Releases for all

Added

• Commands in the assistant's chat. A message starting with / looks something up at once, without waiting for the assistant: /search, /time, /rate,
  

This release adds social media image support, an option to show administrators the full meta tags form, and configurable help text for the simplified widget.

WARNING: THERE IS NO MIGRATION PATH. YOU MUST REINSTALL FROM SCRATCH.

Do not update an existing site to this release. Orchestra ships no update hooks, and none is coming until the first beta release. A site on an earlier alpha holds a database and a module list this code does not match.

Uninstall the Orchestra modules, drop what they leave behind, and install 1.0.0-alpha21 fresh. Every instance, token, task, incident, variable, attachment and delegation from an earlier alpha is lost, and that is expected.

Added

• Your visitors can talk to your site: the Opensolr assistant. A chatbot, Ask this site, that answers from your Opensolr Index. Every question is searched in your content first, and the answer is written as
  it comes (streamed), with links to the pages, the products and the exact pages of your PDFs. What it must not guess it looks up: today's date, the local time anywhere, exchange rates, VAT rates and VAT numbers, distances, postal codes,
  

This is a security release. Upgrading is strongly recommended.
Details are published in the security advisories for this release.
After upgrading, clear caches (drush cr). No database updates are required.

This release fixes a security vulnerability. See the security advisory for details.

It also fixes a bug where the "Generate internal links" dialog would fail with a server error for every user.

Security issues fixed

Xray Audit - Moderately critical - Access bypass - CVE-2026-96389

Security issues fixed

Xray Audit - Moderately critical - Access bypass - CVE-2026-96389

Bugs

Fixes the upgrade from 1.0.1-alpha7. Use this release instead of 1.0.1-alpha11 when upgrading; it contains everything alpha11 does.

Security update: https://www.drupal.org/sa-contrib-2026-hq7gbst6nb

First release

Changelog

• Changes external URL handling in freelinking External plugin - resolves SA-CONTRIB-2026-213

• Fixes SA-CONTRIB-2026-216 access bypass

The 1.0.x branch will soon be marked "unsupported".

Please use the 2.0.x branch instead.

View commit log

Fixes major secuirty issue.

IMPORTANT:
The Twig Tweak support added in Twig Tweak/Plugin Blocks support introduced this security issue and had to be reverted. Rendering an AJAX Block in Twig Tweak *with custom configuration* is no longer supported (by design).

Changelog

Issues: 1 issues resolved.

Changes since 5.1.0 (compare):

Bug

• Revert #3169627 [regression] Flag form element also appearing on non-edit forms

Changelog

Issues: 1 issues resolved.

Changes since 2.0.3 (compare):

Task

• task: #3629047 Update for lupus-ce-renderer 2.8 support, require 2.8 or later

Added

• Drupal AI Search on your Opensolr Index. The new Opensolr AI Search module (included, enable it with the Drupal AI module) makes your Opensolr Index the search of Drupal AI Search. It searches the
  content Data Ingestion or the Data Crawler already sent, so nothing is indexed twice: words and meaning in one ranking, highlighted snippets, and the pages of an attached PDF that match, each linked to its page. The AI
  

Change log:

Thumbnail and admin UI release: stored Mapillary thumbnail URLs are now refreshed before they expire. The Mapillary listings have tabs under Content and import forms, so they no longer depend on Admin Toolbar.