Changelog

A platform maintenance update. The website's underlying platform, Drupal core, was updated from version 11.4.8 to 11.4.9, a bug-fix (non-security) release from the Drupal project. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• The site's Drupal core was updated from 11.4.8 to 11.4.9, an upstream bug-fix release, keeping the platform current with the latest stability fixes.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.

Technical notes

• drupal/core and its core-* meta packages moved 11.4.8 to 11.4.9 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• Full release notes: Drupal 11.4.9.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

A navigation and privacy update. The main menu returns as a full menu bar on most computer screens, every section of the site is now listed in the footer on every device, and the cookie banner is removed because the site sets no optional cookies. The Cookie Policy and Privacy Policy now describe exactly what the site stores.

Highlights

• On computer screens about 1240 pixels wide and larger, the main menu now shows as a single row of links, so screen reader and keyboard users reach every top level page without opening a menu button first. Phones and zoomed in screens keep the Main Menu button.
• Menu labels are shorter: About, Programs, and Contact. Home is no longer in the menu because the logo links to the home page, and Newsletter moved to the footer.
• A new Site sections list in the footer links to every section, including each Islamic Tools page, on every screen size. Screen readers announce it as its own navigation landmark, separate from the Legal and policies list.
• The cookie banner is removed. The site sets no cookies before a visitor asks for something, and the banner only stored its own consent choice, so screen readers no longer announce "We use cookies" on a first visit.
• The Cookie Policy and Privacy Policy now list exactly what the site stores: a sign in cookie for members who log in, prayer location cookies set only after a location is chosen, and a few settings kept in browser storage. Both pages state that no third party cookies are set and that visit counts come from Cloudflare Web Analytics, which uses no cookies.
• The organization's name now reads Global Advocacy of Blind and Low Vision Muslims on the Cookie Policy, Privacy Policy, Terms and Conditions, and Code of Conduct.
• October 1: blog tag labels and links in dark mode now meet color contrast requirements, and the article tags box uses the dark background in dark mode.
• October 2: on the support portal, the public ticket pages gained section headings, a character counter that speaks only at 4,500 and 5,000 characters, a single announcement when a ticket is submitted, a warning before a link opens a new tab, and comments that stay readable in dark mode and name their author.

Technical notes

• Menu fit: nine top level items needed 1,065 pixels against 872 available inside Olivero's 1,350 pixel container, so Olivero's nav-resize script switched every width to the mobile menu. Two items were removed, three labels shortened, and the level 1 gap reduced from 36 to 24 pixels in gablvm_theme (library 2.1.58).
• New site-sections menu and footer block; the existing footer block label became Legal and policies, which names its navigation landmark.
• eu_cookie_compliance stays installed with popup_enabled set to false, so a banner can return before any cookie setting analytics or embed ships. The theme's banner script, template overrides, and styles were removed, along with the prayer times wait for banner logic (gablvm_core prayer_times library 2.38, theme library 2.1.59).
• Policy pages were updated as new node revisions.
• Dark mode tags: Olivero hard codes the tag link and label colors (1.78 to 1 and 3.87 to 1 in dark mode); they now use the brand green and muted text tokens.
• Verified: one row menu at 1240, 1440, and 1920 pixels; footer landmarks named at 390 and 1440 pixels; the Islamic Tools submenu opens from the keyboard; no banner and no cookies on a first visit; zero console errors.

A platform maintenance update. The website's underlying platform, Drupal core, was updated from version 11.4.7 to 11.4.8, a bug-fix (non-security) release from the Drupal project. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• The site's Drupal core was updated from 11.4.7 to 11.4.8, an upstream bug-fix release, keeping the platform current with the latest stability fixes.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.

Technical notes

• drupal/core and its core-* meta packages moved 11.4.7 to 11.4.8 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• Full release notes: Drupal 11.4.8.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

A release covering eleven days of work, most of it in the Quran player. Headline items: when English translation is on, verses a reciter joins in a single breath now play together before their translations, so the English no longer cuts in mid-breath; several reciters' full-surah audio no longer has small holes of silence at verse boundaries; two more full-surah reciters were added; a new E key turns the English translation on or off, and the player's keyboard shortcuts can now be switched off. Outside the player, the Islamic calendar's Umm al-Qura option was corrected, account emails were redesigned and delivered through a new mail service, and the contact forms now support browser autofill. No downtime occurred and no user data was affected.

Highlights

• Quran player: breath groups with English translation. Reciters often carry two or more verses in one breath. With English translation on, the player used to stop after every verse, which could cut the recitation in the middle of a breath. The player now plays all the Arabic of a breath group first and then the English for those verses. Groups were found by scanning all 114 surahs for each affected reciter and confirmed by ear. This covers Sudais, Shuraym, Shatri, Rifai, Minshawi Mujawwad, and Husary Muallim. The recitation itself is not altered: pitch, speed, and tone are untouched. Adding ?groups=0 to the player address turns grouping off.
• Quran player: cleaner full-surah audio. The full-surah files for Shuraym, Shatri, and Rifai had short holes of digital silence at verse boundaries. They are now hosted copies cut from each reciter's continuous recitation, so the holes are gone. Shuraym's Surah Yusuf no longer starts inside its first letter.
• Quran player: cleaner English clips. The English translation clips were cut again so that clips played back to back no longer leave a gap of a third of a second, and a short tone that opened some clips was removed. All 6,350 clips were scanned afterward and none still opens with the tone.
• Two more full-surah reciters: Alzain Mohamed Ahmed, and a calm Haramain style recording by Maher Al Mueaqly.
• Quran player: new E shortcut. Pressing E turns the English translation on or off and announces the new state. If the selected reciter has no English translation, it says so instead of doing nothing.
• Quran player: shortcuts can be switched off. The Keyboard Shortcuts dialog now opens with a "Keyboard shortcuts on" check box. Clearing it turns off every single-key shortcut, which helps people who use speech input, and the choice is remembered in that browser. The Keyboard Shortcuts button always opens the dialog to turn them back on.
• Quran player: an outdated hidden note removed. A note read only by screen readers said the single-key shortcuts were meant for use without a screen reader. That was wrong. The shortcuts have been verified with VoiceOver, NVDA, and JAWS since Version 4.13, so the note is gone.
• Quran player resilience. If one breath group file fails to load, that group plays from its individual verse clips and playback continues.
• Islamic calendar: Umm al-Qura corrected. Choosing Umm al-Qura was silently returning the Saudi moon sighting calendar because of a wrong method code. It now returns Umm al-Qura. The Mathematical method was removed because its month grid ran two days behind the three calendar authorities; old links that name it fall back to the default.
• Account emails redesigned. Welcome, password reset, and the other account emails now have real headings, lists, and the site's look, with wording that depends on the account's role, and each one says at the bottom why it was sent. Site mail is delivered through a new authenticated mail service; designed mail from the site had been failing since August and is working again.
• Bylines and display names. Accounts can carry a display name that appears on bylines and in emails in place of the username. Articles by content editors are credited to the GABLVM Editorial Team and articles by administrators to GABLVM Staff.
• Forms: autofill. The name, email, and phone fields on the contact, Contact GABLVM, and website feedback forms now tell the browser what they hold, so browsers and password managers can fill them in.
• The logo in the header is a link to the home page again.

Technical notes

• Breath groups: group tables come from a loudness scan of every verse boundary (the last 100 ms of a clip compared with the clip's average level), with ear-confirmed additions where a verse ends on a quiet consonant the rule cannot detect. Each group is a single file cut from the continuous recitation the verse clips came from, so it holds no join; each verse keeps its own window on the timeline, so the verse status, seeking, and highlighting work as before. The API serves groups per reciter with clip address, duration, and per-verse offsets. quran_player 1.68 to 1.79, api-worker 1.6.0 to 1.14.3.
• Audio delivery: English translation clips, breath group clips, and the hosted full-surah copies are served from media.gablvm.org, a cached storage host, rather than through a worker. A recorded baseline of response types, byte ranges, cross-origin headers, and error answers was compared before and after the move.
• English clips: the cleaner caps the natural tail at 150 ms of decay after the last word and no longer mistakes a loud lead tone for the first word; a scanner reports any clip that still opens with sound.
• API: a file size that is not a whole number is sent as null, so one bad upstream value can no longer make a strict client reject a whole recitation answer. Reciter lists are cached for 1 hour instead of 24 so a new reciter appears the same day. The reciter catalogue has a single source in the API and the website reads its playback flags from there.
• Keyboard shortcuts: the E handler goes through the check box's normal change event, so every engine reacts exactly as it does to a click. For gapless reciters the "on" confirmation waits for the timing check to pass. The off switch is stored in the browser's local storage and leaves Escape active so the dialog can always be closed; this addresses WCAG 2.1.4 Character Key Shortcuts. The Keyboard Shortcuts button is named by its visible text (WCAG 2.5.3).
• Calendar: the Umm al-Qura key sent a code the upstream API does not recognise, and that API answers an unknown code with its default.
• Mail: a new Symfony Mailer transport sends through the Cloudflare Email Service and replaces a transport left over from a previous host. Account emails share one layout with a plain text version that carries the same footer and reason line. gablvm_core 2.6.9 and 2.6.10.
• Forms: autocomplete tokens added per WCAG 1.3.5 Identify Input Purpose.
• Support portal build: TypeScript 7, esbuild 0.28, and current Cloudflare Workers types; the build now type checks before bundling, so a type error stops a deploy.
• Operations: the nightly off-site archive now includes the website's version history, and a usage monitor sends an alert when worker requests or storage approach their monthly allowance. Routine dependency updates were applied automatically on six days in this period, each behind a health check.

A platform maintenance and security update. The website's underlying platform, Drupal core, was updated from version 11.4.6 to 11.4.7, a security release from the Drupal project. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• The site's Drupal core was updated from 11.4.6 to 11.4.7, an upstream security release, keeping the platform current with the latest security fixes.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.

Technical notes

• drupal/core and its core-* meta packages moved 11.4.6 to 11.4.7 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• Full release notes: Drupal 11.4.7.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

A broad release covering three weeks of work across the website, the support portal, and the status page. Headline items: five additional full-surah reciters in the Quran player, the Quran player page now opens in about a second after a cache rebuild instead of stalling for up to half a minute, prayer times location lookups succeed more often on Android, sunrise and sunset return to the prayer table as clearly labeled rows, and support ticket lookup now works from an email address alone. Two mobile screen reader rounds fixed unnamed controls, glued labels, and missed menu announcements found by walking every page with VoiceOver, TalkBack, and a virtual screen reader. A hardening pass tightened the content security policy, crawler verification, and ticket link handling. The language selector was retired. No downtime occurred and no user data was affected.

Highlights

• Five more full-surah reciters. Abdullah Awad al-Juhani, Ali Abdur-Rahman al-Huthaify, AbdulWadood Haneef, Badr Al Turki, and the combined Sudais and Shuraym recitation are now available in the Quran player, streamed directly from the same audio host the existing reciters use. The same list is served to API clients so the forthcoming mobile app sees exactly what the website offers.
• Quran player cold start fixed. After a routine cache rebuild the Quran player page could take 20 to 50 seconds to appear, sometimes failing outright with an edge timeout, because every catalog list had to be fetched again at once. The page now keeps a stored copy of those lists, refreshed once a day, and the worst measured case after a full rebuild and purge is about one second. Tool pages are also pre-warmed automatically after every rebuild so no visitor pays the cold render.
• Prayer times: sunrise and sunset back in the table. Sunrise sits after Fajr and sunset before Maghrib so the table reads in time order, each row header states its meaning ("Sunrise, Fajr ends", "Sunset, Maghrib begins") so screen readers never present them as extra prayers, and both rows get a quieter visual treatment. The Hijri date is now two separate lines, one per language, so screen readers that switch voices per language read the English cleanly and speak the Arabic with an Arabic voice where one exists.
• Prayer times: location lookups more reliable on Android. Lookups ask for a fast coarse fix first and fall back to a longer high-accuracy search while the status line reports progress; phones indoors or with accuracy off routinely needed more than the old window. A tab reopened after travel now re-checks the device position instead of keeping the departure city, and when a one-time permission has lapsed a hint appears under the Use My Location button.
• Support portal: ticket lookup by email. The ticket ID is hard to read and type with a screen reader, so the lookup form now leads with the email address and treats the ID as optional. Email alone sends one message with fresh links to that address's recent tickets. View links rotate when a ticket is resolved and expire after 30 days, and inbound email replies are threaded into an existing ticket only when the sending domain's authentication checks pass.
• Mobile screen reader round. The Light, System, and Dark appearance buttons, the Quran player seek bar, the menu button, the bookmark button, and several other controls were named only by an attribute that some Android and iOS pairings ignore; each is now named by real text. Hidden labels such as "Location:" no longer glue to the value that follows them in VoiceOver. Header menu and sub-menu open and close are announced. Untouched required form fields are no longer read as "invalid data" on iOS. Decorative step numerals and pager arrows are hidden from assistive technology. Grouped values on the status page are lists rather than flexed spans so they no longer read as one run-together word.
• Screen reader walk of every page. A full pass over gablvm.org and status.gablvm.org with a virtual screen reader fixed the cookie dialog reading its message twice, empty qibla finder placeholders being announced, and unnamed decorative graphics in the support portal. The translation disclaimer dialog now opens on its heading and keyboard focus wraps correctly. Mobile card layouts keep their column labels in the accessibility tree.
• Language selector retired. The third-party translation widget no longer functioned and has been removed from every page along with its script and styles.
• Hardening pass. The content security policy is now enforced rather than report-only, with no inline evaluation allowed, and the support portal editor is self-hosted so no page depends on a third-party script host. Search engine crawlers must now prove their identity through forward-confirmed reverse DNS before receiving crawler treatment, closing a gap where a spoofed crawler name skipped abuse detection. Failed sign-in counting, automated ban handling, and pattern learning in the security module were corrected so unexamined paths are no longer retired early. Ticket pages are served private and unindexed. All outbound portal mail now goes through the same authenticated sending service as the rest of the site.
• Status page and support portal fixes from an independent review round: incident edits and lifecycle state save atomically, editing an older update no longer rewinds an incident, draft incidents no longer change public component status, the live refresh updates component rows and announces list changes, measured uptime wording is exact, the keyboard shortcuts dialog contains focus, and administrator sign-in attempts are counted atomically.
• Groundwork for mobile event alerts. Publishing an event now queues a notification for the forthcoming mobile app's alert service, with delivery scheduled in each recipient's own time zone and transient delivery failures retried on the next run.

Technical notes

• Quran player: the five direct reciters carry IDs 9001 to 9005 as chapter-only entries with URLs built against the shared audio host; Sudais and Shuraym falls back to the older recording for surahs 7, 33, and 46. Timing lookups for them return empty without a network call, English mode is unavailable, and bismillah is treated as embedded. The API layer stamps playback flags (embedded bismillah, chapter only, English translation, verse reciter) on every chapter reciter so clients no longer carry their own copies of those sets. api-worker 1.4.0 and 1.5.0.
• Cold render: the four render-time catalog lists (surahs, reciters, chapter reciters, translations) are held in site state as well as cache, refreshed by a daily cron task; the player no longer fetches surah audio and first-verse data at render time. Upstream fetches in the API layer carry an 8 second timeout and answer 504 rather than holding the request open. Empty timing answers caused by an upstream timeout are no longer publicly cached for 24 hours. A pending English-off handoff is superseded by any new load or surah step. gablvm_core 2.6.6 to 2.6.8, api-worker 1.5.1.
• Prayer times: geolocation runs a 12 second coarse request then a 30 second high-accuracy retry in a shared helper; movement re-check on visibilitychange and pageshow throttled to once per 3 minutes with a 30 second position cache; a 60 second breaker after an upstream timeout or server error so saved-location views fail fast; one date formatting helper with a time zone fallback replaces three unguarded calls that could abort the countdown; the prayer countdown skips the same-day search when the table already shows tomorrow. Web Storage reads on the prayer and qibla pages sit behind guards so blocked storage cannot abort initialization. prayer_times library 2.33 to 2.36.
• Naming and speech: aria-label-only names were replaced by text content or a real label element on the appearance toggle, seek bar, menu button, bookmark button, occasion banner close, and sticky header switch. Visually hidden label spans carry a non-breaking space in DOM text because WebKit's text iterator emits no boundary around out-of-flow boxes and ignores CSS generated content. Webform controls use aria-required in place of native required, re-applied by a mutation observer, so an empty field does not match the invalid state on first load. The menu announcer observes aria-expanded on the header and sub-menu toggles and speaks the change through the site announcer. Tafsir commentary uses a hidden h4 rather than a labeled div; account links render as a list without a typed separator; header search input ids are unique.
• Security module: crawler verification requires reverse DNS within a published suffix plus forward confirmation, cached 24 hours positive and 1 hour negative with a per-process lookup cap; the cron watchdog pass verifies the address itself and no longer overwrites stored user agents. Failed logins accrue only when the core password check registered the flood event, so honeypot and CAPTCHA rejections do not count toward a ban. Pattern learning marks only examined rows as processed and a new source address resets the state under a row lock. IPv6 automatic bans unban by target, and a stale ban row on an allow-listed address can be cleared. A Cloudflare unblock failure no longer erases the local record. gablvm_security 1.1.8.
• Content security policy: report-only off and unsafe-eval dropped; the one static inline script the administration toolbar prints is allowed by hash. The support portal serves its editor from the worker with immutable caching and the rate-limit page uses inline brand tokens. Weekly scans now record every third-party script host per public page against a per-site allow list and run a signed-in policy check.
• Support portal: ticket view links rotate on resolve or close and expire 30 days later, with a fresh permanent link on reopen; inbound replies thread only on a passing authentication result and otherwise open a new ticket marked as an unverified reply; ticket pages are private, no-store, noindex. Ticket reply returns the inserted row; admin sessions carry a password fingerprint; contents heading text is escaped; mailto subjects are encoded; the status pill and ticket metadata moved to design-system tokens after a contrast scan flagged the generic colors. Both portal workers send through the authenticated email service. Seventeen unreachable source files were removed. Administrator login attempts use an atomic counter.
• Status page: incident update edits and lifecycle state persist in one write; cleared incident fields persist as null; the subscribe form posts to the API with the correct verification field name; status measurement times are shown; incident meta rows are lists; day sections are no longer double-announced. The CDN worker validates byte ranges before fetching object bodies.
• Event alerts: publishing an event enqueues per-recipient deliveries through a queue worker; a transient delivery failure leaves no receipt and is retried on the next run, with an attempt counter that stops after 20 rounds, while permanent rejections keep their receipt.
• Housekeeping: the retired translation widget block, template, script, styles, library definition, and theme hook were removed; unreferenced methods and constants in both custom modules were deleted; a deprecated user lookup call was replaced; debug copy buttons use the Clipboard API only with a visible failure state; automated checks run at 90 unit tests and 24 browser tests, all green, with a static analysis pass at level 6.

