Changelog

Categories: Security, Feature, Fix, Perf, Admin, Deps.

[1.13.0] - 2026-06-09

Feature

• CMS pages and CMS blocks now use Page Builder — the native WYSIWYG content field is replaced by the Page Builder canvas on cms_page / cms_block forms. Existing pages open with their current HTML wrapped in a single Html block, so nothing is lost.
• Self-rendering content types — third-party modules can register a content type that owns its own server-side markup (preview included), opening the door to richer custom blocks without touching the core renderer.

Fix

• Magento directives ({{widget …}}, {{store url=…}}) embedded in sanitised HTML now resolve correctly at storefront render time again.

[1.12.2] - 2026-06-05

Deps

• magento/framework pinned to ^103.0.

[1.12.1] - 2026-05-21

Feature

• Color palette / design tokens — seven named slots (primary, secondary, accent, success, danger, neutral light/dark) configured per store view and applied as CSS variables on the canvas. A new colour-swatch picker is wired on Tile, Icon and Divider.
• Symbol blocks — save any subtree as a reusable Symbol; every instance on the page stays in sync.
• Block versioning — snapshot the current page state under a name (Black Friday, Christmas, v1.0) and restore any version in one click. Up to 30 per page.
• A/B test hooks — new common props let a block declare a test key, variant and weight. Visitors get a stable cookie so the same variant follows them across page loads.
• Tap-target audit flags icons under 32px (WCAG 2.5.5). Focus trap keeps Tab focus inside the active modal (Command palette, URL picker, Image picker, Help).

[1.12.0] - 2026-05-21

Feature

• URL picker — modal with Product / Category / CMS Page tabs and live search; replaces URL pasting on Button, Banner and Hero CTAs.
• Image picker — grid browser of pub/media/wysiwyg/ with thumbnails; wired on Image, Hero and Banner.
• Hover state styling — per-block :hover background, colour, scale and shadow without polluting siblings.
• Opacity, z-index, sticky positioning as common Design props.
• Typography presets — 10 named scales (display, H1-H4, lead, body, small, caption, overline) + text-align.
• Display conditions — show a block only to logged-in customers, specific customer groups, or inside a date window. Hidden blocks render empty so the layout stays intact.
• SEO audit panel — real-time checks on heading hierarchy, word count, link text quality, image alt text and CTA URL diversity. Click any issue to jump to the offending block.
• Render-time monitor logs slow blocks (>500 ms) to the browser console with per-type stats.
• Dark mode — three-state toggle (system / light / dark) persisted per browser, propagated to the iframe canvas.
• Onboarding tour — four-step coachmark introduces Inserter, Canvas, Edit panel and ⌘K command palette on first mount.
• Per-store-view indicator in the footer when the consumer template provides a store label.

[1.11.1] - 2026-05-21

Feature

• Every content type's edit form was rewritten to be self-documenting: descriptive labels, hint lines with concrete examples, sensible defaults. Four broken repeatable lists (TrustBadges, PricingTable, StatsGrid, Timeline) are now actual repeatable lists instead of single text inputs.
• Freshly dropped blocks now start with meaningful starter content (placeholder headline, three pricing tiers, a four-event timeline…) instead of empty shells.

Fix

• Dropped the unused columns property on Row (had no effect; layout is driven by Column responsive widths).

[1.11.0] - 2026-05-21

Feature

• Multi-selection + bulk operations — Shift+click selects multiple blocks; floating toolbar offers Group (wraps in a Row), Duplicate, Delete and Clear.
• Command palette (⌘K / Ctrl+K) — fuzzy-search overlay listing every action, every registered block and your personal templates.
• Smart suggestions after add: Row → "Add 2 columns?", Tabs → "Add a first tab?", etc. — non-blocking, dismissable per block.
• Find & Replace (⌘F) scans every text-ish field across the entire tree, with live match count.
• Accessibility audit panel — image alt, heading hierarchy, empty headings/buttons, buttons without destination, videos without source, icons without label. Click a row to jump to the offending block.
• Scroll-reveal animations — 7 presets (fade-in/up/down/left/right, zoom-in) gated by prefers-reduced-motion. Works on Luma and Hyvä.
• Toast notification system centralises feedback (success/info/warn/error) across the builder.
• Sticky save bar in fullscreen mode shows dirty state and proxies the parent admin Save button.
• Empty-state illustrations on canvas, inserter and layers panel; topbar icons regrouped with logical dividers.

