craftcms/cms

• Improved template resource cache collection by replaying structured HTML stack entries without parsing rendered tags.
• Changed CraftCms\Cms\Auth\Passkeys\Passkeys::verifyPasskey() to return the updated credential record on success.
• Changed GraphQL AST value decoding to use webonyx/graphql-php while preserving Craft-specific query condition validation.
• Improved element queries to retain only explicitly supplied custom-field criteria.
• Improved CraftCms\Cms\Form\FormResolver performance by indexing control paths and node UIDs for membership checks.
• Added CraftCms\Cms\Http\ResponseHeaders and CraftCms\Cms\Support\Facades\ResponseHeaders for accumulating response headers within the current request scope.
• Improved job progress persistence by using an atomic upsert.
• Changed CraftCms\Cms\Support\Json::decode() to use exception-based JSON decoding.
• Changed craft:db:drop-all-tables to use Laravel’s schema API.
• Replaced the asset index lifecycle flags with CraftCms\Cms\Asset\Enums\AssetIndexStatus and explicit status transitions.
• Added CraftCms\Cms\Plugin\Plugin::settingsForm() for defining standard plugin settings pages with the Control Panel Form system. (#19439)
• Removed CraftCms\Cms\Plugin\Plugin::settingsHtml(). settingsForm() should be used instead; Yii-era plugin settings HTML remains supported by craftcms/yii2-adapter. (#19439)
• Safe HTML elements are now allowed within Markdown field layout elements. (#19426)
• Added a slideout system for the Inertia/Vue Control Panel, which renders any CpScreenResponse-based screen as an in-page panel from a normal Inertia response, alongside the existing legacy Craft.CpScreenSlideout. (#19354)
• Added CraftCms\Cms\Http\Responses\CpScreenResponse::screenData(). (#19354)
• Removed the Pane.vue Vue component in favor of the craft-pane web component. (#19398)
• Element edit screens now autosave when the form’s values actually differ from the server’s, rather than whenever a control reports a change.
• Improved structure mutation reliability by representing each pending change as a single immutable operation.
• Improved Project Config change event handler registration by keeping callbacks and ordering metadata together.
• Fixed a bug where Table field column handles became arrays after failed validation.
• Fixed a bug where nested or concurrent searches could overwrite another search’s parser state.
• Fixed a bug where cached user permission trees could become stale after permission changes or be modified by assignability filtering.
• Fixed inconsistent handling of forced-disabled plugin configuration values.
• Fixed a bug where CraftCms\Cms\Edition capability checks could report capabilities from the configured edition rather than the receiver.
• Fixed a bug where throwing validation could run the validation lifecycle twice.
• Fixed a bug where CraftCms\Cms\Element\ElementCollection::with() could pass incompatible element classes into eager loading.
• Fixed a bug where cache options and tags registered via CraftCms\Cms\Utility\Utilities\ClearCaches::add() and addTag() were unavailable as Artisan commands.
• Fixed a JavaScript error that occurred on non-Inertial pages that rendered field layout designers. (#19380)
• Fixed a bug where Yii asset bundles registered with craft\web\View::registerAssetBundle() during plugin initialization were not included in rendered pages. (#19393)
• Fixed a bug where legacy asset bundle dependencies could be rendered after their dependent resources when using craftcms/yii2-adapter. (#19394)
• Fixed an error that occurred when config/craft/app.web.php or config/craft/app.console.php was present.
• Fixed a bug where jobs run on the sync queue could remain marked as reserved after completing. (#19431)
• Fixed a bug where Addresses fields weren’t reading the value posted by the Control Panel form, so removing every address didn’t stick and blank addresses could be created. (#19432)
• Fixed a bug where newly-added Matrix entries and addresses showed a spinner indefinitely in the Inertia/Vue element editor, rather than their fields.
• Fixed a bug where opening an element edit page with a Money field immediately created a provisional draft, before anything had been edited.
• Fixed a bug where the jobprogress table was missing dateCompleted and dateFailed columns for installs that were upgraded from Craft 5.
• Fixed a bug where failed queue jobs were losing their descriptions. (#19444)
• Fixed a bug where queue job details in the Queue Manager utility included “Error” and timestamp values even if they were null.

• Fixed a bug where Yii-style migrations could be required twice. (#19376)
• Fixed a bug where the legacy craft\base\Widget class wasn’t fully implementing CraftCms\Cms\Dashboard\Contracts\WidgetInterface. (#19375)

• Added support for Markdown-based custom Dashboard widgets in the application's resources/widgets/ directory. (#19319)
• Replaced pixelandtonic/imagine with intervention/image for image manipulation.
• Added support for the libvips image driver via the optional intervention/image-driver-vips package.
• Added BMP, HEIC, ICO, JPEG 2000, JPEG XL, and TIFF image transform formats when supported by the active image driver.
• Added support for configuring field layout field instruction positions.
• Added fluent APIs for creating and modifying CraftCms\Cms\FieldLayout\FieldLayout, CraftCms\Cms\FieldLayout\FieldLayoutTab, and field layout elements.
• Changed craft:resave:all to discover registered craft:resave:* Artisan commands directly, rather than relying on a resolving event. (#19270)
• Changed the My Account → Addresses page to a full Inertia/Vue page, rendering nested-element cards from data instead of server-rendered HTML. (#19324)
• Changed CraftCms\Cms\Cp\FormFields::textFromConfig() to accept an optional CraftCms\Cms\Cp\Components\Input instance as a second argument, so callers can build on an existing component instead of always creating a plain Input. (#19323)
• Changed CraftCms\Cms\Search\Events\SearchPerformed to be a readonly, immutable event; its $results and $scores properties can no longer be overridden by listeners. CraftCms\Cms\Search\Events\SearchScoresResolving should be used to override scores instead. (#19308)
• Added CraftCms\Cms\Asset\AssetFileKinds. (#19270)
• Added CraftCms\Cms\Cp\Components\Button::action(), for declarative click actions. (#19324)
• Added CraftCms\Cms\Cp\Components\Button::inherit(). (#19306)
• Added CraftCms\Cms\Cp\Components\InputColor. (#19323)
• Added CraftCms\Cms\Cp\Components\InputPassword. (#19323)
• Added CraftCms\Cms\Cp\Data\NavItem::group(). (#19350)
• Added CraftCms\Cms\Cp\Enums\ButtonVariant. (#19306)
• Added CraftCms\Cms\Cp\FormFields::colorFromConfig(). (#19323)
• Added CraftCms\Cms\Cp\FormFields::passwordFromConfig(), passwordHtml(), and passwordFieldHtml(). (#19323)
• Added CraftCms\Cms\Cp\Html\ElementHtml::elementCardLabelHtml(), elementCardActionsHtml(), elementCardThumbHtml(), and elementCardThumbAlignment(). (#19324)
• Added CraftCms\Cms\Cp\Settings::registerSetting() and registerReadOnlySetting(). (#19270)
• Added CraftCms\Cms\Dashboard\WidgetTypes. (#19270)
• Added CraftCms\Cms\Database\Commands\MigrateCommand::registerMigrator(). (#19270)
• Added CraftCms\Cms\Element\ElementTypes. (#19270)
• Added CraftCms\Cms\Element\NestedElementManager::getCardsData() and getIndexData(). (#19324)
• Added CraftCms\Cms\Field\FieldTypes. (#19270)
• Added CraftCms\Cms\Field\LinkTypes. (#19270)
• Added CraftCms\Cms\Field\NestedEntryFieldTypes. (#19270)
• Added CraftCms\Cms\FieldLayout\NativeFields. (#19270)
• Added CraftCms\Cms\Filesystem\FilesystemTypes. (#19270)
• Added CraftCms\Cms\Gql\GqlArguments. (#19270)
• Added CraftCms\Cms\Gql\GqlDirectives. (#19270)
• Added CraftCms\Cms\Gql\GqlMutations. (#19270)
• Added CraftCms\Cms\Gql\GqlQueries. (#19270)
• Added CraftCms\Cms\Gql\GqlTypes. (#19270)
• Added CraftCms\Cms\Image\ImageTransformers. (#19270)
• Added CraftCms\Cms\Image\Raster::getInterventionImage().
• Added CraftCms\Cms\Plugin\Plugin::$filesystemTypes. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$gqlDirectives. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$gqlMutations. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$gqlQueries. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$gqlTypes. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$linkTypes. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$siteTemplateRoots. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::getCacheOptions(). (#19307)
• Added CraftCms\Cms\Plugin\Plugin::getCacheTags(). (#19307)
• Added CraftCms\Cms\Plugin\Plugin::getNativeFields(). (#19307)
• Added CraftCms\Cms\Plugin\Plugin::getSystemMessages(). (#19307)
• Added CraftCms\Cms\Search\Events\SearchResultsResolving. (#19308)
• Added CraftCms\Cms\Search\Events\SearchScoresResolving. (#19308)
• Added CraftCms\Cms\Support\Facades\AuthMethods. (#19270)
• Added CraftCms\Cms\SystemMessage\SystemMessages::register(). (#19270)
• Added CraftCms\Cms\Twig\Variables\Cp::color() and password(). (#19323)
• Added CraftCms\Cms\User\UserPermissions::registerPermissionGroup(). (#19270)
• Added CraftCms\Cms\Utility\Utilities\ClearCaches::add() and addTag(). (#19270)
• Added CraftCms\Cms\Utility\UtilityTypes. (#19270)
• Added CraftCms\Cms\View\TemplateCacheCollectors. (#19270)
• Added CraftCms\Cms\View\TemplateRoots. (#19270)
• Removed CraftCms\Cms\Support\Concerns\EvaluatesClosures and support for closure values in fluent CP component and field layout builder APIs.
• Changed CraftCms\Cms\FieldLayout\LayoutElements\BaseField::label() to accept an optional label and return the field layout element when one is passed. Overrides must accept the new optional argument.
• Changed CraftCms\Cms\Image\Raster::getTextBox() to return a width and height array.
• Renamed the protected CraftCms\Cms\FieldLayout\LayoutElements\BaseField::instructions(), tip(), and warning() methods to instructionsText(), tipText(), and warningText().
• Removed CraftCms\Cms\Asset\Events\AssetFileKindsResolving. CraftCms\Cms\Asset\AssetFileKinds::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Auth\Events\AuthMethodsResolving. CraftCms\Cms\Auth\AuthMethods::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Cp\Events\RegisterCpSettings and CraftCms\Cms\Cp\Events\RegisterReadonlyCpSettings. CraftCms\Cms\Cp\Settings::registerSetting() and registerReadOnlySetting() should be used instead. (#19270)
• Removed CraftCms\Cms\Dashboard\Events\WidgetTypesResolving. CraftCms\Cms\Dashboard\WidgetTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Database\Events\MigratorsResolving. CraftCms\Cms\Database\Commands\MigrateCommand::registerMigrator() should be used instead. (#19270)
• Removed CraftCms\Cms\Element\Events\ElementResaveCommandsResolving. A normal Artisan command in the craft:resave namespace should be registered instead. (#19270)
• Removed CraftCms\Cms\Element\Events\ElementTypesResolving. CraftCms\Cms\Element\ElementTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Field\Events\FieldTypesResolving. CraftCms\Cms\Field\FieldTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Field\Events\LinkTypesResolving. CraftCms\Cms\Field\LinkTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Field\Events\NestedEntryFieldTypesResolving. CraftCms\Cms\Field\NestedEntryFieldTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\FieldLayout\Events\NativeFieldsResolving. CraftCms\Cms\FieldLayout\NativeFields::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Filesystem\Events\FilesystemTypesResolving. CraftCms\Cms\Filesystem\FilesystemTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlArgumentHandlersResolving. CraftCms\Cms\Gql\GqlArguments::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlDirectivesResolving. CraftCms\Cms\Gql\GqlDirectives::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlMutationsResolving. CraftCms\Cms\Gql\GqlMutations::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlQueriesResolving. CraftCms\Cms\Gql\GqlQueries::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlTypesResolving. CraftCms\Cms\Gql\GqlTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Image\Events\ImageTransformersResolving. CraftCms\Cms\Image\ImageTransformers::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Image\Images::MINIMUM_IMAGICK_VERSION and craft\services\Images::MINIMUM_IMAGICK_VERSION.
• Removed CraftCms\Cms\Image\Raster::getImagineImage().
• Removed CraftCms\Cms\Search\Events\ScoringResults in favor of the following new events: (#19308)
  • CraftCms\Cms\Search\Events\SearchResultsResolving
  • CraftCms\Cms\Search\Events\SearchScoresResolving
• Removed CraftCms\Cms\SystemMessage\Events\SystemMessagesResolving. CraftCms\Cms\SystemMessage\SystemMessages::register() should be used instead. (#19270)
• Removed CraftCms\Cms\User\Events\UserPermissionsResolving. CraftCms\Cms\User\UserPermissions::registerPermissionGroup() should be used instead. (#19270)
• Removed CraftCms\Cms\Utility\Events\ClearCachesOptionsResolving and CraftCms\Cms\Utility\Events\ClearCachesTagOptionsResolving. CraftCms\Cms\Utility\Utilities\ClearCaches::add() and addTag() should be used instead. (#19270)
• Removed CraftCms\Cms\Utility\Events\UtilitiesResolving. CraftCms\Cms\Utility\UtilityTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\View\Events\CpTemplateRootsResolving and CraftCms\Cms\View\Events\SiteTemplateRootsResolving. CraftCms\Cms\View\TemplateRoots::register() should be used instead. (#19270)
• Removed CraftCms\Cms\View\Events\TemplateCacheCollectorsResolving. CraftCms\Cms\View\TemplateCacheCollectors::register() should be used instead. (#19270)
• Added the @craftcms/ui/factory module, a jQuery-free layer of typed element factories that mirror the src/Cp/Components PHP builders. (#19323)
• Added createTextInput() and createCopyTextPrompt() to the @craftcms/ui/factory module. (#19333)
• Added turnOn(), turnOff(), and turnIndeterminate() methods to the <craft-switch> web component. (#19323)
• Added a group property to the <craft-nav-item> web component, for rendering a subnav as a non-collapsible semantic grouping. (#19350)
• Added Garnish.CustomSelect and Garnish.MenuBtn to @craftcms/garnish, jQuery-free TypeScript ports of the legacy floating listbox menu and menu-button classes. (#19352)
• Moved the Craft.ComponentSelectInput control panel JavaScript class out of the core bundle into a yii2-adapter compatibility asset, since <craft-component-select> is now used everywhere in core; the componentSelect.twig jsClass escape hatch still works for plugin subclasses. (#19333)
• Moved the Craft.AssetMover, Craft.AssetSelectorModal, Craft.BaseElementSelectInput, Craft.BaseElementSelectorModal, Craft.BaseUploader, Craft.Chart, Craft.CpModal, Craft.CustomizeSourcesModal, Craft.DataTableSorter, Craft.ElementActionTrigger, Craft.ElementDeletionManager, Craft.ElementTableSorter, Craft.EntrySelectInput, Craft.Grid, Craft.PreviewFileModal, Craft.Tabs, Craft.TagSelectInput, Craft.Uploader, and Craft.VolumeFolderSelectorModal control panel JavaScript classes from the legacy jQuery bundle to TypeScript modules. (#19352)
• Changed <craft-nav-item> to render as a <span> instead of an <a> when it has no href, dropping aria-current in that case. (#19350)
• Changed element index table rows and cards so clicking anywhere on them (other than an interactive control) selects them, extending the selection range on shift-click just like clicking a row’s checkbox. (#19351)
• Deprecated the Craft.LightSwitch, Craft.InfoIcon, Craft.ColorInput, Craft.PasswordInput, Craft.IconPicker, Craft.SlidePicker, Craft.SlideRuleInput, and Craft.Tooltip control panel JavaScript classes, along with the .infoicon jQuery plugin. The corresponding @craftcms/ui web components should be used instead. (#19323)
• Removed the Craft.Accordion and Craft.EnvVarGenerator control panel JavaScript classes. (#19323)
• Removed the Craft.DeleteUserModal control panel JavaScript class. It was deprecated in 5.10.0 and unused. (#19352)
• Fixed a bug where Blade templates rendered through Craft used path-based view names, preventing named Laravel view composers from running. (#19177)
• Fixed a bug where the accent semantic color used by colorable elements (e.g. craft-callout, [data-color]) rendered red instead of blue, due to a drifted color mapping in @craftcms/ui. (#19306)
• Fixed a styling issue. (#19296)
• Fixed a bug where Yii adapter plugins could cause legacy Control Panel assets to be omitted. (#19302)
• Fixed a bug where assets’ Alternative Text values could not be cleared. (#19310)
• Fixed a bug where element deletion confirmation dialogs could display unresolved pluralization syntax. (#19311)
• Fixed a bug where replacing an asset would fail silently. (#19312)
• Fixed JavaScript errors that could occur throughout the control panel. (#19313)
• Fixed a bug where forms.checkboxField() and CraftCms\Cms\Cp\FormFields::checkboxFieldHtml() rendered an empty field. (#19338)
• Fixed a bug where Utility pages weren’t rendering, and were logging $ is not defined and window.Cp.config is not a function errors to the console. (#19340)
• Fixed a bug where actionClient requests for bare action paths could corrupt the ?site= query string on multi-site installs. (#19342)
• Craft.cp.announce() now accepts live regions that are plain elements as well as jQuery collections. (#19340)

