5.11.3

• Fixed an error that could occur when registering or logging in with a passkey. (#19657, #19660)

5.11.2

• Improved the performance of loading project config data on PostgreSQL. (#19572)
• Added craft\helpers\StringHelper::containsNewlines().
• Added craft\services\ElementSources::CONTEXT_RESTRICTED_MODAL.
• Added craft\elements\db\EagerLoadPlan::$siteIds.
• Fixed a bug where nested Content Block fields’ content could be lost during a batched resave that included revisions. (#19543)
• Fixed a bug where Money and Number fields’ currency labels didn't line up with their inputs. (#19547)
• Fixed a bug where Structure entries’ “Parent” field could be populated with the parent entry from a different site than the one being edited. (#19576)
• Fixed a bug where the search input on the Users index page could be filled in automatically by LastPass. (#19584)
• Fixed a bug where public registration could fail when sending the activation email, if email verification wasn’t required but the password was deferred. (#19610)
• Fixed a bug where custom fields nested within Content Block fields weren’t editable from element indexes. (#19602)
• Fixed a bug where nested relational fields weren’t enforcing their “Validate related {type}” setting. (#19625)
• Fixed a bug where newly-created generated fields weren’t immediately available to card previews. (#19166)
• Fixed a high-severity SQL injection vulnerability. (GHSA-mjj9-pjh4-r48g)
• Fixed high-severity permission escalation vulnerabilities. (GHSA-r56r-f696-c8w9, GHSA-f6gf-r952-rxg6, GHSA-qcvp-ggx3-97r6)
• Fixed high-severity RCE vulnerabilities. (GHSA-qj3q-j7r4-428p, GHSA-9hp6-3565-gvh5)
• Fixed a high-severity information disclosure vulnerability. (GHSA-v4q3-2g5g-wjj6)
• Fixed a moderate-severity permission escalation vulnerability. (GHSA-v25r-wr32-jfg7)
• Fixed moderate-severity authorization bypass vulnerabilities. (GHSA-xpg7-m6gm-4xfh, GHSA-mp59-9rf5-93wr)
• Fixed a low-severity authorization bypass vulnerability. (GHSA-hvp5-pwxx-2752)
• Fixed a low-severity information disclosure vulnerability. (GHSA-5v62-pcq7-fxj9)

4.18.9

• Added craft\helpers\StringHelper::containsNewlines().
• Fixed a high-severity SQL injection vulnerability. (GHSA-mjj9-pjh4-r48g)
• Fixed high-severity permission escalation vulnerabilities. (GHSA-f6gf-r952-rxg6, GHSA-qcvp-ggx3-97r6)
• Fixed a high-severity information disclosure vulnerability. (GHSA-v4q3-2g5g-wjj6)
• Fixed a high-severity RCE vulnerability. (GHSA-9hp6-3565-gvh5)

5.11.1

• Added support for symfony/filesystem 7.x and 8.x. (#19538)
• Fixed a bug where passkeys created before updating to Craft 5.10 could no longer be used to log in. (#19530, #19536)
• Fixed a bug where eager-loaded native fields could be incorrectly returned as a collection via their magic properties. (#19537)

