a:2:{i:0;a:2:{s:3:"cms";a:4:{s:6:"status";s:8:"eligible";s:8:"releases";a:5:{i:0;a:4:{s:7:"version";s:8:"5.12.0.1";s:8:"critical";b:0;s:5:"notes";s:81:"<ul>
<li>Fixed a bug where icon pickers were showing duplicate icons.</li>
</ul>
";s:4:"date";s:19:"2026-11-03T00:00:00";}i:1;a:4:{s:7:"version";s:6:"5.12.0";s:8:"critical";b:0;s:5:"notes";s:40166:"<h3>MCP and OAuth</h3>
<ul>
<li>Added an authenticated HTTP MCP server, which MCP clients can connect to after a user signs in and authorizes them via OAuth. Clients act as that user, within their permissions and the access level they grant (read only, read and write, or full access for admins). (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>, <a href="https://github.com/craftcms/cms/pull/20189">#20189</a>)</li>
<li>The authenticated MCP server’s endpoints default to <code>/{cpTrigger}/mcp</code> and <code>/{cpTrigger}/mcp/auth</code>, or <code>/mcp</code> and <code>/mcp/auth</code> when public registration is enabled. Endpoints within the control panel can only be used by users with control panel access. (<a href="https://github.com/craftcms/cms/pull/20189">#20189</a>)</li>
<li>Added a public HTTP MCP server, which exposes only the capabilities and content approved from <strong>Settings</strong> → <strong>MCP</strong>, without signing in. Its endpoint defaults to <code>/mcp</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>, <a href="https://github.com/craftcms/cms/pull/20189">#20189</a>)</li>
<li>The HTTP MCP servers are discoverable via <code>/.well-known/ai-catalog.json</code> and a Server Card at <code>&lt;endpoint&gt;/server-card</code>, per <a href="https://modelcontextprotocol.io/seps/2127-mcp-server-cards">SEP-2127</a>. Servers on control panel URLs are never advertised, and the authenticated server is only advertised when public registration is enabled. (<a href="https://github.com/craftcms/cms/pull/20283">#20283</a>)</li>
<li>Added the <code>mcp/serve</code> command, which runs a stdio MCP server acting as a given user. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <strong>Settings</strong> → <strong>MCP</strong>, where administrators can enable the authenticated and public MCP servers, set their endpoints, and approve the capabilities and content that the public server exposes. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>, <a href="https://github.com/craftcms/cms/pull/20189">#20189</a>)</li>
<li>Added support for <code>config/mcp.php</code> and <code>config/oauth.php</code> config files. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added the <code>oauth/generate-keys</code> command, which generates the keys used to sign OAuth access tokens. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added an OAuth authorization server, with discovery metadata, dynamic client registration, PKCE, and refresh token rotation, which the MCP servers and GraphQL API use. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Dynamic OAuth client registration is limited to 10 clients per IP address per hour by default, via the new <code>registrationRateLimit</code> and <code>registrationRateLimitDuration</code> OAuth config settings. (<a href="https://github.com/craftcms/cms/pull/20303">#20303</a>)</li>
<li>Garbage collection now deletes expired and revoked OAuth authorization codes and tokens, and registered OAuth clients that were revoked or never authorized. (<a href="https://github.com/craftcms/cms/pull/20303">#20303</a>)</li>
<li>Plugins can register MCP capabilities via <code>craft\services\Mcp::EVENT_REGISTER_CAPABILITY_TYPES</code>, OAuth resources via <code>craft\services\OAuth::EVENT_REGISTER_RESOURCES</code>, and personal access token scopes via <code>craft\services\PersonalAccessTokens::registerScopeGroup()</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>, <a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\base\ApplicationTrait::getOAuth()</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\base\InputSchemaFieldInterface</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\config\McpConfig</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\config\OAuthConfig</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\events\RegisterOAuthResourcesEvent</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\gql\GqlInputSchema</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added the <code>craft\mcp</code> and <code>craft\oauth</code> namespaces. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>, <a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\services\Config::CATEGORY_MCP</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\services\Config::CATEGORY_OAUTH</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\services\Config::getMcp()</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\services\Config::getOAuth()</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\services\Mcp</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\services\OAuth</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Added <code>craft\utilities\ClearCaches::clear()</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Plain Text, Email, Link, Number, Money, Lightswitch, Date, Time, Color, Country, Table, and option fields now implement <code>craft\base\InputSchemaFieldInterface</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
</ul>
<h3>Personal Access Tokens</h3>
<ul>
<li>Added the My <strong>Account</strong> → <strong>Tokens</strong> screen, where users can create personal access tokens for the APIs that offer them (such as the GraphQL API), rename them, and revoke tokens and the apps they’ve authorized. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>MCP clients that users have authorized are listed on their <strong>My Account</strong> → <strong>Tokens</strong> screen, where they can be revoked. (<a href="https://github.com/craftcms/cms/pull/20291">#20291</a>)</li>
<li>Added <code>craft\base\ApplicationTrait::getPersonalAccessTokens()</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\services\PersonalAccessTokens</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
</ul>
<h3>GraphQL</h3>
<ul>
<li>GraphQL API requests can now be authenticated with OAuth access tokens, granting access to the content the authorizing user has permission to access. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>GraphQL schema components can now support authenticated requests via an <code>authenticated</code> key on their config. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added the <code>currentUser</code> GraphQL query, which returns the user that authenticated the request. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>GraphQL schemas can now include read-only components for sites, sections, entry types, volumes, user groups, category groups, and tag groups. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added the <code>sites</code>, <code>site</code>, <code>sections</code>, <code>section</code>, <code>entryTypes</code>, <code>entryType</code>, <code>volumes</code>, <code>volume</code>, <code>userGroups</code>, <code>userGroup</code>, <code>categoryGroups</code>, <code>categoryGroup</code>, <code>tagGroups</code>, and <code>tagGroup</code> GraphQL queries, which are available when the schema includes the corresponding components. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Elements now have <code>site</code> fields in GraphQL, when the schema includes the “Query for sites” component. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Entries now have <code>section</code> and <code>type</code> fields in GraphQL, when the schema includes the “Query for sections” and “Query for entry types” components. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Assets now have <code>volume</code> fields in GraphQL, when the schema includes the “Query for volumes” component. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Users now have <code>groups</code> fields in GraphQL, when the schema includes the “Query for user groups” component. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Categories and tags now have <code>group</code> fields in GraphQL, when the schema includes the “Query for category groups” and “Query for tag groups” components. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added <code>craft\elements\db\EagerLoadPlan::$configureQuery</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\gql\base\ElementMutationResolver::requireUserAuthorization()</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\gql\queries\Settings</code>. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added <code>craft\gql\types\CategoryGroup</code>. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added <code>craft\gql\types\EntryType</code>. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added <code>craft\gql\types\Section</code>. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added <code>craft\gql\types\Site</code>. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added <code>craft\gql\types\TagGroup</code>. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added <code>craft\gql\types\UserGroup</code>. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added <code>craft\gql\types\Volume</code>. (<a href="https://github.com/craftcms/cms/pull/20055">#20055</a>)</li>
<li>Added <code>craft\helpers\Gql::getSchemaUser()</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\models\GqlSchema::$user</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\services\Gql::getOAuthResource()</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\services\Gql::getSchemaForUser()</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\services\Gql::SCOPE_READ</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
<li>Added <code>craft\services\Gql::SCOPE_WRITE</code>. (<a href="https://github.com/craftcms/cms/pull/20147">#20147</a>)</li>
</ul>
<h3>Multi-Site Editing</h3>
<ul>
<li>Element edit pages now have a “Sites” pane in their sidebars on multi-site installs, in place of the “Status” pane, which lists the sites the element is saved to (that the user can edit), with status toggles and links to the element in each site, and lets authors add the element to other sites. (<a href="https://github.com/craftcms/cms/pull/20061">#20061</a>)</li>
<li>Element editor slideouts can now be switched to other sites, by clicking on a site name within the “Sites” pane. (<a href="https://github.com/craftcms/cms/pull/20061">#20061</a>)</li>
<li>Sites that are added to elements within the “Sites” pane can now be removed again. (<a href="https://github.com/craftcms/cms/pull/20061">#20061</a>)</li>
<li>Element edit pages’ sidebar pane headings now line up with the labels within the panes. (<a href="https://github.com/craftcms/cms/pull/20061">#20061</a>)</li>
<li>Deleting an element for the only site it exists in now soft-deletes it, unless it’s a draft or nested element. (<a href="https://github.com/craftcms/cms/pull/20060">#20060</a>)</li>
<li>Added <code>craft\base\Element::showSitesField()</code>. (<a href="https://github.com/craftcms/cms/pull/20061">#20061</a>)</li>
<li>Added <code>craft\base\Element::sitesFieldHtml()</code>. (<a href="https://github.com/craftcms/cms/pull/20061">#20061</a>)</li>
<li><code>elements/save-draft</code> action responses now include a <code>canDeleteForSite</code> key. (<a href="https://github.com/craftcms/cms/pull/20061">#20061</a>)</li>
</ul>
<h3>Assets</h3>
<ul>
<li>Assets are now initially saved to the site they were uploaded from. (<a href="https://github.com/craftcms/cms/pull/20060">#20060</a>)</li>
<li>Volumes now have a “Propagation Method” setting, which can be set to “Let each asset choose which sites it should be saved to”. New volumes default to this, as do existing volumes on single-site installs. Existing volumes on multi-site installs continue to save assets to all sites. (<a href="https://github.com/craftcms/cms/pull/20060">#20060</a>)</li>
<li>Assets in volumes set to let each asset choose which sites it should be saved to now have a “Sites” pane in their edit pages’ sidebars. (<a href="https://github.com/craftcms/cms/pull/20060">#20060</a>)</li>
<li>Assets in volumes set to let each asset choose which sites it should be saved to can now be deleted for individual sites, as long as they exist in another site. (<a href="https://github.com/craftcms/cms/pull/20060">#20060</a>)</li>
<li>Files can now be uploaded to Assets fields by pasting them from the clipboard while the field has focus. (<a href="https://github.com/craftcms/cms/discussions/20183">#20183</a>, <a href="https://github.com/craftcms/cms/pull/20212">#20212</a>)</li>
<li>Added support for JPEG XL (<code>.jxl</code>) images, when ImageMagick supports it. JPEG XL images can now be uploaded, transformed, and set as a transform’s output format.</li>
<li>BMP images can now be transformed and edited in the Image Editor.</li>
<li>Craft can now determine the dimensions of BMP and JPEG XL images on remote volumes without downloading them.</li>
<li>Added the “Markdown” file kind, and <code>md</code> and <code>markdown</code> are now included in the default <code>allowedFileExtensions</code> config setting value. Markdown files can be previewed with syntax highlighting. (<a href="https://github.com/craftcms/cms/pull/20089">#20089</a>)</li>
<li>Added <code>craft\elements\Asset::KIND_MARKDOWN</code>. (<a href="https://github.com/craftcms/cms/pull/20089">#20089</a>)</li>
<li>Added <code>craft\models\Volume::$propagationMethod</code>. (<a href="https://github.com/craftcms/cms/pull/20060">#20060</a>)</li>
<li>Added <code>craft\services\Images::getSupportsBmp()</code>.</li>
<li>Added <code>craft\services\Images::getSupportsJxl()</code>.</li>
<li>Added <code>Craft.BaseUploader::addFiles()</code>. (<a href="https://github.com/craftcms/cms/discussions/20183">#20183</a>, <a href="https://github.com/craftcms/cms/pull/20212">#20212</a>)</li>
<li><code>Craft.BaseUploader</code> now supports a <code>pasteZone</code> setting. Files pasted while focus is within it are passed to <code>addFiles()</code>, which custom uploader classes must implement to support pasted files. (<a href="https://github.com/craftcms/cms/discussions/20183">#20183</a>, <a href="https://github.com/craftcms/cms/pull/20212">#20212</a>)</li>
<li><code>craft\services\Assets::getAssetById()</code> now returns the asset in another site if it doesn’t exist in the current site, when no site ID is passed. (<a href="https://github.com/craftcms/cms/pull/20060">#20060</a>)</li>
</ul>
<h3>Addresses</h3>
<ul>
<li>Addresses within Addresses fields can now be edited from drafts of their owner elements, by users who can save the drafts but not the canonical owner elements. (<a href="https://github.com/craftcms/cms/issues/19881">#19881</a>)</li>
<li>Addresses now support drafts.</li>
</ul>
<h3>Color Fields</h3>
<ul>
<li>Color fields now support translucent colors. Authors can choose translucent palette colors, and set custom colors’ opacity when the field allows it, via the color picker in browsers that support it or by entering an 8-digit hex value. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Color fields’ palette colors can now have an alpha channel, by entering an 8-digit hex value or via the color picker in browsers that support it. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Color fields now have an “Allow opacity for custom colors” setting. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Color fields now have a “GraphQL Mode” setting, which can be set to “Full data” or “Hex only”. New Color fields default to “Full data”, and existing Color fields default to “Hex only”. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Color field values’ <code>hex</code> properties and GraphQL values now include an alpha channel (e.g. <code>#0000ff80</code>) when the color isn’t fully opaque. Fully-opaque colors are still output as 6-digit hex values. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Color field values now have <code>alpha</code>, <code>rgba</code>, <code>hsla</code>, <code>rgbChannels</code>, <code>oklch</code>, and <code>contrastColor</code> properties, and a <code>contrastRatio()</code> method. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Color fields set to the “Full data” GraphQL mode now return objects with <code>hex</code>, <code>label</code>, <code>red</code>, <code>green</code>, <code>blue</code>, <code>alpha</code>, <code>hue</code>, <code>saturation</code>, <code>lightness</code>, <code>luma</code>, <code>rgb</code>, <code>rgba</code>, <code>rgbChannels</code>, <code>hsl</code>, <code>hsla</code>, <code>oklch</code>, <code>contrastColor</code>, and <code>contrastRatio</code> fields. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\fields\Color::$allowCustomAlpha</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\fields\Color::$fullGraphqlData</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\fields\data\ColorData::getAlpha()</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\fields\data\ColorData::getContrastColor()</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\fields\data\ColorData::getContrastRatio()</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\fields\data\ColorData::getHsla()</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\fields\data\ColorData::getOklch()</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\fields\data\ColorData::getRgbChannels()</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\fields\data\ColorData::getRgba()</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\gql\types\ColorData</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\gql\types\generators\ColorDataType</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li>Added <code>craft\validators\ColorValidator::$allowAlpha</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li><code>craft\fields\data\ColorData::getHex()</code> now has a <code>$withAlpha</code> argument, which defaults to <code>true</code>. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
<li><code>craft\validators\ColorValidator::normalizeColor()</code> now expands 4-digit hex values to 8 digits, and removes fully-opaque alpha channels from 8-digit hex values. (<a href="https://github.com/craftcms/cms/discussions/8983">#8983</a>, <a href="https://github.com/craftcms/cms/pull/20274">#20274</a>)</li>
</ul>
<h3>Icon Fields</h3>
<ul>
<li>Icon pickers can now include icons from custom icon sets. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Icon fields now have an “Icon Sets” setting, when any custom icon sets are registered, which determines which icon sets are selectable and in what order. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added the <code>customIconPath</code> config setting, which registers a “Custom” icon set made up of the SVG files within a directory, such as <code>@config/icons</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Icon field values now have a <code>set</code> property, set to the handle of the custom icon set the icon was selected from (or <code>null</code> for Font Awesome icons). (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Icons selected from custom icon sets are stored as <code>set-handle:icon-name</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li><code>IconData</code> GraphQL objects now have <code>set</code>, <code>svg</code>, and <code>keywords</code> fields. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Icon field values now have <code>getSvg()</code> and <code>getKeywords()</code> methods. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Plugins can register custom icon sets via <code>craft\services\Icons::EVENT_REGISTER_ICON_SETS</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added <code>craft\base\ApplicationTrait::getIcons()</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added <code>craft\events\RegisterIconSetsEvent</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added <code>craft\fields\data\IconData::$set</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added <code>craft\fields\data\IconData::getKeywords()</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added <code>craft\fields\data\IconData::getSvg()</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added <code>craft\fields\Icon::$iconSets</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added <code>craft\icons\DirectoryIconSet</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added <code>craft\icons\IconSet</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li>Added <code>craft\services\Icons</code>. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li><code>craft\helpers\Cp::iconSvg()</code> now supports <code>set-handle:icon-name</code> values. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
<li><code>Craft.IconPicker</code> now supports a <code>sets</code> setting, which can be set to an array of icon set handles (<code>fontawesome</code> for Font Awesome), or <code>'*'</code> for all icon sets. (<a href="https://github.com/craftcms/cms/discussions/17101">#17101</a>, <a href="https://github.com/craftcms/cms/pull/20277">#20277</a>)</li>
</ul>
<h3>Custom Fields</h3>
<ul>
<li>Custom fields now have “Default Tip” and “Default Warning” settings. (<a href="https://github.com/craftcms/cms/pull/19976">#19976</a>)</li>
<li>Added <code>craft\base\FieldTrait::$tip</code>.</li>
