Neos 4.2 »Snowdrop« and Flow 5.2 released

We are thrilled to announce the next version of Neos and Flow aka Snowdrop!
This release brings improvements to SEO, asset handling, Fusion, and UX in general.
Moreover, it includes a lot of smaller changes and fixes.

– Written by

New Features

SEO Package 2.1.0

The team gathered together and merged all the great features from different packages into the official one. However, we didn't stop here: We added many more features and improvements to the SEO package for Neos based on feedback from the community and agencies. It is easier to add structured data to your site as we provide several implemented types and also helpers for your own implementations. Those are based on and Google's Search Guides. The package now makes it even more comfortable to set up a custom robots.txt or to include images to the sitemap.

The new features are mostly optional in version 2.1.0 as some might duplicate what you already built yourself.

Overview of the changes:

  • Configure your robots.txt via fusion (optional)
    • Allows you to make it manageable from the backend with some additional code
    • By default the sitemaps for your language dimension will be added
  • Have images and alternate language links in the sitemap (optional)
  • Structured data for breadcrumbs, social profile and a search box (optional)
  • Most fluid templates are now based on AFX to allow customization
  • Output size and alt attributes for Open Graph image

You can find the instructions on how to use these features in the documentation.

This release supports Neos 3.3 and up.

Improvements to Asset Handling

The asset model is extended with a copyright notice field.

Now you can add your needed copyright notices easily, automatically or manually.

This comes in handy if you use an external asset source. Asset sources, like unsplash specify how the attribution needs to look like, so the copyright notice is automatically populated using the provided metadata, when an asset is imported from an asset source.

With Neos 4.2 you can search through configured asset sources directly in the inspector. The asset editor (not to be confused with the image editor!) now searches through configured asset sources (like Unsplash) in addition to the media library, giving you the power of all your assets.

By the way: There are already quite some interesting 3rd party packages implementing asset sources for Pexels, Shutterstock, MediaWiki, Unsplash and among others.

Improved resilience during deployments

Users will no longer be required to re-login when they already were logged in when deployment of Neos is done. Their user session is now persisted by default. (see below)

The lock holding page is now customizable. This is the page that is shown when caches are flushed, e.g., during a deployment. Previously this has been a technical error page but can now be customized to be a excellent looking maintenance page.

Lastly the node:repair command has been overhauled to produce a cleaner output, proper exit codes and to provide better extensibility.

See below for further information about these three features.

Font Awesome updated to version 5.5

The Font Aweseome version included with Neos has been updated to 5.5 giving you an even broader choice of icons to be used in the Neos backend.

Fusion and AFX changes

Five new Fusion prototypes are added. Some of those prototypes replace existing ones, adding extended functionality and names that should avoid misconceptions we noticed in the past.

  • Prototypes for Data Processing:
    • Neos.Fusion:Maptransform the given items using the itemRenderer (will replace RawCollection)
    • Neos.Fusion:Reduce - transforms the given items to a single value by applying the defined itemReducer
    • Neos.Fusion:DataStructure - will replace the RawArray prototype.
  • Prototypes for Rendering:
    • Neos.Fusion:Join - concatenates the given Fusion values to a single string by using the specified @glue (will replace the Array prototype)
    • Neos.Fusion:Loop - renders all given items using the itemRenderer and concatenates the results to a single string using the given @glue (will replace the Collection prototype)
  • The @apply meta-keyword lets you override multiple properties of a fusion-prototype with a single expression at rendering time. This is useful when complex data structures are handled and passed down to presentational fusion prototypes.

The now deprecated prototypes RawCollection, RawArray, Array and Collection still work of course, but you should consider moving to the new, more unified, naming scheme.

Two new AFX features are added with AFX version 1.2:

  • Afx now supports the ES6 spread syntax, making it easier to pass down multiple props across fusion components. 
  • The new @path annotation allows rendering child nodes into the given fusion path instead of being added to the node-children in the content property. That way more than one fusion property can use AFX for rendering.

See Github PRsAFX documentationFusion documentation and Fusion reference for more details.

Breaking Changes


When filtering by node type, disabled superTypes were treated incorrectly. If you have code that relies on the old, "wrong", behavior, this fix will be breaking for you!

See Github issue for more details.


Sessions are now stored in a persistent cache by default so that authentication status and other sessions related information is not lost when flushing caches.
This is a breaking change, because session data is stored using PHP's serialize() function that could break if the underlying object implementation changed.

See below for more details.

Further Changes and Fixes

Simple Cache Management

A couple of handy CLI commands have been added that allow for easy setup and inspection of configured cache backends:

  • cache:list - display a list of all configured caches and their status
  • cache:show - display details & status for a single cache
  • cache:setup - set up a specific cache (e.g., create required database tables, file structure, ...)
  • cache:setupall - set up all cache backends that support it

See Github issue for more details.