A platform maintenance update. The website's underlying platform, Drupal core, was updated from version 11.4.5 to 11.4.6, a bug-fix (non-security) release from the Drupal project. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• The site's Drupal core was updated from 11.4.5 to 11.4.6, an upstream bug-fix release, keeping the platform current with the latest stability fixes.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.

Technical notes

• drupal/core and its core-* meta packages moved 11.4.5 to 11.4.6 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• Full release notes: Drupal 11.4.6.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

A Quran player reliability and accessibility release covering fixes shipped since the previous release. Headline items: keyboard letter shortcuts in the Quran player work again in every focus position after a regression, rapid surah-to-surah navigation no longer ends in a loading error, and a Mac-only fault that could silence English translation mode was corrected. The release also includes a simplified manual location entry on the prayer times page, screen reader announcement improvements on the contact form, and an internal maintenance pass on the player code. No downtime occurred and no user data was affected.

Highlights

• Quran player keyboard shortcuts restored. A regression introduced on June 26 left the letter shortcuts (play and pause, seeking, speed, mute, and the rest) unresponsive whenever keyboard focus rested on one of the player's toolbar buttons, which is where focus most often sits. The shortcuts were restored on August 16 and verified with three screen readers, VoiceOver, NVDA, and JAWS, across macOS and Windows. A runtime self-check now exercises the shortcut path on every player load so a future failure is detected before listeners encounter it, and an automated browser test suite now guards the behavior permanently.
• Rapid surah navigation fixed. Pressing Next or Previous several times in a row previously issued a separate audio request for every press; the burst could exceed the audio provider's rate limit and playback stopped with a loading error that could persist for the same surah for several minutes. Navigation now announces each step immediately, waits for the selection to settle, and issues a single request for the final choice. When the audio provider is briefly busy regardless, the player retries automatically instead of requiring a manual restart.
• Mac-only English translation freeze fixed. A timing difference in how Mac browsers deliver media events could trap the player in a rapid, silent pause and resume cycle: playback stopped while the controls still indicated playing. The player now distinguishes its own internal control events from genuine user actions, so pause, resume, and VoiceOver's Magic Tap behave correctly and the cycle cannot begin. iPhone playback was unaffected and is unchanged.
• Prayer times manual location entry simplified. Entering a city and country by hand now sits behind a single button instead of an always-open form, and the reading order was corrected so screen readers no longer encounter the country selector in the middle of manual entry.
• Contact form announcements improved. Grouped questions on the contact form are now announced in reading flow for VoiceOver users.
• Player maintenance pass. Several hundred lines of retired styling and script no longer ship to browsers, roughly a thousand further lines of retired server code were removed, the player's audio engines now live in separate files, and automated test coverage grew substantially. A note on performance: this release does not make the site meaningfully faster. It makes the player more reliable and the pages slightly leaner, and it shortens the path for future fixes, including the two shipped the same evening they were reported.

Technical notes

• Keyboard shortcuts: the June 26 regression came from keydown handling that skipped all button elements to protect Space, Enter, and the arrow keys on the toolbar, which also swallowed the letter shortcuts. The handler now excludes only the keys a button actually consumes. quran_player 1.54 shipped the fix; 1.55 added the runtime self-check probe and end-to-end keyboard coverage. A public postmortem of the regression window is in the repository history.
• Surah navigation: Next and Previous are debounced at roughly 300 milliseconds, so a burst of presses issues one audio lookup for the final selection while each step is still announced instantly. The Quran API client additionally retries a 429 rate-limit response once, honoring the Retry-After header capped at three seconds, without tripping its outage circuit breaker. Automatic surah advance is unaffected.
• The Mac fix: the player's media-session anchor, the hidden element that provides lock screen controls and Magic Tap, fires pause and play events for the player's own control calls as well as for real user actions. Each control call now queues exactly one echo token and the event handlers consume one token per event, however late the browser delivers it; only an event with no matching token, a genuine Magic Tap, an interrupting phone call, unplugged headphones, or the natural end of a surah, reaches the toggle logic.
• Maintenance mode form: the login link inside the form description was adjusted so its accessible name reads as a single phrase.
• Module maintenance in gablvm_core: retired code removed, including an unused mail transport; hook implementations converted to modern hook classes grouped by subsystem; geocoding extracted into a dedicated service; the Quran player split into an orchestrator plus separate engine files. Unit coverage grew to 57 tests, including a new suite pinning the Quran API client's retry and cache behavior, and the 14-scenario end-to-end browser suite was hardened from fixed waits to condition-based waits. Quran player component versions in this window: 1.54 (August 16) through 1.63 (August 19).

A platform maintenance update. The website's underlying platform, Drupal core, was updated from version 11.4.4 to 11.4.5, a bug-fix (non-security) release from the Drupal project. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• The site's Drupal core was updated from 11.4.4 to 11.4.5, an upstream bug-fix release, keeping the platform current with the latest stability fixes.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.

Technical notes

• drupal/core and its core-* meta packages moved 11.4.4 to 11.4.5 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• Full release notes: Drupal 11.4.5.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

A monitoring and accessibility release. The headline item is that gablvm.org now watches itself: a JavaScript error in any visitor's browser, on any page, is reported to us automatically within minutes, where previously we only learned of a browser-side bug when the person who hit it took the trouble to describe it. Alongside that, every page gained a live status badge in the footer, the status page was redesigned with day-grouped incident history and uniform 24-hour times, uptime reporting became stricter and more truthful, and the site header was refined for screen reader users by the screen reader user who runs the site. No downtime, and none of your data was affected.

Highlights

• The website now reports its own errors. If a script fails in any visitor's browser, the site sends us an automatic report naming the failing script, the line, and the page, and we are alerted within about ten minutes. Reports contain no personal information: no name, no account, no reading history, only the error itself and where it happened. Known-harmless noise from browser extensions and third-party scripts is filtered out, so an alert always means something real in our own code. Until now, the hardest bugs in the Quran player could only be found when a listener noticed them and wrote to us; this closes that gap for every visitor we will never hear from.
• Every page now shows a live status badge in the footer. The badge reflects the current operational state of GABLVM services and links to the status page, replacing the previous static status line.
• The status page was redesigned. Past incidents are grouped by day across the last fifteen days, every timestamp uses the same 24-hour UTC format, incident timelines read cleanly under a screen reader with each stage as a heading and each date spoken once, and a full contrast pass brought every status page to zero WCAG AA violations.
• Uptime reporting is more honest. The status page now records the raw result of every health check and requires two consecutive failures before a service is publicly shown as down, so a single momentary blip no longer causes a false outage alarm. A recording fault in the earlier system under-counted failures, which made historical uptime figures look better than they were; figures from this release onward are the reliable ones.
• The site header is calmer under a screen reader. The GABLVM logo is now announced as a single, clearly named image rather than a link, the Home link in the navigation handles the trip back to the front page, and a redundant landmark wrapper around the header was removed. VoiceOver users hear one clean announcement instead of overlapping ones, and the iOS VoiceOver cursor no longer catches on the logo.
• The accessibility statement now dates itself. Each time the weekly automated accessibility scan passes with zero violations, the statement's review and testing dates advance automatically, so the statement always reflects the most recent verified scan instead of waiting on a manual edit.

Technical notes

• The error beacon is a small theme script (library error-beacon, now 1.2) that catches uncaught errors and unhandled promise rejections and posts them to a reporting endpoint on the status worker (commits c9bde92d, 31e88094, ad9d9e9e). Reports are de-duplicated by signature, repeats increment a counter rather than creating new records, each new signature triggers exactly one alert, and records are retained for 90 days. Client-side filters drop browser-extension errors, blank cross-origin stubs, the benign Chrome ResizeObserver message, and errors thrown by third-party analytics code.
• The status page redesign (commits e615bf40, 7b2c8408, 53d8252c, 2ee14a67, d4050799, 96abb0e5) grouped past incidents by day, unified all timestamps to 24-hour UTC, converted timeline stages to headings, added an Update post type, and cleared 276 WCAG AA contrast findings across the status pages.
• Uptime history now stores raw check results, and the public display applies a two-strike rule before reporting an outage (commit 2a3fcc51). The footer badge on gablvm.org reads that same public state (commit af211353).
• Header accessibility: the logo is a plain image with explicit alternative text and an explicit image role, and the header wrapper no longer exposes a banner landmark (commits f224d445, da2df8aa, 879c899d, 779736aa). The weekly scan records that construction as a single documented exception scoped to the header only, and on a passing run it also advances the accessibility statement's review dates (commit a839071c).

A cumulative fixes release covering the prayer times page, the Islamic calendar, the Quran player, Sign in with Quran.com, and the automatic site protection. The headline item is prayer timing at northern latitudes: where the last prayer of the night falls after midnight, the page could name the wrong upcoming prayer and could announce that a prayer's time had arrived early. Alongside that, changing the playback speed with English translation on no longer shifts the pitch of the reciter's voice, the 2030 and 2031 calendars have their Eids back, and a group of visitors who were being blocked by our own protection system can reach the site again. No downtime, and none of your data was affected.

Highlights

• Prayer times at northern locations are correct again. In much of northern Europe, Iceland, Canada and the northern United States, summer pushes the last prayer of the night past midnight. Just after midnight the page could point to the following morning's Fajr while a prayer was in fact minutes away, and in the evening the countdown could announce that a prayer's time had arrived roughly ninety minutes early and then stop counting down. The next prayer and its countdown now follow the correct prayer at every latitude, and prayers are no longer marked as completed before they have passed. The Islamic date also turns over promptly at local midnight instead of up to an hour later.
• Eid al-Fitr and Eid al-Adha are back in the 2030 and 2031 calendars. Both Eids, the Day of Arafah, and the real start of Ramadan were missing from those two years in the events list and in the calendar export.
• Changing the speed with English translation on no longer changes the pitch of the voice. Faster and slower playback used to raise or lower the recitation and the translation; both now keep their natural pitch. A speed change made while the player is paused is also applied when you resume, instead of being ignored.
• English translation playback recovers properly from interruptions. Taking a phone call and coming back now resumes where you left off, including when the call arrives in the middle of a translation. The VoiceOver speed setting is honoured during uninterrupted playback, the final verse's translation is no longer skipped at higher speeds, and your listening streak and daily reading time now count the translation half of listening rather than dropping roughly half of it.
• A loaded chapter now shows its real length before you press Play, instead of announcing zero seconds of zero seconds, and very short clips no longer lose a moment of audio or gain a silent tail at non-default speeds.
• The Sign in with Quran.com confirmation email works reliably. Automated mail scanners could open the single-use link before you did and use it up, leaving you with a dead link. Opening the link now shows a confirmation step, so only your own click completes it.
• Genuine visitors are no longer caught by the automatic site protection. Some real people, including visitors reaching newsletter subscription pages, were being blocked, and a handful of mistyped passwords could lead to a temporary block sooner than intended. Both have been corrected, and the protection system's manual controls now reliably lift a block when an administrator removes one.
• The Islamic calendar page opens quickly every time. Once a week the page had to rebuild its list of Islamic dates while someone was waiting for it, which took about four and a half seconds; that work now happens in the background beforehand.

Technical notes

• gablvm_core advanced from 2.5.8 to 2.6.5 (commits beb2b0e5, cc2a24d2, f1de2052, a55a67eb, ed3d3a3b, d45172d9, 7b623f52); gablvm_security advanced from 1.1.2 to 1.1.7 (commits 406e155a, e24f40ae, 38847f9f); the API proxy worker advanced to 1.3.1 (commit 5c856454).
• Next-prayer selection resolves each prayer to whichever instance is still ahead of the location's local clock, so a prayer whose clock time falls after midnight is handled correctly both late in the evening and in the small hours. The countdown carries the matching day offset, which is what caused the early arrival announcement.
• Pitch-preserved speed is produced by offline waveform-similarity overlap-add rendering, one pass per clip with the result cached. The earlier realtime approach was removed along with its whole class of startup races.
• The API proxy holds a prayer-times response with no explicit date for five minutes rather than an hour, so the answer rolls over at the location's local midnight. Dated requests are fixed answers and keep the longer cache.
• In the protection system, automatically learned patterns must show actual attack syntax before they can reach a category that issues a block; login attempts already rejected before the password check are no longer counted twice; and lifting a block now reaches the entry that was actually stored, including the address range used for IPv6.
• Prayer times continue to come from the Aladhan API through our own proxy, with the calculation method and school selectable on the page.
• The Islamic events list is now built during scheduled maintenance for the current and following year under the default calendar method, rather than on a visitor request when its week-long cache lapses. Measured live: 4.5 seconds cold before, 0.25 seconds after.
• No data migrations of consequence.
• Verified: 73 automated tests for the site modules and 24 for the player, all passing; the prayer page checked against several northern locations across the full day; the API proxy checked live for both cache behaviours; caches purged and the corrected files confirmed live.

A security and sign-in release focused on Sign in with Quran.com. The identity information Quran Foundation sends us during sign-in is now cryptographically verified end to end before any account is created or signed in. The same night, a broken corner of that sign-in was fixed: if your Quran.com email matches an existing gablvm.org account, the site used to show a dead-end message that promised a verification email which never arrived. It now actually sends a single-use confirmation link that connects the two accounts and signs you in. Every change was verified line by line and tested live, including a real sign-in against Quran Foundation's production servers. No downtime, and none of your data was affected.

Highlights

• Sign in with Quran.com now verifies the cryptographic signature and the standard identity claims of everything Quran Foundation sends before trusting it. If any check fails, the sign-in is refused rather than guessed at.
• New: when your Quran.com email matches an existing gablvm.org account, you receive a confirmation email with a single-use link that expires in one hour. Opening it proves the address is yours, connects your Quran.com identity to your existing account, and signs you in, with no extra steps. The old page promised this email but the flow behind it had never been built.
• First-time sign-ins through Apple and Google now work correctly. Quran Foundation does not state whether a provider-supplied email address is verified, and the site no longer treats that missing information as a failure.
• In the site protection system, expired IPv6 bans now lift correctly on their own. A bookkeeping mismatch meant some automatic IPv6 unbans quietly failed to remove the ban.

