• Improved the performance of loading project config data on PostgreSQL. (#19572)
• Added craft\helpers\StringHelper::containsNewlines().
• Added craft\services\ElementSources::CONTEXT_RESTRICTED_MODAL.
• Added craft\elements\db\EagerLoadPlan::$siteIds.
• Fixed a bug where nested Content Block fields’ content could be lost during a batched resave that included revisions. (#19543)
• Fixed a bug where Money and Number fields’ currency labels didn't line up with their inputs. (#19547)
• Fixed a bug where Structure entries’ “Parent” field could be populated with the parent entry from a different site than the one being edited. (#19576)
• Fixed a bug where the search input on the Users index page could be filled in automatically by LastPass. (#19584)
• Fixed a bug where public registration could fail when sending the activation email, if email verification wasn’t required but the password was deferred. (#19610)
• Fixed a bug where custom fields nested within Content Block fields weren’t editable from element indexes. (#19602)
• Fixed a bug where nested relational fields weren’t enforcing their “Validate related {type}” setting. (#19625)
• Fixed a bug where newly-created generated fields weren’t immediately available to card previews. (#19166)
• Fixed a high-severity SQL injection vulnerability. (GHSA-mjj9-pjh4-r48g)
• Fixed high-severity permission escalation vulnerabilities. (GHSA-r56r-f696-c8w9, GHSA-f6gf-r952-rxg6, GHSA-qcvp-ggx3-97r6)
• Fixed high-severity RCE vulnerabilities. (GHSA-qj3q-j7r4-428p, GHSA-9hp6-3565-gvh5)
• Fixed a high-severity information disclosure vulnerability. (GHSA-v4q3-2g5g-wjj6)
• Fixed a moderate-severity permission escalation vulnerability. (GHSA-v25r-wr32-jfg7)
• Fixed moderate-severity authorization bypass vulnerabilities. (GHSA-xpg7-m6gm-4xfh, GHSA-mp59-9rf5-93wr)
• Fixed a low-severity authorization bypass vulnerability. (GHSA-hvp5-pwxx-2752)
• Fixed a low-severity information disclosure vulnerability. (GHSA-5v62-pcq7-fxj9)