• Plugins should no longer define extra.laravel.providers in composer.json. (#19263)
• Removed automatic plugin trait lifecycle hooks. (#19263)
• Added CraftCms\Cms\Cp\Components\Button. (#19248)
• Added CraftCms\Cms\Cp\Components\ButtonGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\Callout. (#19248)
• Added CraftCms\Cms\Cp\Components\Checkbox. (#19248)
• Added CraftCms\Cms\Cp\Components\CheckboxGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\CheckboxSelect. (#19248)
• Added CraftCms\Cms\Cp\Components\ChoiceGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\ComponentRegistry. (#19248)
• Added CraftCms\Cms\Cp\Components\Field. (#19248)
• Added CraftCms\Cms\Cp\Components\FieldGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\Lightswitch. (#19248)
• Added CraftCms\Cms\Cp\Components\Radio. (#19248)
• Added CraftCms\Cms\Cp\Components\RadioGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\ViewComponent. (#19248)
• Added CraftCms\Cms\Cp\Concerns\EvaluatesClosures. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasAppearance. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasDisabled. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasId. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasSize. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasVariant. (#19248)
• Added CraftCms\Cms\Cp\Enums\Appearance. (#19248)
• Added CraftCms\Cms\Cp\Enums\Size. (#19248)
• Added CraftCms\Cms\Cp\Enums\Variant. (#19248)
• Added CraftCms\Cms\Cp\FormFields::buttonFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::buttonGroupFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::checkboxFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::checkboxGroupFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::checkboxSelectFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::lightswitchFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::radioFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::radioGroupFieldHtml(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::radioGroupFromConfig(). (#19248)
• Added CraftCms\Cms\Support\Facades\Template. (#19290)
• Added CraftCms\Cms\Twig\Contracts\TwigRendererInterface. (#19290)
• Added CraftCms\Cms\Twig\Variables\Cp::button(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::buttonGroup(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::checkbox(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::checkboxGroup(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::checkboxSelect(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::lightswitch(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::radio(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::radioGroup(). (#19248)
• Added CraftCms\Cms\ui(). (#19248)
• Added CraftCms\Cms\View\TemplateManager. (#19290)
• template() and pageTemplate() now accept an optional template renderer name. (#19290)
• TemplateRendered and PageTemplateRendered events now expose the final renderer name via $rendererName; the corresponding before events no longer expose renderer identity. (#19290)
• Replaced CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizers with CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizerManager. HTML sanitizers should now be registered via CraftCms\Cms\Support\Facades\HtmlSanitizers::extend() rather than CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizers::register(). (#19292)
• Removed CraftCms\Cms\Plugin\Events\PluginUnregistered. (#19263)
• Removed CraftCms\Cms\Plugin\Plugin::bootPlugin(). boot() should be used instead. (#19263)
• Removed CraftCms\Cms\Plugin\Plugin::registerPlugin(). register() should be used instead. (#19263)
• Fixed a bug where the legacy yii\web\JqueryAsset wasn’t resolving properly. (#19264)
• Fixed a bug where bulk entry moves could assign entries to sections that didn’t support their entry types. (#19267)
• Fixed a bug where queued resaves ignored offset and limit criteria or accepted non-positive batch sizes. (#19271)
• Fixed a bug where failed password and passkey login attempts incremented invalid-login counters twice. (#19283)
• Fixed bugs that could prevent authored content from being deleted or reassigned safely when deleting users. (#19273)
• Fixed an issue where disabled and archived user accounts could still authenticate. (#19265)
• Fixed a bug where one-time two-factor authentication credentials could be accepted by concurrent login attempts. (#19282)
• Fixed issues with craft:users:set-password password validation, exit statuses, and session invalidation. (#19272)
• Fixed a bug where selected GraphQL mutations could be mistaken for cacheable queries. (#19284)
• Fixed a high-severity authorization bypass vulnerability.
• Fixed a bug where two-factor authentication could lose login state or verify the wrong user during impersonation. (#19274)
• Fixed a bug where new Matrix blocks weren’t getting created. (#19161)

• Fixed a bug where entries could deadlock when saving their authors. (#15768)
• Fixed an error that could occur when upgrading to Craft 5. (craftcms/commerce#4309)
• Fixed a bug where overridden entry type handles weren’t being prioritized when rendering partial templates. (#18968)
• Fixed high-severity RCE vulnerabilities. (GHSA-5m2g-hhqr-84pc, GHSA-vfcw-xv8p-8rj2)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-4wfw-q5w3-jh42)
• Fixed a low-severity XSS vulnerability. (GHSA-w5rh-mhxj-wr8r)
• Fixed a low-severity information disclosure vulnerability. (GHSA-j5wg-m2pr-35qc)

• Fixed a bug where entries could deadlock when saving their authors. (#15768)
• Fixed an error that could occur when upgrading to Craft 5. (craftcms/commerce#4309)
• Fixed a bug where overridden entry type handles weren’t being prioritized when rendering partial templates. (#18968)
• Fixed high-severity RCE vulnerabilities. (GHSA-5m2g-hhqr-84pc, GHSA-vfcw-xv8p-8rj2)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-4wfw-q5w3-jh42)
• Fixed a low-severity XSS vulnerability. (GHSA-w5rh-mhxj-wr8r)
• Fixed a low-severity information disclosure vulnerability. (GHSA-j5wg-m2pr-35qc)

