, so completion notifications no longer occasionally report a null total.
+
+### Security
+
+- Completed the fix for CVE-2026-39857 (GHSA-xmpp-f9v3-r7qh). The `.choices()` / `.counts()` query builders (`?choices=` / `?counts=` on the public REST API) guarded against leaking distinct values of fields excluded from `publicApiProjection` by resolving the schema field with an exact-name match. A relationship field registers extra query builders whose names differ from the field name — the "slug" alias builders that drop the leading underscore (`author` / `authorAnd` for a field named `_author`) and the `_authorAnd` operation builder — so those aliases were not gated and could still be used by an unauthenticated caller to extract the relationship's distinct choices (the referenced, publicly visible related documents by title/slug, plus per-value counts via `?counts=`) for a relationship an operator intentionally excluded from `publicApiProjection`. Relationship alias builders are now resolved back to their underlying schema field (matching the field name or its `idsStorage`) before the `publicApiProjection` and `viewPermission` checks are applied, so the alias names are gated exactly like the field itself. Thanks to Ta Duc Thien ([thientd](https://github.com/thientd)) for reporting this issue.
+- Restored destination-parent authorization in the page `move()` operation (GHSA-wr5r-wqp2-x4fh). A regression had gated the destination "create" permission check on the source page being restored out of the archive, which silently disabled that check for every ordinary move. As a result a low-privileged but content-editing user (for example an editor) who could edit at least one page could relocate that page under a parent of a restricted page type they have no create/edit rights over (such as one declaring a higher `editRole`/`publishRole`), and in doing so trigger an unchecked re-ranking of the restricted parent's existing children. A cross-parent move into a non-archive destination now again requires "create" permission on the destination, with the archive-restore path handled as an explicit exception. Thanks to 5ud0 / Tarmo Technologies for reporting the issue.
+- Bumped the `nodemailer` dependency from 8.x to 9.x to pick up the fix for GHSA-p6gq-j5cr-w38f, where a message's `raw` option could bypass nodemailer's `disableFileAccess`/`disableUrlAccess` controls and enable arbitrary file reads or SSRF. The real-world risk to Apostrophe is low: core only sends mail from trusted server-side code (such as password-reset emails), never sets those controls, and gives site visitors no way to control a message's `raw` field. nodemailer 9 is a security-only major release with one behavior change worth noting for projects: outbound HTTPS used to fetch remote content (remote-URL attachments, OAuth2 token endpoints, HTTP/HTTPS proxies) now validates TLS certificates by default — if you depend on self-signed or otherwise invalid certificates, opt out per request with `tls.rejectUnauthorized: false`. As a precaution, make sure your own project code never forwards untrusted input into the `raw` field of a module's `email()` call.
+
 ## 4.31.0 (2026-06-10)
 
 ### Adds
@@ -12,7 +59,7 @@
 ### Fixes
 
 - Fixed an issue where using the Tab key to navigate within modals could incorrectly jump focus to a wrong element instead of the next input field.
-Fixed Tab navigation escaping out of modals when the form contained hidden sections or elements that became disabled after editing.
+  Fixed Tab navigation escaping out of modals when the form contained hidden sections or elements that became disabled after editing.
 - Fixed adding or removing an area field from a schema breaking existing documents on an external front such as Astro.
 - For Astro: `AposArea` now renders only schema-backed areas. A missing area no longer throws, and an area orphaned by removing its field from the schema (while its content remains in the document) renders nothing instead of breaking sibling areas in edit mode. Logged-in editors get a diagnostic message in place of an orphaned area; anonymous visitors see nothing.
 - Editable documents sent to an external front (Asgtro) now materialize empty area objects for schema area fields added after the document was created, so they can be edited in context.

