Skip to content
Tools
/
cms
/
Releases
CM
Release history
cms releases
The core Laravel CMS Composer package
Review required
v6.20.1
Bug fix
·
1d
Auth
Dependencies
Multiple fixes across UI, caching, auth, forms, assets
No immediate action
v5.73.24
Bug fix
·
1d
CSV escape + URL hardening + cache collision fix
Upgrade now
v6.20.0
Mixed
·
12d
Auth
RCE / SSRF
Date picker shortcut + Pro prompt + Nav fix
Upgrade now
v5.73.23
Security relevant
·
12d
Auth
RCE / SSRF
Token path traversal fix
No immediate action
v6.19.0
Bug fix
·
21d
Date time overflow fix
Review required
v6.18.1
Security relevant
·
23d
Remote URL hardening
Review required
v5.73.22
Security relevant
·
23d
Remote URL validation hardening
v6.18.0
Bug fix
·
26d
Notable features
Customizable crop ratios for images Add --preset option to `assets:generate-presets` command
What's new
Customizable crop ratios #14630 by @jackmcdade
Add --preset option to assets:generate-presets #14626 by @ryanmitchell
What's fixed
Fix CP login bouncing after Inertia auto-follow #14632 by @jasonvarga
Fix flaky TracksLastModified file timestamp test #14634 by @jasonvarga
Hide redundant 'This field' timezone row in date pickers #14635 by @jasonvarga
Simplify crop aspect ratio config formats #14633 by @jasonvarga
v6.17.0
New feature
·
26d
Notable features
Configurable timezone for date fields in the Control Panel `disabled` and `readOnly` props added to TimePicker component Timezones UI components introduced
What's new
Add configurable timezone for date fields in the Control Panel #14554 by @duncanmcclean
Add disabled and readOnly props to TimePicker component #14620 by @duncanmcclean
Add Timezones components #14612 by @jasonvarga
Allow overriding date format preset options #14600 by @jasonvarga
What's fixed
Dirty state fixes #14592 by @jackmcdade
Localize timezone tooltip in DatePicker #14596 by @jasonvarga
Fix asset browser actions inside selector stack #14565 by @duncanmcclean
Fix date-only formats shifting days due to timezone conversion #14552 by @duncanmcclean
Avoid rendering time for dates in listings when appropriate #14599 by @jasonvarga
Display timezone in DateRangePicker #14601 by @jasonvarga
Fix date-only index fieldtype shifting across timezones #14602 by @jasonvarga
Memoize preprocessed fields in Validator #14605 by @jasonvarga
Show date fieldtype when searching for range #14606 by @jasonvarga
Fix error when typing in a required date range field #14607 by @jasonvarga
Fix HoverCard arrow not displaying #14611 by @jasonvarga
Adjust translation method usage #14610 by @jasonvarga
Fix stale asset listings across queued jobs #14617 by @ryanmitchell
Fix replicator fields using wrong site context #14616 by @ryanmitchell
Fix read-only/disabled states in Radio component #14621 by @duncanmcclean
Lazy-load actions for collections, submissions & terms #14097 by @duncanmcclean
Fix dated entries not syncing with origin revisions #14216 by @duncanmcclean
Fix DateRangePicker crash when selecting first date in a range #13512 by @andrii-trush
Fix moving custom section to 1st position in CP Nav #12993 by @duncanmcclean
Fix read-only state in publish forms #14623 by @duncanmcclean
Fix perPage limit in relationship stack listings #14629 by @wiktorm12
Bump postcss from 8.5.9 to 8.5.13 #14595 by @dependabot
Bump axios from 1.15.0 to 1.16.0 #14613 by @dependabot
v6.16.0
Security relevant
·
1mo
Security fixes
Fix validation bypass via spoofed Precognition-Validate-Only header (#14557)
Notable features
Add strict null coalescence (??? ) support in Antlers parsing Add hooks to asset listings Show license key status in about and support:details commands
What's new
Add support for strict null coalescence (???) in Antlers parsing #14545 by @marcorieser
Add hooks to asset listings #14566 by @edalzell
Show license key status in about and support:details commands #14574 by @jasonvarga
Support icon sets in names #14579 by @jasonvarga
What's fixed
Fix Comb search index delete() rewriting JSON when ref absent #14550 by @SUXUMI
