Cms Laravel Package

• Fixed a bug that prevented third party nested element types from being editable. (#19898)

[!IMPORTANT] This update contains breaking changes for plugins. See #19574, #19563, #19588, #19585, and #19650 for details.

Control Panel UI

• Added inline editing to element index tables. (#19759)
• Added exports to element indexes. (#19759)
• Control panel success, notice, and error messages now go through a single message system instead of several different ones, and are no longer shown twice or lost between pages.
• Messages now stack, newest first, and spread out on hover or focus. A “Skip to messages” link reaches them from the keyboard. They can be swiped away, errors and messages with actions stay until dismissed, and errors are announced to screen readers immediately.
• Improved element index searches to update results as users type. (#19754)
• Added support for controller actions and named Laravel routes in section and Matrix site settings. (#19762)
• Rearranged and cleaned up the control panel’s page shell layout, with improved mobile support. (#19648)
• Control panel pages can now set contentMaxWidth and centerContent options. (#19648)
• Added flyout menus to the global control panel nav, for accessing sub-pages of non-selected sections. (#19648)
• Added close buttons to element detail tabs. (#19648)
• Element editor slideouts now have action menus and “Open in a new tab” buttons. (#19748)
• Removed the legacy control panel stylesheet from Inertia pages. (#19648)
• ElementEditor now supports rendering as a full page in addition to a slideout. (#19648)
• Improved the overall accessibility of the control panel. (#19699)
• Improved the accessibility of element indexes. (#19520, #19749)
• Replaced core inline element editing inputs with Form API controls rendered by Vue, with plugin field HTML compatibility handled by the Yii adapter. (#19590)
• Improved the styling for collapsible field groups.
• Improved the layout and dark mode styling of user edit screens. (#19765)
• Improved the styling of control panel tables and lightswitches. (#19766)
• Improved disabled secondary form actions with explanatory tooltips.
• The “Assets” system settings nav item is now listed under “Content”, and “Globals”, “Categories”, and “Tags” are now listed under a new “Deprecated” heading, if those concepts are supported for the project. (#19670)
• Added reusable server-built form modals and the formModal element action behavior. (#19768)
• Added optional sidebarForm and metadataHtml props to Form.vue pages, allowing sidebar controls to be saved alongside the main form. (#19778)
• Added support for CraftCms\Cms\Http\Responses\CpScreenResponse::addAltAction() submissions on Inertia Form pages and slideouts. (#19779)
• Added the <craft-timeline-item> web component. (#19629)
• Added the placeholder property to <craft-thumbnail>, for an image to show while the thumbnail loads. (#19750)
• Added CraftCms\Cms\Form\Controls\Combobox\CreateOption for creating and selecting resources in comboboxes, including user photo volumes. (#19777)
• Added the --c-thumbnail-image-radius custom property to <craft-thumbnail>, and its other custom properties can now be set on an ancestor. (#19758)
• Content in <craft-chip>’s prefix slot no longer replaces its thumbnail, icon, and status; it’s shown before them. (#19758)
• Migrated the reassign entries, replace relations, and replace references modals to the Form API. (#19589)
• Added CraftCms\Cms\Form\Nodes\Callout::padding(), supported by PHP and Vue form rendering. (#19773)
• Restored Score sorting for element index searches and preserved previous sort fields as tie-breakers. (#19731)

Assets

• Migrated Control Panel uploads to the native Uppy picker and shared upload sessions, including user photos.
• Added support for upload sessions, tus and direct S3 multipart transports, and an extensible JavaScript upload API. (#19604)
• Added background uploads in the Assets index that continue during Control Panel navigation, with persistent progress, retry, cancellation, and filename-conflict controls.
• The image editor now supports Undo/Redo. (#19600)
• Added crop, fit, stretch, and letterbox modes to craft-thumbnail, and removed size-dependent asset thumbnail cropping.
• Added a “Revert to original” button to the image editor. (#19600)
• Image assets now store color data sampled from their file when it’s uploaded, replaced, or indexed, including the image’s dominant color and a grid of the average colors of its regions. (#19740, #19750)
• Asset edit sidebars now fill the space around image previews with a gradient between the colors of the image’s left and right edges. (#19740, #19750)
• Image thumbnails and previews in the control panel now show a blurred placeholder based on the image’s colors while they load. (#19750)
• Control panel uploads now sample image colors in the browser and send them along, so the server doesn’t need to sample the file itself. (#19751)
• <img> tags returned by CraftCms\Cms\Asset\Elements\Asset::getImg() now have a blurred placeholder as their background, unless the image has transparent regions. (#19750)
• Image assets now have BlurHash strings, available via asset.blurhash in templates and the blurhash field in GraphQL queries. (#19755)
• Added the blurhash, colors, and placeholderDataUrl fields to assets in GraphQL queries. (#19740, #19750, #19755)
• Added an optional $mode argument to core thumbnail APIs, defaulting to Fit for thumbnail HTML and Crop for CraftCms\Cms\Asset\Assets::getThumbUrl(). Implementations of CraftCms\Cms\Component\Contracts\Thumbable and CraftCms\Cms\Field\Contracts\ThumbableFieldInterface, and overrides of thumbnail layout methods and thumbUrl(), must update their signatures for Craft 6, including through existing Yii aliases; existing calls remain valid. The Yii Assets service wrapper and legacy thumbnail event are unchanged.
• Added CraftCms\Cms\Asset\Elements\Asset::$colors. (#19740, #19750)
• Added CraftCms\Cms\Asset\Elements\Asset::getBlurhash(). (#19755)
• Added CraftCms\Cms\Asset\Elements\Asset::getPlaceholderDataUrl(). (#19750)
• Added CraftCms\Cms\Asset\Elements\Asset::$uploadColors. (#19751)
• Added CraftCms\Cms\Image\Blurhash. (#19755)
• Added CraftCms\Cms\Image\ColorGrid. (#19755)
• Added CraftCms\Cms\Image\Data\ImageColors. (#19740, #19750)
• Added CraftCms\Cms\Image\Images::colors(). (#19740, #19750)
• Changed users/upload-user-photo to start an upload session using JSON file metadata instead of multipart file data.
• Removed the assets/upload and assets/replace-file multipart endpoints and legacy uploader events and overrides.

Conditions

• Added support for nested condition groups. (#19587)
• Removed the “Show unpermitted entries” setting from Entries, Link, and Markdown fields, in favor of the “Viewable” condition rule in the “Selectable Entries Condition” setting. (#19611, #19622)
• Removed the “Show unpermitted files” and “Allowed File Types” settings from Assets, Link, and Markdown fields, in favor of “Viewable” and “File Type” condition rules in the “Selectable Assets Condition” setting. (#19611, #19622)
• Added a “Selectable {Type} Condition” setting to Link and Markdown fields’ Entry and Asset link types. (#19622)
• Added CraftCms\Cms\Condition\BaseConditionGroup. (#19587)
• Added CraftCms\Cms\Condition\ConditionBuilderPayload. (#19587)
• Added CraftCms\Cms\Condition\ConditionBuilderRenderer. (#19587)
• Added CraftCms\Cms\Condition\ConditionBuilder. (#19587)
• Added CraftCms\Cms\Condition\ConditionRulePayload. (#19587)
• Added CraftCms\Cms\Condition\Contracts\ConditionComponentInterface. (#19587)
• Added CraftCms\Cms\Condition\Contracts\ConditionGroupInterface. (#19587)
• Added CraftCms\Cms\Condition\Contracts\ConditionInterface::createGroup(). (#19587)
• Added CraftCms\Cms\Condition\Contracts\ConditionRuleInterface::getForm(), which replaces getHtml(). (#19588)
• Added CraftCms\Cms\Condition\Contracts\ConditionRuleInterface::isSelectableForCondition(). (#19563)
• Added CraftCms\Cms\Condition\Enums\GroupOperator. (#19587)
• Added CraftCms\Cms\Element\Conditions\Contracts\ElementQueryConditionRuleInterface, which element condition rules that modify element queries should now implement. (#19563)
• Added CraftCms\Cms\Element\Conditions\ElementCondition::$forQuery. (#19563)
• Added CraftCms\Cms\Element\Conditions\ElementCondition. (#19587)
• Removed CraftCms\Cms\Condition\Contracts\ConditionRuleInterface::getHtml(). getForm() must be implemented instead. (#19588)
• Removed CraftCms\Cms\Element\Conditions\Contracts\ElementConditionRuleInterface::getExclusiveQueryParams() and modifyQuery(). ElementQueryConditionRuleInterface::modifyQuery() should be implemented instead, which now accepts the underlying query builder directly. (#19563)
• Removed CraftCms\Cms\Element\Conditions\ElementCondition::$queryParams. (#19563)

Fields

• Added a “Default Row Values” setting to Table fields. (#3621)
• Added support for disabling Matrix entries for individual sites. (#19686)
• Restored Matrix fields’ configured Cards and Cards Grid view modes in element forms.
• Restored Matrix fields’ configured Index view mode in element forms.
• CraftCms\Cms\Field\Contracts\FieldInterface::modifyQuery() now accepts an Illuminate\Database\Query\Builder object for its $query argument, and has a new CraftCms\Cms\Element\Queries\Contracts\ElementQueryInterface $elementQuery argument, and a void return type. (#19562, #19585)
• Moved legacy relation-field settings HTML and entry-title input HTML into the Yii adapter. (#19591)
• Restored “Copy value from site” functionality. (#19683)

Entries & Sections

• Added the “Show the Post Date field” and “Show the Expiry Date field” entry type settings. (#17675)
• Entry types’ Color fields now show a dropdown menu. (#19760)

Workflows

• Added publishing workflows, which control when drafts may be applied to entries. Workflows are configured from Settings → Workflows and assigned to sections. (Craft Pro and Enterprise only.) (#19667)
• Changes to enabled entries in sections with a workflow are now saved as drafts, which must be submitted for review and approved by each workflow stage before they can be applied. (#19667)
• Added the “User Review” workflow stage type, which supports per-group approval requirements, carried-over approvals, change requests, and email notifications for reviewers. (#19667)
• Added a “Workflow” element details tab, for submitting drafts for review, reviewing them, and viewing workflow activity history. (#19667)
• Added CraftCms\Cms\Workflow\Contracts\WorkflowStageInterface and CraftCms\Cms\Workflow\Stages\WorkflowStage, for creating custom workflow stage types. (#19667)
• Added CraftCms\Cms\Workflow\WorkflowStageTypes, for registering custom workflow stage types. (#19667)
• Added CraftCms\Cms\Workflow\Contracts\WorkflowableInterface, which element types can implement to support workflows. (#19667)
• Added CraftCms\Cms\Workflow\Workflows and CraftCms\Cms\Support\Facades\Workflows. (#19667)
• Added the CraftCms\Cms\Workflow\Events\WorkflowTransitioning, WorkflowTransitioned, and WorkflowCommented events. (#19667)

Elements

• Added the autoEagerLoadElements general config setting (true by default), which determines whether element queries should be automatically lazy eager-loaded. (#19637)
• Added Markdown comments to element activity timelines, with support for editing, removing, structured user mentions, and email notifications.
• Added CraftCms\Cms\Activity\Contracts\ShouldBeRetained, allowing activity event types such as comments to opt out of activity garbage collection.
• Restored expand/collapse and drag interactions on structure element index views. (#19691)

Users & Auth

• Added support for sending queued Laravel notifications to CraftCms\Cms\User\Elements\User elements. (#19541)
• Added the authGuard and authPasswordBroker general config settings, allowing Craft authentication to use a dedicated Laravel guard, provider, and password broker. (#19598)

Filesystems

• Removed Craft-managed filesystems and their control panel settings. Volumes and Craft asset transformers now reference Laravel filesystem disks configured in config/filesystems.php, and each defines whether its assets have public URLs. Existing filesystem references are migrated to matching disks automatically, with an actionable error if a disk isn’t configured. (#19650)
• Added CraftCms\Cms\Asset\Models\Volume::$hasUrls, which determines whether the volume’s assets have public URLs. (#19650)
• Added CraftCms\Cms\Config\GeneralConfig::$uploadSessionDisk and getUploadSessionDisk(), which determine the disk used to stage upload sessions. (#19650)
• Renamed CraftCms\Cms\Config\GeneralConfig::$tempAssetUploadFs to $tempAssetUploadDisk, and getTempAssetUploadFs() to getTempAssetUploadDisk(), which now reference a Laravel filesystem disk exclusively. (#19650)
• Renamed CraftCms\Cms\Cp\SelectOptions::getFsOptions() to getDiskOptions(), which now returns Laravel filesystem disk options exclusively. (#19650)
• Removed CraftCms\Cms\Asset\Assets::getTempAssetUploadFs() and CraftCms\Cms\Asset\AssetsHelper::isTempUploadFs(). Assets::getTempAssetUploadDisk() should be used instead, which now returns a Laravel filesystem disk. (#19650)
• Removed CraftCms\Cms\Cp\Components\FilesystemSelect and CraftCms\Cms\Form\Controls\FilesystemSelect. (#19650)
• Removed CraftCms\Cms\Filesystem\Filesystems, FilesystemTypes, Contracts\FsInterface, Filesystems\Filesystem (and its DiskFilesystem, Local, MissingFs, and Temp implementations), Resources\FsResource, Events\FilesystemRenamed, and CraftCms\Cms\Support\Facades\Filesystems. Laravel filesystem disks should be configured and referenced directly instead; Craft filesystem types registered through craft\base\Fs remain supported for legacy plugins via the Yii adapter. (#19650)
• Removed CraftCms\Cms\Http\Controllers\Settings\FilesystemsController and CraftCms\Cms\Http\ViewModels\FilesystemsEditViewModel, along with the Filesystems control panel settings page. (#19650)
• Removed CraftCms\Cms\Plugin\Concerns\HasFilesystemTypes. Plugins can no longer register custom Craft filesystem types. (#19650)

Plugins & Extensibility

• Added CraftCms\Cms\Form\Controls\Text::suffix() for display-only suffix text in PHP and Vue form controls. (#19770)
• Added CraftCms\Cms\Element\Data\ElementSiteSettings, the shared base for element URI and route settings. (#19762)
• Added support for fluent plugin settings classes. (#19574)
• Added support for refreshable standard plugin settings forms and conditional configuration of core form nodes. (#19545)
• Added CraftCms\Cms\Form\Nodes\Group::expanded(), allowing collapsible section groups to start expanded in Vue and HTML forms. (#19772)
• Added CraftCms\Cms\Route\CurrentElement, a contextual attribute for injecting the matched element into controller actions and route closures. (#19762)
• Added CraftCms\Cms\Contracts\PluginInterface::createSettings(), which replaces createSettingsModel(). (#19574)
• Added CraftCms\Cms\Dashboard\Widgets\Widget::component() and props(), which replace getBodyHtml(). (#19564)
• Added CraftCms\Cms\Support\Url::stripCpTrigger(). (#19724)
• CraftCms\Cms\Support\Url::removeParam() now accepts an array of param names. (#19724)
• Removed CraftCms\Cms\Contracts\PluginInterface::createSettingsModel(). createSettings() must be implemented instead. (#19574)
• Removed CraftCms\Cms\Dashboard\Widgets\Widget::getBodyHtml(). component() and props() must be implemented instead. (getBodyHtml() remains supported through the Yii adapter.) (#19564)
• Removed CraftCms\Cms\Support\Url::baseUrl(), cpHost(), encodeParams(), host(), isFullUrl(), removeParams(), and rootRelativeUrl(). (They remain available on craft\helpers\UrlHelper through the Yii adapter.) (#19724)
• Added Cp.$elementDetailsTabs, allowing plugins to register control panel element-details tabs. (#19646)
• Added CraftCms\Cms\Support\Flash::all(), make(), and push(), and a $target argument to Flash::success(), error(), and notice() for showing a message in an inline outlet rather than the default message display.
• Added the messages Inertia shared prop, which carries every flashed control panel message with its type, settings, and id.
• Added useMessages() and useMessageOutlet() for showing control panel messages from Vue, and the craft-message window event for showing them from anywhere else.
• asSuccess() and asFailure() JSON responses now include a messages list on control panel requests, and asSuccess() no longer also flashes the message to the session for JSON responses.
• asFailure() now flashes its message even when the response has validation errors.
• Deprecated the flash Inertia shared prop. messages should be used instead.
• Removed useFlash(), useFlashMessages(), and the FlashMessages Vue component. useMessages() should be used instead.
• Stopped loading the deprecated XRegExp library by default. Plugins that require it can register craft\web\assets\xregexp\XregexpAsset. (#19621)

System

• Improved performance of element queries, control panel rendering, asset transforms, date formatting, and queue status checks, and fixed related SQLite index and timezone issues.
• Added CraftCms\Cms\ProjectConfig\ProjectConfig::getPendingChanges().
• Replaced the project config implementation with separate change handling, storage, and rebuild components.
• Removed HTMX.
• Base site URLs, including url(''), siteUrl(''), and homepage URLs, now respect the addTrailingSlashesToUrls config setting, so they no longer end with a trailing slash by default. The siteUrl Twig variable still always ends with a trailing slash. (#19723)
• Fixed CraftCms\Cms\Support\Env::parse() to preserve unknown aliases rather than throw an exception. (#19535)
• Fixed a bug where validating filesystem attributes could resolve CraftCms\Cms\Filesystem\Filesystems\Filesystem::getRootUrl(). (#19535)
• Fixed a bug where nested Content Block fields’ content could be lost during a batched resave that included revisions. (#19543)
• Fixed a bug where resave and update-statuses commands reported skipped revisions as root element lookup errors.
• Fixed a bug where visiting the logout path while signed out would store it as the post-login redirect, so signing in would immediately sign the user back out. (#19551)
• Fixed a bug where submitting a form after signing in through an elevated or expired session modal could fail CSRF validation.
• Fixed a bug where authenticated control panel requests to Yii2 adapter controller actions were treated as unauthenticated. (#19556)
• Fixed a bug where save errors using shortened field paths could fail to appear on Controls within nested Forms. (#19565)
• Fixed a bug where failed plugin installation or uninstallation could leave project config writable. (#19566)
• Fixed a bug where cached template resolution could ignore the current site, registered template roots, or lookup options. (#19568)
• Fixed a bug where orphan cleanup could delete the wrong rows for composite foreign keys. (#19568)
• Fixed a bug where deleting a site could transfer its content despite selecting the delete option. (#19568)
• Fixed a bug where object templates could render through an outdated Twig environment or behave differently after caching. (#19568)
• Fixed a bug where preparing Composer changes could leave composer.json partially modified after a failure. (#19568)
• Fixed a bug where worker events or progress updates could reactivate cancelled queue jobs. (#19568)
• Fixed a bug where cached search term normalization could use the wrong language. (#19568)
• Fixed a bug where nested Twig namespace tags or exceptions could leave the wrong input namespace active. (#19568)
• Fixed decimal rounding errors involving high-precision values, scientific notation, and negative numbers. (#19568)
• Fixed a bug where generating a URL for another site could leave that site selected after an exception. (#19568)
• Fixed a bug where percentage formatting could lose decimal precision during multiplication. (#19568)
• Fixed a bug where nested cache collection could extend expiration deadlines or ignore expired dependencies. (#19568)
• Fixed a bug where support request emails could omit errors encountered while preparing their attachments. (#19568)
• Fixed a bug where parallel test cleanup could delete another worker’s files. (#19568)
• Fixed a bug where command-line update listings could evaluate update criticality more than once using incomplete update information. (#19568)
• Fixed a bug where preparing a control panel response could discard or leak an input namespace. (#19568)
• Fixed a bug where screen rendering could generate action menu items twice, producing duplicate events or inconsistent action IDs. (#19568)
• Fixed a bug where indexing large asset volumes could exceed memory or database parameter limits. (#19568)
• Fixed a bug where asset folder lookups could return stale or inconsistent results after folders were saved or deleted. (#19568)
• Fixed a bug where concurrent image downloads could delete each other’s temporary files, and failed downloads could leave temporary files behind. (#19568)
• Fixed a bug where loading an image transform index could lose its output format. (#19568)
• Fixed a bug where asset factories could create assets and their folders in different volumes. (#19568)
• Fixed a bug where Money field conditions could compare incorrect units or lose precision. (#19568)
• Fixed a bug where numeric conditions could ignore zero-valued bounds. (#19568)
• Fixed a bug where splitting relation criteria could discard field and source site restrictions. (#19568)
• Fixed a bug where cached field layouts could retain outdated custom field handles or identities. (#19568)
• Fixed a bug where Link fields could lose labels and attributes during normalization or localization. (#19568)
• Fixed a bug where generated field propagation could retain old element state and run during later element operations. (#19568)
• Fixed a bug where validation errors could replace generated field handles and cause subsequent validation failures. (#19568)
• Fixed a bug where JSON fields could misinterpret valid objects containing __ERROR__ or __VALUE__ keys. (#19568)
• Fixed a bug where repairing a field layout UID could undo repairs to its tab and element UIDs. (#19568)
• Fixed a bug where field usage metadata could lose field layout UIDs and produce incorrect links or empty groups. (#19568)
• Fixed a bug where queued resaves could handle null field defaults differently from inline resaves. (#19568)
• Fixed a bug where duplicating an entry could apply submitted changes to the original entry. (#19568)
• Fixed a bug where the first access to lazily loaded entry authors could return no authors. (#19568)
• Fixed a bug where entries deleted with their entry type or section could fail to be restored with it. (#19568)
• Fixed a bug where removing supported sites from a section could leave obsolete entry site data. (#19568)
• Fixed a bug where sections’ site settings tables didn’t have status switches.
• Fixed a bug where creating a section from the command line could ignore a selected existing entry type. (#19568)
• Fixed a bug where element queries could select the wrong site variant when requesting unique results across sites. (#19568)
• Fixed a bug where bulk duplication could save partial results after a validation failure. (#19568)
• Fixed a bug where element indexes could select automatic sources outside their available source collection. (#19568)
• Fixed a bug where element indexes could discard the selected source’s status criteria. (#19568)
• Fixed a bug where component overrides could affect other instances of the same component. (#19568)
• Fixed a bug where element query results could eager-load relations twice. (#19568)
• Fixed a bug where cloned element queries could use callbacks that still read criteria from the original query. (#19568)
• Fixed a bug where failed structure moves could leave locks held and block subsequent operations. (#19568)
• Fixed an error that occurred when deeply duplicating descendants. (#19568)
• Fixed database errors and incorrect ordering when repairing structures. (#19568)
• Fixed a bug where structure repair previews could differ from the repairs that would be applied. (#19568)
• Fixed a bug where user group metadata could be saved before permission elevation was checked. (#19568)
• Fixed a bug where rejected user permission changes could leave some permissions updated. (#19568)
• Fixed a bug where verification email delivery addresses could alter account identity or be lost when notifications were queued. (#19568)
• Fixed inconsistent account eligibility checks when signing into the control panel with OAuth. (#19568)
• Fixed a bug where named OAuth providers could overwrite each other’s configuration. (#19568)
• Fixed a bug where failed account updates could leave in-memory account state inconsistent with persisted data. (#19568)
• Fixed a bug where failed filesystem resolution could leave a previously generated disk available with outdated configuration. (#19568)
• Fixed inconsistent plugin license statuses, issues, and trial information when reading cached metadata. (#19568)
• Fixed a bug where nested GraphQL mutation inputs could affect how sibling inputs were normalized. (#19568)
• Fixed a bug where switching GraphQL schemas could reuse types, arguments, or loaders from the previous schema. (#19568)
• Fixed a bug where resetting generated GraphQL state could unnecessarily invalidate cached query results. (#19568)
• Fixed a bug where removing false, zero, or empty-string project config values could leave their database rows behind.
• Fixed a bug where saving project config repeatedly could persist the same changes more than once. (#19568)
• Fixed a bug where project config path processing state could leak between application instances. (#19568)
• Fixed an error that could occur when creating relation fields. (#19571)
• Fixed a bug where no confirmation dialog was shown when deleting entry types and custom fields. (#19582)
• Fixed user photo asset selections not being saved, and restricted the photo selector to images in the configured volume and subfolder. (#19603)
• Fixed a bug where field types could remain unchanged or switch to an unintended option when their combobox query was submitted with Return. (#19614)
• Fixed a bug where brand icons, including the Markdown field type icon, were not displayed in combobox options. (#19614)
• Fixed a bug where creating an entry type from an entry type select field opened an empty slideout. (#19617)
• Fixed a bug where unpaginated Inertia admin tables could show nonfunctional pagination controls. (#19618)
• Fixed a bug where Save and continue editing left newly created control panel items on their creation page. (#19619)
• Fixed a bug where the “Structure” sorting option was missing from structure element indexes. (#19620)
• Fixed a bug where Asset link type settings were ignored by Link and Markdown fields. (#19623)
• Fixed duplicate plus icons on user management actions. (#19627)
• Fixed a bug where Markdown fields could collapse when initialized inside hidden containers. (#19635)
• Fixed a bug where the account navigation sidebar was missing when editing a user. (#19643)
• Fixed a bug where saved drafts without canonical elements were missing from element indexes. (#19649)
• Fixed a bug where Matrix Index views could show content from the wrong site.
• Fixed a bug where reopening a Matrix entry from an Index view could show its canonical content instead of the owner draft’s content.
• Fixed an error that occurred when upgrading to Craft 6. (#19658)
• Fixed a bug where users in single-site installations could be denied access to localized elements because they lacked an unavailable site permission. (#19666)
• Fixed a bug where unsaved drafts could not be deleted from element indexes. (#19668)
• Fixed a bug where modifier-clicking or middle-clicking on some control panel links wasn’t opening the link in a new tab.
• Fixed a bug where modifier-clicking or middle-clicking the New Entry button didn’t open the creation page in a new tab. (#19669)
• Fixed an error that occurred when loading the Users index if a user belonged to a user group. (#19673)
• Fixed an error that could occur when rendering element table rows with strict Twig variables enabled. (#19679)
• Fixed an error that occurred when moving folders directly beneath an asset volume’s root folder. (#19680)
• Fixed a bug where folders in the Assets index couldn’t be selected, created, renamed, moved, or deleted. (#19682)
• Fixed a bug where assets and folders couldn’t be moved by dragging them onto a folder in the Assets index. (#19682)
• Fixed a bug where clicking a folder in the Assets index didn’t navigate into it or keep the breadcrumbs in sync. (#19682)
• Fixed a bug where the Assets index search couldn’t be expanded to include subfolders. (#19682)
• Fixed a bug where Shift+Space didn’t preview the selected file in the Assets index. (#19682)
• Fixed a bug where the “Preview file” modal was unstyled.
• Fixed a bug where clicking an asset in the Assets index didn’t open its editor. (#19682)
• Fixed a bug where the Assets index’s folder dialogs could render behind other overlays, lose their centering, or not focus their name field. (#19682)
• Fixed multiple bugs with Table fields, including new columns moving or defaulting to Checkbox, settings rows not being draggable, and element edit forms failing when the field value was null. (#19687)
• Fixed a bug where combobox fields rendered through the Form API displayed their label twice. (#19694)
• Fixed a bug where visually-hidden labels, headings, and status messages were visible on some control panel pages.
• Fixed a bug where saving an element draft could send a redundant autosave request. (#19704)
• Fixed a bug where pressing Ctrl/Cmd + S in a slideout could also save the page behind it. (#19705)
• Fixed various bugs with Customize Sources modals. (#19713)
• Fixed an error that could occur when saving elements, if their field layouts still referenced legacy component classes. (#19719)
• Fixed an error that could occur when rendering field settings.
• Fixed a bug where migrations that wrote to the project config had to be defensive about its readOnly state. (#19726)
• Fixed a bug where Shift-selecting a shorter range didn’t deselect items outside the new range. (#19727)
• Fixed a bug where select inputs could lose their selected value if their options were loaded asynchronously. (#19728)
• Fixed a bug where table rows could stop being draggable after their reorder handles were replaced. (#19729)
• Fixed a bug where plugin-provided download element actions didn’t trigger file downloads from element indexes. (#19730)
• Fixed a bug where asset indexing left temporary copies of remote images behind. (#19740)
• Fixed a bug where uploaded and replaced assets’ modification dates came from their temporary files rather than the stored files.
• Fixed an accessibility issue where the Date, Time, and Time zone inputs within <craft-input-date-time> didn’t have individual accessible names. (#19741)
• Fixed a bug where the Delete element action reported success when some elements couldn't be deleted. (#19743)
• Fixed a bug where element index sort direction buttons did nothing. (#19744)
• Fixed an error in the Yii adapter during installation or updates when CRAFT_SITE or X-Craft-Site referenced a missing site. (#19745)
• Fixed a bug where the Edit and View bulk actions did nothing on element indexes. (#19747)
• Fixed an error that occurred when using an icon picker. (#19752)
• Fixed a validation error that occurred when saving an entry type with a color. (#19753)
• Fixed a validation error that occurred when saving a Color field with no color palette, even if “Allow custom colors” was enabled.
• Fixed a bug where element index selection ranges could use a stale anchor after clearing selection or switching view modes. (#19754)
• Fixed a bug where element index searches could move keyboard focus after a page load. (#19754)
• Fixed a bug where element selector modals could display results from an outdated request. (#19754)
• Fixed a bug where element selector modals requested search results on every keystroke. (#19754)
• Fixed a bug where element chips didn’t show their status indicators, and their thumbnails weren’t sized, spaced, or centered for the chip. (#19758)
• Fixed a bug where money inputs could be hidden within fields or submit their values under the wrong name. (#19767)
• Fixed a bug where reactive controls in element editors didn’t refresh their field layouts, including nested form scopes. (#19769)
• Fixed a bug where Form API field instructions displayed Markdown and inline HTML as plain text in Vue forms. (#19771)
• Fixed a bug where <craft-callout> boxes didn’t span all columns in grid layouts. (#19773)
• Fixed a bug where <craft-input> fields with a maxlength weren’t sized to fit it, which made the element index pagination’s page input overlap the “Next page” button.
• Fixed a bug where condition builders passed raw condition values to form change listeners. (#19774)
• Fixed a bug where failed settings saves could lose input and validation errors when a successful save would redirect to another page. (#19775)
• Fixed a bug where card designer previews could fail to render because the preview request omitted the element type. (#19776)