package/claude-tools/run-mocha-file.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Run one (or more) mocha test files serially, logging full stdout+stderr to a
+# file, then print a concise report of which specific tests passed/failed.
+#
+# Usage: claude-tools/run-mocha-file.sh <logfile> <test/file.js> [more files...]
+# Env:   APOS_TEST_DB_PROTOCOL (mongodb|postgres|sqlite) is honored by the suite.
+set -uo pipefail
+
+if [ "$#" -lt 2 ]; then
+  echo "usage: $0 <logfile> <test/file.js> [more files...]" >&2
+  exit 2
+fi
+
+LOG="$1"; shift
+cd "$(dirname "$0")/.." || exit 1
+
+# One at a time. NEVER run our suites in parallel.
+npx mocha -t 10000 "$@" > "$LOG" 2>&1
+CODE=$?
+
+echo "===== exit code: $CODE  (log: $LOG) ====="
+echo "----- passing (✓/√) -----"
+grep -aE '^\s*(✓|√|[0-9]+ passing)' "$LOG" | sed 's/^/  /'
+echo "----- FAILING -----"
+# Mocha marks failures as "  1) suite: title" and a summary "N failing".
+grep -aE '^\s*[0-9]+\) |[0-9]+ failing' "$LOG" | sed 's/^/  /'
+echo "----- last lines -----"
+tail -n 5 "$LOG"
+exit $CODE

package/modules/@apostrophecms/area/index.js

@@ -20,7 +20,8 @@ module.exports = {
             type: 'command-menu-area-cut-widget'
           },
           shortcut: 'Ctrl+X Meta+X',
-          requireWidgetFocus: true
+          requireWidgetFocus: true,
+          skipOnTextSelection: true
         },
         [`${self.__meta.name}:copy-widget`]: {
           type: 'item',
@@ -29,7 +30,8 @@ module.exports = {
             type: 'command-menu-area-copy-widget'
           },
           shortcut: 'Ctrl+C Meta+C',
-          requireWidgetFocus: true
+          requireWidgetFocus: true,
+          skipOnTextSelection: true
         },
         [`${self.__meta.name}:paste-widget`]: {
           type: 'item',
@@ -38,7 +40,12 @@ module.exports = {
             type: 'command-menu-area-paste-widget'
           },
           shortcut: 'Ctrl+V Meta+V',
-          requireWidgetFocus: true
+          requireWidgetFocus: true,
+          // Dispatched by the native paste event listener (see AposAreas.js),
+          // not by the command menu keydown listener, so the clipboard
+          // contents can arbitrate; keydown remains a fallback when the
+          // Clipboard API is unavailable
+          trigger: 'native'
         },
         [`${self.__meta.name}:duplicate-widget`]: {
           type: 'item',
@@ -56,7 +63,8 @@ module.exports = {
             type: 'command-menu-area-remove-widget'
           },
           shortcut: 'Backspace',
-          requireWidgetFocus: true
+          requireWidgetFocus: true,
+          skipOnTextSelection: true
         }
       },
       modal: {
@@ -886,7 +894,8 @@ module.exports = {
           area.items.push({
             _id: self.apos.util.generateId(),
             type: '@apostrophecms/rich-text',
-            content: html
+            content: html,
+            metaType: 'widget'
           });
         }
         return area;

package/modules/@apostrophecms/area/ui/apos/apps/AposAreas.js

@@ -2,6 +2,7 @@
 import createApp, { pinia } from 'Modules/@apostrophecms/ui/lib/vue';
 import { useWidgetGraphStore } from 'Modules/@apostrophecms/ui/stores/widgetGraph.js';
 import { nextTick } from 'vue';
+import { createId } from '@paralleldrive/cuid2';
 
 export default function() {
   const mountedApps = new Map();
@@ -182,22 +183,90 @@ export default function() {
   }
 
   function createWidgetClipboardApp() {
+    const key = 'aposWidgetClipboard';
+    const marker = 'apos-widget:';
 
     // Simpler and more reliable to just talk to localStorage always and avoid the
     // storage event handle
     class Clipboard {
       set(widget) {
-        localStorage.setItem('aposWidgetClipboard', JSON.stringify(widget));
+        const id = createId();
+        localStorage.setItem(key, JSON.stringify({
+          id,
+          widget
+        }));
+        // Stamp the OS clipboard so a later paste can tell whether this
+        // widget copy is still the most recent thing the user copied
+        navigator.clipboard?.writeText(`${marker}${id}`).catch(e => {
+          // eslint-disable-next-line no-console
+          console.warn('Unable to write the widget marker to the clipboard', e);
+        });
       }
 