Technical notes

• gablvm_core advanced from 2.5.5 to 2.5.8 (commits de5658f1, 77281aa1, f0b741fe); gablvm_security advanced to 1.1.2 (commit c5852d13).
• Quran Foundation ID tokens are verified with RS256 signatures against Quran Foundation's published JWKS signing keys (cached six hours, refreshed on an unknown key id), with validation of issuer, audience, authorized party, expiry, issued-at, subject, nonce, and access-token hash when present. Algorithm-confusion tokens are rejected. Each authorization request carries a fresh OIDC nonce that is consumed exactly once at the callback. New dependency: firebase/php-jwt 7.1.0.
• Account provisioning is keyed to the signed permanent subject identifier. Returning users sign straight in; a new identity with no matching local email creates an account; a matching local email requires the new email confirmation flow before linking.
• The confirmation flow issues a single-use token with a one-hour expiry, stored only in hashed form, limited to three emails per hour per identity, with an IP-rate-limited consume-once confirmation endpoint that links the identity, signs the user in, and stores the session tokens from the original callback so no second handshake is needed.
• IPv6 automatic unban now targets the same canonical /64 network the ban was recorded under, so expired IPv6 bans are removed both locally and at the Cloudflare edge.
• Every change was hand-verified before being kept. One earlier over-strict revision (rejecting first-time sign-ins whose email verification status was unknown) was caught and corrected before release.
• In keeping with our disclosure policy we describe the category and impact of security work but not exploit details.
• Verified: 58 unit tests with 279 assertions pass, including 15 new signed-token security fixtures and 5 confirmation-flow tests; a real production Google sign-in exercised the complete verification chain; the confirmation flow was tested end to end on the live site (first use of a link connects and signs in, a second use is rejected); the home page and sign-in redirect were healthy after each deploy.

A security update. The website's underlying platform, Drupal core, was updated from version 11.4.3 to 11.4.4. Release 11.4.4 is a security-only release from the Drupal project that fixes three vulnerabilities its security team rated moderately critical: two cross-site scripting issues and one information-disclosure issue. The Drupal project urged every site to update immediately, and ours did so automatically the same day the release was published. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• The site's Drupal core was updated from 11.4.3 to 11.4.4, an upstream security-only release that closes three vulnerabilities: two cross-site scripting (XSS) flaws and one information-disclosure flaw, all rated moderately critical by the Drupal security team.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.

Technical notes

• drupal/core and its core-* meta packages moved 11.4.3 to 11.4.4 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• SA-CORE-2026-010: information disclosure, rated moderately critical.
• SA-CORE-2026-011: cross-site scripting (XSS), rated moderately critical.
• SA-CORE-2026-012: cross-site scripting (XSS), rated moderately critical.
• In keeping with our disclosure policy we name the category and impact of each fix but not the exploit details; the release contained security fixes only, with no other functional changes. Full release notes: Drupal 11.4.4.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

A platform maintenance update. The website's underlying platform, Drupal core, was updated from version 11.4.2 to 11.4.3, a bug-fix (non-security) release from the Drupal project. This routine release brings in the latest stability and compatibility fixes from the Drupal project and the open-source components the site is built on. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• The site's Drupal core was updated from 11.4.2 to 11.4.3, an upstream bug-fix release, keeping the platform current with the latest stability fixes.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.

Technical notes

• drupal/core and its core-* meta packages moved 11.4.2 to 11.4.3 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

A reliability release for the Quran player, from the twelfth deep review of the site's core code. Twenty fixes shipped, most of them in the player's less-traveled paths: switching surahs quickly, toggling the English translation mid-listen, or coming back to the page after a phone call. If you listen with the English audio translation, the most noticeable change is that checking the translation box in the middle of a surah now continues from the verse you are on, instead of replaying the English from verse one.

Highlights

• Turning on the English audio translation partway through a surah now picks up at the current verse instead of replaying every translation from the beginning.
• Switching to a different surah while paused with English on now starts the new surah at its first verse. Previously it could begin somewhere in the middle.
• After a phone call interrupted playback, a rare sequence of steps could leave two recitations playing on top of each other. That path is closed.
• Pressing Next surah several times quickly now keeps the surah menu and the audio in agreement instead of letting them drift apart.
• Very long listening sessions with auto-advance no longer build up memory until the browser closes the page.
• If a temporary server problem interrupts loading the English translation timings, the player now quietly retries instead of turning the translation off until you reload the page.
• For listeners signed in with a Quran.com account: Continue reading now resumes where you stopped, not where you started; bookmarks taken late in long surahs are more accurate; and the bookmark confirmation no longer speaks over the recitation in translation mode.
• During an outage of the upstream Quran data service, player pages now load quickly with sensible fallbacks instead of hanging for over a minute.
• On Prayer Times, tomorrow's times now appear after the last prayer of the day even when the location lookup service is unavailable, and a country-only location no longer displays as a doubled name like "Kenya, Kenya".

Technical notes

• gablvm_core advanced to 2.5.4; front-end libraries quran_player 1.39, quran_player_qf 2.7, listen_aloud 1.11.
• The gapless-English interleaver now runs its seek-resync on the first poll tick after arming, so a mid-surah toggle targets the verse in progress.
• The Web Audio engine resets its published-position index and interruption flags on every load and stop, and its auto-resume path checks engine ownership before acting, closing the double-audio window.
• Chapter-mode surah loads supersede in-flight requests with a token instead of silently ignoring them; stale metadata seek listeners are removed on each load; decoded audio buffers are released on surah and reciter changes.
• Server side: Hijri API responses are shape-validated before use so a malformed payload cannot interrupt page rendering; the Quran API client gained a 60 second circuit breaker after an exhausted retry ladder; three caching windows were shortened so data derived from a failed upstream probe heals within an hour instead of being pinned for up to a month; and aggregated-asset error responses are no longer marked cacheable at the edge.
• The review ran in multiple independent passes, with every reported finding verified by hand against the source before any change; ten reported findings were rejected as false during that verification.
• Verified: the module's full test suite passes, all key pages respond normally, and the Cloudflare cache was purged so the updated player is live for every visitor.

Summary for everyone. A platform maintenance update. The website's underlying platform, Drupal core, was updated from version 11.4.1 to 11.4.2, a bug-fix (non-security) release from the Drupal project. This routine release brings in the latest stability and compatibility fixes from the Drupal project and the open-source components the site is built on. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

What changed in detail

• The site's Drupal core was updated from 11.4.1 to 11.4.2, an upstream bug-fix release, keeping the platform current with the latest stability fixes.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.

Technical notes

• drupal/core and its core-* meta packages moved 11.4.1 to 11.4.2 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

Finding your location on the Prayer Times page just got easier and more accurate. The country field is now a dropdown list you can pick from, and choosing a country reveals an optional state or region menu that narrows the search. Your city stays a simple text box. This release also tidies three things readers asked about: the long accuracy notice on Prayer Times is now collapsed behind a single line, the outdated May announcement was removed from the home page, and the cookie banner is shorter.

Highlights

• On Prayer Times, country is now a dropdown of 252 countries instead of a text box, so spelling no longer matters. Picking a country shows an optional state or region menu with that country's regions. City stays typed.
• Cities that share a name with places elsewhere now resolve correctly when you pick the region, for example Springfield in Illinois rather than a Springfield in another state or country.
• The accuracy and disclaimer notice on Prayer Times is collapsed behind a line reading "About these times and accuracy". The welcome line stays visible, and prayer times now sit near the top of the page on phones.
• The home page opens with the Assalamualaikum greeting again; the May 2026 release banner it had accumulated was removed.
• The cookie banner now says what it needs to in two short sentences.
• Choosing just a country, or a country and a region, without typing a city now sticks for your next visit the same way a typed city does, and the location line no longer starts with a stray comma when no city is set.
• The Islamic Calendar's accuracy notice is now collapsed behind a line reading "About these dates and accuracy", the same treatment the Prayer Times notice received.
• On the blog list, the current page number in the pager was nearly invisible (dark green on dark green); it now shows clearly in both light and dark mode. Caught by a full-site WAVE sweep.
• The contact form's underlying Webform module reached its first stable release for Drupal 11 and GABLVM applied it the same day it was published. Among its improvements, form validation errors are now announced immediately to screen readers.

Technical notes

• gablvm_core advanced to 2.5.0 and the prayer_times front-end library to 2.21.
• gablvm_core 2.5.1: country-only choices persist via cookie on both the client and the server fallback, geocoder display names no longer leak into the city field, prayer_times library 2.22, hijri_calendar 1.8.
• Theme global-styling 2.1.43: the active pager item background is transparent so the brand-green number reads against the page in both modes. WAVE online re-scan of the blog: zero errors, zero contrast errors.
• Webform updated from 6.3.0-rc2 to the 6.3.0 stable release (first stable for Drupal 11; 292 issues resolved upstream), applied automatically by the update watchdog on July 7.
• Country and region lists are generated from GeoNames data (countryInfo and admin1, CC BY 4.0) and shipped as static JSON inside the module; region lists load in the browser per selected country.
• An optional region joins the geocoder query as city, region, country, and persists in its own browser cookie alongside the saved city and country.
• The region menu appears only when the chosen country has region data and JavaScript is available; without JavaScript the form still works with country and city alone.
• The home page change was saved as a new revision of the front page content, and the cookie banner wording is site configuration, so both are reversible.
• Verified: automated accessibility scans report zero violations on the home page and Prayer Times, a region-scoped lookup resolves Springfield, Illinois correctly, and the Cloudflare cache was purged so all visitors see the new pages.

A platform maintenance update. The website's underlying platform, Drupal core, was updated from version 11.4.0 to 11.4.1, a bug-fix (non-security) release from the Drupal project. This routine release brings in the latest stability and compatibility fixes from the Drupal project and the open-source components the site is built on. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• The site's Drupal core was updated from 11.4.0 to 11.4.1, an upstream bug-fix release, keeping the platform current with the latest stability fixes.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.

Technical notes

• drupal/core and its core-* meta packages moved 11.4.0 to 11.4.1 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

This release fixes how the Prayer Times page remembers your location, so it now follows you instead of getting stuck on an old place. If you type a city by hand, the site remembers it on your next visit. If you use the Use My Location button and later travel somewhere new, the page quietly notices and updates itself. The Quran player also gets a batch of fixes for listeners who use a screen reader or the keyboard, including a translation picker that now actually switches translations, and a protection system correction so that a single mistyped password can never lock a visitor out of the site. The following day, July 4, the same release line received a finishing round of appearance and readability fixes across the site: prayer times that no longer split across lines on phones, a Quran player that looks right in dark mode, a contact form dressed in the site's own colors, a tidier blog page, and easier-to-read introductions.

Highlights

• Prayer times location now stays current. Previously, the page pinned itself to wherever you first shared your location, sometimes for months. A city you typed by hand was shown once and then forgotten. Now a typed city is remembered across visits, sharing your location replaces the remembered city, and if you have moved more than a few kilometers the page refreshes to your new location automatically, with a spoken announcement for screen reader users.
• Quran player: the translation picker works. Choosing a different English translation now takes effect immediately, even mid-listen. Before this fix the choice was silently ignored.
• Quran player: seeking with VoiceOver works in Arabic-only mode. Swiping the progress slider with VoiceOver used to announce a new position and then snap back without moving. It now seeks properly in every playback mode.
• Quran player: pausing with the keyboard stays paused. Pausing with the K key or the space bar was misread as a phone interruption, so playback could restart on its own when you returned to the tab or unlocked your phone. A user pause now always stays a pause.
• Quran player: honest speed and translation announcements. Changing the speed while paused now takes effect when you resume at your exact position, and turning English audio off because a reciter does not support it is now announced instead of happening silently.
• Protection system: one typo can no longer block a visitor. A counting error in the automatic protection system could treat a single failed sign-in as repeated attack attempts and block that visitor permanently. The counting is fixed and every visitor blocked this way has been unblocked. Disclosed by category and impact per our security policy.
• Smaller fixes. The Hijri calendar's screen reader announcements no longer get cut off during fast keyboard navigation, removing a bookmark or note now confirms itself aloud and keeps your reading position, the page translation menu no longer goes blank when you cancel, live events that start late in the evening are no longer marked as ended minutes after they begin, and reply addresses on site emails are set correctly.
• Prayer times fit on one line on phones. Each time, such as 5:52 AM, now stays together on a single line instead of splitting in two, so the day's schedule reads at a glance on a small screen.
• The Quran player looks right in dark mode. A stray light patch near the page trail is gone, and the player's panels now use the same deep green palette as the rest of the site instead of an off-brand dark blue.
• The contact form now wears the site's own design. The step tracker, section header, and answer choices use the site's green and gold instead of the generic blue and gray they shipped with, while keeping the same large, easy targets and clear focus outlines.
• A tidier blog page. Article summaries in the list no longer leak their own internal headings, and the repeated sign-in-to-comment links are gone from the list view; they remain on each article's own page.
• Easier-to-read introductions and a trimmer footer. The welcome notes on the Quran player and prayer times pages are now aligned to the left, which reads more naturally than the old centered block, and the large empty space at the very bottom of every page is gone, with the small gold ornament closing the page neatly.

Technical notes

• gablvm_core advanced to 2.4.0: prayer location persistence redesigned around two mutually exclusive cookie pairs (coordinates from geolocation, city/country from the manual form), each write clearing the other, with a permission-gated silent refresh on load when the device has moved beyond roughly 5 km.
• Prayer times hardening: coordinates are validated as numeric before use, exact-zero coordinates no longer skip the tomorrow fetch, and a failed reverse geocode shows an honest generic label instead of the default city's name.
• Quran player: the translation select's handler is now bound after the DOM is ready (the markup sits below the inline script), the chapter-engine seek is applied in the change event for VoiceOver, keyboard pause sets the user-pause flag, and the stitched engine rebuilds from the exact position on a paused speed change.
• Hijri calendar and Quran verse endpoints now clamp month, year, and translation parameters to plausible ranges, bounding upstream API fan-out and cache growth from unbounded query values.
• gablvm_security advanced to 1.1.0: the cron-side failed-login scan was removed in favor of the real-time per-attempt subscriber (the scan had no cursor and re-counted the same window every run), stored threat paths are truncated to the actual column size, the edge-unban retry path was reordered so a failed edge call is genuinely retried, and 21 wrongly blocked addresses were released at both the edge and the origin.
• Event pipeline: a confirmed-live YouTube stream now maps to the Ongoing status the badge and expiry logic key off, and events starting at or after 11 PM get a guaranteed minimum runtime before the end-of-day cutoff.
• gablvm_theme advanced to 2.0.6: timezone fallbacks aligned with the configured site timezone and manual cache busting added for the theme's first-paint script.
• Verified: full test suite green (31 tests, 115 assertions), all public routes returning 200, the location fix exercised live end to end in all three modes (saved city, saved coordinates, invalid values), and the Cloudflare cache purged.
• July 4 appearance round (stylesheet-only): gablvm_theme global-styling advanced to 2.1.38; gablvm_core quran_player to 1.23, prayer_times to 2.17, and quran_tafsir_lab to 1.8.
• The breadcrumb overflow fade now uses the theme's background token in both light and dark modes instead of the parent theme's hardcoded white, and the Quran player's remaining pre-token dark surfaces moved onto the site's color tokens.
• The contact form restyle changed no markup: form structure, ARIA, and keyboard behavior are untouched, and every restyled state keeps required contrast.
• Verified with before-and-after screenshots at two viewports in both color schemes, and automated accessibility scans across five pages, two viewports, and both color schemes: zero violations.

The platform underneath the website was upgraded to Drupal 11.4, the newest release of the software that powers gablvm.org. Nothing changes in how the tools look or work. The win is under the hood: every page is now built with far less database work behind the scenes, so the site stays fast as it grows, and the foundation is ready for the next generation of improvements. All of your bookmarks, notes, and saved settings carry over unchanged.

Highlights

• A faster engine behind every page. Drupal 11.4 uses about one third of the database and cache lookups that the same pages needed a year ago, and loading content requires roughly half the database queries of the previous release. Visitors do not have to do anything; pages are simply cheaper for the server to build, which keeps the site quick even at busy times.
• Site search reorganized internally. Drupal split its search system into smaller, focused components, and the site was migrated to the new layout. Searching the site works exactly as it did before; this is groundwork that makes future search improvements easier.
• Quicker translation updates. The machinery that checks for interface translation updates was modernized and is dramatically faster, which shortens our routine maintenance runs.
• A stronger foundation for what is next. This release wires in the modern Symfony Runtime under the site and brings the platform current ahead of Drupal 11.5 and Drupal 12, which arrive in December 2026. Staying current means security fixes land here first and future upgrades stay small and safe.
• Stronger password protection. Account passwords are now secured with a stronger, more modern hashing method (argon2id). Nothing is needed from you; each account upgrades itself silently the next time you sign in.
• Friendlier form errors for screen readers. We adopted, ahead of schedule, an upcoming platform change that replaces browser-native form validation bubbles with the site's own clearly announced error messages, which screen readers handle far more reliably.