• Improved template resource cache collection by replaying structured HTML stack entries without parsing rendered tags.
• Changed CraftCms\Cms\Auth\Passkeys\Passkeys::verifyPasskey() to return the updated credential record on success.
• Changed GraphQL AST value decoding to use webonyx/graphql-php while preserving Craft-specific query condition validation.
• Improved element queries to retain only explicitly supplied custom-field criteria.
• Improved CraftCms\Cms\Form\FormResolver performance by indexing control paths and node UIDs for membership checks.
• Added CraftCms\Cms\Http\ResponseHeaders and CraftCms\Cms\Support\Facades\ResponseHeaders for accumulating response headers within the current request scope.
• Improved job progress persistence by using an atomic upsert.
• Changed CraftCms\Cms\Support\Json::decode() to use exception-based JSON decoding.
• Changed craft:db:drop-all-tables to use Laravel’s schema API.
• Replaced the asset index lifecycle flags with CraftCms\Cms\Asset\Enums\AssetIndexStatus and explicit status transitions.
• Added CraftCms\Cms\Plugin\Plugin::settingsForm() for defining standard plugin settings pages with the Control Panel Form system. (#19439)
• Removed CraftCms\Cms\Plugin\Plugin::settingsHtml(). settingsForm() should be used instead; Yii-era plugin settings HTML remains supported by craftcms/yii2-adapter. (#19439)
• Safe HTML elements are now allowed within Markdown field layout elements. (#19426)
• Added a slideout system for the Inertia/Vue Control Panel, which renders any CpScreenResponse-based screen as an in-page panel from a normal Inertia response, alongside the existing legacy Craft.CpScreenSlideout. (#19354)
• Added CraftCms\Cms\Http\Responses\CpScreenResponse::screenData(). (#19354)
• Removed the Pane.vue Vue component in favor of the craft-pane web component. (#19398)
• Element edit screens now autosave when the form’s values actually differ from the server’s, rather than whenever a control reports a change.
• Improved structure mutation reliability by representing each pending change as a single immutable operation.
• Improved Project Config change event handler registration by keeping callbacks and ordering metadata together.
• Fixed a bug where Table field column handles became arrays after failed validation.
• Fixed a bug where nested or concurrent searches could overwrite another search’s parser state.
• Fixed a bug where cached user permission trees could become stale after permission changes or be modified by assignability filtering.
• Fixed inconsistent handling of forced-disabled plugin configuration values.
• Fixed a bug where CraftCms\Cms\Edition capability checks could report capabilities from the configured edition rather than the receiver.
• Fixed a bug where throwing validation could run the validation lifecycle twice.
• Fixed a bug where CraftCms\Cms\Element\ElementCollection::with() could pass incompatible element classes into eager loading.
• Fixed a bug where cache options and tags registered via CraftCms\Cms\Utility\Utilities\ClearCaches::add() and addTag() were unavailable as Artisan commands.
• Fixed a JavaScript error that occurred on non-Inertial pages that rendered field layout designers. (#19380)
• Fixed a bug where Yii asset bundles registered with craft\web\View::registerAssetBundle() during plugin initialization were not included in rendered pages. (#19393)
• Fixed a bug where legacy asset bundle dependencies could be rendered after their dependent resources when using craftcms/yii2-adapter. (#19394)
• Fixed an error that occurred when config/craft/app.web.php or config/craft/app.console.php was present.
• Fixed a bug where jobs run on the sync queue could remain marked as reserved after completing. (#19431)
• Fixed a bug where Addresses fields weren’t reading the value posted by the Control Panel form, so removing every address didn’t stick and blank addresses could be created. (#19432)
• Fixed a bug where newly-added Matrix entries and addresses showed a spinner indefinitely in the Inertia/Vue element editor, rather than their fields.
• Fixed a bug where opening an element edit page with a Money field immediately created a provisional draft, before anything had been edited.
• Fixed a bug where the jobprogress table was missing dateCompleted and dateFailed columns for installs that were upgraded from Craft 5.
• Fixed a bug where failed queue jobs were losing their descriptions. (#19444)
• Fixed a bug where queue job details in the Queue Manager utility included “Error” and timestamp values even if they were null.

• Fixed a bug where entries could deadlock when saving their authors. (#15768)
• Fixed an error that could occur when upgrading to Craft 5. (craftcms/commerce#4309)
• Fixed a bug where overridden entry type handles weren’t being prioritized when rendering partial templates. (#18968)
• Fixed high-severity RCE vulnerabilities. (GHSA-5m2g-hhqr-84pc, GHSA-vfcw-xv8p-8rj2)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-4wfw-q5w3-jh42)
• Fixed a low-severity XSS vulnerability. (GHSA-w5rh-mhxj-wr8r)
• Fixed a low-severity information disclosure vulnerability. (GHSA-j5wg-m2pr-35qc)

• Fixed a high-severity RCE vulnerability. (GHSA-5m2g-hhqr-84pc)
• Fixed a low-severity information disclosure vulnerability. (GHSA-j5wg-m2pr-35qc)

• Fixed a bug where Yii-style migrations could be required twice. (#19376)
• Fixed a bug where the legacy craft\base\Widget class wasn’t fully implementing CraftCms\Cms\Dashboard\Contracts\WidgetInterface. (#19375)

• Fixed a SQL error that could occur when viewing an element with an empty Categories field. (#19372)

• Fixed a bug where sanitized SVGs wouldn’t render. (#19368)

• Added support for Markdown-based custom Dashboard widgets in the application's resources/widgets/ directory. (#19319)
• Replaced pixelandtonic/imagine with intervention/image for image manipulation.
• Added support for the libvips image driver via the optional intervention/image-driver-vips package.
• Added BMP, HEIC, ICO, JPEG 2000, JPEG XL, and TIFF image transform formats when supported by the active image driver.
• Added support for configuring field layout field instruction positions.
• Added fluent APIs for creating and modifying CraftCms\Cms\FieldLayout\FieldLayout, CraftCms\Cms\FieldLayout\FieldLayoutTab, and field layout elements.
• Changed craft:resave:all to discover registered craft:resave:* Artisan commands directly, rather than relying on a resolving event. (#19270)
• Changed the My Account → Addresses page to a full Inertia/Vue page, rendering nested-element cards from data instead of server-rendered HTML. (#19324)
• Changed CraftCms\Cms\Cp\FormFields::textFromConfig() to accept an optional CraftCms\Cms\Cp\Components\Input instance as a second argument, so callers can build on an existing component instead of always creating a plain Input. (#19323)
• Changed CraftCms\Cms\Search\Events\SearchPerformed to be a readonly, immutable event; its $results and $scores properties can no longer be overridden by listeners. CraftCms\Cms\Search\Events\SearchScoresResolving should be used to override scores instead. (#19308)
• Added CraftCms\Cms\Asset\AssetFileKinds. (#19270)
• Added CraftCms\Cms\Cp\Components\Button::action(), for declarative click actions. (#19324)
• Added CraftCms\Cms\Cp\Components\Button::inherit(). (#19306)
• Added CraftCms\Cms\Cp\Components\InputColor. (#19323)
• Added CraftCms\Cms\Cp\Components\InputPassword. (#19323)
• Added CraftCms\Cms\Cp\Data\NavItem::group(). (#19350)
• Added CraftCms\Cms\Cp\Enums\ButtonVariant. (#19306)
• Added CraftCms\Cms\Cp\FormFields::colorFromConfig(). (#19323)
• Added CraftCms\Cms\Cp\FormFields::passwordFromConfig(), passwordHtml(), and passwordFieldHtml(). (#19323)
• Added CraftCms\Cms\Cp\Html\ElementHtml::elementCardLabelHtml(), elementCardActionsHtml(), elementCardThumbHtml(), and elementCardThumbAlignment(). (#19324)
• Added CraftCms\Cms\Cp\Settings::registerSetting() and registerReadOnlySetting(). (#19270)
• Added CraftCms\Cms\Dashboard\WidgetTypes. (#19270)
• Added CraftCms\Cms\Database\Commands\MigrateCommand::registerMigrator(). (#19270)
• Added CraftCms\Cms\Element\ElementTypes. (#19270)
• Added CraftCms\Cms\Element\NestedElementManager::getCardsData() and getIndexData(). (#19324)
• Added CraftCms\Cms\Field\FieldTypes. (#19270)
• Added CraftCms\Cms\Field\LinkTypes. (#19270)
• Added CraftCms\Cms\Field\NestedEntryFieldTypes. (#19270)
• Added CraftCms\Cms\FieldLayout\NativeFields. (#19270)
• Added CraftCms\Cms\Filesystem\FilesystemTypes. (#19270)
• Added CraftCms\Cms\Gql\GqlArguments. (#19270)
• Added CraftCms\Cms\Gql\GqlDirectives. (#19270)
• Added CraftCms\Cms\Gql\GqlMutations. (#19270)
• Added CraftCms\Cms\Gql\GqlQueries. (#19270)
• Added CraftCms\Cms\Gql\GqlTypes. (#19270)
• Added CraftCms\Cms\Image\ImageTransformers. (#19270)
• Added CraftCms\Cms\Image\Raster::getInterventionImage().
• Added CraftCms\Cms\Plugin\Plugin::$filesystemTypes. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$gqlDirectives. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$gqlMutations. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$gqlQueries. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$gqlTypes. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$linkTypes. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::$siteTemplateRoots. (#19307)
• Added CraftCms\Cms\Plugin\Plugin::getCacheOptions(). (#19307)
• Added CraftCms\Cms\Plugin\Plugin::getCacheTags(). (#19307)
• Added CraftCms\Cms\Plugin\Plugin::getNativeFields(). (#19307)
• Added CraftCms\Cms\Plugin\Plugin::getSystemMessages(). (#19307)
• Added CraftCms\Cms\Search\Events\SearchResultsResolving. (#19308)
• Added CraftCms\Cms\Search\Events\SearchScoresResolving. (#19308)
• Added CraftCms\Cms\Support\Facades\AuthMethods. (#19270)
• Added CraftCms\Cms\SystemMessage\SystemMessages::register(). (#19270)
• Added CraftCms\Cms\Twig\Variables\Cp::color() and password(). (#19323)
• Added CraftCms\Cms\User\UserPermissions::registerPermissionGroup(). (#19270)
• Added CraftCms\Cms\Utility\Utilities\ClearCaches::add() and addTag(). (#19270)
• Added CraftCms\Cms\Utility\UtilityTypes. (#19270)
• Added CraftCms\Cms\View\TemplateCacheCollectors. (#19270)
• Added CraftCms\Cms\View\TemplateRoots. (#19270)
• Removed CraftCms\Cms\Support\Concerns\EvaluatesClosures and support for closure values in fluent CP component and field layout builder APIs.
• Changed CraftCms\Cms\FieldLayout\LayoutElements\BaseField::label() to accept an optional label and return the field layout element when one is passed. Overrides must accept the new optional argument.
• Changed CraftCms\Cms\Image\Raster::getTextBox() to return a width and height array.
• Renamed the protected CraftCms\Cms\FieldLayout\LayoutElements\BaseField::instructions(), tip(), and warning() methods to instructionsText(), tipText(), and warningText().
• Removed CraftCms\Cms\Asset\Events\AssetFileKindsResolving. CraftCms\Cms\Asset\AssetFileKinds::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Auth\Events\AuthMethodsResolving. CraftCms\Cms\Auth\AuthMethods::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Cp\Events\RegisterCpSettings and CraftCms\Cms\Cp\Events\RegisterReadonlyCpSettings. CraftCms\Cms\Cp\Settings::registerSetting() and registerReadOnlySetting() should be used instead. (#19270)
• Removed CraftCms\Cms\Dashboard\Events\WidgetTypesResolving. CraftCms\Cms\Dashboard\WidgetTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Database\Events\MigratorsResolving. CraftCms\Cms\Database\Commands\MigrateCommand::registerMigrator() should be used instead. (#19270)
• Removed CraftCms\Cms\Element\Events\ElementResaveCommandsResolving. A normal Artisan command in the craft:resave namespace should be registered instead. (#19270)
• Removed CraftCms\Cms\Element\Events\ElementTypesResolving. CraftCms\Cms\Element\ElementTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Field\Events\FieldTypesResolving. CraftCms\Cms\Field\FieldTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Field\Events\LinkTypesResolving. CraftCms\Cms\Field\LinkTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Field\Events\NestedEntryFieldTypesResolving. CraftCms\Cms\Field\NestedEntryFieldTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\FieldLayout\Events\NativeFieldsResolving. CraftCms\Cms\FieldLayout\NativeFields::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Filesystem\Events\FilesystemTypesResolving. CraftCms\Cms\Filesystem\FilesystemTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlArgumentHandlersResolving. CraftCms\Cms\Gql\GqlArguments::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlDirectivesResolving. CraftCms\Cms\Gql\GqlDirectives::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlMutationsResolving. CraftCms\Cms\Gql\GqlMutations::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlQueriesResolving. CraftCms\Cms\Gql\GqlQueries::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Gql\Events\GqlTypesResolving. CraftCms\Cms\Gql\GqlTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Image\Events\ImageTransformersResolving. CraftCms\Cms\Image\ImageTransformers::register() should be used instead. (#19270)
• Removed CraftCms\Cms\Image\Images::MINIMUM_IMAGICK_VERSION and craft\services\Images::MINIMUM_IMAGICK_VERSION.
• Removed CraftCms\Cms\Image\Raster::getImagineImage().
• Removed CraftCms\Cms\Search\Events\ScoringResults in favor of the following new events: (#19308)
  • CraftCms\Cms\Search\Events\SearchResultsResolving
  • CraftCms\Cms\Search\Events\SearchScoresResolving
• Removed CraftCms\Cms\SystemMessage\Events\SystemMessagesResolving. CraftCms\Cms\SystemMessage\SystemMessages::register() should be used instead. (#19270)
• Removed CraftCms\Cms\User\Events\UserPermissionsResolving. CraftCms\Cms\User\UserPermissions::registerPermissionGroup() should be used instead. (#19270)
• Removed CraftCms\Cms\Utility\Events\ClearCachesOptionsResolving and CraftCms\Cms\Utility\Events\ClearCachesTagOptionsResolving. CraftCms\Cms\Utility\Utilities\ClearCaches::add() and addTag() should be used instead. (#19270)
• Removed CraftCms\Cms\Utility\Events\UtilitiesResolving. CraftCms\Cms\Utility\UtilityTypes::register() should be used instead. (#19270)
• Removed CraftCms\Cms\View\Events\CpTemplateRootsResolving and CraftCms\Cms\View\Events\SiteTemplateRootsResolving. CraftCms\Cms\View\TemplateRoots::register() should be used instead. (#19270)
• Removed CraftCms\Cms\View\Events\TemplateCacheCollectorsResolving. CraftCms\Cms\View\TemplateCacheCollectors::register() should be used instead. (#19270)
• Added the [@craftcms](https://github.com/craftcms)/ui/factory module, a jQuery-free layer of typed element factories that mirror the src/Cp/Components PHP builders. (#19323)
• Added createTextInput() and createCopyTextPrompt() to the [@craftcms](https://github.com/craftcms)/ui/factory module. (#19333)
• Added turnOn(), turnOff(), and turnIndeterminate() methods to the <craft-switch> web component. (#19323)
• Added a group property to the <craft-nav-item> web component, for rendering a subnav as a non-collapsible semantic grouping. (#19350)
• Added Garnish.CustomSelect and Garnish.MenuBtn to [@craftcms](https://github.com/craftcms)/garnish, jQuery-free TypeScript ports of the legacy floating listbox menu and menu-button classes. (#19352)
• Moved the Craft.ComponentSelectInput control panel JavaScript class out of the core bundle into a yii2-adapter compatibility asset, since <craft-component-select> is now used everywhere in core; the componentSelect.twig jsClass escape hatch still works for plugin subclasses. (#19333)
• Moved the Craft.AssetMover, Craft.AssetSelectorModal, Craft.BaseElementSelectInput, Craft.BaseElementSelectorModal, Craft.BaseUploader, Craft.Chart, Craft.CpModal, Craft.CustomizeSourcesModal, Craft.DataTableSorter, Craft.ElementActionTrigger, Craft.ElementDeletionManager, Craft.ElementTableSorter, Craft.EntrySelectInput, Craft.Grid, Craft.PreviewFileModal, Craft.Tabs, Craft.TagSelectInput, Craft.Uploader, and Craft.VolumeFolderSelectorModal control panel JavaScript classes from the legacy jQuery bundle to TypeScript modules. (#19352)
• Changed <craft-nav-item> to render as a <span> instead of an <a> when it has no href, dropping aria-current in that case. (#19350)
• Changed element index table rows and cards so clicking anywhere on them (other than an interactive control) selects them, extending the selection range on shift-click just like clicking a row’s checkbox. (#19351)
• Deprecated the Craft.LightSwitch, Craft.InfoIcon, Craft.ColorInput, Craft.PasswordInput, Craft.IconPicker, Craft.SlidePicker, Craft.SlideRuleInput, and Craft.Tooltip control panel JavaScript classes, along with the .infoicon jQuery plugin. The corresponding [@craftcms](https://github.com/craftcms)/ui web components should be used instead. (#19323)
• Removed the Craft.Accordion and Craft.EnvVarGenerator control panel JavaScript classes. (#19323)
• Removed the Craft.DeleteUserModal control panel JavaScript class. It was deprecated in 5.10.0 and unused. (#19352)
• Fixed a bug where Blade templates rendered through Craft used path-based view names, preventing named Laravel view composers from running. (#19177)
• Fixed a bug where the accent semantic color used by colorable elements (e.g. craft-callout, [data-color]) rendered red instead of blue, due to a drifted color mapping in [@craftcms](https://github.com/craftcms)/ui. (#19306)
• Fixed a styling issue. (#19296)
• Fixed a bug where Yii adapter plugins could cause legacy Control Panel assets to be omitted. (#19302)
• Fixed a bug where assets’ Alternative Text values could not be cleared. (#19310)
• Fixed a bug where element deletion confirmation dialogs could display unresolved pluralization syntax. (#19311)
• Fixed a bug where replacing an asset would fail silently. (#19312)
• Fixed JavaScript errors that could occur throughout the control panel. (#19313)
• Fixed a bug where forms.checkboxField() and CraftCms\Cms\Cp\FormFields::checkboxFieldHtml() rendered an empty field. (#19338)
• Fixed a bug where Utility pages weren’t rendering, and were logging $ is not defined and window.Cp.config is not a function errors to the console. (#19340)
• Fixed a bug where actionClient requests for bare action paths could corrupt the ?site= query string on multi-site installs. (#19342)
• Craft.cp.announce() now accepts live regions that are plain elements as well as jQuery collections. (#19340)

• Added craft\helpers\StringHelper::isMd5().
• Fixed a bug where image transforms could be generated from a stale locally-cached copy of an asset’s source file, after the file was replaced on a non-local filesystem. (#19328)
• Fixed a bug where warnings were getting logged for SSO attributes that mapped to native user properties. (#19294)
• Fixed an error that could occur when applying a draft. (#19277)
• Fixed an error that could occur when running project-config/apply --force. (#19300)
• Fixed a bug where compiled templates could be missing the injected {{ head() }}, {{ beginBody() }}, or {{ endBody() }} tags. (#19304)
• Fixed an error that could occur when listing an element without a slug in an element index.
• Fixed a bug where Matrix and Addresses fields could have empty field action menus. (#19355)
• Fixed a bug where success/failure notifications weren’t being shown after deleting elements. (#19028)
• Fixed high-severity RCE vulnerabilities. (GHSA-5jmw-g85v-7jv2, GHSA-9c4j-cjw3-r3xx, GHSA-5r92-75j8-c534)
• Fixed a high-severity information disclosure vulnerability. (GHSA-4mgp-5vf2-7c9m)
• Fixed a moderate-severity information disclosure vulnerability. (GHSA-hfjh-gw6x-7pv5)
• Fixed a low-severity XSS vulnerability. (GHSA-h9jh-v8vc-m5rp)
• Fixed a low-severity authorization bypass vulnerability. (GHSA-6fp2-8j9w-7mj8)

• Added craft\helpers\StringHelper::isMd5().
• Fixed a high-severity RCE vulnerability. (GHSA-5r92-75j8-c534)

[!IMPORTANT] This update contains breaking changes for plugins. See #19263 for details.

• Plugins should no longer define extra.laravel.providers in composer.json. (#19263)
• Removed automatic plugin trait lifecycle hooks. (#19263)
• Added CraftCms\Cms\Cp\Components\Button. (#19248)
• Added CraftCms\Cms\Cp\Components\ButtonGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\Callout. (#19248)
• Added CraftCms\Cms\Cp\Components\Checkbox. (#19248)
• Added CraftCms\Cms\Cp\Components\CheckboxGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\CheckboxSelect. (#19248)
• Added CraftCms\Cms\Cp\Components\ChoiceGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\ComponentRegistry. (#19248)
• Added CraftCms\Cms\Cp\Components\Field. (#19248)
• Added CraftCms\Cms\Cp\Components\FieldGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\Lightswitch. (#19248)
• Added CraftCms\Cms\Cp\Components\Radio. (#19248)
• Added CraftCms\Cms\Cp\Components\RadioGroup. (#19248)
• Added CraftCms\Cms\Cp\Components\ViewComponent. (#19248)
• Added CraftCms\Cms\Cp\Concerns\EvaluatesClosures. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasAppearance. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasDisabled. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasId. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasSize. (#19248)
• Added CraftCms\Cms\Cp\Concerns\HasVariant. (#19248)
• Added CraftCms\Cms\Cp\Enums\Appearance. (#19248)
• Added CraftCms\Cms\Cp\Enums\Size. (#19248)
• Added CraftCms\Cms\Cp\Enums\Variant. (#19248)
• Added CraftCms\Cms\Cp\FormFields::buttonFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::buttonGroupFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::checkboxFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::checkboxGroupFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::checkboxSelectFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::lightswitchFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::radioFromConfig(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::radioGroupFieldHtml(). (#19248)
• Added CraftCms\Cms\Cp\FormFields::radioGroupFromConfig(). (#19248)
• Added CraftCms\Cms\Support\Facades\Template. (#19290)
• Added CraftCms\Cms\Twig\Contracts\TwigRendererInterface. (#19290)
• Added CraftCms\Cms\Twig\Variables\Cp::button(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::buttonGroup(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::checkbox(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::checkboxGroup(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::checkboxSelect(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::lightswitch(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::radio(). (#19248)
• Added CraftCms\Cms\Twig\Variables\Cp::radioGroup(). (#19248)
• Added CraftCms\Cms\ui(). (#19248)
• Added CraftCms\Cms\View\TemplateManager. (#19290)
• template() and pageTemplate() now accept an optional template renderer name. (#19290)
• TemplateRendered and PageTemplateRendered events now expose the final renderer name via $rendererName; the corresponding before events no longer expose renderer identity. (#19290)
• Replaced CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizers with CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizerManager. HTML sanitizers should now be registered via CraftCms\Cms\Support\Facades\HtmlSanitizers::extend() rather than CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizers::register(). (#19292)
• Removed CraftCms\Cms\Plugin\Events\PluginUnregistered. (#19263)
• Removed CraftCms\Cms\Plugin\Plugin::bootPlugin(). boot() should be used instead. (#19263)
• Removed CraftCms\Cms\Plugin\Plugin::registerPlugin(). register() should be used instead. (#19263)
• Fixed a bug where the legacy yii\web\JqueryAsset wasn’t resolving properly. (#19264)
• Fixed a bug where bulk entry moves could assign entries to sections that didn’t support their entry types. (#19267)
• Fixed a bug where queued resaves ignored offset and limit criteria or accepted non-positive batch sizes. (#19271)
• Fixed a bug where failed password and passkey login attempts incremented invalid-login counters twice. (#19283)
• Fixed bugs that could prevent authored content from being deleted or reassigned safely when deleting users. (#19273)
• Fixed an issue where disabled and archived user accounts could still authenticate. (#19265)
• Fixed a bug where one-time two-factor authentication credentials could be accepted by concurrent login attempts. (#19282)
• Fixed issues with craft:users:set-password password validation, exit statuses, and session invalidation. (#19272)
• Fixed a bug where selected GraphQL mutations could be mistaken for cacheable queries. (#19284)
• Fixed a high-severity authorization bypass vulnerability.
• Fixed a bug where two-factor authentication could lose login state or verify the wrong user during impersonation. (#19274)
• Fixed a bug where new Matrix blocks weren’t getting created. (#19161)

• Added craft\helpers\Gql::isMutation(). (#19285)
• Fixed an error that could occur when saving an element with an eager-loaded relation field value. (#19280)
• Fixed a bug where bulk entry moves could assign entries to sections that didn’t support their entry types. (#19268)
• Fixed a bug where admin tables’ action buttons could fire when rendering. (#19255)
• Fixed an error that occurred when using the null-safe operator in a Twig template. (#19279)
• Fixed a bug where GraphQL mutation queries could be cached. (#19285)
• Fixed a bug where custom element index pages were getting included in the control panel navigation, even if they only contained sources that the current user didn’t have access to. (#19289)
• Fixed high-severity RCE vulnerabilities.
• Fixed a moderate-severity permission escalation vulnerability.
• Fixed a low-severity information disclosure vulnerability.