       get() {
-        const existing = window.localStorage.getItem('aposWidgetClipboard');
-        return existing ? JSON.parse(existing) : null;
+        return this.getEntry()?.widget || null;
+      }
+
+      getId() {
+        return this.getEntry()?.id || null;
+      }
+
+      // Returns { id, widget } or null. Entries written by older releases
+      // hold a bare widget object and are returned with a null id.
+      getEntry() {
+        const existing = window.localStorage.getItem(key);
+        if (!existing) {
+          return null;
+        }
+        let parsed;
+        try {
+          parsed = JSON.parse(existing);
+        } catch (e) {
+          return null;
+        }
+        if (!parsed || typeof parsed !== 'object') {
+          return null;
+        }
+        if (typeof parsed.id === 'string' && parsed.widget?.type) {
+          return parsed;
+        }
+        return {
+          id: null,
+          widget: parsed
+        };
       }
     }
 
     apos.area.widgetClipboard = new Clipboard();
 
+    // Widget paste arrives through the native paste event rather than a
+    // Ctrl+V keydown interception, so the clipboard contents decide: a
+    // widget is pasted only when our marker is still the most recent copy
+    document.addEventListener('paste', e => {
+      if (isInsideEditable()) {
+        // User is typing, native paste wins
+        return;
+      }
+      const text = e.clipboardData?.getData('text/plain') || '';
+      if (!text.startsWith(marker)) {
+        return;
+      }
+      // Never paste the marker itself as text at area level
+      e.preventDefault();
+      if (text.slice(marker.length) === apos.area.widgetClipboard.getId()) {
+        apos.bus.$emit('command-menu-area-paste-widget');
+      }
+    });
+
+    function isInsideEditable() {
+      const el = document.activeElement;
+      return !!el && (
+        el.nodeName === 'INPUT' ||
+        el.nodeName === 'TEXTAREA' ||
+        el.isContentEditable ||
+        !!el.closest?.('[contenteditable]')
+      );
+    }
   }
 
   function cleanupOrphanedApps() {

package/modules/@apostrophecms/asset/index.js

@@ -123,6 +123,9 @@ module.exports = {
     self.externalBuildModuleConfig = {};
 
     self.restartId = self.apos.util.generateId();
+    // Set to `true` once a build in this process has run the lock file
+    // dependency check and succeeded. See `checkLockFile()`.
+    self.lockFileChecked = false;
     self.iconMap = {
       ...globalIcons
     };
@@ -254,20 +257,35 @@ module.exports = {
         afterModuleInit: true,
         async task(argv = {}) {
           self.inBuildTask = true;
+          // If the lock file changed since the last successful build, force a
+          // full rebuild (and clear the build module cache) so a stale admin
+          // UI is never served after a dependency change (npm install/update).
+          // The check runs once per process, so watcher-triggered rebuilds
+          // stay scoped to the detected changes.
+          const lockCheck = await self.checkLockFile();
+          argv = {
+            ...argv,
+            lockChanged: lockCheck.changed
+          };
+          let result;
           if (self.hasBuildModule()) {
-            return self.build(argv);
+            result = await self.build(argv);
+          } else {
+            // Debugging but only if we don't have an external build module.
+            // If we do, the debug output is handled by the respective setter.
+            self.printDebug('setWebpackExtensions', {
+              builds: self.builds,
+              extraBundles: self.extraBundles,
+              webpackExtensions: self.webpackExtensions,
+              webpackExtensionOptions: self.webpackExtensionOptions,
+              verifiedBundles: self.verifiedBundles,
+              rebundleModules: self.rebundleModules
+            });
+            result = await webpackBuild.task(argv);
           }
-          // Debugging but only if we don't have an external build module.
-          // If we do, the debug output is handled by the respective setter.
-          self.printDebug('setWebpackExtensions', {
-            builds: self.builds,
-            extraBundles: self.extraBundles,
-            webpackExtensions: self.webpackExtensions,
-            webpackExtensionOptions: self.webpackExtensionOptions,
-            verifiedBundles: self.verifiedBundles,
-            rebundleModules: self.rebundleModules
-          });
-          return webpackBuild.task(argv);
+          // Record the check now that the build has succeeded.
+          await self.commitLockFileCheck(lockCheck);
+          return result;
         }
       },
 