Technical notes

• Drupal core upgraded 11.3.13 to 11.4.0 via Composer; all database and post updates completed and the active configuration was re-exported to the config sync directory.
• Core's search split installed the new Search Node and Search Help modules to match the reorganized layout; the existing content, user, and help search pages carried over and were verified live.
• The front controller now boots through Symfony Runtime (a new autoload_runtime.php generated by the symfony/runtime Composer plugin).
• Drupal 11.4 ships an experimental core command line tool, dr, built together with the Drush maintainers. It is installed and working alongside Drush, which remains our primary CLI.
• The upgrade required a short maintenance window of roughly ten minutes while updates ran; every tool (prayer times, Quran player, Hijri calendar, qibla, tafsir, newsletter, search) was smoke tested afterward and the full unit test suite passes on 11.4.
• Our own components did not need any code changes for 11.4: gablvm_core 2.3.8 and gablvm_security 1.0.11 run unmodified.
• Password hashing switched to argon2id via the new core password.algorithm container parameter; existing bcrypt hashes verify unchanged and rehash transparently at next successful login.
• Post-release status-report cleanup: the deprecated Contact and History core modules (removed in Drupal 12) were uninstalled (the site's contact forms run on Webform), and enable_html5_validation was set to FALSE, adopting the Drupal 12 accessibility default of server-side validation. Both status warnings cleared; a fresh full accessibility scan after the upgrade shows zero violations across all pages and viewports.

This is a milestone release. The whole website now has a polished dark mode that reads cleanly in both light and dark, with no faded or hard-to-read spots anywhere. The Quran player now picks up where it left off after a phone call. Prayer times now speaks the next prayer aloud when it changes, and marks the prayers whose time has already passed today. And the accessibility of the tools was raised across the board to the strictest contrast standard, with one consistent gold keyboard-focus outline and clearer screen-reader labels. Nothing about your bookmarks or saved data changes.

Highlights

• A polished dark mode across the entire site. Every page and every tool now switches cleanly between light and dark. Backgrounds, text, buttons, and accents all move together, so dark mode is comfortable and fully legible rather than half-finished. If your phone or browser is set to dark, or you choose the moon icon, the whole site follows.
• The Quran player resumes after a phone call. If a call, Siri, or an alarm interrupts a recitation, the player now continues from the same spot when you return, instead of staying paused. It is on by default, and it only resumes after a genuine interruption, never after you deliberately pause.
• Prayer times speaks the next prayer. When one prayer's time arrives and the page advances to the next, it now announces the new upcoming prayer aloud for screen-reader users, instead of changing silently in the background.
• Prayer times marks the prayers you have already prayed. Prayers whose time has passed today are now dimmed and labeled "completed" for screen readers, so at a glance you can tell what is done, what is next, and what is still to come.
• Sharper, more consistent contrast everywhere. Text and labels across the tools were lifted to the strictest (AAA) contrast level, a few off-brand colors and fonts were replaced with the site's own palette, and every tool now shares the same gold keyboard-focus outline so navigating by keyboard feels consistent.
• A clearer prayer-times announcement. Removed a confusing "current item" phrase that a screen reader spoke when the prayer page loaded; the clear "next prayer" label remains.

Technical notes

• The Islamic-features component (gablvm_core) moved from 2.2.x to 2.3.0, a feature release with no breaking changes: player auto-resume after an audio interruption, the prayer rollover announcement, and passed-prayer marking.
• The theme gained a complete light-and-dark design-token system. Every tool stylesheet (prayer times, Quran player, Hijri calendar, qibla, listen-aloud, resources, language selector) was converted to shared tokens that flip correctly between modes; the base link color and roughly a dozen other spots that did not adapt to dark mode were fixed; and two text colors were nudged to clear AAA contrast on the site's ivory background.
• Verified with automated accessibility scans (axe) and computed-contrast audits in both light and dark mode: zero contrast failures on the homepage, an article, the login page, prayer times, the Hijri calendar, and the Quran player.
• The Quran player resume is best-effort on iOS, which can require a tap to restart audio after a call on some versions; in those cases the lock-screen play control resumes from the correct verse. A hidden setting can disable the behavior for debugging.
• This release takes a new whole number (4.0) because a complete site-wide dark mode together with new tool features is a milestone, per our numbering policy.

This release brings the website's core platform and its forms building block fully up to date. We applied the latest Drupal platform release and the newest version of the forms component, along with the supporting libraries they depend on. These are routine maintenance updates that keep the site current, reliable, and secure. Nothing changes about how the site looks or works, and your bookmarks and saved data are untouched.

Highlights

• The site platform is fully current. Updated the underlying platform that runs the website to its latest maintenance release.
• The forms component was updated. The building block that powers the site's forms moved to its newest release.
• Supporting libraries were refreshed. Several shared libraries the platform relies on were brought up to date, which also cleared a dependency knot that had been holding these updates back.

Technical notes

• Drupal core advanced from 11.3.12 to 11.3.13; the Webform module advanced from 6.3.0-rc1 to 6.3.0-rc2.
• Updated the supporting libraries guzzlehttp/guzzle, guzzlehttp/promises, and guzzlehttp/psr7 to their current releases. These had been transitively pinned, which blocked the core and Webform updates from applying; resolving them cleared the stuck state.
• Applied behind a full database and configuration backup, then verified on the live site: no pending database updates, caches rebuilt, key pages and the Quran player confirmed serving normally, and no new errors.
• These are maintenance and reliability updates, not security-specific.

Turning the English translation on or off in the Quran player now keeps your place. Before this release, toggling the English audio during a recitation could jump the player forward, and sometimes skip a verse, instead of continuing from where you were. That is fixed: turning English on resumes the same verse, and turning it off continues at the next verse. This release also wraps up a thorough behind-the-scenes review of the two software components that power the site's Islamic features, tightening reliability, accessibility, and security. Nothing changes about how the site looks, and your bookmarks and saved data are untouched.

Highlights

• The English translation keeps your place. Switching the English audio on or off no longer jumps ahead or skips a verse. Turning it on continues the same verse, and turning it off picks up at the next verse.
• Accessibility polish in the player. Clearer spoken status as verses play, and a keyboard shortcuts dialog built on a native, screen-reader-friendly control.
• Reliability fixes across the player and account tools. A round of small fixes to playback, translation handling, and the Quran.com account connection.
• A no-compromise code review, verified by tests. Both custom components were reviewed end to end, and every confirmed issue was fixed and checked by an automated test suite.

Technical notes

• gablvm_core advanced to 2.2.15; gablvm_security advanced to 1.0.8.
• The English-translation toggle fix: the player's two playback engines now hand off position on a single shared per-verse timeline rather than passing one engine's clock to the other, and the current verse is read from the verse data so the opening Bismillah is no longer miscounted as a verse. This removes both the forward drift on toggle and the skipped-verse on toggle-off.
• Completed a no-compromise review of both custom modules. Every confirmed correctness, accessibility, and quality finding was fixed and verified on the live site.
• Stood up an automated test harness for the modules: 30 unit tests plus 12 end-to-end browser tests, all green.
• Dependency-injection cleanup across both modules. Two oversized service classes were split for maintainability: the Quran account API client was separated from the OAuth layer, and the security module's background scanning was separated from its live request-time detection, each with one-directional dependencies to avoid cycles.
• Security hardening in the abuse-detection and rate-limiting paths is disclosed by date, category, and impact per our policy; no vectors are published.

Listening to the Quran with headphones on iPhone is now smooth. Before this release, plugging headphones in or out during a recitation could cause a brief stutter as the phone switched where the sound came out. We changed how Arabic recitations play so the iPhone keeps the sound steady through a headphone change, which removes that stutter. Background and lock-screen playback and the VoiceOver Magic Tap gesture are steadier too. Your place in the recitation and your saved bookmarks are unaffected.

Highlights

• Smoother headphone changes. Plugging headphones in or out during Arabic recitation no longer interrupts the audio.
• Steadier background and lock-screen audio. Playback continues reliably when the screen is locked or the app is in the background, and the VoiceOver Magic Tap gesture to play and pause is more dependable.
• No more brief distortion on the switch. Moving from the phone speaker to headphones no longer produces the short burst of distorted sound it sometimes did.
• Your place is kept. Turning the English translation on or off keeps your exact position in the recitation.
• One honest note. In the English translation mode, a very brief, self-recovering pause can still happen at the moment you change headphones. It does not lose your place and clears on its own; this is an inherent iPhone behavior during an audio change.

Technical notes

• gablvm_core advanced to 2.2.4.
• Arabic-only listening now uses the player's real-file engine: a single full-surah audio file played through a standard media element, which iOS reconfigures across a headphone route change natively instead of freezing the Web Audio render. The Web Audio engine is now used only when the English translation is on, which needs per-verse interleaving.
• Coverage was audited against the Quran API: all ten verse-by-verse reciters have a matching full-surah recording, so there is no gap. Toggling English switches engines while preserving the seconds-based position and the play or pause state.
• The Web Audio context is pinned to 44.1 kHz so a speaker-to-headphone change never forces the output from a higher sample rate down to a lower one, the specific condition the WebKit audio engine distorts on.
• Resume after an audio-session interruption now verifies that playback actually advanced before rebuilding its source nodes, which removes the occasional Magic Tap jitter caused by an unnecessary rebuild.
• High-resolution audio diagnostics were added behind a debug flag (off for visitors) and used to confirm that the remaining transition is iPhone reconfiguring its audio hardware for roughly six tenths of a second, which is below the web layer and cannot be removed from a web page.
• Known limitation: in English translation mode, which must use the Web Audio engine, that brief reconfiguration pause can still occur on a headphone change; it is self-recovering and does not lose position.
• Verified: the Arabic path plays a real full-surah file through the chapter engine; English toggles switch engines and keep position; default playback is unchanged with zero console errors; confirmed on iPhone.

A security update. The website's underlying platform, Drupal core, was updated from version 11.3.11 to 11.3.12, the Drupal project's security release of June 17, 2026. That release closed five security issues in Drupal core, including one rated critical, so applying it keeps the site protected. The update was applied automatically the same night it was published, within the window Drupal recommends for security releases. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• Drupal core was updated from 11.3.11 to 11.3.12, the Drupal project's security release of June 17, 2026, which fixed five security advisories in core: one critical, three moderately critical, and one less critical.
• The fixes address a range of issues including a critical code-execution risk (PHP object injection), a server-side request forgery, a cache-poisoning and open-redirect issue, and input-validation hardening. None of these were known to have been used against this site.
• The update was applied automatically by the site's maintenance system the same night it was released, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately saw the patched site.

Technical notes

• drupal/core and its core-* meta packages moved 11.3.11 to 11.3.12 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• The 11.3.12 release fixed five Drupal core advisories: SA-CORE-2026-005 (critical, PHP object injection); SA-CORE-2026-006 (moderately critical, gadget chain); SA-CORE-2026-007 (less critical, cache poisoning and open redirect); SA-CORE-2026-008 (moderately critical, server-side request forgery); and SA-CORE-2026-009 (moderately critical, improper validation).
• The site is confirmed running 11.3.12; no configuration or content changes were required. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged.

A small fix to the Quran player. When a reciter finishes a surah and the player continues to the next one, the surah menu now moves with it, so the menu always shows the surah you are actually hearing. This release also bundles a round of reliability and accessibility hardening across the prayer times, qibla, calendar, Listen Aloud, and Quran account tools.

Highlights

• The surah menu now follows auto-advance. Previously, when the player finished a surah and automatically continued to the next, the audio advanced but the surah dropdown stayed on the finished surah, so the menu and the recitation were out of step. Now the menu, the surah name, and the "open tafsir for this surah" link all update to the surah being played. This matters most for screen-reader users, who rely on the menu to know which surah is playing.
• Player shortcuts stay out of the way in controls. Keyboard shortcuts on the Quran player no longer fire while you are using the reciter or surah menus, a checkbox, or the seek slider, so adjusting a control no longer accidentally starts or pauses playback.
• The bookmark verse number matches the surah. On your Quran account, the verse field now follows the length of the surah you picked, instead of always allowing up to 286.
• Steadier qibla compass. Changing your location no longer stacks extra motion listeners, so the compass heading stays smoother.
• Clearer article reader state. The article Listen button now returns to a stopped state if the browser cannot start speech, instead of looking like it is playing in silence.
• More reliable date-based greetings. The time-of-day greeting and the Eid banner now follow your timezone more reliably, and the Ramadan banner can still be dismissed even when the browser blocks local storage in private mode.

Technical notes

• gablvm_core advanced to 2.2.2. The stitched Web Audio engine's load() now syncs the surah select value, and calls the helper that also refreshes the surah name and the tafsir link, on every load including the auto-advance path. Setting the value programmatically does not fire the change handler, so there is no reload loop. The single-file engine already did this. Verified live: a short surah with auto-advance on finished and the menu moved to the next surah on its own, with no console errors.
• gablvm_core advanced to 2.2.3.
• Quran account: the OAuth token refresh now bails instead of refreshing without the per-user lock, so two concurrent requests can no longer double-spend the rotating refresh token and silently disconnect a linked account.
• Quran player: the keyboard-shortcut guard now steps aside for any input, select, textarea, or button (the old check only excluded text inputs), so shortcuts do not fire while you are operating a control.
• Quran account notes: the verse number input takes its max from the selected chapter's verse count instead of a hardcoded 286.
• Qibla: startCompass is guarded so the orientation listeners and the iOS permission banner attach only once across location changes.
• Listen Aloud: the controls revert to a stopped state if speech cannot start, and the voices-changed handler is bound with addEventListener so multiple readers do not clobber each other.
• Banners and event times: event-timezone renders the time in the visitor's resolved zone via Intl, the greeting and Eid banner derive the date the same way, and the Ramadan banner wraps local-storage access in try/catch (private-browsing safe).
• Services: QuranApiService floors the token cache lifetime and guards the last timing segment with is_array; YouTubeLiveService wraps the per-event date parse so one bad date cannot abort the cron sync; QuranPlayerController strips tags from the first-verse translation for parity.
• Hardening: the asset cache-header subscriber matches only Drupal's hashed aggregate filenames; the CyberPanel mail transport (legacy path) builds its From from the message header and attempts every recipient; qf-account tolerates non-JSON responses; and the Hijri year navigation guards an empty select and keeps the local-date correction on "go to today".
• Verified: PHP lint clean, JS syntax clean, the player keyboard guard confirmed live (shortcuts bail in controls, still act elsewhere), and the calendar and home page load with zero console errors.

A set of small accessibility and reliability fixes across several tools, found in an internal review. The prayer times page now shows the Hijri date correctly after the day's last prayer; the Islamic calendar and the translation control return your place to the right spot for screen-reader users; the Listen Aloud reading feature reliably resumes after a pause; and the Qibla finder now shows the fixed calculated direction rather than a live compass reading on devices that cannot provide a true bearing. No downtime, and none of your data was affected.

Highlights

• Prayer times Hijri date after the last prayer. After the day's final prayer, when the page rolls over to tomorrow, the Hijri date now displays correctly instead of showing stray code. This was most noticeable to screen-reader users, who heard the raw markup read aloud.
• Focus returns where you expect. After the Islamic calendar corrects your time zone or you move between months, and after the translation notice is closed, keyboard and screen-reader focus now returns to the calendar or the control you were on, instead of jumping to the top of the page.
• Listen Aloud resumes reliably. The reading feature now reliably resumes after a pause. Previously, if you paused for a while, or changed the voice or speed while paused, pressing resume could leave the controls showing "playing" with no sound, or keep the old voice; it now restarts the current paragraph with your current settings.
• Qibla direction stays honest. On devices that can only report a relative orientation rather than a true compass bearing (some Android browsers and desktops), the Qibla finder now shows the fixed calculated direction instead of a live compass reading that could point the wrong way. Phones with a true compass are unchanged.

Technical notes

• gablvm_core advanced to 2.2.1. These were found in a proactive review of the client-side code, targeting the same bug classes we had just addressed in the Quran player: state surfacing after a rebuild, a timer or reload taking focus from the user, and platform event quirks.
• The tomorrow Hijri date is now written with innerHTML (the same trusted server-rendered markup the page uses for the initial value) rather than as plain text, so the language spans render instead of printing as tags. The calendar flags each navigation and the time-zone-correction redirect in session storage and returns focus to the today cell on the next load.
• Listen Aloud rebuilds the current chunk on resume when the voice or speed changed while paused, or when the pause exceeded the browser's roughly fifteen-second limit on paused speech (after which Chrome and Safari silently drop it); short pauses still resume seamlessly in place. The Qibla handler no longer treats a relative device-orientation reading as a compass heading, falling back to the static direction. The translation disclaimer returns focus to the language control on every close path.
• Verification: confirmed live that the prayer page renders the date markup correctly and that calendar focus returns to the today cell after a time-zone correction and after navigation; every affected page loads with no console errors. The device-sensor and speech-engine paths were verified at the code level. No database update hooks ran and no content or user data was changed.

A major rebuild of the Quran player, now complete. Recitation plays seamlessly from one verse to the next, with no gap. The English audio translation stays matched to the verse being recited, even when you turn it on or off in the middle or while paused. The player keeps playing when your phone is locked or you switch apps, and the lock-screen controls and VoiceOver Magic Tap work reliably. The progress bar moves in minutes and seconds, you can scrub it while paused or while playing, and seeking with VoiceOver moves by a clear amount and stays where you put it. Playback also recovers correctly after you plug in or unplug headphones. The start of each verse was tightened so there is no hesitation, while each reciter's own natural pauses are preserved. No downtime, and none of your data was affected.