Include missing time chars in DateFormat::containsTime #14555 by @jasonvarga
Update setup-cp-vite to install Vite 8 #14559 by @jasonvarga
Fix cache invalidation when using custom fields in URI route #14564 by @duncanmcclean
Fix validation bypass via spoofed Precognition-Validate-Only header #14557 by @duncanmcclean
Restore selected site when resuming session #14562 by @duncanmcclean
Fix relationship selector footer not sticking to bottom of stack #14569 by @duncanmcclean
Fix asset selector drag-to-upload covering footer but not handling drops #14551 by @duncanmcclean
Field margin balance #14567 by @jaygeorge
Harden OrderBys #14572 by @jasonvarga
Fix Asset field set to "Read-only" clipping filename #14575 by @jackmcdade
Fix login redirects #14560 by @jasonvarga
Design a better empty, read-only state for asset fields #14578 by @jackmcdade
Avoid per-icon requests in the Icon storybook #14580 by @jasonvarga
Fix updater crash when addon has no license #14573 by @duncanmcclean
Lazy load Inertia page components #14582 by @jasonvarga
Fix LivePreview listener leak and simplify Grid row updates #14583 by @jasonvarga
Fix SavePipeline initial debounce delay #14586 by @jasonvarga
Debounce LinkFieldtype URL writes #14584 by @jasonvarga
Extract fieldtype update debounce to shared constant #14587 by @jasonvarga
Wrap FieldAction instances with markRaw #14589 by @jasonvarga
Color swatches get borders for contrast #14591 by @jackmcdade
Deduplicate RelationshipInput in-flight item-data requests #14590 by @jasonvarga
German translations #14561 by @helloDanuk
French translations #14585 by @ebeauchamps
v6.15.0
New feature
·
1mo
Notable features
Frontend Two-Factor Authentication Frontend Elevated Sessions Combobox 2.0
What's new
Frontend Elevated Sessions #14424 by @duncanmcclean
Frontend Two-Factor Authentication #14525 by @duncanmcclean
Add config for disabling Elevated Sessions #14464 by @1stevengrant
What's fixed
Better Collaboration Avatars #14511 by @jackmcdade
Fix addon settings blueprint cache collision with field settings blueprint #14509 by @duncanmcclean
Show dashed border in assets fieldtype when field is read-only #14507 by @duncanmcclean
Fix duplicate slugs allowed with depth-conditional routes #14508 by @duncanmcclean
Combobox 2.0 #13843 by @duncanmcclean
Persist active tab in URL hash on globals publish form #14515 by @duncanmcclean
Always display time zone in DatePicker #14518 by @jasonvarga
Fix blank page when visiting CP routes with invalid items #14517 by @jasonvarga
Improve rate limiting #14475 by @ryanmitchell
Hide default Statamic logo on frontend auth pages #14522 by @jasonvarga
Update currencies dictionary #14520 by @tdrayson
Allow extending asset preset generation command #14521 by @daun
Fix NavBuilder crash when nav item has an unresolved children Closure #14523 by @v-Woody
Fix Eloquent user merge setting roles and groups as model attributes #14526 by @duncanmcclean
Fix /!/nocache and /!/csrf CSRF exemption on Laravel 13 #14533 by @ynamite
Improve Link fieldtype in listings #14535 by @duncanmcclean
Fix TypeError when asset last_modified meta is null #14530 by @v-Woody
Fix Live Preview iframe becoming unscrollable after resizing in Chromium #14542 by @duncanmcclean
Fix CP auth error when using multiple user providers #14543 by @andjsch
Fix blank term edit screen and JS error for restricted users #14537 by @joshuablum
Fix durationForHumans deprecation warning and rounding #14541 by @duncanmcclean
Fix elevated session redirect for POST endpoints #14544 by @jasonvarga
Always show success when using forgot password form #14539 by @jasonvarga
Publish container tweaks #14548 by @jasonvarga
Fix updateChildPageUris empty check never short-circuiting #14547 by @duncanmcclean
French translations #14514 by @ebeauchamps
v5.73.21
Bug fix
·
1mo
Minor fixes and improvements.
What's fixed
Always show success when using forgot password form #14539 by @jasonvarga
v6.14.0
New feature
·
1mo
Adds collaboration support.