• Added craft\helpers\StringHelper::isMd5().
• Fixed a bug where image transforms could be generated from a stale locally-cached copy of an asset’s source file, after the file was replaced on a non-local filesystem. (#19328)
• Fixed a bug where warnings were getting logged for SSO attributes that mapped to native user properties. (#19294)
• Fixed an error that could occur when applying a draft. (#19277)
• Fixed an error that could occur when running project-config/apply --force. (#19300)
• Fixed a bug where compiled templates could be missing the injected {{ head() }}, {{ beginBody() }}, or {{ endBody() }} tags. (#19304)
• Fixed an error that could occur when listing an element without a slug in an element index.
• Fixed a bug where Matrix and Addresses fields could have empty field action menus. (#19355)
• Fixed a bug where success/failure notifications weren’t being shown after deleting elements. (#19028)
• Fixed high-severity RCE vulnerabilities. (GHSA-5jmw-g85v-7jv2, GHSA-9c4j-cjw3-r3xx, GHSA-5r92-75j8-c534)
• Fixed a high-severity information disclosure vulnerability. (GHSA-4mgp-5vf2-7c9m)
• Fixed a moderate-severity information disclosure vulnerability. (GHSA-hfjh-gw6x-7pv5)
• Fixed a low-severity XSS vulnerability. (GHSA-h9jh-v8vc-m5rp)
• Fixed a low-severity authorization bypass vulnerability. (GHSA-6fp2-8j9w-7mj8)

• Added craft\helpers\StringHelper::isMd5().
• Fixed a bug where image transforms could be generated from a stale locally-cached copy of an asset’s source file, after the file was replaced on a non-local filesystem. (#19328)
• Fixed a bug where warnings were getting logged for SSO attributes that mapped to native user properties. (#19294)
• Fixed an error that could occur when applying a draft. (#19277)
• Fixed an error that could occur when running project-config/apply --force. (#19300)
• Fixed a bug where compiled templates could be missing the injected {{ head() }}, {{ beginBody() }}, or {{ endBody() }} tags. (#19304)
• Fixed an error that could occur when listing an element without a slug in an element index.
• Fixed a bug where Matrix and Addresses fields could have empty field action menus. (#19355)
• Fixed a bug where success/failure notifications weren’t being shown after deleting elements. (#19028)
• Fixed high-severity RCE vulnerabilities. (GHSA-5jmw-g85v-7jv2, GHSA-9c4j-cjw3-r3xx, GHSA-5r92-75j8-c534)
• Fixed a high-severity information disclosure vulnerability. (GHSA-4mgp-5vf2-7c9m)
• Fixed a moderate-severity information disclosure vulnerability. (GHSA-hfjh-gw6x-7pv5)
• Fixed a low-severity XSS vulnerability. (GHSA-h9jh-v8vc-m5rp)
• Fixed a low-severity authorization bypass vulnerability. (GHSA-6fp2-8j9w-7mj8)

• Added craft\helpers\Gql::isMutation(). (#19285)
• Fixed an error that could occur when saving an element with an eager-loaded relation field value. (#19280)
• Fixed a bug where bulk entry moves could assign entries to sections that didn’t support their entry types. (#19268)
• Fixed a bug where admin tables’ action buttons could fire when rendering. (#19255)
• Fixed an error that occurred when using the null-safe operator in a Twig template. (#19279)
• Fixed a bug where GraphQL mutation queries could be cached. (#19285)
• Fixed a bug where custom element index pages were getting included in the control panel navigation, even if they only contained sources that the current user didn’t have access to. (#19289)
• Fixed high-severity RCE vulnerabilities. (GHSA-9wcj-wqqh-cqvg, GHSA-qj4v-m29p-fj4m)
• Fixed a moderate-severity permission escalation vulnerability. (GHSA-jqf5-vfg6-8cx5)
• Fixed a low-severity information disclosure vulnerability. (GHSA-5mjc-jqcw-6vrp)

• Added craft\gql\base\MutationResolver::requireAllowedSite().
• Fixed a bug where JSON fields weren’t JSON-decoding values saved via GraphQL mutations. (#19230)
• Fixed an error that could occur when reassigning entries to a new author when deleting a user. (#19154)
• Fixed a bug where craft\web\twig\variables\CraftVariable::$rebrand was getting defined for Craft Team installs. (#19249)
• Fixed a bug where “All entries” and “All users” sources could be listed above other sources in relation field settings. (#19185)
• Fixed high-severity authorization bypass vulnerabilities. (GHSA-6qw4-cjqw-fj72, GHSA-3wcr-p33w-528f)
• Fixed moderate-severity authorization bypass vulnerabilities. (GHSA-329j-cx85-8r56, GHSA-4w9w-3x96-7ghp, GHSA-2f55-h4xr-92p2, GHSA-242m-9wq7-vhwq, GHSA-9xvf-7w97-83mv, GHSA-ccpq-mw3m-wwg2)
• Fixed a moderate-severity permission escalation vulnerability. (GHSA-5fh8-74j8-mvcp)
• Fixed low-severity XSS vulnerabilities. (GHSA-5fjj-496j-2qqf)
• Fixed a low-severity authorization bypass vulnerability. (GHSA-5mjc-jqcw-6vrp)

• Updated web-auth/webauthn-lib to 5.3. (#19226)
• Fixed an error that could occur when running CLI commands. (#19030)

• Added craft\services\Security::isRestrictedDir(). (#19179)
• craft\helpers\Image::imageSizeByStream() now supports WebP, AVIF, and HEIC/HEIF images. (#19189)
• craft\services\Sites::getGroupById() now has a $withTrashed argument.
• Fixed a bug where the site/siteId params weren’t being respected on eager-loaded localized queries. (#18588)
• Fixed a bug where it wasn’t possible to enter decimal values after tabbing into a Money field. (#19156)
• Fixed a bug where the search inputs on the Entry Types and Fields settings index pages were case-sensitive on PostgreSQL. (#19158)
• Fixed a bug where timepicker menus weren’t auto-scrolling to the selected time when opened. (#19142)
• Fixed an error that could occur when reassigning entries to a new author when deleting a user. (#19154)
• Fixed a bug where the “All entries” and “All users” sources weren’t available to be selected within Entries/Users field settings. (#19185)
• Fixed a bug where database backups weren’t using the --single-transaction flag on MariaDB. (#19191)
• Fixed a bug where element indexes could show multiple table columns for the same nested fields within Content Block fields. (#19197)
• Fixed a PHP error that could occur when merging canonical changes into a draft that contained nested elements. (#19187)
• Fixed an error that could occur when applying project config changes, if a site group was deleted. (#19076)
• Fixed an error that could occur when nested Matrix entries were copied. (#19195)
• Fixed a bug where project config YAML files could include component name comments with trailing whitespace. (#19198)
• Fixed a low-severity information disclosure vulnerability.
• Fixed a low-severity cache poisoning vulnerability.

• Fixed a bug where element thumbnails could have inconsistent rounded corners. (#19117)
• Fixed a bug where video file uploads could cause a timeout or exhaust the memory limit. (#19131)
• Fixed an error that occurred if a custom source had a condition rule that referenced a field instance that no longer existed. (#19132)
• Fixed a bug where the relation deletion blocker’s messages weren’t always properly capitalized. (#19133)
• Fixed a bug where the “Delete” button within element deletion blocker modals wasn’t getting translated properly. (#19134)
• Fixed a bug where the previewTokenDuration config setting was defaulting to 1 day, rather than to the defaultTokenDuration value. (#18550)
• Fixed a bug where nested elements weren’t showing validation errors. (#19147)
• Fixed a bug where error summaries weren’t properly linking to their corresponding fields’ error lists. (#19147)
• Fixed a low-severity XSS vulnerability. (GHSA-2rp4-x2j7-qmcc)
• Fixed a high-severity authorization bypass vulnerability. (GHSA-p8x7-9vfw-p7vc)

• Added craft\web\twig\AllowableInSandbox.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t resolving aliases for environment variables that referenced an alias (e.g. @root/storage/rebrand). (#19108)
• Fixed a bug where the “Parent” field on Structure entries’ edit pages wasn’t showing the parent entry if it didn’t exist for the same site being edited, causing the parent relationship to be lost on save. (#19110)
• Fixed a high-severity RCE vulnerability. (GHSA-f5wm-88jv-g5hx)

• Forward slashes in query strings are now encoded. (#19057)
• Added craft\controllers\EVENT_BEFORE_SAVE_IMAGE. (#19068)
• Added craft\events\SaveAssetImageEvent. (#19068)
• Added craft\web\Request::getPreviewParam().
• Updated Axios to 1.17.0. (#19053)
• Fixed a bug where no-cache and X-Robots-Tag: none headers weren’t always being sent for requests with x-craft-preview or x-craft-live-preview query string params. (#19060)
• Fixed a bug where the “Delete” element edit page action wasn’t working properly when editing a provisional draft.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t returning boolean values for environment variable names that resolved to true/false values. (#19029)
• Fixed a bug where the submit button within Live Preview was labelled “Submit” rather than “Save”. (#19056)
• Fixed a bug where the selected site wasn’t being remembered after saving an element. (#19054)
• Fixed a bug where transformed SVG images could have two sets of width and height attributes. (#1902w7)
• Fixed an infinite recursion bug. (#19063)
• Fixed a JavaScript error that could occur if there was an error rendering an element condition rule’s Twig template.
• Fixed a bug where relational fields’ element selector modals weren’t showing any results if they were configured to only relate to elements in a specific site, and the author didn’t have permission to access that site. (#19078)
• Fixed a bug where element cards were showing preview values for conditionally-hidden fields. (#19064)
• Fixed a bug where some bulk element actions could exhaust the memory limit on large selections. (#19070)
• Fixed a SQL error that could occur when uploading an asset, if it contained non-UTF-8 alt text in its metadata. (#19069)
• Fixed an error that could occur when editing an entry if a soft-deleted user had recently edited the same entry. (#19081)
• Fixed a PHP error that occurred when setting general config settings via config/general.console.php or config/general.web.php. (#19083)
• Fixed a bug where address cards would show “0, 0” for Longitude/Latitude values when neither field had been populated. (#19093)
• Fixed a bug where field conditions within Matrix blocks weren’t always working when editing the owner element in a slideout. (#19084)
• Fixed a bug where verification code inputs weren’t always getting autofilled by password managers. (#19094)
• Fixed a bug where the “Use defaults” button in element index view menus wasn’t being shown automatically after a column header was pressed on. (#19101)
• Fixed a styling issue.
• Fixed high-severity RCE vulnerabilities. (GHSA-f5wm-88jv-g5hx, GHSA-265m-7826-wjqm)
• Fixed a high-severity information disclosure vulnerability. (GHSA-596p-6jv8-775v)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-xxpx-f366-4xpq)
• Fixed a moderate-severity SSRF vulnerability. (GHSA-2mx8-9ww7-p27x)
• Fixed a low-severity information disclosure vulnerability. (GHSA-957r-qf9p-67xw)
• Fixed a low-severity potential path traversal vulnerability. (GHSA-7hxc-f267-h5q7)

• Added craft\base\ElementInterface::afterAssignedId().
• Fixed an error that occurred when executing the users/remove-2fa command non-interactively, if --method wasn’t provided. (#18724)
• Fixed a bug where Link fields weren’t getting updated when the “Replace relations” element deletion option was chosen. (#18992)
• Fixed a bug where it wasn’t always possible to select new categories or entries in relation fields. (#18976)
• Fixed a bug where Checkboxes and Multi-select fields weren’t handling :empty:/:notempty: params properly. (#18988, #19019)
• Fixed a bug where entries with {id} in their Default Title Format weren’t always getting created with the correct generated title. (#18991)
• Fixed an infinite recursion bug that could occur when rendering sandboxed Twig templates. (#19004)
• Fixed a styling issue. (#19010)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-wg23-69c2-gjc8)
• Fixed a low-severity object injection vulnerability.

