v3.93.0 (2026-11-04)
⚠️ Contains vital security updates. We encourage updating as soon as possible.
🚀 Features
🐛 Bug Fixes
- enforce block child read access in queries (21bdbbf)
- restrict blocks to each field's configured types (cfa60ea)
- enforce pasteURL restrictions on remote URL uploads (9071e58)
- apply xml response policy to xsl content (50d25f2)
- constrain global view redirects to available tenants (63a3a69)
- preserve shared localized draft changes (3.x backport of #17367) (#17394) (49b3c0b)
- resolve config labels before interpolating them into strings (#19209) (9c37160)
- prevent error in sendEmail due to empty from recepient (#18189) (aaea87b)
- delete the browser upload when a processed client upload replaces it for upload-thing storage (#19012) (8995c00)
- drizzle: lazily load drizzle kit tooling (3.x) (#17660) (d89c7c8)
- next: clamp description param on og endpoint (a56cc64)
- richtext-lexical: escape stored values in HTML converters (bed603f)
- ui: translate document drawer labels (3.x) (#19154) (b4e131c)
- ui: prevent duplicate autosaves from virtual field updates (#19096) (ef1bb73)
- ui: translate the collection label in the create new card button (3.x) (#19116) (04ec212)
⚙️ CI
- skip content api tests for audit deps PRs (3.x) (#19300) (59c52a7)
- port audit-dependencies action to 3.x (#19118) (8bbd52e)
🤝 Contributors
- Patrik (@PatrikKozak)
- Jarrod Flesch (@JarrodMFlesch)
- Sasha (@r1tsuu)
- Alessio Gravili (@AlessioGr)
- Elliot DeNolf (@denolfe)
- German Jablonski (@GermanJablo)
- Jessica Rynkar (@JessRynkar)
- Nate Lentz (@nathanlentz)
- Jake Fletcher (@jacobsfletch)