Customizable Lock Holding Page

When a site (or Flow Application) is locked because it is currently being parsed, a technical error page is being shown.

The appearance and contents of this message can now be customized using the new environment variable FLOW_LOCKHOLDINGPAGE.

See Github issue for more details.

Persistent user sessions

Previously Flow sessions were stored like any other cache. Thus they were deleted whenever the cache was flushed. This lead to users being logged out after deployments if not taken special care.

From now on sessions are stored in a persistent cache by default so that authentication status and other sessions related information is not lost when flushing caches.

This is a breaking change because session data is stored using PHP's serialize function that could break if the underlying object implementation changed.

In those cases the sessions can be deleted manually using:

./flow flow:session:destroyAll

See Github issue for more details.

Allow “remote” user sessions to be terminated

A new method has been added to the Flow Security\Context that allows sessions to be removed for a specific account, effectively logging out the corresponding user:

$account = $this->accountRepository->findByAccountIdentifierAndAuthenticationProviderName(
$reason = 'just for fun';
$this->securityContext->destroySessionsForAccount($account, $reason);

This method is automatically invoked whenever an account is deleted.

See Github issue for more details.

Extended Eel Helpers

The following helper functions have been added:

  • - applies an operation to the elements of the given array
  • Array.reduce() - iteratively reduces an array to a single value using a callback function
  • Array.filter() - filters elements of an array using a callback function
  • Array.some() - returns true if an element in the array satisfies a condition
  • Array.every() - returns true if all elements in an array satisfy a condition
  • Array.set() - sets array keys which are calculated at runtime in Eel
  • String.chr() - generates a single-byte string from a number in the encoding's mapping table
  • String.ord() - converts the first byte of a string to a value between 0 and 255
  • String.sha1() - calculate the sha1 hash of a string
  • String.nl2br()- inserts HTML line breaks before all newlines in a string

See Github PRs for more details.

Fizzle filter operations can handle arrays

This commit amends the implementation for the ^=, $= and *= fizzle operators by checking if the given property is an array and if so, checking whether the filter matches in the following way:

  • *= - matches if the array contains an item that matches the filter string exactly
  • ^= - matches if the array's first item matches the filter string exactly
  • $= - matches if the array's last item matches the filter string exactly

See Github PR for more details.

Use localDistributionFolders on package:create

If your composer file has a local distribution folder identified by type "path" and a local folder reference in the "url" new packages are created in the distributionFolder and are required via

composer require ... @dev

See Github PR for more details.

Improvements to the node:repair command

We did a backward compatible rework of the node:repair command that improves the output of the command and introduces a simple event mechanism so that plugins can easily communicate tasks, warnings, and errors.

This also fixes the exit code of the command to be "1" if an error occurred.

See Github issue for more details.

Support HTML5 dialog method in Fluid templates

Support the dialog method used in HTML5 element e.g. `<form method="dialog" ...>`.

See Github PR for more details.

Add maxlength to TextArea view helper

Adds support for the maxlength property to TextArea.

See Github PR for more details.

Utility to add log environment from the method name

Since Flow 5.0, the Flow LoggerInterface is deprecated in deprecated in favor of the PSR-3 compatible LoggerInterface. With this release, all occurrences of the also deprecated SystemLogger was replaced within Neos and Flow core.
The old implementation had one advantage though, it automatically added the log environment - the package, class, and method the log message was issued - to the log message. This release adds a utility method with which you can easily add that information again:

$this->logger->error($logMessage, LogEnvironment::fromMethodName(__METHOD__));

See Github PR for more details.

Exception interfaces with HTTP status and reference code

Flow's exception implementations have a special property for setting the HTTP status code and/or a reference code for further debugging. While very useful you had to extend the Flow exception classes to make use of those features in 3rd party code leading to broken exception semantics. Now you can implement WithHttpStatusInterface and/or WithReferenceCodeInterface in custom exceptions to make use of these features.

See Github PR for more details.

Separate Security Context and Authentication Manager

Mostly a refactoring that improves readability and maintainability but as a side effect fixes the onePerRequest CSRF Strategy.

See Github PR for more details.

Documentation and Support


The detailed upgrading process for Neos 4.2 is explained in the upgrade instructions.


See the Neos 4.2 changelogs and Flow 5.2 changelogs for all changes and details.

Support for Neos 4.2 and Flow 5.2

As shown in our release roadmap, Neos 4.2 and Flow 5.2 will get bugfixes until December 2019 and security fixes until December 2020.

Thank you!

Special thanks for this release goes to the release manager Jon Uhlmann. Thank you also to his fellow team Tiga members, all other core team members and the community for your valuable contributions.

PS: Did you get your Neos Conference ticket yet?

In less than half a year, the annual main event for the Neos community will take place. There, you can  pick up in-depth Neos knowledge, and watch great speakers and connect with the community & core team. Make sure to join Neos Conference at May 10-11 2019 in Dresden, Germany. Some early bird tickets are still available.