Highlights

• Seamless verse-to-verse playback. The player was rebuilt on a new audio engine that stitches each verse onto a single continuous timeline, so the recitation flows with no pause or dip between verses, for the reciters that have per-verse audio.
• The English translation stays in sync and keeps your place. With the English audio translation on, it always matches the verse being recited, including when you toggle it on or off in the middle of playback or while paused; toggling keeps your exact spot and no longer jumps you to a different verse or back to the start.
• Position and seeking in minutes and seconds, including while paused. The progress bar and the skip-back and skip-forward buttons work in minutes and seconds, and you can now move the progress bar while playback is paused, not only while playing, with playback resuming from exactly where you set it.
• Clearer seeking with VoiceOver. Each swipe on the progress bar moves by a clear, useful amount, it no longer announces "boundary reached" while the value is still moving, and the bar no longer jumps away from you while you scrub.
• Background, lock-screen, and headphone playback. Playback continues when your device is locked or when you move to another app, with the lock-screen and VoiceOver Magic Tap controls working reliably, and it now resumes correctly from where it left off after you plug in or unplug headphones. Keeping this on the new engine took special audio routing on iOS.
• Cleaner verse starts that respect each reciter. The small silent lead-in at the start of each verse is trimmed so verses begin promptly, while each reciter's deliberate pauses, which differ a lot between the measured and the melodic styles, are kept fully intact.

Technical notes

• gablvm_core advanced to 2.2.0. The verse-by-verse-capable reciters now play through a Web Audio engine: each verse clip is decoded and scheduled back to back on one audio-context timeline, so playback is sample-accurate with no gap, while the remaining reciters keep using the single-file gapless engine. The English translation is interleaved on the same timeline, so it cannot drift from the recited verse, and toggling it resumes from the current position measured in seconds, which is independent of the clip layout, rather than from a clip index the rebuild renumbers and invalidates, which was the cause of the verse jump, including when English was toggled while paused.
• To survive lock and backgrounding on iOS, the engine's output is routed through a media-stream destination into a hidden media element that the system treats as real now-playing media, which also restores the lock-screen, headphone, and VoiceOver Magic Tap controls; the limitation it works around is that browser-built audio is otherwise suspended in the background. A headphone plug or unplug interrupts the iOS audio session and silently kills the scheduled audio; this is now detected, via the audio context reporting an interrupted or unexpected suspended state and a system pause on the media element, and the next play rebuilds fresh sources from the exact position so sound resumes instead of playing silently. The stitch and background routing each have a switch that falls back to the original engine if ever needed.
• Each clip's leading technical silence is measured and trimmed, capped at seventy milliseconds, so the measured reciters tighten up while the melodic and teaching reciters, whose lead-ins run from a few hundred milliseconds to several seconds, keep their deliberate pauses; a safety margin means a verse onset is never clipped.
• The progress bar reads in seconds from the verse timings and can be scrubbed while paused, holding the set position until you resume. Its per-swipe step is proportional to the surah length so VoiceOver registers a clear change rather than reporting "boundary reached," and the refresh that tracks playback is suppressed while you are adjusting, including when iOS VoiceOver reports only a final change event with no intermediate input events, which previously let the refresh overwrite the bar mid-scrub and pull it away from you.
• With the stitched engine handling every per-verse reciter, the previous verse-by-verse code path and a never-activated English-overlay subsystem became unreachable and were removed, roughly 640 lines, leaving the player simpler to maintain with no change to behavior.
• Verification: both playback engines were exercised end to end, covering play, seek, pause and resume, the English toggle on and off while paused and while playing, seeking while paused, auto-advance between surahs, and switching reciters, with no console errors; the background, headphone-recovery, and Magic Tap behavior was confirmed on device; and the Cloudflare edge cache was purged. No database update hooks ran and no content or user data was changed.

An accessibility and events release. The Events page now shows only what is coming up, and everything past has moved into a dedicated archive that maintains itself, so you can always browse our history without the upcoming list getting cluttered. Quran tafsir commentary now reads its Arabic in the correct voice, and after you change the surah or turn the page your screen reader lands right on the verses instead of the top. The seasonal Eid and Ramadan greeting now shows on the correct day no matter where in the world you are reading from, and the prayer-times countdown reads correctly in the evening. We also gave this changelog page itself a cleaner, less cluttered design. No downtime, and none of your data was affected.

Highlights

• The Events page now organizes itself by date. The Events page lists only upcoming events, and a new Past Events archive holds every finished event, newest first. When an event's date passes it moves from the page into the archive automatically, so nothing needs to be archived by hand. The archive is reachable from the Events menu, from the Events page, and from the Ramadan Archive, all cross-linked.
• Quran tafsir reads Arabic correctly. Arabic quoted inside the English commentary is now language-tagged, so a screen reader pronounces it in the Arabic voice rather than mispronouncing it in English. And after you change the surah or commentary, or move to the next page of verses, screen-reader focus now returns to the verses instead of the top of the page.
• The Eid and Ramadan banner shows on the right day everywhere. The seasonal greeting banner now determines the day across the full range of world time zones rather than the site server's clock, so it appears on the correct day for every visitor, wherever they are.
• The prayer-times countdown reads correctly in the evening. After the night prayer, the next-prayer countdown now renders correctly, where the initial page could previously show it blank to a screen reader before scripts finished loading.
• This changelog page was redesigned. The long list of versions is now tucked into an expandable index, and each release carries a small category tag, so the page is easier to scan and far less cluttered.

Technical notes

• gablvm_core advanced to 2.1.25 and gablvm_security to 1.0.3 across these changes. The events split is a date filter on the events view (event date relative to now) plus a new Past Events display; the occasion banner now probes the eastern, middle, and western extremes of the inhabited time-zone band; inline tafsir Arabic is wrapped in language-tagged spans after sanitization; the prayer countdown now computes the minutes to tomorrow's Fajr instead of returning an empty value.
• Several defensive fixes shipped behind the scenes: a guard so a corrupted 404-tracking record cannot fault a request, a single-flight lock so two simultaneous Quran.com token refreshes cannot invalidate each other, and multibyte-safe matching for non-Latin city names. Per our policy, security-relevant fixes are described by category and impact only.
• Verification: the unit test suite passes, automated accessibility scans report zero violations on the affected pages, and the Cloudflare edge cache was purged. No database update hooks ran and no content or user data was changed.

A module audit and fixes release. We rebuilt the site's administration settings to be easier to use with a screen reader, then ran a comprehensive self-audit of both of our custom modules covering security, code quality, and accessibility, and fixed every finding the same day. The security review came back clean: no vulnerabilities at any access level. The audit did surface a handful of real bugs and accessibility gaps, all now fixed, including unlabeled selection checkboxes in our internal security tools, a configuration lookup that would have interrupted the next livestream sync, and a calendar issue where the Islamic date shown for today could disagree with the month calendar when a calendar authority announcement was in effect. No downtime, no data changes, and nothing changed in how the public site looks.

Highlights

• The administration settings were redesigned for screen reader users. What used to be one long page with eight collapsible sections is now a landing page with five short, focused pages: Quran, Prayer Times, Hijri Calendar, Features and Display, and Integrations. Choices that used to be dropdowns with explanations squeezed into the option text are now radio buttons where each option has its own properly associated description, read once and only once. This also resolved a long-standing annoyance where VoiceOver on iPhone announced each collapsible section twice. No settings or data were changed by the redesign.
• We audited our own modules and fixed everything we found. The audit covered three angles: a security review (database queries, the Quran.com sign-in flow, token storage, request handling, and our IP protection tooling), a full code-quality review, and an accessibility sweep. Security: clean, nothing exploitable found. The other two angles produced the fixes below.
• Accessibility fixes. Selection checkboxes in our internal security management tables now announce exactly which item they select instead of reading as bare unlabeled checkboxes. Decorative status symbols are no longer read aloud before status sentences. Explanations now come before the buttons they explain. A popup notice now uses a real list so screen readers announce item counts and support list navigation. Several option labels were rewritten so the label is short and the explanation lives in a proper description.
• Bug fixes. The YouTube livestream sync read its key from the wrong configuration name, which would have caused the next scheduled sync to fail; fixed before it could. A momentary upstream API failure could previously be remembered for up to a month and quietly degrade verse-by-verse bookmarking for one reciter; failures are no longer cached. Tomorrow's prayer times were re-fetched far more often than needed; they now cache correctly. The Islamic date shown for today now honors calendar authority adjustments the same way the month calendar does, so the two can no longer disagree on the day an announcement matters most. Calendar exports now include a timestamp field required by the calendar standard, improving compatibility with strict calendar applications.
• Housekeeping. Dead code, unused permissions, an orphaned page template, and duplicated logic were removed or consolidated. Browser console logging on the prayer times and calendar pages is now off unless explicitly enabled for troubleshooting. Configuration schema coverage is now complete, which strengthens automated validation ahead of the next Drupal core update.

Technical notes

• gablvm_core moved from 2.1.14 to 2.1.19 across the settings redesign and the audit fixes; gablvm_security moved to 1.0.2. Six commits on June 9, 2026.
• Verification: the full unit test suite passes (13 of 13); automated accessibility scans report zero violations on all five new settings pages and on the home page, Quran player, prayer times, Islamic calendar, and tafsir pages; key pages were exercised in a real browser with no console errors; the Cloudflare edge cache was purged after deployment. No database update hooks ran and no content or user data was modified.
• Per our standing policy, security-relevant fixes are described by category and impact only.

An accessibility, dark-mode, and quality release. The headline: dark mode is now fully accessible across the entire site and every tool, the Quran player, prayer times, the Islamic calendar, the Quran tafsir pages, and the Qibla finder, along with the home page, resources, and events. Everything now meets the highest contrast standard in dark mode as well as in light. Alongside that came a round of behind-the-scenes hardening and reliability fixes, and we expanded the automated weekly accessibility scan to cover every tool and to test dark mode. No data changes, no downtime, and nothing changed in how the site looks in light mode.

Highlights

• Dark mode is now fully accessible everywhere. Several elements across the site and its tools, including the home page announcement banner, breadcrumb links, the prayer-times location dialog, the tafsir headings, the calendar event cards, the Qibla text, and the resource and event links, were using colors that did not adapt to dark mode and were hard to read for anyone browsing with dark mode on. Every page now passes automated contrast checks at the highest level in both light and dark, verified in a browser.
• Accessibility refinements. The events table now announces its purpose to screen readers, and the automatic labeling of icon-only links was tightened so it cannot attach the wrong label to a control.
• The weekly accessibility scan now covers every tool and tests dark mode. The Quran Tafsir, Tafsir Lab, and Qibla Finder pages were added to the scan, and it now runs a dark-mode pass in addition to light. Every launched product is on the checklist, not just a few, and dark-mode regressions will be caught automatically from now on.
• Behind-the-scenes hardening. Internal access controls in the security tools were tightened and an automatic-ban status detail was made more precise. As always, we note the date, category, and impact of security changes but not their exact details. The impact here is low; these are defense-in-depth refinements.
• Reliability. The email-sending component now correctly delivers to every copied recipient, and the prayer-times cache was made more efficient.
• Dark-mode follow-up (June 3, 2026). The weekly accessibility scan caught two more links that were hard to read in dark mode, the written-out contact link on the Accessibility Statement and Privacy Policy pages. Both are fixed, and the fix now covers body-content links across the whole site, so other text pages are protected from the same issue.

Technical notes

• A full from-scratch review of the custom modules and theme found no critical or high-severity issues, and a static-analysis deprecation scan (Drupal extension plus deprecation rules, PHP 8.4) reported zero deprecated API usage. A dark-mode axe-core pass, which the weekly scan had not previously run, surfaced the contrast issues; all were fixed to zero violations in both light and dark across the ten pages scanned.
• The dark-mode fixes were applied as dark-mode-only overrides so the light-mode design is provably unchanged, plus one source fix in the Quran-player stylesheet, where a dark rule had used a border-color design token as a text color (which resolves dark in dark mode).
• The weekly scanner gained three tool pages and a dark-mode colorScheme pass, and now runs fifteen pages across three modes (mobile light, desktop light, desktop dark). Theme and module library versions were bumped and the Cloudflare edge cache purged. No database update hooks ran.

A platform maintenance and security update. The website's underlying platform, Drupal core, was updated from version 11.3.10 to 11.3.11. This is a routine release that brings in the latest security patches and stability fixes from the Drupal project and the open-source components the site is built on. Nothing changed in how the site looks or works, none of your data was affected, and there was no downtime.

Highlights

• The site's Drupal core was updated from 11.3.10 to 11.3.11, keeping the platform current with the latest upstream security and bug-fix releases.
• The update was applied automatically by the site's maintenance system, then verified with an automated health check of the home page and the sign-in page before being kept. The content cache was refreshed afterward so visitors immediately see the current site.
• Although nothing on the site changed visibly, this release is worth noting because it carries security fixes from the open-source components Drupal is built on, so applying it keeps the site protected against recently disclosed issues in those components.

Technical notes

• drupal/core and its core-* meta packages moved 11.3.10 to 11.3.11 through the drupal-update-watch maintenance job, with a full database backup taken first and an automatic rollback armed in case the post-update health check failed.
• Upstream highlights bundled into 11.3.11: security updates to Symfony routing and http-foundation, an update to Twig 3.27.0, and a fix that replaces a vulnerable version of the symfony/polyfill-intl-idn component (tracked upstream as CVE-2026-46644). Core bug fixes in the release include more robust recursive file deletion, correct encoding of repeated dot-segments in generated URLs, PSR stream-response support, and automatic splitting of cache-debug headers larger than 8KB.
• This is a patch release with no Drupal SA-CORE advisory specific to it; it carries third-party security patches rather than fixing a Drupal-core-specific vulnerability. Drupal 11.3.x remains security-supported through December 2026.
• No data migrations of consequence; the database update step ran clean. The dependency manifest change was committed to version control and the Cloudflare edge cache was purged so the change is visible immediately.

A feature and quality release. The site now shows an automatic seasonal greeting banner during Ramadan, both Eids, the Day of Arafah, Ashura, and the Islamic New Year, driven by the Hijri calendar so it appears and disappears on the right days with nothing to schedule by hand. Alongside it came a round of reliability fixes from a full code review (most visible: prayer times now refresh correctly right after midnight, and the live-stream sync window was widened so long Taraweeh and Qiyam broadcasts keep their correct status), and a clean security review of the custom code with two small hardening fixes. We also made the top menu friendlier to screen readers: the "Islamic Tools" dropdown is now announced as a proper group instead of an empty link, and its tools stay quiet until it is opened. The server also moved to Imunify360 for malware and firewall protection. No downtime, and none of your data was affected.

Highlights

• Automatic Ramadan and Eid banner. A greeting banner now appears on the home page and the Islamic calendar during each occasion: Ramadan, with a special message for the last ten nights and Laylat al-Qadr, plus Eid al-Fitr, the Day of Arafah, Eid al-Adha, the Islamic New Year, and Ashura. It reads the current Hijri date from the same source as the calendar, so the two always agree, and it can be dismissed. The previous banner relied on hardcoded dates that had to be updated by hand each year; this one does not.
• Prayer times refresh correctly at midnight. When the page auto-detects your local date, it could briefly show the previous day's times for up to half an hour after midnight. That window is now closed, and the next-prayer calculation was made more robust.
• Live-stream sync window widened. The YouTube live-event sync now follows a stream from two hours before its start to six hours after, so a long Taraweeh or Qiyam broadcast keeps its correct live or replay status.
• Islamic calendar grid hardening. The month grid now aligns correctly even if a date returns from the upstream service in an unusual format.
• Security review and two fixes. A full security pass over the custom code found no critical or high issues and confirmed earlier fixes held. Two low-severity, defense-in-depth items were corrected: stricter validation of an event link, and cross-site-request protection added to the Quran.com disconnect action. As always, we do not publish exact details of security fixes, but we disclose when they happened, their category, and their impact, which was low.
• Server malware and firewall protection upgraded. The server now runs Imunify360, which adds active malware scanning and cleanup, a web application firewall with virtual patching, and brute-force protection, layered on top of the existing Cloudflare protection.
• Main menu dropdown made friendlier to screen readers. The "Islamic Tools" item in the top menu was set up as an empty link that led nowhere. It is now a proper grouping label for its dropdown, so a screen reader announces it as a group rather than as a link to nowhere, and its five tools stay silent until the dropdown is opened. The menu looks and behaves exactly the same. This was a long-standing issue in the menu, not something introduced by this release.
• Plus several minor code-quality cleanups with no user-facing effect.