• Updated logout routes to require CSRF-protected POST requests. (#19252)
• Updated Control Panel configuration serialization to use Illuminate\Support\Js::from(). (#19252)
• Updated the project testing guidelines to emphasize behavior-focused tests. (#19252)
• Updated queue connection retry windows to exceed Craft’s maximum job timeout. (#19252)
• Updated core queue jobs to resolve their dependencies through Laravel’s service container. (#19252)
• Updated automatic garbage collection to run as a unique queue job. (#19252)
• Updated two-factor authentication recovery codes to be encrypted at rest. (#19252)
• Improved field reference cleanup performance. (#19252)
• Improved numeric element reference resolution performance. (#19252)
• Improved element merge performance by avoiding per-relation and per-structure queries. (#19252)
• Improved search indexing memory use when indexing many elements. (#19252)
• Improved asset indexing performance when finding missing and empty folders. (#19252)
• Prevented duplicate image transform jobs from being queued for the same transform. (#19252)
• Removed duplicate Control Panel icon alias registrations. (#19252)
• Fixed a bug where GraphQL asset mutations weren’t executing HTTP requests for remote asset URLs. (#19252)
• Fixed a bug where failed relation writes could leave partial relation changes persisted. (#19252)
• Fixed a bug where element merge replacement jobs could be dispatched before their database transaction was committed. (#19252)
• Fixed a bug where section project-config jobs could be dispatched before their database transaction was committed. (#19252)
• Fixed a bug where passkey login attempts weren’t rate limited. (#19252)
• Fixed a bug where relation localization could not be retried safely after a failed run. (#19252)
• Fixed a bug where project config mutex cleanup could release a lock owned by another process. (#19252)
• Fixed a bug where nested structure operations could release their mutex lock before the outer operation completed. (#19252)
• Fixed a bug where two-factor authentication verification attempts weren’t rate limited. (#19252)
• Fixed a bug where user photo uploads could exceed the configured maximum upload size. (#19252)
• Fixed a bug where unsafe filenames could be used for Craft support attachments. (#19252)
• Fixed a bug where a failed legacy field type migration could leave project config events muted. (#19252)
• Fixed a bug where TemplateGlobals were being resolved every time a Blade component rendered. (#19257)
• Fixed a bug where Craft updates could fail with a 503 response when the action URL contained query parameters.

• Updated core asset I/O to resolve Craft filesystem definitions and configured storage targets through Laravel filesystem disks.
• Updated elevated session prompts to use the modern control panel frontend while preserving the legacy JavaScript APIs.
• Login attempts are now rate limited.
• Added Illuminate\Contracts\Translation\HasLocalePreference support to user elements, allowing Laravel notifications to use users’ Language preferences. (#19228)
• Fixed a bug where site routes weren't being registered for each localized site value.
• Fixed a bug where POST requests to the loginPath weren’t being handled properly. (#19220)
• Fixed a bug where users were redirected to the previous page on logout. (#19220)
• Fixed a bug where requests to the loginPath, setPasswordPath, and verifyEmailPath were getting redirected to the control panel. (#19229)
• Fixed a bug where Laravel translation fallbacks weren’t applied when translationDebugOutput was enabled. (#19228)
• Fixed a bug where custom plugin settings FormRequest classes could persist unvalidated settings. (#19228)
• Fixed a bug where failed Craft API responses weren’t processing response headers. (#19228)
• Fixed a bug where Craft plugin service providers could be skipped when the plugin’s Composer metadata also defined Laravel package discovery settings. (#19228)
• Fixed a bug where event-registered user permissions weren’t getting saved. (#19232)
• Fixed lifecycle leaks where asset, GraphQL, route token, user, and user permission state could persist in long-running application processes. (#19242)
• Fixed moderate-severity authorization bypass vulnerabilities.
• Fixed a low-severity authorization bypass vulnerability.
• Fixed a low-severity XSS vulnerability.

• Added craft\gql\base\MutationResolver::requireAllowedSite().
• Fixed a bug where JSON fields weren’t JSON-decoding values saved via GraphQL mutations. (#19230)
• Fixed an error that could occur when reassigning entries to a new author when deleting a user. (#19154)
• Fixed a bug where craft\web\twig\variables\CraftVariable::$rebrand was getting defined for Craft Team installs. (#19249)
• Fixed a bug where “All entries” and “All users” sources could be listed above other sources in relation field settings. (#19185)
• Fixed high-severity authorization bypass vulnerabilities.
• Fixed moderate-severity authorization bypass vulnerabilities.
• Fixed a moderate-severity permission escalation vulnerability.
• Fixed low-severity XSS vulnerabilities.
• Fixed a low-severity authorization bypass vulnerability.

• craft\services\Sites::getGroupById() now has a $withTrashed argument.
• Fixed an error that could occur when applying project config changes, if a site group was deleted. (#19076)

• Updated web-auth/webauthn-lib to 5.3. (#19226)
• Fixed an error that could occur when running CLI commands. (#19030)

• Users can now connect their accounts to one or more Socialite providers. (#19202)
• The login page now lists Socialite providers. (#19202)
• Fixed a bug where some control panel resources and pages weren’t loading properly. (#19214)

• It’s now possible to load Blade views within Twig templates. (#19148)
• Craft now registers several Blade directives, bringing near feature parity with Twig templating. (#19148)
• Added SQLite database support. (#19149)
• Control panel resources are now provided by a craftcms/cms-assets package. (#19162)
• Renamed CraftCms\Cms\Twig\PageLifecycle to CraftCms\Cms\View\PageLifecycle. (#19148)
• Renamed CraftCms\Cms\Twig\TemplateResolver to CraftCms\Cms\View\TemplateResolver. (#19148)
• Fixed a bug where anonymous homepage and fallback site-template requests could bypass offline-site access enforcement. (#19151)
• Fixed a bug where the login page would show a CSRF token mismatch on http requests
• Fixed an error that could occur during Craft 6 upgrades when the migrations table was missing its track column. (#19168)
• Fixed an error that occurred when saving Users source settings after selecting the Groups table column. (#19184)
• Fixed a bug where database backups weren’t using the --single-transaction or --column-statistics=0 flags on MySQL.
• Fixed a bug where Content Block fields’ nested fields weren’t available as table columns on element indexes.

• Added craft\services\Security::isRestrictedDir(). (#19179)
• craft\helpers\Image::imageSizeByStream() now supports WebP, AVIF, and HEIC/HEIF images. (#19189)
• craft\services\Sites::getGroupById() now has a $withTrashed argument.
• Fixed a bug where the site/siteId params weren’t being respected on eager-loaded localized queries. (#18588)
• Fixed a bug where it wasn’t possible to enter decimal values after tabbing into a Money field. (#19156)
• Fixed a bug where the search inputs on the Entry Types and Fields settings index pages were case-sensitive on PostgreSQL. (#19158)
• Fixed a bug where timepicker menus weren’t auto-scrolling to the selected time when opened. (#19142)
• Fixed an error that could occur when reassigning entries to a new author when deleting a user. (#19154)
• Fixed a bug where the “All entries” and “All users” sources weren’t available to be selected within Entries/Users field settings. (#19185)
• Fixed a bug where database backups weren’t using the --single-transaction flag on MariaDB. (#19191)
• Fixed a bug where element indexes could show multiple table columns for the same nested fields within Content Block fields. (#19197)
• Fixed a PHP error that could occur when merging canonical changes into a draft that contained nested elements. (#19187)
• Fixed an error that could occur when applying project config changes, if a site group was deleted. (#19076)
• Fixed an error that could occur when nested Matrix entries were copied. (#19195)
• Fixed a bug where project config YAML files could include component name comments with trailing whitespace. (#19198)
• Fixed a low-severity information disclosure vulnerability.
• Fixed a low-severity cache poisoning vulnerability.

• craft\helpers\Image::imageSizeByStream() now supports WebP, AVIF, and HEIC/HEIF images. (#19189)
• Fixed a bug where database backups weren’t using the --single-transaction flag on MariaDB. (#19191)

• Fixed an error that occurred when saving an existing asset. (#19152)

• Added CraftCms\Yii2Adapter\Database\DeprecatedTable.
• Added CraftCms\Cms\Translation\Formatter::asRelativeTime(). (#19146)
• craft\elements\Category::find() now returns a CraftCms\Yii2Adapter\Element\Queries\CategoryQuery object. (#19120)
• craft\elements\GlobalSet::find() now returns a CraftCms\Yii2Adapter\Element\Queries\GlobalSetQuery object. (#19120)
• craft\elements\Tag::find() now returns a CraftCms\Yii2Adapter\Element\Queries\TagQuery object. (#19120)
• Fixed a “This password does not use the Bcrypt algorithm” error that could occur when logging in with a user whose password was set in an earlier version of Craft.
• Fixed a “File name is not a string” error that could occur when an error was encountered when rendering a string template. (#19122)
• Fixed a bug where parsed site names would get saved to the project config. (#19123)
• Fixed a bug where plugin $styles, $scripts, and $publishables weren’t published automatically when the plugin was installed or enabled. (#19137)
• Fixed several issues that occurred when Craft was configured with a custom (or no) cpTrigger. (#19127)
• Fixed a bug where Craft wasn’t applying the Settings → General timezone to PHP’s default timezone. (#19138)
• Fixed a bug where entry queries weren’t fetching structure data by default.
• Fixed a bug where top-level structure elements were always repositioned to the end of the structure on save.
• Fixed a bug where the Settings index page didn’t include “Globals”, “Categories”, or “Tags” links, when the concepts were supported. (#19120)
• Fixed errors that occurred when editing global sets, category groups, and tag groups. (#19120)
• Fixed a bug where it wasn’t possible to create new categories. (#19120)
• Fixed an error that occurred when editing a category. (#19120)
• Fixed a bug where users’ Language preference field could be set to Arabic by default when the browser’s preferred language included a territory ID (e.g. en-US).
• Fixed a bug where preview tokens weren’t taking the previewTokenDuration config setting into account.

• Fixed a bug where element thumbnails could have inconsistent rounded corners. (#19117)
• Fixed a bug where video file uploads could cause a timeout or exhaust the memory limit. (#19131)
• Fixed an error that occurred if a custom source had a condition rule that referenced a field instance that no longer existed. (#19132)
• Fixed a bug where the relation deletion blocker’s messages weren’t always properly capitalized. (#19133)
• Fixed a bug where the “Delete” button within element deletion blocker modals wasn’t getting translated properly. (#19134)
• Fixed a bug where the previewTokenDuration config setting was defaulting to 1 day, rather than to the defaultTokenDuration value. (#18550)
• Fixed a bug where nested elements weren’t showing validation errors. (#19147)
• Fixed a bug where error summaries weren’t properly linking to their corresponding fields’ error lists. (#19147)
• Fixed a low-severity XSS vulnerability.
• Fixed a high-severity authorization bypass vulnerability.

• Added CraftCms\Cms\Twig\AllowableInSandbox.
• Fixed a bug where Blade templates weren’t loading for text/Markdown mail. (#19106)
• Fixed a bug where it wasn’t possible to change the primary site, or edit site statuses. (#19109)

• Added craft\web\twig\AllowableInSandbox.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t resolving aliases for environment variables that referenced an alias (e.g. [@root](https://github.com/root)/storage/rebrand). (#19108)
• Fixed a bug where the “Parent” field on Structure entries’ edit pages wasn’t showing the parent entry if it didn’t exist for the same site being edited, causing the parent relationship to be lost on save. (#19110)
• Fixed a high-severity RCE vulnerability.

• Added craft\web\twig\AllowableInSandbox.
• Fixed a high-severity RCE vulnerability.

• Added a new core Markdown field (#18960)
• Added a way for fields to track references and register a deletion blocker for them (#19014)
• Added CraftCms\Cms\Validation\Events\ValidationRulesResolving::$ruleset.
• Relaxed the allowed types in the ValidationRulesResolving event to include any implementation ValidatesWithRuleset or a Illuminate\Http\Request object.
• Renamed CraftCms\Cms\Validation\Events\ValidationRulesResolving::$component to $subject.
• Relocated CraftCms\Cms\Element\Validation\Events\ValidationRulesResolving to CraftCms\Cms\Validation\Events\ to reflect its broader applicability to components and rulesets.
• Fixed errors that could occur when Craft user elements were expected but the authenticated user was resolved as a Laravel user model. (#19051)
• Fixed a bug where the craft:install command would hang if run within a production environment.
• Fixed a bug where “Replace relation” action buttons weren’t working.
• Fixed a “Invalid URL” JavaScript error in the control panel. (#19041)
• Fixed an error that could occur during Craft 6 upgrades when legacy relational or Matrix field settings included showCardsInGrid. (#19047)
• Fixed a bug where queue job progress labels weren’t getting translated.
• Fixed a bug where the control panel sidebar and Queue Manager were showing completed jobs.
• Fixed a bug where CraftCms\Yii2Adapter\Mixins\ValidateMixin::addErrors() had incorrect arguments. (#19065)
• Fixed a bug where plugin templates were not being loaded correctly
• Fixed a bug where query string params were getting registered as variables in Twig templates. (#19090)
• Fixed a bug where parsed site URLs would get saved to the project config. (#19092)

• Forward slashes in query strings are now encoded. (#19057)
• Added craft\controllers\EVENT_BEFORE_SAVE_IMAGE. (#19068)
• Added craft\events\SaveAssetImageEvent. (#19068)
• Added craft\web\Request::getPreviewParam().
• Updated Axios to 1.17.0. (#19053)
• Fixed a bug where no-cache and X-Robots-Tag: none headers weren’t always being sent for requests with x-craft-preview or x-craft-live-preview query string params. (#19060)
• Fixed a bug where the “Delete” element edit page action wasn’t working properly when editing a provisional draft.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t returning boolean values for environment variable names that resolved to true/false values. (#19029)
• Fixed a bug where the submit button within Live Preview was labelled “Submit” rather than “Save”. (#19056)
• Fixed a bug where the selected site wasn’t being remembered after saving an element. (#19054)
• Fixed a bug where transformed SVG images could have two sets of width and height attributes. (#1902w7)
• Fixed an infinite recursion bug. (#19063)
• Fixed a JavaScript error that could occur if there was an error rendering an element condition rule’s Twig template.
• Fixed a bug where relational fields’ element selector modals weren’t showing any results if they were configured to only relate to elements in a specific site, and the author didn’t have permission to access that site. (#19078)
• Fixed a bug where element cards were showing preview values for conditionally-hidden fields. (#19064)
• Fixed a bug where some bulk element actions could exhaust the memory limit on large selections. (#19070)
• Fixed a SQL error that could occur when uploading an asset, if it contained non-UTF-8 alt text in its metadata. (#19069)
• Fixed an error that could occur when editing an entry if a soft-deleted user had recently edited the same entry. (#19081)
• Fixed a PHP error that occurred when setting general config settings via config/general.console.php or config/general.web.php. (#19083)
• Fixed a bug where address cards would show “0, 0” for Longitude/Latitude values when neither field had been populated. (#19093)
• Fixed a bug where field conditions within Matrix blocks weren’t always working when editing the owner element in a slideout. (#19084)
• Fixed a bug where verification code inputs weren’t always getting autofilled by password managers. (#19094)
• Fixed a bug where the “Use defaults” button in element index view menus wasn’t being shown automatically after a column header was pressed on. (#19101)
• Fixed a styling issue.
• Fixed high-severity RCE vulnerabilities.
• Fixed a high-severity information disclosure vulnerability.
• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity information disclosure vulnerability.
• Fixed a low-severity potential path traversal vulnerability.

• Added craft\controllers\EVENT_BEFORE_SAVE_IMAGE. (#19068)
• Added craft\events\SaveAssetImageEvent. (#19068)
• Added craft\web\Request::getPreviewParam().
• Fixed a bug where no-cache and X-Robots-Tag: none headers weren’t always being sent for requests with x-craft-preview or x-craft-live-preview query string params. (#19060)
• Fixed high-severity RCE vulnerabilities.
• Fixed a high-severity information disclosure vulnerability.
• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity information disclosure vulnerability.
• Fixed a low-severity potential path traversal vulnerability.

• Improved the accessibility of the Login page. (#19025)
• Added CraftCms\Cms\User\Contracts\CraftUser and CraftUserTrait. (#19009)
• Removed CraftCms\Cms\Auth\UserProvider; the Craft guard now defaults to Laravel’s Eloquent provider using CraftCms\Cms\User\Models\User. (#19009)
• Added Auth::craftUser()/auth('craft')->craftUser() and request()->craftUser() as Craft-safe ways to access the authenticated user. (#19009)
• Element::getIterator() no longer includes custom field values. (#19004)
• Fixed a bug where checking the elevated session timeout could overwrite newer session data, which could prevent passkeys from being created.
• Fixed a bug where legacy plugin-defined actions.php routes could collide between plugins. (#18994)
• Fixed a bug where JavaScript and CSS registered by utility pages weren’t executed when navigating between utility pages, and weren’t cleaned up when navigating away. (#18978)
• Fixed a bug where custom element authorization methods weren’t respected by Laravel element policies. (#18983)
• Fixed a bug where removing all permissions from a user wouldn’t save. (#18995)
• Fixed a bug where Single sections had Max Authors settings. (#19001)
• Fixed a bug where Channel and Structure sections didn’t have Max Authors settings. (#19001)
• Fixed a bug where sections’ Min Authors settings were defaulting to 1 when blank. (#19001)
• Fixes a bug where the “View entry” permission was listed twice for Single sections, causing a SQL error when both were selected. (#19002)
• Fixes a bug where user group handles weren’t getting auto-generated. (#19002)
• Fixed a JavaScript error that could occur in the Control Panel when a custom element was registered more than once.
• Fixed a bug where Control Panel action menu items could trigger their action twice when clicked.
• Fixed a bug where legacy Control Panel JavaScript wasn’t loaded and initialized on all Control Panel pages.
• Fixed a styling issue with user avatars.

• Added craft\base\ElementInterface::afterAssignedId().
• Fixed an error that occurred when executing the users/remove-2fa command non-interactively, if --method wasn’t provided. (#18724)
• Fixed a bug where Link fields weren’t getting updated when the “Replace relations” element deletion option was chosen. (#18992)
• Fixed a bug where it wasn’t always possible to select new categories or entries in relation fields. (#18976)
• Fixed a bug where Checkboxes and Multi-select fields weren’t handling :empty:/:notempty: params properly. (#18988, #19019)
• Fixed a bug where entries with {id} in their Default Title Format weren’t always getting created with the correct generated title. (#18991)
• Fixed an infinite recursion bug that could occur when rendering sandboxed Twig templates. (#19004)
• Fixed a styling issue. (#19010)
• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity object injection vulnerability.

• Fixed a bug where an empty [@storage](https://github.com/storage)/runtime directory could be created within the webroot. (#18986)

• Improved emoji shortcode handling performance for strings without shortcode delimiters.
• Improved element query performance by caching element source table column listings in memory.
• Improved nested entry type resolution by avoiding unnecessary owner element queries.
• Added Laravel event dispatching to Craft’s Yiisoft\Translator\Translator instance, enabling Yiisoft\Translator\Event\MissingTranslationEvent listeners. (#18952)
• The loginPath config setting is now false by default.
• Renamed the PluginsLoaded event to PluginsRegistered. (#18973)
• Updated Twig to 3.27. (#18980)
• Fixed some errors that could occur when running Craft through Laravel Octane (#18921)
• Fixed an error that occurred when rendering the database update screen outside Control Panel template mode.
• Fixed an error that occurred when Redis was configured as the session driver.
• Fixed a bug where legacy Control Panel URL rules couldn’t route directly to templates. (#18972)
• Fixed an error that could occur when request context was dehydrated after a matched element route was resolved.
• Fixed a bug where CraftCms\Cms\Support\Typecast could skip setters that used a same-name private backing property.
• Fixed a bug where CraftCms\Cms\Support\Typecast could attempt to assign read-only, private-set, protected-set, or setterless virtual properties.
• Fixed a bug where publishable Craft assets were registered during web requests.
• Fixed a bug where eager-loading didn’t treat address, content block, and entry queries as nested element queries.
• Fixed a bug where lazy eager-loading nested element fields could reuse owner criteria and return the wrong elements.
• Fixed an error that occurred when Updates were cached and deserialized.
• Fixed an error that prevented link fields from saving.
• Fixed a bug where Money fields could throw an error during element validation when the field value was falsy.
• Fixed a bug where CraftCms\Cms\Validation\Contracts\Validatable::prepareForValidation() wasn’t called consistently, and plain Validatable classes without a configured ruleset couldn’t be validated. (#18944)
• Fixed a bug where invalid element query filters could return all results. (#18937)
• Fixed an error that occurred when uploading assets to fields with dynamic default upload locations. (#18949)
• Fixed a bug where Craft could look for the license key in config/license.key instead of config/craft/license.key.
• Fixed a styling issue that occurred when editable table cells had a code class. (#18900)

• Updated Twig to 3.27. (#18980)
• Fixed a bug where an empty storage/runtime/ directory was getting created even if runtimePath was being overridden in config/app.php. (#18936)
• Fixed a bug where overridden entry type handles weren’t being respected when rendering partial templates. (#18968)
• Fixed an error that could occur when opening an element slideout. (#18957)
• Fixed a bug where HTML Purifier was stripping out IDs and ID references that included characters that weren’t allowed pre-HTML5. (#18971)

• Reduced the number of database queries executed when eager-loading nested entries or addresses. (#18929)
• Reduced the number of database queries executed when loading image transforms. (#18929)
• Deprecated craft\services\Path::getRuntimePath(). Craft::$app->getRuntimePath() should be called instead.
• Fixed a bug where Single section entries weren’t initially saved with a post date. (#18931)
• Fixed a bug where overriding the runtime path via config/app.php wasn’t possible. (#18936)
• Fixed a bug where pasted nested entries within Matrix fields in Blocks view weren’t always getting fully initialized. (#18912)
• Fixed a bug where collapsed Matrix blocks were getting “Entry [ID]” preview values if their entry type didn’t have a UI Label. (#18484)
• Fixed a bug where nested elements could be deleted when reverting content from a revision. (#18950)
• Fixed a styling issue.
• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity authorization bypass vulnerability.

• Fixed a bug where some element index actions weren’t working. (#18938)
• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity authorization bypass vulnerability.

