Added
- Add a dedicated Spam Protection area with grouped navigation in Craft’s standard sidebar, matching page and panel headings, standard header Save buttons, separate provider and spam-rule permissions, and independent provider saves.
- Add sanitised installation, permissions and integration diagnostics to support bundles, with guidance to send requests from the affected environment.
- Add Salesforce token-request logging with the endpoint and grant type, excluding OAuth credentials.
Changed
- Clarify user permission labels, order spam rules before CAPTCHA and spam filtering services, remove permission info tooltips, align permission nesting with Formie’s navigation while retaining a single Select All control, limit settings permissions to production-accessible tools, and migrate legacy grants to preserve production access.
- Store CAPTCHA, spam filtering and spam-rule settings locally on each installation. Existing values are preserved during upgrade; these settings are no longer deployed through project config.
- Clarify project and instance settings for integrations, stencils, spam protection and captcha providers, including deployment and editing permissions.
- Remove the informational Widget Mode field from Cloudflare Turnstile settings.
Fixed
- Fix “Scroll To Top” having no effect after successful AJAX submissions. (#3023)
- Fix production settings navigation hiding permitted read-only pages and scheduled reports exposing unavailable editing controls.
- Fix form import, report export and scheduled report permissions depending on unrelated management permissions.
- Fix upgrading from Formie 2 failing on Date fields before form statuses have been migrated.
- Fix upgrading from Formie 2 failing on Payment fields before integration scopes have been migrated.
- Fix later migrations failing after an interrupted field-table rename, and report when missing field definitions require restoring a backup.
- Fix an error when upgrading from Formie 3 with an empty or invalid default date. (#3022)
- Fix the Settings page redirecting repeatedly when admin changes are disabled.
- Fix legacy Honeypot settings preventing forms from being created or saved, including from stencils.
- Fix project config sync overwriting or removing instance-level integrations, stencils and spam protection settings.
- Fix notification and submission properties rendering empty or being blocked by the Twig sandbox in PDF attachment filenames. (#3018)
- Fix the Defaults settings page failing to load when custom field positions use non-sequential keys. (#3017)
- Fix Date fields using Calendar (Simple) rendering text inputs instead of native date and time pickers. (#3014)
- Fix reCAPTCHA v3 failing when its script is already loaded without the configured site key.
- Fix reCAPTCHA v3 inline badges rendering outside the form. (#3016)
- Fix slow submission and sent notification indexes in the control panel on sites with many forms.
- Fix encryption warning icons appearing on a separate line from their text.
- Fix custom rendering documentation using removed methods and omitting validation markup and spam-protection inputs.