5.9.21

• Fixed a bug where entries weren’t redirecting back to their section’s page’s URL by default.
• Fixed a bug where the resourceBasePath and resourceBaseUrl config settings weren’t being respected for console requests. (#18685)
• Fixed a bug where eager-loadable GraphQL fields could be populated with the wrong field’s results, if they followed a fragment with a *Interface type condition. (#18708)
• Fixed a bug where users with permission to edit entries, but not view peer entries in a section, weren’t allowed to edit the authors for entries in the section. (#18717)
• Fixed a bug where reference tags weren’t working with generated fields. (#18692)
• Fixed errors that could occur when applying project config changes. (#18720)
• Fixed a bug where it wasn’t always possible to sign into a user account that had the same email address as an inactive user. (#18723)
• Fixed a bug where relational fields’ element query results weren’t always limited to the selected relations if the id param was overridden. (#15570)
• Fixed an error that could occur when executing a queue job. (#18739)
• Fixed high-severity authorization bypass vulnerabilities. (GHSA-x5m4-g2cq-52pq, GHSA-3w32-23wj-rxg3, GHSA-qh45-9g5p-m2v4)
• Fixed moderate-severity permission escalation vulnerabilities. (GHSA-qq2c-2q8j-jh27, GHSA-43cq-c2gq-pfpw)

4.17.14

• Fixed high-severity authorization bypass vulnerabilities. (GHSA-3w32-23wj-rxg3, GHSA-qh45-9g5p-m2v4)

5.9.20

• Fixed an issue that prevented Craft from being installed. (#18700)
• Fixed a bug where nested element cards weren’t showing validation errors. (#18690)
• Fixed a bug where read-only Matrix fields in Index mode weren’t respecting the Default Table Columns setting. (#18684)
• Fixed a bug where nested entries could be lost when reverting content from a revision. (#18691)
• Fixed a bug where nested entries weren’t getting loaded when previewing a revision, if queried with eagerly(). (#18693)

4.17.13.1

• Fixed an issue that prevented Craft from being installed. (#18700)

5.9.19

• Most classes can now be instantiated via the create() Twig function. (#18376)
• Added craft\helpers\ProjectConfig::pathDepth().
• craft\services\Fields::deleteLayout() and deleteLayoutById() now have $hardDelete arguments.
• Deprecated craft\services\ProjectConfig::getPendingChangeSummary().
• Fixed a bug where element search query caches weren’t getting invalidated when elements’ search keywords were indexed. (#18275)
• Fixed a bug where disabled sites weren’t getting loaded when running Codeception tests. (#18638)
• Fixed a bug where custom entry index page icons weren’t getting stored properly if the source name contained periods. (#18631)
• Fixed a bug where copying nested entries on a revision wasn’t working. (#18648)
• Fixed a bug where Matrix fields in Blocks view could have “Duplicate selected blocks” and “Delete selected blocks” field-level actions. (#18652)
• Fixed a bug where the submit button within Live Preview was labelled “Save” rather than “Create entry” when editing an unpublished draft. (#18579)
• Fixed a bug where recent changes could be lost when creating an element or applying a draft, if there were validation errors. (#18657)
• Fixed a bug where nested elements would get soft-deleted after running the entrify/global-set command. (#18650)
• Fixed a bug where the “Max Authors” section setting was visible for Single sections.
• Fixed an exception that would be thrown when attempting to access undefined keys within craft\fields\data\JsonData objects from Twig. (#18656)
• Fixed a bug where address cards could be missing their address preview. (#18632)
• Fixed a bug where the Save button’s spinner wouldn’t appear right away when saving a nested element in a slideout. (#18664)
• Fixed a bug where the server check script wasn’t treating GD as a requirement. (craftcms/server-check#30)
• Fixed a bug where tooltips could be instantiated multiple times within Link fields. (#18666)
• Fixed a bug where localized nested element content could be overwritten when the owner element was propagated to a new site. (#18659)

4.17.13

• Most classes can now be instantiated via the create() Twig function. (#18376)
• Fixed a bug where element search query caches weren’t getting invalidated when elements’ search keywords were indexed. (#18275)