• Updated Twig to 3.26. (#18924, #18926)
• Fixed a bug where editable tables registered unexpected debug toolbar output. (#18895, #18902)
• Fixed a JavaScript error that occurred when pasting nested entries within Matrix fields in Blocks view. (#18912)
• Fixed an error that could occur when editing elements on Apache servers. (#18923)

• Added support for plugins to register Laravel scheduled tasks that run via php artisan schedule:run.
• Updated yiisoft/html to 4.1.0. (#18920)
• Updated elvanto/litemoji to 5.2.0. (#18917)
• Updated pragmarx/google2fa to 9.0.0. (#18919)
• Fixed an error that occurred when opening element selector modals with string sources values. (#18915)
• Added “Elements” and “Deprecations” panels to Laravel Debugbar. (#18897)
• Fixed a bug where legacy redirect responses were not being returned as a redirect (#18893)
• Fixed an error that could occur when saving filesystems with null transient settings. (#18909)
• Fixed a bug where plugin routes were not being registered with the web middleware.
• Fixed an error that could occur when storing image transform indexes. (#18899)
• Fixed an error when loginPath or logoutPath was set to false in GeneralConfig. (#18894)
• Fixed a bug where plugin-registered Twig variables weren’t available via the craft template variable. (#18903)
• Fixed an error that occurred when using the legacy cache service with a new dependency object (#18904)
• Fixed a bug where clearing submitted values could retain the previous value. (#18905)
• Fixed a bug where a legacy Yii action controller would result in a 404 when returning null as the response (#18907)
• Fixed an error that could occur because ol and ul were not normalizing the attributes (#18907)
• Fixed an error that occurred when trying to upload an asset through a legacy filesystem plugin (#18908)

• Added the compiledTemplatesPath config setting. (#18861)
• Added a missing migration that adds minAuthors to the section table (#18875)
• Fixed a bug where the cpTrigger would be appended twice to the URL after running migrations from the control panel. (#18858)
• Fixed an error that occurred when rendering element indexes with blank source headings. (#18891)
• Fixed an error that occurred when uninstalling plugins. (#18862)
• Fixed an error that could occur when Control Panel HTML values were passed as Stringable objects. (#18883)
• Fixed a bug where plugin package config files could affect plugin settings before being published. (#18885)
• Fixed a bug where the control panel would continuously poll for queue job info, even if there were no active jobs. (#18853)
• Fixed a bug where legacy redirect responses were not being handled. (#18860)
• Fixed a bug where email addresses couldn’t be saved when applying unpublished user drafts. (#18882)
• Fixed a bug where the Updates utility wasn’t showing available updates. (#18884)

• Fixed a bug where the |default filter only accepted string values. (#18886)

• Fixed a bug where assets’ Alternative Text values weren’t always being set when replacing an existing asset’s file. (#18713)
• Fixed a bug where element indexes had horizontal scroll bars while loading. (#18870)
• Fixed a bug where elements selected by Link fields weren’t getting replaced with their localized versions when propagating content for newly-created elements to other sites. (#18743)
• Fixed a bug where it wasn’t possible to replace the selected element within Link fields with a localized version of the same element. (#18873)
• Fixed a bug where nested entries weren’t getting their Post Date values set. (#18872)
• Fixed a bug where it was difficult to interact with element source paths within element selector modals. (#18876)

• Added support for SQLite backups and restores. (#18803)
• Added support for Symfony-style array config files in config/craft/sanitizers/. (#18808)
• Added support for configuring the system time zone during installation. (#18794)
• Added the legacy paginate Twig variable back.
• Added CP access permission checks to Control Panel action routes.
• The craftAsset() Twig function now resolves to Vite versioned assets. (#18801)
• Renamed the |money Twig filter’s formatLocale argument to locale.
• Deprecated the csrfTokenName, enableCsrfCookie, and enableCsrfProtection general config settings. (#18806)
• Removed support for the Debug Toolbar. Laravel Debugbar can be used instead. (#18812)
• Improved Control Panel icon loading performance.
• Fixed a PHP error that occurred when saving a Structure section with a Max Levels value. (#18809)
• Fixed a bug where plugin settings pages were missing registered scripts and styles. (#18815)
• Fixed a PHP error that occurred when saving an entry type. (#18816)
• Fixed an issue with Typecast where typed setters wouldn't have precedence over private properties.
• Fixed a bug where Control Panel templates failed to load on Windows due to mismatched directory separators or drive-letter casing in CraftCms\Cms\View\TwigEngine. (#18804)
• Fixed a bug where Craft’s Vite hot file configuration could override the host application’s Vite hot file. (#18810)
• Fixed a bug where CraftCms\Cms\Support\Typecast could give private properties precedence over typed setters.
• Fixed a bug where runQueueAutomatically wasn’t being respected. (#18817)
• Fixed a bug where CraftCms\Cms\Validation\Rules\EnvValueRule could parse boolean values incorrectly.
• Fixed a bug where Blade templates weren’t resolving correctly.
• Fixed a bug where console command aliases weren’t prefixed with craft:.
• Fixed a bug where element duplication included IDs.
• Fixed a bug where legacy action requests didn’t resolve correctly when using DefaultController.
• Fixed a bug where legacy controller CSRF validation exclusions weren’t always respected.
• Fixed a bug where legacy plugin settings weren’t saved correctly.
• Fixed a bug where legacy redirects and streamed responses weren’t forwarded to Laravel correctly.
• Fixed a bug where preview requests could write template caches.
• Fixed a bug where private templates couldn’t be used as section templates.
• Fixed a bug where the legacy Application::EVENT_AFTER_REQUEST event wasn’t triggered.
• Fixed a bug where the password reset email throttle applied to Control Panel requests.
• Fixed a bug where the Support widget could render unescaped HTML.
• Fixed a bug where Twig macros were allowed in sandboxed templates.
• Fixed a bug where user passkeys weren’t persisting.
• Fixed an error that occurred when validation errors stored in the session were plain arrays.
• Fixed compatibility issues with legacy element queries.
• Fixed compatibility issues with legacy fallback routes.
• Fixed legacy model behavior when unsafe config keys were provided.
• Fixed permissions enforcement when duplicating Matrix blocks.
• Fixed permissions enforcement when saving user fields through generic element save endpoints.
• Fixed a bug where a yii\base\InvalidConfigException would be thrown when a Yii2-based plugin registered an asset bundle. (#18818)
• Fixed a bug where using {{ successMessageInput() }} would not decrypt the resulting message for the flash message.
• Fixed a bug where a missing widget from an uninstalled plugin would throw instead of mapping to a MissingWidget.
• Fixed a bug where an address' ownership ids could be overridden unintentionally.
• Fixed a bug where getHasSsoIdentity() would return false when Socialite was not installed but the user had an SSO identity.
• Fixed a bug where the site's offline status was not being enforced on matched element routes.
• Fixed a user photo validation issue with file extensions.
• Fixed a bug where legacy controllers could return null but were not considered handled.
• Improved performance of the dashboard by reducing the amount of queries for widgets
• Fixed a bug where criteria added to clones of executed element queries could be ignored. (#18826)
• Fixed a bug where Yii2 behaviors registered from plugins weren’t getting attached at the right time. (#18824)
• Fixed an error that occurred when running craft:install in environments where Laravel Prompts can only render tasks statically. (#18830)
• Fix legacy model array access for null properties (#18843)
• Fix Twig access to Laravel error bags (#18841)
• Fixed a bug where singles were throwing an exception (#18845)
• Fixed a bug where plugin settings were not saving consistently (#18849)
• Fixed a bug where deprecated string-based orderBy() arguments could cause element queries to throw an unknown column exception. (#18852)
• Fixed a bug where Laravel HTTP exceptions weren’t passed to legacy error handler event listeners. (#18854)
• Fixed a bug where FieldLayouts were being flashed to the session as arrays. (#18847)

Content Management

• Collapsed Matrix blocks now show their entries’ UI labels as preview text, whenever possible. (#18484)
• Element-level actions within nested element management fields (Matrix, Addresses, etc.) now consistently affect all selected elements, when performed on a selected element. (#18561)
• Elements within Matrix and Addresses fields now have “Paste above” actions when a compatible element is copied. (#17406)
• Elements now keep track of the index page’s URL their edit page was linked to from, and explicitly redirect back to that page after save, rather than always redirecting to the referrer. (#18680)
• Addresses fields now have a “Copy all addresses” field-level action. (#18561)
• Matrix fields’ “Expand”, “Collapse”, and “Copy” field-level actions now always affect all nested entries, regardless of whether any entries are selected. (#18561)
• Matrix fields no longer have “Duplicate” and “Delete” field-level actions. (#18561)
• Number fields now show their selected currency beside their input, if their Preview Format setting is set to “As currency values”. (#18498)
• Color field previews are now blank for fields without a value. (#18614)
• Text condition rules now have “does not equal”, “is one of” and “is not one of” operators.
• Numeric condition rules now have “is one of” and “is not one of” operators. (#18734)
• Editable table columns now set min-width styles based on their configured widths, if set. (#18534)
• Entry post dates are no longer automatically set until the entry is fully saved as enabled. (#18642)
• Element edit screens now have a “Save as a new draft” action when editing an explicitly-created draft. (#18722)
• Address edit screens now have “Field settings” action menu items. (#18544)
• Asset edit screens now have “Volume settings” and “Filesystem settings” action menu items. (#18544)
• Entries’ “Entry type settings” and “Section settings” action menu items are now only shown for element edit screens’ primary action menus.
• Category indexes can now have “Group” columns. (#18553)
• Element slideouts now automatically refresh when the same element is updated in another tab/slideout. (#18625)
• Added the “Time Zone” user preference. (#8518)
• Element indexes now automatically refresh after duplicating elements and the queue is completed, if there’s an active search term. (#18636)
• Timestamps in the control panel now include their time zone abbreviation. (#18639)
• Generated field values are no longer truncated within element cards. (#18646)
• Assets’ Alternative Text values are now automatically set on upload, based on descriptive text data found in the uploaded file’s metadata. (#18744)
• When deleting elements, a modal window is now shown alerting the user of any potential issues, such as existing relationships. (#18728)
• “Verification Code” and “Recovery Code” forms no longer get auto-submitted when entering a value.
• Number columns within Table fields are now formatted according to the user’s preferred formatting locale. (#18823)

Administration

• It’s now possible to replace the selected custom field for existing field layout elements. (#18814)
• Sections now have a “Min Authors” setting. (#18662)
• Time fields’ “Max Time” settings can now be set to an earlier time than “Min Time”, for overnight time ranges. (#18575)
• Component chips within component select inputs now have “Replace” actions.
• Newlines in system message bodies are now replaced with <br> tags. (#18058)
• Added the --to-default option to resave commands. (#18522)
• Added the --method option to the users/remove-2fa command. (#18732)

Development

• Added the heading()/h() and h1()…h6() Twig functions. (#18524)
• The tag() Twig function now accepts a string for its second argument. (#18524)
• The |attr, |parseAttr, and |removeClass Twig filters no longer log warnings when performed on a string without an HTML tag. (#17622)
• The |default Twig filter and is empty Twig test now treat all yii\base\Model instances as not empty. (#18727)
• The |number Twig filter now has a locale argument. (#18823)
• The |time and |datetime Twig filters now have withTimeZone arguments. (#18639)
• The |timestamp Twig filter now returns the current time, if applied to a null/empty string value. (#18642)
• dataUrl() is no longer allowed in sandboxed Twig environments by default.
• delete GraphQL queries now have a hardDelete argument. (#18511)
• Entry postDate values are now null on creation, rather than set to the dateCreated value. (#18642)
• Assets’ url GraphQL fields’ immediately arguments are no longer deprecated. (#18581)
• JSON fields now support array values in POST data. (#18705)
• Added craft\filters\SecFetchSiteFilter for request origin verification. (#18641)
• craft\fields\data\LinkData::getUrl() now has an $anyStatus argument, which can be set to false to prevent a value from being returned if a disabled/pending/expired element is linked. (#18527)
• Markdown parsing now respects the first number of ordered lists. (#18671)

Extensibility

• Added craft\base\DefaultableFieldInterface. (#18522)
• Added craft\base\Element::EVENT_DEFINE_DELETION_BLOCKERS. (#18728)
• Added craft\base\ElementActionInterface::getTriggerId().
• Added craft\base\ElementInterface::deletionBlockers(). (#18728)
• Added craft\base\ElementInterface::setDirtyFieldTracking().
• Added craft\elements\PopulateElementEvent::$content.
• Added craft\elements\db\ElementQuery::$activeQuery.
• Added craft\elements\db\ElementQueryInterface::collectIds().
• Added craft\elements\deletionblockers\BaseDeletionBlocker. (#18728)
• Added craft\elements\deletionblockers\DeletionBlockerInterface. (#18728)
• Added craft\elements\deletionblockers\EntryAuthorsBlocker. (#18728)
• Added craft\elements\deletionblockers\RelationDeletionBlocker. (#18728)
• Added craft\errors\FieldNotFoundException::$fieldId.
• Added craft\events\DefineElementDeletionBlockersEvent. (#18728)
• Added craft\fieldlayoutelements\CustomField::setFieldId().
• Added craft\helpers\ElementHelper::belongsToCanonicalOwner().
• Added craft\helpers\Html::jsWithVars().
• Added craft\helpers\Markdown. (#18671)
• Added craft\models\Section::$minAuthors. (#18662)
• Added craft\queue\jobs\ReplaceRelations. (#18728)
• Added craft\services\Elements::REF_TAG_PATTERN.
• Added craft\services\Entries::reassignEntries().
• Added craft\validators\TimeValidator::$outOfRange. (#18575)
• Added Craft.CpScreenSlideout::reload(). (#18625)
• Added Craft.ElementDeletionManager.
• craft\elements\PopulateElementEvent::$row no longer includes fieldValues or generatedFieldValues keys.
• craft\helpers\DateTimeHelper::timeZoneAbbreviation() is no longer deprecated, and now has a $date argument.
• craft\i18n\Formatter::asTime() and asDatetime() now have $withTimeZone arguments. (#18639)
• Removed craft\controllers\AppController::actionResourceJs(). (#18559)
• Craft.CP now triggers a queueCompleted event when the last queue job is completed.
• Deprecated craft\controllers\UsersController::EVENT_DEFINE_CONTENT_SUMMARY. (#18728)
• Deprecated craft\elements\User::$inheritorOnDelete. (#18728)
• Deprecated craft\elements\actions\DeleteUsers. (#18728)
• Deprecated craft\events\DefineUserContentSummaryEvent. (#18728)
• Deprecated Craft.DeleteUserModal. (#18728)

System

• Improve the image quality of WEBP transforms, when optimizeImageFilesize is disabled. (#18635)
• Cross-domain script tags added by JavaScript are now loaded directly, rather than via a proxy. (#18559)
• Updated Twig to 3.24. (#18259, #18454)
• Updated bacon/bacon-qr-code to 3.x. (#18742)
• Updated the built-in composer.phar to 2.9.8. (#18761)
• Fixed a bug where nested entries weren’t getting loaded with their content, if they had an entry type that was no longer allowed by their Matrix field.
• Fixed the wording of the validation error when saving a nested entry with an invalid entry type. (#18506)
• Fixed a bug where relation fields’ element query params weren’t limiting results based on the query’s target site(s). (#18781)
• Fixed a bug where nested content could be updated unexpectedly or deleted after making successive edits to it. (#18835)
• Fixed a bug where full-page element edit screens weren’t being reloaded automatically when the element was saved in another tab.
• Fixed a high-severity RCE vulnerability. (GHSA-f74w-488g-8x5r)
• Fixed a moderate-severity JavaScript injection vulnerability. (GHSA-c55v-343g-5xff)
• Fixed a moderate-severity path traversal vulnerability. (GHSA-287w-mxq6-x2cp)

Development

• The |default Twig filter and is empty Twig test now treat all yii\base\Model instances as not empty. (#18727)
• Added craft\filters\SecFetchSiteFilter for request origin verification. (#18641)
• dataUrl() is no longer allowed in sandboxed Twig environments by default.

Extensibility

• Removed craft\controllers\AppController::actionResourceJs(). (#18559)

System

• Cross-domain script tags added by JavaScript are now loaded directly, rather than via a proxy. (#18559)
• Updated the built-in composer.phar to 2.9.8. (#18761)
• Fixed a moderate-severity JavaScript injection vulnerability. (GHSA-c55v-343g-5xff)
• Fixed a moderate-severity path traversal vulnerability. (GHSA-287w-mxq6-x2cp)

• Updated Yii to 2.0.55. (#18833)
• Fixed a bug where the “Move…” asset index action was always disabled for files. (#18798)
• Fixed a bug where nested elements would get soft-deleted after running the entrify/global-set command on subsequent environments. (#18767)
• Fixed a bug where row headings within Table fields weren’t getting statically translated in the control panel. (#13703)
• Fixed a bug where entry type chips within Matrix settings could be missing their action items.
• Fixed a bug where custom field override settings’ Label, Handle, and Instructions fields could be missing their placeholder values.
• Fixed a bug where site name and language values set to environment variables were getting replaced with their resolved values when installing Craft. (#18780)
• Fixed a bug where site name values set to environment variables were getting replaced with their resolved values on save. (#18789)
• Fixed a bug where browser tabs weren’t always getting refreshed when nested elements were reordered on another browser tab.
• Fixed a bug where reordering nested elements on a draft could reorder them on the canonical owner element as well. (#18751)
• Fixed a high-severity XSS vulnerability. (GHSA-24x4-j6x9-rfw5)
• Fixed a moderate-severity XSS vulnerability. (GHSA-xrqc-p465-2xvg)

• Updated Yii to 2.0.55. (#18833)
• Fixed a bug where the “Move…” asset index action was always disabled for files. (#18798)
• Fixed a high-severity XSS vulnerability. (GHSA-24x4-j6x9-rfw5)

Development

• Reference tags now support fallback values when no attribute is specified. (#17688)
• Deprecated support for categories, global sets, and tags. (#18009)

Extensibility

• Added CraftCms\Cms\Support\Arr.
• Added CraftCms\Cms\Support\DateTimeHelper.
• Added CraftCms\Cms\Support\File.
• Added CraftCms\Cms\Support\Facades\Path.
• Added CraftCms\Cms\Support\Facades\Markdown.
• Added CraftCms\Cms\Support\Path.
• Added CraftCms\Cms\Support\Str.
• Added CraftCms\Cms\Support\URL.
• Added CraftCms\Cms\action_url(), CraftCms\Cms\cp_url(), and CraftCms\Cms\site_url() helper functions.
• craft\services\Elements::stopCollectingCacheInfo() no longer sets the returned duration to the cacheDuration config setting if a duration wasn’t explicitly declared. (#16796)
• Deprecated craft\helpers\ArrayHelper. CraftCms\Cms\Support\Arr should be used instead.
• Deprecated craft\helpers\ConfigHelper. CraftCms\Cms\Support\Config should be used instead.
• Deprecated craft\helpers\DateTimeHelper. CraftCms\Cms\Support\DateTimeHelper should be used instead.
• Deprecated craft\helpers\Diff. CraftCms\Cms\Support\Diff should be used instead.
• Deprecated craft\helpers\ElementHelper. CraftCms\Cms\Element\ElementHelper should be used for core element helper APIs, CraftCms\Cms\Element\ElementSources for source lookup, CraftCms\Cms\Element\ElementAttributeRenderer for attribute rendering, CraftCms\Cms\Element\Drafts for provisional draft helpers, CraftCms\Cms\Field\Enums\TranslationMethod for translation helpers, and Illuminate\Support\Facades\Context with CraftCms\Cms\Element\Drafts::CONTEXT_PREVIEW_USER_ID for preview-user context.
• Deprecated craft\helpers\Html. CraftCms\Cms\Support\Html should be used instead.
• Deprecated craft\helpers\HtmlPurifier. CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizers should be used for HTML sanitization, and CraftCms\Cms\Support\Str should be used for UTF-8 cleanup instead.
• Deprecated craft\helpers\HtmlPurifier::process(). CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizers::sanitize() should be used instead.
• Deprecated craft\helpers\HtmlPurifier::cleanUtf8().
• Deprecated craft\helpers\HtmlPurifier::convertToUtf8(). CraftCms\Cms\Support\Str::convertToUtf8() should be used instead.
• Deprecated craft\helpers\HtmlPurifier::configure(). CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizers::defaults() or a custom sanitizer registration should be used instead.
• Deprecated config/craft/htmlpurifier/*.json sanitizer config files. Sanitizers should be registered on CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizers instead.
• Deprecated craft\services\Path. CraftCms\Cms\Support\Path should be used instead.
• Deprecated craft\helpers\SessionHelper. Illuminate\Support\Facades\Session should be used instead.
• Deprecated craft\helpers\Sequence. CraftCms\Cms\Support\Sequence should be used instead.
• Deprecated craft\helpers\StringHelper. CraftCms\Cms\Support\Str should be used instead.
• Deprecated Craft::$app->getConfig()->getGeneral(). CraftCms\Cms\Config\GeneralConfig should be used instead. This can be used through dependency injection or through app(CraftCms\Cms\Config\GeneralConfig::class).
• Deprecated craft.app.config.general in Twig. app.config.craft.general should be used instead.
• Deprecated craft\helpers\App::env(), CraftCms\Cms\Support\Env::get() should be used instead.
• Deprecated craft\markdown\Markdown, craft\markdown\GithubMarkdown, craft\markdown\MarkdownExtra, and craft\markdown\PreEncodedMarkdown. CraftCms\Cms\Support\Facades\Markdown should be used instead.
• Deprecated craft\helpers\DateRange. CraftCms\Cms\Shared\Enums\DateRangeType and CraftCms\Cms\Shared\Enums\DateRangePeriod should be used instead.
• Deprecated craft\helpers\Cp. One of the following classes should be used instead:
  • CraftCms\Cms\Cp\Alerts
  • CraftCms\Cms\Cp\FormFields
  • CraftCms\Cms\Cp\Html\ContentHtml
  • CraftCms\Cms\Cp\Html\ElementHtml
  • CraftCms\Cms\Cp\Html\ElementIndexHtml
  • CraftCms\Cms\Cp\Html\MenuHtml
  • CraftCms\Cms\Cp\Html\PreviewHtml
  • CraftCms\Cms\Cp\Html\StatusHtml
  • CraftCms\Cms\Cp\Icons
  • CraftCms\Cms\Cp\RequestedSite
• Deprecated craft\helpers\Json. CraftCms\Cms\Support\Json should be used instead.
• Deprecated craft\services\Composer. CraftCms\Cms\Support\Composer should be used instead.
• Deprecated craft\enums\Color. CraftCms\Cms\Support\Enums\Color should be used instead.
• Deprecated craft\enums\AttributeStatus. CraftCms\Cms\Element\Enums\AttributeStatus should be used instead.
• Deprecated craft\enums\CmsEdition. CraftCms\Cms\Edition should be used instead.
• Deprecated craft\enums\ElementIndexViewMode. CraftCms\Cms\Element\Enums\ElementIndexViewMode should be used instead.
• Deprecated craft\enums\LicenseKeyStatus. CraftCms\Cms\Support\Enums\LicenseKeyStatus should be used instead.
• Deprecated craft\enums\MenuItemType. CraftCms\Cms\Element\Enums\MenuItemType should be used instead.
• Deprecated craft\enums\PropagationMethod. CraftCms\Cms\Element\Enums\PropagationMethod should be used instead.
• Deprecated craft\enums\TimePeriod. CraftCms\Cms\Support\Enums\TimePeriod should be used instead.
• Deprecated craft\services\Gc. CraftCms\Cms\GarbageCollection\GarbageCollection should be used instead.
• Deprecated craft\services\Api. CraftCms\Cms\Support\Api should be used instead.
• Deprecated craft\helpers\Api. CraftCms\Cms\Support\Api should be used instead.
• Deprecated craft\nameparsing\CustomLanguage. CraftCms\Cms\Shared\Nameparser\CustomLanguage should be used instead.
• Deprecated craft\helpers\App. The following classes/methods should be used instead:

  • General helpers

  • App:devMode() -> app()->hasDebugModeEnabled()
  • App:parseBooleanEnv() --> \CraftCms\Cms\Support\Env::parseBoolean()
  • App:normalizeValue() --> \CraftCms\Cms\normalizeValue()
  • App:maxPowerCaptain() --> \CraftCms\Cms\maxPowerCaptain()
  • App:silence() --> \CraftCms\Cms\silence()
  • App:backtrace() --> \CraftCms\Cms\backtraceAsString()

  • Env

  • App:env() --> \CraftCms\Cms\Support\Env::get()
  • App:parseEnv() --> \CraftCms\Cms\Support\Env::parse()

  • PHP

  • App:phpVersion() --> \CraftCms\Cms\Support\PHP::version()
  • App:extensionVersion() --> \CraftCms\Cms\Support\PHP::extensionVersion()
  • App:phpConfigValueAsBool() --> \CraftCms\Cms\Support\PHP::configValueAsBool()
  • App:phpConfigValueInBytes() --> \CraftCms\Cms\Support\PHP::configValueInBytes()
  • App:phpSizeToBytes() --> \CraftCms\Cms\Support\PHP::sizeToBytes()
  • App:phpConfigValueAsPaths() --> \CraftCms\Cms\Support\PHP::configValueAsPaths()
  • App:normalizePhpPaths() --> \CraftCms\Cms\Support\PHP::normalizePaths()
  • App:isPathAllowed() --> \CraftCms\Cms\Support\PHP::isPathAllowed()
  • App:phpExecutable() --> \CraftCms\Cms\Support\PHP::executable()
  • App:testIniSet() --> \CraftCms\Cms\Support\PHP::testIniSet()
  • App:checkForValidIconv() --> \CraftCms\Cms\Support\PHP::checkForValidIconv()
  • App:supportsIdn() --> \CraftCms\Cms\Support\PHP::supportsIdn()

  • License

  • App:licenseKey() --> app(\CraftCms\Cms\License\License::class)->key()
  • App:licensingIssues() --> app(\CraftCms\Cms\License\License::class)->issues()
  • App:licenseShunCookieName() --> app(\CraftCms\Cms\License\License::class)->shunCookieName()
  • App:licensingIssuesHash() --> app(\CraftCms\Cms\License\License::class)->issuesHash()
• Deprecated Craft::createGuzzleClient(). CraftCms\Cms\Support\Facades\Http::create() should be used instead.
• Deprecated craft\helpers\FileHelper. CraftCms\Cms\Support\File should be used instead.
• Deprecated craft\helpers\UrlHelper. CraftCms\Cms\Support\URL should be used instead.

Deprecator

• Added CraftCms\Cms\Support\Facades\Deprecator.
• Added CraftCms\Cms\Deprecator\Commands\ClearDeprecations.
• Removed craft\console\controllers\ClearDeprecationsController.php.
• Deprecated craft\services\Deprecator. CraftCms\Cms\Deprecator\Deprecator should be used instead.
• Deprecated craft\models\DeprecationError. CraftCms\Cms\Deprecator\Models\DeprecationError should be used instead.
• Deprecated craft\errors\DeprecationException. CraftCms\Cms\Deprecator\Exceptions\DeprecationException should be used instead.

Console commands

• Added php craft twig:cache - Precompile Twig views
• Added php craft twig:clear - Clear precompiled Twig views
• craft\console\controllers\EnvController has been removed in favor of the classes below:
  • CraftCms\Cms\Console\Commands\Env\EnvRemoveCommand => php craft env:remove
  • CraftCms\Cms\Console\Commands\Env\EnvSetCommand => php craft env:set
  • CraftCms\Cms\Console\Commands\Env\EnvShowCommand => php craft env:show
• craft\console\controllers\IndexAssetsController has been removed in favor of the classes below:
  • CraftCms\Cms\Asset\Commands\CleanupAssetIndexesCommand => php craft index-assets:cleanup
  • CraftCms\Cms\Asset\Commands\IndexAllAssetsCommand => php craft index-assets:all
  • CraftCms\Cms\Asset\Commands\IndexOneAssetCommand => php craft index-assets:one
• craft\console\controllers\BaseSystemStatusController, craft\console\controllers\OnController, and craft\console\controllers\OffController have been removed in favor of the classes below:
  • CraftCms\Cms\Console\Commands\System\OnCommand => php craft on
  • CraftCms\Cms\Console\Commands\System\OffCommand => php craft off
• craft\console\controllers\ElementsController has been removed in favor of the classes below:
  • CraftCms\Cms\Element\Commands\DeleteCommand => php craft elements:delete
  • CraftCms\Cms\Element\Commands\DeleteAllOfTypeCommand => php craft elements:delete-all-of-type
  • CraftCms\Cms\Element\Commands\RestoreCommand => php craft elements:restore
• craft\console\controllers\UpdateStatusesController has been removed in favor of the class below:
  • CraftCms\Cms\Entry\Commands\UpdateStatusesCommand => php craft update-statuses
• craft\console\controllers\utils\FixElementUidsController has been removed in favor of the class below:
  • CraftCms\Cms\Console\Commands\Utils\FixElementUidsCommand => php craft utils:fix-element-uids
• craft\console\controllers\utils\FixFieldLayoutUidsController has been removed in favor of the class below:
  • CraftCms\Cms\Console\Commands\Utils\FixFieldLayoutUidsCommand => php craft utils:fix-field-layout-uids
• craft\console\controllers\utils\PruneOrphanedEntriesController has been removed in favor of the class below:
  • CraftCms\Cms\Console\Commands\Utils\PruneOrphanedEntriesCommand => php craft utils:prune-orphaned-entries
• craft\console\controllers\utils\PruneProvisionalDraftsController has been removed in favor of the class below:
  • CraftCms\Cms\Console\Commands\Utils\PruneProvisionalDraftsCommand => php craft utils:prune-provisional-drafts
• craft\console\controllers\utils\PruneRevisionsController has been removed in favor of the class below:
  • CraftCms\Cms\Console\Commands\Utils\PruneRevisionsCommand => php craft utils:prune-revisions
• craft\console\controllers\utils\RepairController::actionProjectConfig() has been removed in favor of the class below:
  • CraftCms\Cms\ProjectConfig\Commands\RepairCommand => php craft project-config:repair

Mutex

Craft's Mutex classes have been deprecated. Laravel's atomic locking should be used instead.