<li>Added <code>craft\base\FieldTrait::$warning</code>.</li>
<li>Added <code>craft\fieldlayoutelements\BaseField::defaultTip()</code>.</li>
<li>Added <code>craft\fieldlayoutelements\BaseField::defaultWarning()</code>.</li>
</ul>
<h3>Templating</h3>
<ul>
<li>Added the <code>{% render %}</code> Twig tag. (<a href="https://github.com/craftcms/cms/pull/19988">#19988</a>)</li>
<li><code>{% render %}</code> tags and <code>render()</code> methods are allowed within the Twig sandbox. (<a href="https://github.com/craftcms/cms/pull/19988">#19988</a>)</li>
<li>The <code>capitalize</code>, <code>lower</code>, <code>title</code>, and <code>upper</code> Twig filters now have <code>language</code> arguments, which default to the current application language. (<a href="https://github.com/craftcms/cms/pull/19558">#19558</a>)</li>
<li>Added <code>craft\base\Renderable</code>. (<a href="https://github.com/craftcms/cms/pull/19988">#19988</a>)</li>
<li>Added <code>craft\helpers\Template::render()</code>. (<a href="https://github.com/craftcms/cms/pull/19988">#19988</a>)</li>
<li>Added <code>craft\i18n\Locale::languageId()</code>.</li>
<li><code>Illuminate\Support\Collection</code> now has a <code>render()</code> macro, which replaces <code>craft\elements\ElementCollection::render()</code>. (<a href="https://github.com/craftcms/cms/pull/19988">#19988</a>)</li>
<li><code>craft\helpers\ElementHelper::normalizeSlug()</code> now has a <code>$language</code> argument, which defaults to the current application language. (<a href="https://github.com/craftcms/cms/pull/19558">#19558</a>)</li>
<li><code>craft\helpers\StringHelper::toLowerCase()</code>, <code>::toTitleCase()</code>, and <code>::toUpperCase()</code> now have <code>$language</code> arguments, which default to the current application language. (<a href="https://github.com/craftcms/cms/pull/19558">#19558</a>)</li>
<li>Deprecated <code>craft\helpers\ElementHelper::renderElements()</code>. <code>craft\helpers\Template::render()</code> should be used instead. (<a href="https://github.com/craftcms/cms/pull/19988">#19988</a>)</li>
</ul>
<h3>Control Panel</h3>
<ul>
<li>The global Settings page now has an “Extend” section, which contains Plugins and MCP.</li>
<li>Assets settings are now in the “Content” section of the global Settings page, and the “Media” section has been removed.</li>
<li>Filesystem settings are now within Assets settings, at <strong>Settings</strong> → <strong>Assets</strong> → <strong>Filesystems</strong>.</li>
<li>Queue jobs’ Job Data is now syntax-highlighted in the Queue Manager utility.</li>
<li>The Project Config utility’s “Loaded Project Config Data” is now syntax-highlighted.</li>
<li>Asset previews and the Project Config utility now use TanStack Highlight for syntax highlighting, rather than Prism. (<a href="https://github.com/craftcms/cms/pull/20088">#20088</a>)</li>
<li>Added <code>craft\web\assets\highlight\HighlightAsset</code>. (<a href="https://github.com/craftcms/cms/pull/20088">#20088</a>)</li>
<li>Deprecated <code>craft\web\assets\prismjs\PrismJsAsset</code>. <code>craft\web\assets\highlight\HighlightAsset</code> should be used instead. <code>PrismJsAsset</code> now registers a <code>Prism</code> shim backed by TanStack Highlight, which supports Prism’s commonly-used APIs, but not grammar customization, hooks, or plugins. (<a href="https://github.com/craftcms/cms/pull/20088">#20088</a>)</li>
</ul>
<h3>Security</h3>
<ul>
<li>A rate limit is now enforced for <code>users/login</code>, <code>auth/verify-totp</code>, and <code>auth/verify-recovery-code</code> requests. (<a href="https://github.com/craftcms/cms/pull/20054">#20054</a>)</li>
<li>Added the <code>defaultRateLimit</code> and <code>defaultRateLimitDuration</code> config settings, which configure the rate limits for <code>users/login</code>, <code>users/send-password-reset-email</code>, <code>auth/verify-totp</code>, and <code>auth/verify-recovery-code</code> requests. (<a href="https://github.com/craftcms/cms/pull/20054">#20054</a>)</li>
<li>Removed support for the non-standard <code>ED256</code> passkey algorithm. (<a href="https://github.com/craftcms/cms/pull/19701">#19701</a>)</li>
<li>Uploaded file names and search keywords no longer retain bidirectional override characters and other invisible characters.</li>
<li>Added <code>craft\helpers\StringHelper::areConfusable()</code>.</li>
<li>Added <code>craft\helpers\StringHelper::stripPrivateAndUnassignedChars()</code>.</li>
<li><code>craft\helpers\StringHelper::invisibleCharsRegex()</code> now also matches bidirectional embedding, override, and isolate characters; non-whitespace control characters; the word joiner, function application, combining grapheme joiner, and Mongolian vowel separator characters; and blank Hangul filler and braille characters.</li>
<li>Fixed a <a href="https://github.com/craftcms/cms/security/policy#severity--remediation">moderate-severity</a> information disclosure vulnerability. (GHSA-hgwm-4xxx-w8jq)</li>
<li>Fixed a <a href="https://github.com/craftcms/cms/security/policy#severity--remediation">moderate-severity</a> authorization bypass vulnerability. (GHSA-vvm6-wrc8-5fgh)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Saving nested elements on multi-site installs now executes fewer database queries. (<a href="https://github.com/craftcms/cms/pull/20090">#20090</a>)</li>
<li>Search indexing now executes fewer database queries. (<a href="https://github.com/craftcms/cms/pull/20090">#20090</a>)</li>
<li>User permission checks are now faster for users with many permissions. (<a href="https://github.com/craftcms/cms/pull/20149">#20149</a>)</li>
</ul>
<h3>Other Changes</h3>
<ul>
<li>Added the <code>project-config/check</code> command, which checks project config schema compatibility without applying changes.</li>
<li>MySQL database backups and restores now carry over SSL/TLS settings from the system’s MySQL option files (e.g. <code>ssl-ca</code> or <code>disable-ssl-verify-server-cert</code>), if the database connection doesn’t have any <code>PDO::MYSQL_ATTR_SSL_*</code> attributes set. (<a href="https://github.com/craftcms/cms/pull/19366">#19366</a>)</li>
<li>MySQL database backups and restores now respect the <code>PDO::MYSQL_ATTR_SSL_CAPATH</code> and <code>PDO::MYSQL_ATTR_SSL_CIPHER</code> database connection attributes. (<a href="https://github.com/craftcms/cms/pull/19366">#19366</a>)</li>
<li>Element fixtures no longer create revisions by default. Set their <code>createRevisions</code> property to <code>true</code> to retain the previous behavior. (<a href="https://github.com/craftcms/cms/pull/19626">#19626</a>)</li>
<li>Added <code>craft\test\ElementFixtureTrait</code>. (<a href="https://github.com/craftcms/cms/pull/19626">#19626</a>)</li>
<li>Added <code>craft\base\NestedElementTrait::$touchOwnersOnSave</code>.</li>
<li>Added <code>craft\elements\db\NestedElementQueryTrait::mustHaveField()</code>.</li>
<li>Added <code>craft\elements\db\NestedElementQueryTrait::mustHaveOwner()</code>.</li>
<li>Added <code>craft\helpers\Db::isSafeOrderBy()</code>. (<a href="https://github.com/craftcms/cms/pull/19994">#19994</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Craft now requires <code>league/oauth2-server</code>, <code>mcp/sdk</code>, and <code>symfony/finder</code>. (<a href="https://github.com/craftcms/cms/pull/20145">#20145</a>)</li>
<li>Updated Axios to 1.20.0. </li>
<li>Updated Twig to 3.30.</li>
<li>Updated Fabric.js to v7. (<a href="https://github.com/craftcms/cms/pull/19628">#19628</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed a bug where entry and address indexes weren’t showing any results if they had a “Field” condition rule set to “is empty”.</li>
<li>Fixed a bug where <code>craft\services\Elements::deleteElementsForSite()</code> would remove elements’ site rows without deleting the elements, on single-site installs. (<a href="https://github.com/craftcms/cms/pull/20060">#20060</a>)</li>
<li>Fixed a bug where saving a deeply-nested element on its own wouldn’t update its owners’ <code>dateUpdated</code> timestamps, which could cause new revisions to reuse stale nested content. (<a href="https://github.com/craftcms/cms/issues/19594">#19594</a>)</li>
<li>Fixed a bug where deleting an element for a site while editing a provisional draft would delete the provisional draft for all sites. (<a href="https://github.com/craftcms/cms/pull/20061">#20061</a>)</li>
<li>Fixed a bug where DSNs set via database config arrays weren’t getting parsed, so MySQL’s <code>utf8</code> charset wasn’t getting normalized to <code>utf8mb4</code>. (<a href="https://github.com/craftcms/cms/issues/20248">#20248</a>)</li>
<li>Fixed a bug where <code>craft\i18n\Locale::getOrientation()</code> was returning <code>ltr</code> for some right-to-left locales, such as Central Kurdish (<code>ckb</code>) and Punjabi in Arabic script (<code>pa-Arab</code>). (<a href="https://github.com/craftcms/cms/issues/20301">#20301</a>)</li>
<li>Fixed a bug where batched queue jobs weren’t splitting into additional batches before reaching their time limits. (<a href="https://github.com/craftcms/cms/pull/20304">#20304</a>)</li>
<li>Fixed an error that occurred when passing <code>withProvisionalDrafts</code> to a Matrix field via GraphQL. (<a href="https://github.com/craftcms/cms/issues/20308">#20308</a>)</li>
<li>Fixed a bug where users who logged into the control panel with “Remember me” checked could get logged out after an hour of inactivity.</li>
<li>Fixed a bug where default titles of assets with long filenames were taken from the end of the filename. (<a href="https://github.com/craftcms/cms/pull/20112">#20112</a>)</li>
<li>Fixed a bug where characters were stripped from text that wasn’t UTF-8 when it was converted to UTF-8, such as alt text read from images’ IPTC captions. (<a href="https://github.com/craftcms/cms/pull/20111">#20111</a>)</li>
<li>Fixed a bug where the <code>fields/merge</code> and <code>fields/auto-merge</code> commands weren’t updating field condition rules that referenced the merged fields. (<a href="https://github.com/craftcms/cms/issues/19901">#19901</a>)</li>
<li>Fixed a bug where the <code>fields/merge</code> and <code>fields/auto-merge</code> commands weren’t updating Content Block fields’ layouts. (<a href="https://github.com/craftcms/cms/issues/19901">#19901</a>)</li>
<li>Fixed a bug where curly quotes were allowed within asset folder and filenames. (<a href="https://github.com/craftcms/cms/issues/19904">#19904</a>)</li>
<li>Fixed a bug where the “Instructions” setting’s placeholder text wasn’t getting updated when changing a field layout element’s selected field.</li>
<li>Fixed a bug where renaming an asset without including its file extension resulted in a validation error. (<a href="https://github.com/craftcms/cms/issues/19950">#19950</a>)</li>
<li>Fixed a bug where the Image Editor’s crop box couldn’t be resized in some cases. (<a href="https://github.com/craftcms/cms/issues/19980">#19980</a>)</li>
<li>Fixed an error that occurred when opening element selector modals on element edit pages with a <code>returnUrl</code> param. (<a href="https://github.com/craftcms/cms/issues/19983">#19983</a>)</li>
<li>Fixed a bug where <code>orderBy</code> criteria wasn’t getting applied to eager-loaded elements. (<a href="https://github.com/craftcms/cms/pull/19994">#19994</a>)</li>
<li>Fixed a bug where <code>orderBy</code>, <code>offset</code>, and <code>limit</code> params weren’t getting applied to element queries executed via <code>eagerly()</code>. (<a href="https://github.com/craftcms/cms/pull/19994">#19994</a>)</li>
<li>Fixed a bug where eager-loaded elements were getting reversed twice when both <code>orderBy</code> and <code>inReverse</code> criteria were set. (<a href="https://github.com/craftcms/cms/pull/19994">#19994</a>)</li>
<li>Fixed a bug where skipped revisions were getting reported as root element lookup errors when resaving elements. (<a href="https://github.com/craftcms/cms/pull/20026">#20026</a>)</li>
<li>Fixed a bug where pruning revisions could delete nested element revisions in other sites that newer revisions still referenced. (<a href="https://github.com/craftcms/cms/issues/20042">#20042</a>)</li>
<li>Fixed a bug where “Save as a new draft” didn’t carry nested entries over to the new draft. (<a href="https://github.com/craftcms/cms/issues/20226">#20226</a>)</li>
<li>Fixed an error that occurred when logging in with a passkey that was registered with an older version of Craft. (<a href="https://github.com/craftcms/cms/issues/20052">#20052</a>)</li>
<li>Fixed a bug where closing an element selector modal while it was loading caused it to keep loading all of the source’s elements in the background. (<a href="https://github.com/craftcms/cms/issues/20100">#20100</a>)</li>
<li>Fixed a bug where moving assets and replacing existing files with the same name could fail. (<a href="https://github.com/craftcms/cms/issues/20128">#20128</a>)</li>
<li>Fixed a bug where nested entries added via drafts on multi-site installs could get an incomplete first revision, causing their nested content to be deleted when reverting to it. (<a href="https://github.com/craftcms/cms/issues/20151">#20151</a>)</li>
<li>Fixed a bug where nested entries owned by drafts could get their own revisions, which could cause a foreign key error when applying the draft on PostgreSQL. (<a href="https://github.com/craftcms/cms/issues/20151">#20151</a>)</li>
</ul>
";s:4:"date";s:19:"2026-11-03T00:00:00";}i:2;a:4:{s:7:"version";s:8:"5.11.5.1";s:8:"critical";b:0;s:5:"notes";s:169:"<ul>
<li>Fixed a bug that prevented third party nested element types from being editable. (<a href="https://github.com/craftcms/cms/issues/19898">#19898</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-08T00:00:00";}i:3;a:4:{s:7:"version";s:6:"5.11.5";s:8:"critical";b:0;s:5:"notes";s:1443:"<ul>
<li>Fixed a bug where saving an image as a new asset from the Image Editor didn’t always replace the original asset within the Assets field it was selected in. (<a href="https://github.com/craftcms/cms/issues/19791">#19791</a>)</li>
<li>Fixed a bug where queries executed within <code>craft\db\Connection::cache()</code> could cause infinite recursion when <code>craft\cache\DbCache</code> was used as the cache component. (<a href="https://github.com/craftcms/cms/issues/19877">#19877</a>)</li>
<li>Fixed a bug where license records weren’t being updated with the newly-installed versions after running the <code>update</code> command. (<a href="https://github.com/craftcms/cms/issues/19878">#19878</a>)</li>
<li>Fixed a bug where addresses could present as editable even if the user didn’t have permission to save their parent element. (<a href="https://github.com/craftcms/cms/issues/19881">#19881</a>)</li>
<li>Fixed a <a href="https://github.com/craftcms/cms/security/policy#severity--remediation">high-severity</a> SQL injection vulnerability. (<a href="https://github.com/craftcms/cms/security/advisories/GHSA-cphx-cx67-jcqj">GHSA-cphx-cx67-jcqj</a>)</li>
<li>Fixed a <a href="https://github.com/craftcms/cms/security/policy#severity--remediation">moderate-severity</a> authorization bypass vulnerability. (<a href="https://github.com/craftcms/cms/security/advisories/GHSA-4rg3-m2h8-grqw">GHSA-4rg3-m2h8-grqw</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-07T00:00:00";}i:4;a:4:{s:7:"version";s:6:"5.11.4";s:8:"critical";b:0;s:5:"notes";s:3609:"<ul>
<li>Added <code>craft\services\Users::destroyOtherSessions()</code>.</li>
<li>Setting up a two-step verification method now destroys the user’s other sessions.</li>
<li>Deleting a passkey now requires an elevated session.</li>
<li>Fixed a bug where an uninformative error message could be shown when saving a draft that no longer passed validation. (<a href="https://github.com/craftcms/cms/issues/19674">#19674</a>)</li>
<li>Fixed a bug where the Assets index page could display the wrong assets and subfolders after reloading the browser tab. (<a href="https://github.com/craftcms/cms/issues/19689">#19689</a>)</li>
<li>Fixed a bug where Matrix fields set to the “Cards”, “Card grid”, or “Index” view modes weren’t respecting <code>craft\fields\Matrix::EVENT_DEFINE_ENTRY_TYPES</code>. (<a href="https://github.com/craftcms/cms/pull/19685">#19685</a>)</li>
<li>Fixed a bug where the <code>attribute()</code> Twig function was allowed within sandboxed Twig environments, even if it wasn’t listed in <code>allowedFunctions</code>.</li>
<li>Fixed a bug where Twig array access with a <code>false</code> key could return the wrong value when Dev Mode was disabled.</li>
<li>Fixed an error that could occur when adding a new site to a draft, if it contained multiple levels of nested content. (<a href="https://github.com/craftcms/cms/issues/18281">#18281</a>)</li>
<li>Fixed a bug where dragged items weren’t getting dropped where expected, if their container had scrolled during the drag operation. (<a href="https://github.com/craftcms/cms/issues/19721">#19721</a>)</li>
<li>Fixed a bug where publicly-registered users weren’t getting activated and logged in immediately, if email verification wasn’t required but the password was deferred. (<a href="https://github.com/craftcms/cms/issues/19610">#19610</a>)</li>
<li>Fixed a bug where changing an entry’s type could cause values for fields shared by both entry types to be lost. (<a href="https://github.com/craftcms/cms/issues/19737">#19737</a>)</li>
<li>Fixed an error that could occur when running the <code>setup/php-session-table</code> and <code>setup/db-cache-table</code> commands. (<a href="https://github.com/craftcms/cms/pull/19742">#19742</a>)</li>
<li>Fixed an infinite loop that could occur when editing nested Matrix entries in Blocks view. (<a href="https://github.com/craftcms/cms/issues/19756">#19756</a>)</li>
<li>Fixed a bug where filtering elements by textual params or conditions could only work if the param/condition value was all-lowercase. (<a href="https://github.com/craftcms/cms/issues/19781">#19781</a>)</li>
<li>Fixed a <a href="https://github.com/craftcms/cms/security/policy#severity--remediation">high-severity</a> RCE vulnerability. (<a href="https://github.com/craftcms/cms/security/advisories/GHSA-hq78-cm2m-h24h">GHSA-hq78-cm2m-h24h</a>)</li>
<li>Fixed a <a href="https://github.com/craftcms/cms/security/policy#severity--remediation">low-severity</a> RCE vulnerability. (<a href="https://github.com/craftcms/cms/security/advisories/GHSA-6m9q-c5q4-3732">GHSA-6m9q-c5q4-3732</a>)</li>
<li>Fixed a <a href="https://github.com/craftcms/cms/security/policy#severity--remediation">low-severity</a> authorization bypass vulnerability. (<a href="https://github.com/craftcms/cms/security/advisories/GHSA-j2r3-x468-c6j5">GHSA-j2r3-x468-c6j5</a>)</li>
<li>Fixed a <a href="https://github.com/craftcms/cms/security/policy#severity--remediation">low-severity</a> XSS vulnerability. (<a href="https://github.com/craftcms/cms/security/advisories/GHSA-Q2RX-MR36-8RH5">GHSA-q2rx-mr36-8rh5</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-01T00:00:00";}}s:13:"phpConstraint";s:4:"^8.2";s:11:"packageName";s:12:"craftcms/cms";}s:7:"plugins";a:9:{s:9:"admin-bar";a:3:{s:6:"status";s:8:"eligible";s:8:"releases";a:0:{}s:11:"packageName";s:23:"wbrowar/craft-admin-bar";}s:8:"announce";a:3:{s:6:"status";s:8:"eligible";s:8:"releases";a:0:{}s:11:"packageName";s:27:"honchoagency/craft-announce";}s:8:"calendar";a:4:{s:6:"status";s:8:"eligible";s:8:"releases";a:2:{i:0;a:4:{s:7:"version";s:6:"5.0.33";s:8:"critical";b:0;s:5:"notes";s:1196:"<h3>Added</h3>
<ul>
<li>Added a <code>--calendar</code> option to <code>calendar/events/resave</code> to resave events from a single calendar by handle or ID.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed <strong>Select Dates</strong> events imported through Feed Me losing their selected dates or failing to update.</li>
<li>Fixed recurrence rules carrying over between events imported through Feed Me.</li>
<li>Fixed outdated recurrence settings being retained when updating an event through Feed Me with a new recurrence rule.</li>
<li>Fixed recurring event dates being overwritten by multi-site saves through the events service outside the control panel.</li>
<li>Fixed duplicate occurrences when an event's start date was also selected under <strong>Select Dates</strong>.</li>
<li>Fixed an event's start time being changed when retrieving <strong>Select Dates</strong> occurrences.</li>
</ul>
<h3>Security</h3>
<ul>
<li>Updated vulnerable JavaScript dependencies and replaced Lerna with npm workspaces for development builds, which now require Node.js 20.19+ and npm 10+.</li>
<li>Updated the minimum supported Carbon versions to 2.72.6 and 3.8.4 to address a security vulnerability.</li>
</ul>
";s:4:"date";s:19:"2026-10-29T00:00:00";}i:1;a:4:{s:7:"version";s:6:"5.0.32";s:8:"critical";b:0;s:5:"notes";s:147:"<h3>Fixed</h3>
<ul>
<li>Fixed an issue where <strong>Save as a new event</strong> did not preserve changes made while editing an event.</li>
</ul>
";s:4:"date";s:19:"2026-10-11T00:00:00";}}s:13:"phpConstraint";s:13:"^8.0.2|^8.2.0";s:11:"packageName";s:23:"solspace/craft-calendar";}s:8:"ckeditor";a:4:{s:6:"status";s:8:"eligible";s:8:"releases";a:2:{i:0;a:4:{s:7:"version";s:5:"5.9.0";s:8:"critical";b:0;s:5:"notes";s:1065:"<ul>