What's new
Fieldset sections #14297 by @jackmcdade
Collaboration support #13974 by @joshuablum
What's fixed
Use he-tree i18n prop for tree aria instructions #14499 by @jasonvarga
Rename Add Block back to Add Set in replicators #14503 by @joshuablum
Resolve Cascade content closure before checking content #14502 by @marcorieser
Fix nocache database driver failing on MySQL with invalid UTF-8 #14505 by @jasonvarga
Fix bard undos #14506 by @jackmcdade
Fix collection listing search case insensitivity #14486 by @joshuablum
Bump follow-redirects from 1.15.11 to 1.16.0 #14498 by @dependabot
Bump dompurify from 3.3.3 to 3.4.0 #14500 by @dependabot
v6.13.0
Mixed
·
1mo
Introduces Frontend Passkeys support for user authentication.
v5.73.20
Security relevant
·
1mo
Hardens query value resolution and OrderBy operations.
v6.12.0
New feature
·
1mo
⚠ Upgrade required
Internal build tooling has been upgraded to Vite 8 (#14459). Developers extending or customizing the CMS build pipeline should verify compatibility with Vite 8.
Notable features
Assets Tag now supports filtering conditions (#13936).
v6.11.0
Mixed
·
1mo
Added support for PathDataManager public properties, submission export filtering, and elevated session guards for AssignGroups and AssignRoles. Fixed Stache index re-entrancy, form submission types, Range fieldtype decimal support, and centralized SVG/CSS sanitization.
v5.73.19
Mixed
·
1mo
Added `link` tag to allowed Antlers tags and `@default` support to content allowlists. Fixed Stache index re-entrancy causing null URIs on cold initialization and form submission type handling.
v6.10.0
New feature
·
2mo
Notable features
Computed default values for fields Customizable filename replacements list Improved cache handling for nocache regions
v6.9.0
New feature
·
2mo
Security fixes
npm postinstall vulnerability prevention
Notable features
Text component asset.saved event emission whereStatus() on search query builder
v6.8.0
New feature
·
2mo
Notable features
GraphQL API Authentication Ability to disable two-factor authentication Date formatting locale selection
v6.7.3
Bug fix
·
2mo
Fixes header z-index issues, prevents SVG flickering, corrects Bard full-screen width, and updates French and German translations.
v5.73.17
Bug fix
·
2mo
Resolves term revisions error in the CMS.
v6.7.2
Security relevant
·
2mo
Security fixes
PHP sanitization edge cases Authorization on revision routes CSP header on svg route
v5.73.16
Security relevant
·
2mo
Security fixes
Antlers config access control Password reset form sanitization Markdown preview endpoint restriction
v6.7.1
Bug fix
·
2mo
Security fixes
URL::isExternalToApplication() hardening Password reset hardening
v5.73.15
Bug fix
·
2mo
Security fixes
Password reset hardening Additional URL validation tests
v6.7.0
New feature
·
2mo
Security fixes
SVG sanitization on reupload Path traversal prevention in file dictionary Term creation authorization checks
Notable features
Asset::moveUnique() method
v5.73.14
Security relevant
·
2mo
Security fixes
SVG sanitization on reupload Path traversal prevention in file dictionary Term creation authorization
v6.6.3
Bug fix
·
2mo
Security fixes
Relationship endpoint authorization Replicator fieldtype endpoint hardening
v5.73.13
Bug fix
·
2mo
Security fixes
Relationship endpoint authorization
v6.6.2
Bug fix
·
2mo
Corrects color mode preference values, adds proper styling class to outside layout, prevents Bard set deletion on non-backspace keys, and updates French translations.
v6.6.1
Bug fix
·
2mo
Adds Content Search string to translator, improves image preset readability, fixes Bard fieldtype variable reference, and updates tar dependency.
v6.6.0
New feature
·
2mo
Security fixes
Path traversal prevention Term creation authorization Command palette focus handling
Notable features
Image transparency checkerboard Asset listing filters Filter preset save/reset capability
v6.5.0
New feature
·
3mo
Notable features
Image cropping capability Laravel 13 support Stache query builder aggregation methods
v5.73.12
Bug fix
·
3mo
Fixes Antlers config backwards compatibility, parser state restoration, and adds Laravel Debugbar 4 support.
v6.4.1
Bug fix
·
3mo
Reverts Stache item caching during warming phase to prevent issues with concurrent operations.