6.0.0-alpha.18

• Added configurable asset transformers, which can be managed from Settings → Assets → Asset Transformers and assigned to asset volumes by handle.
• Added CraftCms\Cms\Asset\AssetTransformers and CraftCms\Cms\Asset\AssetTransformDrivers.
• Added CraftCms\Cms\Config\GeneralConfig::$defaultAssetTransformer.
• Replaced Craft’s system status with Laravel maintenance mode, including an admin-only Maintenance Mode control in General Settings.
• Removed CraftCms\Cms\Config\GeneralConfig::$isSystemLive, app()->isLive(), and the core craft:on and craft:off commands. Deprecated compatibility remains available through craftcms/yii2-adapter.
• Moved the generateTransformsBeforePageLoad setting to Craft Asset Transformer profiles.
• Removed per-call immediate generation arguments from the core Asset Transform APIs and GraphQL transform arguments.
• Removed the core image transformer registry, contracts, fallback transformer, and execution methods from CraftCms\Cms\Image\ImageTransforms. Legacy equivalents remain available through craftcms/yii2-adapter.
• Improved environment variable and alias settings fields to show suggestions after typing $ or @, automatically bracing embedded environment variables.
• Improved new password fields to provide the configured password rules to supported password managers. (#19516)
• Element edit screens now autosave at the pace of the change — a keystroke waits, a discrete change saves almost immediately.
• Submitting an element edit screen now cancels any in-flight autosave, and a failed autosave reports its HTTP status.
• Element edit screens now indicate which fields a draft has unapplied changes to.
• Fixed a bug where the Control Panel loaded two copies of Lit, which could break rendering within legacy HTML controls.
• Fixed a bug where field layout changes weren’t saved on entry type settings screens.
• Fixed a bug where Typecast would throw when trying to set properties that didn’t exist. (#19492)
• Fixed a bug where POST requests to legacy action URLs weren’t getting routed properly. (#19478)
• Fixed a JavaScript error that occurred when creating a new Dashboard widget. (#19479)
• Fixed a bug where users without a local password could not start an elevated session using OAuth. (#19512)
• Fixed a bug where Yii log targets configured via config/craft/app.php did not receive messages logged with Craft::info() and related methods. (#19517)
• Moved filesystem URL settings to CraftCms\Cms\Filesystem\Filesystems\Local, with legacy filesystem compatibility remaining available through craftcms/yii2-adapter. (#19525)

5.11.0

Warning

GraphQL fields that return user data (author, authorId, authors, authorIds, draftCreator, revisionCreator, uploader, and uploaderId) are no longer available to schemas that don’t have “Query for users” enabled.

Content Management

• Asset alt text no longer gets propagated to all sites the first time it’s filled in. (#19067)

Development

• The params argument of the url() Twig function now accepts false to remove all params from the passed-in URL. (#19102)
• Added craft\web\DbSession, which should be used instead of yii\web\DbSession to prevent “headers already sent” warnings from getting logged. (#19139)
• Arrays created from craft\fields\data\LinkData objects now include type, value, url, label, filename, link, attributes, defaultLabel, elementType, elementId, elementSiteId, and elementTitle keys. (craftcms/element-api#201)

Extensibility

• Added craft\fieldlayoutelements\CustomField::$oldFieldUid.
• Added craft\fields\conditions\FieldConditionRuleInterface::getFieldUid().
• Added craft\helpers\ElementHelper::containsTempSlug().
• Added craft\helpers\Gql::canQueryAllUsers().
• Added craft\helpers\UrlHelper::removeAllParams(). (#19102)
• Added craft\helpers\UrlHelper::removeParams(). (#19102)
• Added craft\services\Config::doesEnvVarExist().
• Added craft\services\Elements::reorderNestedElements(). (#19321)
• Improved craft\helpers\App::parseEnv() behavior. (#19524, #19522)
• The $params argument of craft\helpers\UrlHelper::url() now accepts false to remove all params from the passed-in URL. (#19102)