5.9.18

• Improved error logging when logging in with passkeys. (#18627)
• Added craft\controllers\ElementIndexesController::$fieldLayouts.
• craft\services\ElementSources::getTableAttributes() now has a $fieldLayouts argument.
• Fixed a bug where GraphQL results were getting cached even if they contained transform generation URLs. (#18581)
• Fixed a bug where aria-activedescendant, aria-flowto, and aria-owns attributes weren’t getting namespaced by {% namespace %} tags. (#18577)
• Fixed a bug where sites with missing enabled values were being treated as enabled. (#18572)
• Fixed a bug where GraphQL fields within fragments weren’t getting eager-loaded if the fragment’s type condition referenced an interface (e.g. on EntryInterface) rather than a specific type name. (#18588)
• Fixed a bug where relation fields were getting marked as translatable if they used a custom translation method, even if the rendered translation key was blank. (#18580)
• Fixed a bug where section and field chips in the “Used by” column of the Entry Types index page weren’t getting hyperlinked. (#18589)
• Fixed a bug where exceptions thrown when sending emails weren’t getting handled properly. (#18597)
• Fixed a bug where unordered lists weren’t getting styled correctly within Tip/Warning/Markdown field layout UI elements. (#18598)
• Fixed an error that could occur when upgrading to Craft 5. (#18576)
• Fixed a bug where nested Matrix entries’ Title fields were getting validation errors if blank, even if the nested entry was disabled. (#18611)
• Fixed an infinite recursion bug that could occur if the loginPath, logoutPath, setPasswordPath, or verifyEmailPath config settings were set to a callable that called the sites service. (#18605)
• Fixed a bug where Matrix fields in Index view mode could be missing custom field columns. (#18590)
• Fixed a JavaScript error that could occur when opening a modal. (#18612)
• Fixed a bug where element chips and cards weren’t getting refreshed when a provisional draft’s changes were discarded in a different tab.
• Fixed a bug where element attributes weren’t always updating when content changes were made.
• Fixed a bug where successive edits to nested elements were forgotten. (#18624)
• Fixed a bug where nested elements weren’t getting duplicated when a new site was added to the owner element. (#18621)
• Fixed a bug where nested entries were getting assigned new IDs if they were edited multiple times for the same owner element draft. (#18461)
• Fixed a SQL error that could occur when editing an element draft that had upstream changes. (#18626)
• Fixed a bug where custom sources’ labels weren’t being translated within the document title. (#18629)
• Fixed moderate-severity information disclosure vulnerabilities. (GHSA-gj2p-p9m4-c8gw, GHSA-33m5-hqp9-97pw)
• Fixed a moderate-severity RCE vulnerability. (GHSA-qrgm-p9w5-rrfw)

4.17.12

• Fixed a bug where GraphQL results were getting cached even if they contained transform generation URLs. (#18581)
• Fixed a bug where aria-activedescendant, aria-flowto, and aria-owns attributes weren’t getting namespaced by {% namespace %} tags. (#18577)
• Fixed a moderate-severity information disclosure vulnerability. (GHSA-gj2p-p9m4-c8gw)
• Fixed a moderate-severity RCE vulnerability. (GHSA-qrgm-p9w5-rrfw)

5.9.17

• Added craft\helpers\DateTimeHelper::testTimeToSeconds().
• Fixed an error that could occur after running the utils/fix-field-layout-uids command. (#18516)
• Fixed a JavaScript error that could occur if any field layout elements were configured with unsupported widths. (#18552)
• Fixed an error that could occur when user impersonation failed. (#18569)
• Fixed a bug where deeply-nested elements could be deleted unexpectedly. (#18537)
• Fixed a warning that was getting logged when using craft\filters\SiteFilterTrait.
• Fixed a bug where prefixing entry queries’ authorGroup params with and or not operators wasn’t working properly. (#18551)
• Fixed an error that could occur when running the gc command, if a Matrix field had been converted to an Addresses or Content Block field. (#18549)
• Fixed a styling issue. (#18566)
• Fixed a JavaScript error that could occur when Time fields’ Min/Max Time settings were set.

4.17.11

• Fixed an error that could occur after running the utils/fix-field-layout-uids command. (#18516)
• Fixed a JavaScript error that could occur if any field layout elements were configured with unsupported widths. (#18552)
• Fixed an error that could occur when user impersonation failed. (#18569)