<li>Updated CKEditor to 48.5.2. (<a href="https://github.com/craftcms/ckeditor/issues/633">#633</a>)</li>
<li>Fixed an <code>InvalidSubpathException</code> error that occurred when editing an element with a CKEditor field that had “Insert image” in its toolbar, if the field’s default upload location contained a variable that couldn’t be resolved yet (e.g. <code>{slug}</code>). (<a href="https://github.com/craftcms/ckeditor/issues/618">#618</a>, <a href="https://github.com/craftcms/ckeditor/pull/630">#630</a>)</li>
<li>Fixed a bug where links with styles and advanced link fields could be split into multiple links when their displayed text was changed. (<a href="https://github.com/craftcms/ckeditor/issues/631">#631</a>, <a href="https://github.com/craftcms/ckeditor/pull/632">#632</a>)</li>
<li>Fixed a bug where links with styles and advanced link fields could become difficult to edit or unlink. (<a href="https://github.com/craftcms/ckeditor/issues/631">#631</a>, <a href="https://github.com/craftcms/ckeditor/pull/632">#632</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-06T00:00:00";}i:1;a:4:{s:7:"version";s:5:"5.8.0";s:8:"critical";b:0;s:5:"notes";s:2088:"<ul>
<li>CKEditor packages registered by plugins that load after CKEditor, including from <code>Craft::$app-&gt;onInit()</code> callbacks, are now registered properly. (<a href="https://github.com/craftcms/ckeditor/issues/621">#621</a>)</li>
<li>CKEditor fields now only import third-party CKEditor packages, and register their asset bundles, when one of the package’s toolbar items is in the field’s toolbar. Packages without toolbar items are still loaded for every field.</li>
<li>Third-party CKEditor plugins are now referenced via namespace imports, so plugins with the same name from different packages no longer conflict. Custom config JS can still refer to them by name (e.g. <code>extraPlugins: [Tokens]</code>), as long as the name is unique.</li>
<li>Added <code>craft\ckeditor\Plugin::registerCkeditorPackageBundles()</code>.</li>
<li>Deprecated <code>craft\ckeditor\helpers\CkeditorConfig::getImportStatements()</code>.</li>
<li>Package asset bundles are no longer registered automatically whenever <code>CkeditorAsset</code> is registered.</li>
<li>Fixed a bug where package toolbar items were registered again each time a CKEditor field was rendered.</li>
<li>Fixed a bug where grouped toolbar items from third-party packages weren’t matched against the field’s toolbar.</li>
<li>Fixed a bug where all of a package’s toolbar items were shown as a single group in the toolbar builder, instead of as separately-placeable items and groups.</li>
<li>Fixed a bug where the “Displayed text” value was ignored when inserting a new element link, and the element’s title was used instead. (<a href="https://github.com/craftcms/ckeditor/pull/617">#617</a>)</li>
<li>Fixed a bug where links’ types would change to “URL” if a URL suffix was entered before an element was chosen. (<a href="https://github.com/craftcms/ckeditor/issues/619">#619</a>, <a href="https://github.com/craftcms/ckeditor/pull/624">#624</a>)</li>
<li>Fixed an error that could occur when uninstalling CKEditor. (<a href="https://github.com/craftcms/ckeditor/issues/623">#623</a>)</li>
</ul>
";s:4:"date";s:19:"2026-09-28T00:00:00";}}s:13:"phpConstraint";s:4:"^8.2";s:11:"packageName";s:17:"craftcms/ckeditor";}s:6:"formie";a:4:{s:6:"status";s:8:"eligible";s:8:"releases";a:17:{i:0;a:4:{s:7:"version";s:5:"4.0.7";s:8:"critical";b:0;s:5:"notes";s:22316:"<h3>Added</h3>
<ul>
<li>Keep synced fields linked when importing forms, with a choice when a synced field’s settings differ on the destination. (<a href="https://github.com/verbb/formie/issues/3098">#3098</a>)</li>
<li>Add an <strong>Export…</strong> button to the submissions index. It opens a dialog filled in from your current form, filters and search, where you can adjust the forms, submission types, statuses, dates and columns, and see how many submissions you’ll get, before exporting in any report format. No saved report is needed. (<a href="https://github.com/verbb/formie/issues/3082">#3082</a>)</li>
<li>Add the <a href="https://verbb.io/craft-plugins/formie/docs/v4/get-started/configuration#logsubmissionvalues"><code>logSubmissionValues</code></a> config setting to keep submitted values out of Formie’s log files, while still writing every log entry.</li>
<li>Add an option to leave log files out of support requests.</li>
<li>Add a documentation example for dynamically loaded forms, including shared asset loading and automatic initialisation.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Use a database index for File Upload reference checks, with queued indexing of existing submissions. (<a href="https://github.com/verbb/formie/issues/3069">#3069</a>, <a href="https://github.com/verbb/formie/issues/3096">#3096</a>)</li>
<li>Allow all failed <a href="https://verbb.io/craft-plugins/formie/docs/v4/guides/integrations/integration-dispatch-and-policies#results-and-retries">integration and notification deliveries</a> to be retried using current submission values and settings.</li>
<li>Rename the “View delivery diagnostics” permission to “View queue delivery diagnostics”.</li>
<li>Allow submission exports without Reports access using “Export submissions” under “Access submissions”. Existing report export permissions continue to work. (<a href="https://github.com/verbb/formie/issues/3082">#3082</a>)</li>
<li>Move Mailchimp and Campaign Monitor API error-handling choices to standard dropdowns under <strong>Advanced</strong> on each integration connection. Existing global choices remain fallbacks until the connection saves its own.</li>
<li>Default Mailchimp and Campaign Monitor API rate limits to failed deliveries, while skipping recognised subscriber rejections with a warning. Preserve configured actions and include form, submission and provider details in policy logs. (<a href="https://github.com/verbb/formie/discussions/2172">#2172</a>, <a href="https://github.com/verbb/formie/issues/2276">#2276</a>)</li>
<li>Store reports and schedules in the database instead of project config, allowing <a href="https://verbb.io/craft-plugins/formie/docs/v4/get-started/upgrading-from-v3#reports-and-submission-export">reports to be managed on production</a>. (<a href="https://github.com/verbb/formie/issues/3082">#3082</a>)</li>
<li>Show a warning on reports that point at forms that no longer exist.</li>
<li>Keep encrypted field values out of Formie’s log files, including integration payloads for forms with encrypted fields.</li>
<li>Update the <code>@verbb/formie-*</code> npm packages to use the same version number as the plugin. Version ranges such as <code>^1.0.16</code> need updating once. (<a href="https://github.com/verbb/formie/issues/3081">#3081</a>)</li>
<li>Update the Pardot guide for External Client Apps, OAuth security settings, and separate API and Form Handler delivery.</li>
<li>Clarify terminology throughout the documentation, including synced fields, stencils, saved values and client events.</li>
<li>Simplify control panel labels and help text for integration order, notification timing, test data, field settings and analytics events.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed slow submissions with File Upload fields on sites with large submission histories. (<a href="https://github.com/verbb/formie/issues/3096">#3096</a>)</li>
<li>Fixed <code>useCssLayers</code> being ignored. Front-end CSS, including dynamically loaded field styles, is unlayered by default. Set <code>useCssLayers</code> to <code>true</code> to retain the layered styling used by earlier Formie 4 releases.</li>
<li>Fixed legacy notification tokens in stencils not being upgraded, preventing emails from forms created from those stencils from rendering.</li>
<li>Fixed file pickers in Repeater fields failing to open or opening multiple dialogs when editing submissions.</li>
<li>Fixed queued exports and scheduled reports omitting answer columns when using automatic field selection.</li>
<li>Fixed GoCardless Payment fields not rendering their payment input and redirect instructions.</li>
<li>Fixed submission payment summaries missing for GoCardless, Moneris, Paddle and Square.</li>
<li>Fixed PlaceKit throwing an error when its API key is unset or empty.</li>
<li>Fixed forms using page reloads not showing a link to continue later after saving progress.</li>
<li>Fixed File Upload fields retaining completed attachments after AJAX form resets, and duplicate advanced upload rows after Back navigation. (<a href="https://github.com/verbb/formie/issues/3097">#3097</a>)</li>
<li>Fixed users with permission to import forms being sent to an inaccessible page after a successful import.</li>
<li>Fixed importing a form creating a new form when an existing form had the same handle and no action was selected.</li>
<li>Fixed queued integrations and notifications being discarded after their worker stopped unexpectedly, while preserving the site's queue retry settings.</li>
<li>Fixed upgrades from Formie 2 and 3 failing on PostgreSQL for sites with payments, and sites already upgraded rejecting newer payment statuses, because of an old database constraint.</li>
<li>Fixed upgrades stopping on payments saved with more decimals than their currency has, such as a failed payment of 25.015 USD. The amount is rounded, and the original stays on the payment and in its history.</li>
<li>Fixed notifications from Formie 3 failing or losing values when they used plain tokens such as <code>{email}</code> or <code>{group.field}</code>. These now convert automatically where they match a field on the form, including on sites that have already upgraded. Tokens with filters or Twig still need converting by hand.</li>
<li>Fixed Categories fields losing their All or multiple source selection. The Sources setting is back in the form builder, and fields upgraded from Formie 2 or 3 offer their saved sources again.</li>
<li>Fixed Group and Repeater answers being lost when upgrading from Formie 2 if their child fields held an outdated parent reference.</li>
<li>Fixed per-form permissions from Formie 2 and 3 being removed the next time a user or user group was saved. Forms with existing grants now use <strong>Use Dedicated Permissions</strong>. Grants already removed on an upgraded site need to be granted again.</li>
<li>Fixed Slack, Telegram, Zapier, Web Request, Freshdesk, Gorgias and Zendesk connections saved under their older class names being unavailable after upgrading, and their form integrations not being sent. Web Request URLs saved under the older <code>webhook</code> setting are also kept. A Calendar Event connection saved in Formie 3 also no longer stops every integration on the site from loading.</li>
<li>Fixed Product element integrations saving products without their mapped variant, SKU or price.</li>
<li>Fixed Entry integrations upgraded from Formie 2 losing their field mapping controls and saving entries without mapped field content. Entries already created this way aren't changed, and each repaired integration is logged during the upgrade.</li>
<li>Fixed element integrations failing when a Table field was mapped whole or by column, and Table date and time cells being saved in the wrong timezone.</li>
<li>Fixed Recipients conditions saved in Formie 2 or 3, or chosen in the form builder, not matching the selected option, and stopped sending recipient addresses to the browser in those conditions.</li>
<li>Fixed Address answers from Formie 2 holding only auto-complete text showing as empty, and auto-complete being dropped from Address fields during the upgrade.</li>
<li>Fixed Single-Line Text fields ignoring a <code>type</code> set in their Input Attributes, which showed passwords as plain text on forms set up as the Formie 3 guide described.</li>
<li>Fixed Date dropdown and input fields losing seconds or AM/PM, or gaining an hour, when upgrading from Formie 2, and saving a form resetting the order of upgraded Date sub-fields.</li>
<li>Fixed email notifications failing to render when a multi-select Dropdown inside a Group or Repeater was left blank, or with <code>devMode</code> on for Recipients fields shown as a dropdown.</li>
<li>Fixed Calendar Event integrations failing when a mapped date field was left blank, or when Repeat Until was mapped.</li>
<li>Fixed Email Address fields not enforcing Blocked Domains added or edited in the form builder, including the domains returned through GraphQL.</li>
<li>Fixed forms without a saved layout failing to render.</li>
<li>Fixed control panel pages and form queries failing on PostgreSQL for users with no accessible forms, such as users who can only import forms, and querying forms by an unknown form status.</li>
<li>Fixed users with Create Submissions or Save Submissions permissions, but no form access, being unable to open the new submission screen, save submissions or use the Google address current-location lookup in the control panel.</li>
<li>Fixed Repeater field criteria not matching saved submissions on PostgreSQL.</li>
<li>Fixed the Address field’s auto-complete option missing on PostgreSQL, and for providers enabled through an environment variable.</li>
<li>Fixed uppercase submission UIDs failing to edit a submission on PostgreSQL.</li>
<li>Fixed Agile integration settings failing to load when only tasks are mapped.</li>
<li>Fixed Akismet, CleanTalk and OopSpam throwing an error instead of showing a validation message when saved without an API key.</li>
<li>Fixed the Stripe SDK requirement allowing versions without <code>StripeClient</code>. The minimum is now 7.33.</li>
<li>Fixed TypeScript errors when using the <code>@verbb/formie-*</code> npm packages in projects with <code>moduleResolution</code> set to NodeNext.</li>
<li>Fixed the new report dialog waiting for forms and report data before appearing.</li>
<li>Fixed reopening the new report dialog during its close animation, and kept report loading in a consistent layout with a visible toolbar placeholder and a compact, right-aligned form-picker spinner.</li>
<li>Fixed report charts briefly appearing blank without a loading spinner before drawing.</li>
<li>Fixed GraphQL <code>save_&lt;form&gt;_Submission</code> and <code>saveSubmission</code> mutations not behaving like normal form submissions. They now send email notifications, trigger integrations, run spam and captcha checks, apply field conditions and default values, record request details and follow the form's login, schedule and submission limit rules. Editing through a private token only changes the fields it sends. With a private token, a missing captcha token returns an error, including on multi-page forms. Public GraphQL schemas can create submissions again, with rate limits, but editing by ID and saving drafts need a private schema, and payment forms need <code>submitFormieClientForm</code>. (<a href="https://github.com/verbb/formie/issues/3090">#3090</a>)</li>
<li>Fixed the request IP address being saved in submission metadata and sent to integrations when <strong>Collect IP Address</strong> is off.</li>
<li>Fixed File Upload fields rejecting extensions allowed by Craft's <code>allowedFileExtensions</code>, <code>extraAllowedFileExtensions</code> and <code>extraFileKinds</code> settings. Per-field file type restrictions still apply, and the field settings show the permitted extensions in a neutral notice with clearer configuration guidance. (<a href="https://github.com/verbb/formie/issues/3092">#3092</a>)</li>
<li>Fixed cached multi-page forms becoming stuck on the wrong page when restoring an in-progress submission.</li>
<li>Fixed fields with Disabled visibility losing their values when saving submissions in the control panel. (<a href="https://github.com/verbb/formie/issues/3093">#3093</a>)</li>
<li>Fixed the support form clearing entered values when a required field is missing.</li>
<li>Fixed Repeater validation errors appearing on the wrong row after returning to a previous page, and searchable dropdown selections being cleared during AJAX page navigation. (<a href="https://github.com/verbb/formie/issues/3088">#3088</a>)</li>
<li>Fixed a validation error from the server on a field inside a Group or Repeater marking the other fields around it as invalid on forms that reload the page.</li>
<li>Fixed focus not moving to Checkboxes, Agree, searchable Dropdown and Rich Text fields after a validation error.</li>
<li>Fixed the File Upload field’s asset picker on the control panel submission screen listing nothing, and chosen assets being rejected when saving. The field also has a direct Upload button there now. Chosen assets move into the field’s upload folder, as with an Assets field with a restricted location, and are deleted with the submission if the form deletes files.</li>
<li>Fixed an error and an incomplete submission when a File Upload field’s upload subpath used an answer left blank or that couldn’t be a folder. These files now go to the root of the field’s volume, and move once the answer is filled in.</li>
<li>Fixed notifications saved in the same second sending and listing in an unpredictable order on PostgreSQL.</li>
<li>Fixed files staying behind on forms set to delete file uploads when a trashed submission was later purged by garbage collection. Submissions already in the trash are covered too.</li>
<li>Fixed Address answers holding only auto-complete text showing as empty in email notifications when the field no longer has an Auto-Complete sub-field.</li>
<li>Fixed the Redirect Entry picker appearing empty when Craft’s “All entries” source is disabled. (<a href="https://github.com/verbb/formie/issues/3089">#3089</a>)</li>
<li>Fixed forms failing to load when a field or page has a condition rule that was added but never filled in, which can be present on forms upgraded from Formie 3.</li>
<li>Fixed forms showing “A required form feature could not start” and being unable to submit when a field had conditions enabled but no rules.</li>
<li>Fixed forms showing “A required form feature could not start” and being unable to submit when a field’s browser feature had nothing to attach to, such as Date fields stored as a date picker while using inputs or dropdowns, or conditions inside a Repeater with no rows yet.</li>
<li>Fixed visitors seeing a server error after their submission was saved, and later notifications being skipped, when a notification failed with <code>useQueueForNotifications</code> off. The failure is now logged and left in delivery diagnostics.</li>
<li>Fixed upgrading from Formie 2 failing on forms with encrypted fields when <code>FORMIE_ENCRYPTION_KEY</code> isn’t set, or with File Upload fields whose volume has been deleted.</li>
<li>Fixed conditions from Formie 3 showing an empty Field column in the form builder, on fields, pages, integrations and form rules. Existing conditions now use the same field references as the builder when you upgrade, except on fields synced between forms, which still work as before. (<a href="https://github.com/verbb/formie/issues/3087">#3087</a>)</li>
<li>Fixed <strong>Match Field</strong> validation no longer being enforced on fields imported by the Freeform migrations, and the setting showing a raw token instead of the field’s name in the form builder. (<a href="https://github.com/verbb/formie/issues/3087">#3087</a>)</li>
<li>Fixed submissions throwing an error when <strong>Match Field</strong> points to a field inside a Group or Repeater. Fields in the same Repeater now compare within their row, and other fields compare with the first row. Browser validation still applies to Groups, while Repeater targets are checked when the form is submitted. (<a href="https://github.com/verbb/formie/issues/3087">#3087</a>)</li>
<li>Fixed exports queued in the background failing for users with <strong>Manage reports</strong> but not <strong>Export submissions</strong>.</li>
<li>Fixed Date fields returning an empty object from GraphQL submission queries, and Date Range fields not exposing their <code>start</code> and <code>end</code> values. (<a href="https://github.com/verbb/formie/issues/3079">#3079</a>)</li>
<li>Fixed Group fields failing when queried through GraphQL, and restored direct selection of their subfields. (<a href="https://github.com/verbb/formie/issues/3080">#3080</a>)</li>
<li>Fixed GraphQL mutations written with the documented input type names being rejected for Name, Address, Group, Repeater, Table and Payment fields. These types, and their Group, Repeater and Table output types, now use names based on form and field handles instead of field IDs, so they’re the same in every environment. Any query that hard-coded an ID-based type name needs updating. (<a href="https://github.com/verbb/formie/issues/3080">#3080</a>)</li>
<li>Fixed <code>inputTypeName</code> returning <code>[]</code> for Table fields. (<a href="https://github.com/verbb/formie/issues/3080">#3080</a>)</li>
<li>Fixed AJAX submissions still showing the form error message when Error Message Position is set to None.</li>
<li>Fixed <code>fieldNamespace</code> being ignored when rendering pages or complete forms, and corrected custom form examples and captcha guidance.</li>