• Updated Twig to 3.27. (#18980)
• Fixed a bug where an empty storage/runtime/ directory was getting created even if runtimePath was being overridden in config/app.php. (#18936)
• Fixed a bug where overridden entry type handles weren’t being respected when rendering partial templates. (#18968)
• Fixed an error that could occur when opening an element slideout. (#18957)
• Fixed a bug where HTML Purifier was stripping out IDs and ID references that included characters that weren’t allowed pre-HTML5. (#18971)

• Reduced the number of database queries executed when eager-loading nested entries or addresses. (#18929)
• Reduced the number of database queries executed when loading image transforms. (#18929)
• Deprecated craft\services\Path::getRuntimePath(). Craft::$app->getRuntimePath() should be called instead.
• Fixed a bug where Single section entries weren’t initially saved with a post date. (#18931)
• Fixed a bug where overriding the runtime path via config/app.php wasn’t possible. (#18936)
• Fixed a bug where pasted nested entries within Matrix fields in Blocks view weren’t always getting fully initialized. (#18912)
• Fixed a bug where collapsed Matrix blocks were getting “Entry [ID]” preview values if their entry type didn’t have a UI Label. (#18484)
• Fixed a bug where nested elements could be deleted when reverting content from a revision. (#18950)
• Fixed a styling issue.
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-rvmm-v933-jgxq)
• Fixed a low-severity authorization bypass vulnerability. (GHSA-9p7c-v5x3-rfx8)

• Updated Twig to 3.26. (#18924, #18926)
• Fixed a bug where editable tables registered unexpected debug toolbar output. (#18895, #18902)
• Fixed a JavaScript error that occurred when pasting nested entries within Matrix fields in Blocks view. (#18912)
• Fixed an error that could occur when editing elements on Apache servers. (#18923)

• Fixed a bug where assets’ Alternative Text values weren’t always being set when replacing an existing asset’s file. (#18713)
• Fixed a bug where element indexes had horizontal scroll bars while loading. (#18870)
• Fixed a bug where elements selected by Link fields weren’t getting replaced with their localized versions when propagating content for newly-created elements to other sites. (#18743)
• Fixed a bug where it wasn’t possible to replace the selected element within Link fields with a localized version of the same element. (#18873)
• Fixed a bug where nested entries weren’t getting their Post Date values set. (#18872)
• Fixed a bug where it was difficult to interact with element source paths within element selector modals. (#18876)

Content Management

• Collapsed Matrix blocks now show their entries’ UI labels as preview text, whenever possible. (#18484)
• Element-level actions within nested element management fields (Matrix, Addresses, etc.) now consistently affect all selected elements, when performed on a selected element. (#18561)
• Elements within Matrix and Addresses fields now have “Paste above” actions when a compatible element is copied. (#17406)
• Elements now keep track of the index page’s URL their edit page was linked to from, and explicitly redirect back to that page after save, rather than always redirecting to the referrer. (#18680)
• Addresses fields now have a “Copy all addresses” field-level action. (#18561)
• Matrix fields’ “Expand”, “Collapse”, and “Copy” field-level actions now always affect all nested entries, regardless of whether any entries are selected. (#18561)
• Matrix fields no longer have “Duplicate” and “Delete” field-level actions. (#18561)
• Number fields now show their selected currency beside their input, if their Preview Format setting is set to “As currency values”. (#18498)
• Color field previews are now blank for fields without a value. (#18614)
• Text condition rules now have “does not equal”, “is one of” and “is not one of” operators.
• Numeric condition rules now have “is one of” and “is not one of” operators. (#18734)
• Editable table columns now set min-width styles based on their configured widths, if set. (#18534)
• Entry post dates are no longer automatically set until the entry is fully saved as enabled. (#18642)
• Element edit screens now have a “Save as a new draft” action when editing an explicitly-created draft. (#18722)
• Address edit screens now have “Field settings” action menu items. (#18544)
• Asset edit screens now have “Volume settings” and “Filesystem settings” action menu items. (#18544)
• Entries’ “Entry type settings” and “Section settings” action menu items are now only shown for element edit screens’ primary action menus.
• Category indexes can now have “Group” columns. (#18553)
• Element slideouts now automatically refresh when the same element is updated in another tab/slideout. (#18625)
• Added the “Time Zone” user preference. (#8518)
• Element indexes now automatically refresh after duplicating elements and the queue is completed, if there’s an active search term. (#18636)
• Timestamps in the control panel now include their time zone abbreviation. (#18639)
• Generated field values are no longer truncated within element cards. (#18646)
• Assets’ Alternative Text values are now automatically set on upload, based on descriptive text data found in the uploaded file’s metadata. (#18744)
• When deleting elements, a modal window is now shown alerting the user of any potential issues, such as existing relationships. (#18728)
• “Verification Code” and “Recovery Code” forms no longer get auto-submitted when entering a value.
• Number columns within Table fields are now formatted according to the user’s preferred formatting locale. (#18823)

Administration

• It’s now possible to replace the selected custom field for existing field layout elements. (#18814)
• Sections now have a “Min Authors” setting. (#18662)
• Time fields’ “Max Time” settings can now be set to an earlier time than “Min Time”, for overnight time ranges. (#18575)
• Component chips within component select inputs now have “Replace” actions.
• Newlines in system message bodies are now replaced with <br> tags. (#18058)
• Added the --to-default option to resave commands. (#18522)
• Added the --method option to the users/remove-2fa command. (#18732)

Development

• Added the heading()/h() and h1()…h6() Twig functions. (#18524)
• The tag() Twig function now accepts a string for its second argument. (#18524)
• The |attr, |parseAttr, and |removeClass Twig filters no longer log warnings when performed on a string without an HTML tag. (#17622)
• The |default Twig filter and is empty Twig test now treat all yii\base\Model instances as not empty. (#18727)
• The |number Twig filter now has a locale argument. (#18823)
• The |time and |datetime Twig filters now have withTimeZone arguments. (#18639)
• The |timestamp Twig filter now returns the current time, if applied to a null/empty string value. (#18642)
• dataUrl() is no longer allowed in sandboxed Twig environments by default.
• delete GraphQL queries now have a hardDelete argument. (#18511)
• Entry postDate values are now null on creation, rather than set to the dateCreated value. (#18642)
• Assets’ url GraphQL fields’ immediately arguments are no longer deprecated. (#18581)
• JSON fields now support array values in POST data. (#18705)
• Added craft\filters\SecFetchSiteFilter for request origin verification. (#18641)
• craft\fields\data\LinkData::getUrl() now has an $anyStatus argument, which can be set to false to prevent a value from being returned if a disabled/pending/expired element is linked. (#18527)
• Markdown parsing now respects the first number of ordered lists. (#18671)

Extensibility

• Added craft\base\DefaultableFieldInterface. (#18522)
• Added craft\base\Element::EVENT_DEFINE_DELETION_BLOCKERS. (#18728)
• Added craft\base\ElementActionInterface::getTriggerId().
• Added craft\base\ElementInterface::deletionBlockers(). (#18728)
• Added craft\base\ElementInterface::setDirtyFieldTracking().
• Added craft\elements\PopulateElementEvent::$content.
• Added craft\elements\db\ElementQuery::$activeQuery.
• Added craft\elements\db\ElementQueryInterface::collectIds().
• Added craft\elements\deletionblockers\BaseDeletionBlocker. (#18728)
• Added craft\elements\deletionblockers\DeletionBlockerInterface. (#18728)
• Added craft\elements\deletionblockers\EntryAuthorsBlocker. (#18728)
• Added craft\elements\deletionblockers\RelationDeletionBlocker. (#18728)
• Added craft\errors\FieldNotFoundException::$fieldId.
• Added craft\events\DefineElementDeletionBlockersEvent. (#18728)
• Added craft\fieldlayoutelements\CustomField::setFieldId().
• Added craft\helpers\ElementHelper::belongsToCanonicalOwner().
• Added craft\helpers\Html::jsWithVars().
• Added craft\helpers\Markdown. (#18671)
• Added craft\models\Section::$minAuthors. (#18662)
• Added craft\queue\jobs\ReplaceRelations. (#18728)
• Added craft\services\Elements::REF_TAG_PATTERN.
• Added craft\services\Entries::reassignEntries().
• Added craft\validators\TimeValidator::$outOfRange. (#18575)
• Added Craft.CpScreenSlideout::reload(). (#18625)
• Added Craft.ElementDeletionManager.
• craft\elements\PopulateElementEvent::$row no longer includes fieldValues or generatedFieldValues keys.
• craft\helpers\DateTimeHelper::timeZoneAbbreviation() is no longer deprecated, and now has a $date argument.
• craft\i18n\Formatter::asTime() and asDatetime() now have $withTimeZone arguments. (#18639)
• Removed craft\controllers\AppController::actionResourceJs(). (#18559)
• Craft.CP now triggers a queueCompleted event when the last queue job is completed.
• Deprecated craft\controllers\UsersController::EVENT_DEFINE_CONTENT_SUMMARY. (#18728)
• Deprecated craft\elements\User::$inheritorOnDelete. (#18728)
• Deprecated craft\elements\actions\DeleteUsers. (#18728)
• Deprecated craft\events\DefineUserContentSummaryEvent. (#18728)
• Deprecated Craft.DeleteUserModal. (#18728)

System

• Improve the image quality of WEBP transforms, when optimizeImageFilesize is disabled. (#18635)
• Cross-domain script tags added by JavaScript are now loaded directly, rather than via a proxy. (#18559)
• Updated Twig to 3.24. (#18259, #18454)
• Updated bacon/bacon-qr-code to 3.x. (#18742)
• Updated the built-in composer.phar to 2.9.8. (#18761)
• Fixed a bug where nested entries weren’t getting loaded with their content, if they had an entry type that was no longer allowed by their Matrix field.
• Fixed the wording of the validation error when saving a nested entry with an invalid entry type. (#18506)
• Fixed a bug where relation fields’ element query params weren’t limiting results based on the query’s target site(s). (#18781)
• Fixed a bug where nested content could be updated unexpectedly or deleted after making successive edits to it. (#18835)
• Fixed a bug where full-page element edit screens weren’t being reloaded automatically when the element was saved in another tab.
• Fixed a high-severity RCE vulnerability. (GHSA-f74w-488g-8x5r)
• Fixed a moderate-severity JavaScript injection vulnerability. (GHSA-c55v-343g-5xff)
• Fixed a moderate-severity path traversal vulnerability. (GHSA-287w-mxq6-x2cp)

