• Improved keyboard control for Money fields. (#18198, #18212)
• User queries now always return active, non-pending users first, unless otherwise specified by orderBy. (#18148)
• The utils/fix-field-layout-uids command now checks for duplicate top-level field layout UUIDs. (#18193)
• Fixed a bug where all plugin settings were being saved to the project config, rather than just posted settings. (craftcms/commerce#4006)
• Fixed a bug where custom selects could be positioned incorrectly after the window was resized. (#18179)
• Fixed an error that could occur when logging a deprecation warning, if the backtrace contained any non-UTF-8-encoded strings. (#18218)
• Fixed a bug where it wasn’t possible to view assets if they had exactly 50 subfolders alongside them. (#18213)
• Fixed a bug where Matrix fields’ Entry Types settings were partially interactive when admin changes were disallowed. (#18145)
• Fixed a bug where users could be unable to sign in if an inactive user account existed with the same email address. (#18148)
• Fixed a bug where Content Block fields could appear to be missing their content when viewing a revision. (#18149)
• Fixed a bug where Dropdown and Radio Button fields weren’t handling :empty:/:notempty: element query params properly for options with blank values. (#18156)
• Fixed a bug where chip icons were getting rounded. (#18163)
• Fixed a bug where object templates that included another template were missing variables. (#18165)
• Fixed a JavaScript error that could occur if two control panel animations were triggered simultaneously.
• Fixed a bug where it wasn’t possible to copy/paste nested entries within Matrix fields set to the inline-editable blocks view mode, for unpublished owner elements. (#18185)
• Fixed a bug where custom fields’ checkboxes weren’t getting removed from field layouts’ “Card Attributes” lists when removed from the layout.
• Fixed a bug where consecutive hyphens (-) within Link fields’ “Class Name” values were getting removed. (#18201)
• Fixed an error that could occur when saving a recursively-nested element. (#18164)
• Fixed a bug where element indexes could show muliple table columns for the same field/label/handle combinations. (#18209)
• Fixed a bug where element indexes’ “View” menus could list some custom fields under “Attributes”. (#18221)
• Fixed SSRF vulnerabilities. (GHSA-96pq-hxpw-rgh8, GHSA-m5r2-8p9x-hp5m, GHSA-8jr8-7hr4-vhfx)
• Fixed an XSS vulnerability. (GHSA-7pr4-wx9w-mqwr)
• Fixed a SQL injection vulnerability. (GHSA-2453-mppf-46cj)
• Fixed an XSS vulnerability. (GHSA-9f5h-mmq6-2x78)
• Fixed a permission escalation vulnerability. (GHSA-fxp3-g6gw-4r4v)
• Fixed an RCE vulnerability. (GHSA-7jx7-3846-m7w7)