<li>Fixed the Address Country and Name Prefix sub-fields outputting no value in email notification field summaries. (<a href="https://github.com/verbb/formie/issues/3085">#3085</a>)</li>
<li>Fixed stencil email previews and test emails failing with “Form not found”, using fields from an unrelated form, or rendering the Form Name variable blank. (<a href="https://github.com/verbb/formie/issues/3091">#3091</a>)</li>
<li>Fixed saving and copying stencils containing synced fields.</li>
<li>Fixed integration mappings from Formie 3 that use Form Name, Submission Date, Site Name or Site Handle failing to send, and Name, Address and Group sub-field mappings showing as “Don’t Include” and being cleared when saving the form. Existing mappings update automatically. (<a href="https://github.com/verbb/formie/issues/3086">#3086</a>)</li>
<li>Fixed failed notification and integration alert emails failing to send when Craft’s <code>enableTwigSandbox</code> setting is on. Customised messages using the default <code>json_encode</code> and <code>integration.name</code> output are updated automatically.</li>
<li>Fixed the Trello, Google Sheets and Calendar Event integrations throwing an error when loading their form settings.</li>
<li>Fixed the Product element integration failing to save when “Overwrite Values” is off.</li>
<li>Fixed GoCardless webhooks being processed and then reported as failed.</li>
<li>Fixed Front integration messages being reported as failed after they were delivered.</li>
<li>Fixed Freshdesk deliveries failing their queue job after handling an existing contact, even though the contact update and ticket were delivered.</li>
<li>Fixed Freshdesk reporting a failure instead of a skipped delivery when an event cancelled sending its contact.</li>
<li>Fixed HubSpot deliveries being reported as successful after a file upload failed, allowing the form to be sent without its file.</li>
<li>Fixed integration errors configured to be skipped still failing the enclosing queue job or triggering failure alerts.</li>
<li>Fixed the Diagnostics button failing to open on control panels served over plain HTTP.</li>
<li>Fixed Capsule throwing an error when fetching opportunity fields.</li>
<li>Fixed the Sent Notifications index showing “-” for the Notification column.</li>
<li>Fixed pruning of sent notifications using the wrong cutoff time for sites not set to UTC.</li>
<li>Fixed a server error when saving a form’s template fields failed validation on a non-JSON request.</li>
<li>Fixed <code>FieldLayout::getForm()</code> throwing an error.</li>
<li>Fixed slow submission exports and indexes for forms with rich text Multi-Line Text fields, or with <code>plainTextHtmlSanitizationMode</code> set to <code>sanitize</code>, caused by rebuilding the HTML purifier configuration for every value. (<a href="https://github.com/verbb/formie/issues/3083">#3083</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>IntegrationResult::rejected()</code>, <code>IntegrationResult::unknown()</code>, <code>IntegrationResult::requiresReconciliation()</code> and <code>IntegrationResult::$retryable</code>. Rejected and unknown results are now failures, and every failure can be retried.</li>
<li>Deprecate <code>DeliveryAttempts::reconcile()</code>, <code>DeliveryAttempts::hasReconciliation()</code>, <code>DeliveryAttempts::executePrepared()</code>, <code>DeliveryAttempts::EVENT_RECONCILIATION</code>, <code>DeliveryAttempts::operationFingerprint()</code>, <code>DeliveryAttempts::operationFingerprints()</code>, <code>IntegrationRunner::dispatchFingerprint()</code>, <code>IntegrationRunner::dispatchFingerprints()</code>, <code>SubmissionDispatches::resume()</code>, <code>IntegrationTriggers::forceIntegration()</code>, the <code>DispatchSubmission</code> job, <code>Integration::supportsDeliveryWriteTracking()</code> and <code>IntegrationStatus::isFinalized()</code>.</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove the “Confirm delivery outcomes” and “Force integration execution” permissions, and the confirm and force-run controls in Delivery Diagnostics. Diagnostics and Export remain for troubleshooting.</li>
<li>Remove the <code>formie/deliveries</code> and <code>formie/deliveries/recover</code> console commands. <code>formie/cron/run</code> no longer re-sends submission deliveries interrupted by a crash, and its <code>deliveries</code> group now only recovers payment webhooks. If a crash interrupts a delivery, run the integration from the submission’s edit page.</li>
</ul>
";s:4:"date";s:19:"2026-11-05T00:00:00";}i:1;a:4:{s:7:"version";s:5:"4.0.6";s:8:"critical";b:0;s:5:"notes";s:6144:"<h3>Added</h3>
<ul>
<li>Add “All Form Fields”, “All Non Empty Fields”, “All Visible Fields” and formatted Group and Repeater summaries to integration field mappings for text fields. Freshdesk ticket descriptions receive them as HTML. (<a href="https://github.com/verbb/formie/issues/3078">#3078</a>)</li>
<li>Add <code>IntegrationField::$acceptsHtml</code> for integration fields that render HTML content. (<a href="https://github.com/verbb/formie/issues/3078">#3078</a>)</li>
<li>Add instructions explaining the Redirect Source options in form behaviour settings.</li>
<li>Add field warning for URL settings in the control panel, when the URL starts with a reference.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Allow reference-supplied external redirect URLs, leaving the choice of destination source to the editor.</li>
<li>Update the minimum Tiptap requirement to <code>1.0.6</code>.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed an information disclosure vulnerability. (<a href="https://github.com/verbb/formie/pull/3074">#3074</a>)</li>
<li>Fixed a moderate-severity cross-site scripting vulnerability. (GHSA-544h-97wp-pvhx)</li>
<li>Fix rich-text Multi-Line Text answers displaying as HTML source when referenced in email notifications.</li>
<li>Fix rich-text editor registration running more than once when Craft’s <code>buildId</code> setting is configured.</li>
<li>Fix garbage collection failing when pruning Formie submissions, sent notifications or uploaded assets. (<a href="https://github.com/verbb/formie/issues/3075">#3075</a>)</li>
<li>Fix form group permissions not applying to email notification Advanced and Templates tabs, the New Submission form list, the Recent Form Submissions widget, and sent notification sources, actions and resending.</li>
<li>Fix the cursor jumping to the end when typing around variable tags.</li>
<li>Fix browser requests failing when Craft uses a custom action trigger, including token refresh after AJAX submissions. (<a href="https://github.com/verbb/formie/issues/3068">#3068</a>)</li>
<li>Fix file upload reference checks causing MySQL sort-memory errors for large submissions. (<a href="https://github.com/verbb/formie/issues/3069">#3069</a>)</li>
<li>Fix upload manager file order and move button states becoming inconsistent after reordering files. (<a href="https://github.com/verbb/formie/issues/3070">#3070</a>)</li>
<li>Fix searchable dropdown placeholders not appearing until a form field is focused. (<a href="https://github.com/verbb/formie/issues/3072">#3072</a>)</li>
<li>Fix client-rendered forms failing to load when Date fields contain dropdown controls, including AM/PM controls. (<a href="https://github.com/verbb/formie/pull/3073">#3073</a>)</li>
<li>Fix Date pickers displaying calendar labels in English on non-English sites. (<a href="https://github.com/verbb/formie/issues/3076">#3076</a>)</li>
<li>Fix required advanced Date pickers being skipped by client-side validation. (<a href="https://github.com/verbb/formie/issues/3077">#3077</a>)</li>
<li>Fix Date fields showing Required settings that were reset on save. Set Required on the Date's sub-fields instead. (<a href="https://github.com/verbb/formie/issues/3077">#3077</a>)</li>
<li>Fix invisible hCaptcha challenges timing out before they could be completed, requiring a second submit click. (<a href="https://github.com/verbb/formie/issues/3067">#3067</a>)</li>
<li>Fix Agree fields not being selectable in integration field mappings. (<a href="https://github.com/verbb/formie/issues/3066">#3066</a>)</li>
<li>Fix the Opt-In Field setting for integrations not being able to be cleared. (<a href="https://github.com/verbb/formie/issues/3066">#3066</a>)</li>
<li>Fix large HubSpot portals failing to load or refresh integration settings due to the metadata storage limit.</li>
<li>Fix optional field selections, including Match Field and integration field references, not being able to be cleared.</li>
<li>Fix country defaults for Phone, Address Country and Google address autocomplete not being able to be cleared.</li>
<li>Fix Phone country dropdowns selecting the first allowed country when the default is None, and not restoring None when forms reset. (<a href="https://github.com/verbb/formie/issues/3071">#3071</a>)</li>
<li>Fix optional option-source parameters not being able to be cleared, and provider defaults restoring explicitly empty values.</li>
<li>Fix Form Default positions not being retained for Address and Name instructions, and Content, HTML, Recipients, Quiz and Survey labels.</li>
<li>Fix deleted page client events returning on forms upgraded from legacy event settings.</li>
<li>Fix clearing custom required error messages reverting to their previous value. (<a href="https://github.com/verbb/formie/issues/3065">#3065</a>)</li>
<li>Fix populating Entries and other element fields with a single element ID.</li>
<li>Fix forms on path-based sites receiving refreshed submission tokens for the wrong site. (<a href="https://github.com/verbb/formie/issues/3064">#3064</a>)</li>
<li>Fix Microsoft Dynamics 365 requests failing with a provider origin override error. (<a href="https://github.com/verbb/formie/issues/3063">#3063</a>)</li>
<li>Fix theme attributes not being applied to AJAX success and error messages. (<a href="https://github.com/verbb/formie/issues/3061">#3061</a>)</li>
<li>Fix nested alert roles in form error messages that could cause duplicate screen reader announcements. (<a href="https://github.com/verbb/formie/issues/3062">#3062</a>)</li>
<li>Fix AJAX submissions showing the form error message when Error Message Position is set to None.</li>
<li>Fix Opayo re-tokenizing cards and requesting unnecessary merchant sessions after completing a 3D Secure challenge. (<a href="https://github.com/verbb/formie/issues/3048">#3048</a>)</li>
<li>Fix importing Formie 3 forms with a null redirect target. (<a href="https://github.com/verbb/formie/issues/3060">#3060</a>)</li>
<li>Fix variable pickers not showing for redirect URL settings.</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove the <code>completionRedirectAllowedOrigins</code> configuration setting.</li>
</ul>
";s:4:"date";s:19:"2026-11-01T00:00:00";}i:2;a:4:{s:7:"version";s:5:"4.0.5";s:8:"critical";b:0;s:5:"notes";s:5954:"<h3>Added</h3>
<ul>
<li>Add a Maximum Displayed Options setting for searchable dropdowns, defaulting to 100 while searching all options. (<a href="https://github.com/verbb/formie/issues/3059">#3059</a>)</li>
<li>Add configurable Dropdown placeholders across all option sources, enabled for new fields while preserving existing options and defaults. (<a href="https://github.com/verbb/formie/issues/3058">#3058</a>)</li>
<li>Add Form layout, Alphabetical, and Custom field ordering for reports and exports, preserving existing custom orders. (<a href="https://github.com/verbb/formie/issues/3054">#3054</a>)</li>
<li>Add report subcolumn support for parent fields, including Name and Address, with Single Column, Separate Columns, and Both display options for automatic reports. (<a href="https://github.com/verbb/formie/issues/3055">#3055</a>)</li>
<li>Add a dedicated field value projection and event for reports, with readable combined values and independent field formatting. (<a href="https://github.com/verbb/formie/issues/3055">#3055</a>)</li>
<li>Add save-time validation for completion redirect URLs, with guidance for external origins that are not allowed. (<a href="https://github.com/verbb/formie/issues/3038">#3038</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Retain compact condition selectors with Plugin Kit’s <code>xxs</code> size.</li>
<li>Update the minimum Auth requirement to <code>2.0.56</code>.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix render-time theme overrides being ignored for fields on sites with form translations. (<a href="https://github.com/verbb/formie/issues/3057">#3057</a>)</li>
<li>Fix forms with Question CAPTCHA failing to render when strict Twig variables are enabled, and correct the answer input name for submission. (<a href="https://github.com/verbb/formie/issues/3056">#3056</a>)</li>
<li>Fix form imports not reporting missing update permission when the existing form is hidden from the control panel index.</li>
<li>Fix conditional Payment fields initializing widgets more than once, including duplicate Opayo Drop-in sessions and unhandled mount errors. (<a href="https://github.com/verbb/formie/issues/3048">#3048</a>)</li>
<li>Fix dragging inside a nested field’s editor moving its parent Group or Repeater field. (<a href="https://github.com/verbb/formie/issues/3049">#3049</a>)</li>
<li>Fix retired Duplicate, Honeypot, and JavaScript CAPTCHAs appearing as unavailable after upgrading, remove their obsolete form bindings, and preserve third-party CAPTCHA bindings that reuse those handles. (<a href="https://github.com/verbb/formie/issues/3047">#3047</a>)</li>
<li>Fix required dropdowns enhanced with third-party libraries such as Choices.js failing validation when options are selected, and preserve custom required messages. (<a href="https://github.com/verbb/formie/issues/3046">#3046</a>)</li>
<li>Fix new fields failing to save after upgrading to Formie 4 on PostgreSQL. (<a href="https://github.com/verbb/formie/issues/3045">#3045</a>)</li>
<li>Fix submission index sorting ignoring the selected direction when switching between Submission and Date Created. (<a href="https://github.com/verbb/formie/issues/3044">#3044</a>)</li>
<li>Fix report field columns and exports using alphabetical order instead of the form layout when including all fields. (<a href="https://github.com/verbb/formie/issues/3054">#3054</a>)</li>
<li>Fix integration provider options appearing as custom values after upgrading or as “Don’t Include” after selection. (<a href="https://github.com/verbb/formie/issues/3042">#3042</a>)</li>
<li>Fix integrations failing for whole Name and other container field mappings, and migrate legacy Phone sub-field mappings on previously upgraded forms. (<a href="https://github.com/verbb/formie/issues/3052">#3052</a>)</li>
<li>Include the destination field and safe field reference in integration mapping errors, while continuing to fail the integration when a mapping cannot be resolved. (<a href="https://github.com/verbb/formie/issues/3052">#3052</a>)</li>
<li>Fix Freshdesk ticket payloads with and without attachments, including errors resolving field mappings and uploaded files. (<a href="https://github.com/verbb/formie/issues/3051">#3051</a>)</li>
<li>Fix integration failures before sending blocking retries, and allow unresolved provider operations to be confirmed individually in Delivery Diagnostics. (<a href="https://github.com/verbb/formie/issues/3051">#3051</a>)</li>
<li>Fix queued notifications being incorrectly rejected as stale when site translations are applied, and provide clearer rejection messages and directions to delivery diagnostics. (<a href="https://github.com/verbb/formie/issues/3040">#3040</a>)</li>
<li>Fix translated notification content losing formatting and custom TipTap nodes when emails are sent. (<a href="https://github.com/verbb/formie/issues/3040">#3040</a>)</li>
<li>Fix the Condition dropdown showing no options when configuring conditional email notification recipients. (<a href="https://github.com/verbb/formie/issues/3053">#3053</a>)</li>
<li>Fix matching recipient conditions returning no email addresses, and preserve older recipient rules when editing notifications. (<a href="https://github.com/verbb/formie/issues/3053">#3053</a>)</li>
<li>Fix email field summaries including opted-out fields inside Group and Repeater fields. (<a href="https://github.com/verbb/formie/issues/3043">#3043</a>)</li>
<li>Fix text-based fields inside Group fields not displaying their default values. (<a href="https://github.com/verbb/formie/issues/3039">#3039</a>)</li>
<li>Fix custom validation messages not saving or being used for fields inside Group and Repeater fields. (<a href="https://github.com/verbb/formie/issues/3041">#3041</a>)</li>
<li>Fix Checkboxes fields not enforcing option limits or using custom option limit error messages in the browser. (<a href="https://github.com/verbb/formie/issues/3037">#3037</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-28T00:00:00";}i:3;a:4:{s:7:"version";s:5:"4.0.4";s:8:"critical";b:0;s:5:"notes";s:4033:"<h3>Added</h3>
<ul>
<li>Add <code>allowedPrivateIntegrationHosts</code> configuration for integrations connecting to trusted private networks. (<a href="https://github.com/verbb/formie/issues/3034">#3034</a>)</li>
<li>Add a Kebab Case text transform for reference tokens, including File Upload subpaths and filenames.</li>
<li>Add temporary Salesforce diagnostics for API requests, field filtering, cached settings and editor mappings.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Updated Markdown-it to 14.3.3 and the frontend build toolchain to Vite 8.3.4.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix plugin initialization failing on Craft versions before 5.10, preserving user submission deletion, reassignment and restoration. (<a href="https://github.com/verbb/formie/issues/3035">#3035</a>)</li>
<li>Fix integration metadata being altered or discarded by diagnostic redaction, including refreshed Salesforce fields disappearing.</li>
<li>Fix ordinary integration settings being mistaken for credentials in diagnostic logs.</li>
<li>Fixed variable tags not showing their configured transform name or default-value indicator.</li>
<li>Fix page-reload submissions stalling when the submit delay is zero.</li>
<li>Fix mounted form lifecycle events omitting the form instance, including submission, page navigation, token refresh and teardown hooks. (<a href="https://github.com/verbb/formie/issues/3032">#3032</a>)</li>
<li>Fix form builder tab navigation adding browser history entries, so Back returns to the previous page. (<a href="https://github.com/verbb/formie/issues/3029">#3029</a>)</li>
<li>Fix form Appearance position dropdowns appearing empty when registration hooks filter or key their options. (<a href="https://github.com/verbb/formie/issues/3017">#3017</a>)</li>
<li>Fix File Upload subfolder and filename variable pickers including the field being edited, including unnamed fields.</li>
<li>Fix duplicate Upload Location validation errors and an unusably narrow subfolder editor. Only show the subfolder editor after selecting a location, with simpler instructions.</li>
<li>Fix built-in variables hiding available transforms in the variable picker.</li>
<li>Clarify upgrade guidance for settings that resolve references instead of Twig, including upload paths and filenames, supported transforms, and settings that retain Twig support.</li>
<li>Fix Date sub-field labels and settings reverting after saving the form builder. (<a href="https://github.com/verbb/formie/issues/3026">#3026</a>)</li>
<li>Fix Address country defaults and builder previews when option values use full country names. (<a href="https://github.com/verbb/formie/issues/3036">#3036</a>)</li>
<li>Fix nested fields remaining hidden when a conditional Group or Repeater is revealed after continuing a multi-page form. (<a href="https://github.com/verbb/formie/issues/3031">#3031</a>)</li>
<li>Fix Agree fields reverting their Label Position from Form Default to Hidden after saving. (<a href="https://github.com/verbb/formie/issues/3030">#3030</a>)</li>
<li>Fix field variables in notification subjects appearing literally in PDF attachment filenames. (<a href="https://github.com/verbb/formie/issues/3025">#3025</a>)</li>
<li>Fix Hidden fields missing from notification email address variable pickers.</li>
<li>Fix forms created on secondary sites using the primary site as their source and failing when saving their first field. (<a href="https://github.com/verbb/formie/issues/3024">#3024</a>)</li>
<li>Fix editing Name field labels on secondary sites failing when Use Multiple Name Fields is disabled. (<a href="https://github.com/verbb/formie/issues/3024">#3024</a>)</li>
<li>Fix custom hidden field defaults leaving reference tokens unresolved when rendering a new form. (<a href="https://github.com/verbb/formie/issues/3027">#3027</a>)</li>
<li>Fix dropdown optgroup labels being replaced with <code>true</code> and their optgroup setting being lost in the form builder. (<a href="https://github.com/verbb/formie/issues/3028">#3028</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-22T00:00:00";}i:4;a:4:{s:7:"version";s:5:"4.0.3";s:8:"critical";b:0;s:5:"notes";s:3734:"<h3>Added</h3>
<ul>
<li>Add a dedicated Spam Protection area with grouped navigation in Craft’s standard sidebar, matching page and panel headings, standard header Save buttons, separate provider and spam-rule permissions, and independent provider saves.</li>