@@ -402,12 +420,13 @@ module.exports = {
       // development related properties: * `devServerUrl` (optional, string or
       // null) the base server URL for the dev server when available. *
       // `hmrTypes` (optional, array of strings) the entrypoint types that are
-      // currently served with HMR. * `ts` (optional, number) the timestamp ms
-      // of the last `apos` build. This number will be written to the
-      // `.manifest.json` file to allow the external build module to optimize
-      // the build time based on the last build change. The module can retrieve
-      // both `getSystemLastChangeMs()` and `loadSavedBuildManifest()` methods
-      // to perform a cache check.
+      // currently served with HMR.
+      //
+      // Lock file (dependency) changes are detected by the core (by hashing the
+      // lock file content) and signalled to the build module via the
+      // `lockChanged` build option, which should force a rebuild. The
+      // `getSystemLastChangeMs()` modified-time helper is deprecated and no
+      // longer needed for that purpose.
       //
       // ** `async watch(watcher, options)`: the method to attach the watcher
       // to the external build module.
@@ -500,11 +519,16 @@ module.exports = {
       // - `changes` is an array of changed files. This is reserved for the
       // legacy build system and should never appear in the external build
       // module.
+      // - `lockChanged` is a boolean flag set by the core when the lock file
+      // content changed since the last build (or no lock file was found). The
+      // build module should force a rebuild when it is `true`.
       //
       // Returns an object:
       // - `isTask`: if `true`, the build is executed as a task. If false
       // optimization can be applied (e.g. build apostrophe admin UI only
-      // once). - `hmr`: if `true`, the hot module replacement is enabled. -
+      // once). - `lockChanged`: if `true`, dependencies changed since the last
+      // build (or there is no lock file); the build module should force a
+      // rebuild. - `hmr`: if `true`, the hot module replacement is enabled. -
       // `hmrPort`: the port for the HMR WS server. If not set, the default port
       // is used. - `devServer`: if `false`, the dev server is disabled.
       // Otherwise, it's a string (enum) `public` or `apos`. Note that if `hmr`
@@ -527,6 +551,7 @@ module.exports = {
         }
         const options = {
           isTask: !argv['check-apos-build'],
+          lockChanged: !!argv.lockChanged,
           hmr: self.hasHMR(),
           hmrPort: self.options.hmrPort,
           modulePreloadPolyfill: self.options.modulePreloadPolyfill,
@@ -845,22 +870,146 @@ module.exports = {
       },
       getAssetBaseUrl() {
         const namespace = self.getNamespace();
+        const prefix = self.apos.prefix || '';
         if (self.isProductionMode()) {
           const releaseId = self.getReleaseId();
           const releaseDir = `/apos-frontend/releases/${releaseId}/${namespace}`;
           if (process.env.APOS_UPLOADFS_ASSETS) {
             return `${self.uploadfs.getUrl()}${releaseDir}`;
           } else {
-            return releaseDir;
+            return `${prefix}${releaseDir}`;
           }
         }
-        return `/apos-frontend/${namespace}`;
+        return `${prefix}/apos-frontend/${namespace}`;
       },
       getCacheBasePath() {
         return process.env.APOS_ASSET_CACHE ||
               path.join(self.apos.rootDir, 'data/temp/webpack-cache');
       },
 