• Deprecated craft\mutex\Mutex
• Deprecated craft\mutex\MutexTrait
• Deprecated Craft::$app->getMutex()

Components

• Deprecated craft\base\ComponentInterface. CraftCms\Cms\Component\Contracts\ComponentInterface should be used instead.
• Deprecated craft\base\ConfigurableComponentInterface. CraftCms\Cms\Component\Contracts\ConfigurableComponentInterface should be used instead.
• Deprecated craft\base\SavableComponentInterface. CraftCms\Cms\Component\Contracts\SavableComponentInterface should be used instead.

Dashboard & Widgets

Controllers

• Removed craft\controllers\DashboardController. The following controllers now implement this functionality:
  • CraftCms\Cms\Http\Controllers\Dashboard\DashboardController
  • CraftCms\Cms\Http\Controllers\Dashboard\WidgetsController
  • CraftCms\Cms\Http\Controllers\Dashboard\Widgets\CraftSupportController
  • CraftCms\Cms\Http\Controllers\Dashboard\Widgets\FeedController

Deprecations

• Deprecated Craft::$app->getDashboard(). app(\CraftCms\Cms\Dashboard\Dashboard::class) should be used instead.
• Deprecated craft\services\Dashboard. CraftCms\Cms\Dashboard\Dashboard should be used instead.
• Deprecated craft\base\Widget. CraftCms\Cms\Dashboard\Widgets\Widget should be used instead.
• Deprecated craft\base\WidgetInterface. CraftCms\Cms\Dashboard\Contracts\WidgetInterface should be used instead.
• Deprecated craft\base\WidgetTrait.
• Deprecated craft\widgets\CraftSupport. CraftCms\Cms\Dashboard\Widgets\CraftSupport should be used instead.
• Deprecated craft\widgets\Feed. CraftCms\Cms\Dashboard\Widgets\Feed should be used instead.
• Deprecated craft\widgets\MissingWidget. CraftCms\Cms\Dashboard\Widgets\MissingWidget should be used instead.
• Deprecated craft\widgets\MyDrafts. CraftCms\Cms\Dashboard\Widgets\MyDrafts should be used instead.
• Deprecated craft\widgets\NewUsers. CraftCms\Cms\Dashboard\Widgets\NewUsers should be used instead.
• Deprecated craft\widgets\QuickPost. CraftCms\Cms\Dashboard\Widgets\QuickPost should be used instead.
• Deprecated craft\widgets\RecentEntries. CraftCms\Cms\Dashboard\Widgets\RecentEntries should be used instead.
• Deprecated craft\widgets\Updates. CraftCms\Cms\Dashboard\Widgets\Updates should be used instead.
• Deprecated craft\records\Widget. CraftCms\Cms\Dashboard\Models\Widget should be used instead.

Events

• Deprecated craft\services\Dashboard::EVENT_REGISTER_WIDGET_TYPES. CraftCms\Cms\Dashboard\Events\WidgetTypesResolving should be used instead.
• Deprecated craft\events\WidgetEvent in favor of the following new events:
  • craft\services\Dashboard::EVENT_BEFORE_SAVE_WIDGET => CraftCms\Cms\Dashboard\Events\WidgetSaving
  • craft\services\Dashboard::EVENT_AFTER_SAVE_WIDGET => CraftCms\Cms\Dashboard\Events\WidgetSaved
  • craft\services\Dashboard::EVENT_BEFORE_DELETE_WIDGET => CraftCms\Cms\Dashboard\Events\WidgetDeleting
  • craft\services\Dashboard::EVENT_AFTER_DELETE_WIDGET => CraftCms\Cms\Dashboard\Events\WidgetDeleted

Address

• Added CraftCms\Cms\Support\Facades\Addresses.

Assets

• Added CraftCms\Cms\Asset\AssetsHelper.
• Added CraftCms\Cms\Support\Facades\Assets.
• Added CraftCms\Cms\Support\Facades\AssetIndexer facade.
• Added CraftCms\Cms\Support\Facades\Folders.
• Deprecated craft\helpers\Assets. CraftCms\Cms\Asset\AssetsHelper should be used instead.
• Deprecated craft\services\Assets. CraftCms\Cms\Asset\Assets and CraftCms\Cms\Asset\Folders should be used instead.
• Deprecated \craft\records\Asset. \CraftCms\Cms\Asset\Models\Asset should be used instead.
• Deprecated \craft\records\AssetIndexData. \CraftCms\Cms\Asset\Models\AssetIndexData should be used instead.
• Deprecated \craft\records\AssetIndexingSession. \CraftCms\Cms\Asset\Models\AssetIndexingSession should be used instead.
• Deprecated \craft\records\Volume. \CraftCms\Cms\Asset\Models\Volume should be used instead.
• Deprecated \craft\records\VolumeFolder. \CraftCms\Cms\Asset\Models\VolumeFolder should be used instead.
• Deprecated \craft\controllers\AssetIndexesController. \CraftCms\Cms\Http\Controllers\Utilities\AssetIndexesController should be used instead.
• Deprecated craft\services\AssetIndexer. CraftCms\Cms\Asset\AssetIndexer should be used instead.
• Deprecated craft\models\AssetIndexData. CraftCms\Cms\Asset\Data\AssetIndexEntry should be used instead.
• Deprecated craft\models\AssetIndexingSession. CraftCms\Cms\Asset\Data\IndexingSession should be used instead.
• Deprecated craft\errors\AssetException. CraftCms\Cms\Asset\Exceptions\AssetException should be used instead.
• Deprecated craft\errors\AssetDisallowedExtensionException. CraftCms\Cms\Asset\Exceptions\AssetDisallowedExtensionException should be used instead.
• Deprecated craft\errors\AssetNotIndexableException. CraftCms\Cms\Asset\Exceptions\AssetNotIndexableException should be used instead.
• Deprecated craft\errors\FileException. CraftCms\Cms\Asset\Exceptions\FileException should be used instead.
• Deprecated craft\errors\ImageException. CraftCms\Cms\Asset\Exceptions\ImageException should be used instead.
• Deprecated craft\errors\ImageTransformException. CraftCms\Cms\Asset\Exceptions\ImageTransformException should be used instead.
• Deprecated craft\errors\MissingAssetException. CraftCms\Cms\Asset\Exceptions\MissingAssetException should be used instead.
• Deprecated craft\errors\MissingVolumeFolderException. CraftCms\Cms\Asset\Exceptions\MissingVolumeFolderException should be used instead.
• Deprecated craft\errors\VolumeException. CraftCms\Cms\Asset\Exceptions\VolumeException should be used instead.

Events

• Added CraftCms\Cms\Asset\Events\AssetFileKindsResolving.
• Added CraftCms\Cms\Asset\Events\SetAssetFilename.
• Deprecated craft\events\SetAssetFilenameEvent. CraftCms\Cms\Asset\Events\SetAssetFilename should be used instead.
• Deprecated craft\events\RegisterAssetFileKindsEvent. CraftCms\Cms\Asset\Events\AssetFileKindsResolving should be used instead.
• Deprecated craft\events\ReplaceAssetEvent in favor of the following new events:
  • craft\services\Assets::EVENT_BEFORE_REPLACE_ASSET => CraftCms\Cms\Asset\Events\AssetReplacing
  • craft\services\Assets::EVENT_AFTER_REPLACE_ASSET => CraftCms\Cms\Asset\Events\AssetReplaced
• Deprecated craft\events\DefineAssetThumbUrlEvent. CraftCms\Cms\Asset\Events\ThumbUrlResolving should be used instead.
• Deprecated craft\events\AssetPreviewEvent. CraftCms\Cms\Asset\Events\PreviewHandlerResolving should be used instead.

Auth

• Refactored the authentication system to use Laravel's authentication system.
• Added CraftCms\Cms\Auth\Events\SettingPassword.
• Added CraftCms\Cms\User\Notifications\ResetPasswordNotification.
• Deprecated craft\services\Auth. CraftCms\Cms\Auth\Auth should be used instead.
• Deprecated craft\web\User. auth('craft')->user() or CraftCms\Cms\User\Elements\User methods should be used instead.
• Deprecated craft\events\AuthenticateUserEvent. CraftCms\Cms\Auth\Events\UserAuthenticating should be used instead.
• Deprecated \craft\records\Authenticator. \CraftCms\Cms\Auth\Models\Authenticator should be used instead.
• Deprecated \craft\records\RecoveryCodes. \CraftCms\Cms\Auth\Models\RecoveryCodes should be used instead.
• Deprecated \craft\records\SsoIdentity. \CraftCms\Cms\Auth\Models\SsoIdentity should be used instead.
• Deprecated \craft\records\WebAuthn. \CraftCms\Cms\Auth\Models\WebAuthn should be used instead.
• Deprecated craft\behaviors\SessionBehavior::authorize. CraftCms\Cms\Auth\SessionAuth::authorize should be used instead.
• Deprecated craft\behaviors\SessionBehavior::deauthorize. CraftCms\Cms\Auth\SessionAuth::deauthorize should be used instead.
• Deprecated craft\behaviors\SessionBehavior::checkAuthorization. CraftCms\Cms\Auth\SessionAuth::checkAuthorization should be used instead.
• Deprecated craft\services\Users::isVerificationCodeValidForUser(). Password::broker('craft')->tokenExists($user, $code) should be used instead.
• Deprecated GeneralConfig::elevatedSessionDuration(). The auth.password_timeout config value should be used instead. To disable password confirmation (elevated sessions), you now set this value to -1 instead of 0.
  • Elevated sessions now work through Laravel's password confirmation system.
• Removed craft\controllers\AuthController. The following controllers now implement this functionality:
  • CraftCms\Cms\Http\Controllers\Users\AuthMethodController
  • CraftCms\Cms\Http\Controllers\Users\PasskeysController
  • CraftCms\Cms\Http\Controllers\Users\RecoveryCodesController
• Removed verificationCode and verificationCodeIssuedDate columns on the users table in favor of the password_reset_tokens table.

Authorization

Craft 6 now uses Laravel's authorization system for element authorization checks.

Added

• Added CraftCms\Cms\Auth\Events\ElementAuthorizing event for customizing element authorization.
• Added CraftCms\Cms\Element\Policies\ElementPolicy base policy for element authorization.
• Added element-specific authorization policies:
  • CraftCms\Cms\Address\Policies\AddressPolicy
  • CraftCms\Cms\Asset\Policies\AssetPolicy
  • CraftCms\Cms\Entry\Policies\EntryPolicy
  • CraftCms\Cms\User\Policies\UserPolicy
  • CraftCms\Cms\Field\Policies\ContentBlockPolicy

Passkeys

• Added CraftCms\Cms\Auth\Passkeys\Passkeys.
• Deprecated craft\services\Auth passkey methods. The following should be used instead:
  • Auth::hasPasskeys() -> app(Passkeys::class)->hasPasskeys()
  • Auth::getPasskeys() -> app(Passkeys::class)->getPasskeys()
  • Auth::getPasskeyCreationOptions() -> app(Passkeys::class)->getPasskeyCreationOptions()
  • Auth::verifyPasskeyCreationResponse() -> app(Passkeys::class)->verifyPasskeyCreationResponse()
  • Auth::getPasskeyRequestOptions() -> app(Passkeys::class)->getPasskeyRequestOptions()
  • Auth::verifyPasskey() -> app(Passkeys::class)->verifyPasskey()
  • Auth::deletePasskey() -> app(Passkeys::class)->deletePasskey()
• Deprecated craft\auth\passkeys\CredentialRepository. CraftCms\Cms\Auth\Passkeys\CredentialRepository should be used instead.
• Deprecated craft\auth\passkeys\WebauthnServer. CraftCms\Cms\Auth\Passkeys\WebauthnServer should be used instead.

Conditions

Added

• Added CraftCms\Cms\Support\Facades\Conditions.

Controllers

• Removed craft\controllers\ConditionsController. CraftCms\Cms\Http\Controllers\ConditionsController should be used instead.

Deprecations

Service

• Deprecated craft\services\Conditions. CraftCms\Cms\Condition\Conditions should be used instead.

Base Conditions

• Deprecated craft\base\conditions\ConditionInterface. CraftCms\Cms\Condition\Contracts\ConditionInterface should be used instead.
• Deprecated craft\base\conditions\ConditionRuleInterface. CraftCms\Cms\Condition\Contracts\ConditionRuleInterface should be used instead.
• Deprecated craft\base\conditions\BaseCondition. CraftCms\Cms\Condition\BaseCondition should be used instead.
• Deprecated craft\base\conditions\BaseConditionRule. CraftCms\Cms\Condition\BaseConditionRule should be used instead.
• Deprecated craft\base\conditions\BaseTextConditionRule. CraftCms\Cms\Condition\BaseTextConditionRule should be used instead.
• Deprecated craft\base\conditions\BaseNumberConditionRule. CraftCms\Cms\Condition\BaseNumberConditionRule should be used instead.
• Deprecated craft\base\conditions\BaseSelectConditionRule. CraftCms\Cms\Condition\BaseSelectConditionRule should be used instead.
• Deprecated craft\base\conditions\BaseMultiSelectConditionRule. CraftCms\Cms\Condition\BaseMultiSelectConditionRule should be used instead.
• Deprecated craft\base\conditions\BaseLightswitchConditionRule. CraftCms\Cms\Condition\BaseLightswitchConditionRule should be used instead.
• Deprecated craft\base\conditions\BaseDateRangeConditionRule. CraftCms\Cms\Condition\BaseDateRangeConditionRule should be used instead.
• Deprecated craft\base\conditions\BaseElementSelectConditionRule. CraftCms\Cms\Condition\BaseElementSelectConditionRule should be used instead.

Elements

• Deprecated craft\elements\conditions\ElementCondition. CraftCms\Cms\Element\Conditions\ElementCondition should be used instead.
• Deprecated craft\elements\conditions\ElementConditionInterface. CraftCms\Cms\Element\Conditions\Contracts\ElementConditionInterface should be used instead.
• Deprecated craft\elements\conditions\ElementConditionRuleInterface. CraftCms\Cms\Element\Conditions\Contracts\ElementConditionRuleInterface should be used instead.
• Deprecated craft\elements\conditions\HintableConditionRuleTrait. CraftCms\Cms\Element\Conditions\HintableConditionRuleTrait should be used instead.
• Deprecated craft\elements\conditions\TitleConditionRule. CraftCms\Cms\Element\Conditions\TitleConditionRule should be used instead.
• Deprecated craft\elements\conditions\SlugConditionRule. CraftCms\Cms\Element\Conditions\SlugConditionRule should be used instead.
• Deprecated craft\elements\conditions\UriConditionRule. CraftCms\Cms\Element\Conditions\UriConditionRule should be used instead.
• Deprecated craft\elements\conditions\IdConditionRule. CraftCms\Cms\Element\Conditions\IdConditionRule should be used instead.
• Deprecated craft\elements\conditions\StatusConditionRule. CraftCms\Cms\Element\Conditions\StatusConditionRule should be used instead.
• Deprecated craft\elements\conditions\HasUrlConditionRule. CraftCms\Cms\Element\Conditions\HasUrlConditionRule should be used instead.
• Deprecated craft\elements\conditions\HasDescendantsRule. CraftCms\Cms\Element\Conditions\HasDescendantsRule should be used instead.
• Deprecated craft\elements\conditions\LevelConditionRule. CraftCms\Cms\Element\Conditions\LevelConditionRule should be used instead.
• Deprecated craft\elements\conditions\DateCreatedConditionRule. CraftCms\Cms\Element\Conditions\DateCreatedConditionRule should be used instead.
• Deprecated craft\elements\conditions\DateUpdatedConditionRule. CraftCms\Cms\Element\Conditions\DateUpdatedConditionRule should be used instead.
• Deprecated craft\elements\conditions\SiteConditionRule. CraftCms\Cms\Element\Conditions\SiteConditionRule should be used instead.
• Deprecated craft\elements\conditions\SiteGroupConditionRule. CraftCms\Cms\Element\Conditions\SiteGroupConditionRule should be used instead.
• Deprecated craft\elements\conditions\LanguageConditionRule. CraftCms\Cms\Element\Conditions\LanguageConditionRule should be used instead.
• Deprecated craft\elements\conditions\RelatedToConditionRule. CraftCms\Cms\Element\Conditions\RelatedToConditionRule should be used instead.
• Deprecated craft\elements\conditions\NotRelatedToConditionRule. CraftCms\Cms\Element\Conditions\NotRelatedToConditionRule should be used instead.

Entries

• Deprecated craft\elements\conditions\entries\EntryCondition. CraftCms\Cms\Entry\Conditions\EntryCondition should be used instead.
• Deprecated craft\elements\conditions\entries\PostDateConditionRule. CraftCms\Cms\Entry\Conditions\PostDateConditionRule should be used instead.
• Deprecated craft\elements\conditions\entries\ExpiryDateConditionRule. CraftCms\Cms\Entry\Conditions\ExpiryDateConditionRule should be used instead.
• Deprecated craft\elements\conditions\entries\SectionConditionRule. CraftCms\Cms\Entry\Conditions\SectionConditionRule should be used instead.
• Deprecated craft\elements\conditions\entries\TypeConditionRule. CraftCms\Cms\Entry\Conditions\TypeConditionRule should be used instead.
• Deprecated craft\elements\conditions\entries\AuthorConditionRule. CraftCms\Cms\Entry\Conditions\AuthorConditionRule should be used instead.
• Deprecated craft\elements\conditions\entries\AuthorGroupConditionRule. CraftCms\Cms\Entry\Conditions\AuthorGroupConditionRule should be used instead.
• Deprecated craft\elements\conditions\entries\ViewableConditionRule. CraftCms\Cms\Entry\Conditions\ViewableConditionRule should be used instead.
• Deprecated craft\elements\conditions\entries\SavableConditionRule. CraftCms\Cms\Entry\Conditions\SavableConditionRule should be used instead.
• Deprecated craft\elements\conditions\entries\FieldConditionRule. CraftCms\Cms\Entry\Conditions\FieldConditionRule should be used instead.

Users

• Deprecated craft\elements\conditions\users\UserCondition. CraftCms\Cms\User\Conditions\UserCondition should be used instead.
• Deprecated craft\elements\conditions\users\UsernameConditionRule. CraftCms\Cms\User\Conditions\UsernameConditionRule should be used instead.
• Deprecated craft\elements\conditions\users\EmailConditionRule. CraftCms\Cms\User\Conditions\EmailConditionRule should be used instead.
• Deprecated craft\elements\conditions\users\FirstNameConditionRule. CraftCms\Cms\User\Conditions\FirstNameConditionRule should be used instead.
• Deprecated craft\elements\conditions\users\LastNameConditionRule. CraftCms\Cms\User\Conditions\LastNameConditionRule should be used instead.
• Deprecated craft\elements\conditions\users\GroupConditionRule. CraftCms\Cms\User\Conditions\GroupConditionRule should be used instead.
• Deprecated craft\elements\conditions\users\AdminConditionRule. CraftCms\Cms\User\Conditions\AdminConditionRule should be used instead.
• Deprecated craft\elements\conditions\users\CredentialedConditionRule. CraftCms\Cms\User\Conditions\CredentialedConditionRule should be used instead.
• Deprecated craft\elements\conditions\users\LastLoginDateConditionRule. CraftCms\Cms\User\Conditions\LastLoginDateConditionRule should be used instead.
• Deprecated craft\elements\conditions\users\AffiliatedSiteConditionRule. CraftCms\Cms\User\Conditions\AffiliatedSiteConditionRule should be used instead.

Assets

• Deprecated craft\elements\conditions\assets\AssetCondition. CraftCms\Cms\Asset\Conditions\AssetCondition should be used instead.
• Deprecated craft\elements\conditions\assets\VolumeConditionRule. CraftCms\Cms\Asset\Conditions\VolumeConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\FilenameConditionRule. CraftCms\Cms\Asset\Conditions\FilenameConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\FileTypeConditionRule. CraftCms\Cms\Asset\Conditions\FileTypeConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\FileSizeConditionRule. CraftCms\Cms\Asset\Conditions\FileSizeConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\HeightConditionRule. CraftCms\Cms\Asset\Conditions\HeightConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\WidthConditionRule. CraftCms\Cms\Asset\Conditions\WidthConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\DateModifiedConditionRule. CraftCms\Cms\Asset\Conditions\DateModifiedConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\HasAltConditionRule. CraftCms\Cms\Asset\Conditions\HasAltConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\UploaderConditionRule. CraftCms\Cms\Asset\Conditions\UploaderConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\SavableConditionRule. CraftCms\Cms\Asset\Conditions\SavableConditionRule should be used instead.
• Deprecated craft\elements\conditions\assets\ViewableConditionRule. CraftCms\Cms\Asset\Conditions\ViewableConditionRule should be used instead.

Addresses

• Deprecated craft\elements\conditions\addresses\AddressCondition. CraftCms\Cms\Address\Conditions\AddressCondition should be used instead.
• Deprecated craft\elements\conditions\addresses\FullNameConditionRule. CraftCms\Cms\Address\Conditions\FullNameConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\OrganizationConditionRule. CraftCms\Cms\Address\Conditions\OrganizationConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\OrganizationTaxIdConditionRule. CraftCms\Cms\Address\Conditions\OrganizationTaxIdConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\LocalityConditionRule. CraftCms\Cms\Address\Conditions\LocalityConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\DependentLocalityConditionRule. CraftCms\Cms\Address\Conditions\DependentLocalityConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\PostalCodeConditionRule. CraftCms\Cms\Address\Conditions\PostalCodeConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\SortingCodeConditionRule. CraftCms\Cms\Address\Conditions\SortingCodeConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\CountryConditionRule. CraftCms\Cms\Address\Conditions\CountryConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\AdministrativeAreaConditionRule. CraftCms\Cms\Address\Conditions\AdministrativeAreaConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\AddressLine1ConditionRule. CraftCms\Cms\Address\Conditions\AddressLine1ConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\AddressLine2ConditionRule. CraftCms\Cms\Address\Conditions\AddressLine2ConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\AddressLine3ConditionRule. CraftCms\Cms\Address\Conditions\AddressLine3ConditionRule should be used instead.
• Deprecated craft\elements\conditions\addresses\FieldConditionRule. CraftCms\Cms\Address\Conditions\FieldConditionRule should be used instead.

Fields

• Deprecated craft\fields\conditions\FieldConditionRuleInterface. CraftCms\Cms\Field\Conditions\Contracts\FieldConditionRuleInterface should be used instead.
• Deprecated craft\fields\conditions\FieldConditionRuleTrait. CraftCms\Cms\Field\Conditions\FieldConditionRuleTrait should be used instead.
• Deprecated craft\fields\conditions\GeneratedFieldConditionRule. CraftCms\Cms\Field\Conditions\GeneratedFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\TextFieldConditionRule. CraftCms\Cms\Field\Conditions\TextFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\NumberFieldConditionRule. CraftCms\Cms\Field\Conditions\NumberFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\MoneyFieldConditionRule. CraftCms\Cms\Field\Conditions\MoneyFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\OptionsFieldConditionRule. CraftCms\Cms\Field\Conditions\OptionsFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\RelationalFieldConditionRule. CraftCms\Cms\Field\Conditions\RelationalFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\LightswitchFieldConditionRule. CraftCms\Cms\Field\Conditions\LightswitchFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\EmptyFieldConditionRule. CraftCms\Cms\Field\Conditions\EmptyFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\DateFieldConditionRule. CraftCms\Cms\Field\Conditions\DateFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\CountryFieldConditionRule. CraftCms\Cms\Field\Conditions\CountryFieldConditionRule should be used instead.
• Deprecated craft\fields\conditions\LinkFieldConditionRule. CraftCms\Cms\Field\Conditions\LinkFieldConditionRule should be used instead.

Events

• Deprecated craft\events\RegisterConditionRulesEvent. CraftCms\Cms\Condition\Events\ConditionRulesResolving should be used instead.

Drafts

• Deprecated craft\services\Drafts. CraftCms\Cms\Element\Drafts should be used instead.
• Deprecated craft\events\DraftEvent. One of the events extending CraftCms\Cms\Element\Events\DraftEvent should be used instead.
• Deprecated craft\behaviors\DraftBehavior. CraftCms\Cms\Element\Concerns\Draftable should be used instead.