<li>Add sanitised installation, permissions and integration diagnostics to support bundles, with guidance to send requests from the affected environment.</li>
<li>Add Salesforce token-request logging with the endpoint and grant type, excluding OAuth credentials.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Clarify user permission labels, order spam rules before CAPTCHA and spam filtering services, remove permission info tooltips, align permission nesting with Formie’s navigation while retaining a single Select All control, limit settings permissions to production-accessible tools, and migrate legacy grants to preserve production access.</li>
<li>Store CAPTCHA, spam filtering and spam-rule settings locally on each installation. Existing values are preserved during upgrade; these settings are no longer deployed through project config.</li>
<li>Clarify project and instance settings for integrations, stencils, spam protection and captcha providers, including deployment and editing permissions.</li>
<li>Remove the informational Widget Mode field from Cloudflare Turnstile settings.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix “Scroll To Top” having no effect after successful AJAX submissions. (<a href="https://github.com/verbb/formie/issues/3023">#3023</a>)</li>
<li>Fix production settings navigation hiding permitted read-only pages and scheduled reports exposing unavailable editing controls.</li>
<li>Fix form import, report export and scheduled report permissions depending on unrelated management permissions.</li>
<li>Fix upgrading from Formie 2 failing on Date fields before form statuses have been migrated.</li>
<li>Fix upgrading from Formie 2 failing on Payment fields before integration scopes have been migrated.</li>
<li>Fix later migrations failing after an interrupted field-table rename, and report when missing field definitions require restoring a backup.</li>
<li>Fix an error when upgrading from Formie 3 with an empty or invalid default date. (<a href="https://github.com/verbb/formie/issues/3022">#3022</a>)</li>
<li>Fix the Settings page redirecting repeatedly when admin changes are disabled.</li>
<li>Fix legacy Honeypot settings preventing forms from being created or saved, including from stencils.</li>
<li>Fix project config sync overwriting or removing instance-level integrations, stencils and spam protection settings.</li>
<li>Fix notification and submission properties rendering empty or being blocked by the Twig sandbox in PDF attachment filenames. (<a href="https://github.com/verbb/formie/issues/3018">#3018</a>)</li>
<li>Fix the Defaults settings page failing to load when custom field positions use non-sequential keys. (<a href="https://github.com/verbb/formie/issues/3017">#3017</a>)</li>
<li>Fix Date fields using Calendar (Simple) rendering text inputs instead of native date and time pickers. (<a href="https://github.com/verbb/formie/issues/3014">#3014</a>)</li>
<li>Fix reCAPTCHA v3 failing when its script is already loaded without the configured site key.</li>
<li>Fix reCAPTCHA v3 inline badges rendering outside the form. (<a href="https://github.com/verbb/formie/issues/3016">#3016</a>)</li>
<li>Fix slow submission and sent notification indexes in the control panel on sites with many forms.</li>
<li>Fix encryption warning icons appearing on a separate line from their text.</li>
<li>Fix custom rendering documentation using removed methods and omitting validation markup and spam-protection inputs.</li>
</ul>
";s:4:"date";s:19:"2026-10-20T00:00:00";}i:5;a:4:{s:7:"version";s:5:"4.0.2";s:8:"critical";b:0;s:5:"notes";s:4668:"<h3>Changed</h3>
<ul>
<li>Update the minimum Auth requirement to <code>2.0.55</code>.</li>
<li>Update the minimum Tiptap requirement to <code>1.0.5</code>.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix JSON report exports failing to download in the control panel.</li>
<li>Fix reports ignoring the option to display choice labels instead of values.</li>
<li>Fix disabled or missing payment providers allowing payment forms to complete.</li>
<li>Fix card details and temporary payment credentials being included in saved submissions and integration payloads.</li>
<li>Fix Bpoint payment fields not rendering their card inputs.</li>
<li>Fix Eway and Bpoint payment summaries missing from the submission editor.</li>
<li>Fix summary fields remaining blank after AJAX page navigation.</li>
<li>Fix summary fields repeatedly retrying failed requests.</li>
<li>Fix multi-row Likert answers not saving when editing submissions in the control panel.</li>
<li>Fix rank selectors missing labels in the submission editor.</li>
<li>Fix passwords containing only <code>0</code> not being stored correctly.</li>
<li>Fix cleared number fields restoring their default value when submissions are saved or loaded.</li>
<li>Fix hidden query prefills replacing submitted values after native form validation errors.</li>
<li>Fix editing submissions in the control panel replacing captured hidden values with the current administrator, date or IP address.</li>
<li>Fix text counters and phone countries not returning to their initial values when forms reset.</li>
<li>Fix rich-text validation errors failing to focus and describe the editable control.</li>
<li>Fix text, name, dropdown, email, phone, number and hidden field labels not identifying their inputs in the submission editor.</li>
<li>Fix text minimum limits using the maximum limit's unit in the submission editor.</li>
<li>Fix static table fields allowing rows to be added or removed in the submission editor.</li>
<li>Fix custom radio answers missing from the submission editor.</li>
<li>Fix checkbox toggles sharing option labels and being included in submission values and validation.</li>
<li>Fix required table fields incorrectly requiring every cell to have a value.</li>
<li>Fix Pardot form handlers rejecting submissions with existing single-select mappings such as <code>country.value</code>, while retaining plain field names and separate multi-select values.</li>
<li>Fix calculations using another calculation with a number prefix or suffix returning incorrect results.</li>
<li>Fix spam submissions configured to show success failing to display completion messages or redirect.</li>
<li>Fix fresh forms retaining an earlier submission’s spam-protection timer.</li>
<li>Fix form schedules accepting an end date before their start date.</li>
<li>Fix save-and-resume links losing the form page after saving a resumed submission.</li>
<li>Fix forms freezing when live validation and disabling the submit button until valid are both enabled.</li>
<li>Fix file upload names failing to refresh after navigating between form pages.</li>
<li>Fix duplicate validation errors for disallowed file uploads.</li>
<li>Fix users with create-only submission permissions being unable to save new submissions in the control panel.</li>
<li>Fix Salesforce Client Credentials connections using generic login endpoints instead of their saved instance domain, and clarify the My Domain requirement.</li>
<li>Fix reCAPTCHA initialization when another reCAPTCHA SDK is already present on the page.</li>
<li>Fix AWeber OAuth provider resolution on case-sensitive filesystems.</li>
<li>Fix missing class references affecting CAPTCHA language detection, integrations, GraphQL, element conditions, submission editing, and plugin migrations. (<a href="https://github.com/verbb/formie/pull/3012">#3012</a>)</li>
<li>Fix Events integration date mappings failing and preserve mapped timezones.</li>
<li>Fix oversized payment webhooks failing instead of returning HTTP 413, and stencil permission failures returning the wrong error.</li>
<li>Fix unnecessary predefined option and submission status deprecation errors with the debug toolbar enabled.</li>
<li>Fix IP submission throttling using an incorrect time window on sites with a non-UTC timezone. (<a href="https://github.com/verbb/formie/issues/3013">#3013</a>)</li>
<li>Fix SuiteCRM Contact fields not loading for field mapping with the V8 API. (<a href="https://github.com/verbb/formie/issues/3010">#3010</a>)</li>
<li>Fix SuiteCRM Contact mappings being omitted from record payloads after a full integration refresh. (<a href="https://github.com/verbb/formie/issues/3011">#3011</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-17T00:00:00";}i:6;a:4:{s:7:"version";s:5:"4.0.1";s:8:"critical";b:0;s:5:"notes";s:2189:"<h3>Added</h3>
<ul>
<li>Add the <code>formie:unload-warning:collect-exclusions</code> browser event for integrations to exclude automatically updated transport fields from unsaved-changes checks. (<a href="https://github.com/verbb/formie/issues/3008">#3008</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update the minimum Auth requirement to <code>2.0.53</code>.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix saving upgraded Date fields resetting their child-field identities and settings.</li>
<li>Fix Date year dropdowns losing their available years and rejecting valid submissions after upgrading.</li>
<li>Fix Date migrations overriding explicitly configured future year ranges.</li>
<li>Fix empty legacy Phone values displaying serialized country metadata after upgrading to Formie 4.</li>
<li>Fix upgrades clearing integration connection state and cached field metadata required by existing mappings.</li>
<li>Fix integration lists rendering as an empty pane instead of configured integrations or the empty-state message.</li>
<li>Fix integration type icons appearing oversized or stretched in integration lists.</li>
<li>Fix Zendesk tickets being rejected when the mapped requester name is blank.</li>
<li>Fix submission status color migrations failing when legacy status event handlers are registered.</li>
<li>Fix an error when upgrading multi-site installs from Formie 3 to Formie 4. (<a href="https://github.com/verbb/formie/issues/3007">#3007</a>)</li>
<li>Fix unnecessary <code>EVENT_MODIFY_HTML_TAG</code> deprecation warnings when rendering forms with the debug toolbar enabled. (<a href="https://github.com/verbb/formie/issues/3009">#3009</a>)</li>
<li>Fix CAPTCHA token updates triggering an unsaved-changes warning on untouched forms. (<a href="https://github.com/verbb/formie/issues/3008">#3008</a>)</li>
<li>Fix initial conditional field visibility triggering an unsaved-changes warning after native submissions.</li>
<li>Fix edits made immediately after a form loads being treated as saved.</li>
<li>Fix CAPTCHA widgets and callbacks remaining active after failed setup or removal.</li>
<li>Fix CAPTCHA widgets with a numeric zero handle failing to validate or reset.</li>
</ul>
";s:4:"date";s:19:"2026-10-16T00:00:00";}i:7;a:4:{s:7:"version";s:5:"4.0.0";s:8:"critical";b:0;s:5:"notes";s:61760:"<blockquote class="note warning"><p>Before upgrading to Formie 4, review the <a href="https://verbb.io/craft-plugins/formie/docs/v4/get-started/upgrading-from-v3">Upgrading from v3</a> guide for breaking changes and required migration steps.</p>
</blockquote>
<h3>Added</h3>
<ul>
<li>Add a Formie 3 to Formie 4 migration path for existing Craft 5 projects.</li>
<li>Add direct Formie 2 to Formie 4 migration support, allowing Craft 4 projects to move to Craft 5 without upgrading through Formie 3 first.</li>
<li>Add Formie 4 Compatibility Mode, enabled by default, to bridge selected Formie 3 class aliases, event owners, custom field schema methods, field config keys, theme config keys, and legacy front-end event listeners during upgrades.</li>
<li>Add first-party framework-agnostic, browser, React, Vue, and Web Components packages for server-rendered and client-rendered forms, with REST and GraphQL transports.</li>
<li>Add headless GraphQL payment support: structured Payment field input types, payment follow-up fields on <code>submitFormieClientForm</code>, and BYO provider documentation. (<a href="https://github.com/verbb/formie/issues/1375">#1375</a>)</li>
<li>Add GraphQL <code>Json</code> siblings for stored rich-text content alongside existing <code>Html</code> fields (<a href="https://github.com/verbb/formie/issues/865">#865</a>): <code>submitActionMessageJson</code>, <code>errorMessageJson</code>, <code>instructionsJson</code>, <code>descriptionJson</code>, and <code>contentJson</code>.</li>
<li>Add generic <code>saveSubmission</code> GraphQL mutation for handle-based submission saves (<a href="https://github.com/verbb/formie/issues/1007">#1007</a>).</li>
<li>Add developer extension APIs for schema-driven integration and notification settings, submission workflow stages and tasks, field value projections, slot tags, client modules, and programmatic form and submission factories.</li>
<li>Add <strong>Form Statuses</strong> to label form lifecycle states in the control panel (active, draft, archived), with form builder assignment, index status menu filtering, bulk actions, and project config support. Rename existing submission workflow labels to <strong>Submission Statuses</strong>, with backward-compatible class aliases. (<a href="https://github.com/verbb/formie/issues/1471">#1471</a>)</li>
<li>Dispatch integrations on control panel submission saves when the re-run policy includes <strong>Control panel save</strong>, including bulk status changes and other direct element saves. CP submission edit saves continue to use the submission workflow without double-triggering. (<a href="https://github.com/verbb/formie/discussions/2253">Discussion #2253</a>)</li>
<li>Add a staged submission workflow service (<code>SubmissionWorkflow</code>) with <code>preflight</code>, <code>validate</code>, <code>screen</code>, <code>persist</code>, <code>dispatch</code>, and <code>finalize</code> stages.</li>
<li>Add database-backed temporary submission state, incomplete submission state, saved drafts, and resume-token handling.</li>
<li>Add multi-site support with automatic site availability via Form Group site policy, per-site content translation via sparse site overrides, portable stencil translations, and per-site required-field overrides. (<a href="https://github.com/verbb/formie/issues/2308">#2308</a>, <a href="https://github.com/verbb/formie/issues/84">#84</a>, <a href="https://github.com/verbb/formie/issues/2724">#2724</a>, <a href="https://github.com/verbb/formie/issues/2968">#2968</a>, <a href="https://github.com/verbb/formie/issues/2982">#2982</a>)</li>
<li>Add a dedicated optional field-content encryption key, an Encryption settings page, key generation and status commands, resumable re-encryption, previous-key recovery, and read-only handling for unavailable encrypted values.</li>
<li>Add <code>siteHandle</code> request parameter support for headless form load and submit endpoints (<a href="https://github.com/verbb/formie/issues/2286">#2286</a>).</li>
<li>Add <code>Cleanup</code> service, <code>./craft formie/gc/run</code>, and <code>./craft formie/cron/run</code> console commands for scheduled cleanup and retention. <code>formie/cron/run</code> also runs due scheduled reports, with <code>--only</code>, <code>--skip-gc</code>, and <code>--skip-reports</code> for finer scheduling control.</li>
<li>Add <strong>Reports</strong> control panel section for saved analytical views over submissions: filters, summary counts, charts, column configuration, and on-demand export (CSV, Excel, JSON, XML, text) with configurable filename tokens. (<a href="https://github.com/verbb/formie/issues/647">#647</a>)</li>
<li>Add <strong>Scheduled Reports</strong> to email a summary and export attachment from a saved report on daily or weekly schedules, with configurable file type, optional email template, recipients, and user group delivery. (<a href="https://github.com/verbb/formie/issues/692">#692</a>, <a href="https://github.com/verbb/formie/issues/2184">#2184</a>)</li>
<li>Add <strong>Report Async Export Row Threshold</strong> setting (<strong>Settings → Submissions</strong>) to queue large report exports in the background (default 1000 rows). (<a href="https://github.com/verbb/formie/issues/2259">#2259</a>)</li>
<li>Add <strong>Quiz</strong> field to forms for scored questionnaires (<a href="https://github.com/verbb/formie/issues/605">#605</a>). Each question supports radio buttons, checkboxes, or a dropdown; mark correct answers on static options, enable optional <strong>Weighted score</strong> for per-option points, and add <strong>Answer explanation</strong> rich text for incorrect responses. Form <strong>Behaviour → Quiz Scoring</strong> settings control pass percentage, retake restrictions (by logged-in user or IP address), and whether Ajax/client submit responses include a <code>quizResult</code> payload after a successful final-page submit. Scores persist in <code>formie_submission_quiz_results</code> for complete, non-spam submissions.</li>
<li>Add <strong>Survey</strong> field to forms with selectable presentation types: radio buttons, checkboxes, dropdown, <strong>Likert</strong> scale (<a href="https://github.com/verbb/formie/issues/798">#798</a>), <strong>Rating</strong> star scale (<a href="https://github.com/verbb/formie/issues/2282">#2282</a>), and <strong>Rank</strong> drag-and-drop ordering (<a href="https://github.com/verbb/formie/issues/605">#605</a>). Likert supports single- and multi-row layouts, optional <strong>Weighted score</strong> on static columns, and built-in predefined scale defaults. Rank fields preserve submitted order on validation re-render.</li>
<li>Add a <strong>Results</strong> tab to the form builder when a form includes Quiz or Survey fields (<a href="https://github.com/verbb/formie/issues/605">#605</a>). View per-question response counts and option breakdowns, rank-weighted preference charts, Likert scoring averages when weighted scoring is enabled, and a quiz summary (attempts, average score, pass rate, pass threshold) for scored quizzes.</li>
<li>Add <strong>Checkout Mode</strong> setting to the Opayo payment integration, with <strong>Own Form</strong> (default) and <strong>Drop-in Checkout</strong> options. Drop-in Checkout renders card fields inside an Opayo-hosted iframe via <code>sagepayCheckout</code>, which can reduce PCI scope compared to own-form tokenisation, while reusing the existing server-side session key, transaction, and 3DS callback flow.</li>
<li>Add registered <strong>Custom Provider</strong> option sources for Dropdown, Radio, Checkboxes, and Recipients fields. Modules can register lightweight <code>OptionSourceProviderInterface</code> classes via <code>OptionSources::EVENT_REGISTER_OPTION_SOURCE_PROVIDERS</code> for local Craft data without building a full integration. See <a href="https://verbb.io/craft-plugins/formie/docs/v4/developers/custom-option-source-providers">Custom option source providers</a>. (<a href="https://github.com/verbb/formie/issues/1421">#1421</a>)</li>
<li>Add dynamic Brevo list assignment via field mapping. Map a form field to the Brevo <strong>List</strong> integration field to subscribe contacts to a submission-specific list, with fallback to the form’s configured list. (<a href="https://github.com/verbb/formie/issues/2849">#2849</a>)</li>
<li>Add <strong>Merge Multi-Option Fields</strong> setting to the Pipedrive integration. When updating an existing person (matched by email), mapped multi-option field values such as labels can be appended to existing values instead of replacing them.</li>
<li>Add a persisted <code>metadata</code> JSON column on submissions for submit-time request context (referrer, user agent, tracking cookies) and developer-defined custom data via <code>form.setSubmissionMetadata()</code>. Reference tokens such as <code>{metadata:custom.campaignId}</code> and <code>{metadata:request.referrer}</code> are supported in notifications, integrations, and PDFs. (<a href="https://github.com/verbb/formie/issues/1379">#1379</a>)</li>
<li>Add top-level <strong>Integrations</strong> control panel navigation for managing CRM, email marketing, element, and other payload integrations outside <strong>Settings</strong>.</li>
<li>Add <strong>site-scoped</strong> integrations that can be created and edited on production environments (<code>allowAdminChanges = false</code>). Existing integrations remain <strong>project-scoped</strong> and deploy via project config.</li>
<li>Add <strong>When integrations re-run</strong> settings (Integrations → Settings) with per-integration policies: once on submit (default), also when submission is edited, or custom trigger events. Integration conditions still apply. (<a href="https://github.com/verbb/formie/issues/1429">#1429</a>, <a href="https://github.com/verbb/formie/issues/1724">#1724</a>, <a href="https://github.com/verbb/formie/issues/2591">#2591</a>, <a href="https://github.com/verbb/formie/issues/1970">#1970</a>)</li>
<li>Add <strong>Use Submission User as Author</strong> to Entry element integrations, assigning the collected submission user as the entry author when <strong>Collect User</strong> is enabled on the form. (<a href="https://github.com/verbb/formie/issues/1363">#1363</a>)</li>
<li>HubSpot <strong>Map to Form</strong> integrations now resolve custom object <code>objectTypeId</code> values when submitting to HubSpot forms, including portal-specific custom objects (Enterprise). Refresh HubSpot forms after creating custom objects. (<a href="https://github.com/verbb/formie/issues/2649">#2649</a>)</li>
