merge main to latest (#5460)

Author: boutell

.changeset/array-draggable-false-non-inline.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": minor
+---
+
+Added support for `draggable: false` on non-inline `array` schema fields. Previously this option was only respected when `inline: true`. When set on a standard (modal-based) array field, drag-and-drop reordering and keyboard reordering are now disabled in the array editor's slat list.

.changeset/common-beans-lie.md

@@ -0,0 +1,5 @@
+---
+"@apostrophecms/seo": minor
+---
+
+Removes unimplemented hreflang output; use @apostrophecms/sitemap for hreflang support

.changeset/curvy-bobcats-peel.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": minor
+---
+
+Introduced support for postgres://, sqlite://, and multipostgres:// database URIs in addition to mongodb://. The new db-connect API supports all of the database operations currently used in our own core, pro and multisite modules. For more information see the documentation.

.changeset/env-secrets-support.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": minor
+---
+
+The session secret and the uploadfs `disabledFileKey` can now be supplied via the `APOS_SESSION_SECRET` and `APOS_UPLOADFS_DISABLED_FILE_KEY` environment variables. As with other Apostrophe environment variables, these take precedence over the corresponding `app.js` configuration.

.changeset/new-doors-turn.md

@@ -0,0 +1,5 @@
+---
+"sanitize-html": patch
+---
+
+Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to [Dipanshu singh](https://github.com/Dipanshusinghh) for pointing out the issue and contributing the fix.

.changeset/ripe-terms-happen.md

@@ -0,0 +1,11 @@
+---
+"@apostrophecms/apostrophe-astro": minor
+"apostrophe": minor
+---
+
+Fixed adding or removing an area field from a schema breaking existing documents on an external front such as Astro.
+
+- `AposArea` now renders only schema-backed areas. A missing area no longer throws, and an area orphaned by removing its field from the schema (while its content remains in the document) renders nothing instead of breaking sibling areas in edit mode. Logged-in editors get a diagnostic message in place of an orphaned area; anonymous visitors see nothing.
+- Editable documents sent to an external front now materialize empty area objects for schema area fields added after the document was created, so they can be edited in context.
+- `apos.util.getManagerOf` accepts a `{ log }` option to suppress its error log when probing objects that may not have a manager.
+

.changeset/shaky-regions-spend.md

@@ -0,0 +1,5 @@
+---
+"@apostrophecms/seo": minor
+---
+
+Removes the `seoSiteCanonicalUrl` field from global settings. The base URL is now derived automatically from `APOS_BASE_URL` or the `baseUrl` option. The value remains available at `req.data.global.seoSiteCanonicalUrl` for backwards compatibility.

.changeset/smart-kids-rest.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": patch
+---
+
+Selecting an item in a relationship "browse" dialog no longer scrolls the title and Cancel/Select buttons out of view when the item is far down the list.

.changeset/soft-hats-smile.md

@@ -0,0 +1,6 @@
+---
+"@apostrophecms/cli": minor
+---
+
+**Breaking:** `apos create` is now an interactive guided installer (it delegates to `create-apostrophe`). The `<shortname>` positional argument and the `--starter` and `--mongodb-uri` options have been removed - project name, starter kit, and database are now chosen through prompts. For scripted installs, use `npm create apostrophe@latest -- --unattended` instead.
+

.changeset/sparkly-experts-walk.md

@@ -0,0 +1,5 @@
+---
+"apostrophe": patch
+---
+
+Sites with a custom filterByIndexPage method no longer experience failures in the sitemap module and potential creeping CPU performance penalties. A regression introduced with our static site support, but not specific to static sites.