Technical notes

• The banner is a hook_page_top render gated to the front page and the calendar route, driven by a new current-occasion helper over HijriCalendarService::getCurrentHijriDate(). Its render cache expires at local midnight, and cron purges the home page and calendar at the Cloudflare edge when the active occasion changes, so transitions are prompt with no hardcoded dates. Dismissal is per occasion via localStorage. Verified live for Eid al-Adha, 10 Dhu al-Hijjah 1447.
• Correctness fixes: prayer-times auto-date results now cache 5 minutes instead of 30 and the next-prayer comparison uses minutes since midnight; the live-sync window is a consistent minus-2 to plus-6 hours; the calendar tolerates unpadded Gregorian dates; plus a strict in_array, a removed dead property, and a guarded reciter formatter.
• Security fixes: event-link output is restricted to http and https schemes, and the Quran.com disconnect route now requires a CSRF token that is auto-appended to the link.
• Navigation accessibility: the "Islamic Tools" parent menu link was changed from an empty fragment to a no-link route, so Olivero renders it as a non-interactive group label instead of an anchor with an empty href. The collapsed submenu stays correctly out of the accessibility tree until opened, and reveals all five named items when opened. Verified in the rendered accessibility tree at desktop and mobile widths.
• No database update hooks ran. Cloudflare's anonymous-HTML edge cache was purged after deploy so the changes, and this changelog entry, are visible immediately.

A maintenance and quality release. We closed the remaining findings from the comprehensive module-wide audit that began in version 3.2 (the items flagged for follow-up there, several of which expanded into multiple discrete fixes once we looked closely), twenty-one fixes in all, spanning our security, core, and theme modules. Most are under-the-hood code-quality and maintainability improvements with no change to how the site looks or behaves. The visible changes are an across-the-board tightening of color and contrast so every page draws from the same brand palette, a handful of small screen-reader refinements, and a set of security-module adjustments that reduce false positives and improve performance. A follow-on accessibility pass on May 25, 2026 corrected the final low-contrast item, on the contact form's step tracker, and repaired the weekly automated accessibility scan that surfaced it. No new features, no data changes, no downtime.

Highlights

• Brand color and contrast consistency. We replaced more than a hundred hard-coded gray values scattered across the Quran Player, Prayer Times, Qibla Finder, Islamic Calendar, newsletter, and resources pages with our central brand color tokens. This makes the warm-ivory, brand-green, and antique-gold palette consistent on every page, and means a future palette change happens in one place rather than file by file. Two specific low-contrast text values were corrected to meet our WCAG 2.2 AA contrast targets, and the keyboard-shortcuts panel and the language-selector dialog were brought onto the same tokens.
• Screen-reader and motion refinements. The Qibla Finder's location dialog now carries the correct dialog semantics so screen readers announce it as a modal. The "live" status indicator animation now respects the reduce-motion system setting for visitors who are sensitive to movement. A set of redundant hidden labels on the light, system, and dark theme switcher was removed so VoiceOver no longer reads them twice, and the switcher now uses a single tab stop with arrow-key navigation between its three buttons, matching the standard pattern for a toggle group.
• Security module refinements. We refined the input-matching rules in our threat-detection module to remove false positives that could have flagged ordinary requests containing certain encoded characters, so legitimate visitors are not caught by mistake while real attack patterns are still detected. We added defensive guards to our Content-Security-Policy header processing so it only rewrites genuine HTML responses and skips oversized or non-HTML responses, which is both safer for file downloads and faster. We also removed a large block of unused legacy pattern-matching code from the security module, reducing its footprint with no change to active protection.
• Code maintainability under the hood. Several internal services, including the YouTube livestream sync and the Quran.com sign-in service, were refactored to receive their dependencies through Drupal's standard dependency-injection container rather than fetching them globally. This has no user-facing effect but makes the code easier to test and maintain. Caching for the Islamic Calendar was made more precise so an update clears only its own cached data rather than unrelated caches. We also expanded the in-code documentation explaining why our back-channel sign-in token does not require local signature verification, so the security rationale is captured for future reviewers.
• Contact form step-tracker contrast. The small step labels on the contact form's progress tracker ("Your contact information," then "Complete") inherited a light gray from the form module that fell just below our contrast target on the desktop layout. Upcoming steps now use our antique-gold text color and the current and completed steps use brand green, both comfortably above the WCAG 2.2 AA threshold and correct in dark mode as well. This was the last outstanding contrast item on the site; every page now passes our automated accessibility scan with zero violations.

Technical notes

• Eleven commits landed on master. gablvm_security: 8f72ac08 (threat-detection false-positive pattern removal), 506ee49c (Content-Security-Policy body-rewrite guards for non-200, non-HTML, and oversized responses), 8ef5205b (removal of an unused pattern-matching library). gablvm_core: 820945ed (targeted cache-tag invalidation, numeric library versions, cache-context dedupe), a2403cc5 and 361f60cd (dependency injection into the YouTube and OAuth services), 72fda3b7 (id_token rationale), f0c74539 (brand-token colors and Qibla dialog semantics), 2cf179e9 (the gray-to-token sweep). gablvm_theme: 4edf8ee2 (accessibility polish) and b79f643a (a documented form-error decision).
• The gray-to-token sweep touched eleven CSS files and replaced 129 hard-coded gray hex values with brand custom properties carrying literal fallbacks. White was left intact. Affected library versions were bumped to bust the aggregated-CSS cache, and representative pages were rendered and visually inspected after the change.
• The dependency-injection refactors were validated by a clean container compile and service instantiation. The OAuth service change was additionally validated by a 302 on the sign-in route; a live end-to-end sign-in test with VoiceOver is recommended as a follow-up rather than asserted here.
• Two findings were resolved as documentation rather than code changes. The per-field form-error live region is intentionally assertive: the errors are static at server-side render and are reachable through both the status-message summary and per-field description linking, so demoting them is deferred pending a live VoiceOver pass. Separately, a note was recorded that the decorative pseudo-element alt-text syntax is ignored by some older WebKit versions, which is a known browser limitation rather than a site defect.
• No database update hooks ran. No configuration drift. Cloudflare's anonymous-HTML edge cache was purged after deploy so visitors receive the refreshed styling and this changelog entry immediately rather than waiting for the edge time-to-live to expire.
• A follow-on accessibility pass on May 25 corrected the contact page's Webform progress-tracker text, which the contributed form module styles at #777 (4.18:1 on our ivory background, just under the 4.5:1 AA threshold). The fix is a theme override mapping the labels to the brand gold-text and green custom properties rather than an edit to the contributed module, so it survives module updates; commit f3358c7c, the global-styling library bumped to 2.1.17, and Cloudflare's edge cache purged for the contact page. A full re-scan across twelve pages at mobile and desktop widths returned zero violations and 650 passing checks. Separately, the weekly automated accessibility scan that surfaced this item was itself repaired (commit 260d8c51) after a Node.js package-loading incompatibility had been stopping it from completing its run.

Eight accessibility and security fixes from a module-wide audit, plus a critical platform security update. Most important: we applied a critical Drupal core security update and rebooted the server to apply queued operating-system updates. We also fixed a sign-in edge case affecting some Apple users on the Sign in with Quran.com flow. Reading progress now records both your verse position and your daily activity to Quran.com, so streaks and the Today's Reading panel populate correctly. And we submitted our Quran Foundation v4 API integration to the May 2026 Quran Foundation Hackathon. All maintenance items are now up to date.

Highlights

• Apple sign-in edge case fixed. When you signed in with Quran.com using an Apple account, our previous check required Apple's identity token to include an "email verified" flag. Apple does not always include that flag, so some legitimate sign-ins were silently rejected and sent to a "verify your email" page that did not apply. The check is now restructured to only require the verification flag on the specific branch where it actually matters for account security (matching by email address to an existing GABLVM user), with a carve-out for Apple Private Relay addresses, which Apple intrinsically verifies. Apple sign-in works end to end for new and returning users.
• Reading progress now records to two endpoints. Every Quran Player session over eight seconds now logs simultaneously to a position endpoint (drives the Continue Reading panel) and a daily-aggregate endpoint (drives the streak engine and Today's Reading panel). Previously only position was recorded, so streaks were not visibly counting your gablvm.org sessions. Reliable flush on surah change, audio end, and page close using navigator.sendBeacon.
• Comprehensive module audit shipped eight fixes. A multi-angle code review of our security, theme, and core modules surfaced 25 findings. Eight surgical fixes were shipped in three commits: a search-engine-bot exemption for our threat detection module so Googlebot and similar crawlers do not get auto-banned for normal indexing probes; a flood throttle on ban-notification emails so a botnet cannot trigger a flood of admin alerts; defensive try-and-catch on threat database writes so attack load cannot turn 404s into 500s; three missing configuration schema entries; a corrected dialog accessibility attribute on the keyboard shortcuts panel; a screen reader fix that stops double-announcing required-field markers; a branding block restructure that removes a flagged aria-hidden focusable element pattern; and a live-event badge label correction so the visible text and the accessible name match. Seventeen further findings are tracked for post-judging follow-up.
• Cloudflare IPv6 reverse-proxy ranges added. The site's reverse-proxy configuration now includes Cloudflare's IPv6 prefixes alongside its IPv4 ranges. Without this, a single misbehaving IPv6 visitor could have caused downstream impacts for other visitors sharing the same Cloudflare edge address. Resolved.
• Quran Foundation Hackathon submission. Our integration with the Quran Foundation v4 API was submitted to the May 2026 Quran Foundation Hackathon at 4:40 AM UTC today. The public submission code repository is at github.com/Alexrydder/gablvm-quran-foundation-hackathon. The integration architecture documentation is published at /quran/about-integration. Judging is open over the coming weeks.
• Drupal core security update applied (11.3.10). Closed nineteen active advisories with a single coordinated upgrade: SA-CORE-2026-004 (Drupal core, highly critical), a Twig template-sandbox advisory, and a Symfony component advisory family. The upgrade landed cleanly with no database update hooks needed, no configuration drift, and an end-to-end smoke test passing on all integration routes. A first attempt earlier in the day surfaced a structural mismatch on this server between two copies of Drupal core that had drifted apart; the mismatch was repaired and the upgrade re-applied successfully. Total exposure during the work was bounded by Cloudflare cache, which continued to serve previously-rendered pages while the rollback ran. The auto-update workflow has also been tightened so the next core security release is picked up automatically by the daily check rather than waiting for manual application.
• Host server rebooted for operating-system updates. The host running gablvm.org was rebooted to land an on-disk Linux kernel point release and a set of userspace library updates that had been queued since the last maintenance window. KernelCare had been live-patching the running kernel against published security advisories in the meantime, so there was no open exposure window. The reboot took approximately sixty to ninety seconds, during which Cloudflare continued to serve cached responses to most visitors. No configuration changes, no data loss.

Technical notes

• Three commits landed on master: 624787ee (gablvm_security defense-in-depth), 5168b790 (gablvm_core config schema + shortcuts dialog), 8eca0887 (gablvm_theme VoiceOver triple-fix). The Apple sign-in fix landed in an earlier commit on May 20.
• Smoke-test routes (home, login, OAuth sign-in, my-account, about-integration) returned expected HTTP status codes both before and after every commit.
• The accessibility theme library version was bumped to 1.3 to bust the aggregated CSS cache for the form-required marker fix. No database hooks ran for this release.

Maintenance release. We applied today's Drupal updates (core, the URL-aliasing module, and the transactional email module), introduced an automated workflow that keeps the site current on safe updates without manual intervention, and corrected a sentence in the version 3.0 entry that wrongly suggested Apple sign-in was the default for connecting your Quran.com account. There are no new user-facing features in this release.

Highlights

• Drupal core update. The platform that runs gablvm.org was upgraded from 11.3.8 to 11.3.9, a maintenance release with bug fixes and dependency bumps. Two database update hooks ran cleanly. The site was smoke-tested after the update and returned HTTP 200.
• Pathauto module update. The URL-aliasing module that produces friendly addresses like /articles/2026/05/… was upgraded from 1.14 to 1.15. A small post-update hook removed an obsolete configuration key.
• Symfony Mailer module upgrade. The module responsible for transactional email (password resets, contact-form responses, newsletter delivery) was upgraded across a major version, from 1.6 to 2.0. Three database update hooks ran. An end-to-end test confirmed delivery through the new transport.
• Automated update workflow. A scheduled daily check now examines the project's package manifest, applies maintenance and minor releases automatically after taking a database snapshot, runs Drupal's update hooks and a homepage smoke test afterwards, and rolls everything back if the smoke test fails. Major-version upgrades are not auto-applied; the maintainer is notified so a human can review the change. The site stays current on safe updates without anyone needing to take manual action.
• Kernel security update applied. The Linux kernel local-privilege-escalation advisory (CVE-2026-31431, publicly known as "CopyFail") was published in late April 2026 and affected most modern Linux distributions. The patched kernel has been installed on the server and the system was rebooted to bring it into running memory, closing the vulnerability. The site was offline for approximately 60 to 90 seconds during the reboot. No data loss, no configuration changes. Public guidance on the advisory is published by the National Vulnerability Database.
• Version 3.0 wording correction. The earlier changelog line about connecting your Quran.com account read "Sign in with Apple is the default flow," which was inaccurate and could have given Android users the impression that they were excluded. The line now reads neutrally: Quran.com handles the sign-in step using whichever method you already use there (email and password, Google, or Apple). No functional change, only the description.

Technical notes

• The update sequence runs composer update on the affected packages followed by drush updatedb -y and drush cache:rebuild, with a composer audit pre-flight that returned zero advisories for the project as a whole.
• The automated workflow categorizes available updates by semver. Items flagged as semver-safe (patch and minor releases that respect the existing version constraint) are auto-applied. Items requiring a constraint relaxation (major-version bumps) are reported but never applied without review. Pre-apply state is captured so a smoke-test failure can roll the site back automatically; backups are pruned on a fixed retention window.
• The Symfony Mailer 2.0 module exposes its API through autowired services rooted at Drupal\symfony_mailer\MailerPlusInterface and component-specific interfaces. Any earlier references to an email_factory service are obsolete; the standard Drupal MailManager (\Drupal::service('plugin.manager.mail')) remains the portable path for one-off sends, with the system module's hook_mail expecting $params['context'] to contain subject and message strings.
• Cloudflare's anonymous-HTML edge cache was purged after the changelog edit so all readers see the corrected version 3.0 wording immediately rather than waiting for the edge time-to-live to expire.

You can now sign in to gablvm.org with your Quran.com account. Once connected, the bookmarks and notes you save on gablvm.org are saved to your Quran.com account too, and they appear on the Quran.com mobile and web apps. Your reading position logs automatically every time you listen, your reading streak counts the days you keep going, and a new "Today's reading" panel tells you in real time whether your latest session was tracked. This is the biggest single release we have shipped since gablvm.org launched, and we built it with screen-reader users in mind from the very first design choice.

Highlights

• Connect your Quran.com account at /quran/my-account. Quran.com handles the sign-in step using whichever method you already use there (email and password, Google, or Apple). Once connected, bookmarks, notes, reading streaks, recent reading positions, and goal progress sync between gablvm.org and Quran.com.
• Bookmark a verse from /quran-listen. A button on the Quran Player captures the currently-playing verse and saves it to your Quran.com Favorites collection.
• Bookmark dashboard. Your bookmarks appear on /quran/my-account with verse references, jump-to-verse links, and a Remove button on each. Reciter and mode are restored when you click a jump link.
• Bookmark deep-links jump straight to the bookmarked verse. No Bismillah preroll, no playback of the surah from verse 1.
• Take notes on a specific verse. Up to 5,000 characters per note. Notes appear in your list immediately, with Remove buttons on each.
• Reading sessions log automatically. Eight seconds after audio playback begins, gablvm.org logs your position to your Quran.com account.
• Today's reading panel. A new section under Reading streak that updates in real time as you listen, so you know your session was tracked without waiting until midnight UTC.
• Reading streaks. Counts the consecutive days you have read. Updates once per day at midnight UTC.
• Recent reading positions. The five most recent positions you logged appear on /quran/my-account so you can pick up where you left off.
• Hijri date display fix. The Arabic Hijri month names for Dhu al-Qa'dah and Dhu al-Hijjah were rendered without the space between the two parts. Now reads the standard spelling.
• Sunrise and Sunset rows on /prayer-times. Solar events are now visually distinguished from prayer rows.

Technical notes

• OAuth2 authorization_code with PKCE for the Quran.com handshake. Refresh-token rotation is supported.
• Today's reading panel uses the canonical /auth/v1/goals/get-todays-plan and /auth/v1/activity-days endpoints (clarified by Quran Foundation's developer team on May 5; the previously-suspected /goals/today and /activity-days/today paths do not exist).
• Bookmark deep-link prefetches chapter timings before loading audio, so the seek happens before playback starts, no Bismillah preroll or verse-1 audio bleed.
• Drupal drupalSettings JSON blob renders near the end of the body; bookmark target reads are deferred to DOMContentLoaded so window.drupalSettings is available.
• 500-millisecond grace at verse boundaries: clicking Bookmark in the last half-second of a verse saves the next verse instead, matching listener intent.
• Notes endpoint requires a saveToQR field (Save to Quran Reflect cross-post toggle); we send false to keep notes private.
• Disconnect/reconnect now preserves local listening-context metadata (reciter + mode keyed by surah:verse), so reconnecting to the same Quran.com account restores the same UX.

