• Added a new page explorer menu built with the admin API and React (Karl Hobley, Josh Barr, Thibaud Colas, Janneke Janssen, Rob Moorman, Maurice Bartnig, Jonny Scholes, Matt Westcott, Sævar Öfjörð Magnússon, Eirikur Ingi Magnusson, Harris Lapiroff, Hugo van den Berg, Olly Willans, Andy Babic, Ben Enright, Bertrand Bordage)
• Added privacy settings for documents (Ulrich Wagner, Matt Westcott)
• Optimised page URL generation by caching site paths in the request scope (Tobias McNulty, Matt Westcott)
• The current live version of a page is now tracked on the revision listing view (Matheus Bratfisch)
• Each block created in a StreamField is now assigned a globally unique identifier (Matt Westcott)
• Mixcloud oEmbed pattern has been updated (Alice Rose)
• Added last_published_at field to the Page model (Matt Westcott)
• Added show_in_menus_default flag on page models, to allow "show in menus" to be checked by default (LB (Ben Johnston))
• "Copy page" form now validates against copying to a destination where the user does not have permission (Henk-Jan van Hasselaar)
• Allows reverse relations in RelatedFields for elasticsearch & PostgreSQL search backends (Lucas Moeskops, Bertrand Bordage)
• Added oEmbed support for Facebook (Mikalai Radchuk)
• Added oEmbed support for Tumblr (Mikalai Radchuk)
• Fix: Unauthenticated AJAX requests to admin views now return 403 rather than redirecting to the login page (Karl Hobley)
• Fix: TableBlock options afterChange, afterCreateCol, afterCreateRow, afterRemoveCol, afterRemoveRow and contextMenu can now be overridden (Loic Teixeira)
• Fix: The lastmod field returned by wagtailsitemaps now shows the last published date rather than the date of the last draft edit (Matt Westcott)
• Fix: Document chooser upload form no longer renders container elements for hidden fields (Jeffrey Chau)
• Fix: Prevented exception when visiting a preview URL without initiating the preview (Paul Kamp)