# v2.2.26
## 11/05/2026

1. [](#bugfix)
    * When PHP can't start sessions (for example, `session.save_path` points at a folder that no longer exists after a server move), Grav now writes the reason to `grav.log` instead of showing "Session corruption detected" on every page to every visitor
    * A session holding an unusable user object is now actually replaced with a fresh one, instead of crashing every page with an error until the visitor clears their cookies
    * The debug bar no longer reports Twig deprecations on every page, one for Grav's sandbox source policy and one for how page content Twig is rendered [#4387](https://github.com/getgrav/grav/issues/4387)

# v2.2.25
## 11/05/2026

1. [](#bugfix)
    * A scheduled job that its plugin switches off with `when()` (such as YetiSearch Pro's embed job while semantic search is off) is no longer run and recorded as a failure each time it comes due. The scheduler leaves it out of the run and out of the health check, and `Job::passesWhen()` tells other tools whether a job's condition lets it run
    * [security] A media link's attributes now go through the same name check as `attribute()`, so page content can no longer put an event handler on the link. Thanks @R0X4R

# v2.2.24
## 11/04/2026

1. [](#bugfix)
    * Running a plugin's test suite against a Grav checkout no longer leaves a `user/config/security-private.php` in the plugin's folder, where a `git add -A` could commit it into the plugin's release. Grav now creates the key file only in a real Grav install, and code that loads Grav's classes from anywhere else gets a key that lasts for that process

# v2.2.23
## 11/03/2026

1. [](#bugfix)
    * When a cache file can't be deleted, the cache purge job and `bin/grav clear` now name the file and the reason (such as "Permission denied") instead of "Unknown error", and carry on with the rest of the cache instead of stopping at the first one ([#4384](https://github.com/getgrav/grav/issues/4384))
    * [security] The `svg_image()` Twig function now escapes the classes it adds to the SVG. Thanks @manus-pi
    * [security] The `svg_image()` Twig function only inlines real `.svg` files, so a theme that takes the image path from a page header can no longer be pointed at other files on the server

# v2.2.22
## 11/02/2026

1. [](#bugfix)
    * On servers with the PHP `yaml` extension, a YAML file with a plain `y`, `yes`, `on`, `off`, `n` or `no` key keeps that key instead of turning it into `1` or `0`, so settings such as an image's `y:` size and the `YES`/`NO` language strings load the same as on servers without the extension
    * An asset added by the site's own full URL, such as `url('theme://css/custom.css', true)`, or by a link that starts with the site's subfolder, no longer renders with the host or subfolder twice