Known limitations and what is next

• Goal creation UI is not yet in this release. If you set a daily reading goal in the Quran.com mobile or web app, the progress will show up automatically on /quran/my-account. A goal creation form on gablvm.org is coming in a follow-up release.
• Chapter-mode bookmark seek has about 5 percent timing drift. The chapter (gapless) audio file has slightly different pacing than the per-verse audio files we use to compute the seek position. Bookmarks land in the right area but may be off by a half-second to a second on a typical surah.

A blind reader using VoiceOver pointed out that when the location permission dialog opens on the Prayer Times page or the Qibla Finder, screen-reader focus was landing directly on the "Continue" button. That meant a screen-reader user heard "Continue, button" without ever hearing the dialog's title or the explanation of what they were continuing to. We changed the focus target so the dialog now opens with focus on the heading "Location Access," and the explanation paragraph is the next thing read as the user swipes forward. The buttons are still reachable in the same order; only the starting point moved. The same focus fix was applied to the external-link interstitial dialog, the small "You are leaving gablvm.org" modal that appears when you click an off-site link.

Highlights

• Prayer Times location dialog: VoiceOver now opens with focus on the "Location Access" heading. Swiping right reads the body explanation and then reaches Continue and No Thanks.
• Qibla Finder location dialog: same fix applied. Behavior matches Prayer Times.
• The dialog itself, the buttons, and the keyboard interaction are unchanged. Pressing Escape still cancels. Pressing Continue still triggers the browser's native location permission prompt within the same user-gesture window (the Safari iOS fix from version 2.6 is preserved).
• Sighted keyboard users will not notice a difference: the heading is not in the tab order, so pressing Tab still goes Continue, then No Thanks. Only programmatic focus on dialog open changed.
• External-link interstitial dialog (the "You are leaving gablvm.org" modal that appears when you click an off-site link): same fix. VoiceOver now opens with focus on the "You are leaving gablvm.org" heading instead of the "Stay on gablvm.org" button, so the explanation and destination URL are read before the user reaches the action buttons.

Technical notes

• Both dialog headings (#location-explain-title and #qibla-location-dialog-title) gained tabindex="-1" so they accept programmatic focus without entering the keyboard tab order.
• The setTimeout(function(){ continueBtn.focus(); }, 100) calls in prayer-times.js and qibla-finder.js were changed to focus the title heading, with the Continue button retained as a fallback if the heading element is not found. The 100-millisecond delay is preserved because Safari iOS VoiceOver still needs that beat to acknowledge the modal state before focus() calls inside the just-opened dialog will reliably land.
• Library versions bumped: prayer_times 2.0 to 2.1, qibla_finder 1.x to 1.1, to bust browser and aggregated-asset caches.
• Cloudflare's anonymous-HTML edge cache was explicitly purged for /prayer-times, /qibla, /qibla-finder, and /islamic-tools after deploy so visitors received the new markup immediately rather than waiting for the one-hour edge TTL to expire.
• External-link interstitial: #gablvm-extlink-title heading gained tabindex="-1"; the setTimeout in extlink-interstitial.js openModal() now targets the title with the cancel button as fallback. The dialog's existing focus-trap selector ([tabindex]:not([tabindex="-1"])) already excludes the heading, so Tab cycling between Continue and Cancel is unchanged. Library version bumped from 1.3 to 1.4 to bust caches.
• One contrib module bump rolled in alongside the fix: drupal/redirect 1.12.0 to 1.13.0 (general maintenance release, no security advisory).

A reader on a wide external monitor (around 1920 pixels or more) reported that the cookie consent banner at the bottom of our pages was rendering one letter per line, making the "We use cookies" message look like a vertical column of characters. We reproduced the bug, traced it to a CSS formula that had been competing with itself at very wide viewport widths, and shipped a fix. The banner now renders horizontally on any screen size from small mobile phones up through 4K displays. No content or wording changed; this was purely a layout fix.

Highlights

• Cookie consent banner text now flows correctly on wide displays (1920 to 3840 pixels). Previously, text on monitors beyond roughly 1900 pixels would collapse into a narrow column and wrap per-character. The banner looked badly broken on large external monitors and 4K displays, though it rendered normally on laptop screens.
• No content or wording changed. This was purely a layout fix.

Technical notes

• The cookie banner wrapper had both max-width: 72rem and a horizontal padding calculated as calc((100vw - 72rem) / 2). That padding formula is meant for full-width containers that center their content via edge padding; on a max-width'd element it eats into the inner box instead. At 2560 pixels viewport the math produced zero or negative content space, forcing every letter onto its own line.
• Fix: replaced the calculated padding with a plain padding: 1.5rem. The outer #sliding-popup handles full width and margin: 0 auto handles centering, so the calc was redundant.
• Theme library version bumped from 2.1.7 to 2.1.8 to bust browser and CDN caches.
• Verified at viewports 320, 480, 768, 1024, 1400, 1600, 1920, 2560, and 3840 pixels.
• Commit d20a80f4 on master.

Tonight we fixed a chain of three browser compatibility bugs that had been quietly breaking the location permission flow on the Prayer Times page for Safari iOS users, especially those who rely on VoiceOver. We also made the whole homepage feel roughly four times faster from a cold start by asking Cloudflare to cache the page at its nearest edge location for anonymous visitors, and added a small handle that lets anyone re-trigger the location dialog on demand (/prayer-times?resetLocation=1) for testing or for revoking an earlier acceptance. None of these changes affect what the site looks like; they are entirely about making existing features work correctly on more devices and load faster for everyone.

Highlights

• The location permission dialog on the Prayer Times page now works end-to-end on Safari iOS 16 and later. Before this release, the dialog either did not appear at all, or appeared but silently failed to trigger Safari's native "Allow location?" prompt after you tapped Continue, or never appeared on the first visit when the server had already filled in an approximate location from your IP address. All three paths are now fixed and tested. The Qibla Finder received the same corresponding fixes.
• The homepage and most other pages now load from Cloudflare's edge cache for anonymous visitors, rather than fetching fresh from our origin server on every request. Measured time-to-first-byte dropped from roughly four hundred and forty milliseconds to roughly one hundred milliseconds on a warm edge hit, which should make the site feel noticeably snappier on repeat visits. Signed-in users (editors) still bypass the cache entirely so they never see stale content, and administrative pages are never cached.
• A new /prayer-times?resetLocation=1 handle lets anyone reset the in-app location acceptance flag and trigger the dialog again. This is useful if you changed your mind after previously granting location, if you want to re-test the dialog flow, or if a bug report ever needs to be reproduced from a clean state. The handle persists as a supported tool; it is not a temporary debug switch.
• VoiceOver behavior on the location dialog is cleaner. The dialog announces its title on open, the body paragraph is reachable by a normal swipe or scroll, and the Continue and No Thanks buttons announce their plain text without re-reading the body paragraph on every focus move. The dialog's VoiceOver focus also lands reliably on Continue when it opens, rather than occasionally landing on Cancel.
• The changelog on the new server now matches the one on the old server. During the hosting migration, the production database and the staging database were carried separately, and a public changelog entry published on one server was not automatically present on the other. This release brings both in sync and establishes a checklist item in the migration playbook.

Technical notes

• Three Safari bugs were fixed in sequence in gablvm_core versions 2.0.2, 2.0.3, and 2.0.4. The 2.0.2 fix removes a navigator.permissions.query call whose behavior changed between iOS 15 and iOS 16 in a way that moved dialog.showModal() outside Safari's required user-gesture task. The 2.0.3 fix reorders onContinue so that navigator.geolocation.getCurrentPosition() fires before dialog.close(), because on Safari iOS dialog.close() consumes the transient user activation that gesture-gated APIs require. The 2.0.4 fix replaces an insufficient URL-parameter heuristic with an explicit localStorage flag as the gate on whether the user has already granted, URL parameters on Prayer Times can come from server-side IP fallback and are not a reliable signal of user intent.
• A final report of "Continue does nothing" was traced to Safari's own saved Location permission being set to Allow at the Website Settings level, which causes Safari to silently grant coordinates without prompting. The code was working as designed in that case. Users who want to re-see the native prompt can change Safari Website Settings for gablvm.org from Allow to Ask. The full incident timeline is published on status.gablvm.org as incident 51.
• VoiceOver hardening in 2.0.5 through 2.0.8 added explicit role="dialog" and aria-modal="true" to the dialog markup, added a 100-millisecond delay before calling focus() on the Continue button so Safari's accessibility tree can sync before the focus lands, removed aria-describedby and verbose aria-label overrides on the dialog body and buttons (VoiceOver was re-reading the body on every button focus move), and added diagnostic logging in both the auto-request path and the button-click path so a user with ?debug=1 can see exactly what the browser returns for each geolocation call.
• The ?resetLocation=1 handle was added in 2.0.5 and hardened in 2.0.6 to strip itself from the URL via history.replaceState() after running, so a browser refresh does not re-trigger the reset and loop the dialog.
• The Cloudflare HTML edge-cache rule is rule six in the existing "Drupal Cache Rules" ruleset on the gablvm.org zone. It matches anonymous visitors (no Drupal session cookie) on non-admin and non-user paths and sets an edge time-to-live of one hour. Drupal already returns a cache-control header that permits caching for one hour on anonymous responses, so this rule honors what Drupal was already asking for; Cloudflare was simply not acting on it before.
• Drupal 11's new asset-delivery path for aggregated JavaScript still returns Cache-Control: no-store, private from origin, which defeats both browser caching and edge caching for the JavaScript bundles even though CSS bundles from the same directory cache correctly. This is visible to performance auditing tools as a penalty on the Add Expires Headers grade; a response-header override shipped in a later release will address it.

Today we moved the GABLVM website to a new hosting provider. The transition was designed to be invisible to visitors: the site stayed reachable throughout the cutover, no visible page served a 404, no tool went offline, and nothing about the site's address or identity changed. Alongside the move, we fixed a small but long-standing accessibility issue on every mailto link across the site, including the [email protected] link on this page. Screen reader users had been hearing an unnamed image announced next to every email address; that icon is now properly hidden from assistive technology while remaining visible to sighted readers. This release also opens a new Quran Tafsir reading page under Islamic Tools: pick a surah and a scholarly commentary, and read verse by verse with Arabic text and an expanded, screen-reader-friendly English translation of the commentary alongside.

Highlights

• The website moved to a new hosting provider on April 22, 2026. Both servers served traffic in parallel during the transition through our existing content delivery network, so the cutover did not require a maintenance window and no visitor should have seen a dropped page. After the move, every tool (Quran Player, Prayer Times, Islamic Calendar, Qibla Finder, blog, contact form, support portal) was re-tested on the new server before the old server was retired.
• The email icon that appeared next to mailto addresses such as [email protected] is now correctly hidden from screen readers. Previously, VoiceOver and other assistive technology announced it as an unnamed image on every email link. This is the same class of fix we shipped in version 2.5 for the external-link icon; it simply had not yet been extended to email and phone icons. The icons remain visible to sighted users.
• Quran Tafsir, a new reading page under the Islamic Tools menu, gives blind and low-vision readers direct access to scholarly verse-by-verse commentary on the Quran. Three English tafsirs are offered at launch: Ma'arif-ul-Quran, Tafsir Ibn Kathir, and Tazkirul Quran. Each is labelled with how much of the Quran that commentary covers, so you can choose with full information. When the same block of commentary covers a run of consecutive verses (classical scholars often comment on a range rather than a single verse), the verses are grouped under one heading so the commentary is read once, not repeated verse by verse. The Arabic text is preserved exactly; the commentary is sanitized to strip visual clutter and demote in-commentary headings so screen-reader rotor navigation remains clean. This feature was built and tested in a hidden experimental URL for several days before being promoted.
• The breadcrumb trail, the row that says Home › [current page] near the top of every page, now behaves correctly on every sub-page. Before this release, the single "Home" entry in the breadcrumb on a sub-page like Quran Player or Prayer Times was rendered as a static, non-clickable label that was also announced by VoiceOver as "current page." A screen reader user who landed in the breadcrumb landmark and tried to click "Home" found that nothing happened. "Home" is now a real link again, and the current page is shown next to it.
• The scheduled database backup ran into a configuration gap on the new server where its target directory did not yet exist. The directory was created with the correct ownership so future scheduled backups write cleanly without administrator intervention.

Technical notes

• The migration moved the production website, the staging site, all Drupal databases, all custom cron jobs, the Let's Encrypt certificate bundle, the live kernel-patching agent, and the self-hosted git remotes to the new VPS. No vhost address or hostname changed from the DNS point of view; the cutover happened behind our Cloudflare tunnel, which ran as a multi-replica setup (old origin and new origin both registered to the same tunnel) until the new origin was fully verified.
• Full git version-control history for both the production and staging sites, totaling roughly five hundred and forty megabytes of commits, was preserved intact. The initial migration archive had excluded version-control metadata to save transfer bytes, which would have silently dropped the entire site's commit history if not caught; a pre-destroy verification pass surfaced this and the history was re-copied separately with correct vhost user ownership.
• Several runtime locations that live outside the website's own folder structure and are easy to miss in vhost-level migrations were explicitly carried over: self-hosted git remotes used by our internal tooling, the Let's Encrypt certificate store, KernelCare registration state, and every system-level scheduled job.
• The accessibility fix for mailto and telephone icons extends the existing cleanup pass in the gablvm_extlink_interstitial behavior to cover svg.mailto and svg.tel in addition to the svg.ext selector it already handled. Library version bumped to 1.3 so the aggregator serves the updated script.
• The scheduled-backup fix created the missing destination folder on the new server with the correct vhost ownership and permissions. The root cause was a class of migration gap, Drupal modules that write outside the web root are not captured by a vhost-level tarball and only reveal themselves when the cron fires on the target. Our internal migration playbook has been updated to include a post-cutover cron run as a mandatory verification step.
• The Quran Tafsir page uses the Quran Foundation public content API on our existing read-only token. Commentary HTML is sanitized at render time, only a small set of inline tags is allowed through, and in-commentary headings are demoted to emphasized paragraphs so they do not compete with the page's own heading structure for VoiceOver's rotor. Repeated commentary across consecutive verses is detected by normalizing the plain-text body and hashing it, then collapsing runs of identical hashes into a single rendered group. The legacy experimental URL permanently redirects to the canonical page, so the link we emailed during the hidden-build phase still resolves.
• The breadcrumb fix reworks two things in the custom theme. First, the breadcrumb template now decides "link versus current-page marker" by whether the item carries a URL, not by its position in the trail, this removes a load-bearing assumption that the last item in the trail was always the current page, which broke on any sub-page where Drupal's default breadcrumb builder returned only the parent chain. Second, a new hook_preprocess_breadcrumb in the theme appends the current page title, with no URL, as the final trail item. Together the two changes let Home (and every other parent link) render as a real anchor while the current page becomes the only item carrying aria-current. Theme version bumped to 2.0.2.
• Per our disclosure policy, we publish the date and category of an infrastructure change of this scope but do not publish the outgoing or incoming provider names in release notes.

This release applies the latest Drupal core patch, taking the site from 11.3.7 to 11.3.8. There is no user-facing change you should notice. Routine maintenance release, published for transparency so you always know when the underlying platform has moved.

Highlights

• The site now runs Drupal 11.3.8, a non-security patch release from the upstream Drupal project. Per our disclosure policy, we publish the date and category of every core update even when there is no security component and no visible change.

Technical notes

• Applied via the standard core update procedure: maintenance mode, local database snapshot, composer update "drupal/core-*" -W, drush updatedb (no pending updates), drush cache:rebuild, maintenance mode off, smoke tests across the seven canonical routes, watchdog error check, Cloudflare edge purge.
• The composer patch on Drupal core re-applied cleanly from the cached patch file without intervention.
• Upgrade scope included drupal/core, drupal/core-recommended, drupal/core-composer-scaffold, drupal/core-project-message, and drupal/core-recipe-unpack. No transitive dependency churn beyond those five packages.

This release resolves a Quran Player issue where the seek bar and skip controls could stop responding after a network interruption, completes a site-wide accessibility sweep that brought every public page back to zero WCAG 2.2 Level AA violations, quiets a browser console warning that was appearing on every page load, and hardens the Prayer Times page against unexpected input. If you were using the Quran Player and the controls felt unresponsive, that is the bug this release fixes.

