• Updated logout routes to require CSRF-protected POST requests. (#19252)
• Updated Control Panel configuration serialization to use Illuminate\Support\Js::from(). (#19252)
• Updated the project testing guidelines to emphasize behavior-focused tests. (#19252)
• Updated queue connection retry windows to exceed Craft’s maximum job timeout. (#19252)
• Updated core queue jobs to resolve their dependencies through Laravel’s service container. (#19252)
• Updated automatic garbage collection to run as a unique queue job. (#19252)
• Updated two-factor authentication recovery codes to be encrypted at rest. (#19252)
• Improved field reference cleanup performance. (#19252)
• Improved numeric element reference resolution performance. (#19252)
• Improved element merge performance by avoiding per-relation and per-structure queries. (#19252)
• Improved search indexing memory use when indexing many elements. (#19252)
• Improved asset indexing performance when finding missing and empty folders. (#19252)
• Prevented duplicate image transform jobs from being queued for the same transform. (#19252)
• Removed duplicate Control Panel icon alias registrations. (#19252)
• Fixed a bug where GraphQL asset mutations weren’t executing HTTP requests for remote asset URLs. (#19252)
• Fixed a bug where failed relation writes could leave partial relation changes persisted. (#19252)
• Fixed a bug where element merge replacement jobs could be dispatched before their database transaction was committed. (#19252)
• Fixed a bug where section project-config jobs could be dispatched before their database transaction was committed. (#19252)
• Fixed a bug where passkey login attempts weren’t rate limited. (#19252)
• Fixed a bug where relation localization could not be retried safely after a failed run. (#19252)
• Fixed a bug where project config mutex cleanup could release a lock owned by another process. (#19252)
• Fixed a bug where nested structure operations could release their mutex lock before the outer operation completed. (#19252)
• Fixed a bug where two-factor authentication verification attempts weren’t rate limited. (#19252)
• Fixed a bug where user photo uploads could exceed the configured maximum upload size. (#19252)
• Fixed a bug where unsafe filenames could be used for Craft support attachments. (#19252)
• Fixed a bug where a failed legacy field type migration could leave project config events muted. (#19252)
• Fixed a bug where TemplateGlobals were being resolved every time a Blade component rendered. (#19257)
• Fixed a bug where Craft updates could fail with a 503 response when the action URL contained query parameters.