[truecharts-admin]

This PR contains the following updates:

Package	Update	Change
getgrav/grav	patch	2.2.12 → 2.2.13

---

Release Notes

getgrav/grav

v2.2.13

Compare Source

10/23/2026

1. • [security] A field in a page's Flex form override keeps the stricter rules for dynamic options after it is merged into the directory blueprint, however it is renamed or numbered. Thanks @​soquip
   • [security] Page content is now checked for unsafe markup as though its Twig runs, even when Twig is off for that page, since a later move or rename can turn it into a module. Thanks @​vLWa7ch
   • [security] Flex user accounts: an account without super-admin access can no longer edit or delete a super-admin account through a Flex form, and a submitted password hash is ignored when an account is saved. Thanks @​manus-pi
   • [security] Flex page storage now refuses a folder, template or language that is not a plain name. Thanks @​shm0x00
   • [security] Images referenced by stream URI in page content, the watermark image and media_directory() now only come from media folders (pages, images, media, themes, plugins), configurable with the new security.media.allowed_roots setting. Thanks @​123abab123789

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[trueforge-bot]

📦 App Size Analysis

Note

Comparing ghcr.io/trueforge-org/grav:rolling ➔ ghcr.io/trueforge-org/grav:sandbox

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	188.97 MB	189.06 MB	+86.08 kB (+0.05%)	🔼
linux/arm64	184.56 MB	184.65 MB	+88.05 kB (+0.05%)	🔼

[Crow-Control]

Auto approved automated PR