• Added craft\web\twig\AllowableInSandbox.
• Fixed a bug where craft\helpers\App::parseEnv() wasn’t resolving aliases for environment variables that referenced an alias (e.g. @root/storage/rebrand). (#19108)
• Fixed a bug where the “Parent” field on Structure entries’ edit pages wasn’t showing the parent entry if it didn’t exist for the same site being edited, causing the parent relationship to be lost on save. (#19110)
• Fixed a high-severity RCE vulnerability.