[1.10.0] - 2026-05-21

Feature

• Smart drop on existing blocks — drop on the top half inserts before, bottom half inserts after; pairs with the per-gutter + buttons for a forgiving DnD UX.
• Unsaved changes pill in the topbar; block count + autosave status in the footer.
• Export / Import the canvas state as a JSON file; migrators run automatically on import.
• Help modal (? key) lists every keyboard shortcut, platform-aware (⌘ on macOS, Ctrl elsewhere).
• Real history timeline — every action records type / target / time and the History panel lists them newest-first. Click any row to revert.
• Copy / paste blocks (⌘C / ⌘V) preserves the full subtree with fresh ids. Copy / paste design (⌘⌥C / ⌘⌥V) lifts only Design / Spacing / Visibility / Custom CSS values.
• Personal templates — save a selected subtree under a name, drop it back with a click. Stored per browser, up to 50.
• Inserter favourites (star) and Recent blocks sections; search synonyms map title → Heading, picture → Image, btn → Button, etc. (~50 EN/FR pairs).
• Block lock — locked blocks get a 🔒 badge and inert drag/duplicate/delete until unlocked.
• Auto-save draft in localStorage with a Restore banner on next mount when the draft is fresher than the loaded state.
• Spacing presets (S / M / L / XL = 8 / 16 / 24 / 48 px) above every spacing field.
• Product cards in the admin canvas now render the same resized + cached images visitors see (frontend area emulation).

[1.9.2] - 2026-05-21

Fix

• Drag-and-drop from the Block Inserter into the iframe canvas now works — switched to the native HTML5 drag API which is cross-document by design.
• Product images now display in the admin canvas — added a frontend-aware image URL resolver with a media-URL fallback when called from admin scope.

Feature

• Visual drag feedback: every gutter highlights while a drag is in progress, the targeted gutter gets a stronger outline, and the root-list fallback shows an outline when targeted.

[1.9.1] - 2026-05-21

Fix

• Live-render AJAX no longer returns the admin login HTML. Custom CSRF handling on the controller was triggering a 302 to the admin URL; replaced by the standard form_key query parameter — same security guarantee, no custom code.
• Silenced the iframe sandbox warning by removing the (no-op) sandbox attribute on the same-origin srcdoc iframe.

Admin

• Topbar / rail icons made visible — brand, device switcher, rail buttons and toolbar actions were too small on HiDPI admin viewports. Hit targets bumped, every icon now has a clear silhouette.

[1.9.0] - 2026-05-21

Feature

• True storefront-quality WYSIWYG. The admin canvas now renders inside a same-origin srcdoc iframe so block markup paints in a CSS sandbox: the frontend stylesheet is the only one applied, the Magento admin styles can no longer bleed through, and the result matches what visitors will see.

[1.8.0] - 2026-05-21

Feature

• Major editor UX rewrite — fullscreen-capable modal with a top device-preview switcher (desktop / tablet / mobile), vertical icon rail (Inserter / Layers / History), slide-out sidepanel, clean canvas, 3-tab block edit panel (Content / Design / Advanced) and bottom breadcrumbs.
• Block Inserter with search across label/code/description, category filter, grid/list view toggle, click-to-add and drag-to-add.
• Insertion gutters at every nesting level — hover pops a + button that opens the Inserter pre-seeded for that exact slot.
• Floating block toolbar anchored top-left of each block (drag, edit, duplicate, delete).
• Custom CSS triplet (Before / Main / After) on every non-structural block, sanitised at render time.
• Admin Label common field shown in the Layers panel and edit panel header.
• Hide on print common toggle.