+      // Absolute path to the project package manager lock file, or `false`
+      // when none is found. Shared by the webpack and external build paths.
+      async findPackageLockPath() {
+        const candidates = [ 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml' ];
+        for (const name of candidates) {
+          const candidate = path.join(self.apos.npmRootDir, name);
+          if (await fs.pathExists(candidate)) {
+            return candidate;
+          }
+        }
+        return false;
+      },
+
+      // md5 of the current lock file content, or `null` when there is no lock
+      // file (e.g. in tests). Used to detect dependency changes reliably,
+      // where modified times cannot be trusted (fresh checkouts, restored
+      // build artifacts, clock skew).
+      async getLockFileHash() {
+        const lockPath = await self.findPackageLockPath();
+        if (!lockPath) {
+          return null;
+        }
+        return self.apos.util.md5(await fs.readFile(lockPath, 'utf8'));
+      },
+
+      // Where the lock file hash from the last build is persisted.
+      getLockFileHashPath() {
+        return path.join(
+          self.apos.rootDir, 'data/temp', self.getNamespace(), 'lock-file-hash'
+        );
+      },
+
+      async readSavedLockFileHash() {
+        try {
+          const value = (await fs.readFile(self.getLockFileHashPath(), 'utf8')).trim();
+          return value || null;
+        } catch (e) {
+          return null;
+        }
+      },
+
+      async saveLockFileHash(hash) {
+        const file = self.getLockFileHashPath();
+        if (!hash) {
+          await fs.remove(file);
+          return;
+        }
+        await fs.mkdirp(path.dirname(file));
+        await fs.writeFile(file, hash, 'utf8');
+      },
+
+      // Clear the external build module's cache (e.g. @apostrophecms/vite),
+      // whose cache directory is not keyed on the lock file content. The
+      // webpack file system cache is keyed on the lock file content and
+      // self-invalidates, so it is left in place; forcing a rebuild is enough
+      // for it to produce a fresh bundle.
+      async clearBuildModuleCache() {
+        if (self.hasBuildModule()) {
+          await self.getBuildModule().clearCache();
+        }
+      },
+
+      // Decide whether the build should be forced because of a dependency
+      // change, returning `true` so callers can force a full rebuild.
+      // `currentHash` is accepted to avoid reading the lock file twice; it is
+      // `null` when no lock file was found.
+      //
+      // - No lock file (e.g. some monorepo setups): force a rebuild so a stale
+      //   admin UI is never served, but do NOT clear the build module cache -
+      //   there is no evidence dependencies changed and clearing it on every
+      //   run would be needlessly expensive.
+      // - Lock content changed, or there is no record of a previous build:
+      //   clear the build module cache so the rebuild cannot reuse stale
+      //   modules, and force a rebuild.
+      // - Lock content unchanged: no forced rebuild.
+      //
+      // The new hash is persisted by the caller via `saveLockFileHash()` only
+      // after the build succeeds, so a failed build is retried.
+      async checkLockFileChanged(currentHash) {
+        if (currentHash === null) {
+          return true;
+        }
+        const saved = await self.readSavedLockFileHash();
+        if (saved === currentHash) {
+          return false;
+        }
+        await self.clearBuildModuleCache();
+        return true;
+      },
+
+      // Run the dependency (lock file) check that drives the `lockChanged`
+      // build option, once per process. The first build performs the real
+      // comparison; later invocations (e.g. watcher-triggered rebuilds)
+      // report no change, because a dependency change while the process is
+      // running requires a restart anyway. The result must be handed back
+      // to `commitLockFileCheck()` after the build succeeds.
+      async checkLockFile() {
+        if (self.lockFileChecked) {
+          return {
+            committed: true,
+            changed: false,
+            hash: null
+          };
+        }
+        const hash = await self.getLockFileHash();
+        const changed = await self.checkLockFileChanged(hash);
+        return {
+          committed: false,
+          changed,
+          hash
+        };
+      },
+
+      // Persist the result of `checkLockFile()`. Called only after a
+      // successful build, so a failed build repeats the forced rebuild.
+      async commitLockFileCheck({ committed, hash }) {
+        if (committed) {
+          return;
+        }
+        await self.saveLockFileHash(hash);
+        self.lockFileChecked = true;
+      },
+
       // Override to set externally a build watcher (a `chokidar` instance).
       // This method will be invoked only if/when needed.
       // Example:

package/modules/@apostrophecms/asset/lib/build/external-module-api.js

@@ -212,28 +212,19 @@ function invoke() {
     // Helper function for external build modules to find the last package
     // change timestamp in milliseconds. Works with Node.js and npm, yarn, and
     // pnpm package managers. Might be extended if a need arises.
+    //
+    // @deprecated Lock file modified times are unreliable (fresh checkouts,
+    // restored build artifacts, clock skew). The core now detects dependency
+    // changes by hashing the lock file content and forces a rebuild via the
+    // `lockChanged` build option, so build modules no longer need this. Kept
+    // for backwards compatibility and will be removed in the next major version.
     async getSystemLastChangeMs() {
-      const packageLock = await findPackageLock();
+      const packageLock = await self.findPackageLockPath();
       if (!packageLock) {
         return false;
       }
 
       return (await fs.stat(packageLock)).mtimeMs;
-
-      async function findPackageLock() {
-        const packageLockPath = path.join(self.apos.npmRootDir, 'package-lock.json');
-        const yarnPath = path.join(self.apos.npmRootDir, 'yarn.lock');
-        const pnpmPath = path.join(self.apos.npmRootDir, 'pnpm-lock.yaml');
-        if (await fs.pathExists(packageLockPath)) {
-          return packageLockPath;
-        } else if (await fs.pathExists(yarnPath)) {
-          return yarnPath;
-        } else if (await fs.pathExists(pnpmPath)) {
-          return pnpmPath;
-        } else {
-          return false;
-        }
-      }
     },
 