Elements

• Added CraftCms\Cms\Element\ElementCaches and CraftCms\Cms\Support\Facades\ElementCaches.
  • Deprecated craft\services\Elements::getIsCollectingCacheInfo(). CraftCms\Cms\Element\ElementCaches::isCollectingCacheInfo() should be used instead.
  • Deprecated craft\services\Elements::startCollectingCacheInfo(). CraftCms\Cms\Element\ElementCaches::startCollectingCacheInfo() should be used instead.
  • Deprecated craft\services\Elements::collectCacheTags(). CraftCms\Cms\Element\ElementCaches::collectCacheTags() should be used instead.
  • Deprecated craft\services\Elements::setCacheExpiryDate(). CraftCms\Cms\Element\ElementCaches::setCacheExpiryDate() should be used instead.
  • Deprecated craft\services\Elements::collectCacheInfoForElement(). CraftCms\Cms\Element\ElementCaches::collectCacheInfoForElement() should be used instead.
  • Deprecated craft\services\Elements::stopCollectingCacheInfo(). CraftCms\Cms\Element\ElementCaches::stopCollectingCacheInfo() should be used instead.
  • Deprecated craft\services\Elements::invalidateAllCaches(). CraftCms\Cms\Element\ElementCaches::invalidateAll() should be used instead.
  • Deprecated craft\services\Elements::invalidateCachesForElementType(). CraftCms\Cms\Element\ElementCaches::invalidateForElementType() should be used instead.
  • Deprecated craft\services\Elements::invalidateCachesForElement(). CraftCms\Cms\Element\ElementCaches::invalidateForElement() should be used instead.
• Added CraftCms\Cms\Element\BulkOp\BulkOps, CraftCms\Cms\Element\BulkOp\BulkOpDeferrals, and CraftCms\Cms\Support\Facades\BulkOps.
  • Deprecated craft\services\Elements::getBulkOpKeys(). CraftCms\Cms\Element\BulkOp\BulkOps::activeKeys() should be used instead.
  • Deprecated craft\services\Elements::beginBulkOp(). CraftCms\Cms\Element\BulkOp\BulkOps::start() should be used instead.
  • Deprecated craft\services\Elements::resumeBulkOp(). CraftCms\Cms\Element\BulkOp\BulkOps::resume() should be used instead.
  • Deprecated craft\services\Elements::endBulkOp(). CraftCms\Cms\Element\BulkOp\BulkOps::end() should be used instead.
  • Deprecated craft\services\Elements::trackElementInBulkOps(). CraftCms\Cms\Element\BulkOp\BulkOps::trackElement() should be used instead.
  • Deprecated craft\services\Elements::ensureBulkOp(). CraftCms\Cms\Element\BulkOp\BulkOps::ensure() should be used instead.
  • Deprecated craft\events\BulkOpEvent::defer(). CraftCms\Cms\Element\BulkOp\BulkOps::defer() should be used instead.
• Added CraftCms\Cms\Element\ElementActivity, CraftCms\Cms\Element\Data\ElementActivity, CraftCms\Cms\Element\Enums\ElementActivityType, and CraftCms\Cms\Support\Facades\ElementActivity.
  • Deprecated craft\services\Elements::getRecentActivity(). CraftCms\Cms\Element\ElementActivity::getRecentActivity() should be used instead.
  • Deprecated craft\services\Elements::trackActivity(). CraftCms\Cms\Element\ElementActivity::trackActivity() should be used instead.
• Added CraftCms\Cms\Element\Actions\ElementAction, CraftCms\Cms\Element\ElementActions, CraftCms\Cms\Element\Contracts\DeleteActionInterface, CraftCms\Cms\Element\Contracts\ElementActionInterface, CraftCms\Cms\Element\Events\ElementActionPerformed, CraftCms\Cms\Element\Events\ElementActionPerforming, CraftCms\Cms\Http\Controllers\Elements\PerformElementActionController, and CraftCms\Cms\Support\Facades\ElementActions.
• Added Laravel-native element action classes under CraftCms\Cms\Element\Actions, CraftCms\Cms\Asset\Actions, CraftCms\Cms\Entry\Actions, and CraftCms\Cms\User\Actions.
• Added CraftCms\Cms\Element\ElementExporters, CraftCms\Cms\Element\Contracts\ElementExporterInterface, CraftCms\Cms\Element\Exporters\ElementExporter, CraftCms\Cms\Http\Controllers\Elements\ElementIndex\ExportElementIndexController, and CraftCms\Cms\Support\Facades\ElementExporters.
• Added Laravel-native element exporter classes under CraftCms\Cms\Element\Exporters.
• Deprecated craft\errors\InvalidTypeException. CraftCms\Cms\Element\Exceptions\InvalidTypeException should be used instead.
• Deprecated craft\errors\UnsupportedSiteException. CraftCms\Cms\Element\Exceptions\UnsupportedSiteException should be used instead.
• Deprecated craft\base\ElementAction, craft\base\ElementActionInterface, craft\elements\actions\DeleteActionInterface, and the legacy craft\elements\actions\* classes. The corresponding CraftCms\Cms\Element\Actions\*, CraftCms\Cms\Asset\Actions\*, CraftCms\Cms\Entry\Actions\*, and CraftCms\Cms\User\Actions\* classes should be used instead.
• Deprecated craft\base\ElementExporter, craft\base\ElementExporterInterface, and the legacy craft\elements\exporters\* classes. The corresponding CraftCms\Cms\Element\Exporters\* classes should be used instead.

Validation

Craft 6 introduces a new validation system that uses Laravel's Validator instead of Yii2's model validation.

Added

• Added CraftCms\Cms\Validation\Contracts\Validatable interface for classes that support Laravel-style validation.
• Added CraftCms\Cms\Validation\Contracts\ValidatableWithRuleset interface for classes that use a Ruleset class to define validation rules.
• Added CraftCms\Cms\Validation\Ruleset abstract class for defining validation rules, messages, and preparation logic.
• Added CraftCms\Cms\Validation\Attributes\Ruleset PHP attribute for specifying a component's ruleset class.
• Added CraftCms\Cms\Validation\Concerns\Validates trait for simple validation support.
• Added CraftCms\Cms\Validation\Concerns\ValidatesWithRuleset trait for ruleset-based validation.
• Added CraftCms\Cms\Validation\Concerns\HasScenarios trait for scenario-based validation filtering.
• Added CraftCms\Cms\Validation\Concerns\InteractsWithValidator trait providing common validator interactions.
• Added CraftCms\Cms\Element\Validation\ElementRules abstract class for defining element-specific validation rules.
• Added CraftCms\Cms\Element\Validation\Events\ValidationRulesResolving event for plugins to modify element validation rules.
• Added CraftCms\Cms\Element\Validation\Rules\ElementUriRule for validating element URIs.
• Added element-specific ruleset classes:
  • CraftCms\Cms\Address\Validation\AddressRules
  • CraftCms\Cms\Asset\Validation\AssetRules
  • CraftCms\Cms\Entry\Validation\EntryRules
  • CraftCms\Cms\User\Validation\UserRules
  • CraftCms\Cms\Field\Elements\ContentBlockRules
• Added CraftCms\Cms\Asset\Validation\Rules\AssetLocationRule for validating asset locations.
• Added CraftCms\Cms\User\Validation\Rules\UserPasswordRule for validating user passwords.
• Added CraftCms\Cms\User\Validation\Rules\UsernameRule for validating usernames.
• Added CraftCms\Cms\Validation\Rules\UniqueCaseInsensitiveRule for case-insensitive unique validation.
• Added CraftCms\Cms\Validation\Rules\DisallowMb4 for disallowing 4-byte UTF-8 characters.
• Added CraftCms\Cms\Validation\Rules\MoneyRule for validating money values.

Changed

• FieldInterface::getElementValidationRules() has been replaced by FieldInterface::getElementRules() which returns rules in Laravel's validation format.
• Added FieldInterface::prepareForElementValidation() for preparing field values before validation.
• Validation rules are now defined as Laravel-style arrays (e.g., ['required', 'string', 'max:255']).

Deprecations

• Deprecated craft\base\Model::hasErrors(). Use ->errors()->has($attribute) or ->errors()->isNotEmpty() instead.
• Deprecated craft\base\Model::getErrors(). Use ->errors()->get($attribute) or ->errors()->getMessages() instead.
• Deprecated craft\base\Model::addErrors(). Use ->errors()->add($attribute, $message) instead.
• Deprecated craft\base\Model::clearErrors(). Use ->errors()->forget() instead.
• Deprecated CraftCms\Cms\Component\Concerns\ValidatableComponent. Use CraftCms\Cms\Validation\Concerns\Validates instead.
• Deprecated CraftCms\Cms\Component\Contracts\ValidatableComponentInterface. Use CraftCms\Cms\Validation\Contracts\Validatable instead.
• Deprecated \craft\records\ContentBlock. \CraftCms\Cms\Element\Models\ContentBlock should be used instead.
• Deprecated \craft\records\Draft. \CraftCms\Cms\Element\Models\Draft should be used instead.
• Deprecated \craft\records\Element. \CraftCms\Cms\Element\Models\Element should be used instead.
• Deprecated \craft\records\Element_SiteSettings. \CraftCms\Cms\Element\Models\ElementSiteSettings should be used instead.
• Deprecated \craft\records\Revision. \CraftCms\Cms\Element\Models\Revision should be used instead.

ElementSources

• Deprecated craft\services\ElementSources. CraftCms\Cms\Element\ElementSources should be used instead.
• Deprecated craft\events\DefineSourceSortOptionsEvent. CraftCms\Cms\Element\Events\ElementSourceSortOptionsResolving should be used instead.
• Deprecated craft\events\DefineSourceTableAttributesEvent. CraftCms\Cms\Element\Events\ElementSourceTableAttributesResolving should be used instead.

Element Queries

• Deprecated craft\elements\db\ElementRelationParamParser. CraftCms\Cms\Database\ElementRelationParamFilter should be used instead.
• Deprecated craft\elements\db\NestedElementQueryInterface. CraftCms\Cms\Element\Queries\Contracts\NestedElementQueryInterface should be used instead.
• Deprecated craft\elements\db\NestedElementQueryTrait. CraftCms\Cms\Element\Queries\Concerns\QueriesNestedElements should be used instead.
• Deprecated craft\elements\db\OrderByPlaceholderExpression. CraftCms\Cms\Database\Expressions\OrderByPlaceholderExpression should be used instead.
• Deprecated \craft\elements\db\AddressQuery. \CraftCms\Cms\Element\Queries\AddressQuery should be used instead.
• Deprecated \craft\elements\db\AssetQuery \CraftCms\Cms\Element\Queries\AssetQuery should be used instead.
• Deprecated \craft\elements\db\ContentBlockQuery \CraftCms\Cms\Element\Queries\ContentBlockQuery should be used instead.
• Deprecated \craft\elements\db\ElementQuery \CraftCms\Cms\Element\Queries\ElementQuery should be used instead.
• Deprecated \craft\elements\db\ElementQueryInterface
• Deprecated \craft\elements\db\EntryQuery \CraftCms\Cms\Element\Queries\EntryQuery should be used instead.
• Deprecated \craft\elements\db\UserQuery \CraftCms\Cms\Element\Queries\UserQuery should be used instead.

Entries & Entry Types

• Updated entry type table pagination to return Laravel-style pagination metadata and use the configured GeneralConfig::$pageTrigger query parameter.
• Deprecated craft\services\Entries. CraftCms\Cms\Entry\Entries and CraftCms\Cms\Entry\EntryTypes should be used instead.
• Deprecated craft\models\EntryType. CraftCms\Cms\Entry\Data\EntryType should be used instead.
• Deprecated craft\records\EntryType. CraftCms\Cms\Entry\Models\EntryType should be used instead.
• Deprecated craft\records\Entry. CraftCms\Cms\Entry\Models\Entry should be used instead.
• Deprecated craft\errors\EntryTypeNotFoundException. CraftCms\Cms\Entry\Exceptions\EntryTypeNotFoundException should be used instead.
• Deprecated craft\events\EntryTypeEvent. One of these should be used instead:
  • craft\services\Entries::EVENT_BEFORE_DELETE_ENTRY_TYPE => CraftCms\Cms\Section\Events\DeletingEntryType
  • craft\services\Entries::EVENT_BEFORE_APPLY_ENTRY_TYPE_DELETE => CraftCms\Cms\Entry\Events\ApplyingEntryTypeDelete
  • craft\services\Entries::EVENT_AFTER_DELETE_ENTRY_TYPE => CraftCms\Cms\Entry\Events\EntryTypeDeleted
  • craft\services\Entries::EVENT_BEFORE_SAVE_ENTRY_TYPE => CraftCms\Cms\Entry\Events\EntryTypeSaving
  • craft\services\Entries::EVENT_AFTER_SAVE_ENTRY_TYPE => CraftCms\Cms\Entry\Events\EntryTypeSaved
• Removed craft\controllers\EntriesController. The following controllers now implement this functionality:
  • CraftCms\Cms\Http\Controllers\Entries\CreateEntryController
  • CraftCms\Cms\Http\Controllers\Entries\EntriesIndexController
  • CraftCms\Cms\Http\Controllers\Entries\MoveEntryToSectionController
  • CraftCms\Cms\Http\Controllers\Entries\StoreEntryController
• Removed craft\controllers\EntryTypesController in favor of CraftCms\Cms\Http\Controllers\EntryTypesController
• Removed craft\console\controllers\EntryTypesController in favor of:
  • CraftCms\Cms\Entry\Commands\MergeEntryTypesCommand

Component

• Added CraftCms\Cms\Component\Component base class, replacing Yii2's BaseObject/Component with config hydration, magic getters/setters, and Arrayable support.
• Added CraftCms\Cms\Component\Exceptions\InvalidCallException, replacing yii\base\InvalidCallException.
• Added CraftCms\Cms\Component\Exceptions\UnknownPropertyException, replacing yii\base\UnknownPropertyException.

Field Layouts

Added

• Added CraftCms\Cms\FieldLayout\FieldLayoutForm.
• Added CraftCms\Cms\FieldLayout\FieldLayoutFormTab.
• Added CraftCms\Cms\FieldLayout\FieldLayoutFormElement.
• Added CraftCms\Cms\FieldLayout\FieldLayoutServiceProvider.
• Added CraftCms\Cms\FieldLayout\Concerns\HasFieldLayout trait.

Deprecations

• Deprecated craft\models\FieldLayout. CraftCms\Cms\FieldLayout\FieldLayout should be used instead.
• Deprecated craft\models\FieldLayoutTab. CraftCms\Cms\FieldLayout\FieldLayoutTab should be used instead.
• Deprecated craft\base\FieldLayoutComponent. CraftCms\Cms\FieldLayout\FieldLayoutComponent should be used instead.
• Deprecated craft\base\FieldLayoutElement. CraftCms\Cms\FieldLayout\FieldLayoutElement should be used instead.
• Deprecated craft\base\FieldLayoutProviderInterface. CraftCms\Cms\FieldLayout\Contracts\FieldLayoutProviderInterface should be used instead.
• Deprecated craft\records\FieldLayout. CraftCms\Cms\FieldLayout\Models\FieldLayout should be used instead.
• Deprecated craft\fieldlayoutelements\BaseField. CraftCms\Cms\FieldLayout\LayoutElements\BaseField should be used instead.
• Deprecated craft\fieldlayoutelements\BaseNativeField. CraftCms\Cms\FieldLayout\LayoutElements\BaseNativeField should be used instead.
• Deprecated craft\fieldlayoutelements\BaseUiElement. CraftCms\Cms\FieldLayout\LayoutElements\BaseUiElement should be used instead.
• Deprecated craft\fieldlayoutelements\CustomField. CraftCms\Cms\FieldLayout\LayoutElements\CustomField should be used instead.
• Deprecated craft\fieldlayoutelements\Heading. CraftCms\Cms\FieldLayout\LayoutElements\Heading should be used instead.
• Deprecated craft\fieldlayoutelements\HorizontalRule. CraftCms\Cms\FieldLayout\LayoutElements\HorizontalRule should be used instead.
• Deprecated craft\fieldlayoutelements\Html. CraftCms\Cms\FieldLayout\LayoutElements\Html should be used instead.
• Deprecated craft\fieldlayoutelements\LineBreak. CraftCms\Cms\FieldLayout\LayoutElements\LineBreak should be used instead.
• Deprecated craft\fieldlayoutelements\Markdown. CraftCms\Cms\FieldLayout\LayoutElements\Markdown should be used instead.
• Deprecated craft\fieldlayoutelements\Template. CraftCms\Cms\FieldLayout\LayoutElements\Template should be used instead.
• Deprecated craft\fieldlayoutelements\TextField. CraftCms\Cms\FieldLayout\LayoutElements\TextField should be used instead.
• Deprecated craft\fieldlayoutelements\TextareaField. CraftCms\Cms\FieldLayout\LayoutElements\TextareaField should be used instead.
• Deprecated craft\fieldlayoutelements\Tip. CraftCms\Cms\FieldLayout\LayoutElements\Tip should be used instead.
• Deprecated craft\fieldlayoutelements\TitleField. CraftCms\Cms\FieldLayout\LayoutElements\TitleField should be used instead.
• Deprecated craft\fieldlayoutelements\FullNameField. CraftCms\Cms\FieldLayout\LayoutElements\FullNameField should be used instead.
• Deprecated craft\fieldlayoutelements\addresses\AddressField. CraftCms\Cms\FieldLayout\LayoutElements\addresses\AddressField should be used instead.
• Deprecated craft\fieldlayoutelements\addresses\CountryCodeField. CraftCms\Cms\FieldLayout\LayoutElements\addresses\CountryCodeField should be used instead.
• Deprecated craft\fieldlayoutelements\addresses\LabelField. CraftCms\Cms\FieldLayout\LayoutElements\addresses\LabelField should be used instead.
• Deprecated craft\fieldlayoutelements\addresses\LatLongField. CraftCms\Cms\FieldLayout\LayoutElements\addresses\LatLongField should be used instead.
• Deprecated craft\fieldlayoutelements\addresses\OrganizationField. CraftCms\Cms\FieldLayout\LayoutElements\addresses\OrganizationField should be used instead.
• Deprecated craft\fieldlayoutelements\addresses\OrganizationTaxIdField. CraftCms\Cms\FieldLayout\LayoutElements\addresses\OrganizationTaxIdField should be used instead.
• Deprecated craft\fieldlayoutelements\assets\AssetTitleField. CraftCms\Cms\FieldLayout\LayoutElements\assets\AssetTitleField should be used instead.
• Deprecated craft\fieldlayoutelements\assets\AltField. CraftCms\Cms\FieldLayout\LayoutElements\assets\AltField should be used instead.
• Deprecated craft\fieldlayoutelements\entries\EntryTitleField. CraftCms\Cms\FieldLayout\LayoutElements\Entries\EntryTitleField should be used instead.
• Deprecated craft\fieldlayoutelements\users\UsernameField. CraftCms\Cms\FieldLayout\LayoutElements\Users\UsernameField should be used instead.
• Deprecated craft\fieldlayoutelements\users\FullNameField. CraftCms\Cms\FieldLayout\LayoutElements\Users\FullNameField should be used instead.
• Deprecated craft\fieldlayoutelements\users\EmailField. CraftCms\Cms\FieldLayout\LayoutElements\Users\EmailField should be used instead.
• Deprecated craft\fieldlayoutelements\users\AffiliatedSiteField. CraftCms\Cms\FieldLayout\LayoutElements\Users\AffiliatedSiteField should be used instead.
• Deprecated craft\fieldlayoutelements\users\PhotoField. CraftCms\Cms\FieldLayout\LayoutElements\Users\PhotoField should be used instead.
• Deprecated craft\events\CreateFieldLayoutFormEvent. CraftCms\Cms\FieldLayout\Events\FieldLayoutFormCreating should be used instead.
• Deprecated craft\events\DefineFieldLayoutCustomFieldsEvent. CraftCms\Cms\FieldLayout\Events\FieldLayoutCustomFieldsResolving should be used instead.
• Deprecated craft\events\DefineFieldLayoutElementsEvent. CraftCms\Cms\FieldLayout\Events\FieldLayoutUIElementsResolving should be used instead.
• Deprecated craft\events\DefineFieldLayoutFieldsEvent. CraftCms\Cms\FieldLayout\Events\NativeFieldsResolving should be used instead.
• Deprecated craft\events\DefineShowFieldLayoutComponentInFormEvent. CraftCms\Cms\FieldLayout\Events\FieldLayoutComponentShowInFormResolving should be used instead.
• Deprecated craft\events\DefineFieldActionsEvent. CraftCms\Cms\FieldLayout\Events\FieldLayoutActionMenuItemsResolving should be used instead.

Fields

• Updated field index pagination to return Laravel-style pagination metadata and use the configured GeneralConfig::$pageTrigger query parameter.
• Removed craft\controllers\FieldsController in favor of CraftCms\Cms\Http\Controllers\FieldsController.
• Removed craft\controllers\MatrixController. CraftCms\Cms\Http\Controllers\MatrixController should be used instead.
• Removed craft\controllers\RelationalFieldsController. CraftCms\Cms\Http\Controllers\RelationalFieldsController should be used instead.
• Deprecated craft\errors\InvalidFieldException. CraftCms\Cms\Field\Exceptions\InvalidFieldException should be used instead.
• Deprecated craft\fields\data\ColorData. CraftCms\Cms\Field\Data\ColorData should be used instead.
• Deprecated craft\fields\data\IconData. CraftCms\Cms\Field\Data\IconData should be used instead.
• Deprecated craft\fields\data\JsonData. CraftCms\Cms\Field\Data\JsonData should be used instead.
• Deprecated craft\fields\data\LinkData. CraftCms\Cms\Field\Data\LinkData should be used instead.
• Deprecated craft\fields\data\MultiOptionsFieldData. CraftCms\Cms\Field\Data\MultiOptionsFieldData should be used instead.
• Deprecated craft\fields\data\OptionData. CraftCms\Cms\Field\Data\OptionData should be used instead.
• Deprecated craft\fields\data\SingleOptionFieldData. CraftCms\Cms\Field\Data\SingleOptionFieldData should be used instead.
• Deprecated craft\fields\linktypes\Asset. CraftCms\Cms\Field\LinkTypes\Asset should be used instead.
• Deprecated craft\fields\linktypes\BaseElementLinkType. CraftCms\Cms\Field\LinkTypes\BaseElementLinkType should be used instead.
• Deprecated craft\fields\linktypes\BaseLinkType. CraftCms\Cms\Field\LinkTypes\BaseLinkType should be used instead.
• Deprecated craft\fields\linktypes\BaseTextLinkType. CraftCms\Cms\Field\LinkTypes\BaseTextLinkType should be used instead.
• Deprecated craft\fields\linktypes\Category. CraftCms\Cms\Field\LinkTypes\Category should be used instead.
• Deprecated craft\fields\linktypes\Email. CraftCms\Cms\Field\LinkTypes\Email should be used instead.
• Deprecated craft\fields\linktypes\Entry. CraftCms\Cms\Field\LinkTypes\Entry should be used instead.
• Deprecated craft\fields\linktypes\Phone. CraftCms\Cms\Field\LinkTypes\Phone should be used instead.
• Deprecated craft\fields\linktypes\Sms. CraftCms\Cms\Field\LinkTypes\Sms should be used instead.
• Deprecated craft\fields\linktypes\Url. CraftCms\Cms\Field\LinkTypes\Url should be used instead.
• Deprecated craft\fields\Addresses. CraftCms\Cms\Field\Addresses should be used instead.
• Deprecated craft\fields\Assets. CraftCms\Cms\Field\Assets should be used instead.
• Deprecated craft\fields\BaseOptionsField. CraftCms\Cms\Field\BaseOptionsField should be used instead.
• Deprecated craft\fields\BaseRelationField. CraftCms\Cms\Field\BaseRelationField should be used instead.
• Deprecated craft\fields\ButtonGroup. CraftCms\Cms\Field\ButtonGroup should be used instead.
• Deprecated craft\fields\Categories. CraftCms\Cms\Field\Categories should be used instead.
• Deprecated craft\fields\Checkboxes. CraftCms\Cms\Field\Checkboxes should be used instead.
• Deprecated craft\fields\Color. CraftCms\Cms\Field\Color should be used instead.
• Deprecated craft\fields\ContentBlock. CraftCms\Cms\Field\ContentBlock should be used instead.
• Deprecated craft\fields\Country. CraftCms\Cms\Field\Country should be used instead.
• Deprecated craft\fields\Date. CraftCms\Cms\Field\Date should be used instead.
• Deprecated craft\fields\Dropdown. CraftCms\Cms\Field\Dropdown should be used instead.
• Deprecated craft\fields\Email. CraftCms\Cms\Field\Email should be used instead.
• Deprecated craft\fields\Entries. CraftCms\Cms\Field\Entries should be used instead.
• Deprecated craft\fields\Icon. CraftCms\Cms\Field\Icon should be used instead.
• Deprecated craft\fields\Json. CraftCms\Cms\Field\Json should be used instead.
• Deprecated craft\fields\Lightswitch. CraftCms\Cms\Field\Lightswitch should be used instead.
• Deprecated craft\fields\Link. CraftCms\Cms\Field\Link should be used instead.
• Deprecated craft\fields\Matrix. CraftCms\Cms\Field\Matrix should be used instead.
• Deprecated craft\fields\MissingField. CraftCms\Cms\Field\MissingField should be used instead.
• Deprecated craft\fields\Money. CraftCms\Cms\Field\Money should be used instead.
• Deprecated craft\fields\MultiSelect. CraftCms\Cms\Field\MultiSelect should be used instead.
• Deprecated craft\fields\Number. CraftCms\Cms\Field\Number should be used instead.
• Deprecated craft\fields\PlainText. CraftCms\Cms\Field\PlainText should be used instead.
• Deprecated craft\fields\RadioButtons. CraftCms\Cms\Field\RadioButtons should be used instead.
• Deprecated craft\fields\Range. CraftCms\Cms\Field\Range should be used instead.
• Deprecated craft\fields\Table. CraftCms\Cms\Field\Table should be used instead.
• Deprecated craft\fields\Tags. CraftCms\Cms\Field\Tags should be used instead.
• Deprecated craft\fields\Time. CraftCms\Cms\Field\Time should be used instead.
• Deprecated craft\fields\Url. CraftCms\Cms\Field\Url should be used instead.
• Deprecated craft\fields\Users. CraftCms\Cms\Field\Users should be used instead.
• Deprecated craft\services\Fields. CraftCms\Cms\Field\Fields should be used instead.

Filesystems

• Deprecated craft\errors\InvalidSubpathException. CraftCms\Cms\Filesystem\Exceptions\InvalidSubpathException should be used instead.

GQL

• Deprecated \craft\records\GqlSchema. \CraftCms\Cms\Gql\Models\GqlSchema should be used instead.
• Deprecated \craft\records\GqlToken. \CraftCms\Cms\Gql\Models\GqlToken should be used instead.

HTTP

• Deprecated craft\config\GeneralConfig::$errorTemplatePrefix and craft\config\GeneralConfig::errorTemplatePrefix(). Configure Laravel's custom error pages instead.
• Deprecated craft\filters\BasicHttpAuthLogin. Use the auth.basic middleware instead. (see https://laravel.com/docs/12.x/authentication#http-basic-authentication)
• Deprecated craft\filters\BasicHttpAuthStatic. Use the auth.basic middleware instead. (see https://laravel.com/docs/12.x/authentication#http-basic-authentication)
• Deprecated craft\filters\BasicHttpAuthTrait. Use the auth.basic middleware instead. (see https://laravel.com/docs/12.x/authentication#http-basic-authentication)
• Deprecated craft\filters\Cors. Use Laravel's CORS settings instead. (see https://laravel.com/docs/12.x/routing#cors)
• Deprecated craft\filters\Headers. Use Laravel middleware instead. (see https://laravel.com/docs/middleware)
• Deprecated craft\filters\ConditionalFilterTrait.
• Deprecated craft\filters\SiteFilterTrait.
• Deprecated craft\filters\UtilityAccess.
• Deprecated craft\controllers\AppController::actionLicensingIssues(). CraftCms\Cms\Http\Middleware\EnforceLicenses should be used instead.
• Removed craft\controllers\AppController::actionHealthCheck(). CraftCms\Cms\Http\Controllers\App\HealthCheckController should be used instead.
• Removed craft\controllers\AppController::actionGetCpAlerts() and actionShunCpAlert(). CraftCms\Cms\Http\Controllers\App\CpAlertsController should be used instead.
• Removed craft\controllers\AppController::actionIconPickerOptions(). Use CraftCms\Cms\Http\Controllers\IconController::pickerOptions() instead.
• Removed craft\controllers\AppController::actionSetLicenseShunCookie(). CraftCms\Cms\Http\Controllers\App\LicensesController::setShunCookie() should be used instead.
• Removed craft\controllers\AppController::actionGetPluginLicenseInfo() and actionUpdatePluginLicense(). CraftCms\Cms\Http\Controllers\App\PluginsController should be used instead.
• Removed craft\controllers\AppController::actionBrokenImage(). CraftCms\Cms\Http\Middleware\ShowBrokenImage should be used instead.
• Removed craft\controllers\AppController::actionRenderElements() and actionRenderComponents(). CraftCms\Cms\Http\Controllers\App\RenderController should be used instead.
• Removed craft\controllers\NotFoundController. Laravel's exception handling should be used instead.
• Removed the header-setting logic in yii2-adapter\legacy\web\Application. The new \CraftCms\Cms\Http\Middleware\SetHeaders middleware handles this functionality.
• Removed the licensing issues screen logic in yii2-adapter\legacy\web\Application. The new \CraftCms\Cms\Http\Middleware\EnforceLicenses middleware handles this functionality.
• Removed craft\controllers\AppController::actionTryEdition() and actionSwitchToLicensedEdition() in favor of CraftCms\Cms\Http\Controllers\EditionController.