[1.7.2] - 2026-05-21

Fix

• Admin AJAX live-render returned 403 because Magento's default form_key validator can't read a JSON-body POST. Now validates the X-Form-Key header via hash_equals.
• Column structural preview no longer shows Column ([object Object]/12) after state v2 widened Column.width to per-breakpoint values.
• Live-render now surfaces 403/404/500 status codes and missing form_key cookies in the browser console for easier debugging.

[1.7.1] - 2026-05-21

Fix

• Fatal error on every admin page that loads the Forms compat layer (Access level to AbstractFormFieldType::getCommonSchema() must be public). Our method was renamed to getSharedSchema() so both concerns can coexist.

[1.7.0] - 2026-05-21

Feature

• True WYSIWYG live editing in the admin canvas: leaf blocks (Heading, Text, Button, Image, Hero, Tile, Testimonial…) show the actual storefront HTML instead of a JS-side approximation.
• Inline contenteditable — recognised text targets become editable in place; edits flow back to the state through a debounced update.
• Shared schema on every non-structural block — Design (CSS class / id), Spacing (mt/mb/pt/pb/pl/pr) and Visibility (hide on desktop / tablet / mobile, print) without touching existing markup.
• Responsive column widths (state v2) — Column.width widens to { default, md, lg } so the same column can declare a different span at mobile / tablet / desktop. Existing pages auto-migrate on load.
• Block breadcrumbs in the toolbar — clickable hierarchy that lets authors walk up the tree.
• Layers panel with a tree view of the entire page; click a row to select + scroll the canvas.
• Clear layout action with a two-stage arm/confirm to avoid accidental wipes.
• Floating block toolbar (label + duplicate + delete) overlays the top-right of the selected block.
• Product cards now post checkout/cart/add directly (icon + Add to cart label), with form_key and uenc hydrated client-side so it stays FPC-safe. Variable products (configurable / grouped / bundle) show a localised "Starting at" label.
• New product_types filter on ProductGrid / ProductSlider (comma-separated allow-list).

[1.6.0] - 2026-05-20

Full audit pass: security hardening, bug fixes, performance, and developer ergonomics. The only behaviour change that affects existing storefront content is HTML/SVG sanitisation for the html content type and the icon raw-SVG passthrough — see "Breaking" below.

Security

• Admin-authored HTML in the html content type is now sanitised on render. <script>, <iframe>, <style>, <form> and event-handler attributes (onclick, onload, …) are stripped; javascript: and data: URLs in href/src are neutralised. Closes a stored-XSS surface any content-edit role could exploit.
• Inline <svg> icons (icon content type, trust-badge icons) are also sanitised: <script>, <foreignObject>, every on*= attribute, and javascript:/data: xlink:href values are removed before the SVG reaches the page.
• The MessageBox dismiss button, Coupon copy button, Table-of-Contents auto-population, and Countdown timer no longer emit inline onclick= or inline <script> tags. All four behaviours now ship as a single small frontend JS file (wm-pb-runtime.js) and the rendered HTML carries data-* attributes only. Stores running with a strict script-src 'self' CSP policy (Magento 2.4.4+ default) finally see those widgets working at full functionality.