<li>Add <strong>Enable Conditions</strong> to form integration settings, allowing integrations to be triggered only when submission field and status rules match. (<a href="https://github.com/verbb/formie/issues/447">#447</a>)</li>
<li>Add <strong>Integration Dispatch</strong> form settings (Integrations → Settings) to run payload integrations sequentially, choose immediate vs queued execution per integration, control notification timing relative to integrations, and expose dispatch results via <code>{dispatch:handle:property}</code> variables (for example <code>{dispatch:user:url}</code>). Dispatch variables appear in variable pickers when integration dispatch is enabled. (<a href="https://github.com/verbb/formie/issues/2635">#2635</a>, <a href="https://github.com/verbb/formie/issues/1152">#1152</a>, <a href="https://github.com/verbb/formie/issues/2810">#2810</a>)</li>
<li>Add durable integration and notification delivery history with encrypted diagnostics, safe retries, reconciliation tools, and support-download controls.</li>
<li>Add configurable <strong>Integration API Error Handling</strong> for Mailchimp and Campaign Monitor, classifying rate-limited and rejected payloads separately from operational failures. (<a href="https://github.com/verbb/formie/discussions/2172">#2172</a>, <a href="https://github.com/verbb/formie/issues/1990">#1990</a>)</li>
<li>Add <code>Integrations::EVENT_AFTER_TRIGGER_INTEGRATION_FAILED</code> for handling integration failures outside the queue, and <strong>Send Email Alert for Failed Integration</strong> settings mirroring failed notification alerts. (<a href="https://github.com/verbb/formie/discussions/2579">Discussion #2579</a>)</li>
<li>Add integration option sources, allowing integrations to opt in and expose selectable remote option lists to Dropdown, Radio and Checkboxes fields. (<a href="https://github.com/verbb/formie/issues/512">#512</a>)</li>
<li>Add Mailchimp option sources for Interest Categories and Tags, using cached integration form settings and manual refresh actions from the field settings UI. (<a href="https://github.com/verbb/formie/issues/512">#512</a>)</li>
<li>Add CRM integration option sources for HubSpot (forms and CRM properties), Salesforce, Zoho, and Microsoft Dynamics 365 picklists. (<a href="https://github.com/verbb/formie/issues/512">#512</a>)</li>
<li>Add Salesforce Client Credentials authentication with configurable My Domain support. (<a href="https://github.com/verbb/formie/issues/2961">#2961</a>)</li>
<li>Add an event-based Microsoft Dynamics 365 entity registry for custom entities without requiring a custom integration subclass. (<a href="https://github.com/verbb/formie/issues/2995">#2995</a>)</li>
<li>Add repeater sub-field reference support with explicit row scope (<code>first</code>, <code>last</code>, <code>index</code>, <code>all</code>, <code>count</code>, custom row expressions) for variable tokens, notifications, conditions, and integrations. Repeater nested fields now appear once in the variable picker, with row targeting configured in the variable settings popover. (<a href="https://github.com/verbb/formie/issues/1728">#1728</a>, <a href="https://github.com/verbb/formie/issues/1255">#1255</a>, <a href="https://github.com/verbb/formie/issues/2099">#2099</a>, <a href="https://github.com/verbb/formie/issues/1888">#1888</a>, <a href="https://github.com/verbb/formie/issues/2338">#2338</a>)</li>
<li>Add console commands to inspect unresolved payments, reconcile gateway status, record verified outcomes and resume submission processing.</li>
<li>Add Stripe subscription <strong>Payment Limit</strong> field settings to cancel subscriptions automatically after a fixed or dynamic number of payments using Stripe subscription schedules. (<a href="https://github.com/verbb/formie/issues/2123">#2123</a>)</li>
<li>Add Stripe subscription <strong>Setup Fee</strong> field settings to charge a one-time fee on the first subscription invoice using Stripe invoice items. (<a href="https://github.com/verbb/formie/issues/1767">#1767</a>)</li>
<li>Migrate GoCardless payments from deprecated Redirect Flows to Billing Request Flows, including mandate fulfilment, one-off payment creation, and billing request webhooks. (<a href="https://github.com/verbb/formie/issues/2552">#2552</a>)</li>
<li>Add GoCardless recurring subscription support via Direct Debit mandate authorisation and GoCardless subscription creation after billing request fulfilment. (<a href="https://github.com/verbb/formie/issues/2552">#2552</a>)</li>
<li>Add <strong>Display Type</strong> settings to File Upload fields: <strong>File Input (Simple)</strong> keeps the native browser input and uploads files on form submit; <strong>Upload Manager (Advanced)</strong> adds a drag-and-drop zone with async staged uploads, progress, remove, and reorder controls via Formie’s upload endpoints. Existing forms default to <strong>File Input (Simple)</strong>. (<a href="https://github.com/verbb/formie/issues/133">#133</a>, <a href="https://github.com/verbb/formie/issues/2385">#2385</a>, <a href="https://github.com/verbb/formie/discussions/1692">Discussion #1692</a>)</li>
<li>Add per-field <strong>Asset Data Retention</strong> settings to File Upload fields, allowing uploaded assets to be deleted after a configured duration while the submission record is kept. (<a href="https://github.com/verbb/formie/issues/1715">#1715</a>)</li>
<li>Add unique-value, match-field, text-limit, number-limit, email-format, blocked-domain, options-limit, and file-upload validation message overrides on supported field types. (<a href="https://github.com/verbb/formie/issues/1475">#1475</a>)</li>
<li>Add existing and synced fields to <strong>Group</strong> fields from the form builder, so reusable field definitions can be placed inside independent group wrappers with namespaced handles. (<a href="https://github.com/verbb/formie/issues/2069">#2069</a>)</li>
<li>Add form group policies for allowed submission statuses, optional per-group field palettes, and new-form default profiles (stencil, templates, form defaults). Group policies inherit from global settings; allowed submission statuses are enforced at the group level. (<a href="https://github.com/verbb/formie/issues/2717">#2717</a>, <a href="https://github.com/verbb/formie/issues/2209">#2209</a>, <a href="https://github.com/verbb/formie/issues/863">#863</a>)</li>
<li>Add optional per-form reCAPTCHA <strong>Action</strong> and <strong>Minimum Score</strong> settings for score-based modes, inheriting global Spam Protection defaults when left blank. (<a href="https://github.com/verbb/formie/issues/2167">#2167</a>, <a href="https://github.com/verbb/formie/issues/2804">#2804</a>)</li>
<li>Add <strong>Settings → Synced Fields</strong> as a read-only audit page listing shared field definitions and the forms they appear on, with a <strong>View usage</strong> link from synced fields in the form builder. (<a href="https://github.com/verbb/formie/issues/2377">#2377</a>)</li>
<li>Add a configurable field palette for the form builder, with drag-and-drop group and field organisation, per-field enable/disable, and optional palette label overrides. Replaces the legacy <strong>Disabled Field Types</strong> settings checkboxes. (<a href="https://github.com/verbb/formie/issues/2209">#2209</a>)</li>
<li>Add synced-field support for stencils, preserving shared definition links when creating new forms from a stencil. (<a href="https://github.com/verbb/formie/issues/1677">#1677</a>, <a href="https://github.com/verbb/formie/issues/1734">#1734</a>)</li>
<li>Add stencil scopes so developers can ship starter forms in project config while content editors can create and manage their own stencils in the control panel. (<a href="https://github.com/verbb/formie/issues/2814">#2814</a>)</li>
<li>Add <strong>Form Groups</strong> for control panel organisation. (<a href="https://github.com/verbb/formie/issues/1039">#1039</a>, <a href="https://github.com/verbb/formie/issues/662">#662</a>)</li>
<li>Add a dedicated <strong>Settings → Defaults</strong> control panel page for form, field, and notification defaults. (<a href="https://github.com/verbb/formie/issues/863">#863</a>)</li>
<li>Show field handles in the form builder when the Craft user preference <strong>Show field handles in edit forms</strong> is enabled (admin users only), with a copy-to-clipboard control on hover. (<a href="https://github.com/verbb/formie/issues/2279">#2279</a>)</li>
<li>Show an <strong>Encrypted</strong> padlock badge on fields in the form builder when <strong>Enable Content Encryption</strong> is turned on. (<a href="https://github.com/verbb/formie/issues/2332">#2332</a>)</li>
<li>Add an optional <strong>Other</strong> choice for Radio fields, with a configurable label and free-text input on the front-end. (<a href="https://github.com/verbb/formie/issues/1875">#1875</a>)</li>
<li>Add password validation settings to the Password field: minimum length, and requirements for uppercase, lowercase, and special characters. (<a href="https://github.com/verbb/formie/issues/1880">#1880</a>)</li>
<li>Add a <strong>Unique User Email</strong> setting to Email Address fields, to reject email addresses already associated with a Craft user account. (<a href="https://github.com/verbb/formie/issues/1151">#1151</a>)</li>
<li>Add global <strong>Allowed domains</strong> email rules under <strong>Settings → Spam Protection → Email Rules</strong>. Allowlisted domains or full email addresses skip global blocked-domain and free-provider checks only; other spam screening still applies. (<a href="https://github.com/verbb/formie/issues/2335">#2335</a>)</li>
<li>Add <code>craft.formie.ref()</code> and <code>craft.formie.refField()</code> for building variable-picker-compatible reference tokens from Twig when overriding settings such as <code>submitActionMessage</code>. See <a href="https://verbb.io/craft-plugins/formie/docs/v4/developers/reference-tokens">Reference tokens</a>. (<a href="https://github.com/verbb/formie/issues/2838">#2838</a>)</li>
<li>Add <strong>Lock Field Settings</strong> and <strong>Editor Note</strong> on the field editor <strong>Advanced</strong> tab to help content authors protect important field configuration. Locking dims field settings until <strong>Unlock</strong> is clicked for the session; notes appear in the field editor banner. (<a href="https://github.com/verbb/formie/issues/1189">#1189</a>)</li>
<li>Add <strong>Field Error Announcement</strong> plugin setting (<strong>Settings → Forms</strong>) to control how front-end validation and submit errors are announced to screen readers (<code>polite</code>, <code>assertive</code>, or <code>off</code>). Live validation while typing always uses polite announcements. (<a href="https://github.com/verbb/formie/issues/2505">#2505</a>)</li>
<li>Add scoped <strong>Submission Limits</strong> per form: cap all submissions for a form (closes the form when reached), submissions per IP address, or submissions per logged-in user, over configurable periods. <a href="https://github.com/verbb/formie/discussions/1939">Discussion #1939</a></li>
<li>Add a <strong>Template</strong> default value source for Hidden fields using sandboxed Craft object templates. Resolved server-side on render and submit; posted values are ignored. <strong>Custom Value</strong> behaviour is unchanged. (<a href="https://github.com/verbb/formie/issues/2605">#2605</a>)</li>
<li>Add rich text editing for field <strong>Instructions</strong>, including Craft entry links with <code>target="_blank"</code>, configurable via <code>rich-text.json</code> under <code>fields.instructions</code>. Legacy plain-text and markdown instructions are normalized automatically without migration. (<a href="https://github.com/verbb/formie/issues/724">#724</a>)</li>
<li>Add Craft-style attribute maps and merge helpers for <code>setFieldSettings()</code> field overrides, including <code>mergeInputAttributes</code> and <code>mergeContainerAttributes</code>. (<a href="https://github.com/verbb/formie/issues/2510">#2510</a>)</li>
<li>Add a <strong>Note</strong> builder field for form-builder guidance with Tip, Warning, Info, and Error styles. (<a href="https://github.com/verbb/formie/issues/2498">#2498</a>)</li>
<li>Add a <strong>Rich Text</strong> cosmetic field for WYSIWYG content in the form builder, configurable via <code>rich-text.json</code> under <code>fields.content</code>. (<a href="https://github.com/verbb/formie/issues/1028">#1028</a>, <a href="https://github.com/verbb/formie/issues/1709">#1709</a>, <a href="https://github.com/verbb/formie/discussions/2070">Discussion #2070</a>, <a href="https://github.com/verbb/formie/discussions/772">Discussion #772</a>)</li>
<li>Add a syntax-highlighted HTML code editor for HTML cosmetic fields in the form builder, with project config via <code>html.json</code>. (<a href="https://github.com/verbb/formie/issues/2181">#2181</a>)</li>
<li>Add a <strong>Custom Field</strong> form-builder field backed by opt-in Craft field adapters. (<a href="https://github.com/verbb/formie/issues/2208">#2208</a>)</li>
<li>Add Google Maps field support to <strong>Custom Field</strong> fields. (<a href="https://github.com/verbb/formie/issues/625">#625</a>)</li>
<li>Add Maps field support to <strong>Custom Field</strong> fields. (<a href="https://github.com/verbb/formie/issues/626">#626</a>)</li>
<li>Add Craft Link field support to <strong>Custom Field</strong> fields, covering URL, email, phone and SMS link values. (<a href="https://github.com/verbb/formie/issues/718">#718</a>)</li>
<li>Add dynamic <strong>Option Source</strong> settings for Dropdown, Radio and Checkboxes, allowing options to be populated from predefined option sets and other structured sources. (<a href="https://github.com/verbb/formie/issues/2684">#2684</a>)</li>
<li>Add a <strong>Use Searchable Dropdown</strong> setting for Dropdown fields, element relation fields when <strong>Display type</strong> is <strong>Dropdown</strong>, and Recipients when shown as a dropdown. The front end loads Formie’s <code>combobox</code> browser module so users can filter predefined options. (<a href="https://github.com/verbb/formie/issues/960">#960</a>)</li>
<li>Add support for changing compatible field types in the form builder, initially limited to simple string-like fields such as Single-Line Text and Email Address. Existing submissions are not rewritten. (<a href="https://github.com/verbb/formie/discussions/2110">Discussion #2110</a>)</li>
<li>Add <strong>Settings → Fields → Field Builder</strong> policy settings for <strong>Allow Multi-Select Dropdowns</strong> and <strong>Allow Phone Country Selector</strong>. When disabled, the corresponding field settings are hidden in the form builder and forced off on existing fields. (<a href="https://github.com/verbb/formie/discussions/2484">Discussion #2484</a>, <a href="https://github.com/verbb/formie/discussions/2485">Discussion #2485</a>)</li>
<li>Add <strong>Date Range</strong> collection to Date/Time fields when <strong>Display Type</strong> is <strong>Calendar (Advanced)</strong>, using Flatpickr range mode to collect a start and end date/time. (<a href="https://github.com/verbb/formie/issues/2011">#2011</a>)</li>
<li>Add calendar date validation for Date/Time <strong>Text Inputs</strong> and <strong>Dropdowns</strong>, rejecting impossible dates (for example February 31), enforcing configured <strong>Min Date</strong> / <strong>Max Date</strong> settings on those display types, and surfacing validation errors on the offending sub-field. (<a href="https://github.com/verbb/formie/issues/1458">#1458</a>)</li>
<li>Add smart <strong>State / Province</strong> behaviour for Address fields, with <strong>Text</strong> or <strong>Dropdown when available</strong> input modes, country-dependent subdivision loading, dynamic labels (State, Province, Prefecture, and so on), optional hiding when unused, searchable dropdowns, and datalist suggestions for text fallback. (<a href="https://github.com/verbb/formie/issues/1416">#1416</a>)</li>
<li>Add table column reference support for Calculations fields with explicit row scope (<code>first</code>, <code>last</code>, <code>index</code>, <code>all</code>, <code>count</code>, custom row expressions). Table columns now appear in the Calculations variable picker, with row targeting configured in the variable settings popover. (<a href="https://github.com/verbb/formie/issues/1284">#1284</a>)</li>
<li>Add failed notification alert recipients by Craft user group and additional email addresses. (<a href="https://github.com/verbb/formie/issues/2226">#2226</a>)</li>
<li>Add per-rule validation message overrides via a <strong>Validation</strong> form builder tab and the <code>validationMessages</code> field setting, with legacy <code>errorMessage</code> values migrated to <code>validationMessages.required</code>. (<a href="https://github.com/verbb/formie/issues/1269">#1269</a>)</li>
<li>Track and display who created and last updated a form in the form builder Settings tab footer and as optional forms index columns. (<a href="https://github.com/verbb/formie/discussions/2342">Discussion #2342</a>)</li>
<li>Add an Autocomplete setting to single-line and multi-line text fields in the form builder Settings tab, with a searchable list of HTML autocomplete tokens. (<a href="https://github.com/verbb/formie/discussions/2764">Discussion #2764</a>)</li>
<li>Document using <code>{env:FORMIE_*}</code> environment variable tokens in notification recipient fields. (<a href="https://github.com/verbb/formie/issues/2676">#2676</a>)</li>
<li>Add a page setting to place the submit button at the end of the last field row. (<a href="https://github.com/verbb/formie/issues/2542">#2542</a>)</li>
<li>Add control panel submission field condition behaviour with plugin and per-form settings to follow, collapse, or ignore front-end field and page conditions when editing submissions. (<a href="https://github.com/verbb/formie/issues/2435">#2435</a>)</li>
<li>Add a default country setting for Google Places address auto-complete fields. (<a href="https://github.com/verbb/formie/issues/2721">#2721</a>)</li>
<li>Add a configurable maximum email attachment size, and validate notification attach assets in the form builder. (<a href="https://github.com/verbb/formie/issues/2697">#2697</a>)</li>
<li>Add group-scoped form and submission permissions using stable form group handles, with optional per-form dedicated permissions via a new <strong>Use Dedicated Permissions</strong> form setting. (<a href="https://github.com/verbb/formie/issues/1426">#1426</a>, <a href="https://github.com/verbb/formie/issues/1356">#1356</a>, <a href="https://github.com/verbb/formie/issues/2489">#2489</a>, <a href="https://github.com/verbb/formie/discussions/1696">Discussion #1696</a>)</li>
<li>Add built-in submission guards (honeypot, minimum submit time, replay protection) via a <code>RunSubmissionGuardsTask</code> screen-stage workflow task and <strong>Settings → Spam Protection</strong> controls.</li>
<li>Add suspicious text detection, maximum links screening, global submission throttling, and per-IP submission throttling under <strong>Settings → Spam Protection</strong>. (<a href="https://github.com/verbb/formie/discussions/1331">#1332</a>, <a href="https://github.com/verbb/formie/issues/1154">#1154</a>, <a href="https://github.com/verbb/formie/issues/1099">#1099</a>)</li>
<li>Add Theme setting for Friendly Captcha (light/dark/auto). (<a href="https://github.com/verbb/formie/issues/2907">#2907</a>)</li>
<li>Add extensible TipTap nodes, marks, toolbar controls, and constrained TextStyle definitions across Formie editing, previews, and PHP rendering, including opt-in font family, font size, text/background color, line height, and Small caps controls.</li>
<li>Add <code>csrfInput</code> render option to control Craft CSRF hidden input output (<code>true</code> default, <code>false</code> to omit, or an options array such as <code>{ async: true }</code> for statically cached pages). (<a href="https://github.com/verbb/formie/discussions/2121">#2121</a>)</li>
<li>Add <strong>Enable Multi-Page Forms</strong> plugin setting to disable multi-page forms in the form builder. When disabled, authors cannot add pages and existing multi-page forms cannot be saved until reduced to a single page. (<a href="https://github.com/verbb/formie/discussions/2483">#2483</a>)</li>
<li>Add a <strong>Last Edited By</strong> column to submission sources, tracking the Craft user who last saved a submission in the control panel. (<a href="https://github.com/verbb/formie/issues/1403">#1403</a>)</li>
<li>Add <code>allowedSubmitMethods</code> plugin setting to restrict form submission methods to Ajax only, page reload only, or both (<a href="https://github.com/verbb/formie/issues/1751">#1751</a>).</li>
<li>Redesign page <strong>Client Events</strong> with a dedicated <strong>Tracking</strong> tab, support for multiple named events per page, variable picker values, and server-resolved <code>clientEvents</code> payloads in Ajax submit responses (<a href="https://github.com/verbb/formie/issues/888">#888</a>).</li>