Mail

• Added CraftCms\Cms\Email\Commands\SendTestMailCommand.
• Added CraftCms\Cms\Email\Mailables\CraftMailable, a base mailable class that automatically applies project config email settings (from, replyTo, mailer) with site-specific overrides.
• Added CraftCms\Cms\SystemMessage\Mailables\SystemMessageMailable.
• Deprecated Craft::$app->getMailer(). Laravel mailers/drivers and CraftCms\Cms\SystemMessage\SystemMessages::mailable() should be used instead.
• Deprecated craft\mail\Mailer. Laravel mailers/drivers and CraftCms\Cms\SystemMessage\SystemMessages::mailable() should be used instead.
• Deprecated craft\helpers\MailerHelper. Laravel mail configuration and drivers should be used instead.
• Deprecated craft\config\GeneralConfig::$testToEmailAddress and craft\config\GeneralConfig::testToEmailAddress(). Illuminate\Support\Facades\Mail::alwaysTo() should be used instead.
• Deprecated craft\mail\Mailer::$template, craft\mail\Mailer::$siteOverrides, craft\models\MailSettings::$template, and craft\models\MailSettings::$siteOverrides. Laravel mailable views and environment-specific Laravel mailers should be used instead.
• Removed legacy projectConfig.email mail settings and mail transport adapter configuration in favor of Laravel's mail config and drivers.

Migrations

Craft and Yii's migrations have been removed in favor of Laravel migrations.

The php craft fields:merge and php craft entry-types:merge commands will now generate Laravel migrations.

• Deprecated craft\db\Migration. CraftCms\Cms\Database\Migration should be used instead.
• Deprecated craft\db\MigrationManager
• Removed craft\helpers\MigrationHelper as it was deprecated since 4.0.0.
• Removed craft\console\controllers\InstallController in favor of:
  • CraftCms\Cms\Console\Commands\InstallCommand
  • CraftCms\Cms\Console\Commands\InstallCheckCommand
• Removed craft\console\controllers\MigrateController in favor of:
  • CraftCms\Cms\Database\Commands\MigrateCommand
• Removed craft\console\controllers\UpController in favor of:
  • CraftCms\Cms\Console\Commands\UpCommand

Plugins

Added

• The base CraftCms\Cms\Plugin\Plugin class is now a Laravel ServiceProvider which provides a new way to register components for your plugins.

Deprecations

• Deprecated craft\services\Plugins. CraftCms\Cms\Plugin\Plugins should be used instead.
• Deprecated craft\base\Plugin. CraftCms\Cms\Plugin\Plugin should be used instead.
• Deprecated craft\base\PluginTrait.
• Deprecated craft\base\PluginInterface. CraftCms\Cms\Plugin\Contracts\PluginInterface should be used instead.
• Deprecated craft\errors\InvalidPluginException. CraftCms\Cms\Plugin\Exceptions\InvalidPluginException should be used instead.
• Deprecated craft\errors\InvalidLicenseKeyException. CraftCms\Cms\Plugin\Exceptions\InvalidLicenseKeyException should be used instead.

Controllers

• Removed craft\controllers\PluginsController. Use CraftCms\Cms\Http\Controllers\PluginsController instead.

Commands

• Removed craft\console\controllers\PluginController in favor of:
  • CraftCms\Cms\Plugin\Commands\DisableCommand -> php craft plugin:disable
  • CraftCms\Cms\Plugin\Commands\EnableCommand -> php craft plugin:enable
  • CraftCms\Cms\Plugin\Commands\InstallCommand -> php craft plugin:install
  • CraftCms\Cms\Plugin\Commands\UninstallCommand -> php craft plugin:uninstall
  • CraftCms\Cms\Plugin\Commands\ListCommand -> php craft plugin:list

Events

• Deprecated craft\events\PluginEvent in favor of the following new events:
  • craft\base\Plugin::EVENT_BEFORE_SAVE_SETTINGS => CraftCms\Cms\Component\Events\ComponentEvent
  • craft\base\Plugin::EVENT_AFTER_SAVE_SETTINGS => CraftCms\Cms\Component\Events\ComponentEvent
  • craft\services\Plugins::EVENT_BEFORE_DISABLE_PLUGIN => CraftCms\Cms\Plugin\Events\PluginDisabling;
  • craft\services\Plugins::EVENT_BEFORE_ENABLE_PLUGIN => CraftCms\Cms\Plugin\Events\PluginEnabling;
  • craft\services\Plugins::EVENT_BEFORE_INSTALL_PLUGIN => CraftCms\Cms\Plugin\Events\PluginInstalling;
  • craft\services\Plugins::EVENT_BEFORE_LOAD_PLUGINS => CraftCms\Cms\Plugin\Events\PluginsLoading;
  • craft\services\Plugins::EVENT_BEFORE_SAVE_PLUGIN_SETTINGS => CraftCms\Cms\Plugin\Events\SavingPluginSettings;
  • craft\services\Plugins::EVENT_BEFORE_UNINSTALL_PLUGIN => CraftCms\Cms\Plugin\Events\PluginUninstalling;
  • craft\services\Plugins::EVENT_AFTER_DISABLE_PLUGIN => CraftCms\Cms\Plugin\Events\PluginDisabled;
  • craft\services\Plugins::EVENT_AFTER_ENABLE_PLUGIN => CraftCms\Cms\Plugin\Events\PluginEnabled;
  • craft\services\Plugins::EVENT_AFTER_INSTALL_PLUGIN => CraftCms\Cms\Plugin\Events\PluginInstalled;
  • craft\services\Plugins::EVENT_AFTER_LOAD_PLUGINS => CraftCms\Cms\Plugin\Events\PluginsLoaded;
  • craft\services\Plugins::EVENT_AFTER_SAVE_PLUGIN_SETTINGS => CraftCms\Cms\Plugin\Events\PluginSettingsSaved;
  • craft\services\Plugins::EVENT_AFTER_UNINSTALL_PLUGIN => CraftCms\Cms\Plugin\Events\PluginUninstalled;

Request

• Added Request::isPreview() macro for detecting preview requests via x-craft-preview or x-craft-live-preview parameters.
• Added Request::isCpRequest(), Request::isSiteRequest(), Request::isActionRequest(), Request::actionSegments(), Request::actionSegmentsToRoute(), Request::duplicateWithUri(), Request::getToken(), and Request::getSigned() macros.
• Updated paginated requests to resolve the current page from the configured GeneralConfig::$pageTrigger query parameter rather than path-style pagination segments.

Security

• Added CraftCms\Cms\Support\Security.
• Added CraftCms\Cms\Support\Facades\Security.
• Added CraftCms\Cms\Http\Middleware\AddLogContext.
• Deprecated Craft::$app->getSecurity() in favor of Laravel's Hash and Crypt facades, or CraftCms\Cms\Support\Facades\Security.
• Deprecated GeneralConfig::$blowfishHashCost in favor of Laravel's hashing.bcrypt.rounds config or the BCRYPT_ROUNDS environment variable.

Updates

The craft\services\Updates internal service has been removed. CraftCms\Cms\Update\Updates should be used instead.

Moved the following controllers:

• craft\controllers\ConfigSyncController => CraftCms\Cms\Http\Controllers\ConfigSyncController
• craft\controllers\InstallController => CraftCms\Cms\Http\Controllers\InstallController
• craft\controllers\MigrateController => CraftCms\Cms\Http\Controllers\MigrateController
• craft\controllers\PluginStoreController => CraftCms\Cms\Http\Controllers\PluginStore\PluginStoreController
• craft\controllers\PluginStore\InstallController => CraftCms\Cms\Http\Controllers\PluginStore\InstallController
• craft\controllers\PluginStore\RemoveController => CraftCms\Cms\Http\Controllers\PluginStore\RemoveController
• craft\controllers\UpdaterController => CraftCms\Cms\Http\Controllers\Updates\UpdaterController
• craft\controllers\UpdatesController => CraftCms\Cms\Http\Controllers\Updates\UpdatesController
• craft\console\controllers\UpdateController in favor of these commands:
  • CraftCms\Cms\Update\Commands\UpdateCommand
  • CraftCms\Cms\Update\Commands\ComposerInstallCommand
  • CraftCms\Cms\Update\Commands\InfoCommand

Deprecations & removals

• Deprecated craft\helpers\Install. CraftCms\Cms\Site\Concerns\SiteDefaults should be used instead.
• Deprecated craft\helpers\Update. The only method was checkPhpConstraint which is now available on CraftCms\Cms\Support\PHP::checkConstraint()
• Removed craft\events\UpdateReleaseEvent in favor of CraftCms\Cms\Update\Events\CriticalUpdateReleasedEvent
• Removed craft\models\Update. CraftCms\Cms\Update\Data\Update should be used instead.
• Removed craft\models\UpdateRelease. CraftCms\Cms\Update\Data\UpdateRelease should be used instead.
• Removed craft\models\Updates. CraftCms\Cms\Update\Data\Updates should be used instead.

Users

• Removed craft\console\controllers\UsersController in favor of the following commands (signatures are the same):
  • CraftCms\Cms\User\Commands\ActivationUrlCommand
  • CraftCms\Cms\User\Commands\CreateCommand
  • CraftCms\Cms\User\Commands\DeleteCommand
  • CraftCms\Cms\User\Commands\ImpersonateCommand
  • CraftCms\Cms\User\Commands\ListAdminsCommand
  • CraftCms\Cms\User\Commands\LogoutAllCommand
  • CraftCms\Cms\User\Commands\PasswordResetUrlCommand
  • CraftCms\Cms\User\Commands\Remove2faCommand
  • CraftCms\Cms\User\Commands\SetPasswordCommand
  • CraftCms\Cms\User\Commands\UnlockCommand

Project Config

• Deprecated craft\services\ProjectConfig. CraftCms\Cms\ProjectConfig\ProjectConfig should be used instead.
• Removed craft\controllers\ProjectConfigController in favor of CraftCms\Cms\Http\Controllers\Utilities\ProjectConfigController
• Removed craft\console\controllers\PcController & craft\console\controllers\ProjectConfigController in favor of the following commands:
  • CraftCms\Cms\ProjectConfig\Commands\ApplyCommand
  • CraftCms\Cms\ProjectConfig\Commands\DiffCommand
  • CraftCms\Cms\ProjectConfig\Commands\ExportCommand
  • CraftCms\Cms\ProjectConfig\Commands\GetCommand
  • CraftCms\Cms\ProjectConfig\Commands\RebuildCommand
  • CraftCms\Cms\ProjectConfig\Commands\RemoveCommand
  • CraftCms\Cms\ProjectConfig\Commands\SetCommand
  • CraftCms\Cms\ProjectConfig\Commands\TouchCommand
  • CraftCms\Cms\ProjectConfig\Commands\WriteCommand
  • All commands can be called using either php craft project-config or php craft pc
• Deprecated craft\events\ConfigEvent in favor of the following events:
  • CraftCms\Cms\ProjectConfig\Events\ProjectConfigItemAdding
  • CraftCms\Cms\ProjectConfig\Events\ItemAdded
  • CraftCms\Cms\ProjectConfig\Events\ProjectConfigItemUpdated
  • CraftCms\Cms\ProjectConfig\Events\ItemUpdated
  • CraftCms\Cms\ProjectConfig\Events\ProjectConfigItemRemoved
  • CraftCms\Cms\ProjectConfig\Events\ItemRemoved
• Deprecated craft\services\ProjectConfig::EVENT_AFTER_APPLY_CHANGES
  • Added CraftCms\Cms\ProjectConfig\Events\ChangesApplied
• Deprecated craft\services\ProjectConfig::EVENT_AFTER_WRITE_YAML_FILES
• Added CraftCms\Cms\ProjectConfig\Events\YamlFilesWritten
• Deprecated craft\services\ProjectConfig::EVENT_REBUILD
  • Added CraftCms\Cms\ProjectConfig\Events\ProjectConfigRebuilt
• Removed craft\errors\BusyResourceException in favor of CraftCms\Cms\ProjectConfig\Exceptions\BusyResourceException
• Removed craft\errors\StaleResourceException in favor of CraftCms\Cms\ProjectConfig\Exceptions\StaleResourceException
• Added CraftCms\Cms\ProjectConfig\Exceptions\ReadonlyException
• Removed craft\models\ProjectConfigData in favor of CraftCms\Cms\ProjectConfig\Data\ProjectConfigData
• Removed craft\models\ReadOnlyProjectConfigData in favor of CraftCms\Cms\ProjectConfig\Data\ReadOnlyProjectConfigData
• Deprecated craft\helpers\ProjectConfig. CraftCms\Cms\ProjectConfig\ProjectConfigHelper should be used instead.

Revisions

• Deprecated craft\services\Revisions. CraftCms\Cms\Element\Revisions should be used instead.
• Deprecated craft\events\RevisionEvent. One of the events extending CraftCms\Cms\Element\Events\RevisionEvent should be used instead.
• Deprecated craft\behaviors\RevisionBehavior. CraftCms\Cms\Element\Concerns\Revisionable should be used instead.

Routes

• Deprecated craft\services\Routes. CraftCms\Cms\Route\Routes should be used instead.
• Using routes in config/routes.php is no longer supported. Register routes using Laravel's routing instead.

Search

• Added CraftCms\Cms\Support\Facades\Search.
• Deprecated craft\services\Search. CraftCms\Cms\Search\Search should be used instead.
• Deprecated Craft::$app->getSearch(). CraftCms\Cms\Support\Facades\Search or app(CraftCms\Cms\Search\Search::class) should be used instead.
• Deprecated craft\search\SearchQuery. CraftCms\Cms\Search\SearchQuery should be used instead.
• Deprecated craft\search\SearchQueryTerm. CraftCms\Cms\Search\SearchQueryTerm should be used instead.
• Deprecated craft\search\SearchQueryTermGroup. CraftCms\Cms\Search\SearchQueryTermGroup should be used instead.
• Deprecated craft\events\SearchEvent in favor of the following new events:
  • craft\services\Search::EVENT_BEFORE_SEARCH => CraftCms\Cms\Search\Events\SearchStarting
  • craft\services\Search::EVENT_AFTER_SEARCH => CraftCms\Cms\Search\Events\SearchPerformed
  • craft\services\Search::EVENT_BEFORE_SCORE_RESULTS => CraftCms\Cms\Search\Events\ScoringResults
• Deprecated craft\events\IndexKeywordsEvent. CraftCms\Cms\Search\Events\KeywordsIndexing should be used instead.

Sections

• Updated section index pagination to return Laravel-style pagination metadata and use the configured GeneralConfig::$pageTrigger query parameter.
• Deprecated the section related methods in craft\services\Entries. CraftCms\Cms\Section\Sections should be used instead.
• Deprecated craft\models\Section. CraftCms\Cms\Section\Data\Section should be used instead.
• Deprecated craft\records\Section. CraftCms\Cms\Section\Models\Section should be used instead.
• Deprecated craft\models\Section_SiteSettings. CraftCms\Cms\Section\Data\SectionSiteSettings should be used instead.
• Deprecated craft\records\Section_SiteSettings. CraftCms\Cms\Section\Models\SectionSiteSettings should be used instead.
• Deprecated craft\events\SectionEvent. One of these should be used instead:
  • craft\services\Entries::EVENT_BEFORE_DELETE_SECTION => CraftCms\Cms\Section\Events\SectionDeleting
  • craft\services\Entries::EVENT_BEFORE_APPLY_SECTION_DELETE => CraftCms\Cms\Section\Events\SectionDeletionApplying
  • craft\services\Entries::EVENT_AFTER_DELETE_SECTION => CraftCms\Cms\Section\Events\SectionDeleted
  • craft\services\Entries::EVENT_BEFORE_SAVE_SECTION => CraftCms\Cms\Section\Events\SectionSaving
  • craft\services\Entries::EVENT_AFTER_SAVE_SECTION => CraftCms\Cms\Section\Events\SectionSaved
• Removed craft\controllers\SectionsController in favor of CraftCms\Cms\Http\Controllers\SectionsController
• Removed craft\console\controllers\SectionsController in favor of:
  • CraftCms\Cms\Section\Commands\CreateCommand
  • CraftCms\Cms\Section\Commands\DeleteCommand
• Added CraftCms\Cms\Section\Enums\DefaultPlacement
• Added CraftCms\Cms\Section\Enums\SectionType
• Deprecated craft\errors\SectionNotFoundException. CraftCms\Cms\Section\Exceptions\SectionNotFoundException should be used instead.

Sites

• Deprecated craft\services\Sites. CraftCms\Cms\Site\Sites should be used instead.

• Deprecated craft\models\Site. CraftCms\Cms\Site\Data\Site should be used instead.

• Deprecated craft\models\SiteGroup. CraftCms\Cms\Site\Data\SiteGroup should be used instead.

• Deprecated craft\records\Site. CraftCms\Cms\Site\Models\Site should be used instead.

• Deprecated craft\records\SiteGroup. CraftCms\Cms\Site\Models\SiteGroup should be used instead.

• Deprecated craft\events\SiteEvent. One of CraftCms\Cms\Site\Events\* should be used instead.

• Deprecated craft\events\DeleteSiteEvent. One of CraftCms\Cms\Site\Events\SiteDeleting or CraftCms\Cms\Site\Events\SiteDeleted should be used instead.

• Deprecated craft\events\ReorderSitesEvent. One of CraftCms\Cms\Site\Events\SitesReordering or CraftCms\Cms\Site\Events\SitesReordered should be used instead.

• Deprecated craft\events\SiteGroupEvent. One of CraftCms\Cms\Site\Events\* should be used instead.

• Deprecated craft\errors\SiteNotFoundException. CraftCms\Cms\Site\Exceptions\SiteNotFoundException should be used instead.

• Deprecated craft\errors\SiteGroupNotFoundException.

• Removed craft\controllers\SitesController in favor of:

  • CraftCms\Cms\Http\Controllers\Settings\SitesController
  • CraftCms\Cms\Http\Controllers\Settings\SiteGroupsController

Structures

• Deprecated craft\services\Structures. CraftCms\Cms\Structure\Structures should be used instead.
• Deprecated craft\models\Structure. CraftCms\Cms\Structure\Data\Structure should be used instead.
• Deprecated craft\records\Structure. CraftCms\Cms\Structure\Models\Structure should be used instead.
• Deprecated craft\records\StructureElement. CraftCms\Cms\Structure\Models\StructureElement should be used instead.
• Replaced craft\controllers\StructuresController. CraftCms\Cms\Http\Controllers\StructuresController.
• Replaced structure related commands in craft\console\controllers\RepairController with:
  • \CraftCms\Cms\Structure\Commands\RepairCategoryGroupStructureCommand
  • \CraftCms\Cms\Structure\Commands\RepairSectionStructureCommand

System Messages

• Deprecated craft\services\SystemMessages. CraftCms\Cms\SystemMessage\SystemMessages should be used instead.
• Deprecated craft\models\SystemMessage and craft\records\SystemMessage. CraftCms\Cms\SystemMessage\Models\SystemMessage should be used instead.
• Replaced craft\controllers\SystemMessagesController with CraftCms\Cms\Http\Controllers\Utilities\SystemMessagesController

Tokens

• Deprecated craft\services\Tokens. CraftCms\Cms\RouteToken\RouteTokens should be used instead.
• Deprecated craft\records\Token. CraftCms\Cms\RouteToken\Models\RouteToken should be used instead.

Twig

• Updated Twig {% paginate %} queries to use Laravel paginators and generate query-string pagination URLs based on GeneralConfig::$pageTrigger.
• Added CraftCms\Cms\Twig\Twig service for managing Twig environments, replacing the Twig management logic previously in craft\web\View.
• Added CraftCms\Cms\Twig\TemplateRenderer for rendering templates, replacing the rendering logic previously in craft\web\View.
• Added CraftCms\Cms\Twig\PageLifecycle for managing the page rendering lifecycle (head/body placeholder replacement), replacing the page lifecycle logic previously in craft\web\View.
• Added CraftCms\Cms\Support\Facades\Twig facade, resolving to CraftCms\Cms\Twig\TemplateRenderer.
• Added CraftCms\Cms\Twig\Environment, moved from craft\web\twig\Environment.
• Added CraftCms\Cms\Twig\TemplateResolver.
• Added CraftCms\Cms\Twig\TemplateLoader.
• Added CraftCms\Cms\Twig\Exceptions\TemplateLoaderException.
• Added helper functions in the CraftCms\Cms namespace: template(), sandboxedTemplate(), pageTemplate(), renderString(), renderSandboxedString(), renderObjectTemplate(), renderSandboxedObjectTemplate().
• Added sanitize Twig filter for sanitizing HTML with CraftCms\Cms\Support\HtmlSanitizer\HtmlSanitizers.
• Deprecated craft\web\View::getTwig(). CraftCms\Cms\Twig\Twig::get() should be used instead.
• Deprecated craft\web\View::setTwig(). CraftCms\Cms\Twig\Twig::set() should be used instead.
• Deprecated craft\web\View::createTwig(). CraftCms\Cms\Twig\Twig::create() should be used instead.
• Deprecated craft\web\View::registerCpTwigExtension(). CraftCms\Cms\Twig\Twig::registerExtension() should be used instead.
• Deprecated craft\web\View::registerSiteTwigExtension(). CraftCms\Cms\Twig\Twig::registerExtension() should be used instead.
• Deprecated craft\web\View::registerTwigExtension(). CraftCms\Cms\Twig\Twig::registerExtension() should be used instead.
• Deprecated craft\web\View::renderTemplate(). CraftCms\Cms\Twig\TemplateRenderer::renderTemplate() or the template() helper should be used instead.
• Deprecated craft\web\View::renderSandboxedTemplate(). CraftCms\Cms\Twig\TemplateRenderer::renderSandboxedTemplate() or the sandboxedTemplate() helper should be used instead.
• Deprecated craft\web\View::renderPageTemplate(). CraftCms\Cms\Twig\TemplateRenderer::renderPageTemplate() or the pageTemplate() helper should be used instead.
• Deprecated craft\web\View::renderString(). CraftCms\Cms\Twig\TemplateRenderer::renderString() or the renderString() helper should be used instead.
• Deprecated craft\web\View::renderSandboxedString(). CraftCms\Cms\Twig\TemplateRenderer::renderSandboxedString() or the renderSandboxedString() helper should be used instead.
• Deprecated craft\web\View::renderObjectTemplate(). CraftCms\Cms\Twig\TemplateRenderer::renderObjectTemplate() or the renderObjectTemplate() helper should be used instead.
• Deprecated craft\web\View::renderSandboxedObjectTemplate(). CraftCms\Cms\Twig\TemplateRenderer::renderSandboxedObjectTemplate() or the renderSandboxedObjectTemplate() helper should be used instead.
• Deprecated craft\web\View::normalizeObjectTemplate(). CraftCms\Cms\Twig\TemplateRenderer::normalizeObjectTemplate() should be used instead.
• Deprecated craft\web\View::getIsRenderingTemplate(). CraftCms\Cms\Twig\TemplateRenderer::isRenderingTemplate should be used instead.
• Deprecated craft\web\View::getIsRenderingPageTemplate(). CraftCms\Cms\Twig\TemplateRenderer::isRenderingPageTemplate should be used instead.
• Deprecated craft\web\twig\Environment. CraftCms\Cms\Twig\Environment should be used instead.
• Deprecated craft\web\View::EVENT_AFTER_CREATE_TWIG. CraftCms\Cms\Twig\Events\TwigCreated should be used instead.
• Deprecated craft\web\View::doesTemplateExist(). CraftCms\Cms\Twig\TemplateResolver::doesTemplateExist() should be used instead.
• Deprecated craft\web\View::resolveTemplate(). CraftCms\Cms\Twig\TemplateResolver::resolveTemplate() should be used instead.
• Deprecated craft\web\twig\TemplateLoader. CraftCms\Cms\Twig\TemplateLoader should be used instead.
• Deprecated craft\web\twig\TemplateLoaderException. CraftCms\Cms\Twig\Exceptions\TemplateLoaderException should be used instead.

Events

• Added CraftCms\Cms\Twig\Events\TwigCreated, dispatched when a Twig environment is created.
• Added CraftCms\Cms\Twig\Events\TemplateRendering, dispatched before a template is rendered. Supports cancellation via ValidatableEvent.
• Added CraftCms\Cms\Twig\Events\TemplateRendered, dispatched after a template is rendered. Has a mutable output property.
• Added CraftCms\Cms\Twig\Events\PageTemplateRendering, dispatched before a page template is rendered. Supports cancellation via ValidatableEvent.
• Added CraftCms\Cms\Twig\Events\PageTemplateRendered, dispatched after a page template is rendered. Has a mutable output property.
• Added CraftCms\Cms\Twig\Events\PageStarting, dispatched when page rendering begins.
• Added CraftCms\Cms\Twig\Events\PageEnded, dispatched when page rendering ends. Has nullable headHtml, bodyBeginHtml, and bodyEndHtml properties for overriding HtmlStack output.
• Deprecated craft\web\View::EVENT_BEFORE_RENDER_TEMPLATE. CraftCms\Cms\Twig\Events\TemplateRendering should be used instead.
• Deprecated craft\web\View::EVENT_AFTER_RENDER_TEMPLATE. CraftCms\Cms\Twig\Events\TemplateRendered should be used instead.
• Deprecated craft\web\View::EVENT_BEFORE_RENDER_PAGE_TEMPLATE. CraftCms\Cms\Twig\Events\PageTemplateRendering should be used instead.
• Deprecated craft\web\View::EVENT_AFTER_RENDER_PAGE_TEMPLATE. CraftCms\Cms\Twig\Events\PageTemplateRendered should be used instead.