Fix

• The Tile content type was rendering nested-escaped garbage when the body was populated. Visible immediately on any page that used a Tile / feature-card block.
• The default category filter on embedded builder mounts silently dropped 28 of the 50 registered content types — commerce (product widgets, CMS blocks, recent reviews, …) and marketing (newsletter signup, coupon, banner, trust badges, countdown timer). The default is now "show every registered type"; consumers that explicitly opt into a subset are unaffected.
• Two Tabs or two Accordions with identical children no longer share the same radio-group name, so clicking a tab/panel in one no longer toggles the other.
• The Newsletter Signup widget no longer fails the CSRF check on submit: the rendered form ships an empty form_key placeholder which is hydrated client-side from the standard Magento session cookie. Works under full-page-cache.
• Admin previews of Magento-widget content types (product grids, recent reviews, CMS block embed, …) no longer come back empty when the store scope resolves to the admin store (id 0). The renderer falls back to the default store view.
• The PHP-side state validator and migrator are no longer dead code on the save path: invalid submissions are rejected with a logged warning instead of overwriting the previous valid state.

Perf

• The admin builder JavaScript (~80 KB across SortableJS + 7 builder modules) is no longer loaded on admin pages that don't mount a builder. Dashboards, sales orders, system config, etc., now skip the load entirely. Pages that do mount a builder (CMS / blog / custom-entity forms) are unchanged.
• The palette panel filter input no longer rebuilds the DOM + Sortable instances on every keystroke; items are built once and hidden/shown via CSS.
• The undo history is capped at 100 entries (was unbounded). Long edit sessions on heavy CMS pages no longer leak hundreds of megabytes.
• MagentoWidgetRenderer injects its 12 heaviest Magento dependencies through DI proxies — pages that never actually render a Magento-aware widget skip the constructor cost entirely. The CustomerSession proxy in particular keeps Full-Page-Cache hit rates intact.

Admin

• New WmPageBuilder.unmount(mountId) JS API — tears down a builder instance properly (subscribers, listeners, Sortable instances). The builder mount now auto-unmounts a stale instance before remounting on the same mountId, fixing a memory-leak pattern that hit per-store fieldsets (Knockout html: re-renders).
• Palette category titles ("Layout", "Content", "Commerce", "Marketing", …) are now translated via Magento's __() rather than the hard-coded French map that mixed languages depending on which categories were present.

Breaking

• HTML and SVG inputs in the html and icon content types are now sanitised. If a store relied on inline <script>/<iframe> blocks inside html widgets, those blocks are removed on render — move the JavaScript into a real module-shipped JS file (loaded via layout XML) and the markup will remain unchanged.

[1.5.6] - 2026-05-20

Fix

• Removed an aggressive responsive cap that limited the palette to 200px tall on standard admin forms (CMS page editor, etc.), where the form column happens to be a little under 900px wide. Forms wider than 700px now show the full 3-column layout with naturally-sized panels — the palette uses all the vertical space available and the full list of content types is visible without internal scrolling on most viewports.

[1.5.5] - 2026-05-20

Admin

• Builder shell now uses the full available viewport height instead of a fixed 70 % slice. The palette panel can show many more items at once on the CMS page form and any other mount, removing the need to scroll past every category to find a content type.

[1.5.4] - 2026-05-20

Fix

• Removed a duplicate script load that caused the builder JavaScript to run twice on every page render. The most visible symptom was a doubled "Search…" input inside the palette panel (and, on rare occasions, two canvases stacked on top of each other). The builder now relies exclusively on the global bootstrap loader introduced in 1.5.0.

[1.5.3] - 2026-05-20

Fix

• Hardened the admin bootstrap loader against a missing SortableJS file. If the vendor library failed to load (for example, after an upgrade where the static deploy had not yet run), the loader left window.define undefined, which broke every subsequent Magento admin script (theme.js, grid.js, tabs.js, translation dictionary, etc.) and effectively crashed the admin. The loader now restores AMD even when the load fails.

[1.5.2] - 2026-05-20

Fix

• Restored the admin builder field template (builder-html.html) and the SortableJS vendor library — both were missing from the released package, which broke the admin canvas rendering and drag-and-drop on fresh installs.

[1.5.1] - 2026-05-18

Admin

• Module now registers itself under the Wimakeit root admin menu (Wimakeit_Core::main) with a Settings entry (sortOrder 999) pointing to the wimakeit_pagebuilder configuration section. Access is gated by the Wimakeit_PageBuilder::admin ACL resource.