• Updated Yii to 2.0.55. (#18833)
• Fixed a bug where the “Move…” asset index action was always disabled for files. (#18798)
• Fixed a bug where nested elements would get soft-deleted after running the entrify/global-set command on subsequent environments. (#18767)
• Fixed a bug where row headings within Table fields weren’t getting statically translated in the control panel. (#13703)
• Fixed a bug where entry type chips within Matrix settings could be missing their action items.
• Fixed a bug where custom field override settings’ Label, Handle, and Instructions fields could be missing their placeholder values.
• Fixed a bug where site name and language values set to environment variables were getting replaced with their resolved values when installing Craft. (#18780)
• Fixed a bug where site name values set to environment variables were getting replaced with their resolved values on save. (#18789)
• Fixed a bug where browser tabs weren’t always getting refreshed when nested elements were reordered on another browser tab.
• Fixed a bug where reordering nested elements on a draft could reorder them on the canonical owner element as well. (#18751)
• Fixed a high-severity XSS vulnerability. (GHSA-24x4-j6x9-rfw5)
• Fixed a moderate-severity XSS vulnerability. (GHSA-xrqc-p465-2xvg)

• Fixed a bug where dependencies required by composer.json were getting updated when installing/updating plugins. (#18755)
• Fixed a bug where element thumbnails weren’t always getting loaded when they became visible.
• Fixed a bug where two-step verification setup was working even if the user failed to re-authenticate, if they already had an elevated session. (#18753)
• Fixed a bug where changes to Table fields’ “Table Columns” settings would cause existing data to be lost, if the “Static Rows” setting was enabled. (#18764)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-7h62-6v23-v8fm)

• Fixed a bug where entries weren’t redirecting back to their section’s page’s URL by default.
• Fixed a bug where the resourceBasePath and resourceBaseUrl config settings weren’t being respected for console requests. (#18685)
• Fixed a bug where eager-loadable GraphQL fields could be populated with the wrong field’s results, if they followed a fragment with a *Interface type condition. (#18708)
• Fixed a bug where users with permission to edit entries, but not view peer entries in a section, weren’t allowed to edit the authors for entries in the section. (#18717)
• Fixed a bug where reference tags weren’t working with generated fields. (#18692)
• Fixed errors that could occur when applying project config changes. (#18720)
• Fixed a bug where it wasn’t always possible to sign into a user account that had the same email address as an inactive user. (#18723)
• Fixed a bug where relational fields’ element query results weren’t always limited to the selected relations if the id param was overridden. (#15570)
• Fixed an error that could occur when executing a queue job. (#18739)
• Fixed high-severity authorization bypass vulnerabilities. (GHSA-x5m4-g2cq-52pq)
• Fixed moderate-severity authorization bypass vulnerabilities. (GHSA-3w32-23wj-rxg3, GHSA-qh45-9g5p-m2v4)
• Fixed moderate-severity permission escalation vulnerabilities. (GHSA-qq2c-2q8j-jh27, GHSA-43cq-c2gq-pfpw)

• Fixed an issue that prevented Craft from being installed. (#18700)
• Fixed a bug where nested element cards weren’t showing validation errors. (#18690)
• Fixed a bug where read-only Matrix fields in Index mode weren’t respecting the Default Table Columns setting. (#18684)
• Fixed a bug where nested entries could be lost when reverting content from a revision. (#18691)
• Fixed a bug where nested entries weren’t getting loaded when previewing a revision, if queried with eagerly(). (#18693)

• Most classes can now be instantiated via the create() Twig function. (#18376)
• Added craft\helpers\ProjectConfig::pathDepth().
• craft\services\Fields::deleteLayout() and deleteLayoutById() now have $hardDelete arguments.
• Deprecated craft\services\ProjectConfig::getPendingChangeSummary().
• Fixed a bug where element search query caches weren’t getting invalidated when elements’ search keywords were indexed. (#18275)
• Fixed a bug where disabled sites weren’t getting loaded when running Codeception tests. (#18638)
• Fixed a bug where custom entry index page icons weren’t getting stored properly if the source name contained periods. (#18631)
• Fixed a bug where copying nested entries on a revision wasn’t working. (#18648)
• Fixed a bug where Matrix fields in Blocks view could have “Duplicate selected blocks” and “Delete selected blocks” field-level actions. (#18652)
• Fixed a bug where the submit button within Live Preview was labelled “Save” rather than “Create entry” when editing an unpublished draft. (#18579)
• Fixed a bug where recent changes could be lost when creating an element or applying a draft, if there were validation errors. (#18657)
• Fixed a bug where nested elements would get soft-deleted after running the entrify/global-set command. (#18650)
• Fixed a bug where the “Max Authors” section setting was visible for Single sections.
• Fixed an exception that would be thrown when attempting to access undefined keys within craft\fields\data\JsonData objects from Twig. (#18656)
• Fixed a bug where address cards could be missing their address preview. (#18632)
• Fixed a bug where the Save button’s spinner wouldn’t appear right away when saving a nested element in a slideout. (#18664)
• Fixed a bug where the server check script wasn’t treating GD as a requirement. (craftcms/server-check#30)
• Fixed a bug where tooltips could be instantiated multiple times within Link fields. (#18666)
• Fixed a bug where localized nested element content could be overwritten when the owner element was propagated to a new site. (#18659)

• Improved error logging when logging in with passkeys. (#18627)
• Added craft\controllers\ElementIndexesController::$fieldLayouts.
• craft\services\ElementSources::getTableAttributes() now has a $fieldLayouts argument.
• Fixed a bug where GraphQL results were getting cached even if they contained transform generation URLs. (#18581)
• Fixed a bug where aria-activedescendant, aria-flowto, and aria-owns attributes weren’t getting namespaced by {% namespace %} tags. (#18577)
• Fixed a bug where sites with missing enabled values were being treated as enabled. (#18572)
• Fixed a bug where GraphQL fields within fragments weren’t getting eager-loaded if the fragment’s type condition referenced an interface (e.g. on EntryInterface) rather than a specific type name. (#18588)
• Fixed a bug where relation fields were getting marked as translatable if they used a custom translation method, even if the rendered translation key was blank. (#18580)
• Fixed a bug where section and field chips in the “Used by” column of the Entry Types index page weren’t getting hyperlinked. (#18589)
• Fixed a bug where exceptions thrown when sending emails weren’t getting handled properly. (#18597)
• Fixed a bug where unordered lists weren’t getting styled correctly within Tip/Warning/Markdown field layout UI elements. (#18598)
• Fixed an error that could occur when upgrading to Craft 5. (#18576)
• Fixed a bug where nested Matrix entries’ Title fields were getting validation errors if blank, even if the nested entry was disabled. (#18611)
• Fixed an infinite recursion bug that could occur if the loginPath, logoutPath, setPasswordPath, or verifyEmailPath config settings were set to a callable that called the sites service. (#18605)
• Fixed a bug where Matrix fields in Index view mode could be missing custom field columns. (#18590)
• Fixed a JavaScript error that could occur when opening a modal. (#18612)
• Fixed a bug where element chips and cards weren’t getting refreshed when a provisional draft’s changes were discarded in a different tab.
• Fixed a bug where element attributes weren’t always updating when content changes were made.
• Fixed a bug where successive edits to nested elements were forgotten. (#18624)
• Fixed a bug where nested elements weren’t getting duplicated when a new site was added to the owner element. (#18621)
• Fixed a bug where nested entries were getting assigned new IDs if they were edited multiple times for the same owner element draft. (#18461)
• Fixed a SQL error that could occur when editing an element draft that had upstream changes. (#18626)
• Fixed a bug where custom sources’ labels weren’t being translated within the document title. (#18629)
• Fixed moderate-severity information disclosure vulnerabilities. (GHSA-gj2p-p9m4-c8gw, GHSA-33m5-hqp9-97pw)
• Fixed a moderate-severity RCE vulnerability. (GHSA-qrgm-p9w5-rrfw)

• Added craft\helpers\DateTimeHelper::testTimeToSeconds().
• Fixed an error that could occur after running the utils/fix-field-layout-uids command. (#18516)
• Fixed a JavaScript error that could occur if any field layout elements were configured with unsupported widths. (#18552)
• Fixed an error that could occur when user impersonation failed. (#18569)
• Fixed a bug where deeply-nested elements could be deleted unexpectedly. (#18537)
• Fixed a warning that was getting logged when using craft\filters\SiteFilterTrait.
• Fixed a bug where prefixing entry queries’ authorGroup params with and or not operators wasn’t working properly. (#18551)
• Fixed an error that could occur when running the gc command, if a Matrix field had been converted to an Addresses or Content Block field. (#18549)
• Fixed a styling issue. (#18566)
• Fixed a JavaScript error that could occur when Time fields’ Min/Max Time settings were set.

• Updated @simplewebauthn/browser to 13.3.0. (#18545)
• Updated web-auth/webauthn-lib to 5.2.4. (#18545)
• Fixed an error that occurred when loading some control panel resources on environments with craft\web\AssetManager::$cacheSourcePaths disabled. (#18536)
• Fixed a bug where craft\fields\data\LinkData::getUrl() was returning the URL suffix rather than an empty string, if the rendered base URL was an empty string.
• Fixed a styling bug where horizontal rules could bleed out of their containing panes.

• Element edit pages once again redirect to their referral URL on save. (#18483)
• Added craft\filters\IpRateLimitIdentity. (#18510)
• Added craft\helpers\App::resourcePathByUri().
• Removed thamtech/yii2-ratelimiter-advanced. (#18510)
• Fixed a bug where global set GraphQL query caches weren’t getting invalidated when global sets were updated. (#18479)
• Fixed a bug where users/suspend-user and users/unsuspend-user actions required that the logged-in user have control panel access. (#18485)
• Fixed a bug where flipping an image within the Image Editor didn’t always work. (#18486)
• Fixed a bug where SVG files missing their width and height attributes weren’t getting them set as expected.
• Fixed an error that occurred if a template referenced a preloaded Single entry followed by a null coalescing operator. (#18503)
• Fixed a bug where links within Redactor fields were getting target="_blank" added to them. (#18500)
• Fixed an error that could occur when applying project config changes, or editing entries with an invalid entry type. (#18477, #18505)
• Fixed a bug where Content Block fields’ nested values weren’t always getting set correctly via resave commands. (#18453)
• Fixed a bug where addresses without labels weren’t getting chip labels. (#18481)
• Fixed a JavaScript error that could occur on element edit pages.
• Fixed a bug where cross-site validation errors weren’t preventing elements from getting saved. (#18292)
• Fixed a bug where failure messages when pasting elements weren’t getting displayed properly.
• Fixed a bug where craft\helpers\UrlHelper::cpReferralUrl() was returning the referrer URL even if it had the same URI as the current page. (#18483)
• Fixed a bug where Matrix field’ grouped entry type menu labels weren’t translatable. (#18528)
• Fixed moderate-severity SSRF vulnerabilities. (GHSA-3m9m-24vh-39wx, GHSA-95wr-3f2v-v2wh)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-jq2f-59pj-p3m3)