System

• Added support for .well-known/passkey-endpoints requests. (#19364)
• The front-end login page no longer returns a redirect response for logged-in users, if it’s a preview request. (#19360)
• Improved queue job reservation performance when queues contain many large jobs. (#19097)
• Updated svg-sanitizer to 1.0.
• Updated Twig to 3.28.
• Updated yii2-debug to 2.1.28.
• Fixed a bug where craft\web\Controller::asModelSuccess() and asModelFailure() could include more data than expected. (#19469)
• Fixed a bug where eager-loading users’ addresses would also eager-load any addresses defined by custom Addresses fields.
• Fixed a bug where the primary site’s content wasn’t preferred when propagating a Single section’s entry to new sites. (#19473)
• Fixed a bug where asset bundles could be only partially published, if two requests attempted to publish and clear them concurrently. (#19477)
• Fixed a bug where propagated entries were getting URIs assigned based on their temporary slugs, if the section didn’t specify a URI format for the site the entry was initially saved in. (#19495)
• Fixed a bug where password managers could attempt to submit the TOTP 2FA form before the application was ready for it, causing the login page to reload. (#19497)
• Fixed an exception that was thrown if null was passed to an asset query’s uploader param. (#19484)
• Fixed a bug where cached GraphQL queries weren’t registering the original queries’ cache tags or cache expiration date. (#19508)
• Fixed a bug where the control panel could become non-interactive after a slideout was closed. (#9912, #19511)
• Fixed a bug where typing an environment variable name into a plugin’s license key input could result in multiple additions to the .env file, and cause the license key input to disappear. (#19518)
• Fixed an error that could occur when running the fields/auto-merge command. (#19519)
• Fixed a bug where passkeys created before updating to Craft 5.10 could no longer be used to log in. (#19530)
• Fixed an error that could occur when editing an element. (#17268)
• Fixed a bug where getEagerLoadedElements() wasn’t returning results for eager-loaded native fields, such as authors. (#19471)
• Fixed a bug where field condition rules within field layout components weren’t getting updated when a custom field was replaced within the layout. (#19515)
• Fixed high-severity RCE vulnerabilities. (GHSA-g48f-wc2q-4rrv, GHSA-wr79-9v6x-5rfq, GHSA-qm9x-rmcj-h2rc, GHSA-xmwr-88vw-5ghh)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-7rr3-4jcm-x526)
• Fixed a moderate-severity account hijack vulnerability. (GHSA-xh42-494x-2xgv)
• Fixed moderate-severity information disclosure vulnerabilities. (GHSA-pcmv-c398-gc5m, GHSA-4w9w-3x96-7ghp, GHSA-j697-8x93-7mp2)
• Fixed a low-severity information disclosure vulnerability. (GHSA-w643-x88w-6wcm)
• Fixed a low-severity RCE vulnerability. (GHSA-j6r9-fxgv-j7x5)

4.18.8

• Fixed a bug where cached GraphQL queries weren’t registering the original queries’ cache tags or cache expiration date. (#19508)
• Fixed a high-severity RCE vulnerability. (GHSA-xmwr-88vw-5ghh)
• Fixed a moderate-severity information disclosure vulnerability. (GHSA-j697-8x93-7mp2)
• Fixed a low-severity information disclosure vulnerability. (GHSA-w643-x88w-6wcm)

