Squeeze

Changed

• Require Verbb Base 3.0.20 or later so shared control-panel layouts use the current asset bundle namespace. (verbb-base#3)

Fixed

• Fixed a moderate-severity resource consumption vulnerability.
• Fixed a low-severity information disclosure vulnerability.

Added

• Added optional signed-in user binding for generated download tokens.
• Added configurable file-count and uncompressed-size limits for generated archives.

Changed

• Reduced memory usage by streaming assets through disk-backed temporary files while building archives.

Fixed

• Fixed duplicate asset filenames overwriting earlier files in generated archives.
• Fixed invalid archive-name values being coerced into unintended filenames.
• Fixed a low-severity information disclosure vulnerability affecting concurrent archive downloads.
• Fixed a moderate-severity information disclosure vulnerability.

Changed

• Route plugin settings through the plugin’s authorized settings controller.

Changed

• Align documentation filenames with page titles and update internal links.
• Updated documentation for clearer, more consistent guidance.

Changed

• Normalize plugin settings.

Anonymous downloads that pass raw asset IDs (files[]) will stop working until you mint a signed token in Twig. Update frontend templates before upgrading — see Upgrading to signed downloads.

Added

• Added access control for downloads: anonymous requests require a signed token; raw asset IDs are only allowed for logged-in users who can view each asset.
• Added allowedVolumes and defaultTokenDuration settings (CP and config/squeeze.php).
• Added signed download tokens via craft.squeeze.createToken() and craft.squeeze.getDownloadUrl() (accept asset IDs or Asset elements).

Changed

• Archive filenames are now sanitized before use.
• Security: the legacy anonymous files[]=<id> download URL no longer authorizes downloads on its own.

Changed

• Now requires Craft 5.0+.

Anonymous downloads that pass raw asset IDs (files[]) will stop working until you mint a signed token in Twig. Update frontend templates before upgrading — see Upgrading to signed downloads.

Added

• Added access control for downloads: anonymous requests require a signed token; raw asset IDs are only allowed for logged-in users who can view each asset.
• Added allowedVolumes and defaultTokenDuration settings (CP and config/squeeze.php).
• Added signed download tokens via craft.squeeze.createToken() and craft.squeeze.getDownloadUrl() (accept asset IDs or Asset elements).

Changed

• Archive filenames are now sanitized before use.
• Security: the legacy anonymous files[]=<id> download URL no longer authorizes downloads on its own.

The plugin’s package name has changed to verbb/squeeze. Squeeze will need be updated to 2.0 from a terminal, by running composer require verbb/squeeze && composer remove olivierbon/craft-squeeze.

Changed

• Migration to verbb/squeeze.
• Now requires Craft 4.0+.

• Fixed an issue where the temporary zip wasn't being deleted

• Added ability to trigger download via URL

• Initial release