• The PDO::MYSQL_ATTR_MULTI_STATEMENTS attribute is no longer set by default for database connections. (#18474)
• Added craft\elements\Entry::canMove().
• Fixed a bug where element selector modals weren’t showing any results if they were limited to sources that only exist for a different site than the active one. (#18478)
• Fixed low-severity information disclosure vulnerabilities. (GHSA-44px-qjjc-xrhq, GHSA-vgjg-248p-rfm2, GHSA-x76w-8c62-48mg)
• Fixed a moderate-severity access control vulnerability. (GHSA-6mrr-q3pj-h53w)
• Fixed moderate-severity information disclosure vulnerabilities. (GHSA-3pvf-vxrv-hh9c, GHSA-5pgf-h923-m958)
• Fixed a moderate-severity RCE vulnerability. (GHSA-86vw-x4ww-x467)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-f582-6gf6-gx4g)

• The control panel is now translated into Greek. (#18458)
• The PDO::MYSQL_ATTR_MULTI_STATEMENTS attribute is now set to false by default for database connections.
• Fixed a bug where searchindex and searchindexqueue rows weren’t being deleted when an element was deleted for a site. (#18394)
• Fixed a bug where multi-select condition rules weren’t applying their “has a value” and “is empty” operators correctly. (#18470)
• Fixed an unintended change in behavior where craft\helpers\App::parseEnv() was returning null instad of an empty string, when an environment variable name was passed in, which was set to an empty string.
• Fixed a bug where drafts within “My Drafts” widgets weren’t getting hyperlinked. (#18456)
• Fixed a bug where nested entries were getting assigned new IDs if they were edited multiple times for the same owner element draft. (#18461)
• Fixed a bug where the “New Tab” button within field layout designers could be positioned incorrectly. (#18450)
• Fixed a high-severity RCE vulnerability. (GHSA-2fph-6v5w-89hh)

• Added craft\services\Tokens::getRemainingTokenUsages().
• Added craft\web\Request::getTokenRoute().
• Fixed a JavaScript error that could occur when opening or submitting a slideout.
• Fixed a high-severity permission escalation vulnerability. (GHSA-cc7p-2j3x-x7xf)

• The nb locale is now treated as a fallback for no on environments where no isn’t supported. (#18431)
• Element indexes now show “Paste” buttons alongside bulk element action buttons. (#18427)
• Boolean environment variables now universally support truthy/falsy values, including on/off and yes/no. (#18441)
• Impoved the performance of craft\helpers\Typecast. (#18426)
• Added App::normalizeBooleanValue().
• Added craft\events\ExecuteGqlQueryEvent::$cacheDuration. (#18442)
• Added craft\events\ExecuteGqlQueryEvent::$cacheTags. (#18442)
• Added craft\web\Request::getWantsImage().
• Added craft\web\Request::getWantsJson().
• Added craft\web\Request::wants().
• Fixed a bug where 404 responses could be set to an image based on the brokenImagePath config setting for Chrome. (#18438)
• Fixed a bug where some Matrix bulk action labels weren’t getting translated.
• Fixed a bug where global nav items weren’t showing an icon if the icon was set to 0.
• Fixed moderate-severity RCE vulnerabilities. (GHSA-4484-8v2f-5748, GHSA-qx2q-q59v-wf3j)
• Fixed a moderate-severity XSS vulnerability. (GHSA-3x4w-mxpf-fhqq)
• Fixed a low-severity path traversal vulnerability. (GHSA-472v-j2g4-g9h2)

• slug columns referenced in element queries’ select, where, or orderBy expressions now explicitly resolve to elements_sites.slug. (#18416)
• Fixed a bug where the control panel requests could trigger an infinite browser redirect loop. (#18420)
• Fixed a bug where craft\helpers\App::parseBooleanEnv() wasn’t handling false values properly. (#18418)
• Fixed a bug where DECIMAL field values with 0 precision weren’t gettnig typecasted properly in element queries.

[!WARNING]
Relational condition rules’ element ID templates are now rendered in a sandboxed Twig environment, when enableTwigSandbox is enabled.

• Added craft\helpers\ElementHelper::cleanseQueryCriteria().
• Fixed an error that could occur when editing an element with a Table field. (#18408)
• Fixed an error that occurred when editing a Table field with no default rows. (#18407)
• Fixed a high-severity RCE vulnerability. (GHSA-fp5j-j7j4-mcxc)
• Fixed a high-severity SQL injection vulnerability. (GHSA-g7j6-fmwx-7vp8)

• Element edit pages no longer redirect to their referral URL on save. (#18404)
• Fixed a bug where the Entries index page could trigger an infinite browser redirect loop. (#18400)
• Fixed a styling issue with slideouts within Live Preview. (#18383)

• Nested entries’ edit screens now have a “Field settings” action menu item.
• GraphQL API requests no longer get cache response headers; only no-cache headers, and only if the request had a X-Craft-Gql-Cache: no-cache header, or if the request contained any mutations. (#18348)
• Legacy entry index URLs now redirect content/<page-name>.
• The create() Twig function now allows craft\helpers\ classes to be created. (#18376)
• yii\base\Event is now allowed in its entirety within sandboxed Twig environments.
• Added craft\helpers\ElementHelper::elementRevisionsUrl().
• Fixed a bug where Dashboard columns weren’t getting refreshed when the window was resized. (#18389)
• Fixed a bug where craft\web\View::renderSandboxedObjectTemplate() and renderSandboxedString() weren’t properly sandboxing templates rendered from the control panel.
• Fixed a bug where element queries with draftOf set to false were omitting canonical elements that were duplicated for an owner draft.
• Fixed a bug where newly-created nested elements were being fully duplicated to other drafts, rather than just their ownership data.
• Fixed a bug where ancestor elements’ breadcrumbs weren’t getting hyperlinked. (#18375)
• Fixed a bug where craft\models\Volume::getSubpath() could return / instead of an empty string, if the subpath was set to an environment variable set to an empty string. (#18379)
• Fixed a bug where it wasn’t possible to set assets’ alt text via GraphQL mutations. (#18381)
• Fixed a bug where dragging a field from a field layout designer’s “Add” HUD, and then dropping it back on itself, would result in the field getting selected in a hidden state. (#18382)
• Fixed a bug where custom entry index pages were getting included in the global nav, even if they only contained sources that weren’t available to the current user. (#18391)
• Fixed an error that occurred when creating a new element on multi-site installs, if its field layout contained any generated fields. (#18393)
• Fixed a bug where pressing <kbd>Return</kbd> on a textarea when bulk-editing elements would submit the changes.
• Fixed a bug where it wasn’t possible to save an entry with a pre-selected author that is no longer allowed to author entries for the section. (#18397)
• Fixed a bug where the “View all revisions” button wasn’t working for nested entries. (#18398)
• Fixed a low-severity XSS vulnerability. (GHSA-fvwq-45qv-xvhv)
• Fixed a low-severity information disclosure vulnerability. (GHSA-vg3j-hpm9-8v5v)

• It’s now possible to set elements’ Thumbnail Source to a field nested within a Content Block field. (#18365)
• Elements within embedded element indexes are now hyperlinked by default. (#17080)
• Added craft\db\mysql\Schema::getRowFormat().
• Added craft\db\mysql\Schema::setRowFormat().
• Added craft\fieldlayoutelements\BaseField::getThumbOptions().
• Added craft\helpers\Cp::cardThumbOptions().
• Added craft\models\FieldLayout::getThumbHtmlForElement().
• Added craft\models\FieldLayout::hasThumbField().
• Deprecated craft\models\FieldLayout::getThumbField(). hasThumbField() or getThumbHtmlForElement() should be used instead.
• Fixed a bug where nested entries within Matrix fields weren’t showing their UI labels if they didn’t have titles.
• Fixed a bug where assets weren’t getting hyperlinked on the Assets index page in thumbnail view.
• Fixed a bug where sections and volumes were getting included in entry/asset breadcrumb menus, even if their sources were disabled. (#18359)
• Fixed an error that could occur when updating to Craft 5.9, if the entrytypes table’s row format was set to COMPACT. (#18349)
• Fixed a bug where newly-selected elements weren’t being rendered correctly for relational fields set to the “Card grid” view mode. (#18362)
• Fixed a bug where card previews weren’t getting updated when a selected field was removed from the field layout.
• Fixed potential JavaScript errors that could occur if a disclosure menu’s trigger or target elements were missing. (#18358)
• Fixed a JavaScript error that occurred if a Matrix field’s label was hidden. (#18366)
• Fixed an infinite recursion bug. (#18363)

• Fixed a bug where nested elements could appear to be editable when their field was read-only.
• Fixed a bug where nested element changes weren’t being shown in cross-domain preview requests, if no changes had been made to the root entry yet. (#18337)
• Fixed a bug where Live Preview wasn’t upadting when making changes to nested elements via a Matrix field in Index view.
• Fixed a bug where Table fields with “Static Rows” enabled were losing their values when edited, if the field hadn’t been resaved since updating to Craft 5.9. (#18350)
• Fixed an unintentional breaking change when querying Link field data via GraphQL. (#18355)
• Fixed an error that occurred when saving the Customize Sources modal for non-entry element types. (#18347)
• Fixed a bug where links in section breadcrumb menus didn’t include the page slug. (#18352)
• Fixed a JavaScript warning that occurred after selecting an element in a relation field, if the Max Relations setting was reached. (#18358)
• Fixed a bug where a “Singles” breadcrumb was included on entry edit pages when the “Singles” source had been disabled within the Customize Sources modal. (#18359)

• Added craft\models\FieldLayout::getEditableCustomFieldElements().
• Fixed a bug where {% case %} tags with three or more values within {% switch %} tags weren’t working properly. (#18334)
• Fixed a bug where Matrix fields in Blocks view could lose their existing values when they became editable.
• Fixed a bug where Content Block fields and Matrix fields in Blocks view weren’t updating their nested fields’ editability states.
• Fixed an error that could occur when executing a GraphQL query with a Link field. (#18339)
• Fixed a bug where read-only custom fields could be treated as required. (#18342)

• Fixed a bug where multi-value {% case %} tags within {% switch %} tags weren’t working properly. (#18334)

• Fixed an error that occurred when upgrading to Craft 5.
• Fixed a bug where assets weren’t being rendered correctly immediately after being uploaded to an Assets field. (#18318)
• Fixed a bug where it was possible to rename existing entry index pages to a blank name. (#18321)
• Fixed a bug where element save notifications weren’t hyperlinking the element label. (#18326)
• Fixed a bug where sidebar states weren’t being remembered across page loads. (#18323)
• Fixed an error that could occur when displaying an embedded element index that included field layouts with generated fields. (#18320)
• Fixed errors that occurred when performing user administration actions on Craft Team. (#18331)
• Fixed a warning that was getting logged when accessing the Plugin Store. (#18324)
• Fixed a bug where component names weren’t getting trimmed of leading/trailing whitespace on save. (#18315)

• Fixed an error that could occur when updating to Craft 5.9. (#18309)
• Fixed a bug where custom entry index pages that only contained native sources weren’t getting their own nav items. (#18311)
• Fixed a bug where element selector modals were blank, for relational fields that weren’t limited to specific sources. (#18313)
• Fixed a bug where image transforms with invalid position properties weren’t being handled properly. (#18310)
• Fixed a bug where image transforms weren’t being sorted by their translated names. (#18315)