[1.5.0] - 2026-05-06

Feature

• 35 new content types added to the builder palette, covering layout, media, text, interactive, and form-input categories.
• Central state repository — the canvas state is now persisted through a unified repository, replacing the previous ad-hoc save paths and making the editor easier to embed across modules.
• Reusable field block — third-party modules can now mount a fully-wired builder field inside their own admin forms with a single block reference.
• Global JS auto-mount — the builder JavaScript loads on every admin page and automatically mounts any builder canvas injected dynamically by Knockout (no more manual hook required).

[1.3.0] - 2026-04-30

Feature

• Fullscreen editor for text and HTML fields — opens a modal overlay with a larger writing surface for long-form content.
• Server-side StateRenderer — the canvas state can be rendered to HTML on the server, opening the door to email templates, PDF generation, and other non-Knockout consumers.

Admin

• All Iconify icons replaced with inline SVG, removing the runtime dependency on the Iconify CDN and improving admin load time and CSP friendliness.

[1.2.0] - 2026-04-30

Feature

• Live preview iframe drawer — a slide-out drawer renders the current canvas state inside an isolated iframe, giving an instant preview of how content will appear in the storefront.

Admin

• Properties panel polish: visual 12-segment column-width picker, iOS-style toggle for boolean fields, inline hints under each field, colored section icons.

Fix

• Column-width picker and options-list no longer overflow the 320-pixel properties panel; column-picker segments are rendered as ARIA radios so Magento admin pill-button CSS no longer leaks into the widget.

[1.1.0] - 2026-04-29

Feature

• Eight new primitive content types: button (label, URL, target, style), image (src, alt, width, height, alignment), divider (thickness, hex color, vertical margin), spacer (height), icon (SVG/material-icon name, size, color), video (YouTube / Vimeo / self-hosted, autoplay, controls), quote (text, author, citation source), list (ordered / unordered, items array).
• All content types now expose getDescription() for tooltip support on the palette.
• Undo / redo history in the state store with toolbar buttons and wm-pb-btn--disabled class toggled on each state change.
• Keyboard shortcuts: Delete / Backspace removes selected item, Cmd/Ctrl+D duplicates, Cmd/Ctrl+Z undoes, Cmd/Ctrl+Shift+Z redoes, Escape deselects. Suppressed when an input field has focus.
• Real-time palette search input filters the item list.
• Friendly category labels in the palette, with fallback to title-cased code.
• Duplicate-code detection on the canvas: items sharing the same code property get a warning class and tooltip.
• Pattern validation in the schema renderer: schema fields with a pattern property show inline error / success states.
• Collapsible fieldset groups: schema keys with group: 'field'|'validation'|'conditional' render as <details> sections.

Admin

• Surgical property panel updates: inputs are patched in-place when the same item is selected, preventing focus loss on every keystroke.
• ARIA attributes added on palette items, canvas drop zones, properties panel, item handles, and action buttons.
• New developer guide docs/CONTENT_TYPE_REGISTRATION.md for third-party content-type registration.

Fix

• Toolbar undo / redo buttons were rendered but had no click handlers — now fully wired.

[1.0.0] - 2025-01-01

Feature

• Initial release of the generic admin visual editor framework.
• ContentTypeRegistryInterface and ContentTypeInterface public API contracts, plus AbstractContentType base class with sane defaults.
• Five primitive content types: row, column, heading, text, html.
• StateSerializer and StateValidator for canvas state management.
• Builder block and BuilderViewModel for embedding the editor in admin layouts.
• Vanilla JS builder: state machine, canvas, palette, properties, schema-renderer (no framework dependency).
• SortableJS 1.15.x bundled (MIT license).
• CSP-safe inline script initialisation via SecureHtmlRenderer.
• Admin CSS 3-panel shell (palette / canvas / properties).
• i18n stubs for en_US, fr_FR, nl_NL.