<li>Add submission PDF downloads from the control panel and via <code>craft.formie.generateSubmissionPdf()</code> / <code>craft.formie.getSubmissionPdfDownloadUrl()</code> (<a href="https://github.com/verbb/formie/issues/1213">#1213</a>, <a href="https://github.com/verbb/formie/discussions/1273">Discussion #1273</a>).</li>
<li>Add custom variable sources via <code>Variables::EVENT_REGISTER_VARIABLES</code>, exposing registered tokens in the variable picker and resolving them server-side when references are parsed. (<a href="https://github.com/verbb/formie/issues/898">#898</a>)</li>
<li>Add an <code>includeFlatpickrCss</code> plugin setting to disable Formie’s bundled Flatpickr stylesheet when your project already provides its own. (<a href="https://github.com/verbb/formie/issues/2341">#2341</a>)</li>
<li>Add conditional submission status rules in the form builder <strong>Settings → Submissions</strong> tab, evaluated on the front end during submission processing. (<a href="https://github.com/verbb/formie/issues/508">#508</a>)</li>
<li>Add conditional redirect rules under <strong>Behaviour → After Submit</strong>, with an optional <strong>Enable Redirect Rules</strong> toggle that overrides the default submit action when conditions match. (<a href="https://github.com/verbb/formie/issues/830">#830</a>)</li>
<li>Add a stock Form Preview slide-out in the form builder, rendering the current form with Formie’s default templates, CSS, and JavaScript. (<a href="https://github.com/verbb/formie/issues/370">#370</a>)</li>
<li>Add submission UID to the control panel submission sidebar and as an optional submissions index column. (<a href="https://github.com/verbb/formie/issues/2404">#2404</a>)</li>
<li>Add an opt-in setting to disable the submit button until the current page passes validation. (<a href="https://github.com/verbb/formie/issues/1514">#1514</a>)</li>
<li>Add Ajax-safe tab link state theme keys <code>tabLinkCurrent</code> and <code>tabLinkInactive</code>, with aliases for <code>pageTabLinkActive</code>, <code>pageTabLinkInactive</code>, and <code>pageInactive</code> (<a href="https://github.com/verbb/formie/issues/1279">#1279</a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Require Craft CMS 5 and PHP 8.2+.</li>
<li>Rebuild the form builder around React, schema-driven settings, and shared Plugin Kit components.</li>
<li>Replace the legacy bundled front-end theme/runtime with package-based browser and framework runtimes for server-rendered and client-rendered forms.</li>
<li>Route controller, managed client, GraphQL, draft, payment, notification, and integration processing through the staged submission workflow.</li>
<li>Move integration settings to PHP-defined schemas and front-end integration, captcha, address, payment, and field behavior to client modules.</li>
<li>Replace the Dropdown, Radio and Checkboxes option-table <strong>Disabled</strong> column with a row-menu <strong>Visible / Hidden / Disabled</strong> availability control (<a href="https://github.com/verbb/formie/issues/1816">#1816</a>). <strong>Hidden</strong> removes an option from the front-end form while preserving stored submission values and labels; <strong>Disabled</strong> renders the option with HTML <code>disabled</code> so it stays visible but cannot be selected. Legacy <code>disabled: true</code> option rows are treated as hidden. Non-default states are indicated in the options table with row background tints.</li>
<li>Rework multi-site propagation and translation to use each form’s <strong>source site</strong> (where it was created) instead of Craft’s global primary site. “Same language” and “Same site group” propagation modes now filter from the source site. Forms store a persisted <code>sourceSiteId</code>. (<a href="https://github.com/verbb/formie/issues/84">#84</a>)</li>
<li>Stop routing user-authored form content (labels, placeholders, messages, options) through the <code>formie</code> translation category. Form copy is output from the database after site overrides are merged; <code>formie.php</code> is for Formie-owned UI strings only (<a href="https://github.com/verbb/formie/issues/2907">#2907</a>).</li>
<li>Replace text-limit counter <code>{startTag}{num}{endTag}</code> translation strings with Craft plural syntax and wire translated counter copy on the front end. (<a href="https://github.com/verbb/formie/issues/2526">#2526</a>)</li>
<li>Stream CSV/text report exports row-by-row to disk for memory-safe large datasets (<a href="https://github.com/verbb/formie/issues/2497">#2497</a>).</li>
<li>Use stable field references and normalized field values across notifications, calculations, conditions, integrations, GraphQL, exports, and historical submission content.</li>
<li>Update phone number values sent to integrations to use <code>E164</code> format instead of international formatting. (<a href="https://github.com/verbb/formie/discussions/2731">Discussion #2731</a>)</li>
<li>Improve integration queue job descriptions and debug output with form context (<code>formId</code>, <code>formHandle</code>, <code>formTitle</code>). (<a href="https://github.com/verbb/formie/discussions/2172">#2172</a>)</li>
<li>OAuth integration redirect URIs now default to a Craft action URL instead of a site URL. Add an optional <strong>OAuth Redirect URI Override</strong> plugin setting. (<a href="https://github.com/verbb/formie/issues/1333">#1333</a>)</li>
<li>Store incomplete submissions and pending uploads in database-backed, tokenized records with expiry, capability checks, garbage collection, and idempotent payment replay handling.</li>
<li>Replace self-referential synced fields with shared definitions and per-form placements, and update stencils to use snapshot semantics and stable field-reference remapping.</li>
<li>Improve <strong>Submission Limits</strong> form settings UX (<strong>Apply Limit To</strong>, consolidated messaging) and clarify the distinction from global <strong>Submission Throttling</strong> abuse controls. Add <a href="https://verbb.io/craft-plugins/formie/docs/v4/forms/submission-limits">Submission Limits</a> author documentation. <a href="https://github.com/verbb/formie/discussions/1939">Discussion #1939</a></li>
<li>Improve HTML and Rich Text cosmetic field builder previews and control panel submission views to show rendered output instead of raw source where appropriate. (<a href="https://github.com/verbb/formie/issues/2182">#2182</a>)</li>
<li>Move Agree field checked/unchecked display labels to the Settings tab and clarify that submissions store a boolean; use <code>getFieldValueAsString()</code> for Yes/No-style output. (<a href="https://github.com/verbb/formie/issues/2288">#2288</a>)</li>
<li>Replace custom static-cache refresh snippets with built-in token refresh behavior and tighten anonymous route, CORS, file-upload, callback, and webhook handling.</li>
<li>Freeform 4/5 plugin migrations now process submissions in batches (default 100) to avoid memory exhaustion on large forms. Use <code>php craft formie/migrate/freeform4</code> (or <code>freeform5</code>) with <code>--batch-size</code>, <code>--submission-offset</code>, <code>--submission-limit</code>, <code>--submissions-only</code>, and <code>--skip-submissions</code> for large migrations. (<a href="https://github.com/verbb/formie/issues/2513">#2513</a>)</li>
<li>Improve default theme color contrast for WCAG 2.2 AA — darker error text, muted helper text, and border-only control styling with split border tokens (<a href="https://github.com/verbb/formie/issues/2475">#2475</a>).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed rate-limit bypass, CSRF, XSS, information disclosure, payment verification, XML injection, submission permission, and redirect URL vulnerabilities.</li>
<li>Fix file-upload security checks for MIME types, extensions, active content, and filename normalization.</li>
<li>Fix plugin uninstall via <code>project-config/apply</code> failing when Formie stencil project config is removed after the <code>formie_stencils</code> table has already been dropped. (<a href="https://github.com/verbb/formie/issues/1710">#1710</a>)</li>
<li>Fix plugin migrations failing on production when <code>allowAdminChanges</code> is disabled because migrations attempted to write plugin settings to project config. (<a href="https://github.com/verbb/formie/issues/2615">#2615</a>)</li>
<li>Fix captcha provider credentials saved in the control panel being wiped when project config syncs on deploy. Site-scoped captcha settings are now preserved across deployments. (<a href="https://github.com/verbb/formie/issues/2407">#2407</a>)</li>
<li>Fix Salesforce integrations failing after Craft 5 / Formie 3 upgrades when OAuth tokens were migrated without <code>instance_url</code>, by falling back to stored integration settings and backfilling token values. (<a href="https://github.com/verbb/formie/issues/2492">#2492</a>)</li>
<li>Fix Stripe payments failing with “Invalid email address” when <strong>Payment Receipt</strong> is enabled but the mapped receipt email resolves empty (for example legacy <code>{field.email}</code> tokens or <strong>User Email</strong> while logged out). (<a href="https://github.com/verbb/formie/issues/2262">#2262</a>)</li>
<li>Fix payment amount parsing for locale-formatted dynamic values (for example <code>1,234.56</code>, <code>1.750,00</code>, and <code>£750.00</code>) on both the server and in the browser payment modules. (<a href="https://github.com/verbb/formie/issues/2334">#2334</a>)</li>
<li>Fix payment follow-up states (such as 3D Secure authentication) showing as red validation errors. Action-required and pending payment responses now render as neutral form notices, and Ajax submit payloads include <code>paymentStatus</code>, <code>paymentMessage</code>, <code>paymentAction</code>, and <code>paymentDecision</code> metadata. (<a href="https://github.com/verbb/formie/issues/2660">#2660</a>)</li>
<li>Fix external redirect payments (for example Mollie) leaving users on the status polling page when payment fails. Failed payments now redirect back to the original form URL with a flash error message. (<a href="https://github.com/verbb/formie/issues/2502">#2502</a>)</li>
<li>Fix Stripe and other payment follow-up submits re-validating one-time captcha tokens (for example reCAPTCHA v2 checkbox and hCaptcha), which caused duplicate-token spam failures on the second Ajax POST. Incomplete continuation submits now skip captcha screening, matching replay-token behaviour. (<a href="https://github.com/verbb/formie/issues/2465">#2465</a>)</li>
<li>Fix Opayo, Stripe, Paddle, and GoCardless payment integrations not resolving <strong>Billing Details</strong> field mappings from the form builder static table, so Name and Address fields are included in payment payloads again. (<a href="https://github.com/verbb/formie/issues/2617">#2617</a>)</li>
<li>Fix OAuth integrations reporting a successful connection when their access token was not persisted. (<a href="https://github.com/verbb/formie/issues/2961">#2961</a>)</li>
<li>Fix Zoho picklist mappings sending option metadata IDs instead of their API values. (<a href="https://github.com/verbb/formie/issues/2959">#2959</a>)</li>
<li>Fix User element integration silently skipping group assignment when a configured group UID no longer resolves. (<a href="https://github.com/verbb/formie/issues/2909">#2909</a>)</li>
<li>Fix Group nested field values being ignored in submission title format tokens and Element/integration field mappings when the picker stored a child field reference. (<a href="https://github.com/verbb/formie/issues/2922">#2922</a>)</li>
<li>Fix queued integrations losing submit-time context (referrer, IP address, HubSpot/Pardot tracking cookies) by persisting request metadata on the submission at submit time and hydrating integration context from it in queue workers. (<a href="https://github.com/verbb/formie/issues/1379">#1379</a>)</li>
<li>Fix Salesforce integration refresh failing when an enabled object such as Opportunity or Case is unavailable in the connected org. (<a href="https://github.com/verbb/formie/issues/1551">#1551</a>)</li>
<li>Fix Marketo OAuth connect failing when an empty <code>scope</code> parameter is sent with the client-credentials grant, and normalize API domains that include a trailing <code>/rest</code> segment. (<a href="https://github.com/verbb/formie/issues/2718">#2718</a>)</li>
<li>Fix Mailchimp integrations not exposing or formatting <strong>Address</strong> merge fields, which prevented mapping Formie Address fields to Mailchimp audiences that require <code>ADDRESS</code> data. (<a href="https://github.com/verbb/formie/issues/2387">#2387</a>)</li>
<li>Improve Pardot integration errors when an account does not support API v4 (legacy Pardot Classic). (<a href="https://github.com/verbb/formie/issues/2642">#2642</a>)</li>
<li>Fix Upload Manager returning “Invalid file upload field” when a File Upload field is nested under a Group (and related nested content-key paths), and writing staged asset ids under the correct nested input names. (<a href="https://github.com/verbb/formie/issues/2948">#2948</a>)</li>
<li>Fix Recent Submissions widget breaking the control panel because <code>WidgetsVendorAsset</code> published from a <code>src/</code> path that is not shipped in the package (<a href="https://github.com/verbb/formie/issues/2939">#2939</a>).</li>
<li>Fix required File Upload fields using Upload Manager never passing client-side validation after a successful upload. (<a href="https://github.com/verbb/formie/issues/2924">#2924</a>)</li>
<li>Fix phone country dropdown flags not appearing on Craft Cloud. Flag sprites are inlined in the front-end bundle instead of loading from relative CSS asset paths. (<a href="https://github.com/verbb/formie/issues/2529">#2529</a>)</li>
<li>Fix file upload assets being deleted when trashing a submission with <strong>File Uploads → Delete files</strong> enabled, so restored submissions keep their uploaded files. (<a href="https://github.com/verbb/formie/discussions/1258">#1258</a>)</li>
<li>Skip notification email attachments when the asset file cannot be read, instead of failing the entire send. (<a href="https://github.com/verbb/formie/issues/2626">#2626</a>)</li>
<li>Fix file upload validation allowing extensions such as <code>.jfif</code> that Craft cannot save as assets. (<a href="https://github.com/verbb/formie/issues/2716">#2716</a>)</li>
<li>Fix File Upload fields failing on submit when no upload location is set, by requiring the setting in the form builder and falling back to the plugin default volume when configured. (<a href="https://github.com/verbb/formie/issues/2597">#2597</a>)</li>
<li>Fix Ajax and multi-page File Upload fields losing their uploaded-file summary after step navigation or when editing existing submissions. (<a href="https://github.com/verbb/formie/issues/2742">#2742</a>, <a href="https://github.com/verbb/formie/issues/1856">#1856</a>, <a href="https://github.com/verbb/formie/issues/1910">#1910</a>)</li>
<li>Fix File Upload fields inside Repeater or Group fields not initializing upload persistence for nested inputs. (<a href="https://github.com/verbb/formie/issues/1448">#1448</a>)</li>
<li>Fix ActiveCampaign Email marketing contact payloads sending blank unmapped properties (now <code>array_filter</code>’d like the CRM path). (<a href="https://github.com/verbb/formie/issues/2934">#2934</a>)</li>
<li>Fix status-change notifications never sending: the trigger compared <code>Submission::getStatus()</code> as a status model, but it returns the handle string. (<a href="https://github.com/verbb/formie/issues/2931">#2931</a>)</li>
<li>Fix control panel submission saves running visitor page-flow and new-submission semantics on <code>editExisting</code> requests, which blocked status-change notifications, flipped completed submissions to incomplete, and overwrote the selected status. (<a href="https://github.com/verbb/formie/issues/2932">#2932</a>)</li>
<li>Fix form import with <strong>Update existing form</strong> not removing notifications deleted before export. Empty <code>notifications</code> arrays in the import payload now replace the form’s notifications instead of being ignored. (<a href="https://github.com/verbb/formie/issues/1941">#1941</a>)</li>
<li>Fix notification email preview and send failing when both <strong>From Name</strong> and <strong>From Email</strong> are set. (<a href="https://github.com/verbb/formie/issues/2698">#2698</a>)</li>
<li>Fix Recipients fields preserving the selected option label when multiple recipient options send to the same email address, using encrypted row identity tokens while keeping recipient emails private in front-end markup. (<a href="https://github.com/verbb/formie/issues/2382">#2382</a>)</li>
<li>Fix option field values appearing empty in notification “All Form Fields” summaries when options were overridden via Twig <code>setFieldSettings()</code>, by applying persisted submission snapshots when loading forms for email/export and falling back to stored option values when labels cannot be resolved. (<a href="https://github.com/verbb/formie/issues/2350">#2350</a>)</li>
<li>Sanitize notification queue job debug data to valid UTF-8 before re-serializing failed jobs, preventing queue rows from becoming unreadable when submission content contains invalid byte sequences. (<a href="https://github.com/verbb/formie/issues/2344">#2344</a>)</li>
<li>Improve notification mailer failure logging when Craft returns no transport error message, including CLI/queue context to help diagnose cron-only send failures. (<a href="https://github.com/verbb/formie/issues/2610">#2610</a>)</li>
<li>Validate literal email addresses in notification recipient settings so invalid addresses are caught when saving notifications. (<a href="https://github.com/verbb/formie/issues/2712">#2712</a>)</li>
<li>Fix email notification preview failing when a recipient setting references a non-email field. (<a href="https://github.com/verbb/formie/issues/2537">#2537</a>)</li>
<li>Fix final submit validating only the current page when a later page is conditionally hidden — <code>isLastPage()</code> / <code>isFirstPage()</code> now accept the submission so they skip unreachable pages the same way as <code>getNextPage()</code>. (<a href="https://github.com/verbb/formie/issues/2927">#2927</a>)</li>
<li>Fix page (and other form-builder) conditions showing an empty Value dropdown for Submission Status by always supplying status select options. (<a href="https://github.com/verbb/formie/issues/2925">#2925</a>)</li>
<li>Fix CP submission edit (Follow field conditions) always hiding pages whose conditions use <code>{submission:*}</code> tokens — the client now evaluates those from a submission snapshot instead of treating them as missing fields. (<a href="https://github.com/verbb/formie/issues/2925">#2925</a>)</li>
<li>Fix headless/Ajax validation error messages using the wrong locale by applying the target site language at submission time (<a href="https://github.com/verbb/formie/issues/1545">#1545</a>).</li>
<li>Apply spam behaviour (success/message) without attempting to persist discarded spam submissions when <strong>Save spam submissions</strong> is disabled, avoiding failed saves under bot load. (<a href="https://github.com/verbb/formie/issues/2818">#2818</a>)</li>
<li>Fix page-reload single-line and multi-line text limit validation rerenders so field error styling, form-level error messages, and scroll/focus behaviour match ajax submissions. (<a href="https://github.com/verbb/formie/issues/1997">#1997</a>)</li>
<li>Fix Address and other fixed-parent sub-field settings being unavailable in the form builder by restoring on-demand field type config loading for nested sub-field types. (<a href="https://github.com/verbb/formie/issues/1416">#1416</a>)</li>
<li>Fix submission status filters in the control panel returning no results when submissions were saved without a persisted <code>statusId</code>, and resolve status queries by display name as well as handle. (<a href="https://github.com/verbb/formie/issues/2687">#2687</a>)</li>
<li>Fix form usage counts and the form builder Usage tab omitting entries on disabled Craft sites. (<a href="https://github.com/verbb/formie/issues/2612">#2612</a>)</li>
<li>Fix the form builder Usage tab not listing elements that reference a form on non-primary sites, including when Craft stores a relation without a specific <code>sourceSiteId</code>. (<a href="https://github.com/verbb/formie/issues/2695">#2695</a>)</li>
<li>Fix dropdown field options not saving in the form builder when no default option is selected. (<a href="https://github.com/verbb/formie/issues/2795">#2795</a>)</li>
<li>Fix replacing a deleted field with a new field using the same handle requiring a two-step save in the form builder. (<a href="https://github.com/verbb/formie/issues/1854">#1854</a>)</li>
<li>Fix missing page-list validation indicators in the form builder when a form has no pages. (<a href="https://github.com/verbb/formie/issues/2786">#2786</a>)</li>
<li>Keep field error live regions mounted without reserving empty layout space, honour the configured announcement priority, and associate definition-driven errors with their controls. (<a href="https://github.com/verbb/formie/issues/2954">#2954</a>)</li>