Content Management

• Matrix fields set to the “Cards” or “Blocks” view modes now show an “Add” button per entry type group, when the viewport is wide enough to support it. (#17731)
• Matrix fields set to the “Cards” view mode now have “Copy selected entries”, “Duplicate selected entries”, and “Delete selected entries” field-level actions, if any entries are selected. (#18251)
• Matrix fields set to the “Blocks” view mode now have a “Expand/collapse selected blocks”, “Copy selected blocks”, “Duplicate selected blocks”, and “Delete selected blocks” field-level actions, if any entries are selected. (#18001, #18251)
• Matrix fields set to the “Blocks” view mode now have block action menus with “Expand/Collapse”, “Entry type settings”, and “Copy” actions, even if the field isn’t editable. (#18013)
• Chips and cards are generally no longer hyperlinked. (#17591)
• Entry revision menus now always include a “View all revisions” link. (#18050)
• Timestamps within entry revision menus now have tooltips that reveal the full date and time. (#18050)
• It’s now possible to add new sites to entries via their slideout editors. (#17795)
• Entry “Duplicate” bulk actions now duplicate entries as drafts. (#18260)
• Elements created via “Save as a new…” actions now initially have an empty slug. (#17932)
• The control panel is no longer scrollable when a menu is expanded. (#17960)
• Most site breadcrumbs no longer include selection menus if there’s only one selectable site. (#16526)
• Number fields with “Step Size” and “Min Value” or “Max Value” settings will now get min/max attributes set on their input. (#17973)
• Element, field, and entry type edit pages now redirect back to the previous page’s URL on save. (#16140)
• Bulk element actions are now available on element indexes for mobile devices.
• Textual condition rules are now case-insensitive. (#18107)
• Added support for exporting elements as XLSX and YAML files. (#18160)
• Non-editable fields now have “Read Only” badges. (#18215)
• Revisions now keep track of which element attributes/fields were modified for the revision.
• Improved the styling of tips and warnings in field layouts. (#18261)

Accessibility

• Improved the accessibility of the Orientation setting within the Image Editor’s crop tool. (#17690)
• The Image Editor’s focal point tool is now keyboard accessible. (#17880)
• All sortable checkbox select options, selected Dashboard widgets, and site listings now have keyboard-accessible “Move up” and “Move down” action items. (#18067)
• Improved the accessibility of user permission lists and GraphQL schema component lists. (#18290)

Administration

• It’s now possible to divide entry sources into multiple index pages, via the Customize Sources modal. (#17779)
• The Customize Sources modal now supports mobile devices. (#18067)
• Added the “UI Label Format” entry type setting. (#18044)
• Added the “Allow line breaks in titles” entry type setting. (#18265)
• Added the “Change the author of other users’ entries” permission for channel and structure sections. (#18298)
• Added the “View user” GraphQL schema option for Craft Solo. (#17863)
• Users’ User Groups settings now show a component select input, and support inline group editing/creation on environments that allow administrative changes.
• Address labels can now be made optional. (#11410)
• Relational fields now have an “Inline list” view mode. (#17744)
• Relational fields and Matrix fields now have a “Card grid” view mode, replacing the “Show cards in a grid” setting. (#17744)
• Relational fields’ selectable element conditions can now have “Status” condition rules. (#17945)
• Added the “Show ON/OFF labels in cards” setting to Lightswitch fields. (#17743)
• Control panel-defined routes now have action menus with “Move up”/“Move down” actions. (#17706)
• “Generate image transform” jobs now include the asset’s filename in the job description. (#17753)
• “Field” and “Section” condition rules now show field/section handles for users with the “Show field handles in edit forms” preference enabled. (#17909)
• Native fields within element edit pages now have “Copy attribute name” actions. (#18114)
• “Remove” actions on the Plugins index page now show a confirmation dialog. (#17922)
• Composer package constraints in composer.json are now set with caret operators (e.g. ^1.2.3). (#18297)
• entrify commands no longer require a category group/tag group/global set handle to be passed.
• entrify commands now automatically assign newly-created channel/structure sections to “Categories” or “Tags” pages. (#17779)
• The clear-cache command now accepts a space-delimited list of cache IDs that should be cleared.
• The up command now warns about any astray license issues before running migrations. (#18297)
• Compiled templates are now deleted by the up command rather than from migrate commands.
• Added the enableTwigSandbox config setting. (#18208, #18216)
• Added the useIdnaNontransitionalToUnicode config setting. (#17946)
• The maxCachedCloudImageSize config setting is now set to 0 by default. (#17997)
• The disableGraphqlTransformDirective config setting is now deprecated.
• System message emails are now rendered using GitHub-flavored Markdown. (#18058)
• Drag-and-drop icons are now longer shown for devices that don’t support pointer events. (#18067)
• The Caches utility now keeps track of which options were previously selected. (#9447)
• Field layouts can now set editability conditions on custom fields, based on the edited element. (#18181)
• Element cards and table views can now include fields nested within Content Block fields. (#18206, #18252)
• Element table views can now include generated fields. (#18253)
• Element indexes can now be sorted by generated fields. (#18253)
• Generated fields now normalize true/false/null/integer/float values to the appropriate types. (#18267)
• Money fields’ icons now indicate their selected currency, for common currencies.

Development

• Reference tags now support fallback values when no attribute is specified. (#17688)
• Added support for referencing environment variables anywhere within settings that support them (e.g. foo/$ENV_NAME/bar or foo-${ENV_NAME}-bar). (#17794)
• Environmental settings can now reference CRAFT_SITE (the current site’s handle) and CRAFT_SITE_UPPER (the current site’s handle in UPPER_SNAKE_CASE) environment variables, which are defined at runtime. (#17794)
• It’s now possible to create unpublished drafts via GraphQL. (#17805)
• It’s no longer possible to instantiate objects that don’t extend yii\base\BaseObject via the create() Twig function, which fixes a moderate-severity SSTI issue. (GHSA-94rc-cqvm-m4pw)
• Added the randomString() Twig function. (#18020)
• Added the uuid() Twig function.
• The Twig hash filter now supports passing a hashing algorithm, such as 'md5' or 'sha256'. (#17885)
• The @parseRefs and @transform GraphQL directives are now optional for each GraphQL schema, which fixes a high-severity IDOR issue. (GHSA-7x43-mpfg-r9wj)
• GraphQL API requests can now identify themselves as preview requests by passing an X-Craft-Preview-Token header, set to the x-craft-preview/x-craft-live-preview query param in the preview target URL.
• Added support for referencing environment variables anywhere within settings that support them (e.g. foo/$ENV_NAME/bar or foo-${ENV_NAME}-bar). (#17949)
• It’s no longer possible to instantiate objects that don’t extend yii\base\BaseObject via the create() Twig function. (GHSA-94rc-cqvm-m4pw)
• Added the uuid() Twig function.
• The @parseRefs and @transform GraphQL directives are now optional for each GraphQL schema. (GHSA-7x43-mpfg-r9wj)