Translations

• Deprecated craft\i18n\FormatConverter. CraftCms\Cms\Translation\FormatConverter should be used instead.
• Deprecated craft\i18n\Formatter. CraftCms\Cms\Translation\Formatter should be used instead.
• Deprecated craft\i18n\I18N. CraftCms\Cms\Translation\I18N should be used instead.
• Deprecated craft\i18n\Locale. CraftCms\Cms\Translation\Locale should be used instead.
• Deprecated craft\i18n\MessageFormatter.
• Deprecated craft\i18n\PhpMessageSource.
• Deprecated craft\i18n\Translation. CraftCms\Cms\Support\Facades\I18N should be used instead.
• Deprecated Craft::t. CraftCms\Cms\t should be used instead.

Users

• CraftCms\Cms\User\Elements\User now implements Illuminate\Contracts\Auth\Authenticatable, Illuminate\Contracts\Auth\Access\Authorizable, Illuminate\Contracts\Auth\CanResetPassword, and Illuminate\Contracts\Auth\MustVerifyEmail.
• Added CraftCms\Cms\User\Notifications\VerifyEmailNotification.
• Users::purgeExpiredPendingUsers() now joins the password_reset_tokens table to find expired pending users.
• Removed verificationCode and verificationCodeIssuedDate columns on the users table in favor of the password_reset_tokens table.
• Deprecated craft\services\Users::isVerificationCodeValidForUser(). Password::broker('craft')->tokenExists($user, $code) should be used instead.
• Removed craft\controllers\UsersController in favor of:
  • CraftCms\Cms\Http\Controllers\Users\ActivateController.
  • CraftCms\Cms\Http\Controllers\Users\PasswordController.
  • CraftCms\Cms\Http\Controllers\Users\SaveUserController.
• Removed \craft\controllers\UserSettingsController in favor of:
  • CraftCms\Cms\Http\Controllers\Settings\UserGroupsController
  • CraftCms\Cms\Http\Controllers\Settings\UserSettingsController
• Deprecated UserGroupEvent in favor of:
  • CraftCms\Cms\User\Events\UserGroupSaving
  • CraftCms\Cms\User\Events\UserGroupSaved
  • CraftCms\Cms\User\Events\UserGroupDeletionApplying
  • CraftCms\Cms\User\Events\UserGroupDeleting
  • CraftCms\Cms\User\Events\UserGroupDeleted
• Deprecated \craft\exceptions\UserGroupNotFoundException.
• Deprecated \craft\services\UserGroups. CraftCms\Cms\User\UserGroups should be used instead.
• Deprecated \craft\models\UserGroup. CraftCms\Cms\User\Data\UserGroup should be used instead.
• Deprecated \craft\records\User. \CraftCms\Cms\User\Models\User should be used instead.
• Deprecated \craft\records\UserGroup. \CraftCms\Cms\User\Models\UserGroup should be used instead.
• Deprecated \craft\records\UserPermission. \CraftCms\Cms\User\Models\UserPermission should be used instead.
• Deprecated craft\services\UserPermissions. CraftCms\Cms\User\UserPermissions should be used instead.
• Deprecated craft.app.userPermissions. craft.userPermissions should be used instead.
• Deprecated craft\events\DefineEditUserScreensEvent. CraftCms\Cms\User\Events\EditUserScreensResolving should be used instead.

View

• Added CraftCms\Cms\View\TwigEngine.
• Added CraftCms\Cms\View\HtmlStack.
• Added CraftCms\Cms\Support\Facades\HtmlStack.
• Added CraftCms\Cms\View\Enums\Position enum.
• Added CraftCms\Cms\View\InputNamespace.
• Added CraftCms\Cms\Support\Facades\InputNamespace.
• Added CraftCms\Cms\View\TemplateHooks.
• Added CraftCms\Cms\Support\Facades\TemplateHooks.
• Added CraftCms\Cms\View\DeltaRegistry.
• Added CraftCms\Cms\Support\Facades\DeltaRegistry.
• Added CraftCms\Cms\View\TemplateMode enum.
• Added CraftCms\Cms\View\Events\CpTemplateRootsResolving.
• Added CraftCms\Cms\View\Events\SiteTemplateRootsResolving.
• Added CraftCms\Cms\View\TemplateCaches.
• Added CraftCms\Cms\View\CacheCollectors\DependencyCollector.
• Added CraftCms\Cms\View\CacheCollectors\ResourceCollector.
• Added CraftCms\Cms\View\Contracts\CacheCollectorInterface.
• Added CraftCms\Cms\View\Data\TemplateCacheContext.
• Added CraftCms\Cms\View\Events\TemplateCacheCollectorsResolving.
• Deprecated craft\services\TemplateCaches. CraftCms\Cms\View\TemplateCaches should be used instead.
• Deprecated craft\web\View::registerJs(). CraftCms\Cms\View\HtmlStack::js() should be used instead.
• Deprecated craft\web\View::registerJsWithVars(). CraftCms\Cms\View\HtmlStack::jsWithVars() should be used instead.
• Deprecated craft\web\View::registerJsFile(). CraftCms\Cms\View\HtmlStack::jsFile() should be used instead.
• Deprecated craft\web\View::registerCss(). CraftCms\Cms\View\HtmlStack::css() should be used instead.
• Deprecated craft\web\View::registerCssFile(). CraftCms\Cms\View\HtmlStack::cssFile() should be used instead.
• Deprecated craft\web\View::registerScript(). CraftCms\Cms\View\HtmlStack::script() should be used instead.
• Deprecated craft\web\View::registerScriptWithVars(). CraftCms\Cms\View\HtmlStack::scriptWithVars() should be used instead.
• Deprecated craft\web\View::registerHtml(). CraftCms\Cms\View\HtmlStack::html() should be used instead.
• Deprecated craft\web\View::registerMetaTag(). CraftCms\Cms\View\HtmlStack::metaTag() should be used instead.
• Deprecated craft\web\View::registerLinkTag(). CraftCms\Cms\View\HtmlStack::linkTag() should be used instead.
• Deprecated craft\web\View::registerTranslations(). CraftCms\Cms\View\HtmlStack::translations() should be used instead.
• Deprecated craft\web\View::registerJsImport(). CraftCms\Cms\View\HtmlStack::jsImport() should be used instead.
• Deprecated craft\web\View::registerIcons(). CraftCms\Cms\View\HtmlStack::icons() should be used instead.
• Deprecated craft\web\View::startJsBuffer(). CraftCms\Cms\View\HtmlStack::startJsBuffer() should be used instead.
• Deprecated craft\web\View::clearJsBuffer(). CraftCms\Cms\View\HtmlStack::clearJsBuffer() should be used instead.
• Deprecated craft\web\View::startScriptBuffer(). CraftCms\Cms\View\HtmlStack::startScriptBuffer() should be used instead.
• Deprecated craft\web\View::clearScriptBuffer(). CraftCms\Cms\View\HtmlStack::clearScriptBuffer() should be used instead.
• Deprecated craft\web\View::startCssBuffer(). CraftCms\Cms\View\HtmlStack::startCssBuffer() should be used instead.
• Deprecated craft\web\View::clearCssBuffer(). CraftCms\Cms\View\HtmlStack::clearCssBuffer() should be used instead.
• Deprecated craft\web\View::startCssFileBuffer(). CraftCms\Cms\View\HtmlStack::startCssFileBuffer() should be used instead.
• Deprecated craft\web\View::clearCssFileBuffer(). CraftCms\Cms\View\HtmlStack::clearCssFileBuffer() should be used instead.
• Deprecated craft\web\View::startJsFileBuffer(). CraftCms\Cms\View\HtmlStack::startJsFileBuffer() should be used instead.
• Deprecated craft\web\View::clearJsFileBuffer(). CraftCms\Cms\View\HtmlStack::clearJsFileBuffer() should be used instead.
• Deprecated craft\web\View::startHtmlBuffer(). CraftCms\Cms\View\HtmlStack::startHtmlBuffer() should be used instead.
• Deprecated craft\web\View::clearHtmlBuffer(). CraftCms\Cms\View\HtmlStack::clearHtmlBuffer() should be used instead.
• Deprecated craft\web\View::startMetaTagBuffer(). CraftCms\Cms\View\HtmlStack::startMetaTagBuffer() should be used instead.
• Deprecated craft\web\View::clearMetaTagBuffer(). CraftCms\Cms\View\HtmlStack::clearMetaTagBuffer() should be used instead.
• Deprecated craft\web\View::startJsImportBuffer(). CraftCms\Cms\View\HtmlStack::startJsImportBuffer() should be used instead.
• Deprecated craft\web\View::clearJsImportBuffer(). CraftCms\Cms\View\HtmlStack::clearJsImportBuffer() should be used instead.
• Deprecated craft\web\View::getNamespace(). CraftCms\Cms\View\InputNamespace::get() should be used instead.
• Deprecated craft\web\View::setNamespace(). CraftCms\Cms\View\InputNamespace::set() should be used instead.
• Deprecated craft\web\View::namespaceInputs(). CraftCms\Cms\View\InputNamespace::namespaceInputs() should be used instead.
• Deprecated craft\web\View::namespaceInputName(). CraftCms\Cms\View\InputNamespace::namespaceInputName() should be used instead.
• Deprecated craft\web\View::namespaceInputId(). CraftCms\Cms\View\InputNamespace::namespaceInputId() should be used instead.
• Deprecated craft\web\View::TEMPLATE_MODE_CP. CraftCms\Cms\View\TemplateMode::Cp should be used instead.
• Deprecated craft\web\View::TEMPLATE_MODE_SITE. CraftCms\Cms\View\TemplateMode::Site should be used instead.
• Deprecated craft\web\View::getTemplateMode(). CraftCms\Cms\View\TemplateMode::get() should be used instead.
• Deprecated craft\web\View::setTemplateMode(). CraftCms\Cms\View\TemplateMode::set() should be used instead.
• Deprecated craft\web\View::getTemplatesPath(). CraftCms\Cms\View\TemplateMode::templatesPath() should be used instead.
• Deprecated craft\web\View::getCpTemplateRoots(). CraftCms\Cms\View\TemplateMode::templateRoots() should be used instead.
• Deprecated craft\web\View::getSiteTemplateRoots(). CraftCms\Cms\View\TemplateMode::templateRoots() should be used instead.
• Deprecated craft\web\View::EVENT_REGISTER_CP_TEMPLATE_ROOTS. CraftCms\Cms\View\Events\CpTemplateRootsResolving should be used instead.
• Deprecated craft\web\View::EVENT_REGISTER_SITE_TEMPLATE_ROOTS. CraftCms\Cms\View\Events\SiteTemplateRootsResolving should be used instead.
• Deprecated craft\web\View::registerDeltaName(). CraftCms\Cms\View\DeltaRegistry::registerName() should be used instead.
• Deprecated craft\web\View::getDeltaNames(). CraftCms\Cms\View\DeltaRegistry::getNames() should be used instead.
• Deprecated craft\web\View::getModifiedDeltaNames(). CraftCms\Cms\View\DeltaRegistry::getModifiedNames() should be used instead.
• Deprecated craft\web\View::setInitialDeltaValue(). CraftCms\Cms\View\DeltaRegistry::setInitialValue() should be used instead.
• Deprecated craft\web\View::getInitialDeltaValues(). CraftCms\Cms\View\DeltaRegistry::getInitialValues() should be used instead.
• Deprecated craft\web\View::getIsDeltaRegistrationActive(). CraftCms\Cms\View\DeltaRegistry::isActive() should be used instead.
• Deprecated craft\web\View::setIsDeltaRegistrationActive(). CraftCms\Cms\View\DeltaRegistry::setActive() should be used instead.
• Deprecated craft\web\View::hook(). CraftCms\Cms\View\TemplateHooks::register() should be used instead.
• Deprecated craft\web\View::invokeHook(). CraftCms\Cms\View\TemplateHooks::invoke() should be used instead.

• Fixed a bug where dependencies required by composer.json were getting updated when installing/updating plugins. (#18755)
• Fixed a bug where element thumbnails weren’t always getting loaded when they became visible.
• Fixed a bug where two-step verification setup was working even if the user failed to re-authenticate, if they already had an elevated session. (#18753)
• Fixed a bug where changes to Table fields’ “Table Columns” settings would cause existing data to be lost, if the “Static Rows” setting was enabled. (#18764)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-7h62-6v23-v8fm)

• Fixed a bug where dependencies required by composer.json were getting updated when installing/updating plugins. (#18755)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-7h62-6v23-v8fm)

• Fixed a bug where entries weren’t redirecting back to their section’s page’s URL by default.
• Fixed a bug where the resourceBasePath and resourceBaseUrl config settings weren’t being respected for console requests. (#18685)
• Fixed a bug where eager-loadable GraphQL fields could be populated with the wrong field’s results, if they followed a fragment with a *Interface type condition. (#18708)
• Fixed a bug where users with permission to edit entries, but not view peer entries in a section, weren’t allowed to edit the authors for entries in the section. (#18717)
• Fixed a bug where reference tags weren’t working with generated fields. (#18692)
• Fixed errors that could occur when applying project config changes. (#18720)
• Fixed a bug where it wasn’t always possible to sign into a user account that had the same email address as an inactive user. (#18723)
• Fixed a bug where relational fields’ element query results weren’t always limited to the selected relations if the id param was overridden. (#15570)
• Fixed an error that could occur when executing a queue job. (#18739)
• Fixed high-severity authorization bypass vulnerabilities. (GHSA-x5m4-g2cq-52pq, GHSA-3w32-23wj-rxg3, GHSA-qh45-9g5p-m2v4)
• Fixed moderate-severity permission escalation vulnerabilities. (GHSA-qq2c-2q8j-jh27, GHSA-43cq-c2gq-pfpw)

• Fixed high-severity authorization bypass vulnerabilities. (GHSA-3w32-23wj-rxg3, GHSA-qh45-9g5p-m2v4)

• Fixed an issue that prevented Craft from being installed. (#18700)
• Fixed a bug where nested element cards weren’t showing validation errors. (#18690)
• Fixed a bug where read-only Matrix fields in Index mode weren’t respecting the Default Table Columns setting. (#18684)
• Fixed a bug where nested entries could be lost when reverting content from a revision. (#18691)
• Fixed a bug where nested entries weren’t getting loaded when previewing a revision, if queried with eagerly(). (#18693)

• Fixed an issue that prevented Craft from being installed. (#18700)

• Most classes can now be instantiated via the create() Twig function. (#18376)
• Added craft\helpers\ProjectConfig::pathDepth().
• craft\services\Fields::deleteLayout() and deleteLayoutById() now have $hardDelete arguments.
• Deprecated craft\services\ProjectConfig::getPendingChangeSummary().
• Fixed a bug where element search query caches weren’t getting invalidated when elements’ search keywords were indexed. (#18275)
• Fixed a bug where disabled sites weren’t getting loaded when running Codeception tests. (#18638)
• Fixed a bug where custom entry index page icons weren’t getting stored properly if the source name contained periods. (#18631)
• Fixed a bug where copying nested entries on a revision wasn’t working. (#18648)
• Fixed a bug where Matrix fields in Blocks view could have “Duplicate selected blocks” and “Delete selected blocks” field-level actions. (#18652)
• Fixed a bug where the submit button within Live Preview was labelled “Save” rather than “Create entry” when editing an unpublished draft. (#18579)
• Fixed a bug where recent changes could be lost when creating an element or applying a draft, if there were validation errors. (#18657)
• Fixed a bug where nested elements would get soft-deleted after running the entrify/global-set command. (#18650)
• Fixed a bug where the “Max Authors” section setting was visible for Single sections.
• Fixed an exception that would be thrown when attempting to access undefined keys within craft\fields\data\JsonData objects from Twig. (#18656)
• Fixed a bug where address cards could be missing their address preview. (#18632)
• Fixed a bug where the Save button’s spinner wouldn’t appear right away when saving a nested element in a slideout. (#18664)
• Fixed a bug where the server check script wasn’t treating GD as a requirement. (craftcms/server-check#30)
• Fixed a bug where tooltips could be instantiated multiple times within Link fields. (#18666)
• Fixed a bug where localized nested element content could be overwritten when the owner element was propagated to a new site. (#18659)

• Most classes can now be instantiated via the create() Twig function. (#18376)
• Fixed a bug where element search query caches weren’t getting invalidated when elements’ search keywords were indexed. (#18275)

• Improved error logging when logging in with passkeys. (#18627)
• Added craft\controllers\ElementIndexesController::$fieldLayouts.
• craft\services\ElementSources::getTableAttributes() now has a $fieldLayouts argument.
• Fixed a bug where GraphQL results were getting cached even if they contained transform generation URLs. (#18581)
• Fixed a bug where aria-activedescendant, aria-flowto, and aria-owns attributes weren’t getting namespaced by {% namespace %} tags. (#18577)
• Fixed a bug where sites with missing enabled values were being treated as enabled. (#18572)
• Fixed a bug where GraphQL fields within fragments weren’t getting eager-loaded if the fragment’s type condition referenced an interface (e.g. on EntryInterface) rather than a specific type name. (#18588)
• Fixed a bug where relation fields were getting marked as translatable if they used a custom translation method, even if the rendered translation key was blank. (#18580)
• Fixed a bug where section and field chips in the “Used by” column of the Entry Types index page weren’t getting hyperlinked. (#18589)
• Fixed a bug where exceptions thrown when sending emails weren’t getting handled properly. (#18597)
• Fixed a bug where unordered lists weren’t getting styled correctly within Tip/Warning/Markdown field layout UI elements. (#18598)
• Fixed an error that could occur when upgrading to Craft 5. (#18576)
• Fixed a bug where nested Matrix entries’ Title fields were getting validation errors if blank, even if the nested entry was disabled. (#18611)
• Fixed an infinite recursion bug that could occur if the loginPath, logoutPath, setPasswordPath, or verifyEmailPath config settings were set to a callable that called the sites service. (#18605)
• Fixed a bug where Matrix fields in Index view mode could be missing custom field columns. (#18590)
• Fixed a JavaScript error that could occur when opening a modal. (#18612)
• Fixed a bug where element chips and cards weren’t getting refreshed when a provisional draft’s changes were discarded in a different tab.
• Fixed a bug where element attributes weren’t always updating when content changes were made.
• Fixed a bug where successive edits to nested elements were forgotten. (#18624)
• Fixed a bug where nested elements weren’t getting duplicated when a new site was added to the owner element. (#18621)
• Fixed a bug where nested entries were getting assigned new IDs if they were edited multiple times for the same owner element draft. (#18461)
• Fixed a SQL error that could occur when editing an element draft that had upstream changes. (#18626)
• Fixed a bug where custom sources’ labels weren’t being translated within the document title. (#18629)
• Fixed moderate-severity information disclosure vulnerabilities. (GHSA-gj2p-p9m4-c8gw, GHSA-33m5-hqp9-97pw)
• Fixed a moderate-severity RCE vulnerability. (GHSA-qrgm-p9w5-rrfw)

• Fixed a bug where GraphQL results were getting cached even if they contained transform generation URLs. (#18581)
• Fixed a bug where aria-activedescendant, aria-flowto, and aria-owns attributes weren’t getting namespaced by {% namespace %} tags. (#18577)
• Fixed a moderate-severity information disclosure vulnerability. (GHSA-gj2p-p9m4-c8gw)
• Fixed a moderate-severity RCE vulnerability. (GHSA-qrgm-p9w5-rrfw)

• Added craft\helpers\DateTimeHelper::testTimeToSeconds().
• Fixed an error that could occur after running the utils/fix-field-layout-uids command. (#18516)
• Fixed a JavaScript error that could occur if any field layout elements were configured with unsupported widths. (#18552)
• Fixed an error that could occur when user impersonation failed. (#18569)
• Fixed a bug where deeply-nested elements could be deleted unexpectedly. (#18537)
• Fixed a warning that was getting logged when using craft\filters\SiteFilterTrait.
• Fixed a bug where prefixing entry queries’ authorGroup params with and or not operators wasn’t working properly. (#18551)
• Fixed an error that could occur when running the gc command, if a Matrix field had been converted to an Addresses or Content Block field. (#18549)
• Fixed a styling issue. (#18566)
• Fixed a JavaScript error that could occur when Time fields’ Min/Max Time settings were set.

• Fixed an error that could occur after running the utils/fix-field-layout-uids command. (#18516)
• Fixed a JavaScript error that could occur if any field layout elements were configured with unsupported widths. (#18552)
• Fixed an error that could occur when user impersonation failed. (#18569)

• Updated @simplewebauthn/browser to 13.3.0. (#18545)
• Updated web-auth/webauthn-lib to 5.2.4. (#18545)
• Fixed an error that occurred when loading some control panel resources on environments with craft\web\AssetManager::$cacheSourcePaths disabled. (#18536)
• Fixed a bug where craft\fields\data\LinkData::getUrl() was returning the URL suffix rather than an empty string, if the rendered base URL was an empty string.

• Fixed an error that occurred when loading some control panel resources on environments with craft\web\AssetManager::$cacheSourcePaths disabled. (#18536)

• Element edit pages once again redirect to their referral URL on save. (#18483)
• Added craft\filters\IpRateLimitIdentity. (#18510)
• Added craft\helpers\App::resourcePathByUri().
• Removed thamtech/yii2-ratelimiter-advanced. (#18510)
• Fixed a bug where global set GraphQL query caches weren’t getting invalidated when global sets were updated. (#18479)
• Fixed a bug where users/suspend-user and users/unsuspend-user actions required that the logged-in user have control panel access. (#18485)
• Fixed a bug where flipping an image within the Image Editor didn’t always work. (#18486)
• Fixed a bug where SVG files missing their width and height attributes weren’t getting them set as expected.
• Fixed an error that occurred if a template referenced a preloaded Single entry followed by a null coalescing operator. (#18503)
• Fixed a bug where links within Redactor fields were getting target="_blank" added to them. (#18500)
• Fixed an error that could occur when applying project config changes, or editing entries with an invalid entry type. (#18477, #18505)
• Fixed a bug where Content Block fields’ nested values weren’t always getting set correctly via resave commands. (#18453)
• Fixed a bug where addresses without labels weren’t getting chip labels. (#18481)
• Fixed a JavaScript error that could occur on element edit pages.
• Fixed a bug where cross-site validation errors weren’t preventing elements from getting saved. (#18292)
• Fixed a bug where failure messages when pasting elements weren’t getting displayed properly.
• Fixed a bug where craft\helpers\UrlHelper::cpReferralUrl() was returning the referrer URL even if it had the same URI as the current page. (#18483)
• Fixed a bug where Matrix field’ grouped entry type menu labels weren’t translatable. (#18528)
• Fixed moderate-severity SSRF vulnerabilities. (GHSA-3m9m-24vh-39wx, GHSA-95wr-3f2v-v2wh)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-jq2f-59pj-p3m3)

• Added craft\filters\IpRateLimitIdentity. (#18510)
• Added craft\helpers\App::resourcePathByUri().
• Removed thamtech/yii2-ratelimiter-advanced. (#18510)
• Fixed a bug where global set GraphQL query caches weren’t getting invalidated when global sets were updated. (#18479)
• Fixed a bug where users/suspend-user and users/unsuspend-user actions required that the logged-in user have control panel access. (#18485)
• Fixed a bug where flipping an image within the Image Editor didn’t always work. (#18486)
• Fixed a bug where SVG files missing their width and height attributes weren’t getting them set as expected.
• Fixed an error that occurred if a template referenced a preloaded Single entry followed by a null coalescing operator. (#18503)
• Fixed a bug where links within Redactor fields were getting target="_blank" added to them. (#18500)
• Fixed moderate-severity SSRF vulnerabilities. (GHSA-3m9m-24vh-39wx, GHSA-95wr-3f2v-v2wh)

• The PDO::MYSQL_ATTR_MULTI_STATEMENTS attribute is no longer set by default for database connections. (#18474)
• Added craft\elements\Entry::canMove().
• Fixed a bug where element selector modals weren’t showing any results if they were limited to sources that only exist for a different site than the active one. (#18478)
• Fixed low-severity information disclosure vulnerabilities. (GHSA-44px-qjjc-xrhq, GHSA-vgjg-248p-rfm2, GHSA-x76w-8c62-48mg)
• Fixed a moderate-severity access control vulnerability. (GHSA-6mrr-q3pj-h53w)
• Fixed moderate-severity information disclosure vulnerabilities. (GHSA-3pvf-vxrv-hh9c, GHSA-5pgf-h923-m958)
• Fixed a moderate-severity RCE vulnerability. (GHSA-86vw-x4ww-x467)
• Fixed a moderate-severity authorization bypass vulnerability. (GHSA-f582-6gf6-gx4g)

• The PDO::MYSQL_ATTR_MULTI_STATEMENTS attribute is no longer set by default for database connections. (#18474)
• Fixed low-severity information disclosure vulnerabilities. (GHSA-44px-qjjc-xrhq, GHSA-vgjg-248p-rfm2, GHSA-x76w-8c62-48mg)
• Fixed a moderate-severity access control vulnerability. (GHSA-6mrr-q3pj-h53w)
• Fixed moderate-severity information disclosure vulnerabilities. (GHSA-3pvf-vxrv-hh9c, GHSA-5pgf-h923-m958)

• The control panel is now translated into Greek. (#18458)
• The PDO::MYSQL_ATTR_MULTI_STATEMENTS attribute is now set to false by default for database connections.
• Fixed a bug where searchindex and searchindexqueue rows weren’t being deleted when an element was deleted for a site. (#18394)
• Fixed a bug where multi-select condition rules weren’t applying their “has a value” and “is empty” operators correctly. (#18470)
• Fixed an unintended change in behavior where craft\helpers\App::parseEnv() was returning null instad of an empty string, when an environment variable name was passed in, which was set to an empty string.
• Fixed a bug where drafts within “My Drafts” widgets weren’t getting hyperlinked. (#18456)
• Fixed a bug where nested entries were getting assigned new IDs if they were edited multiple times for the same owner element draft. (#18461)
• Fixed a bug where the “New Tab” button within field layout designers could be positioned incorrectly. (#18450)
• Fixed a high-severity RCE vulnerability. (GHSA-2fph-6v5w-89hh)
• Fixed a low-severity path traversal vulnerability. (GHSA-472v-j2g4-g9h2)

• The PDO::MYSQL_ATTR_MULTI_STATEMENTS attribute is now set to false by default for database connections.
• Fixed a bug where searchindex and searchindexqueue rows weren’t being deleted when an element was deleted for a site. (#18394)
• Fixed a bug where multi-select condition rules weren’t applying their “has a value” and “is empty” operators correctly. (#18470)
• Fixed a low-severity path traversal vulnerability. (GHSA-472v-j2g4-g9h2)