     // Retrieve saved during build core metadata. The metadata is saved in the

package/modules/@apostrophecms/asset/lib/build/internals.js

@@ -168,7 +168,7 @@ module.exports = (self) => {
     // more information.
     async saveBuildManifest(manifest) {
       const {
-        entrypoints, ts, devServerUrl, hmrTypes
+        entrypoints, devServerUrl, hmrTypes
       } = manifest;
       const content = [];
 
@@ -186,11 +186,9 @@ module.exports = (self) => {
           bundles: Array.from(bundles ?? [])
         });
       }
-      const current = await self.loadSavedBuildManifest(true);
       await fs.outputJson(
         path.join(self.getBundleRootDir(), '.manifest.json'),
         {
-          ts: ts || current.ts,
           devServerUrl,
           hmrTypes,
           manifest: content

package/modules/@apostrophecms/asset/lib/build/task.js

@@ -106,6 +106,11 @@ module.exports = (self) => ({
         }
       }
 
+      // A lock file change forces a full rebuild of every build.
+      if (argv && argv.lockChanged) {
+        rebuild = true;
+      }
+
       if (rebuild) {
         await fs.mkdirp(bundleDir);
         await build({
@@ -754,19 +759,8 @@ module.exports = (self) => ({
       return pkgTimestamp > parseInt(timestamp);
     }
 
-    async function findPackageLock() {
-      const packageLockPath = path.join(self.apos.npmRootDir, 'package-lock.json');
-      const yarnPath = path.join(self.apos.npmRootDir, 'yarn.lock');
-      const pnpmPath = path.join(self.apos.npmRootDir, 'pnpm-lock.yaml');
-      if (await fs.pathExists(packageLockPath)) {
-        return packageLockPath;
-      } else if (await fs.pathExists(yarnPath)) {
-        return yarnPath;
-      } else if (await fs.pathExists(pnpmPath)) {
-        return pnpmPath;
-      } else {
-        return false;
-      }
+    function findPackageLock() {
+      return self.findPackageLockPath();
     }
 
     function getComponentName(component, { enumerateImports } = {}, i) {

package/modules/@apostrophecms/command-menu/ui/apos/components/TheAposCommandMenu.vue

@@ -55,7 +55,9 @@ export default {
                     shortcut.toUpperCase(),
                     {
                       ...command.action,
-                      requireWidgetFocus: command.requireWidgetFocus || false
+                      requireWidgetFocus: command.requireWidgetFocus || false,
+                      skipOnTextSelection: command.skipOnTextSelection || false,
+                      trigger: command.trigger || 'keydown'
                     }
                   ]);
               });
@@ -96,7 +98,15 @@ export default {
         ? this.getFirstNonShortcutModal(index + -1)
         : properties.itemName || 'default';
     },
+    hasTextSelection() {
+      const selection = window.getSelection();
+      return !!selection && !selection.isCollapsed;
+    },
     keyboardShortcutListener(event) {
+      // Keys already handled by more specific UI must not trigger shortcuts
+      if (event.defaultPrevented) {
+        return;
+      }
       if (event.target.nodeName !== 'INPUT' && event.target.nodeName !== 'TEXTAREA' && document.activeElement.contentEditable !== 'true') {
         const key = [
           [ 'ALT', event.altKey ],
@@ -121,6 +131,16 @@ export default {
           if (action.requireWidgetFocus && !useWidgetStore().focusedWidget) {
             return;
           }
+          // A text selection wins over the shortcut, the browser
+          // performs its native action (e.g. copy the selected text)
+          if (action.skipOnTextSelection && this.hasTextSelection()) {
+            return;
+          }
+          // Handled by a native event listener (e.g. paste) when the
+          // Clipboard API is available; keydown is the legacy fallback
+          if (action.trigger === 'native' && navigator.clipboard) {
+            return;
+          }
           event.preventDefault();
           apos.bus.$emit(action.type, action.payload);
           return;