<li>Fix required Multi-line Text fields with Rich Text enabled being skipped by client-side validation — the backing <code>&lt;textarea&gt;</code> lives in a <code>display: none</code> wrapper, so visibility is now judged from the rich-text editor host instead. (<a href="https://github.com/verbb/formie/issues/2947">#2947</a>)</li>
<li>Fix field validation errors relying on <code>aria-errormessage</code> alone — also merge the error message id into <code>aria-describedby</code> (keeping any instruction ids) so assistive tech with weak <code>aria-errormessage</code> support still announces the error. (<a href="https://github.com/verbb/formie/issues/2946">#2946</a>)</li>
<li>Fix element-field variable tokens with a property selector resolving empty (e.g. <code>{field:&lt;ref&gt;:title}</code>). Unindexed selectors now resolve against related elements and join multi-value results. (<a href="https://github.com/verbb/formie/issues/2930">#2930</a>)</li>
<li>Fix rich text toolbars always showing only Bold/Italic — pass <code>buttons</code> / <code>linkOptions</code> to <code>pk-tiptap-editor</code> instead of the obsolete <code>*Attr</code> prop names so configured buttons reach the element. (<a href="https://github.com/verbb/formie/issues/2929">#2929</a>)</li>
<li>Fix submitting a filled Date/Time field throwing <code>Undefined property: DateFieldValue::$date</code> during validation when resolving nested <code>date</code>/<code>time</code> paths (including Date fields inside Group/Repeater). (<a href="https://github.com/verbb/formie/issues/2923">#2923</a>)</li>
<li>Fix date dropdown fields rejecting year-only values with “Year cannot be blank” when other date parts are disabled. Partial date parts are stored via <code>DateFieldValue</code> without requiring a full calendar date. (<a href="https://github.com/verbb/formie/issues/2261">#2261</a>)</li>
<li>Fix Google Maps API script conflicts when Address field autocomplete and the Google Maps Craft plugin are used on the same page. Formie reuses an existing <code>window.google</code> instance instead of injecting a second Maps script. (<a href="https://github.com/verbb/formie/issues/2041">#2041</a>)</li>
<li>Fix Phone field country selector labels not respecting the field’s <strong>Country Language</strong> setting. (<a href="https://github.com/verbb/formie/issues/2042">#2042</a>)</li>
<li>Fix required asterisk indicator not appearing on Agree fields when the field label is hidden and consent copy is shown on the checkbox label. (<a href="https://github.com/verbb/formie/issues/2333">#2333</a>)</li>
<li>Fix Summary field Ajax refreshes ignoring custom <code>themeConfig</code> classes by round-tripping render-time theme config through the summary HTML endpoint (<a href="https://github.com/verbb/formie/issues/1721">#1721</a>).</li>
<li>Skip client-side validation for fields disabled by conditional logic, and disable conditionally hidden submit buttons so Enter no longer triggers hidden submit/next actions. (<a href="https://github.com/verbb/formie/issues/2727">#2727</a>, <a href="https://github.com/verbb/formie/issues/1136">#1136</a>, <a href="https://github.com/verbb/formie/discussions/1628">Discussion #1628</a>)</li>
<li>Bound spam keyword scanning and spam log payloads so very large field values cannot stall PHP workers during spam handling. (<a href="https://github.com/verbb/formie/issues/2065">#2065</a>)</li>
<li>Fix Signature fields intermittently showing a misleading “browser does not support” message on multi-page forms, conditional fields, and late layout by retrying canvas sizing, watching visibility changes, and showing accurate status copy when initialization fails. (<a href="https://github.com/verbb/formie/issues/2708">#2708</a>)</li>
<li>Fix Dropdown, Radio and Checkboxes <strong>Disabled</strong> option availability not outputting HTML <code>disabled</code> on the front-end form. (<a href="https://github.com/verbb/formie/issues/1816">#1816</a>)</li>
<li>Prompt for confirmation when closing a field settings overlay with Escape (or backdrop/header close) only when the field has unsaved changes. Untouched new fields close immediately. (<a href="https://github.com/verbb/formie/issues/2219">#2219</a>)</li>
<li>Fix checkbox fields saving their default option values when explicitly unchecked on submit. (<a href="https://github.com/verbb/formie/issues/2457">#2457</a>)</li>
<li>Fix the Dutch translation mapping <code>Auto</code> to <code>Automatisch</code>, which incorrectly changed checkbox labels and values meaning “car”. (<a href="https://github.com/verbb/formie/issues/2636">#2636</a>)</li>
<li>Generate translatable date picker placeholders from the configured date and time formats when no custom placeholder is set. (<a href="https://github.com/verbb/formie/issues/2464">#2464</a>)</li>
<li>Initialise captcha placeholders immediately when multipage forms change page via tabs or Ajax <strong>Next</strong>, so Friendly Captcha and other providers mount on the visible page before submit. (<a href="https://github.com/verbb/formie/issues/1893">#1893</a>)</li>
<li>Tear down Cloudflare Turnstile widgets with <code>remove()</code> during remounts and apply CSP nonces to dynamically loaded captcha scripts where available, reducing console noise on strict CSP hosts. (<a href="https://github.com/verbb/formie/issues/2535">#2535</a>)</li>
<li>Wait for reCAPTCHA Enterprise readiness before executing score/policy challenges on multipage navigation. (<a href="https://github.com/verbb/formie/issues/2224">#2224</a>)</li>
<li>Fix redirect Entry selections on the Behaviour tab (and stencils) never persisting because save read <code>submitActionEntryId</code> instead of the posted <code>submitActionEntry</code> list. (<a href="https://github.com/verbb/formie/issues/2926">#2926</a>)</li>
<li>Fix rich-text links to internal pages opening in a new tab including <code>rel="noopener noreferrer nofollow"</code>. Internal links now omit the attribute; external links keep it. (<a href="https://github.com/verbb/formie/issues/2604">#2604</a>)</li>
<li>Fix submit button conditions not applying on the front end. (<a href="https://github.com/verbb/formie/issues/2568">#2568</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate legacy form render IDs, asset helpers, render options, runtime-named classes and JavaScript translation hooks in favor of the new render IDs, <code>formAssets()</code> / <code>frontendAssets()</code> helpers, client/frontend naming, and package-based runtimes.</li>
<li>Deprecate legacy HTML tag APIs in favor of slot tag APIs.</li>
<li>Deprecate JSON, variable, email, and legacy key field-value APIs in favor of array, reference, and reference-block APIs.</li>
<li>Deprecate legacy custom field schema, preview, and input-template APIs in favor of <code>defineFormBuilder*Schema()</code>, <code>defineFormBuilderPreviewSchema()</code>, and <code>getInputTemplatePath()</code>.</li>
<li>Deprecate legacy integration settings, front-end variables, payment processing, and submission dispatch helpers in favor of schema settings, client modules, and workflow services.</li>
<li>Deprecate legacy Formie DOM and validator events, GraphQL client-event setting names, refresh-token parameters, theme config keys, and schema config keys.</li>
<li>Deprecate the <code>PredefinedOptions</code> service and namespace in favor of <code>OptionSources</code> and the <code>verbb\formie\options\predefined</code> namespace.</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove the legacy <code>CustomElement</code> submission model, <code>FieldLegacy</code> trait, Formie 3 field <code>inputHtml()</code> fallback, and expired field <code>name</code> helpers.</li>
<li>Remove the old JavaScript form bus, built-in front-end bundle assumptions, and <code>getFrontEndJsVariables()</code> integration API.</li>
<li>Remove the Duplicate, JavaScript, and Honeypot captcha integrations and the Algolia address provider.</li>
<li>Remove file, Redis, Memcached, and session-backed submission progression; Formie 4 uses database-backed state and no longer exposes <code>submissionStateMode</code> or <code>submissionStore</code>.</li>
<li>Remove <code>enableGatsbyCompatibility</code> and direct <code>templateHtml</code> usage from the primary GraphQL rendering path.</li>
<li>Require GraphQL submission mutations to pass the applicable submission guards and a bootstrap <code>requestToken</code> for headless transports.</li>
</ul>
";s:4:"date";s:19:"2026-10-16T00:00:00";}i:8;a:4:{s:7:"version";s:6:"3.1.50";s:8:"critical";b:0;s:5:"notes";s:566:"<h3>Fixed</h3>
<ul>
<li>Fix plugin initialization failing on Craft versions before 5.10, preserving user submission deletion, reassignment and restoration. (<a href="https://github.com/verbb/formie/issues/3035">#3035</a>)</li>
<li>Fix custom CRM integrations failing to send submissions when field settings are omitted. (<a href="https://github.com/verbb/formie/issues/3033">#3033</a>)</li>
<li>Fix field variables in notification subjects appearing literally in PDF attachment filenames. (<a href="https://github.com/verbb/formie/issues/3025">#3025</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-22T00:00:00";}i:9;a:4:{s:7:"version";s:6:"3.1.49";s:8:"critical";b:0;s:5:"notes";s:888:"<h3>Changed</h3>
<ul>
<li>Update the minimum Auth requirement to <code>2.0.55</code>.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix Date/Time field variables rendering blank in email notification subjects and legacy whole-field variables rendering blank in subjects and content. (<a href="https://github.com/verbb/formie/issues/3015">#3015</a>)</li>
<li>Fix notification properties and submission site names being blocked by the Twig sandbox in PDF attachment filenames. (<a href="https://github.com/verbb/formie/issues/3018">#3018</a>)</li>
<li>Fix Pardot form handlers rejecting submissions with existing single-select mappings such as <code>country.value</code>, while retaining plain field names and separate multi-select values.</li>
<li>Fix SuiteCRM Contact fields not loading for field mapping with the V8 API. (<a href="https://github.com/verbb/formie/issues/3010">#3010</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-20T00:00:00";}i:10;a:4:{s:7:"version";s:6:"3.1.48";s:8:"critical";b:0;s:5:"notes";s:2746:"<h3>Changed</h3>
<ul>
<li>Updated user deletion handling to use Craft’s deletion blockers, with options to reassign, unassign, or delete related submissions.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed Craft emitting deprecation warnings while loading Formie fields.</li>
<li>Fix SugarCRM connections sending an invalid placeholder client secret, and allow custom OAuth client credentials. (<a href="https://github.com/verbb/formie/issues/2988">#2988</a>)</li>
<li>Fix non-form JSON files causing an error when reviewed for import. (<a href="https://github.com/verbb/formie/issues/3001">#3001</a>)</li>
<li>Fix long-running queue workers sending email notifications with settings cached from an earlier job. (<a href="https://github.com/verbb/formie/issues/2998">#2998</a>)</li>
<li>Fixed element integration mappings accepting unsupported query or element attributes.</li>
<li>Fixed element field option ordering accepting unsupported query expressions.</li>
<li>Fixed Entries and other element field handles rendering empty in email notification Twig, including query methods, length checks and numeric indexing. (<a href="https://github.com/verbb/formie/issues/2996">#2996</a>)</li>
<li>Fix logged-in user variables being blocked by the Twig sandbox in File Upload field subpaths.</li>
<li>Fix <code>{systemEmail}</code>, <code>{systemReplyTo}</code>, and <code>{systemName}</code> resolving to literal environment variable names in email notifications. (<a href="https://github.com/verbb/formie/issues/2997">#2997</a>)</li>
<li>Fixed form notification settings accepting changes without the corresponding form-builder permission.</li>
<li>Fixed control-panel lists and import summaries rendering untrusted values as markup.</li>
<li>Fixed support requests disabling TLS certificate verification.</li>
<li>Fixed provider secrets being included in reCAPTCHA request URLs.</li>
<li>Fixed Pardot prospect email values being interpolated into API paths without encoding.</li>
<li>Fix Pardot form handlers treating multiple checkbox and multi-select values as one combined option by sending each selected value as a separate parameter.</li>
<li>Fixed form duplication and form-builder metadata endpoints bypassing their corresponding permissions.</li>
<li>Fixed notification IDs being accepted when they belonged to another form.</li>
<li>Fixed submission bulk actions applying changes outside the current user's save permissions.</li>
<li>Fixed element-index requests accepting client-controlled form scopes for submissions and sent notifications.</li>
<li>Fixed notification editors being able to attach assets they are not permitted to view.</li>
<li>Fixed read-only submission viewers being offered subscription cancellation actions.</li>
</ul>
";s:4:"date";s:19:"2026-10-15T00:00:00";}i:11;a:4:{s:7:"version";s:6:"3.1.47";s:8:"critical";b:0;s:5:"notes";s:266:"<h3>Changed</h3>
<ul>
<li>Require Verbb Auth 2.0.50 or later for OAuth password-grant callback support.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix SugarCRM connections failing to authenticate. (<a href="https://github.com/verbb/formie/issues/2988">#2988</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-09T00:00:00";}i:12;a:4:{s:7:"version";s:6:"3.1.46";s:8:"critical";b:0;s:5:"notes";s:823:"<h3>Changed</h3>
<ul>
<li>Require Verbb Base 3.0.20 or later so shared control-panel layouts use the current asset bundle namespace. (<a href="https://github.com/verbb/verbb-base/issues/3">verbb-base#3</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix statically cached forms occasionally discarding valid submissions when Craft's asynchronous CSRF input races Formie's CAPTCHA token refresh. (<a href="https://github.com/verbb/formie/issues/2986">#2986</a>)</li>
<li>Fix composite field variables in notification email headers failing to render. (<a href="https://github.com/verbb/formie/issues/2985">#2985</a>)</li>
<li>Fix element field previews ignoring Specific Elements and other option settings after editing a field.</li>
<li>Fix conditionally hidden fields remaining visible when using custom field wrappers.</li>
</ul>
";s:4:"date";s:19:"2026-10-07T00:00:00";}i:13;a:4:{s:7:"version";s:6:"3.1.45";s:8:"critical";b:0;s:5:"notes";s:1375:"<h3>Changed</h3>
<ul>
<li>Updated the required version of <code>verbb/base</code> to 3.0.19.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix Payment field details missing from submission exports.</li>
<li>Fix Phone subfield variables causing notification email bodies to render empty. (<a href="https://github.com/verbb/formie/issues/2980">#2980</a>)</li>
<li>Fix Salesforce Client Credentials API requests failing after a successful connection. (<a href="https://github.com/verbb/formie/issues/2981">#2981</a>)</li>
<li>Fix queued integration jobs including cached provider metadata, and improve HubSpot submission performance for accounts with many forms.</li>
<li>Fix invalid HubSpot tracking-cookie values causing form submissions to be rejected.</li>
<li>Fix hidden labels remaining visible for element fields using Radio Buttons or Checkboxes display types. (<a href="https://github.com/verbb/formie/issues/2979">#2979</a>)</li>
<li>Fix text word and character limits disagreeing between browser and server validation for Unicode punctuation, emoji, and composed characters. (<a href="https://github.com/verbb/formie/issues/2977">#2977</a>)</li>
<li>Fix <code>{formName}</code>, <code>{formHandle}</code>, and <code>{siteHandle}</code> being blocked by the Twig sandbox in File Upload field subpaths. (<a href="https://github.com/verbb/formie/issues/2978">#2978</a>)</li>
</ul>
";s:4:"date";s:19:"2026-10-02T00:00:00";}i:14;a:4:{s:7:"version";s:6:"3.1.44";s:8:"critical";b:0;s:5:"notes";s:1979:"<h3>Added</h3>
<ul>
<li>Add Salesforce Client Credentials authentication with configurable My Domain support. (<a href="https://github.com/verbb/formie/issues/2961">#2961</a>)</li>
<li>Add the <code>allowLegacySignatureImageUrls</code> config setting to disable unsigned Signature image URLs for existing submissions.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Protect Signature image URLs for new submissions with field-scoped access tokens while preserving URLs in previously sent email notifications.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed a moderate-severity authorization vulnerability. (GHSA-q6g7-g2wg-h43h)</li>
<li>Fix field variables in notification email address settings resolving to rendered HTML when custom email templates are used. (<a href="https://github.com/verbb/formie/issues/2974">#2974</a>)</li>
<li>Fix OAuth integrations failing to connect after authorisation. (<a href="https://github.com/verbb/formie/issues/2973">#2973</a>)</li>
<li>Fixed OAuth callback transaction validation.</li>
<li>Fixed authorization for connecting and disconnecting OAuth integrations.</li>
<li>Fixed a moderate-severity information disclosure vulnerability. (GHSA-rh4q-6j5r-8jqf)</li>
<li>Fixed a moderate-severity authorization vulnerability. (GHSA-p696-447f-9258)</li>
<li>Fixed a moderate-severity authorization vulnerability. (GHSA-qg3f-hm4x-h5h8)</li>
<li>Fixed a moderate-severity information disclosure vulnerability. (GHSA-963f-vfpf-f85p)</li>
<li>Fix slow GraphQL schema creation and form rendering when integrations have large cached settings. (<a href="https://github.com/verbb/formie/issues/2972">#2972</a>)</li>
<li>Fix email notifications failing when their content references an empty optional field.</li>
<li>Fix email notifications failing when their content references a deleted field.</li>
<li>Fix PHP 8.4 deprecation warnings caused by implicitly nullable parameters and CSV parsing. (<a href="https://github.com/verbb/formie/issues/2970">#2970</a>)</li>
</ul>
";s:4:"date";s:19:"2026-09-30T00:00:00";}i:15;a:4:{s:7:"version";s:6:"3.1.43";s:8:"critical";b:0;s:5:"notes";s:660:"<h3>Fixed</h3>
<ul>
<li>Fixed a high-severity server-side request forgery vulnerability. (<a href="https://github.com/verbb/formie/security/advisories/GHSA-82jr-3xc8-86mr">GHSA-82jr-3xc8-86mr</a>)</li>
<li>Fix creating forms from legacy stencils containing temporary page, row, or field IDs.</li>
<li>Fix editing stencils when the Solspace Calendar event integration is installed.</li>
<li>Fix form redirect responses failing after the submission was saved. (<a href="https://github.com/verbb/formie/issues/2969">#2969</a>)</li>
<li>Fix form content fields being inaccessible in email notification variables after the Twig sandbox security changes.</li>
</ul>
";s:4:"date";s:19:"2026-09-24T00:00:00";}i:16;a:4:{s:7:"version";s:6:"3.1.42";s:8:"critical";b:0;s:5:"notes";s:1202:"<h3>Changed</h3>
<ul>
<li>Resolve redirect URL placeholders as strict submission, field and form tokens instead of executing Twig, while rendering remaining form-authored Twig and object templates in Base's explicit sandbox.</li>
<li>Require <code>verbb/base</code> 3.0.17 or later for the explicit sandbox renderers and collection safeguards.</li>
<li>Apply <code>EVENT_MODIFY_TWIG_ENVIRONMENT</code> permissions as additions to Twig sandbox defaults; broad <code>allowedClasses</code> permissions no longer apply to those renders.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed a high-severity server-side template injection vulnerability. (<a href="https://github.com/verbb/formie/security/advisories/GHSA-25q7-h5pg-6wjv">GHSA-25q7-h5pg-6wjv</a>)</li>
<li>Fixed a high-severity server-side template injection vulnerability. (<a href="https://github.com/verbb/formie/security/advisories/GHSA-3m2m-h2c6-gjwh">GHSA-3m2m-h2c6-gjwh</a>)</li>
<li>Fixed a high-severity server-side template injection vulnerability. (<a href="https://github.com/verbb/formie/security/advisories/GHSA-f55h-mf7f-7wx7">GHSA-f55h-mf7f-7wx7</a>)</li>
<li>Fixed a high-severity server-side template injection vulnerability.</li>
</ul>
";s:4:"date";s:19:"2026-09-23T00:00:00";}}s:13:"phpConstraint";s:4:"^8.2";s:11:"packageName";s:12:"verbb/formie";}s:22:"graphql-authentication";a:3:{s:6:"status";s:8:"eligible";s:8:"releases";a:0:{}s:11:"packageName";s:37:"jamesedmonston/graphql-authentication";}s:10:"lettermint";a:4:{s:6:"status";s:8:"eligible";s:8:"releases";a:1:{i:0;a:4:{s:7:"version";s:6:"v2.0.0";s:8:"critical";b:0;s:5:"notes";s:374:"<h3>Added</h3>
<ul>
<li>Test suite, coding standard and static analysis checks.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Use the official <a href="https://github.com/lettermint/symfony-mailer"><code>lettermint/symfony-mailer</code></a> transport instead of <code>somehow-digital/symfony-lettermint-mailer</code>.</li>
<li>Update the plugin icon and add an icon mask.</li>
</ul>
";s:4:"date";s:19:"2026-10-25T00:00:00";}}s:13:"phpConstraint";s:4:"^8.2";s:11:"packageName";s:32:"somehow-digital/craft-lettermint";}s:12:"phone-number";a:3:{s:6:"status";s:8:"eligible";s:8:"releases";a:0:{}s:11:"packageName";s:25:"rynpsc/craft-phone-number";}s:15:"craft-recaptcha";a:3:{s:6:"status";s:8:"eligible";s:8:"releases";a:0:{}s:11:"packageName";s:20:"c10d/craft-recaptcha";}}}i:1;N;}