v6.4.0
Breaking risk
·
3mo
Breaking changes
Antlers hardening: See PR #14092 for upgrade notes
Security fixes
Antlers hardening for code execution prevention SVG sanitization Authorization checks on redirects
Notable features
Floating toolbar keyboard shortcuts Disabled Button component prop Extra values through container and publish form
v5.73.11
Breaking risk
·
3mo
Breaking changes
Antlers hardening: See PR #14092 for upgrade notes
Security fixes
Antlers hardening External Glide URL validation Redirect hardening
v6.3.3
Bug fix
·
3mo
Security fixes
Password reset URL validation HTML rendering hardening
v5.73.10
Bug fix
·
3mo
Security fixes
Password reset URL validation HTML rendering hardening
v6.3.2
Bug fix
·
3mo
Security fixes
HTML fieldtype sanitization
v5.73.9
Bug fix
·
3mo
Security fixes
HTML fieldtype sanitization
v5.73.8
Bug fix
·
3mo
Fixes nocache region replacement, Icon fieldtype augmentation errors, and whereIn/whereNotIn query builder issues with boolean values.
v6.3.1
Bug fix
·
3mo
Fixed numerous UI and functionality issues across the control panel including field width settings, Bard editor interactions, dark mode rendering, and data filtering.
v6.3.0
New feature
·
3mo
Notable features
GraphQL introspection configuration Focal point editing inputs Dotted settings capability
v5.73.7
Bug fix
·
3mo
Reverted etag implementation due to compatibility issues.
v6.2.5
Bug fix
·
3mo
Fixed static caching configuration, improved component documentation and type hints, corrected navigation and asset handling, and updated translations.
v5.73.6
Bug fix
·
3mo
Fixed preference persistence issues, asset authentication, and custom field handling in entry URI updates.
v6.2.4
Bug fix
·
3mo
Fixed entry date shifting on save, entry publish permission errors, and starter kit installation with dev stability. Replaced uniqid with nanoid and switched from browser tests to storybook tests. Added Russian translations.
v6.2.3
Bug fix
·
3mo
Fixed an error during webauthn migration publishing; localized the time picker; added metadata storage for passkey last login; and escaped HTML in the command palette.
v6.2.2
Security relevant
·
3mo
Added authentication to asset routes to prevent unauthorized access to files.
v5.73.5
Security relevant
·
3mo
Added authentication requirement to asset routes to prevent unauthorized access to files.
v6.2.1
Bugfix
·
4mo
Fixed an error in the markdown fieldtype when no container is present.
v6.2.0
Mixed
·
4mo
Added collection tree in navigation, max width CP control, permissions check/uncheck buttons, Ctrl+k for bard link stack, and time field enhancements. Fixed asset selector padding, legacy format sets, nested bard toolbars, z-index for markdown/datepicker, and CarbonImmutable TypeError.
v5.73.4
Bug fix
·
4mo
Fixed issues with handling 0 values in text fields and null strings in slugs. Resolved invalidation of multi-site URLs in ApplicationCacher.
v5.73.3
Bug fix
·
4mo
Fixed an issue where a large number of assets would be provided in listing views and implemented an abort 404 error when an asset is not found in AssetsController.
v6.1.0
Mixed
·
4mo
Added a duration column to the asset browser, added search instructions for sets, and added mod+s shortcuts to save blueprint and collection order. Fixed errors in the Command Palette asset search, Date Fieldtype, and Replicators nested inside Grid/Group fields, and updated tar to 7.5.7.
v6.0.0
Mixed
·
4mo
Introduced a redesigned Control Panel with a UI Component library, Vue 3, Tailwind 4, and Inertia.js. Added Command Palette, Two-factor authentication, Passkeys, and REST API Authentication. Enhanced Antlers syntax, date/timezone support, and fieldtype support. Dropped support for Laravel 11 and PHP 8.2.
v5.73.2
Bug fix
·
4mo
Reverted visibility change to AssetContainer::accessible(), fixed 304 responses without client cache headers, resolved an uninitialized property error in HandleEntrySchedule job, updated lodash to 4.17.23, and prevented unnecessary Bard value updates when content has not changed.
v5.73.1
Bug fix
·
4mo
Reverted configuration values in forms to resolve issue #13632.
v5.73.0
Bug fix
·
4mo
Notable features
Config values can now be used in forms Closures are now supported in cascade content hydration
v5.72.0
Bug fix
·
4mo
Notable features
Query scopes are now supported in navigations (#13509)
v5.71.0
Mixed
·
4mo
Added PHP 8.5 compatibility and allowed retrieving raw arrays from Values objects. Fixed issues with collection structures, blueprint cache, field parents, and the eloquent:import-users command. Updated validator and qs dependencies and added French translations.
© 2026 releaseport. All rights reserved.
Feed
Tools
Feeds
Security
Brief
Search tools, categories, lists, and users
Use ↑↓ to navigate, Enter to open, Esc to close
No results for "
⌘K to open
↑↓ navigate
⏎ open