Extensibility

• Subnav items within the global control panel navigation can now have icons. (#17879)
• It’s now possible to modify the template path via craft\web\View::EVENT_BEFORE_RENDER_TEMPLATE and EVENT_BEFORE_RENDER_PAGE_TEMPLATE. (#18125)
• Custom fields’ icons can now be defined at the instance level, via a getIcon() method.
• Added craft\base\ElementIndex::multiPageSources(). (#17779)
• Added craft\base\ElementTrait::$applyingDraft. (#18057)
• Added craft\base\ElementTrait::$hasProvisionalChanges. (#17915)
• Added craft\base\ElementTrait::$propagateRequired.
• Added craft\base\FieldInterface::propagateValue().
• Added craft\elements\Entry::EVENT_DEFINE_META_FIELDS. (#17996)
• Added craft\elements\User::isInGroups(). (#17989)
• Added craft\elements\actions\Duplicate::$asDrafts.
• Added craft\elements\conditions\HintableConditionRuleTrait. (#17909)
• Added craft\events\DefineFieldActionsEvent.
• Added craft\events\DefineGqlArgumentsEvent.
• Added craft\events\DefineMetaFields. (#17996)
• Added craft\events\RegisterElementCardAttributesEvent::$fieldLayout. (#17920)
• Added craft\fieldlayoutelements\BaseField::EVENT_DEFINE_ACTION_MENU_ITEMS. (#18037)
• Added craft\fieldlayoutelements\BaseField::copyAttributeAction(). (#18114)
• Added craft\fieldlayoutelements\BaseField::getPreviewOptions().
• Added craft\fieldlayoutelements\BaseField::key().
• Added craft\fieldlayoutelements\CustomField::getElementEditCondition().
• Added craft\fieldlayoutelements\CustomField::setElementEditCondition().
• Added craft\fields\BaseRelationField::VIEW_MODE_CARDS_GRID.
• Added craft\fields\BaseRelationField::VIEW_MODE_CARDS.
• Added craft\fields\BaseRelationField::VIEW_MODE_LIST_INLINE.
• Added craft\fields\BaseRelationField::VIEW_MODE_LIST.
• Added craft\fields\BaseRelationField::VIEW_MODE_THUMBS.
• Added craft\fields\Matrix::VIEW_MODE_CARDS_GRID.
• Added craft\fields\data\LinkData::getAttributes(). (#18184)
• Added craft\gql\base\ElementArguments::EVENT_DEFINE_ARGUMENTS. (#18062)
• Added craft\helpers\Assets::resolveSubpath(). (#18103)
• Added craft\helpers\Cp::cardPreviewOptions().
• Added craft\helpers\ElementHelper::loadProvisionalChanges(). (#17915)
• Added craft\helpers\StringHelper::convertLineBreaks().
• Added craft\helpers\UrlHelper::cpReferralUrl().
• Added craft\i18n\Locale::getDefaultCurrency().
• Added craft\models\EntryType::$uiLabelFormat.
• Added craft\models\FieldLayout::$thumbFieldKey.
• Added craft\models\FieldLayout::getCardBodyHtmlForElement().
• Added craft\models\FieldLayout::getElementByKey().
• Added craft\models\FieldLayoutForm::getStaticElements().
• Added craft\models\Section::getCpIndexUri().
• Added craft\models\Section::getPage().
• Added craft\services\ElementSources::getFirstPage(). (#17779)
• Added craft\services\ElementSources::getPageSettings(). (#17779)
• Added craft\services\ElementSources::getPages(). (#17779)
• Added craft\services\ElementSources::pageExists(). (#17779)
• Added craft\services\ElementSources::pageNameId(). (#17779)
• Added craft\services\ElementSources::savePageSettings().
• Added craft\services\ElementSources::saveSources().
• Added craft\services\Search::deleteOrphanedIndexJobs().
• Added craft\services\Structure::EVENT_AFTER_UPDATE_ELEMENT.
• Added craft\services\Structure::EVENT_BEFORE_UPDATE_ELEMENT.
• Added craft\web\BaseSpreadsheetResponseFormatter.
• Added craft\web\GqlResponseFormatter.
• Added craft\web\Request::getHasInvalidToken().
• Added craft\web\Response::FORMAT_GQL.
• Added craft\web\Response::FORMAT_XLSX.
• Added craft\web\Response::FORMAT_YAML.
• Added craft\web\View::renderSandboxedObjectTemplate().
• Added craft\web\View::renderSandboxedString().
• Added craft\web\View::renderSandboxedTemplate().
• Added craft\web\XlsxResponseFormatter.
• Added craft\web\YamlResponseFormatter.
• Added craft\web\twig\AllowedInSandbox. (#18219)
• Added craft\web\twig\SecurityPolicy.
• Added craft\web\twig\nodes\BaseNode.
• Added Craft.BaseElementIndex::asyncSelectDefaultSource().
• Added Craft.BaseElementIndex::asyncSelectSource().
• Added Craft.BaseElementIndex::asyncSelectSourceByKey().
• Added Craft.BaseElementIndex::ensureSourceAttributeInfo().
• craft\base\Element::EVENT_AFTER_MOVE_IN_STRUCTURE is no longer deprecated.
• craft\base\Element::EVENT_BEFORE_MOVE_IN_STRUCTURE is no longer deprecated.
• craft\base\ElementInterface::afterMoveInStructure() is no longer deprecated.
• craft\base\ElementInterface::beforeMoveInStructure() is no longer deprecated.
• craft\base\ElementInterface::cardAttributes() now has a $fieldLayout argument. (#17920)
• craft\events\ElementStructureEvent is no longer deprecated.
• craft\fieldlayoutelements\CustomField::editable() now has an $element argument.
• craft\helpers\ElementHelper::findSource() now has $withDisabled and $page arguments.
• craft\helpers\FileHelper::writeToFile() now throws an exception if the file path isn’t writable, or there isn’t sufficient free space on the disk. (#17762)
• craft\helpers\UrlHelper now encodes square brackets in generated URLs. (#17840)
• craft\models\FieldLayout::getCardBodyElements() now always returns an array of arrays with html keys.
• craft\services\ElementSources::getSources() now has a $page argument. (#17779)
• craft\services\ElementSources::sourceExists() now has a $page argument. (#17779)
• craft\web\Request::accepts() now accepts wildcard characters (*) in the $contentType argument, to check for a range of MIME types (e.g. application/*+json).
• craft\web\Request::getAcceptsJson() now returns true for requests with Content-Type headers that match application/*+json, in addition to application/json.
• Checkbox selects can now be configured with a storageKey setting.
• The _includes/forms/checkbox.twig template now escapes the label variable. A raw HTML label can be passed by wrapping the label value in raw() or craft\helpers\Template::raw().
• The _includes/forms/radio.twig template now escapes the label variable. A raw HTML label can be passed by wrapping the label value in raw() or craft\helpers\Template::raw().
• Craft.ui.createCheckbox() now escapes the config.label property. A raw HTML label can be passed via the config.labelHtml property.
• Craft.ui.createSelect() now escapes options’ label properties. Raw HTML labels can be passed via labelHtml properties.
• Deprecated craft\fieldlayoutelements\BaseField::$includeInCards.
• Deprecated craft\fieldlayoutelements\BaseField::$providesThumbs.
• Deprecated craft\fields\BaseRelationField::$showCardsInGrid.
• Deprecated craft\fields\Matrix::$showCardsInGrid.
• Deprecated craft\helpers\StringHelper::capitalizePersonalName(). toPascalCase() should be used instead.
• Deprecated craft\helpers\StringHelper::isWhitespace(). isBlank() should be used instead.
• Deprecated craft\helpers\StringHelper::upperCamelize(). toPascalCase() should be used instead.
• Deprecated craft\models\FieldLayout::getCardBodyAttributes().
• Deprecated craft\models\FieldLayout::getCardBodyFields().
• Deprecated craft\services\Structure::EVENT_AFTER_MOVE_ELEMENT. EVENT_AFTER_UPDATE_ELEMENT should be used instead.
• Deprecated craft\services\Structure::EVENT_BEFORE_MOVE_ELEMENT. EVENT_BEFORE_UPDATE_ELEMENT should be used instead.
• Deprecated craft\web\CsvResponseResponseFormatter::$escapeChar.
• Deprecated Craft.BaseElementIndex::selectDefaultSource().
• Deprecated Craft.BaseElementIndex::selectSource().
• Deprecated Craft.BaseElementIndex::selectSourceByKey().
• Deprecated the $cardElements argument in craft\helpers\Cp::cardPreviewHtml().
• Deprecated the $cardElements argument in craft\models\FieldLayout::getCardBodyElements().

System

• GraphQL API responses now set their Content-Type header to application/graphql-response+json.
• GraphQL API responses now set cache headers based on whether a mutation was performed, regardless of the request type.
• Global set queries no longer register cache tags.
• Improved element index performance. (#17557)
• Improved element query performance. (#17850)
• Reduced the number of queries executed when working with nested entries, addresses, and content blocks. (#18142)
• Session-based cookies no longer use colons (:) in their names. (#18158)
• A rate limit is now enforced for users/send-password-reset-email requests. (#17337)
• Added the Illuminate Support library.
• Added the PhpSpreadsheet library.
• Updated Yii to 2.0.54.
• Updated Twig to 3.21. (#17603, #18225)
• Removed the Stringy library. (#16606)
• Fixed a bug where elements with unsaved changes could show outdated attribute/field values within element index tables, chips, and cards throughout the control panel. (#17915)
• Fixed a bug where Table fields with the “Static Rows” setting enabled would lose track of which values belonged to which row headings, if the “Default Values” table was reordered. (#17090)
• Fixed a bug where requests with invalid tokens would throw an exception before the application was fully initialized, which could lead to other errors. (#18000)
• Fixed a bug where titles, slugs, and required custom field values weren’t always getting propagated to other sites when creating a new element. (#17955)
• Fixed a bug where it was possible to create more than five users with the Team edition.
• Fixed a bug where deadlocks could occur when updating elements’ search indexes. (#18139)
• Fixed a bug where element index pages weren’t retaining their search query param if present on the initial request.
• Fixed a bug where element search query caches weren’t getting invalidated when elements’ search keywords were indexed. (#18275)
• Fixed a bug where Matrix and Addresses fields weren’t loading provisional drafts for GraphQL preview requests.
• Fixed a bug where generated field values weren’t always up-to-date if their template referenced nested elements. (#17938)
• Fixed a bug where ineditable fields appeared to be editable via the inline editing mode on element indexes. (#18291)
• Fixed a bug where Addresses fields weren’t working properly when editing elements for non-primary sites. (#18306)
• Fixed low-severity XSS vulnerabilities. (GHSA-4mgv-366x-qxvx)
• Fixed a moderate-severity RCE vulnerability. (GHSA-v47q-jxvr-p68x)
• Fixed moderate-severity permission escalation vulnerabilities. (GHSA-2xfc-g69j-x2mp, GHSA-jxm3-pmm2-9gf6)
• Fixed a high-severity SSRF and SSTI vulnerability. (GHSA-5fvc-7894-ghp4)
• Fixed a moderate-severity SSTI vulnerability. (GHSA-qc86-q28f-ggww)
• Fixed a moderate-severity user account enumeration vulnerability. (GHSA-234q-vvw3-mrfq)

• Fixed an error that could occur if the purgeStaleUserSessionDuration config setting was set to a duration interval string. (#18238)
• Fixed a bug where image transforms weren’t getting regenerated on Local filesystems, if the transform params changed and the asset transform index had been cleared. (#18249)
• Fixed a bug where custom Login page logos could be sized incorrectly. (#18229)
• Fixed a bug where element index pages weren’t preserving “Trashed” status selections between page loads. (#18230)
• Fixed a bug where it was possible to suspend SSO-based user accounts.
• Fixed an error that could occur when a nested element’s field layout no longer existed. (#18246)
• Fixed a bug where selecting new elements within relation fields could cause multiple draft saves in quick succession.
• Fixed a bug where verification emails weren’t getting sent when a user without the “Administrate users” permission changed a user account’s email address.
• Fixed a bug where MP3 files weren’t always being properly recognized. (#18243)
• Fixed a bug where deeply-nested slideouts could cause visual glitches in Chromium-based browsers. (#18255)
• Fixed low-severity XSS vulnerabilities. (GHSA-6j87-m5qx-9fqp, GHSA-3jh3-prx3-w6wc)
• Fixed moderate-severity SSRF vulnerabilities. (GHSA-gp2f-7wcm-5fhx, GHSA-v2gc-rm6g-wrw9)
• Fixed a moderate-severity TOCTOU vulnerability. (GHSA-6fx5-5cw5-4897)

• Improved keyboard control for Money fields. (#18198, #18212)
• User queries now always return active, non-pending users first, unless otherwise specified by orderBy. (#18148)
• The utils/fix-field-layout-uids command now checks for duplicate top-level field layout UUIDs. (#18193)
• Fixed a bug where all plugin settings were being saved to the project config, rather than just posted settings. (craftcms/commerce#4006)
• Fixed a bug where custom selects could be positioned incorrectly after the window was resized. (#18179)
• Fixed an error that could occur when logging a deprecation warning, if the backtrace contained any non-UTF-8-encoded strings. (#18218)
• Fixed a bug where it wasn’t possible to view assets if they had exactly 50 subfolders alongside them. (#18213)
• Fixed a bug where Matrix fields’ Entry Types settings were partially interactive when admin changes were disallowed. (#18145)
• Fixed a bug where users could be unable to sign in if an inactive user account existed with the same email address. (#18148)
• Fixed a bug where Content Block fields could appear to be missing their content when viewing a revision. (#18149)
• Fixed a bug where Dropdown and Radio Button fields weren’t handling :empty:/:notempty: element query params properly for options with blank values. (#18156)
• Fixed a bug where chip icons were getting rounded. (#18163)
• Fixed a bug where object templates that included another template were missing variables. (#18165)
• Fixed a JavaScript error that could occur if two control panel animations were triggered simultaneously.
• Fixed a bug where it wasn’t possible to copy/paste nested entries within Matrix fields set to the inline-editable blocks view mode, for unpublished owner elements. (#18185)
• Fixed a bug where custom fields’ checkboxes weren’t getting removed from field layouts’ “Card Attributes” lists when removed from the layout.
• Fixed a bug where consecutive hyphens (-) within Link fields’ “Class Name” values were getting removed. (#18201)
• Fixed an error that could occur when saving a recursively-nested element. (#18164)
• Fixed a bug where element indexes could show multiple table columns for the same field/label/handle combinations. (#18209)
• Fixed a bug where element indexes’ “View” menus could list some custom fields under “Attributes”. (#18221)
• Fixed moderate-severity SSRF vulnerabilities. (GHSA-96pq-hxpw-rgh8, GHSA-m5r2-8p9x-hp5m, GHSA-8jr8-7hr4-vhfx)
• Fixed a low-severity XSS vulnerability. (GHSA-7pr4-wx9w-mqwr)
• Fixed a high-severity SQL injection vulnerability. (GHSA-2453-mppf-46cj)
• Fixed a low-severity XSS vulnerability. (GHSA-9f5h-mmq6-2x78)
• Fixed a high-severity permission escalation vulnerability. (GHSA-fxp3-g6gw-4r4v)
• Fixed a moderate-severity RCE vulnerability. (GHSA-7jx7-3846-m7w7)