Highlights

• The Quran Player now preserves playback state when the audio stream is interrupted. Previously, a network hiccup during automatic surah advancement could leave the player in a state where the seek bar and skip buttons did nothing. The player now keeps the current surah playable if the recovery path fails, and shows a clear retry message instead of eating the button press.
• The same recovery fix was applied to the verse-by-verse playback mode, which had the identical bug.
• External-link icons on the Events page, and anywhere else we link to an outside site, are now correctly hidden from screen readers. They were previously announced as an empty image on every link, which was noisy for assistive technology users. The icons remain visible to sighted readers.
• The Prayer Times page now rejects out-of-range calculation method and school values in its URL parameters, falling back to sensible defaults instead of forwarding the input to the upstream prayer-time service.
• A browser console warning about a specific Content Security Policy directive has been silenced. The directive was correctly set, but the browser was noting that it is ignored in the specific CSP mode we use for observability. The directive remains in effect where it has actual effect, and is no longer emitted in the mode where it is a no-op.

Technical notes

• The Quran Player's core surah-load function no longer wipes the audio element sources before the network call. It snapshots the previous playback state, pauses only, and only swaps in a new source when the API response is confirmed. If the fetch fails, the previous surah is restored along with the matching dropdown value, and a retry-oriented status message is displayed.
• The seek-by-seconds function now surfaces a status message when audio is not loaded, instead of silently returning.
• The accessibility sweep used axe-core at WCAG 2.0, 2.1, and 2.2 Level A and AA, on eight public pages: the homepage, Quran Player, Prayer Times, Islamic Calendar, Contact, Events, Qibla Finder, and Newsletter. All eight finished at zero violations.
• The external-link icons are hidden at the behavior level in the existing gablvm extlink interstitial script, which walks svg.ext elements and sets aria-hidden="true" while removing the empty aria-label and the role attribute. Library version bumped so the aggregator serves the updated script.
• One upstream review finding about a theoretical bitwise operation in the IP-ban module was verified against the code and rejected as a false positive. The existing implementation produces correct output for all CIDR mask widths because of how PHP handles character conversion. Similar verification rejected two other upstream findings that did not hold up against the real source.
• The public status page carries incident #48 with the full investigation, identification, monitoring, and resolution timeline for the Quran Player bug.

Two things in this release. First, we applied the latest security update to the platform that runs the website. This was a routine precaution; the site was offline for less than two minutes during the update, and no personal data, content, or account was affected. We have not seen any actual attempts to exploit the underlying issues on our site. Second, we added a disclaimer interstitial for links that take you away from gablvm.org, so that you always have a chance to review where you are about to go before leaving.

Highlights

• Every link on the site that points to an external website now shows a brief disclaimer before you leave. The disclaimer explains that the external site is not operated by GABLVM, gives you the destination URL, and lets you continue or cancel. Links to our own sister domains bypass the disclaimer.
• The underlying Drupal platform was updated to the latest security release. Public details of that release are at drupal.org.
• The site was placed into maintenance mode briefly while the update was installed, then returned to service once the post-update checks passed.
• Automated smoke tests ran against the homepage, the changelog, and every Islamic tool page immediately after the update. Every page responded normally.

Technical notes

• Drupal core and its four related composer packages moved from 11.3.6 to 11.3.7, along with two downstream Symfony polyfill dependencies. No custom module, theme, or configuration code was changed for the security update.
• A database snapshot was taken before the update and stored outside the site directory. Database schema updates were a no-op for this release, and the all-cache rebuild afterward completed cleanly.
• No watchdog errors were written during or after the upgrade window. The existing composer patch on Drupal core was re-applied to the new version automatically.
• The external-link interstitial is a small custom module paired with the contrib extlink module. It tags outbound links, intercepts the click, opens a WCAG-compliant dialog, and opens the destination in a new tab only after explicit confirmation.
• Per our disclosure policy, we document the date, the category, and the impact of security fixes on this page, but we do not publish exact vectors. The upstream advisory is the authoritative source for the technical details.

Two user-facing fixes shipped the same day. First, the status page at status.gablvm.org was incorrectly showing zero percent uptime for the Support Portal and Status Page services, even though both were operating normally. Second, on small mobile phones the cookie notice at the bottom of the page could grow tall enough to cover form fields on the Contact Us and Newsletter pages, making those forms hard to fill out. Both issues are now resolved. No personal data or content was affected by either issue.

Highlights

• The mobile cookie consent banner has been rebuilt to use a compact layout on small screens. Its maximum height is now capped at forty-five percent of the visible viewport, and the page is padded by the same amount so every form field remains reachable by scrolling. The banner continues to work normally on tablet and desktop.
• The site footer has been reorganized into a two-column layout on tablet and desktop displays wider than seven hundred and twenty pixels. Footer navigation sits on the left and the site legal notice on the right, reducing the footer's overall height by roughly twenty percent on pages where the main content is short.
• The monitoring worker behind the status page was redeployed with a correction that had been written the previous day but was not included in the earlier deployment bundle. The monitoring system now correctly skips recording automated health checks for services that are managed manually, which is what was causing the zero-percent display.
• Incorrect historical uptime records for the Support Portal and Status Page services have been removed from the database.

Technical notes

• In the main theme stylesheet, the cookie banner now has a forty-five percent viewport maximum height, and a new rule pads the document body by the same amount when the banner is visible, so the document scroll extends past the fixed-position banner.
• The mobile media query now overrides the flex basis of the cookie banner message block. Without this override, the flex basis of twenty-eight rem was being interpreted as a minimum height when the container flipped to column direction, producing a banner taller than the viewport on phones.
• A new media query turns the footer inner container into a two-column grid at tablet breakpoints and up.
• The support portal worker was rebuilt and redeployed. The previously deployed bundle did not contain the skip logic for services with the manual override flag set, which is why automated uptime history records were still being written for manually-managed services.

This release matched the support portal and status page to the illuminated manuscript look of the main website. The two sites now share the same warm ivory backgrounds, serif headings, green and gold palette, and dark mode support. If you use the support portal or the status page, the visual language should now feel continuous with the rest of gablvm.org.

Highlights

• The public header, navigation, ticket forms, article pages, and status banners on support.gablvm.org were restyled to match the main website.
• The status page at status.gablvm.org received the same visual treatment, including the dark-green page header, gold hairlines, and consistent typography.
• The admin area of the support portal was also refreshed so that staff pages share the look of the rest of the site.
• Status page timestamps were switched to always display in Coordinated Universal Time to avoid ambiguity for visitors in different regions.
• The ninety-day uptime history now ignores a single isolated health-check failure and only records downtime when two consecutive checks fail, preventing transient network blips from distorting the uptime percentage.

Technical notes

• All support portal templates were moved to a shared design-system module that exports the same CSS custom properties used by the main website theme. Future visual adjustments cascade through both sites from a single token source.
• The worker templates use the design tokens via CSS variables rather than hard-coded hex values, so dark mode works without template duplication.
• An inline script identifier conflict that had been causing a browser console warning on the support portal was resolved by wrapping the affected blocks in immediately-invoked function expressions.

This release completed the illuminated manuscript redesign across every remaining page of the website, introduced a proper dark mode with its own dedicated palette, upgraded the underlying platform, and shipped a batch of preventive fixes and polish items that surfaced in a full code audit. Visitors who prefer dark themes now get a dedicated dark version of every page, not just an inverted one. Readers using the Listen to This Article feature on blog posts can change playback speed without the audio stopping and restarting.

Highlights

• The illuminated manuscript aesthetic was extended to the About page, blog article pages, the events listing, and the tool pages that were not already part of the original relaunch.
• Dark mode is now supported end to end with its own dedicated color tokens. Dark mode activates either by operating system preference or by an explicit setting saved on the site. A small header control lets you switch between light, dark, and system preference at any time.
• The Listen to This Article feature now changes playback speed seamlessly without stopping and restarting the audio.
• The site was updated to Drupal 11.3.6, which includes performance optimizations and accessibility improvements from the core framework.
• The blog listing was converted from raw rows into a two-column editorial layout with thin gold hairlines separating posts.
• Article pages use a long-form reading layout with a gold drop cap on the first letter and a comfortable sixty-eight-character reading measure.
• Decorative Roman numerals were removed from the "What We Do" section on the homepage. They were being read aloud by some screen readers alongside the actual heading text, which was redundant.
• The Arabic greeting in the hero section is now properly marked up with a language attribute so that screen readers pronounce it with the correct language.
• The health monitoring behind the status page now requires two consecutive failures before it records downtime, reducing false alerts from momentary network blips.

Technical notes

• Design tokens live in the main theme stylesheet as CSS custom properties. Dark mode overrides are scoped to both the operating system color scheme media query and an explicit data attribute on the root element, so the two triggers produce the same result.
• A small theme toggle library manages the light and dark preference in browser local storage.
• A complete audit across custom modules, controllers, and client-side scripts surfaced eight preventive fixes covering race conditions, error handling, and a Safari-only issue with the location permission dialog.
• The homepage heading element was changed from CSS display none to a visually hidden class so assistive technology announces it correctly.
• Module version strings were set formally for the first time for both custom modules.
• The iOS compass orientation permission prompt, used by the Qibla Finder, was redesigned as a prominent banner at the top of the page for better screen reader discoverability on Safari for iOS.

This was the first full visual relaunch of the website. Every page received a new design inspired by the tradition of illuminated Islamic manuscripts: warm ivory backgrounds, a dark green and warm gold color palette, the Fraunces serif typeface for display text, and Inter for body text. The goal was to make the site feel warm, dignified, and spiritually respectful rather than generic or corporate, while preserving zero WCAG 2.2 Level AA violations across every page.

Highlights

• The homepage was rebuilt as a sequence of full-width editorial sections: a deep forest-green hero with a gold eyebrow label, an ivory mission section, a "What We Do" list, a parchment-toned faith section, a tools directory, and a closing dua section.
• Every heading on the site now uses the Fraunces typeface with optical sizing. Body text uses Inter. These two typefaces together balance warmth with legibility for low-vision readers.
• A new shield logo featuring a crescent and star was introduced.
• The Quran Player, Prayer Times, Islamic Calendar, and new Qibla Finder pages were all restyled with a unified look so each tool feels like part of the same publication.
• Focus indicators across the entire site were redesigned as a three-pixel bright gold outline with an ivory halo. This is visible against every background on the site and meets non-text contrast requirements.
• A new Qibla Finder tool was added, showing the direction to the Kaaba from the visitor's location, with audio guidance support for blind and low-vision users.
• The blog was restructured with categories, an editorial grid layout, breadcrumb navigation, and a new Listen to This Article text-to-speech feature.
• The footer was rebuilt with gold hairlines and small-caps section labels.
• Empty blocks that were being rendered but had no content, such as the unused social media sidebar, were hidden until they have content to show.

Technical notes

• The theme was restructured around a CSS custom properties token system. All colors, fonts, and spacing are defined once at the root level and referenced everywhere else, which is what made the illuminated manuscript refresh manageable.
• The base theme primary color was switched from its default blue to the GABLVM brand green, cascading automatically through navigation, links, buttons, and pagers.
• Several pages that had hard-coded dark theme CSS, including the Qibla Finder and the Prayer Times location dialog, were converted to the light theme to match the rest of the site.
• Ten Drupal and theme bugs were fixed as part of a full code audit, including a timezone edge case for Ramadan event display and a schema issue in the configuration export.

March was an accessibility-first month. We certified the entire site against WCAG 2.2 Level AA with zero violations, added a live YouTube synchronization system so that event livestream status is always accurate, launched a new contact form with categories, added keyboard shortcuts for power users, and refined the Quran Player with an accessible seek bar and screen reader improvements. We also completed a large round of proactive security hardening.

New features

• A YouTube livestream synchronization system was added so that the event status shown on the site always reflects whether a livestream is upcoming, ongoing, or concluded.
• A new accessible contact form with categories was launched, replacing a simpler single-field form.
• Keyboard shortcuts were added across the site for faster navigation by assistive technology users and power users.
• Support portal staff can now edit incident descriptions and timeline updates inline.
• The Quran Player gained an accessible seek bar that is properly announced by VoiceOver, with responsive seeking and correct boundary handling.
• An Islamic calendar disclaimer and admin date override system was introduced to let staff correct the displayed Hijri date when official moon sighting authorities revise their announcements.

Accessibility

• WCAG 2.2 Level AA certification was achieved across the entire site. Every page was scanned with axe-core at multiple viewport sizes and zero violations remain.
• An enterprise accessibility scan pipeline was added so that new pages are automatically audited before going live.
• The Quran Player seek bar and reciter labels, the prayer settings form, and the breadcrumb heading were all reworked based on direct feedback from blind and low-vision users.
• Settings forms were fixed so that screen readers no longer announce the same description twice.

Reliability and performance

• The Prayer Times API caching layer and an N+1 query in the status page were optimized for faster loads.
• The Quran Player and Islamic Calendar API timeouts were tuned across the board to fail fast and retry gracefully.
• The YouTube API was moved behind the GABLVM API proxy at api.gablvm.org, giving it a single place to cache, rate-limit, and monitor. The YouTube endpoint is also authenticated and hidden from the public API listing.
• A Status Page v3 was released with expanded incident history, webhook subscribers, and better uptime history charts.

Security

• A substantial round of proactive security hardening was completed. The details are not published here, but none of these changes were a response to any actual compromise. They were all proactive hardening based on internal and external audits.
• The site-level protection against abusive traffic was expanded to cover additional threat patterns across eight categories.

Bug fixes

• Prayer Times no longer shows the wrong day for visitors in the Western Hemisphere.
• The prayer countdown now advances correctly on phones that go to sleep and wake up, and correctly announces arrival at the next prayer time.
• The Islamic Calendar now uses the visitor's local date rather than the server's date.
• Non-Latin city names entered in Prayer Times settings no longer cause encoding failures.
• The next prayer indicator in Prayer Times is now correct after the Isha prayer.
• The Quran Player no longer fails when switching to the English translation mode.
• The event livestream status indicator no longer shows "Live" with a delay.
• The events page no longer returns a SQL error when sorting by table headers.
• Scheduled tasks that had stopped running are now running again on their proper schedule.

February was the public launch month. The GABLVM website went live with the Quran Player, Prayer Times, the Hijri Calendar, a support portal, and a status page. The month was spent fixing bugs surfaced by real usage and making the tools genuinely accessible to blind and low-vision visitors, which is the whole reason the project exists.

Launch

• The initial public release of the combined website and support portal went live in mid-February.
• The Quran Player launched with multiple reciters, verse-by-verse audio, and optional English translation.
• Prayer Times launched with automatic geolocation, a countdown to the next prayer, and Hijri date display.
• The Islamic Calendar launched with a month view, upcoming observance list, and an admin override for official date corrections.
• The support portal launched with ticketing, articles, status monitoring, and an incidents history view.
• Forty Ramadan 1447 event entries were added, covering Taraweeh and Qiyam events with livestream links.

Bug fixes from real usage

• Accessibility fixes in the prayer times readout for screen readers.
• A fix to a crash in the site-level request filtering middleware that was causing a blank page for some uncached requests.
• The logo image now announces correctly as an image with descriptive alt text.
• A fix to the Islamic Calendar events feature so it respects the selected calculation method.
• A fix to events that were skipping the "Ongoing" state and appearing as already "Past".
• A fix to the ticket reply flow that was returning a 404 for legitimate replies.
• A fix to the status page so it no longer always showed "Operational" regardless of actual service state.

Improvements

• An off-site backup pipeline was added, with automated weekly backup verification and email notifications to staff.
• A weekly automated dependency update job was added to the support portal.
• Cloudflare edge cache auto-purge was added so that content changes are immediately visible without a manual cache clear.
• Inbound emails to the support portal are now decoded correctly when they arrive with quoted-printable encoding, which is common for Gmail replies.
• The admin dashboard was redesigned with clearer statistics and bulk ticket operations.

The beginning. GABLVM's website was created in November 2025, a few months before the public Islamic tools launched in February 2026. This entry records that founding period: the site was built, its core pages and its accessibility statement and policies were written, and the newsletter and first resources went live.

Highlights

• November 19, 2025, the website was created. The first pages went up the same day: Home, About Us, Programs and Services, and Contact Us.
• November 25 to 26, 2025, the foundation of trust and accessibility went in. The Accessibility Statement, Privacy Policy, Terms and Conditions, Code of Conduct, and Cookie Policy were all written and published.
• November 29, 2025, the email newsletter went live and its first issue was sent.
• December 2025, the newsletter began publishing and the first accessible Islamic resource was published.

Technical notes

• These founding dates come from the website's own database records, the creation timestamps preserved on the original content and the first account, which mark the site's start at November 19, 2025. They are not derived from later version control, which began only in 2026 and so does not reflect this earlier history.
• The dedicated Islamic tools (Quran player, prayer times, Hijri calendar) and the regular numbered release history begin with Version 1.0 in February 2026, recorded above.