6.0.0-alpha.17

• Improved template resource cache collection by replaying structured HTML stack entries without parsing rendered tags.
• Changed CraftCms\Cms\Auth\Passkeys\Passkeys::verifyPasskey() to return the updated credential record on success.
• Changed GraphQL AST value decoding to use webonyx/graphql-php while preserving Craft-specific query condition validation.
• Improved element queries to retain only explicitly supplied custom-field criteria.
• Improved CraftCms\Cms\Form\FormResolver performance by indexing control paths and node UIDs for membership checks.
• Added CraftCms\Cms\Http\ResponseHeaders and CraftCms\Cms\Support\Facades\ResponseHeaders for accumulating response headers within the current request scope.
• Improved job progress persistence by using an atomic upsert.
• Changed CraftCms\Cms\Support\Json::decode() to use exception-based JSON decoding.
• Changed craft:db:drop-all-tables to use Laravel’s schema API.
• Replaced the asset index lifecycle flags with CraftCms\Cms\Asset\Enums\AssetIndexStatus and explicit status transitions.
• Added CraftCms\Cms\Plugin\Plugin::settingsForm() for defining standard plugin settings pages with the Control Panel Form system. (#19439)
• Removed CraftCms\Cms\Plugin\Plugin::settingsHtml(). settingsForm() should be used instead; Yii-era plugin settings HTML remains supported by craftcms/yii2-adapter. (#19439)
• Safe HTML elements are now allowed within Markdown field layout elements. (#19426)
• Added a slideout system for the Inertia/Vue Control Panel, which renders any CpScreenResponse-based screen as an in-page panel from a normal Inertia response, alongside the existing legacy Craft.CpScreenSlideout. (#19354)
• Added CraftCms\Cms\Http\Responses\CpScreenResponse::screenData(). (#19354)
• Removed the Pane.vue Vue component in favor of the craft-pane web component. (#19398)
• Element edit screens now autosave when the form’s values actually differ from the server’s, rather than whenever a control reports a change.
• Improved structure mutation reliability by representing each pending change as a single immutable operation.
• Improved Project Config change event handler registration by keeping callbacks and ordering metadata together.
• Fixed a bug where Table field column handles became arrays after failed validation.
• Fixed a bug where nested or concurrent searches could overwrite another search’s parser state.
• Fixed a bug where cached user permission trees could become stale after permission changes or be modified by assignability filtering.
• Fixed inconsistent handling of forced-disabled plugin configuration values.
• Fixed a bug where CraftCms\Cms\Edition capability checks could report capabilities from the configured edition rather than the receiver.
• Fixed a bug where throwing validation could run the validation lifecycle twice.
• Fixed a bug where CraftCms\Cms\Element\ElementCollection::with() could pass incompatible element classes into eager loading.
• Fixed a bug where cache options and tags registered via CraftCms\Cms\Utility\Utilities\ClearCaches::add() and addTag() were unavailable as Artisan commands.
• Fixed a JavaScript error that occurred on non-Inertial pages that rendered field layout designers. (#19380)
• Fixed a bug where Yii asset bundles registered with craft\web\View::registerAssetBundle() during plugin initialization were not included in rendered pages. (#19393)
• Fixed a bug where legacy asset bundle dependencies could be rendered after their dependent resources when using craftcms/yii2-adapter. (#19394)
• Fixed an error that occurred when config/craft/app.web.php or config/craft/app.console.php was present.
• Fixed a bug where jobs run on the sync queue could remain marked as reserved after completing. (#19431)
• Fixed a bug where Addresses fields weren’t reading the value posted by the Control Panel form, so removing every address didn’t stick and blank addresses could be created. (#19432)
• Fixed a bug where newly-added Matrix entries and addresses showed a spinner indefinitely in the Inertia/Vue element editor, rather than their fields.
• Fixed a bug where opening an element edit page with a Money field immediately created a provisional draft, before anything had been edited.
• Fixed a bug where the jobprogress table was missing dateCompleted and dateFailed columns for installs that were upgraded from Craft 5.
• Fixed a bug where failed queue jobs were losing their descriptions. (#19444)
• Fixed a bug where queue job details in the Queue Manager utility included “Error” and timestamp values even if they were null.

5.10.14

• Fixed a bug where entries could deadlock when saving their authors. (#15768)
• Fixed an error that could occur when upgrading to Craft 5. (craftcms/commerce#4309)
• Fixed a bug where overridden entry type handles weren’t being prioritized when rendering partial templates. (#18968)
• Fixed high-severity RCE vulnerabilities. (GHSA-5m2g-hhqr-84pc, GHSA-vfcw-xv8p-8rj2)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-4wfw-q5w3-jh42)
• Fixed a low-severity XSS vulnerability. (GHSA-w5rh-mhxj-wr8r)
• Fixed a low-severity information disclosure vulnerability. (GHSA-j5wg-m2pr-35qc)

4.18.7

• Fixed a high-severity RCE vulnerability. (GHSA-5m2g-hhqr-84pc)
• Fixed a low-severity information disclosure vulnerability. (GHSA-j5wg-m2pr-35qc)